[linux.git] / kernel / audit_watch.c

// SPDX-License-Identifier: GPL-2.0-or-later
/* audit_watch.c -- watching inodes
 *
 * Copyright 2003-2009 Red Hat, Inc.
 * Copyright 2005 Hewlett-Packard Development Company, L.P.
 * Copyright 2005 IBM Corporation
 */

#include <linux/file.h>
#include <linux/kernel.h>
#include <linux/audit.h>
#include <linux/kthread.h>
#include <linux/mutex.h>
#include <linux/fs.h>
#include <linux/fsnotify_backend.h>
#include <linux/namei.h>
#include <linux/netlink.h>
#include <linux/refcount.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/security.h>
#include "audit.h"

/*
 * Reference counting:
 *
 * audit_parent: lifetime is from audit_init_parent() to receipt of an FS_IGNORED
 * 	event.  Each audit_watch holds a reference to its associated parent.
 *
 * audit_watch: if added to lists, lifetime is from audit_init_watch() to
 * 	audit_remove_watch().  Additionally, an audit_watch may exist
 * 	temporarily to assist in searching existing filter data.  Each
 * 	audit_krule holds a reference to its associated watch.
 */

struct audit_watch {
	refcount_t		count;	/* reference count */
	dev_t			dev;	/* associated superblock device */
	char			*path;	/* insertion path */
	unsigned long		ino;	/* associated inode number */
	struct audit_parent	*parent; /* associated parent */
	struct list_head	wlist;	/* entry in parent->watches list */
	struct list_head	rules;	/* anchor for krule->rlist */
};

struct audit_parent {
	struct list_head	watches; /* anchor for audit_watch->wlist */
	struct fsnotify_mark mark; /* fsnotify mark on the inode */
};

/* fsnotify handle. */
static struct fsnotify_group *audit_watch_group;

/* fsnotify events we care about. */
#define AUDIT_FS_WATCH (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
			FS_MOVE_SELF | FS_UNMOUNT)

static void audit_free_parent(struct audit_parent *parent)
{
	WARN_ON(!list_empty(&parent->watches));
	kfree(parent);
}

static void audit_watch_free_mark(struct fsnotify_mark *entry)
{
	struct audit_parent *parent;

	parent = container_of(entry, struct audit_parent, mark);
	audit_free_parent(parent);
}

static void audit_get_parent(struct audit_parent *parent)
{
	if (likely(parent))
		fsnotify_get_mark(&parent->mark);
}

static void audit_put_parent(struct audit_parent *parent)
{
	if (likely(parent))
		fsnotify_put_mark(&parent->mark);
}

/*
 * Find and return the audit_parent on the given inode.  If found a reference
 * is taken on this parent.
 */
static inline struct audit_parent *audit_find_parent(struct inode *inode)
{
	struct audit_parent *parent = NULL;
	struct fsnotify_mark *entry;

	entry = fsnotify_find_inode_mark(inode, audit_watch_group);
	if (entry)
		parent = container_of(entry, struct audit_parent, mark);

	return parent;
}

void audit_get_watch(struct audit_watch *watch)
{
	refcount_inc(&watch->count);
}

void audit_put_watch(struct audit_watch *watch)
{
	if (refcount_dec_and_test(&watch->count)) {
		WARN_ON(watch->parent);
		WARN_ON(!list_empty(&watch->rules));
		kfree(watch->path);
		kfree(watch);
	}
}

static void audit_remove_watch(struct audit_watch *watch)
{
	list_del(&watch->wlist);
	audit_put_parent(watch->parent);
	watch->parent = NULL;
	audit_put_watch(watch); /* match initial get */
}

char *audit_watch_path(struct audit_watch *watch)
{
	return watch->path;
}

int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
{
	return (watch->ino != AUDIT_INO_UNSET) &&
		(watch->ino == ino) &&
		(watch->dev == dev);
}

/* Initialize a parent watch entry. */
static struct audit_parent *audit_init_parent(const struct path *path)
{
	struct inode *inode = d_backing_inode(path->dentry);
	struct audit_parent *parent;
	int ret;

	parent = kzalloc(sizeof(*parent), GFP_KERNEL);
	if (unlikely(!parent))
		return ERR_PTR(-ENOMEM);

	INIT_LIST_HEAD(&parent->watches);

	fsnotify_init_mark(&parent->mark, audit_watch_group);
	parent->mark.mask = AUDIT_FS_WATCH;
	ret = fsnotify_add_inode_mark(&parent->mark, inode, 0);
	if (ret < 0) {
		audit_free_parent(parent);
		return ERR_PTR(ret);
	}

	return parent;
}

/* Initialize a watch entry. */
static struct audit_watch *audit_init_watch(char *path)
{
	struct audit_watch *watch;

	watch = kzalloc(sizeof(*watch), GFP_KERNEL);
	if (unlikely(!watch))
		return ERR_PTR(-ENOMEM);

