struct audit_entry *entry; 
int audit_receive_filter(int type, int pid, int uid, int seq, void *data,							uid_t loginuid){	struct audit_entry *entry;	struct task_struct *tsk;	int *dest;	int		   err = 0;	unsigned listnr;	switch (type) {	case AUDIT_LIST:		/* We can't just spew out the rules here because we might fill		 * the available socket buffer space and deadlock waiting for		 * auditctl to read from it... which isn't ever going to		 * happen if we're actually running in the context of auditctl		 * trying to _send_ the stuff */		 		dest = kmalloc(2 * sizeof(int), GFP_KERNEL);		if (!dest)			return -ENOMEM;		dest[0] = pid;		dest[1] = seq;		tsk = kthread_run(audit_list_rules, dest, "audit_list_rules");		if (IS_ERR(tsk)) {			kfree(dest);			err = PTR_ERR(tsk);		}		break;	case AUDIT_ADD:		if (!(entry = kmalloc(sizeof(*entry), GFP_KERNEL)))			return -ENOMEM;		if (audit_copy_rule(&entry->rule, data)) {			kfree(entry);			return -EINVAL;		}		listnr = entry->rule.flags & ~AUDIT_FILTER_PREPEND;		audit_add_rule(entry, &audit_filter_list[listnr]);		audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 				"auid=%u added an audit rule\n", loginuid);		break;	case AUDIT_DEL:		listnr =((struct audit_rule *)data)->flags & ~AUDIT_FILTER_PREPEND;		if (listnr >= AUDIT_NR_FILTERS)			return -EINVAL;		err = audit_del_rule(data, &audit_filter_list[listnr]);		if (!err)			audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,				  "auid=%u removed an audit rule\n", loginuid);		break;	default:		return -EINVAL;	}	return err;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/3c789a19054034847afe80af2f23ebb0eebfbad6/auditsc.c/clean/kernel/auditsc.c