Release 4.7 kernel/audit_watch.c

/* audit_watch.c -- watching inodes
 *
 * Copyright 2003-2009 Red Hat, Inc.
 * Copyright 2005 Hewlett-Packard Development Company, L.P.
 * Copyright 2005 IBM Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */

#include <linux/kernel.h>
#include <linux/audit.h>
#include <linux/kthread.h>
#include <linux/mutex.h>
#include <linux/fs.h>
#include <linux/fsnotify_backend.h>
#include <linux/namei.h>
#include <linux/netlink.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/security.h>
#include "audit.h"

/*
 * Reference counting:
 *
 * audit_parent: lifetime is from audit_init_parent() to receipt of an FS_IGNORED
 *      event.  Each audit_watch holds a reference to its associated parent.
 *
 * audit_watch: if added to lists, lifetime is from audit_init_watch() to
 *      audit_remove_watch().  Additionally, an audit_watch may exist
 *      temporarily to assist in searching existing filter data.  Each
 *      audit_krule holds a reference to its associated watch.
 */


struct audit_watch {
	
atomic_t		count;	/* reference count */
	
dev_t			dev;	/* associated superblock device */
	
char			*path;	/* insertion path */
	
unsigned long		ino;	/* associated inode number */
	
struct audit_parent	*parent; /* associated parent */
	
struct list_head	wlist;	/* entry in parent->watches list */
	
struct list_head	rules;	/* anchor for krule->rlist */
};


struct audit_parent {
	
struct list_head	watches; /* anchor for audit_watch->wlist */
	
struct fsnotify_mark mark; /* fsnotify mark on the inode */
};

/* fsnotify handle. */

static struct fsnotify_group *audit_watch_group;

/* fsnotify events we care about. */

#define AUDIT_FS_WATCH (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
                        FS_MOVE_SELF | FS_EVENT_ON_CHILD)



static void audit_free_parent(struct audit_parent *parent)
{
	WARN_ON(!list_empty(&parent->watches));
	kfree(parent);
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
28
100.00%
2
100.00%
Total
28
100.00%
2
100.00%



static void audit_watch_free_mark(struct fsnotify_mark *entry)
{
	struct audit_parent *parent;

	parent = container_of(entry, struct audit_parent, mark);
	audit_free_parent(parent);
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
33
100.00%
4
100.00%
Total
33
100.00%
4
100.00%



static void audit_get_parent(struct audit_parent *parent)
{
	if (likely(parent))
		fsnotify_get_mark(&parent->mark);
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
26
100.00%
1
100.00%
Total
26
100.00%
1
100.00%



static void audit_put_parent(struct audit_parent *parent)
{
	if (likely(parent))
		fsnotify_put_mark(&parent->mark);
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
26
100.00%
1
100.00%
Total
26
100.00%
1
100.00%

/*
 * Find and return the audit_parent on the given inode.  If found a reference
 * is taken on this parent.
 */


static inline struct audit_parent *audit_find_parent(struct inode *inode)
{
	struct audit_parent *parent = NULL;
	struct fsnotify_mark *entry;

	entry = fsnotify_find_inode_mark(audit_watch_group, inode);
	if (entry)
		parent = container_of(entry, struct audit_parent, mark);

	return parent;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
54
100.00%
3
100.00%
Total
54
100.00%
3
100.00%



void audit_get_watch(struct audit_watch *watch)
{
	atomic_inc(&watch->count);
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
18
100.00%
1
100.00%
Total
18
100.00%
1
100.00%



void audit_put_watch(struct audit_watch *watch)
{
	if (atomic_dec_and_test(&watch->count)) {
		WARN_ON(watch->parent);
		WARN_ON(!list_empty(&watch->rules));
		kfree(watch->path);
		kfree(watch);
	}
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
53
100.00%
1
100.00%
Total
53
100.00%
1
100.00%



