Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland...

[sfrench/cifs-2.6.git] / kernel / audit.h

diff --git a/kernel/audit.h b/kernel/audit.h
index 6aa33b848cf2f0363ba6b8f8f477e9c36f2affc8..2554bd524fd1a67cdb694ef7ff230f8e3dc809cf 100644 (file)
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -73,6 +73,9 @@ struct audit_field {
        struct selinux_audit_rule       *se_rule;
 };
 
+struct audit_tree;
+struct audit_chunk;
+
 struct audit_krule {
        int                     vers_ops;
        u32                     flags;
@@ -83,9 +86,11 @@ struct audit_krule {
        u32                     field_count;
        char                    *filterkey; /* ties events to rules */
        struct audit_field      *fields;
+       struct audit_field      *arch_f; /* quick access to arch field */
        struct audit_field      *inode_f; /* quick access to an inode field */
        struct audit_watch      *watch; /* associated watch */
-       struct list_head        rlist;  /* entry in audit_watch.rules list */
+       struct audit_tree       *tree;  /* associated watched tree */
+       struct list_head        rlist;  /* entry in audit_{watch,tree}.rules list */
 };
 
 struct audit_entry {
@@ -104,6 +109,7 @@ static inline int audit_hash_ino(u32 ino)
        return (ino & (AUDIT_INODE_BUCKETS-1));
 }
 
+extern int audit_match_class(int class, unsigned syscall);
 extern int audit_comparator(const u32 left, const u32 op, const u32 right);
 extern int audit_compare_dname_path(const char *dname, const char *path,
                                    int *dirlen);
@@ -113,7 +119,6 @@ extern struct sk_buff *         audit_make_reply(int pid, int seq, int type,
 extern void                audit_send_reply(int pid, int seq, int type,
                                             int done, int multi,
                                             void *payload, int size);
-extern void                audit_log_lost(const char *message);
 extern void                audit_panic(const char *message);
 
 struct audit_netlink_list {
@@ -129,18 +134,48 @@ extern void audit_handle_ievent(struct inotify_watch *, u32, u32, u32,
                                const char *, struct inode *);
 extern int selinux_audit_rule_update(void);
 
+extern struct mutex audit_filter_mutex;
+extern void audit_free_rule_rcu(struct rcu_head *);
+
+#ifdef CONFIG_AUDIT_TREE
+extern struct audit_chunk *audit_tree_lookup(const struct inode *);
+extern void audit_put_chunk(struct audit_chunk *);
+extern int audit_tree_match(struct audit_chunk *, struct audit_tree *);
+extern int audit_make_tree(struct audit_krule *, char *, u32);
+extern int audit_add_tree_rule(struct audit_krule *);
+extern int audit_remove_tree_rule(struct audit_krule *);
+extern void audit_trim_trees(void);
+extern int audit_tag_tree(char *old, char *new);
+extern void audit_schedule_prune(void);
+extern void audit_prune_trees(void);
+extern const char *audit_tree_path(struct audit_tree *);
+extern void audit_put_tree(struct audit_tree *);
+#else
+#define audit_remove_tree_rule(rule) BUG()
+#define audit_add_tree_rule(rule) -EINVAL
+#define audit_make_tree(rule, str, op) -EINVAL
+#define audit_trim_trees() (void)0
+#define audit_put_tree(tree) (void)0
+#define audit_tag_tree(old, new) -EINVAL
+#define audit_tree_path(rule) ""       /* never called */
+#endif
+
+extern char *audit_unpack_string(void **, size_t *, size_t);
+
 #ifdef CONFIG_AUDITSYSCALL
-extern void __audit_signal_info(int sig, struct task_struct *t);
-static inline void audit_signal_info(int sig, struct task_struct *t)
+extern int __audit_signal_info(int sig, struct task_struct *t);
+static inline int audit_signal_info(int sig, struct task_struct *t)
 {
-       if (unlikely(audit_pid && t->tgid == audit_pid))
-               __audit_signal_info(sig, t);
+       if (unlikely((audit_pid && t->tgid == audit_pid) ||
+                    (audit_signals && !audit_dummy_context())))
+               return __audit_signal_info(sig, t);
+       return 0;
 }
 extern enum audit_state audit_filter_inodes(struct task_struct *,
                                            struct audit_context *);
 extern void audit_set_auditable(struct audit_context *);
 #else
-#define audit_signal_info(s,t)
+#define audit_signal_info(s,t) AUDIT_DISABLED
 #define audit_filter_inodes(t,c) AUDIT_DISABLED
 #define audit_set_auditable(c)
 #endif