Lines Matching full:context
28 * Subject and object context labeling support added by <danjones@us.ibm.com>
220 * it's going to remain 1-element for almost any setup) until we free context itself.
456 /* Determine if any context name data matches a rule's watch data */
816 * @ctx: audit context
850 * @ctx: audit context
916 static inline void audit_proctitle_free(struct audit_context *context) in audit_proctitle_free() argument
918 kfree(context->proctitle.value); in audit_proctitle_free()
919 context->proctitle.value = NULL; in audit_proctitle_free()
920 context->proctitle.len = 0; in audit_proctitle_free()
923 static inline void audit_free_module(struct audit_context *context) in audit_free_module() argument
925 if (context->type == AUDIT_KERN_MODULE) { in audit_free_module()
926 kfree(context->module.name); in audit_free_module()
927 context->module.name = NULL; in audit_free_module()
930 static inline void audit_free_names(struct audit_context *context) in audit_free_names() argument
934 list_for_each_entry_safe(n, next, &context->names_list, list) { in audit_free_names()
941 context->name_count = 0; in audit_free_names()
942 path_put(&context->pwd); in audit_free_names()
943 context->pwd.dentry = NULL; in audit_free_names()
944 context->pwd.mnt = NULL; in audit_free_names()
947 static inline void audit_free_aux(struct audit_context *context) in audit_free_aux() argument
951 while ((aux = context->aux)) { in audit_free_aux()
952 context->aux = aux->next; in audit_free_aux()
955 context->aux = NULL; in audit_free_aux()
956 while ((aux = context->aux_pids)) { in audit_free_aux()
957 context->aux_pids = aux->next; in audit_free_aux()
960 context->aux_pids = NULL; in audit_free_aux()
970 * for reuse, so long as the passed context is not NULL or a dummy context.
977 /* if ctx is non-null, reset the "ctx->context" regardless */ in audit_reset_context()
978 ctx->context = AUDIT_CTX_UNUSED; in audit_reset_context()
1033 struct audit_context *context; in audit_alloc_context() local
1035 context = kzalloc(sizeof(*context), GFP_KERNEL); in audit_alloc_context()
1036 if (!context) in audit_alloc_context()
1038 context->context = AUDIT_CTX_UNUSED; in audit_alloc_context()
1039 context->state = state; in audit_alloc_context()
1040 context->prio = state == AUDIT_STATE_RECORD ? ~0ULL : 0; in audit_alloc_context()
1041 INIT_LIST_HEAD(&context->killed_trees); in audit_alloc_context()
1042 INIT_LIST_HEAD(&context->names_list); in audit_alloc_context()
1043 context->fds[0] = -1; in audit_alloc_context()
1044 context->return_valid = AUDITSC_INVALID; in audit_alloc_context()
1045 return context; in audit_alloc_context()
1049 * audit_alloc - allocate an audit context block for a task
1052 * Filter on the task information and allocate a per-task audit context
1059 struct audit_context *context; in audit_alloc() local
1072 context = audit_alloc_context(state); in audit_alloc()
1073 if (!context) { in audit_alloc()
1078 context->filterkey = key; in audit_alloc()
1080 audit_set_context(tsk, context); in audit_alloc()
1085 static inline void audit_free_context(struct audit_context *context) in audit_free_context() argument
1088 audit_reset_context(context); in audit_free_context()
1089 audit_proctitle_free(context); in audit_free_context()
1090 free_tree_refs(context); in audit_free_context()
1091 kfree(context->filterkey); in audit_free_context()
1092 kfree(context); in audit_free_context()
1095 static int audit_log_pid_context(struct audit_context *context, pid_t pid, in audit_log_pid_context() argument
1103 ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID); in audit_log_pid_context()
1120 static void audit_log_execve_info(struct audit_context *context, in audit_log_execve_info() argument
1157 audit_log_format(*ab, "argc=%d", context->execve.argc); in audit_log_execve_info()
1229 *ab = audit_log_start(context, in audit_log_execve_info()
1286 } while (arg < context->execve.argc); in audit_log_execve_info()
1317 static void audit_log_time(struct audit_context *context, struct audit_buffer **ab) in audit_log_time() argument
1319 const struct audit_ntp_data *ntp = &context->time.ntp_data; in audit_log_time()
1320 const struct timespec64 *tk = &context->time.tk_injoffset; in audit_log_time()
