audit_mark 268 kernel/audit.h extern void audit_remove_mark(struct audit_fsnotify_mark *audit_mark); audit_mark 41 kernel/audit_fsnotify.c static void audit_fsnotify_mark_free(struct audit_fsnotify_mark *audit_mark) audit_mark 43 kernel/audit_fsnotify.c kfree(audit_mark->path); audit_mark 44 kernel/audit_fsnotify.c kfree(audit_mark); audit_mark 49 kernel/audit_fsnotify.c struct audit_fsnotify_mark *audit_mark; audit_mark 51 kernel/audit_fsnotify.c audit_mark = container_of(mark, struct audit_fsnotify_mark, mark); audit_mark 52 kernel/audit_fsnotify.c audit_fsnotify_mark_free(audit_mark); audit_mark 67 kernel/audit_fsnotify.c static void audit_update_mark(struct audit_fsnotify_mark *audit_mark, audit_mark 70 kernel/audit_fsnotify.c audit_mark->dev = inode ? inode->i_sb->s_dev : AUDIT_DEV_UNSET; audit_mark 71 kernel/audit_fsnotify.c audit_mark->ino = inode ? inode->i_ino : AUDIT_INO_UNSET; audit_mark 76 kernel/audit_fsnotify.c struct audit_fsnotify_mark *audit_mark; audit_mark 91 kernel/audit_fsnotify.c audit_mark = kzalloc(sizeof(*audit_mark), GFP_KERNEL); audit_mark 92 kernel/audit_fsnotify.c if (unlikely(!audit_mark)) { audit_mark 93 kernel/audit_fsnotify.c audit_mark = ERR_PTR(-ENOMEM); audit_mark 97 kernel/audit_fsnotify.c fsnotify_init_mark(&audit_mark->mark, audit_fsnotify_group); audit_mark 98 kernel/audit_fsnotify.c audit_mark->mark.mask = AUDIT_FS_EVENTS; audit_mark 99 kernel/audit_fsnotify.c audit_mark->path = pathname; audit_mark 100 kernel/audit_fsnotify.c audit_update_mark(audit_mark, dentry->d_inode); audit_mark 101 kernel/audit_fsnotify.c audit_mark->rule = krule; audit_mark 103 kernel/audit_fsnotify.c ret = fsnotify_add_inode_mark(&audit_mark->mark, inode, true); audit_mark 105 kernel/audit_fsnotify.c fsnotify_put_mark(&audit_mark->mark); audit_mark 106 kernel/audit_fsnotify.c audit_mark = ERR_PTR(ret); audit_mark 111 kernel/audit_fsnotify.c return audit_mark; audit_mark 114 kernel/audit_fsnotify.c static void audit_mark_log_rule_change(struct audit_fsnotify_mark *audit_mark, char *op) audit_mark 117 kernel/audit_fsnotify.c struct audit_krule *rule = audit_mark->rule; audit_mark 126 kernel/audit_fsnotify.c audit_log_untrustedstring(ab, audit_mark->path); audit_mark 132 kernel/audit_fsnotify.c void audit_remove_mark(struct audit_fsnotify_mark *audit_mark) audit_mark 134 kernel/audit_fsnotify.c fsnotify_destroy_mark(&audit_mark->mark, audit_fsnotify_group); audit_mark 135 kernel/audit_fsnotify.c fsnotify_put_mark(&audit_mark->mark); audit_mark 145 kernel/audit_fsnotify.c static void audit_autoremove_mark_rule(struct audit_fsnotify_mark *audit_mark) audit_mark 147 kernel/audit_fsnotify.c struct audit_krule *rule = audit_mark->rule; audit_mark 150 kernel/audit_fsnotify.c audit_mark_log_rule_change(audit_mark, "autoremove_rule"); audit_mark 162 kernel/audit_fsnotify.c struct audit_fsnotify_mark *audit_mark; audit_mark 165 kernel/audit_fsnotify.c audit_mark = container_of(inode_mark, struct audit_fsnotify_mark, mark); audit_mark 182 kernel/audit_fsnotify.c if (audit_compare_dname_path(dname, audit_mark->path, AUDIT_NAME_FULL)) audit_mark 184 kernel/audit_fsnotify.c audit_update_mark(audit_mark, inode); audit_mark 186 kernel/audit_fsnotify.c audit_autoremove_mark_rule(audit_mark); audit_mark 168 kernel/audit_tree.c return audit_mark(mark)->chunk; audit_mark 173 kernel/audit_tree.c kmem_cache_free(audit_tree_mark_cachep, audit_mark(mark)); audit_mark 288 kernel/audit_tree.c audit_mark(mark)->chunk = chunk; audit_mark 524 kernel/audit_watch.c struct audit_fsnotify_mark *audit_mark; audit_mark 531 kernel/audit_watch.c audit_mark = audit_alloc_mark(new, pathname, strlen(pathname)); audit_mark 532 kernel/audit_watch.c if (IS_ERR(audit_mark)) { audit_mark 534 kernel/audit_watch.c return PTR_ERR(audit_mark); audit_mark 536 kernel/audit_watch.c new->exe = audit_mark; audit_mark 450 kernel/auditfilter.c struct audit_fsnotify_mark *audit_mark; audit_mark 584 kernel/auditfilter.c audit_mark = audit_alloc_mark(&entry->rule, str, f_val); audit_mark 585 kernel/auditfilter.c if (IS_ERR(audit_mark)) { audit_mark 587 kernel/auditfilter.c err = PTR_ERR(audit_mark); audit_mark 591 kernel/auditfilter.c entry->rule.exe = audit_mark;