	INIT_LIST_HEAD(&watch->rules);
	refcount_set(&watch->count, 1);
	watch->path = path;
	watch->dev = AUDIT_DEV_UNSET;
	watch->ino = AUDIT_INO_UNSET;

	return watch;
}

/* Translate a watch string to kernel representation. */
int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op)
{
	struct audit_watch *watch;

	if (!audit_watch_group)
		return -EOPNOTSUPP;

	if (path[0] != '/' || path[len-1] == '/' ||
	    (krule->listnr != AUDIT_FILTER_EXIT &&
	     krule->listnr != AUDIT_FILTER_URING_EXIT) ||
	    op != Audit_equal ||
	    krule->inode_f || krule->watch || krule->tree)
		return -EINVAL;

	watch = audit_init_watch(path);
	if (IS_ERR(watch))
		return PTR_ERR(watch);

	krule->watch = watch;

	return 0;
}

/* Duplicate the given audit watch.  The new watch's rules list is initialized
 * to an empty list and wlist is undefined. */
static struct audit_watch *audit_dupe_watch(struct audit_watch *old)
{
	char *path;
	struct audit_watch *new;

	path = kstrdup(old->path, GFP_KERNEL);
	if (unlikely(!path))
		return ERR_PTR(-ENOMEM);

	new = audit_init_watch(path);
	if (IS_ERR(new)) {
		kfree(path);
		goto out;
	}

	new->dev = old->dev;
	new->ino = old->ino;
	audit_get_parent(old->parent);
	new->parent = old->parent;

out:
	return new;
}

static void audit_watch_log_rule_change(struct audit_krule *r, struct audit_watch *w, char *op)
{
	struct audit_buffer *ab;

	if (!audit_enabled)
		return;
	ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE);
	if (!ab)
		return;
	audit_log_session_info(ab);
	audit_log_format(ab, "op=%s path=", op);
	audit_log_untrustedstring(ab, w->path);
	audit_log_key(ab, r->filterkey);
	audit_log_format(ab, " list=%d res=1", r->listnr);
	audit_log_end(ab);
}

/* Update inode info in audit rules based on filesystem event. */
static void audit_update_watch(struct audit_parent *parent,
			       const struct qstr *dname, dev_t dev,
			       unsigned long ino, unsigned invalidating)
{
	struct audit_watch *owatch, *nwatch, *nextw;
	struct audit_krule *r, *nextr;
	struct audit_entry *oentry, *nentry;

	mutex_lock(&audit_filter_mutex);
	/* Run all of the watches on this parent looking for the one that
	 * matches the given dname */
	list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
		if (audit_compare_dname_path(dname, owatch->path,
					     AUDIT_NAME_FULL))
			continue;

		/* If the update involves invalidating rules, do the inode-based
		 * filtering now, so we don't omit records. */
		if (invalidating && !audit_dummy_context())
			audit_filter_inodes(current, audit_context());

		/* updating ino will likely change which audit_hash_list we
		 * are on so we need a new watch for the new list */
		nwatch = audit_dupe_watch(owatch);
		if (IS_ERR(nwatch)) {
			mutex_unlock(&audit_filter_mutex);
			audit_panic("error updating watch, skipping");
			return;
		}
		nwatch->dev = dev;
		nwatch->ino = ino;

		list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) {

			oentry = container_of(r, struct audit_entry, rule);
			list_del(&oentry->rule.rlist);
			list_del_rcu(&oentry->list);

			nentry = audit_dupe_rule(&oentry->rule);
			if (IS_ERR(nentry)) {
				list_del(&oentry->rule.list);
				audit_panic("error updating watch, removing");
			} else {
				int h = audit_hash_ino((u32)ino);

				/*
				 * nentry->rule.watch == oentry->rule.watch so
				 * we must drop that reference and set it to our
				 * new watch.
				 */
				audit_put_watch(nentry->rule.watch);
				audit_get_watch(nwatch);
				nentry->rule.watch = nwatch;
				list_add(&nentry->rule.rlist, &nwatch->rules);
				list_add_rcu(&nentry->list, &audit_inode_hash[h]);
				list_replace(&oentry->rule.list,
					     &nentry->rule.list);
			}
			if (oentry->rule.exe)
				audit_remove_mark(oentry->rule.exe);

			call_rcu(&oentry->rcu, audit_free_rule_rcu);
		}

		audit_remove_watch(owatch);
		goto add_watch_to_parent; /* event applies to a single watch */
	}
	mutex_unlock(&audit_filter_mutex);
	return;

add_watch_to_parent:
	list_add(&nwatch->wlist, &parent->watches);
	mutex_unlock(&audit_filter_mutex);
	return;
}

/* Remove all watches & rules associated with a parent that is going away. */
static void audit_remove_parent_watches(struct audit_parent *parent)
{
	struct audit_watch *w, *nextw;
	struct audit_krule *r, *nextr;
	struct audit_entry *e;

	mutex_lock(&audit_filter_mutex);
	list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
		list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
			e = container_of(r, struct audit_entry, rule);
			audit_watch_log_rule_change(r, w, "remove_rule");
			if (e->rule.exe)
				audit_remove_mark(e->rule.exe);
			list_del(&r->rlist);
			list_del(&r->list);
			list_del_rcu(&e->list);
			call_rcu(&e->rcu, audit_free_rule_rcu);
		}
		audit_remove_watch(w);
	}
	mutex_unlock(&audit_filter_mutex);

