Function report

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\audit.c Create Date:2022-07-28 11:22:33
Last Modify:2020-03-12 14:18:49 Copyright©Brick
home page Tree
Annotation kernel can get tool activityDownload SCCTChinese

Name:auditd_send_unicast_skb - Send a record via unicast to auditd*@skb: audit record* Description:* Send a skb to the audit daemon, returns positive/zero values on success and* negative values on failure; in all cases the skb will be consumed by this

Proto:static int auditd_send_unicast_skb(struct sk_buff *skb)

Type:int

Parameter:

TypeParameterName
struct sk_buff *skb
666  _read_lock() - mark the beginning of an RCU read-side critical section* When synchronize_rcu() is invoked on one CPU while other CPUs* are within RCU read-side critical sections, then the* synchronize_rcu() is guaranteed to block until after all the other
667  ac = fetch RCU-protected pointer for dereferencing(struct auditd_connection - kernel/auditd connection state*@pid: auditd PID*@portid: netlink portid*@net: the associated network namespace*@rcu: RCU head* Description:* This struct is RCU protected; you must either hold the RCU lock for reading)
668  If Not ac Then
669  _read_unlock() - marks the end of an RCU read-side critical section.* In most situations, rcu_read_unlock() is immune from deadlock.* However, in kernels built with CONFIG_RCU_BOOST, rcu_read_unlock()
670  free an sk_buff
671  rc = -ECONNREFUSED
672  Go to err
674  net = get_net(net)
675  sk = audit_get_sk - Return the audit socket for the given network namespace*@net: the destination network namespace* Description:* Returns the sock pointer if valid, NULL otherwise. The caller must ensure
676  portid = portid
677  _read_unlock() - marks the end of an RCU read-side critical section.* In most situations, rcu_read_unlock() is immune from deadlock.* However, in kernels built with CONFIG_RCU_BOOST, rcu_read_unlock()
679  rc = netlink_unicast(sk, skb, portid, 0)
680  put_net(net)
681  If rc < 0 Then Go to err
684  Return rc
686  err :
687  If ac && rc == -ECONNREFUSED Then auditd_reset - Disconnect the auditd connection*@ac: auditd connection state* Description:* Break the auditd/kauditd connection and move all the queued records into the* hold queue in case auditd reconnects
689  Return rc
Caller
NameDescribe
audit_replace