Lines Matching defs:audit_context
101 struct audit_context { struct
102 int dummy; /* must be the first element */
103 int in_syscall; /* 1 if task is in a syscall */
104 enum audit_state state, current_state;
105 unsigned int serial; /* serial number for record */
106 int major; /* syscall number */
107 struct timespec64 ctime; /* time of syscall entry */
108 unsigned long argv[4]; /* syscall arguments */
109 long return_code;/* syscall return code */
110 u64 prio;
111 int return_valid; /* return code is valid */
120 struct audit_names preallocated_names[AUDIT_NAMES];
121 int name_count; /* total records in names_list */
122 struct list_head names_list; /* struct audit_names->list anchor */
123 char *filterkey; /* key for rule that triggered record */
124 struct path pwd;
125 struct audit_aux_data *aux;
126 struct audit_aux_data *aux_pids;
127 struct sockaddr_storage *sockaddr;
128 size_t sockaddr_len;
130 pid_t pid, ppid;
131 kuid_t uid, euid, suid, fsuid;
132 kgid_t gid, egid, sgid, fsgid;
133 unsigned long personality;
134 int arch;
136 pid_t target_pid;
137 kuid_t target_auid;
138 kuid_t target_uid;
139 unsigned int target_sessionid;
140 u32 target_sid;
141 char target_comm[TASK_COMM_LEN];
143 struct audit_tree_refs *trees, *first_trees;
144 struct list_head killed_trees;
145 int tree_count;
147 int type;
148 union {
198 int fds[2];
199 struct audit_proctitle proctitle;