Lines Matching defs:watch
44 * audit_krule holds a reference to its associated watch.
111 void audit_get_watch(struct audit_watch *watch)
113 atomic_inc(&watch->count);
116 void audit_put_watch(struct audit_watch *watch)
118 if (atomic_dec_and_test(&watch->count)) {
119 WARN_ON(watch->parent);
120 WARN_ON(!list_empty(&watch->rules));
121 kfree(watch->path);
122 kfree(watch);
126 void audit_remove_watch(struct audit_watch *watch)
128 list_del(&watch->wlist);
129 audit_put_parent(watch->parent);
130 watch->parent = NULL;
131 audit_put_watch(watch); /* match initial get */
134 char *audit_watch_path(struct audit_watch *watch)
136 return watch->path;
139 int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
141 return (watch->ino != (unsigned long)-1) &&
142 (watch->ino == ino) &&
143 (watch->dev == dev);
146 /* Initialize a parent watch entry. */
170 /* Initialize a watch entry. */
173 struct audit_watch *watch;
175 watch = kzalloc(sizeof(*watch), GFP_KERNEL);
176 if (unlikely(!watch))
179 INIT_LIST_HEAD(&watch->rules);
180 atomic_set(&watch->count, 1);
181 watch->path = path;
182 watch->dev = (dev_t)-1;
183 watch->ino = (unsigned long)-1;
185 return watch;
188 /* Translate a watch string to kernel respresentation. */
191 struct audit_watch *watch;
199 krule->inode_f || krule->watch || krule->tree)
202 watch = audit_init_watch(path);
203 if (IS_ERR(watch))
204 return PTR_ERR(watch);
206 audit_get_watch(watch);
207 krule->watch = watch;
212 /* Duplicate the given audit watch. The new watch's rules list is initialized
277 * are on so we need a new watch for the new list */
281 audit_panic("error updating watch, skipping");
296 audit_panic("error updating watch, removing");
301 * nentry->rule.watch == oentry->rule.watch so
303 * new watch.
305 audit_put_watch(nentry->rule.watch);
307 nentry->rule.watch = nwatch;
320 goto add_watch_to_parent; /* event applies to a single watch */
390 /* Release resources used for watch path information. */
408 struct audit_watch *w, *watch = krule->watch;
414 if (strcmp(watch->path, w->path))
419 /* put krule's and initial refs to temporary watch */
420 audit_put_watch(watch);
421 audit_put_watch(watch);
424 krule->watch = watch = w;
430 watch->parent = parent;
432 list_add(&watch->wlist, &parent->watches);
434 list_add(&krule->rlist, &watch->rules);
437 /* Find a matching watch entry, or add this one.
441 struct audit_watch *watch = krule->watch;
449 ret = audit_get_nd(watch->path, &ndp, &ndw);
458 /* update watch filter fields */
460 watch->dev = ndw->path.dentry->d_inode->i_sb->s_dev;
461 watch->ino = ndw->path.dentry->d_inode->i_ino;
479 h = audit_hash_ino((u32)watch->ino);
489 struct audit_watch *watch = krule->watch;
490 struct audit_parent *parent = watch->parent;
494 if (list_empty(&watch->rules)) {
495 audit_remove_watch(watch);
513 /* Update watch data in audit rules based on fsnotify events. */