MCPcopy Create free account
hub / github.com/F-Stack/f-stack / audit_pipe_preselect_check

Function audit_pipe_preselect_check

freebsd/security/audit/audit_pipe.c:393–424  ·  view source on GitHub ↗

- * Determine whether a specific audit pipe matches a record with these * properties. Algorithm is as follows: * * - If the pipe is configured to track the default trail configuration, then * use the results of global preselection matching. * - If not, search for a specifically configured auid entry matching the * event. If an entry is found, use that. * - Otherwise, use the default

Source from the content-addressed store, hash-verified

391 * - Otherwise, use the default flags or naflags configured for the pipe.
392 */
393static int
394audit_pipe_preselect_check(struct audit_pipe *ap, au_id_t auid,
395 au_event_t event, au_class_t class, int sorf, int trail_preselect)
396{
397 struct audit_pipe_preselect *app;
398
399 AUDIT_PIPE_LOCK_ASSERT(ap);
400
401 switch (ap->ap_preselect_mode) {
402 case AUDITPIPE_PRESELECT_MODE_TRAIL:
403 return (trail_preselect);
404
405 case AUDITPIPE_PRESELECT_MODE_LOCAL:
406 app = audit_pipe_preselect_find(ap, auid);
407 if (app == NULL) {
408 if (auid == AU_DEFAUDITID)
409 return (au_preselect(event, class,
410 &ap->ap_preselect_naflags, sorf));
411 else
412 return (au_preselect(event, class,
413 &ap->ap_preselect_flags, sorf));
414 } else
415 return (au_preselect(event, class, &app->app_mask,
416 sorf));
417
418 default:
419 panic("audit_pipe_preselect_check: mode %d",
420 ap->ap_preselect_mode);
421 }
422
423 return (0);
424}
425
426/*
427 * Determine whether there exists a pipe interested in a record with specific

Callers 2

audit_pipe_preselectFunction · 0.85
audit_pipe_submitFunction · 0.85

Calls 3

au_preselectFunction · 0.85
panicFunction · 0.50

Tested by

no test coverage detected