	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
}

/* Get path information necessary for adding watches. */
static int audit_get_nd(struct audit_watch *watch, struct path *parent)
{
	struct dentry *d = kern_path_locked(watch->path, parent);
	if (IS_ERR(d))
		return PTR_ERR(d);
	if (d_is_positive(d)) {
		/* update watch filter fields */
		watch->dev = d->d_sb->s_dev;
		watch->ino = d_backing_inode(d)->i_ino;
	}
	inode_unlock(d_backing_inode(parent->dentry));
	dput(d);
	return 0;
}

/* Associate the given rule with an existing parent.
 * Caller must hold audit_filter_mutex. */
static void audit_add_to_parent(struct audit_krule *krule,
				struct audit_parent *parent)
{
	struct audit_watch *w, *watch = krule->watch;
	int watch_found = 0;

	BUG_ON(!mutex_is_locked(&audit_filter_mutex));

	list_for_each_entry(w, &parent->watches, wlist) {
		if (strcmp(watch->path, w->path))
			continue;

		watch_found = 1;

		/* put krule's ref to temporary watch */
		audit_put_watch(watch);

		audit_get_watch(w);
		krule->watch = watch = w;

		audit_put_parent(parent);
		break;
	}

	if (!watch_found) {
		watch->parent = parent;

		audit_get_watch(watch);
		list_add(&watch->wlist, &parent->watches);
	}
	list_add(&krule->rlist, &watch->rules);
}

/* Find a matching watch entry, or add this one.
 * Caller must hold audit_filter_mutex. */
int audit_add_watch(struct audit_krule *krule, struct list_head **list)
{
	struct audit_watch *watch = krule->watch;
	struct audit_parent *parent;
	struct path parent_path;
	int h, ret = 0;

	/*
	 * When we will be calling audit_add_to_parent, krule->watch might have
	 * been updated and watch might have been freed.
	 * So we need to keep a reference of watch.
	 */
	audit_get_watch(watch);

	mutex_unlock(&audit_filter_mutex);

	/* Avoid calling path_lookup under audit_filter_mutex. */
	ret = audit_get_nd(watch, &parent_path);

	/* caller expects mutex locked */
	mutex_lock(&audit_filter_mutex);

	if (ret) {
		audit_put_watch(watch);
		return ret;
	}

	/* either find an old parent or attach a new one */
	parent = audit_find_parent(d_backing_inode(parent_path.dentry));
	if (!parent) {
		parent = audit_init_parent(&parent_path);
		if (IS_ERR(parent)) {
			ret = PTR_ERR(parent);
			goto error;
		}
	}

	audit_add_to_parent(krule, parent);

	h = audit_hash_ino((u32)watch->ino);
	*list = &audit_inode_hash[h];
error:
	path_put(&parent_path);
	audit_put_watch(watch);
	return ret;
}

void audit_remove_watch_rule(struct audit_krule *krule)
{
	struct audit_watch *watch = krule->watch;
	struct audit_parent *parent = watch->parent;

	list_del(&krule->rlist);

	if (list_empty(&watch->rules)) {
		/*
		 * audit_remove_watch() drops our reference to 'parent' which
		 * can get freed. Grab our own reference to be safe.
		 */
		audit_get_parent(parent);
		audit_remove_watch(watch);
		if (list_empty(&parent->watches))
			fsnotify_destroy_mark(&parent->mark, audit_watch_group);
		audit_put_parent(parent);
	}
}

/* Update watch data in audit rules based on fsnotify events. */
static int audit_watch_handle_event(struct fsnotify_mark *inode_mark, u32 mask,
				    struct inode *inode, struct inode *dir,
				    const struct qstr *dname, u32 cookie)
{
	struct audit_parent *parent;

	parent = container_of(inode_mark, struct audit_parent, mark);

	if (WARN_ON_ONCE(inode_mark->group != audit_watch_group))
		return 0;

	if (mask & (FS_CREATE|FS_MOVED_TO) && inode)
		audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
	else if (mask & (FS_DELETE|FS_MOVED_FROM))
		audit_update_watch(parent, dname, AUDIT_DEV_UNSET, AUDIT_INO_UNSET, 1);
	else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF))
		audit_remove_parent_watches(parent);

	return 0;
}

static const struct fsnotify_ops audit_watch_fsnotify_ops = {
	.handle_inode_event =	audit_watch_handle_event,
	.free_mark =		audit_watch_free_mark,
};

static int __init audit_watch_init(void)
{
	audit_watch_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops, 0);
	if (IS_ERR(audit_watch_group)) {
		audit_watch_group = NULL;
		audit_panic("cannot create audit fsnotify group");
	}
	return 0;
}
device_initcall(audit_watch_init);

int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old)
{
	struct audit_fsnotify_mark *audit_mark;
	char *pathname;

	pathname = kstrdup(audit_mark_path(old->exe), GFP_KERNEL);
	if (!pathname)
		return -ENOMEM;

	audit_mark = audit_alloc_mark(new, pathname, strlen(pathname));
	if (IS_ERR(audit_mark)) {
		kfree(pathname);
		return PTR_ERR(audit_mark);
	}
	new->exe = audit_mark;

	return 0;
}

int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
{
	struct file *exe_file;
	unsigned long ino;
	dev_t dev;

