linux/kernel/audit_fsnotify.c

// SPDX-License-Identifier: GPL-2.0-or-later
/* audit_fsnotify.c -- tracking inodes
 *
 * Copyright 2003-2009,2014-2015 Red Hat, Inc.
 * Copyright 2005 Hewlett-Packard Development Company, L.P.
 * Copyright 2005 IBM Corporation
 */

#include <linux/kernel.h>
#include <linux/audit.h>
#include <linux/kthread.h>
#include <linux/mutex.h>
#include <linux/fs.h>
#include <linux/fsnotify_backend.h>
#include <linux/namei.h>
#include <linux/netlink.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/security.h>
#include "audit.h"

/*
 * this mark lives on the parent directory of the inode in question.
 * but dev, ino, and path are about the child
 */
struct audit_fsnotify_mark { … };

/* fsnotify handle. */
static struct fsnotify_group *audit_fsnotify_group;

/* fsnotify events we care about. */
#define AUDIT_FS_EVENTS …

static void audit_fsnotify_mark_free(struct audit_fsnotify_mark *audit_mark)
{ … }

static void audit_fsnotify_free_mark(struct fsnotify_mark *mark)
{ … }

char *audit_mark_path(struct audit_fsnotify_mark *mark)
{ … }

int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev)
{ … }

static void audit_update_mark(struct audit_fsnotify_mark *audit_mark,
			     const struct inode *inode)
{ … }

struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len)
{ … }

static void audit_mark_log_rule_change(struct audit_fsnotify_mark *audit_mark, char *op)
{ … }

void audit_remove_mark(struct audit_fsnotify_mark *audit_mark)
{ … }

void audit_remove_mark_rule(struct audit_krule *krule)
{ … }

static void audit_autoremove_mark_rule(struct audit_fsnotify_mark *audit_mark)
{ … }

/* Update mark data in audit rules based on fsnotify events. */
static int audit_mark_handle_event(struct fsnotify_mark *inode_mark, u32 mask,
				   struct inode *inode, struct inode *dir,
				   const struct qstr *dname, u32 cookie)
{ … }

static const struct fsnotify_ops audit_mark_fsnotify_ops = …;

static int __init audit_fsnotify_init(void)
{ … }
device_initcall(audit_fsnotify_init);