Re: [PATCH 2/2] audit string fields interface + consumer

Here is an update that incorporates changes based on Tim's feedback: - sanity check for path with trailing / - call path_release - use audit_compare_watch and fixes panics due to the assumption of the existence of rule->watch. diff --git a/kernel/audit.h b/kernel/audit.h index f3b2a00..cc979e9 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -52,6 +52,12 @@ enum audit_state { }; /* Rule lists */ +struct audit_watch { + char *path; /* watch insertion path */ + struct list_head mlist; /* entry in master_watchlist */ + struct list_head rules; /* associated rules */ +}; + struct audit_field { u32 type; u32 val; @@ -67,6 +73,8 @@ struct audit_krule { u32 buflen; /* for data alloc on list rules */ u32 field_count; struct audit_field fields[AUDIT_MAX_FIELDS]; + struct audit_watch *watch; /* associated watch */ + struct list_head rlist; /* entry in audit_watch.rules list */ };