	/* only do exe filtering if we are recording @current events/records */
	if (tsk != current)
		return 0;

	if (!current->mm)
		return 0;
	exe_file = get_mm_exe_file(current->mm);
	if (!exe_file)
		return 0;
	ino = file_inode(exe_file)->i_ino;
	dev = file_inode(exe_file)->i_sb->s_dev;
	fput(exe_file);

	return audit_mark_compare(mark, ino, dev);
}
Commit	Line	Data
1a59d1b8	1	// SPDX-License-Identifier: GPL-2.0-or-later
cfcad62c EP	2	/* audit_watch.c -- watching inodes
	3	*
	4	* Copyright 2003-2009 Red Hat, Inc.
	5	* Copyright 2005 Hewlett-Packard Development Company, L.P.
	6	* Copyright 2005 IBM Corporation
cfcad62c EP	7	*/
cfcad62c EP	8
5efc2443	9	#include <linux/file.h>
cfcad62c EP	10	#include <linux/kernel.h>
	11	#include <linux/audit.h>
	12	#include <linux/kthread.h>
	13	#include <linux/mutex.h>
	14	#include <linux/fs.h>
e9fd702a	15	#include <linux/fsnotify_backend.h>
cfcad62c EP	16	#include <linux/namei.h>
cfcad62c EP	17	#include <linux/netlink.h>
bd120ded	18	#include <linux/refcount.h>
cfcad62c	19	#include <linux/sched.h>
5a0e3ad6	20	#include <linux/slab.h>
cfcad62c EP	21	#include <linux/security.h>
	22	#include "audit.h"
	23
	24	/*
	25	* Reference counting:
	26	*
e9fd702a	27	* audit_parent: lifetime is from audit_init_parent() to receipt of an FS_IGNORED
cfcad62c EP	28	* event. Each audit_watch holds a reference to its associated parent.
	29	*
	30	* audit_watch: if added to lists, lifetime is from audit_init_watch() to
	31	* audit_remove_watch(). Additionally, an audit_watch may exist
	32	* temporarily to assist in searching existing filter data. Each
	33	* audit_krule holds a reference to its associated watch.
	34	*/
	35
	36	struct audit_watch {
bd120ded	37	refcount_t count; /* reference count */
cfcad62c	38	dev_t dev; /* associated superblock device */
e08b061e	39	char path; / insertion path */
cfcad62c EP	40	unsigned long ino; /* associated inode number */
	41	struct audit_parent parent; / associated parent */
	42	struct list_head wlist; /* entry in parent->watches list */
ae7b8f41	43	struct list_head rules; /* anchor for krule->rlist */
cfcad62c EP	44	};
	45
	46	struct audit_parent {
ae7b8f41	47	struct list_head watches; /* anchor for audit_watch->wlist */
e61ce867	48	struct fsnotify_mark mark; /* fsnotify mark on the inode */
cfcad62c EP	49	};
cfcad62c EP	50
e9fd702a	51	/* fsnotify handle. */
b8800aa5	52	static struct fsnotify_group *audit_watch_group;
cfcad62c	53
e9fd702a EP	54	/* fsnotify events we care about. */
e9fd702a EP	55	#define AUDIT_FS_WATCH (FS_MOVE \| FS_CREATE \| FS_DELETE \| FS_DELETE_SELF \|\
7dbe6080	56	FS_MOVE_SELF \| FS_UNMOUNT)
cfcad62c	57
ae7b8f41 EP	58	static void audit_free_parent(struct audit_parent *parent)
	59	{
	60	WARN_ON(!list_empty(&parent->watches));
	61	kfree(parent);
	62	}
	63
e61ce867	64	static void audit_watch_free_mark(struct fsnotify_mark *entry)
cfcad62c EP	65	{
	66	struct audit_parent *parent;
	67
e9fd702a	68	parent = container_of(entry, struct audit_parent, mark);
ae7b8f41	69	audit_free_parent(parent);
cfcad62c EP	70	}
cfcad62c EP	71
e9fd702a EP	72	static void audit_get_parent(struct audit_parent *parent)
	73	{
	74	if (likely(parent))
	75	fsnotify_get_mark(&parent->mark);
	76	}
	77
	78	static void audit_put_parent(struct audit_parent *parent)
	79	{
	80	if (likely(parent))
	81	fsnotify_put_mark(&parent->mark);
	82	}
	83
	84	/*
	85	* Find and return the audit_parent on the given inode. If found a reference
	86	* is taken on this parent.
	87	*/
	88	static inline struct audit_parent audit_find_parent(struct inode inode)
	89	{
	90	struct audit_parent *parent = NULL;
e61ce867	91	struct fsnotify_mark *entry;
e9fd702a	92
230d97d3	93	entry = fsnotify_find_inode_mark(inode, audit_watch_group);
e9fd702a EP	94	if (entry)