1331 if (context->type == AUDIT_TIME_ADJNTPVAL) { in audit_log_time()
1335 *ab = audit_log_start(context, in audit_log_time()
1352 *ab = audit_log_start(context, GFP_KERNEL, in audit_log_time()
1364 static void show_special(struct audit_context *context, int *call_panic) in show_special() argument
1369 ab = audit_log_start(context, GFP_KERNEL, context->type); in show_special()
1373 switch (context->type) { in show_special()
1375 int nargs = context->socketcall.nargs; in show_special()
1380 context->socketcall.args[i]); in show_special()
1384 from_kuid(&init_user_ns, context->ipc.uid), in show_special()
1385 from_kgid(&init_user_ns, context->ipc.gid), in show_special()
1386 context->ipc.mode); in show_special()
1387 if (lsmprop_is_set(&context->ipc.oprop)) { in show_special()
1388 if (audit_log_obj_ctx(ab, &context->ipc.oprop)) in show_special()
1391 if (context->ipc.has_perm) { in show_special()
1393 ab = audit_log_start(context, GFP_KERNEL, in show_special()
1399 context->ipc.qbytes, in show_special()
1400 context->ipc.perm_uid, in show_special()
1401 context->ipc.perm_gid, in show_special()
1402 context->ipc.perm_mode); in show_special()
1409 context->mq_open.oflag, context->mq_open.mode, in show_special()
1410 context->mq_open.attr.mq_flags, in show_special()
1411 context->mq_open.attr.mq_maxmsg, in show_special()
1412 context->mq_open.attr.mq_msgsize, in show_special()
1413 context->mq_open.attr.mq_curmsgs); in show_special()
1419 context->mq_sendrecv.mqdes, in show_special()
1420 context->mq_sendrecv.msg_len, in show_special()
1421 context->mq_sendrecv.msg_prio, in show_special()
1422 (long long) context->mq_sendrecv.abs_timeout.tv_sec, in show_special()
1423 context->mq_sendrecv.abs_timeout.tv_nsec); in show_special()
1427 context->mq_notify.mqdes, in show_special()
1428 context->mq_notify.sigev_signo); in show_special()
1431 struct mq_attr *attr = &context->mq_getsetattr.mqstat; in show_special()
1436 context->mq_getsetattr.mqdes, in show_special()
1441 audit_log_format(ab, "pid=%d", context->capset.pid); in show_special()
1442 audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable); in show_special()
1443 audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted); in show_special()
1444 audit_log_cap(ab, "cap_pe", &context->capset.cap.effective); in show_special()
1445 audit_log_cap(ab, "cap_pa", &context->capset.cap.ambient); in show_special()
1448 audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd, in show_special()
1449 context->mmap.flags); in show_special()
1453 context->openat2.flags, in show_special()
1454 context->openat2.mode, in show_special()
1455 context->openat2.resolve); in show_special()
1458 audit_log_execve_info(context, &ab); in show_special()
1462 if (context->module.name) { in show_special()
1463 audit_log_untrustedstring(ab, context->module.name); in show_special()
1471 audit_log_time(context, &ab); in show_special()
1492 * @context: audit_context for the task
1498 static void audit_log_name(struct audit_context *context, struct audit_names *n, in audit_log_name() argument
1503 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH); in audit_log_name()
1522 if (context->pwd.dentry && context->pwd.mnt) in audit_log_name()
1523 audit_log_d_path(ab, " name=", &context->pwd); in audit_log_name()
1579 struct audit_context *context = audit_context(); in audit_log_proctitle() local
1582 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE); in audit_log_proctitle()
1589 if (!context->proctitle.value) { in audit_log_proctitle()
1604 context->proctitle.value = buf; in audit_log_proctitle()
1605 context->proctitle.len = res; in audit_log_proctitle()
1607 msg = context->proctitle.value; in audit_log_proctitle()
1608 len = context->proctitle.len; in audit_log_proctitle()
1616 * @ctx: the audit context
1655 struct audit_context *context = audit_context(); in audit_log_exit() local
1660 context->personality = current->personality; in audit_log_exit()
1662 switch (context->context) { in audit_log_exit()
1664 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL); in audit_log_exit()
1668 context->arch, context->major); in audit_log_exit()
1669 if (context->personality != PER_LINUX) in audit_log_exit()
