Lines Matching refs:ab
959 struct audit_buffer *ab; in audit_log_pid_context() local
964 ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID); in audit_log_pid_context()
965 if (!ab) in audit_log_pid_context()
968 audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid, in audit_log_pid_context()
973 audit_log_format(ab, " obj=(none)"); in audit_log_pid_context()
976 audit_log_format(ab, " obj=%s", ctx); in audit_log_pid_context()
980 audit_log_format(ab, " ocomm="); in audit_log_pid_context()
981 audit_log_untrustedstring(ab, comm); in audit_log_pid_context()
982 audit_log_end(ab); in audit_log_pid_context()
988 struct audit_buffer **ab) in audit_log_execve_info() argument
1024 audit_log_format(*ab, "argc=%d", context->execve.argc); in audit_log_execve_info()
1095 audit_log_end(*ab); in audit_log_execve_info()
1096 *ab = audit_log_start(context, in audit_log_execve_info()
1098 if (!*ab) in audit_log_execve_info()
1123 audit_log_format(*ab, "%s", abuf); in audit_log_execve_info()
1129 audit_log_n_hex(*ab, buf, len_tmp); in audit_log_execve_info()
1135 audit_log_n_string(*ab, buf, len_tmp); in audit_log_execve_info()
1161 static void audit_log_cap(struct audit_buffer *ab, char *prefix, in audit_log_cap() argument
1167 audit_log_format(ab, " %s=0", prefix); in audit_log_cap()
1170 audit_log_format(ab, " %s=", prefix); in audit_log_cap()
1172 audit_log_format(ab, "%08x", cap->cap[CAP_LAST_U32 - i]); in audit_log_cap()
1175 static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name) in audit_log_fcaps() argument
1178 audit_log_format(ab, " cap_fe=? cap_fver=? cap_fp=? cap_fi=?"); in audit_log_fcaps()
1181 audit_log_cap(ab, "cap_fp", &name->fcap.permitted); in audit_log_fcaps()
1182 audit_log_cap(ab, "cap_fi", &name->fcap.inheritable); in audit_log_fcaps()
1183 audit_log_format(ab, " cap_fe=%d cap_fver=%x cap_frootid=%d", in audit_log_fcaps()
1190 struct audit_buffer *ab; in show_special() local
1193 ab = audit_log_start(context, GFP_KERNEL, context->type); in show_special()
1194 if (!ab) in show_special()
1200 audit_log_format(ab, "nargs=%d", nargs); in show_special()
1202 audit_log_format(ab, " a%d=%lx", i, in show_special()
1208 audit_log_format(ab, "ouid=%u ogid=%u mode=%#ho", in show_special()
1216 audit_log_format(ab, " osid=%u", osid); in show_special()
1219 audit_log_format(ab, " obj=%s", ctx); in show_special()
1224 audit_log_end(ab); in show_special()
1225 ab = audit_log_start(context, GFP_KERNEL, in show_special()
1227 if (unlikely(!ab)) in show_special()
1229 audit_log_format(ab, in show_special()
1238 audit_log_format(ab, in show_special()
1248 audit_log_format(ab, in show_special()
1258 audit_log_format(ab, "mqdes=%d sigev_signo=%d", in show_special()
1264 audit_log_format(ab, in show_special()
1272 audit_log_format(ab, "pid=%d", context->capset.pid); in show_special()
1273 audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable); in show_special()
1274 audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted); in show_special()
1275 audit_log_cap(ab, "cap_pe", &context->capset.cap.effective); in show_special()
1276 audit_log_cap(ab, "cap_pa", &context->capset.cap.ambient); in show_special()
1279 audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd, in show_special()
1283 audit_log_execve_info(context, &ab); in show_special()
1286 audit_log_format(ab, "name="); in show_special()
1288 audit_log_untrustedstring(ab, context->module.name); in show_special()
1290 audit_log_format(ab, "(null)"); in show_special()
1294 audit_log_end(ab); in show_special()
1320 struct audit_buffer *ab; in audit_log_name() local
1322 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH); in audit_log_name()
1323 if (!ab) in audit_log_name()
1326 audit_log_format(ab, "item=%d", record_num); in audit_log_name()
1329 audit_log_d_path(ab, " name=", path); in audit_log_name()
1334 audit_log_format(ab, " name="); in audit_log_name()
1335 audit_log_untrustedstring(ab, n->name->name); in audit_log_name()
1341 audit_log_d_path(ab, " name=", &context->pwd); in audit_log_name()
1345 audit_log_format(ab, " name="); in audit_log_name()
1346 audit_log_n_untrustedstring(ab, n->name->name, in audit_log_name()
1350 audit_log_format(ab, " name=(null)"); in audit_log_name()
1353 audit_log_format(ab, " inode=%lu dev=%02x:%02x mode=%#ho ouid=%u ogid=%u rdev=%02x:%02x", in audit_log_name()
1368 audit_log_format(ab, " osid=%u", n->osid); in audit_log_name()
1372 audit_log_format(ab, " obj=%s", ctx); in audit_log_name()
1380 audit_log_format(ab, " nametype=NORMAL"); in audit_log_name()
1383 audit_log_format(ab, " nametype=PARENT"); in audit_log_name()
1386 audit_log_format(ab, " nametype=DELETE"); in audit_log_name()
1389 audit_log_format(ab, " nametype=CREATE"); in audit_log_name()