	95	parent = container_of(entry, struct audit_parent, mark);
	96
	97	return parent;
	98	}
	99
cfcad62c EP	100	void audit_get_watch(struct audit_watch *watch)
cfcad62c EP	101	{
bd120ded	102	refcount_inc(&watch->count);
cfcad62c EP	103	}
	104
	105	void audit_put_watch(struct audit_watch *watch)
	106	{
bd120ded	107	if (refcount_dec_and_test(&watch->count)) {
cfcad62c EP	108	WARN_ON(watch->parent);
	109	WARN_ON(!list_empty(&watch->rules));
	110	kfree(watch->path);
	111	kfree(watch);
	112	}
	113	}
	114
b8800aa5	115	static void audit_remove_watch(struct audit_watch *watch)
cfcad62c EP	116	{
cfcad62c EP	117	list_del(&watch->wlist);
e9fd702a	118	audit_put_parent(watch->parent);
cfcad62c EP	119	watch->parent = NULL;
	120	audit_put_watch(watch); /* match initial get */
	121	}
	122
	123	char audit_watch_path(struct audit_watch watch)
	124	{
	125	return watch->path;
	126	}
	127
ae7b8f41	128	int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
cfcad62c	129	{
84cb777e	130	return (watch->ino != AUDIT_INO_UNSET) &&
ae7b8f41 EP	131	(watch->ino == ino) &&
ae7b8f41 EP	132	(watch->dev == dev);
cfcad62c EP	133	}
	134
	135	/* Initialize a parent watch entry. */
bf2e1ae4	136	static struct audit_parent audit_init_parent(const struct path path)
cfcad62c	137	{
3b362157	138	struct inode *inode = d_backing_inode(path->dentry);
cfcad62c	139	struct audit_parent *parent;
e9fd702a	140	int ret;
cfcad62c EP	141
	142	parent = kzalloc(sizeof(*parent), GFP_KERNEL);
	143	if (unlikely(!parent))
	144	return ERR_PTR(-ENOMEM);
	145
	146	INIT_LIST_HEAD(&parent->watches);
cfcad62c	147
054c636e	148	fsnotify_init_mark(&parent->mark, audit_watch_group);
e9fd702a	149	parent->mark.mask = AUDIT_FS_WATCH;
b249f5be	150	ret = fsnotify_add_inode_mark(&parent->mark, inode, 0);
e9fd702a	151	if (ret < 0) {
ae7b8f41	152	audit_free_parent(parent);
e9fd702a	153	return ERR_PTR(ret);
cfcad62c EP	154	}
	155
	156	return parent;
	157	}
	158
	159	/* Initialize a watch entry. */
	160	static struct audit_watch audit_init_watch(char path)
	161	{
	162	struct audit_watch *watch;
	163
	164	watch = kzalloc(sizeof(*watch), GFP_KERNEL);
	165	if (unlikely(!watch))
	166	return ERR_PTR(-ENOMEM);
	167
	168	INIT_LIST_HEAD(&watch->rules);
bd120ded	169	refcount_set(&watch->count, 1);
cfcad62c	170	watch->path = path;
84cb777e RGB	171	watch->dev = AUDIT_DEV_UNSET;
84cb777e RGB	172	watch->ino = AUDIT_INO_UNSET;
cfcad62c EP	173
	174	return watch;
	175	}
	176
fd97646b	177	/* Translate a watch string to kernel representation. */
cfcad62c EP	178	int audit_to_watch(struct audit_krule krule, char path, int len, u32 op)
	179	{
	180	struct audit_watch *watch;
	181
e9fd702a	182	if (!audit_watch_group)
cfcad62c EP	183	return -EOPNOTSUPP;
	184
	185	if (path[0] != '/' \|\| path[len-1] == '/' \|\|
67daf270 PM	186	(krule->listnr != AUDIT_FILTER_EXIT &&
67daf270 PM	187	krule->listnr != AUDIT_FILTER_URING_EXIT) \|\|
cfcad62c EP	188	op != Audit_equal \|\|
	189	krule->inode_f \|\| krule->watch \|\| krule->tree)
	190	return -EINVAL;
	191
	192	watch = audit_init_watch(path);
	193	if (IS_ERR(watch))
	194	return PTR_ERR(watch);
	195
cfcad62c EP	196	krule->watch = watch;
	197
	198	return 0;
	199	}
	200
	201	/* Duplicate the given audit watch. The new watch's rules list is initialized
	202	* to an empty list and wlist is undefined. */
	203	static struct audit_watch audit_dupe_watch(struct audit_watch old)
	204	{
	205	char *path;
	206	struct audit_watch *new;
	207
	208	path = kstrdup(old->path, GFP_KERNEL);
	209	if (unlikely(!path))
	210	return ERR_PTR(-ENOMEM);
	211
	212	new = audit_init_watch(path);
	213	if (IS_ERR(new)) {
	214	kfree(path);
	215	goto out;
	216	}
	217
	218	new->dev = old->dev;
	219	new->ino = old->ino;
e9fd702a	220	audit_get_parent(old->parent);
