- * Determine whether a specific audit pipe matches a record with these * properties. Algorithm is as follows: * * - If the pipe is configured to track the default trail configuration, then * use the results of global preselection matching. * - If not, search for a specifically configured auid entry matching the * event. If an entry is found, use that. * - Otherwise, use the default
| 391 | * - Otherwise, use the default flags or naflags configured for the pipe. |
| 392 | */ |
| 393 | static int |
| 394 | audit_pipe_preselect_check(struct audit_pipe *ap, au_id_t auid, |
| 395 | au_event_t event, au_class_t class, int sorf, int trail_preselect) |
| 396 | { |
| 397 | struct audit_pipe_preselect *app; |
| 398 | |
| 399 | AUDIT_PIPE_LOCK_ASSERT(ap); |
| 400 | |
| 401 | switch (ap->ap_preselect_mode) { |
| 402 | case AUDITPIPE_PRESELECT_MODE_TRAIL: |
| 403 | return (trail_preselect); |
| 404 | |
| 405 | case AUDITPIPE_PRESELECT_MODE_LOCAL: |
| 406 | app = audit_pipe_preselect_find(ap, auid); |
| 407 | if (app == NULL) { |
| 408 | if (auid == AU_DEFAUDITID) |
| 409 | return (au_preselect(event, class, |
| 410 | &ap->ap_preselect_naflags, sorf)); |
| 411 | else |
| 412 | return (au_preselect(event, class, |
| 413 | &ap->ap_preselect_flags, sorf)); |
| 414 | } else |
| 415 | return (au_preselect(event, class, &app->app_mask, |
| 416 | sorf)); |
| 417 | |
| 418 | default: |
| 419 | panic("audit_pipe_preselect_check: mode %d", |
| 420 | ap->ap_preselect_mode); |
| 421 | } |
| 422 | |
| 423 | return (0); |
| 424 | } |
| 425 | |
| 426 | /* |
| 427 | * Determine whether there exists a pipe interested in a record with specific |
no test coverage detected