1670 audit_log_format(ab, " per=%lx", context->personality); in audit_log_exit()
1671 if (context->return_valid != AUDITSC_INVALID) in audit_log_exit()
1673 str_yes_no(context->return_valid == in audit_log_exit()
1675 context->return_code); in audit_log_exit()
1678 context->argv[0], in audit_log_exit()
1679 context->argv[1], in audit_log_exit()
1680 context->argv[2], in audit_log_exit()
1681 context->argv[3], in audit_log_exit()
1682 context->name_count); in audit_log_exit()
1684 audit_log_key(ab, context->filterkey); in audit_log_exit()
1688 audit_log_uring(context); in audit_log_exit()
1695 for (aux = context->aux; aux; aux = aux->next) { in audit_log_exit()
1697 ab = audit_log_start(context, GFP_KERNEL, aux->type); in audit_log_exit()
1727 if (context->type) in audit_log_exit()
1728 show_special(context, &call_panic); in audit_log_exit()
1730 if (context->fds[0] >= 0) { in audit_log_exit()
1731 ab = audit_log_start(context, GFP_KERNEL, AUDIT_FD_PAIR); in audit_log_exit()
1734 context->fds[0], context->fds[1]); in audit_log_exit()
1739 if (context->sockaddr_len) { in audit_log_exit()
1740 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR); in audit_log_exit()
1743 audit_log_n_hex(ab, (void *)context->sockaddr, in audit_log_exit()
1744 context->sockaddr_len); in audit_log_exit()
1749 for (aux = context->aux_pids; aux; aux = aux->next) { in audit_log_exit()
1753 if (audit_log_pid_context(context, axs->target_pid[i], in audit_log_exit()
1762 if (context->target_pid && in audit_log_exit()
1763 audit_log_pid_context(context, context->target_pid, in audit_log_exit()
1764 context->target_auid, context->target_uid, in audit_log_exit()
1765 context->target_sessionid, in audit_log_exit()
1766 &context->target_ref, in audit_log_exit()
1767 context->target_comm)) in audit_log_exit()
1770 if (context->pwd.dentry && context->pwd.mnt) { in audit_log_exit()
1771 ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD); in audit_log_exit()
1773 audit_log_d_path(ab, "cwd=", &context->pwd); in audit_log_exit()
1779 list_for_each_entry(n, &context->names_list, list) { in audit_log_exit()
1782 audit_log_name(context, n, NULL, i++, &call_panic); in audit_log_exit()
1785 if (context->context == AUDIT_CTX_SYSCALL) in audit_log_exit()
1789 ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); in audit_log_exit()
1797 * __audit_free - free a per-task audit context
1798 * @tsk: task whose audit context block to free
1804 struct audit_context *context = tsk->audit_context; in __audit_free() local
1806 if (!context) in __audit_free()
1810 if (!list_empty(&context->killed_trees)) in __audit_free()
1811 audit_kill_trees(context); in __audit_free()
1818 if (tsk == current && !context->dummy) { in __audit_free()
1819 context->return_valid = AUDITSC_INVALID; in __audit_free()
1820 context->return_code = 0; in __audit_free()
1821 if (context->context == AUDIT_CTX_SYSCALL) { in __audit_free()
1822 audit_filter_syscall(tsk, context); in __audit_free()
1823 audit_filter_inodes(tsk, context); in __audit_free()
1824 if (context->current_state == AUDIT_STATE_RECORD) in __audit_free()
1826 } else if (context->context == AUDIT_CTX_URING) { in __audit_free()
1828 audit_filter_uring(tsk, context); in __audit_free()
1829 audit_filter_inodes(tsk, context); in __audit_free()
1830 if (context->current_state == AUDIT_STATE_RECORD) in __audit_free()
1831 audit_log_uring(context); in __audit_free()
1836 audit_free_context(context); in __audit_free()
1868 * __audit_uring_entry - prepare the kernel task's audit context for io_uring
1873 * audit_uring_entry() as we rely on the audit context checking present in that
1884 * NOTE: It's possible that we can be called from the process' context in __audit_uring_entry()
1890 if (ctx->context == AUDIT_CTX_SYSCALL) in __audit_uring_entry()
1897 ctx->context = AUDIT_CTX_URING; in __audit_uring_entry()
1903 * __audit_uring_exit - wrap up the kernel task's audit context after io_uring
1909 * audit_uring_exit() as we rely on the audit context checking present in that
1917 if (ctx->context != AUDIT_CTX_URING) in __audit_uring_exit()
1923 if (ctx->context == AUDIT_CTX_SYSCALL) { in __audit_uring_exit()