cfcad62c EP	221	new->parent = old->parent;
	222
	223	out:
	224	return new;
	225	}
	226
	227	static void audit_watch_log_rule_change(struct audit_krule r, struct audit_watch w, char *op)
	228	{
4fa7f086 RGB	229	struct audit_buffer *ab;
	230
	231	if (!audit_enabled)
	232	return;
626abcd1	233	ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE);
4fa7f086 RGB	234	if (!ab)
4fa7f086 RGB	235	return;
a2c97da1	236	audit_log_session_info(ab);
d0a3f18a	237	audit_log_format(ab, "op=%s path=", op);
4fa7f086 RGB	238	audit_log_untrustedstring(ab, w->path);
	239	audit_log_key(ab, r->filterkey);
	240	audit_log_format(ab, " list=%d res=1", r->listnr);
	241	audit_log_end(ab);
cfcad62c EP	242	}
	243
	244	/* Update inode info in audit rules based on filesystem event. */
	245	static void audit_update_watch(struct audit_parent *parent,
6921d4eb	246	const struct qstr *dname, dev_t dev,
cfcad62c EP	247	unsigned long ino, unsigned invalidating)
	248	{
	249	struct audit_watch owatch, nwatch, *nextw;
	250	struct audit_krule r, nextr;
	251	struct audit_entry oentry, nentry;
	252
	253	mutex_lock(&audit_filter_mutex);
ae7b8f41 EP	254	/* Run all of the watches on this parent looking for the one that
ae7b8f41 EP	255	* matches the given dname */
cfcad62c	256	list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
795d673a	257	if (audit_compare_dname_path(dname, owatch->path,
e3d6b07b	258	AUDIT_NAME_FULL))
cfcad62c EP	259	continue;
	260
	261	/* If the update involves invalidating rules, do the inode-based
	262	* filtering now, so we don't omit records. */
ae7b8f41	263	if (invalidating && !audit_dummy_context())
cdfb6b34	264	audit_filter_inodes(current, audit_context());
cfcad62c	265
ae7b8f41 EP	266	/* updating ino will likely change which audit_hash_list we
ae7b8f41 EP	267	* are on so we need a new watch for the new list */
cfcad62c EP	268	nwatch = audit_dupe_watch(owatch);
	269	if (IS_ERR(nwatch)) {
	270	mutex_unlock(&audit_filter_mutex);
	271	audit_panic("error updating watch, skipping");
	272	return;
	273	}
	274	nwatch->dev = dev;
	275	nwatch->ino = ino;
	276
	277	list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) {
	278
	279	oentry = container_of(r, struct audit_entry, rule);
	280	list_del(&oentry->rule.rlist);
	281	list_del_rcu(&oentry->list);
	282
ae7b8f41	283	nentry = audit_dupe_rule(&oentry->rule);
cfcad62c EP	284	if (IS_ERR(nentry)) {
	285	list_del(&oentry->rule.list);
	286	audit_panic("error updating watch, removing");
	287	} else {
	288	int h = audit_hash_ino((u32)ino);
ae7b8f41 EP	289
	290	/*
	291	* nentry->rule.watch == oentry->rule.watch so
	292	* we must drop that reference and set it to our
	293	* new watch.
	294	*/
	295	audit_put_watch(nentry->rule.watch);
	296	audit_get_watch(nwatch);
	297	nentry->rule.watch = nwatch;
cfcad62c EP	298	list_add(&nentry->rule.rlist, &nwatch->rules);
	299	list_add_rcu(&nentry->list, &audit_inode_hash[h]);
	300	list_replace(&oentry->rule.list,
	301	&nentry->rule.list);
	302	}
34d99af5 RGB	303	if (oentry->rule.exe)
34d99af5 RGB	304	audit_remove_mark(oentry->rule.exe);
cfcad62c	305
cfcad62c EP	306	call_rcu(&oentry->rcu, audit_free_rule_rcu);
	307	}
	308
	309	audit_remove_watch(owatch);
	310	goto add_watch_to_parent; /* event applies to a single watch */
	311	}
	312	mutex_unlock(&audit_filter_mutex);
	313	return;
	314
	315	add_watch_to_parent:
	316	list_add(&nwatch->wlist, &parent->watches);
	317	mutex_unlock(&audit_filter_mutex);
	318	return;
	319	}
	320
	321	/* Remove all watches & rules associated with a parent that is going away. */
	322	static void audit_remove_parent_watches(struct audit_parent *parent)
	323	{
	324	struct audit_watch w, nextw;
	325	struct audit_krule r, nextr;
	326	struct audit_entry *e;
	327
	328	mutex_lock(&audit_filter_mutex);
