Function report

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\auditsc.c Create Date:2022-07-28 11:27:04
Last Modify:2020-03-17 16:31:21 Copyright©Brick
home page Tree
Annotation kernel can get tool activityDownload SCCTChinese

Name:Given an audit_name check the inode hash table to see if they match.* Called holding the rcu read lock to protect the use of audit_inode_hash

Proto:static int audit_filter_inode_name(struct task_struct *tsk, struct audit_names *n, struct audit_context *ctx)

Type:int

Parameter:

TypeParameterName
struct task_struct *tsk
struct audit_names *n
struct audit_context *ctx
811  h = audit_hash_ino((u32)ino)
812  list = Hash for inode-based rules [h]
817  If audit_in_mask( & rule, syscall number ) && Compare a task_struct with an audit_rule. Return 1 on match, 0* otherwise.* If task_creation is true, this is an explicit indication that we are* filtering a task rule at task creation time. This and tsk == current are Then
819  current_state = state
820  Return 1
823  Return 0
Caller
NameDescribe
audit_filter_inodesAt syscall exit time, this filter is called if any audit_names have been* collected during syscall processing. We only check rules in sublists at hash* buckets applicable to the inode numbers in audit_names.