Function report

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\auditsc.c Create Date:2022-07-28 11:27:10
Last Modify:2020-03-17 16:31:21 Copyright©Brick
home page Tree
Annotation kernel can get tool activityDownload SCCTChinese

Name:audit_alloc - allocate an audit context block for a task*@tsk: task* Filter on the task information and allocate a per-task audit context* if necessary. Doing so turns on system call auditing for the* specified task

Proto:int audit_alloc(struct task_struct *tsk)

Type:int

Parameter:

TypeParameterName
struct task_struct *tsk
919  char * key = NULL
921  If Value is more likely to compile time(!audit_ever_enabled) Then Return 0
924  state = At process creation time, we can determine if system-call auditing is* completely disabled for this task. Since we only have the task* structure at this point, we can only check uid and gid.
925  If state == Do not create per-task audit_context.* No syscall-specific audit records can* be generated. Then
926  clear_tsk_thread_flag(tsk, syscall auditing active )
927  Return 0
930  If Not (context = audit_alloc_context(state)) Then
931  kfree(key)
932  audit_log_lost - conditionally log lost audit message event*@message: the message stating reason for lost audit message* Emit at least 1 message per second, even if audit_rate_check is* throttling.* Always increment the lost messages counter.
933  Return -ENOMEM
935  key for rule that triggered record = key
937  audit_set_context(tsk, context)
938  Set thread flags in other task's structures.* See asm/thread_info.h for TIF_xxxx flags available:
939  Return 0