cfcad62c EP	329	list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
	330	list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
	331	e = container_of(r, struct audit_entry, rule);
e7df61f4	332	audit_watch_log_rule_change(r, w, "remove_rule");
34d99af5 RGB	333	if (e->rule.exe)
34d99af5 RGB	334	audit_remove_mark(e->rule.exe);
cfcad62c EP	335	list_del(&r->rlist);
	336	list_del(&r->list);
	337	list_del_rcu(&e->list);
	338	call_rcu(&e->rcu, audit_free_rule_rcu);
	339	}
	340	audit_remove_watch(w);
	341	}
	342	mutex_unlock(&audit_filter_mutex);
e9fd702a	343
e2a29943	344	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
cfcad62c EP	345	}
cfcad62c EP	346
cfcad62c	347	/* Get path information necessary for adding watches. */
15a9155f	348	static int audit_get_nd(struct audit_watch watch, struct path parent)
cfcad62c	349	{
79714f72 AV	350	struct dentry *d = kern_path_locked(watch->path, parent);
79714f72 AV	351	if (IS_ERR(d))
15a9155f	352	return PTR_ERR(d);
3b362157	353	if (d_is_positive(d)) {
15a9155f	354	/* update watch filter fields */
fc64005c	355	watch->dev = d->d_sb->s_dev;
3b362157	356	watch->ino = d_backing_inode(d)->i_ino;
cfcad62c	357	}
69924b89	358	inode_unlock(d_backing_inode(parent->dentry));
15a9155f	359	dput(d);
cfcad62c EP	360	return 0;
	361	}
	362
e9fd702a	363	/* Associate the given rule with an existing parent.
cfcad62c EP	364	* Caller must hold audit_filter_mutex. */
	365	static void audit_add_to_parent(struct audit_krule *krule,
	366	struct audit_parent *parent)
	367	{
	368	struct audit_watch w, watch = krule->watch;
	369	int watch_found = 0;
	370
e9fd702a EP	371	BUG_ON(!mutex_is_locked(&audit_filter_mutex));
e9fd702a EP	372
cfcad62c EP	373	list_for_each_entry(w, &parent->watches, wlist) {
	374	if (strcmp(watch->path, w->path))
	375	continue;
	376
	377	watch_found = 1;
	378
f8259b26	379	/* put krule's ref to temporary watch */
cfcad62c EP	380	audit_put_watch(watch);
	381
	382	audit_get_watch(w);
	383	krule->watch = watch = w;
aa7c043d RGB	384
aa7c043d RGB	385	audit_put_parent(parent);
cfcad62c EP	386	break;
	387	}
	388
	389	if (!watch_found) {
cfcad62c EP	390	watch->parent = parent;
cfcad62c EP	391
f8259b26	392	audit_get_watch(watch);
cfcad62c EP	393	list_add(&watch->wlist, &parent->watches);
	394	}
	395	list_add(&krule->rlist, &watch->rules);
	396	}
	397
	398	/* Find a matching watch entry, or add this one.
	399	* Caller must hold audit_filter_mutex. */
ae7b8f41	400	int audit_add_watch(struct audit_krule krule, struct list_head *list)
cfcad62c EP	401	{
cfcad62c EP	402	struct audit_watch *watch = krule->watch;
cfcad62c	403	struct audit_parent *parent;
15a9155f	404	struct path parent_path;
ae7b8f41	405	int h, ret = 0;
cfcad62c	406
baa2a4fd RC	407	/*
	408	* When we will be calling audit_add_to_parent, krule->watch might have
	409	* been updated and watch might have been freed.
	410	* So we need to keep a reference of watch.
	411	*/
	412	audit_get_watch(watch);
	413
35fe4d0b EP	414	mutex_unlock(&audit_filter_mutex);
	415
	416	/* Avoid calling path_lookup under audit_filter_mutex. */
15a9155f	417	ret = audit_get_nd(watch, &parent_path);
35fe4d0b	418
15a9155f	419	/* caller expects mutex locked */
e118e9c5 EP	420	mutex_lock(&audit_filter_mutex);
e118e9c5 EP	421
baa2a4fd RC	422	if (ret) {
baa2a4fd RC	423	audit_put_watch(watch);
15a9155f	424	return ret;
baa2a4fd	425	}
cfcad62c	426
e118e9c5	427	/* either find an old parent or attach a new one */
3b362157	428	parent = audit_find_parent(d_backing_inode(parent_path.dentry));
e9fd702a	429	if (!parent) {
15a9155f	430	parent = audit_init_parent(&parent_path);
cfcad62c	431	if (IS_ERR(parent)) {
35fe4d0b EP	432	ret = PTR_ERR(parent);
35fe4d0b EP	433	goto error;
cfcad62c	434	}
e9fd702a	435	}
cfcad62c	436
