117 	struct audit_entry *entry;  in audit_init_entry()  local
120 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);  in audit_init_entry()
121 	if (unlikely(!entry))  in audit_init_entry()
126 		kfree(entry);  in audit_init_entry()
129 	entry->rule.fields = fields;  in audit_init_entry()
131 	return entry;  in audit_init_entry()
219 static int audit_match_signal(struct audit_entry *entry)  in audit_match_signal()  argument
221 	struct audit_field *arch = entry->rule.arch_f;  in audit_match_signal()
227 					       entry->rule.mask) &&  in audit_match_signal()
229 					       entry->rule.mask));  in audit_match_signal()
235 					       entry->rule.mask));  in audit_match_signal()
238 					       entry->rule.mask));  in audit_match_signal()
249 	struct audit_entry *entry;  in audit_to_entry_common()  local
278 	entry = audit_init_entry(rule->field_count);  in audit_to_entry_common()
279 	if (!entry)  in audit_to_entry_common()
282 	entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;  in audit_to_entry_common()
283 	entry->rule.listnr = listnr;  in audit_to_entry_common()
284 	entry->rule.action = rule->action;  in audit_to_entry_common()
285 	entry->rule.field_count = rule->field_count;  in audit_to_entry_common()
288 		entry->rule.mask[i] = rule->mask[i];  in audit_to_entry_common()
292 		__u32 *p = &entry->rule.mask[AUDIT_WORD(bit)];  in audit_to_entry_common()
302 				entry->rule.mask[j] |= class[j];  in audit_to_entry_common()
306 	return entry;  in audit_to_entry_common()
333 static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)  in audit_field_valid()  argument
337 		if (entry->rule.listnr != AUDIT_FILTER_TYPE &&  in audit_field_valid()
338 		    entry->rule.listnr != AUDIT_FILTER_USER)  in audit_field_valid()
417 	struct audit_entry *entry;  in audit_data_to_entry()  local
423 	entry = audit_to_entry_common(data);  in audit_data_to_entry()
424 	if (IS_ERR(entry))  in audit_data_to_entry()
429 		struct audit_field *f = &entry->rule.fields[i];  in audit_data_to_entry()
444 			entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;  in audit_data_to_entry()
447 		err = audit_field_valid(entry, f);  in audit_data_to_entry()
473 			entry->rule.arch_f = f;  in audit_data_to_entry()
488 			entry->rule.buflen += f->val;  in audit_data_to_entry()
509 			entry->rule.buflen += f->val;  in audit_data_to_entry()
511 			err = audit_to_watch(&entry->rule, str, f->val, f->op);  in audit_data_to_entry()
521 			entry->rule.buflen += f->val;  in audit_data_to_entry()
523 			err = audit_make_tree(&entry->rule, str, f->op);  in audit_data_to_entry()
529 			err = audit_to_inode(&entry->rule, f);  in audit_data_to_entry()
534 			if (entry->rule.filterkey || f->val > AUDIT_MAX_KEY_LEN)  in audit_data_to_entry()
539 			entry->rule.buflen += f->val;  in audit_data_to_entry()
540 			entry->rule.filterkey = str;  in audit_data_to_entry()
545 	if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)  in audit_data_to_entry()
546 		entry->rule.inode_f = NULL;  in audit_data_to_entry()
549 	return entry;  in audit_data_to_entry()
552 	if (entry->rule.watch)  in audit_data_to_entry()
553 		audit_put_watch(entry->rule.watch); /* matches initial get */  in audit_data_to_entry()
554 	if (entry->rule.tree)  in audit_data_to_entry()
555 		audit_put_tree(entry->rule.tree); /* that's the temporary one */  in audit_data_to_entry()
556 	audit_free_rule(entry);  in audit_data_to_entry()
750 	struct audit_entry *entry;  in audit_dupe_rule()  local
755 	entry = audit_init_entry(fcount);  in audit_dupe_rule()
