Lines Matching refs:rule
465 struct audit_krule *rule, in audit_filter_rules() argument
476 if (ctx && rule->prio <= ctx->prio) in audit_filter_rules()
481 for (i = 0; i < rule->field_count; i++) { in audit_filter_rules()
482 struct audit_field *f = &rule->fields[i]; in audit_filter_rules()
500 result = audit_exe_compare(tsk, rule->exe); in audit_filter_rules()
634 result = audit_watch_compare(rule->watch, in audit_filter_rules()
643 result = match_tree_refs(ctx, rule->tree); in audit_filter_rules()
757 if (rule->filterkey) { in audit_filter_rules()
759 ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC); in audit_filter_rules()
761 ctx->prio = rule->prio; in audit_filter_rules()
763 switch (rule->action) { in audit_filter_rules()
785 if (audit_filter_rules(tsk, &e->rule, NULL, NULL, in audit_filter_task()
788 *key = kstrdup(e->rule.filterkey, GFP_ATOMIC); in audit_filter_task()
797 static int audit_in_mask(const struct audit_krule *rule, unsigned long val) in audit_in_mask() argument
810 return rule->mask[word] & bit; in audit_in_mask()
837 if (audit_in_mask(&e->rule, op) && in __audit_filter_op()
838 audit_filter_rules(tsk, &e->rule, ctx, name, in __audit_filter_op()
2305 for (i = 0; i < e->rule.field_count; i++) { in __audit_inode()
2306 struct audit_field *f = &e->rule.fields[i]; in __audit_inode()
2311 && e->rule.action == AUDIT_NEVER) { in __audit_inode()
2423 for (i = 0; i < e->rule.field_count; i++) { in __audit_inode_child()
2424 struct audit_field *f = &e->rule.fields[i]; in __audit_inode_child()
2429 && e->rule.action == AUDIT_NEVER) { in __audit_inode_child()