|
Linux Kernel
3.7.1
|
All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
|
Linux Kernel
3.7.1
|
Go to the source code of this file.
Data Structures | |
| struct | audit_status |
| struct | audit_tty_status |
| struct | audit_rule_data |
| struct | audit_rule |
Enumerations | |
| enum | { Audit_equal, Audit_not_equal, Audit_bitmask, Audit_bittest, Audit_lt, Audit_gt, Audit_le, Audit_ge, Audit_bad } |
| #define AUDIT_ANOM_ABEND 1701 /* Process ended abnormally */ |
| #define AUDIT_ANOM_LINK 1702 /* Suspicious use of file links */ |
| #define AUDIT_ARCH_ALPHA (EM_ALPHA|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) |
| #define AUDIT_ARCH_ARM (EM_ARM|__AUDIT_ARCH_LE) |
| #define AUDIT_ARCH_CRIS (EM_CRIS|__AUDIT_ARCH_LE) |
| #define AUDIT_ARCH_I386 (EM_386|__AUDIT_ARCH_LE) |
| #define AUDIT_ARCH_IA64 (EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) |
| #define AUDIT_ARCH_MIPS64 (EM_MIPS|__AUDIT_ARCH_64BIT) |
| #define AUDIT_ARCH_MIPSEL (EM_MIPS|__AUDIT_ARCH_LE) |
| #define AUDIT_ARCH_MIPSEL64 (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) |
| #define AUDIT_ARCH_OPENRISC (EM_OPENRISC) |
| #define AUDIT_ARCH_PARISC64 (EM_PARISC|__AUDIT_ARCH_64BIT) |
| #define AUDIT_ARCH_PPC64 (EM_PPC64|__AUDIT_ARCH_64BIT) |
| #define AUDIT_ARCH_S390X (EM_S390|__AUDIT_ARCH_64BIT) |
| #define AUDIT_ARCH_SH64 (EM_SH|__AUDIT_ARCH_64BIT) |
| #define AUDIT_ARCH_SHEL (EM_SH|__AUDIT_ARCH_LE) |
| #define AUDIT_ARCH_SHEL64 (EM_SH|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) |
| #define AUDIT_ARCH_SPARC64 (EM_SPARCV9|__AUDIT_ARCH_64BIT) |
| #define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) |
| #define AUDIT_ARG1 (AUDIT_ARG0+1) |
| #define AUDIT_ARG2 (AUDIT_ARG0+2) |
| #define AUDIT_ARG3 (AUDIT_ARG0+3) |
| #define AUDIT_BIT_TEST (AUDIT_BIT_MASK|AUDIT_EQUAL) |
| #define AUDIT_BPRM_FCAPS 1321 /* Information about fcaps increasing perms */ |
| #define AUDIT_CAPSET 1322 /* Record showing argument to sys_capset */ |
| #define AUDIT_CONFIG_CHANGE 1305 /* Audit system configuration change */ |
| #define AUDIT_FILTER_ENTRY 0x02 /* Apply rule at syscall entry */ |
| #define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */ |
| #define AUDIT_FILTER_PREPEND 0x10 /* Prepend to front of list */ |
| #define AUDIT_FILTER_TASK 0x01 /* Apply rule at task creation (not syscall) */ |
| #define AUDIT_FILTER_TYPE 0x05 /* Apply rule at audit_log_start */ |
| #define AUDIT_FILTER_USER 0x00 /* Apply rule to user-generated messages */ |
| #define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */ |
| #define AUDIT_FIRST_USER_MSG 1100 /* Userspace messages mostly uninteresting to kernel */ |
| #define AUDIT_FIRST_USER_MSG2 2100 /* More user space messages */ |
| #define AUDIT_GREATER_THAN_OR_EQUAL (AUDIT_GREATER_THAN|AUDIT_EQUAL) |
| #define AUDIT_INTEGRITY_DATA 1800 /* Data integrity verification */ |
| #define AUDIT_INTEGRITY_METADATA 1801 /* Metadata integrity verification */ |
| #define AUDIT_INTEGRITY_PCR 1804 /* PCR invalidation msgs */ |
| #define AUDIT_IPC_SET_PERM 1311 /* IPC new permissions record type */ |
| #define AUDIT_KERNEL_OTHER 1316 /* For use by 3rd party modules */ |
| #define AUDIT_LESS_THAN_OR_EQUAL (AUDIT_LESS_THAN|AUDIT_EQUAL) |
| #define AUDIT_LIST 1002 /* List syscall rules -- deprecated */ |
| #define AUDIT_LIST_RULES 1013 /* List syscall filtering rules */ |
| #define AUDIT_MAC_CIPSOV4_DEL 1408 /* NetLabel: del CIPSOv4 DOI entry */ |
| #define AUDIT_MAC_CONFIG_CHANGE 1405 /* Changes to booleans */ |
| #define AUDIT_MAC_IPSEC_EVENT 1415 /* Audit an IPSec event */ |
| #define AUDIT_MAC_STATUS 1404 /* Changed enforcing,permissive,off */ |
| #define AUDIT_MAC_UNLBL_ALLOW 1406 /* NetLabel: allow unlabeled traffic */ |
| #define AUDIT_MAX_FIELD_COMPARE AUDIT_COMPARE_SGID_TO_FSGID |
| #define AUDIT_MMAP 1323 /* Record showing descriptor and flags in mmap */ |
| #define AUDIT_NETFILTER_CFG 1325 /* Netfilter chain modifications */ |
| #define AUDIT_NETFILTER_PKT 1324 /* Packets traversing netfilter chains */ |
| #define AUDIT_OPERATORS (AUDIT_EQUAL|AUDIT_NOT_EQUAL|AUDIT_BIT_MASK) |
| #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ |
| #define AUDIT_SIGNAL_INFO 1010 /* Get info about sender of signal to auditd */ |
| #define AUDIT_SOCKETCALL 1304 /* sys_socketcall arguments */ |
1.8.2