756 	if (unlikely(!entry))  in audit_dupe_rule()
759 	new = &entry->rule;  in audit_dupe_rule()
806 			audit_free_rule(entry);  in audit_dupe_rule()
816 	return entry;  in audit_dupe_rule()
821 static struct audit_entry *audit_find_rule(struct audit_entry *entry,  in audit_find_rule()  argument
828 	if (entry->rule.inode_f) {  in audit_find_rule()
829 		h = audit_hash_ino(entry->rule.inode_f->val);  in audit_find_rule()
831 	} else if (entry->rule.watch) {  in audit_find_rule()
836 				if (!audit_compare_rule(&entry->rule, &e->rule)) {  in audit_find_rule()
843 		*p = list = &audit_filter_list[entry->rule.listnr];  in audit_find_rule()
847 		if (!audit_compare_rule(&entry->rule, &e->rule)) {  in audit_find_rule()
860 static inline int audit_add_rule(struct audit_entry *entry)  in audit_add_rule()  argument
863 	struct audit_watch *watch = entry->rule.watch;  in audit_add_rule()
864 	struct audit_tree *tree = entry->rule.tree;  in audit_add_rule()
871 	if (entry->rule.listnr == AUDIT_FILTER_USER ||  in audit_add_rule()
872 		entry->rule.listnr == AUDIT_FILTER_TYPE)  in audit_add_rule()
877 	e = audit_find_rule(entry, &list);  in audit_add_rule()
889 		err = audit_add_watch(&entry->rule, &list);  in audit_add_rule()
902 		err = audit_add_tree_rule(&entry->rule);  in audit_add_rule()
909 	entry->rule.prio = ~0ULL;  in audit_add_rule()
910 	if (entry->rule.listnr == AUDIT_FILTER_EXIT) {  in audit_add_rule()
911 		if (entry->rule.flags & AUDIT_FILTER_PREPEND)  in audit_add_rule()
912 			entry->rule.prio = ++prio_high;  in audit_add_rule()
914 			entry->rule.prio = --prio_low;  in audit_add_rule()
917 	if (entry->rule.flags & AUDIT_FILTER_PREPEND) {  in audit_add_rule()
918 		list_add(&entry->rule.list,  in audit_add_rule()
919 			 &audit_rules_list[entry->rule.listnr]);  in audit_add_rule()
920 		list_add_rcu(&entry->list, list);  in audit_add_rule()
921 		entry->rule.flags &= ~AUDIT_FILTER_PREPEND;  in audit_add_rule()
923 		list_add_tail(&entry->rule.list,  in audit_add_rule()
924 			      &audit_rules_list[entry->rule.listnr]);  in audit_add_rule()
925 		list_add_tail_rcu(&entry->list, list);  in audit_add_rule()
931 	if (!audit_match_signal(entry))  in audit_add_rule()
945 static inline int audit_del_rule(struct audit_entry *entry)  in audit_del_rule()  argument
948 	struct audit_watch *watch = entry->rule.watch;  in audit_del_rule()
949 	struct audit_tree *tree = entry->rule.tree;  in audit_del_rule()
956 	if (entry->rule.listnr == AUDIT_FILTER_USER ||  in audit_del_rule()
957 		entry->rule.listnr == AUDIT_FILTER_TYPE)  in audit_del_rule()
962 	e = audit_find_rule(entry, &list);  in audit_del_rule()
983 	if (!audit_match_signal(entry))  in audit_del_rule()
1060 	struct audit_entry *entry;  in audit_rule_change()  local
1062 	entry = audit_data_to_entry(data, datasz);  in audit_rule_change()
1063 	if (IS_ERR(entry))  in audit_rule_change()
1064 		return PTR_ERR(entry);  in audit_rule_change()
1068 		err = audit_add_rule(entry);  in audit_rule_change()
1069 		audit_log_rule_change("add_rule", &entry->rule, !err);  in audit_rule_change()
1072 		err = audit_del_rule(entry);  in audit_rule_change()
1073 		audit_log_rule_change("remove_rule", &entry->rule, !err);  in audit_rule_change()
1081 		audit_free_rule(entry);  in audit_rule_change()
1365 	struct audit_entry *entry = container_of(r, struct audit_entry, rule);  in update_lsm_rule()  local
1380 		list_del_rcu(&entry->list);  in update_lsm_rule()
1385 		list_replace_rcu(&entry->list, &nentry->list);  in update_lsm_rule()
1388 	call_rcu(&entry->rcu, audit_free_rule_rcu);  in update_lsm_rule()