static void audit_remove_watch(struct audit_watch *watch)
{
	list_del(&watch->wlist);
	audit_put_parent(watch->parent);
	watch->parent = NULL;
	audit_put_watch(watch); /* match initial get */
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
37
97.37%
2
66.67%
stephen hemminger
stephen hemminger
1
2.63%
1
33.33%
Total
38
100.00%
3
100.00%



char *audit_watch_path(struct audit_watch *watch)
{
	return watch->path;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
16
100.00%
1
100.00%
Total
16
100.00%
1
100.00%



int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
{
	return (watch->ino != AUDIT_INO_UNSET) &&
		(watch->ino == ino) &&
		(watch->dev == dev);
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
41
97.62%
2
66.67%
richard guy briggs
richard guy briggs
1
2.38%
1
33.33%
Total
42
100.00%
3
100.00%

/* Initialize a parent watch entry. */


static struct audit_parent *audit_init_parent(struct path *path)
{
	struct inode *inode = d_backing_inode(path->dentry);
	struct audit_parent *parent;
	int ret;

	parent = kzalloc(sizeof(*parent), GFP_KERNEL);
	if (unlikely(!parent))
		return ERR_PTR(-ENOMEM);

	INIT_LIST_HEAD(&parent->watches);

	fsnotify_init_mark(&parent->mark, audit_watch_free_mark);
	parent->mark.mask = AUDIT_FS_WATCH;
	ret = fsnotify_add_mark(&parent->mark, audit_watch_group, inode, NULL, 0);
	if (ret < 0) {
		audit_free_parent(parent);
		return ERR_PTR(ret);
	}

	return parent;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
121
95.28%
4
66.67%
al viro
al viro
3
2.36%
1
16.67%
david howells
david howells
3
2.36%
1
16.67%
Total
127
100.00%
6
100.00%

/* Initialize a watch entry. */


static struct audit_watch *audit_init_watch(char *path)
{
	struct audit_watch *watch;

	watch = kzalloc(sizeof(*watch), GFP_KERNEL);
	if (unlikely(!watch))
		return ERR_PTR(-ENOMEM);

	INIT_LIST_HEAD(&watch->rules);
	atomic_set(&watch->count, 1);
	watch->path = path;
	watch->dev = AUDIT_DEV_UNSET;
	watch->ino = AUDIT_INO_UNSET;

	return watch;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
82
97.62%
1
50.00%
richard guy briggs
richard guy briggs
2
2.38%
1
50.00%
Total
84
100.00%
2
100.00%

/* Translate a watch string to kernel representation. */


int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op)
{
	struct audit_watch *watch;

	if (!audit_watch_group)
		return -EOPNOTSUPP;

	if (path[0] != '/' || path[len-1] == '/' ||
	    krule->listnr != AUDIT_FILTER_EXIT ||
	    op != Audit_equal ||
	    krule->inode_f || krule->watch || krule->tree)
		return -EINVAL;

	watch = audit_init_watch(path);
	if (IS_ERR(watch))
		return PTR_ERR(watch);

	krule->watch = watch;

	return 0;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
107
100.00%
2
100.00%
Total
107
100.00%
2
100.00%

/* Duplicate the given audit watch.  The new watch's rules list is initialized
 * to an empty list and wlist is undefined. */


static struct audit_watch *audit_dupe_watch(struct audit_watch *old)
{
	char *path;
	struct audit_watch *new;

	path = kstrdup(old->path, GFP_KERNEL);
	if (unlikely(!path))
		return ERR_PTR(-ENOMEM);

	new = audit_init_watch(path);
	if (IS_ERR(new)) {
		kfree(path);
		goto out;
	}

	new->dev = old->dev;
	new->ino = old->ino;
	audit_get_parent(old->parent);
	new->parent = old->parent;

out:
	return new;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
108
100.00%
2
100.00%
Total
108
100.00%
2
100.00%



