33  * 	audit_krule holds a reference to its associated watch.
100 void audit_get_watch(struct audit_watch *watch)  in audit_get_watch()  argument
102 	refcount_inc(&watch->count);  in audit_get_watch()
105 void audit_put_watch(struct audit_watch *watch)  in audit_put_watch()  argument
107 	if (refcount_dec_and_test(&watch->count)) {  in audit_put_watch()
108 		WARN_ON(watch->parent);  in audit_put_watch()
109 		WARN_ON(!list_empty(&watch->rules));  in audit_put_watch()
110 		kfree(watch->path);  in audit_put_watch()
111 		kfree(watch);  in audit_put_watch()
115 static void audit_remove_watch(struct audit_watch *watch)  in audit_remove_watch()  argument
117 	list_del(&watch->wlist);  in audit_remove_watch()
118 	audit_put_parent(watch->parent);  in audit_remove_watch()
119 	watch->parent = NULL;  in audit_remove_watch()
120 	audit_put_watch(watch); /* match initial get */  in audit_remove_watch()
123 char *audit_watch_path(struct audit_watch *watch)  in audit_watch_path()  argument
125 	return watch->path;  in audit_watch_path()
128 int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)  in audit_watch_compare()  argument
130 	return (watch->ino != AUDIT_INO_UNSET) &&  in audit_watch_compare()
131 		(watch->ino == ino) &&  in audit_watch_compare()
132 		(watch->dev == dev);  in audit_watch_compare()
135 /* Initialize a parent watch entry. */
159 /* Initialize a watch entry. */
162 	struct audit_watch *watch;  in audit_init_watch()  local
164 	watch = kzalloc(sizeof(*watch), GFP_KERNEL);  in audit_init_watch()
165 	if (unlikely(!watch))  in audit_init_watch()
168 	INIT_LIST_HEAD(&watch->rules);  in audit_init_watch()
169 	refcount_set(&watch->count, 1);  in audit_init_watch()
170 	watch->path = path;  in audit_init_watch()
171 	watch->dev = AUDIT_DEV_UNSET;  in audit_init_watch()
172 	watch->ino = AUDIT_INO_UNSET;  in audit_init_watch()
174 	return watch;  in audit_init_watch()
177 /* Translate a watch string to kernel representation. */
180 	struct audit_watch *watch;  in audit_to_watch()  local
189 	    krule->inode_f || krule->watch || krule->tree)  in audit_to_watch()
192 	watch = audit_init_watch(path);  in audit_to_watch()
193 	if (IS_ERR(watch))  in audit_to_watch()
194 		return PTR_ERR(watch);  in audit_to_watch()
196 	krule->watch = watch;  in audit_to_watch()
201 /* Duplicate the given audit watch.  The new watch's rules list is initialized
267 		 * are on so we need a new watch for the new list */  in audit_update_watch()
271 			audit_panic("error updating watch, skipping");  in audit_update_watch()
286 				audit_panic("error updating watch, removing");  in audit_update_watch()
291 				 * nentry->rule.watch == oentry->rule.watch so  in audit_update_watch()
293 				 * new watch.  in audit_update_watch()
295 				audit_put_watch(nentry->rule.watch);  in audit_update_watch()
297 				nentry->rule.watch = nwatch;  in audit_update_watch()
310 		goto add_watch_to_parent; /* event applies to a single watch */  in audit_update_watch()
348 static int audit_get_nd(struct audit_watch *watch, struct path *parent)  in audit_get_nd()  argument
350 	struct dentry *d = kern_path_locked(watch->path, parent);  in audit_get_nd()
354 		/* update watch filter fields */  in audit_get_nd()
355 		watch->dev = d->d_sb->s_dev;  in audit_get_nd()
356 		watch->ino = d_backing_inode(d)->i_ino;  in audit_get_nd()
368 	struct audit_watch *w, *watch = krule->watch;  in audit_add_to_parent()  local
374 		if (strcmp(watch->path, w->path))  in audit_add_to_parent()
379 		/* put krule's ref to temporary watch */  in audit_add_to_parent()
380 		audit_put_watch(watch);  in audit_add_to_parent()
383 		krule->watch = watch = w;  in audit_add_to_parent()
390 		watch->parent = parent;  in audit_add_to_parent()
392 		audit_get_watch(watch);  in audit_add_to_parent()
393 		list_add(&watch->wlist, &parent->watches);  in audit_add_to_parent()
395 	list_add(&krule->rlist, &watch->rules);  in audit_add_to_parent()
398 /* Find a matching watch entry, or add this one.
402 	struct audit_watch *watch = krule->watch;  in audit_add_watch()  local
408 	 * When we will be calling audit_add_to_parent, krule->watch might have  in audit_add_watch()
409 	 * been updated and watch might have been freed.  in audit_add_watch()
410 	 * So we need to keep a reference of watch.  in audit_add_watch()
412 	audit_get_watch(watch);  in audit_add_watch()
417 	ret = audit_get_nd(watch, &parent_path);  in audit_add_watch()
423 		audit_put_watch(watch);  in audit_add_watch()
439 	h = audit_hash_ino((u32)watch->ino);  in audit_add_watch()
443 	audit_put_watch(watch);  in audit_add_watch()
449 	struct audit_watch *watch = krule->watch;  in audit_remove_watch_rule()  local
450 	struct audit_parent *parent = watch->parent;  in audit_remove_watch_rule()
454 	if (list_empty(&watch->rules)) {  in audit_remove_watch_rule()
460 		audit_remove_watch(watch);  in audit_remove_watch_rule()
467 /* Update watch data in audit rules based on fsnotify events. */