e118e9c5	437	audit_add_to_parent(krule, parent);
cfcad62c	438
ae7b8f41 EP	439	h = audit_hash_ino((u32)watch->ino);
ae7b8f41 EP	440	*list = &audit_inode_hash[h];
35fe4d0b	441	error:
15a9155f	442	path_put(&parent_path);
baa2a4fd	443	audit_put_watch(watch);
cfcad62c EP	444	return ret;
	445	}
	446
a05fb6cc	447	void audit_remove_watch_rule(struct audit_krule *krule)
cfcad62c EP	448	{
	449	struct audit_watch *watch = krule->watch;
	450	struct audit_parent *parent = watch->parent;
	451
	452	list_del(&krule->rlist);
	453
	454	if (list_empty(&watch->rules)) {
d76036ab JK	455	/*
	456	* audit_remove_watch() drops our reference to 'parent' which
	457	* can get freed. Grab our own reference to be safe.
	458	*/
	459	audit_get_parent(parent);
cfcad62c	460	audit_remove_watch(watch);
d76036ab	461	if (list_empty(&parent->watches))
e2a29943	462	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
d76036ab	463	audit_put_parent(parent);
cfcad62c EP	464	}
	465	}
	466
e9fd702a	467	/* Update watch data in audit rules based on fsnotify events. */
b9a1b977 AG	468	static int audit_watch_handle_event(struct fsnotify_mark *inode_mark, u32 mask,
b9a1b977 AG	469	struct inode inode, struct inode dir,
950cc0d2	470	const struct qstr *dname, u32 cookie)
e9fd702a	471	{
cfcad62c EP	472	struct audit_parent *parent;
cfcad62c EP	473
ce8f76fb	474	parent = container_of(inode_mark, struct audit_parent, mark);
e9fd702a	475
dabe729d	476	if (WARN_ON_ONCE(inode_mark->group != audit_watch_group))
b9a1b977	477	return 0;
cfcad62c	478
e9fd702a	479	if (mask & (FS_CREATE\|FS_MOVED_TO) && inode)
6921d4eb	480	audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
e9fd702a	481	else if (mask & (FS_DELETE\|FS_MOVED_FROM))
6921d4eb	482	audit_update_watch(parent, dname, AUDIT_DEV_UNSET, AUDIT_INO_UNSET, 1);
e9fd702a	483	else if (mask & (FS_DELETE_SELF\|FS_UNMOUNT\|FS_MOVE_SELF))
cfcad62c	484	audit_remove_parent_watches(parent);
e9fd702a EP	485
	486	return 0;
	487	}
	488
e9fd702a	489	static const struct fsnotify_ops audit_watch_fsnotify_ops = {
b9a1b977	490	.handle_inode_event = audit_watch_handle_event,
054c636e	491	.free_mark = audit_watch_free_mark,
cfcad62c EP	492	};
	493
	494	static int __init audit_watch_init(void)
	495	{
867a448d	496	audit_watch_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops, 0);
e9fd702a EP	497	if (IS_ERR(audit_watch_group)) {
	498	audit_watch_group = NULL;
	499	audit_panic("cannot create audit fsnotify group");
	500	}
cfcad62c EP	501	return 0;
cfcad62c EP	502	}
1a3aedbc	503	device_initcall(audit_watch_init);
34d99af5 RGB	504
	505	int audit_dupe_exe(struct audit_krule new, struct audit_krule old)
	506	{
	507	struct audit_fsnotify_mark *audit_mark;
	508	char *pathname;
	509
	510	pathname = kstrdup(audit_mark_path(old->exe), GFP_KERNEL);
	511	if (!pathname)
	512	return -ENOMEM;
	513
	514	audit_mark = audit_alloc_mark(new, pathname, strlen(pathname));
	515	if (IS_ERR(audit_mark)) {
	516	kfree(pathname);
	517	return PTR_ERR(audit_mark);
	518	}
	519	new->exe = audit_mark;
	520
	521	return 0;
	522	}
	523
	524	int audit_exe_compare(struct task_struct tsk, struct audit_fsnotify_mark mark)
	525	{
15ce414b RGB	526	struct file *exe_file;
	527	unsigned long ino;
	528	dev_t dev;
	529
47846d51 PM	530	/* only do exe filtering if we are recording @current events/records */
	531	if (tsk != current)
	532	return 0;
	533
969d90ec	534	if (!current->mm)
47846d51 PM	535	return 0;
47846d51 PM	536	exe_file = get_mm_exe_file(current->mm);
5efc2443 MG	537	if (!exe_file)
5efc2443 MG	538	return 0;
45063097 AV	539	ino = file_inode(exe_file)->i_ino;
45063097 AV	540	dev = file_inode(exe_file)->i_sb->s_dev;
5efc2443	541	fput(exe_file);
47846d51	542
34d99af5 RGB	543	return audit_mark_compare(mark, ino, dev);
34d99af5 RGB	544	}