1926 * where we may be called from process context before we in __audit_uring_exit()
1978 * Fill in audit context at syscall entry. This only happens if the
1979 * audit context was created when the task was created and the state or
1980 * filters demand the audit context be built. If the state from the
1989 struct audit_context *context = audit_context(); in __audit_syscall_entry() local
1992 if (!audit_enabled || !context) in __audit_syscall_entry()
1995 WARN_ON(context->context != AUDIT_CTX_UNUSED); in __audit_syscall_entry()
1996 WARN_ON(context->name_count); in __audit_syscall_entry()
1997 if (context->context != AUDIT_CTX_UNUSED || context->name_count) { in __audit_syscall_entry()
2002 state = context->state; in __audit_syscall_entry()
2006 context->dummy = !audit_n_rules; in __audit_syscall_entry()
2007 if (!context->dummy && state == AUDIT_STATE_BUILD) { in __audit_syscall_entry()
2008 context->prio = 0; in __audit_syscall_entry()
2013 context->arch = syscall_get_arch(current); in __audit_syscall_entry()
2014 context->major = major; in __audit_syscall_entry()
2015 context->argv[0] = a1; in __audit_syscall_entry()
2016 context->argv[1] = a2; in __audit_syscall_entry()
2017 context->argv[2] = a3; in __audit_syscall_entry()
2018 context->argv[3] = a4; in __audit_syscall_entry()
2019 context->context = AUDIT_CTX_SYSCALL; in __audit_syscall_entry()
2020 context->current_state = state; in __audit_syscall_entry()
2021 ktime_get_coarse_real_ts64(&context->stamp.ctime); in __audit_syscall_entry()
2025 * __audit_syscall_exit - deallocate audit context after a system call
2029 * Tear down after system call. If the audit context has been marked as
2037 struct audit_context *context = audit_context(); in __audit_syscall_exit() local
2039 if (!context || context->dummy || in __audit_syscall_exit()
2040 context->context != AUDIT_CTX_SYSCALL) in __audit_syscall_exit()
2044 if (!list_empty(&context->killed_trees)) in __audit_syscall_exit()
2045 audit_kill_trees(context); in __audit_syscall_exit()
2047 audit_return_fixup(context, success, return_code); in __audit_syscall_exit()
2049 audit_filter_syscall(current, context); in __audit_syscall_exit()
2050 audit_filter_inodes(current, context); in __audit_syscall_exit()
2051 if (context->current_state != AUDIT_STATE_RECORD) in __audit_syscall_exit()
2057 audit_reset_context(context); in __audit_syscall_exit()
2062 struct audit_context *context; in handle_one() local
2069 context = audit_context(); in handle_one()
2070 p = context->trees; in handle_one()
2071 count = context->tree_count; in handle_one()
2077 if (likely(put_tree_ref(context, chunk))) in handle_one()
2079 if (unlikely(!grow_tree_refs(context))) { in handle_one()
2081 audit_set_auditable(context); in handle_one()
2083 unroll_tree_refs(context, p, count); in handle_one()
2086 put_tree_ref(context, chunk); in handle_one()
2091 struct audit_context *context; in handle_path() local
2098 context = audit_context(); in handle_path()
2099 p = context->trees; in handle_path()
2100 count = context->tree_count; in handle_path()
2114 if (unlikely(!put_tree_ref(context, chunk))) { in handle_path()
2129 unroll_tree_refs(context, p, count); in handle_path()
2133 if (grow_tree_refs(context)) { in handle_path()
2135 unroll_tree_refs(context, p, count); in handle_path()
2140 unroll_tree_refs(context, p, count); in handle_path()
2141 audit_set_auditable(context); in handle_path()
2147 static struct audit_names *audit_alloc_name(struct audit_context *context, in audit_alloc_name() argument
2152 if (context->name_count < AUDIT_NAMES) { in audit_alloc_name()
2153 aname = &context->preallocated_names[context->name_count]; in audit_alloc_name()
2164 list_add_tail(&aname->list, &context->names_list); in audit_alloc_name()
2166 context->name_count++; in audit_alloc_name()
2167 if (!context->pwd.dentry) in audit_alloc_name()
2168 get_fs_pwd(current->fs, &context->pwd); in audit_alloc_name()
2176 * Search the audit_names list for the current audit context. If there is an
2183 struct audit_context *context = audit_context(); in __audit_reusename() local
2186 list_for_each_entry(n, &context->names_list, list) { in __audit_reusename()
2199 * Add a name to the list of audit names for this context.
