Function report |
Source Code:kernel\auditsc.c |
Create Date:2022-07-28 11:28:11 |
Last Modify:2020-03-17 16:31:21 | Copyright©Brick |
home page | Tree |
Annotation kernel can get tool activity | Download SCCT | Chinese |
Name:__audit_inode_child - collect inode info for created/removed objects*@parent: inode of dentry parent*@dentry: dentry being audited*@type: AUDIT_TYPE_* value that we're looking for* For syscalls that create or remove filesystem objects, audit_inode
Proto:void __audit_inode_child(struct inode *parent, const struct dentry *dentry, const unsigned char type)
Type:void
Parameter:
Type | Parameter | Name |
---|---|---|
struct inode * | parent | |
const struct dentry * | dentry | |
const unsigned char | type |
2065 | context = audit_context() |
2068 | struct audit_names * n, * found_parent = NULL, * found_child = NULL |
2073 | If Not 1 if task is in a syscall Then Return |
2078 | When i < field_count cycle |
2081 | If type == FileSystem Type && audit_comparator(s_magic, op, val) && action == Do not build context if rule matches Then |
2092 | If inode Then handle_one(inode) |
2097 | If Not name || cord type != a parent audit record && cord type != we don't know yet Then Continue |
2105 | If cord type == we don't know yet Then cord type = a parent audit record |
2107 | found_parent = n |
2108 | Break |
2115 | If Not name || cord type != type && cord type != we don't know yet Then Continue |
2131 | If Not found_parent Then |
2133 | n = audit_alloc_name(context, a parent audit record ) |
2134 | If Not n Then Return |
2139 | If Not found_child Then |
2140 | found_child = audit_alloc_name(context, type) |
2141 | If Not found_child Then Return |
2147 | If found_parent Then |
2150 | refcnt++ |
2154 | If inode Then Copy inode data into an audit_names. |
2156 | Else ino = AUDIT_INO_UNSET |
Source code conversion tool public plug-in interface | X |
---|---|
Support c/c++/esqlc/java Oracle/Informix/Mysql Plug-in can realize: logical Report Code generation and batch code conversion |