selinux/include/audit.h

19  * selinux_audit_rule_init - alloc/init an selinux audit rule structure.
20  * @field: the field this rule refers to
21  * @op: the operator the rule uses
22  * @rulestr: the text "target" of the rule
23  * @rule: pointer to the new rule structure returned via this
26  * Returns 0 if successful, -errno if not.  On success, the rule structure
30 int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **rule,
34  * selinux_audit_rule_free - free an selinux audit rule structure.
35  * @rule: pointer to the audit rule to be freed
37  * This will free all memory associated with the given rule.
38  * If @rule is NULL, no operation is performed.
40 void selinux_audit_rule_free(void *rule);
43  * selinux_audit_rule_match - determine if a context ID matches a rule.
45  * @field: the field this rule refers to
46  * @op: the operator the rule uses
47  * @rule: pointer to the audit rule to check against
49  * Returns 1 if the context id matches the rule, 0 if it does not, and
52 int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *rule);
55  * selinux_audit_rule_known - check to see if rule contains selinux fields.
56  * @rule: rule to be checked
57  * Returns 1 if there are selinux fields specified in the rule, 0 otherwise.
59 int selinux_audit_rule_known(struct audit_krule *rule);