2204 struct audit_context *context = audit_context(); in __audit_getname() local
2207 if (context->context == AUDIT_CTX_UNUSED) in __audit_getname()
2210 n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN); in __audit_getname()
2271 struct audit_context *context = audit_context(); in __audit_inode() local
2279 if (context->context == AUDIT_CTX_UNUSED) in __audit_inode()
2317 list_for_each_entry_reverse(n, &context->names_list, list) { in __audit_inode()
2344 n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN); in __audit_inode()
2379 * This call updates the audit context with the child's information.
2389 struct audit_context *context = audit_context(); in __audit_inode_child() local
2397 if (context->context == AUDIT_CTX_UNUSED) in __audit_inode_child()
2420 list_for_each_entry(n, &context->names_list, list) { in __audit_inode_child()
2439 list_for_each_entry(n, &context->names_list, list) { in __audit_inode_child()
2459 n = audit_alloc_name(context, AUDIT_TYPE_PARENT); in __audit_inode_child()
2466 found_child = audit_alloc_name(context, type); in __audit_inode_child()
2471 * directory. All names for this context are relinquished in in __audit_inode_child()
2492 * Also sets the context as auditable.
2496 if (ctx->context == AUDIT_CTX_UNUSED) in auditsc_get_stamp()
2517 struct audit_context *context = audit_context(); in __audit_mq_open() local
2520 memcpy(&context->mq_open.attr, attr, sizeof(struct mq_attr)); in __audit_mq_open()
2522 memset(&context->mq_open.attr, 0, sizeof(struct mq_attr)); in __audit_mq_open()
2524 context->mq_open.oflag = oflag; in __audit_mq_open()
2525 context->mq_open.mode = mode; in __audit_mq_open()
2527 context->type = AUDIT_MQ_OPEN; in __audit_mq_open()
2541 struct audit_context *context = audit_context(); in __audit_mq_sendrecv() local
2542 struct timespec64 *p = &context->mq_sendrecv.abs_timeout; in __audit_mq_sendrecv()
2549 context->mq_sendrecv.mqdes = mqdes; in __audit_mq_sendrecv()
2550 context->mq_sendrecv.msg_len = msg_len; in __audit_mq_sendrecv()
2551 context->mq_sendrecv.msg_prio = msg_prio; in __audit_mq_sendrecv()
2553 context->type = AUDIT_MQ_SENDRECV; in __audit_mq_sendrecv()
2565 struct audit_context *context = audit_context(); in __audit_mq_notify() local
2568 context->mq_notify.sigev_signo = notification->sigev_signo; in __audit_mq_notify()
2570 context->mq_notify.sigev_signo = 0; in __audit_mq_notify()
2572 context->mq_notify.mqdes = mqdes; in __audit_mq_notify()
2573 context->type = AUDIT_MQ_NOTIFY; in __audit_mq_notify()
2584 struct audit_context *context = audit_context(); in __audit_mq_getsetattr() local
2586 context->mq_getsetattr.mqdes = mqdes; in __audit_mq_getsetattr()
2587 context->mq_getsetattr.mqstat = *mqstat; in __audit_mq_getsetattr()
2588 context->type = AUDIT_MQ_GETSETATTR; in __audit_mq_getsetattr()
2598 struct audit_context *context = audit_context(); in __audit_ipc_obj() local
2600 context->ipc.uid = ipcp->uid; in __audit_ipc_obj()
2601 context->ipc.gid = ipcp->gid; in __audit_ipc_obj()
2602 context->ipc.mode = ipcp->mode; in __audit_ipc_obj()
2603 context->ipc.has_perm = 0; in __audit_ipc_obj()
2604 security_ipc_getlsmprop(ipcp, &context->ipc.oprop); in __audit_ipc_obj()
2605 context->type = AUDIT_IPC; in __audit_ipc_obj()
2619 struct audit_context *context = audit_context(); in __audit_ipc_set_perm() local
2621 context->ipc.qbytes = qbytes; in __audit_ipc_set_perm()
2622 context->ipc.perm_uid = uid; in __audit_ipc_set_perm()
2623 context->ipc.perm_gid = gid; in __audit_ipc_set_perm()
2624 context->ipc.perm_mode = mode; in __audit_ipc_set_perm()
2625 context->ipc.has_perm = 1; in __audit_ipc_set_perm()
2630 struct audit_context *context = audit_context(); in __audit_bprm() local
2632 context->type = AUDIT_EXECVE; in __audit_bprm()
2633 context->execve.argc = bprm->argc; in __audit_bprm()
2645 struct audit_context *context = audit_context(); in __audit_socketcall() local
2649 context->type = AUDIT_SOCKETCALL; in __audit_socketcall()
2650 context->socketcall.nargs = nargs; in __audit_socketcall()
2651 memcpy(context->socketcall.args, args, nargs * sizeof(unsigned long)); in __audit_socketcall()
2663 struct audit_context *context = audit_context(); in __audit_fd_pair() local
2665 context->fds[0] = fd1; in __audit_fd_pair()
2666 context->fds[1] = fd2; in __audit_fd_pair()
2674 * Returns 0 for success or NULL context or < 0 on error.
