Function report

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\audit_watch.c Create Date:2022-07-28 11:29:17
Last Modify:2020-03-17 17:15:07 Copyright©Brick
home page Tree
Annotation kernel can get tool activityDownload SCCTChinese

Name:Find a matching watch entry, or add this one.* Caller must hold audit_filter_mutex.

Proto:int audit_add_watch(struct audit_krule *krule, struct list_head **list)

Type:int

Parameter:

TypeParameterName
struct audit_krule *krule
struct list_head **list
403  watch = associated watch
406  ret = 0
413  audit_get_watch(watch)
415  mutex_unlock - release the mutex*@lock: the mutex to be released* Unlock a mutex that has been locked by this task previously.* This function must not be used in interrupt context. Unlocking* of a not locked mutex is not allowed.
418  ret = Get path information necessary for adding watches.
421  mutex_lock( & audit_filter_mutex)
423  If ret Then
424  audit_put_watch(watch)
425  Return ret
429  parent = Find and return the audit_parent on the given inode. If found a reference* is taken on this parent.
430  If Not parent Then
431  parent = Initialize a parent watch entry.
432  If IS_ERR(parent) Then
433  ret = PTR_ERR(parent)
434  Go to error
438  Associate the given rule with an existing parent.* Caller must hold audit_filter_mutex.
440  h = audit_hash_ino((u32)associated inode number )
441  list = Hash for inode-based rules [h]
442  error :
443  path_put( & parent_path)
444  audit_put_watch(watch)
445  Return ret
Caller
NameDescribe
audit_add_ruleAdd rule to given filterlist if not a duplicate.