From: Dustin Kirkland (IBM)
Previously existing filters are named AUDIT_FILTER_USER, *_TASK,
*_ENTRY, *_WATCH, and *_EXIT. These fall into two categories: what is
filtered or when the filter applies. AUDIT_FILTER_EXCLUDE fits into
neither of these categories. For the sake of consistency,
AUDIT_FILTER_EXCLUDE and audit_filter_exclude() are changed to
AUDIT_FILTER_TYPE and audit_filter_type() as the message type is the
only operand to this filter.
Signed-off-by: Dustin Kirkland <dustin.kirkland(a)us.ibm.com>
---
diff --git a/include/linux/audit.h b/include/linux/audit.h
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -92,7 +92,7 @@
#define AUDIT_FILTER_ENTRY 0x02 /* Apply rule at syscall entry */
#define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */
#define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */
-#define AUDIT_FILTER_EXCLUDE 0x05 /* Apply rule at audit_log_start */
+#define AUDIT_FILTER_TYPE 0x05 /* Apply rule at audit_log_start */
#define AUDIT_NR_FILTERS 6
@@ -291,7 +291,7 @@ extern int audit_sockaddr(int len, void
extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);
extern void audit_signal_info(int sig, struct task_struct *t);
extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
-extern int audit_filter_exclude(int type);
+extern int audit_filter_type(int type);
extern char *audit_ipc_context(struct kern_ipc_perm *ipcp);
extern int audit_set_macxattr(const char *name);
#else
diff --git a/kernel/audit.c b/kernel/audit.c
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -700,7 +700,7 @@ struct audit_buffer *audit_log_start(str
if (!audit_initialized)
return NULL;
- if (unlikely(audit_filter_exclude(type)))
+ if (unlikely(audit_filter_type(type)))
return NULL;
if (gfp_mask & __GFP_WAIT)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -669,16 +669,16 @@ int audit_filter_user(struct netlink_skb
return ret; /* Audit by default */
}
-int audit_filter_exclude(int type)
+int audit_filter_type(int type)
{
struct audit_entry *e;
int result = 0;
rcu_read_lock();
- if (list_empty(&audit_filter_list[AUDIT_FILTER_EXCLUDE]))
+ if (list_empty(&audit_filter_list[AUDIT_FILTER_TYPE]))
goto unlock_and_return;
- list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_EXCLUDE],
+ list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE],
list) {
struct audit_rule *rule = &e->rule;
int i;