函数逻辑报告

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\audit_fsnotify.c Create Date:2022-07-27 12:33:11
Last Modify:2020-03-17 18:09:23 Copyright©Brick
首页 函数Tree
注解内核,赢得工具下载SCCTEnglish

函数名称：audit_remove_mark

函数原型：void audit_remove_mark(struct audit_fsnotify_mark *audit_mark)

返回类型：void

参数：

类型参数名称
struct audit_fsnotify_mark *audit_mark
134  fsnotify_destroy_mark( & snotify mark on the inode , snotify handle. )
135  fsnotify_put_mark( & snotify mark on the inode )
调用者
名称描述
audit_data_to_entryTranslate struct audit_rule_data to kernel's rule representation.
audit_dupe_ruleDuplicate an audit rule. This will be a deep copy with the exception* of the watch - that pointer is carried over. The LSM specific fields* will be updated in the copy. The point is to be able to replace the old
audit_rule_changeaudit_rule_change - apply all rules to the specified message type*@type: audit message type*@seq: netlink audit message sequence (serial) number*@data: payload data*@datasz: size of payload data
update_lsm_rule
audit_update_watchUpdate inode info in audit rules based on filesystem event.
audit_remove_parent_watchesRemove all watches & rules associated with a parent that is going away.
audit_remove_mark_rule
kill_rules