FreeBSD/sys/security/audit/audit_pipe.c
/*-
 * Determine whether a specific audit pipe matches a record with these
 * properties.  Algorithm is as follows:
 *
 * - If the pipe is configured to track the default trail configuration, then
 *   use the results of global preselection matching.
 * - If not, search for a specifically configured auid entry matching the
 *   event.  If an entry is found, use that.
 * - Otherwise, use the default flags or naflags configured for the pipe.
 */
Determine whether a specific audit pipe matches a record with these
properties.  Algorithm is as follows.

- If the pipe is configured to track the default trail configuration, then
use the results of global preselection matching.
- If not, search for a specifically configured auid entry matching the
event.  If an entry is found, use that.
- Otherwise, use the default flags or naflags configured for the pipe.
Determine whether a specific audit pipe matches a record with these properties . Algorithm is as follows . - If the pipe is configured to track the default trail configuration then use the results of global preselection matching . - If not search for a specifically configured auid entry matching the event . If an entry is found use that . - Otherwise use the default flags or naflags configured for the pipe .
static int
audit_pipe_preselect_check(struct audit_pipe *ap, au_id_t auid,
    au_event_t event, au_class_t class, int sorf, int trail_preselect)
{
	struct audit_pipe_preselect *app;
	AUDIT_PIPE_LOCK_ASSERT(ap);
	switch (ap->ap_preselect_mode) {
	case AUDITPIPE_PRESELECT_MODE_TRAIL:
		return (trail_preselect);
	case AUDITPIPE_PRESELECT_MODE_LOCAL:
		app = audit_pipe_preselect_find(ap, auid);
		if (app == NULL) {
			if (auid == AU_DEFAUDITID)
				return (au_preselect(event, class,
				    &ap->ap_preselect_naflags, sorf));
			else
				return (au_preselect(event, class,
				    &ap->ap_preselect_flags, sorf));
		} else
			return (au_preselect(event, class, &app->app_mask,
			    sorf));
	default:
		panic("audit_pipe_preselect_check: mode %d",
		    ap->ap_preselect_mode);
	}
	return (0);
}
static int audit_pipe_preselect_check ( struct audit_pipe * ap , au_id_t auid , au_event_t event , au_class_t class , int sorf , int trail_preselect ) { struct audit_pipe_preselect * app ; AUDIT_PIPE_LOCK_ASSERT ( ap ) ; switch ( ap -> ap_preselect_mode ) { case AUDITPIPE_PRESELECT_MODE_TRAIL : return ( trail_preselect ) ; case AUDITPIPE_PRESELECT_MODE_LOCAL : app = audit_pipe_preselect_find ( ap , auid ) ; if ( app == NULL ) { if ( auid == AU_DEFAUDITID ) return ( au_preselect ( event , class , & ap -> ap_preselect_naflags , sorf ) ) ; else return ( au_preselect ( event , class , & ap -> ap_preselect_flags , sorf ) ) ; } else return ( au_preselect ( event , class , & app -> app_mask , sorf ) ) ; default : panic ( " " , ap -> ap_preselect_mode ) ; } return ( 0 ) ; }
Determine whether a specific audit pipe matches a record with these
 properties.
Determine whether a specific audit pipe matches a record with these properties .