2678 struct audit_context *context = audit_context(); in __audit_sockaddr() local
2680 if (!context->sockaddr) { in __audit_sockaddr()
2685 context->sockaddr = p; in __audit_sockaddr()
2688 context->sockaddr_len = len; in __audit_sockaddr()
2689 memcpy(context->sockaddr, a, len); in __audit_sockaddr()
2695 struct audit_context *context = audit_context(); in __audit_ptrace() local
2697 context->target_pid = task_tgid_nr(t); in __audit_ptrace()
2698 context->target_auid = audit_get_loginuid(t); in __audit_ptrace()
2699 context->target_uid = task_uid(t); in __audit_ptrace()
2700 context->target_sessionid = audit_get_sessionid(t); in __audit_ptrace()
2701 strscpy(context->target_comm, t->comm); in __audit_ptrace()
2702 security_task_getlsmprop_obj(t, &context->target_ref); in __audit_ptrace()
2771 struct audit_context *context = audit_context(); in __audit_log_bprm_fcaps() local
2779 ax->d.next = context->aux; in __audit_log_bprm_fcaps()
2780 context->aux = (void *)ax; in __audit_log_bprm_fcaps()
2813 struct audit_context *context = audit_context(); in __audit_log_capset() local
2815 context->capset.pid = task_tgid_nr(current); in __audit_log_capset()
2816 context->capset.cap.effective = new->cap_effective; in __audit_log_capset()
2817 context->capset.cap.inheritable = new->cap_effective; in __audit_log_capset()
2818 context->capset.cap.permitted = new->cap_permitted; in __audit_log_capset()
2819 context->capset.cap.ambient = new->cap_ambient; in __audit_log_capset()
2820 context->type = AUDIT_CAPSET; in __audit_log_capset()
2825 struct audit_context *context = audit_context(); in __audit_mmap_fd() local
2827 context->mmap.fd = fd; in __audit_mmap_fd()
2828 context->mmap.flags = flags; in __audit_mmap_fd()
2829 context->type = AUDIT_MMAP; in __audit_mmap_fd()
2834 struct audit_context *context = audit_context(); in __audit_openat2_how() local
2836 context->openat2.flags = how->flags; in __audit_openat2_how()
2837 context->openat2.mode = how->mode; in __audit_openat2_how()
2838 context->openat2.resolve = how->resolve; in __audit_openat2_how()
2839 context->type = AUDIT_OPENAT2; in __audit_openat2_how()
2844 struct audit_context *context = audit_context(); in __audit_log_kern_module() local
2846 context->module.name = kstrdup(name, GFP_KERNEL); in __audit_log_kern_module()
2847 if (!context->module.name) in __audit_log_kern_module()
2849 context->type = AUDIT_KERN_MODULE; in __audit_log_kern_module()
2871 struct audit_context *context = audit_context(); in __audit_tk_injoffset() local
2874 if (!context->type) in __audit_tk_injoffset()
2875 context->type = AUDIT_TIME_INJOFFSET; in __audit_tk_injoffset()
2876 memcpy(&context->time.tk_injoffset, &offset, sizeof(offset)); in __audit_tk_injoffset()
2881 struct audit_context *context = audit_context(); in __audit_ntp_log() local
2887 context->type = AUDIT_TIME_ADJNTPVAL; in __audit_ntp_log()
2888 memcpy(&context->time.ntp_data, ad, sizeof(*ad)); in __audit_ntp_log()
2969 * and dummy context state because seccomp actions should be logged even when
3008 if (likely(!ctx || ctx->context == AUDIT_CTX_UNUSED)) in audit_killed_trees()