Function report

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\audit.c Create Date:2022-07-28 11:23:33
Last Modify:2020-03-12 14:18:49 Copyright©Brick
home page Tree
Annotation kernel can get tool activityDownload SCCTChinese

Name:audit_log_start - obtain an audit buffer*@ctx: audit_context (may be NULL)*@gfp_mask: type of allocation*@type: audit message type* Returns audit_buffer pointer on success or NULL on error

Proto:struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type)

Type:struct audit_buffer

Parameter:

TypeParameterName
struct audit_context *ctx
gfp_tgfp_mask
inttype
1751  serial = serial
1753  If audit_initialized != AUDIT_INITIALIZED Then Return NULL
1756  If Value for the false possibility is greater at compile time(!audit_filter(type, Apply rule before record creation )) Then Return NULL
1766  If Not (auditd_test_task - Check to see if a given task is an audit daemon*@task: the task to check* Description:* Return 1 if the task is a registered audit daemon, 0 otherwise. || audit_ctl_owner_current - Test to see if the current task owns the lock* Description:* Return true if the current task owns the audit control lock, false if it* doesn't own the lock.) Then
1767  stime = audit_backlog_wait_time
1769  When Number of outstanding audit_buffers allowed.* When set to zero, this means unlimited. && skb_queue_len - get queue length*@list_: list to measure* Return the length of an &sk_buff queue. > Number of outstanding audit_buffers allowed.* When set to zero, this means unlimited. cycle
1772  wake_up_interruptible( & kauditd_wait)
1776  If gfpflags_allow_blocking(gfp_mask) && stime > 0 Then
1784  Else
1795  ab = audit_buffer_alloc(ctx, gfp_mask, type)
1796  If Not ab Then
1797  audit_log_lost - conditionally log lost audit message event*@message: the message stating reason for lost audit message* Emit at least 1 message per second, even if audit_rate_check is* throttling.* Always increment the lost messages counter.
1798  Return NULL
1801  audit_get_stamp(NULL or associated context , & t, & serial)
1802  audit_log_format - format a message into the audit buffer.*@ab: audit_buffer*@fmt: format string*@...: optional parameters matching @fmt string* All the work is done in audit_log_vformat.
1805  Return ab
Caller
NameDescribe
audit_log_config_change
audit_log_common_recv_msg
audit_log_feature_change
audit_log_path_deniedaudit_log_path_denied - report a path restriction denial*@type: audit message type (AUDIT_ANOM_LINK, AUDIT_ANOM_CREAT, etc)*@operation: specific operation name
audit_log_set_loginuid
audit_logaudit_log - Log an audit record*@ctx: audit context*@gfp_mask: type of allocation*@type: audit message type*@fmt: format string to use*@...: variable parameters matching the format string* This is a convenience function that calls audit_log_start,
audit_log_rule_changeLog rule additions and removals
audit_log_pid_context
audit_log_execve_info
show_special
audit_log_nameaudit_log_name - produce AUDIT_PATH record from struct audit_names*@context: audit_context for the task*@n: audit_names structure with reportable details*@path: optional path to report instead of audit_names->name*@record_num: record number to report when
audit_log_proctitle
audit_log_exit
audit_core_dumpsaudit_core_dumps - record information about processes that end abnormally*@signr: signal value* If a process ends with a core dump, something fishy is going on and we* should record the event for investigation.
audit_seccompaudit_seccomp - record information about a seccomp action*@syscall: syscall number*@signr: signal value*@code: the seccomp action* Record the information associated with a seccomp action. Event filtering for
audit_seccomp_actions_logged
audit_watch_log_rule_change
audit_mark_log_rule_change
audit_tree_log_remove_rule
selinux_setprocattr
common_lsm_auditmmon_lsm_audit - generic LSM auditing function*@a: auxiliary audit data*@pre_audit: lsm-specific pre-audit callback*@post_audit: lsm-specific post-audit callback* setup the audit buffer for common security information* uses callback to print LSM specific
integrity_audit_msg
ima_audit_measurement