tools/testing/selftests/landlock/audit.h

Source file repositories/reference/linux-study-clean/tools/testing/selftests/landlock/audit.h

File Facts

System
Linux kernel
Corpus path
tools/testing/selftests/landlock/audit.h
Extension
.h
Size
14645 bytes
Lines
606
Domain
Support Tooling And Documentation
Bucket
tools
Inferred role
Support Tooling And Documentation: implementation source
Status
source implementation candidate

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

struct audit_filter {
	__u32 record_type;
	size_t exe_len;
	char exe[PATH_MAX];
};

struct audit_message {
	struct nlmsghdr header;
	union {
		struct audit_status status;
		struct audit_features features;
		struct audit_rule_data rule;
		struct nlmsgerr err;
		char data[PATH_MAX + 200];
	};
};

static const struct timeval audit_tv_default = {
	/*
	 * Default socket timeout for audit_match_record() callers that expect a
	 * record to arrive.  Asynchronous kauditd delivery can exceed 1 usec
	 * under heavy debug configs (KASAN, lockdep), where kauditd_thread
	 * scheduling between audit_log_end() and netlink_unicast() takes longer
	 * than the previous 1 usec timeout. 1 second is a generous ceiling: on
	 * the happy path, kauditd delivers within dozens of usec.
	 */
	.tv_sec = 1,
};

static const struct timeval audit_tv_fast = {
	/*
	 * Fast timeout for paths that expect no record (audit_init() drain,
	 * audit_count_records(), probes).  Causes audit_recv() to return
	 * -EAGAIN once the socket buffer is empty, naturally terminating the
	 * read loop.
	 */
	.tv_usec = 1,
};

static int audit_send(const int fd, const struct audit_message *const msg)
{
	struct sockaddr_nl addr = {
		.nl_family = AF_NETLINK,
	};
	int ret;

	do {
		ret = sendto(fd, msg, msg->header.nlmsg_len, 0,
			     (struct sockaddr *)&addr, sizeof(addr));
	} while (ret < 0 && errno == EINTR);

	if (ret < 0)
		return -errno;

	if (ret != msg->header.nlmsg_len)
		return -E2BIG;

	return 0;
}

static int audit_recv(const int fd, struct audit_message *msg)
{
	struct sockaddr_nl addr;
	socklen_t addrlen = sizeof(addr);
	struct audit_message msg_tmp;
	int err;

	if (!msg)
		msg = &msg_tmp;

	do {
		err = recvfrom(fd, msg, sizeof(*msg), 0,
			       (struct sockaddr *)&addr, &addrlen);
	} while (err < 0 && errno == EINTR);

	if (err < 0)
		return -errno;

	if (addrlen != sizeof(addr) || addr.nl_pid != 0)
		return -EINVAL;

	/* Checks Netlink error or end of messages. */
	if (msg->header.nlmsg_type == NLMSG_ERROR)
		return msg->err.error;

	return 0;
}

static int audit_request(const int fd,
			 const struct audit_message *const request,

Annotation

Implementation Notes