1392 audit_log_format(ab, " nametype=UNKNOWN"); in audit_log_name()
1396 audit_log_fcaps(ab, n); in audit_log_name()
1397 audit_log_end(ab); in audit_log_name()
1407 struct audit_buffer *ab; in audit_log_proctitle() local
1412 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE); in audit_log_proctitle()
1413 if (!ab) in audit_log_proctitle()
1416 audit_log_format(ab, "proctitle="); in audit_log_proctitle()
1440 audit_log_n_untrustedstring(ab, msg, len); in audit_log_proctitle()
1441 audit_log_end(ab); in audit_log_proctitle()
1448 struct audit_buffer *ab; in audit_log_exit() local
1454 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL); in audit_log_exit()
1455 if (!ab) in audit_log_exit()
1457 audit_log_format(ab, "arch=%x syscall=%d", in audit_log_exit()
1460 audit_log_format(ab, " per=%lx", context->personality); in audit_log_exit()
1462 audit_log_format(ab, " success=%s exit=%ld", in audit_log_exit()
1466 audit_log_format(ab, in audit_log_exit()
1474 audit_log_task_info(ab); in audit_log_exit()
1475 audit_log_key(ab, context->filterkey); in audit_log_exit()
1476 audit_log_end(ab); in audit_log_exit()
1480 ab = audit_log_start(context, GFP_KERNEL, aux->type); in audit_log_exit()
1481 if (!ab) in audit_log_exit()
1488 audit_log_format(ab, "fver=%x", axs->fcap_ver); in audit_log_exit()
1489 audit_log_cap(ab, "fp", &axs->fcap.permitted); in audit_log_exit()
1490 audit_log_cap(ab, "fi", &axs->fcap.inheritable); in audit_log_exit()
1491 audit_log_format(ab, " fe=%d", axs->fcap.fE); in audit_log_exit()
1492 audit_log_cap(ab, "old_pp", &axs->old_pcap.permitted); in audit_log_exit()
1493 audit_log_cap(ab, "old_pi", &axs->old_pcap.inheritable); in audit_log_exit()
1494 audit_log_cap(ab, "old_pe", &axs->old_pcap.effective); in audit_log_exit()
1495 audit_log_cap(ab, "old_pa", &axs->old_pcap.ambient); in audit_log_exit()
1496 audit_log_cap(ab, "pp", &axs->new_pcap.permitted); in audit_log_exit()
1497 audit_log_cap(ab, "pi", &axs->new_pcap.inheritable); in audit_log_exit()
1498 audit_log_cap(ab, "pe", &axs->new_pcap.effective); in audit_log_exit()
1499 audit_log_cap(ab, "pa", &axs->new_pcap.ambient); in audit_log_exit()
1500 audit_log_format(ab, " frootid=%d", in audit_log_exit()
1506 audit_log_end(ab); in audit_log_exit()
1513 ab = audit_log_start(context, GFP_KERNEL, AUDIT_FD_PAIR); in audit_log_exit()
1514 if (ab) { in audit_log_exit()
1515 audit_log_format(ab, "fd0=%d fd1=%d", in audit_log_exit()
1517 audit_log_end(ab); in audit_log_exit()
1522 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR); in audit_log_exit()
1523 if (ab) { in audit_log_exit()
1524 audit_log_format(ab, "saddr="); in audit_log_exit()
1525 audit_log_n_hex(ab, (void *)context->sockaddr, in audit_log_exit()
1527 audit_log_end(ab); in audit_log_exit()
1552 ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD); in audit_log_exit()
1553 if (ab) { in audit_log_exit()
1554 audit_log_d_path(ab, "cwd=", &context->pwd); in audit_log_exit()
1555 audit_log_end(ab); in audit_log_exit()
1569 ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); in audit_log_exit()
1570 if (ab) in audit_log_exit()
1571 audit_log_end(ab); in audit_log_exit()
2548 static void audit_log_task(struct audit_buffer *ab) in audit_log_task() argument
2559 audit_log_format(ab, "auid=%u uid=%u gid=%u ses=%u", in audit_log_task()
2564 audit_log_task_context(ab); in audit_log_task()
2565 audit_log_format(ab, " pid=%d comm=", task_tgid_nr(current)); in audit_log_task()
2566 audit_log_untrustedstring(ab, get_task_comm(comm, current)); in audit_log_task()
2567 audit_log_d_path_exe(ab, current->mm); in audit_log_task()
2579 struct audit_buffer *ab; in audit_core_dumps() local
2587 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_ANOM_ABEND); in audit_core_dumps()
2588 if (unlikely(!ab)) in audit_core_dumps()
2590 audit_log_task(ab); in audit_core_dumps()
2591 audit_log_format(ab, " sig=%ld res=1", signr); in audit_core_dumps()
2592 audit_log_end(ab); in audit_core_dumps()
2609 struct audit_buffer *ab; in audit_seccomp() local
2611 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_SECCOMP); in audit_seccomp()
2612 if (unlikely(!ab)) in audit_seccomp()
2614 audit_log_task(ab); in audit_seccomp()
2615 audit_log_format(ab, " sig=%ld arch=%x syscall=%ld compat=%d ip=0x%lx code=0x%x", in audit_seccomp()
2618 audit_log_end(ab); in audit_seccomp()
2624 struct audit_buffer *ab; in audit_seccomp_actions_logged() local
2629 ab = audit_log_start(audit_context(), GFP_KERNEL, in audit_seccomp_actions_logged()
2631 if (unlikely(!ab)) in audit_seccomp_actions_logged()
2634 audit_log_format(ab, in audit_seccomp_actions_logged()
2637 audit_log_end(ab); in audit_seccomp_actions_logged()