* audit_rotate_vnode() is called by a user or kernel thread to configure or * de-configure auditing on a vnode. The arguments are the replacement * credential (referenced) and vnode (referenced and opened) to substitute * for the current credential and vnode, if any. If either is set to NULL, * both should be NULL, and this is used to indicate that audit is being * disabled. Any previous c
| 490 | * generating rotation requests to auditd. |
| 491 | */ |
| 492 | void |
| 493 | audit_rotate_vnode(struct ucred *cred, struct vnode *vp) |
| 494 | { |
| 495 | struct ucred *old_audit_cred; |
| 496 | struct vnode *old_audit_vp; |
| 497 | struct vattr vattr; |
| 498 | |
| 499 | KASSERT((cred != NULL && vp != NULL) || (cred == NULL && vp == NULL), |
| 500 | ("audit_rotate_vnode: cred %p vp %p", cred, vp)); |
| 501 | |
| 502 | if (vp != NULL) { |
| 503 | vn_lock(vp, LK_SHARED | LK_RETRY); |
| 504 | if (VOP_GETATTR(vp, &vattr, cred) != 0) |
| 505 | vattr.va_size = 0; |
| 506 | VOP_UNLOCK(vp); |
| 507 | } else { |
| 508 | vattr.va_size = 0; |
| 509 | } |
| 510 | |
| 511 | /* |
| 512 | * Rotate the vnode/cred, and clear the rotate flag so that we will |
| 513 | * send a rotate trigger if the new file fills. |
| 514 | */ |
| 515 | AUDIT_WORKER_LOCK(); |
| 516 | old_audit_cred = audit_cred; |
| 517 | old_audit_vp = audit_vp; |
| 518 | audit_cred = cred; |
| 519 | audit_vp = vp; |
| 520 | audit_size = vattr.va_size; |
| 521 | audit_file_rotate_wait = 0; |
| 522 | audit_trail_enabled = (audit_vp != NULL); |
| 523 | audit_syscalls_enabled_update(); |
| 524 | AUDIT_WORKER_UNLOCK(); |
| 525 | |
| 526 | /* |
| 527 | * If there was an old vnode/credential, close and free. |
| 528 | */ |
| 529 | if (old_audit_vp != NULL) { |
| 530 | vn_close(old_audit_vp, AUDIT_CLOSE_FLAGS, old_audit_cred, |
| 531 | curthread); |
| 532 | crfree(old_audit_cred); |
| 533 | } |
| 534 | } |
| 535 | |
| 536 | void |
| 537 | audit_worker_init(void) |
no test coverage detected