static void audit_watch_log_rule_change(struct audit_krule *r, struct audit_watch *w, char *op)
{
	if (audit_enabled) {
		struct audit_buffer *ab;
		ab = audit_log_start(NULL, GFP_NOFS, AUDIT_CONFIG_CHANGE);
		if (unlikely(!ab))
			return;
		audit_log_format(ab, "auid=%u ses=%u op=",
				 from_kuid(&init_user_ns, audit_get_loginuid(current)),
				 audit_get_sessionid(current));
		audit_log_string(ab, op);
		audit_log_format(ab, " path=");
		audit_log_untrustedstring(ab, w->path);
		audit_log_key(ab, r->filterkey);
		audit_log_format(ab, " list=%d res=1", r->listnr);
		audit_log_end(ab);
	}
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
107
87.70%
2
50.00%
kees cook
kees cook
9
7.38%
1
25.00%
eric w. biederman
eric w. biederman
6
4.92%
1
25.00%
Total
122
100.00%
4
100.00%

/* Update inode info in audit rules based on filesystem event. */


static void audit_update_watch(struct audit_parent *parent,
			       const char *dname, dev_t dev,
			       unsigned long ino, unsigned invalidating)
{
	struct audit_watch *owatch, *nwatch, *nextw;
	struct audit_krule *r, *nextr;
	struct audit_entry *oentry, *nentry;

	mutex_lock(&audit_filter_mutex);
	/* Run all of the watches on this parent looking for the one that
         * matches the given dname */
	list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
		if (audit_compare_dname_path(dname, owatch->path,
					     AUDIT_NAME_FULL))
			continue;

		/* If the update involves invalidating rules, do the inode-based
                 * filtering now, so we don't omit records. */
		if (invalidating && !audit_dummy_context())
			audit_filter_inodes(current, current->audit_context);

		/* updating ino will likely change which audit_hash_list we
                 * are on so we need a new watch for the new list */
		nwatch = audit_dupe_watch(owatch);
		if (IS_ERR(nwatch)) {
			mutex_unlock(&audit_filter_mutex);
			audit_panic("error updating watch, skipping");
			return;
		}
		nwatch->dev = dev;
		nwatch->ino = ino;

		list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) {

			oentry = container_of(r, struct audit_entry, rule);
			list_del(&oentry->rule.rlist);
			list_del_rcu(&oentry->list);

			nentry = audit_dupe_rule(&oentry->rule);
			if (IS_ERR(nentry)) {
				list_del(&oentry->rule.list);
				audit_panic("error updating watch, removing");
			} else {
				int h = audit_hash_ino((u32)ino);

				/*
                                 * nentry->rule.watch == oentry->rule.watch so
                                 * we must drop that reference and set it to our
                                 * new watch.
                                 */
				audit_put_watch(nentry->rule.watch);
				audit_get_watch(nwatch);
				nentry->rule.watch = nwatch;
				list_add(&nentry->rule.rlist, &nwatch->rules);
				list_add_rcu(&nentry->list, &audit_inode_hash[h]);
				list_replace(&oentry->rule.list,
					     &nentry->rule.list);
			}
			if (oentry->rule.exe)
				audit_remove_mark(oentry->rule.exe);

			audit_watch_log_rule_change(r, owatch, "updated_rules");

			call_rcu(&oentry->rcu, audit_free_rule_rcu);
		}

		audit_remove_watch(owatch);
		goto add_watch_to_parent; /* event applies to a single watch */
	}
	mutex_unlock(&audit_filter_mutex);
	return;

add_watch_to_parent:
	list_add(&nwatch->wlist, &parent->watches);
	mutex_unlock(&audit_filter_mutex);
	return;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
358
94.71%
2
40.00%
richard guy briggs
richard guy briggs
17
4.50%
1
20.00%
jeff layton
jeff layton
2
0.53%
1
20.00%
burn alting
burn alting
1
0.26%
1
20.00%
Total
378
100.00%
5
100.00%

/* Remove all watches & rules associated with a parent that is going away. */


static void audit_remove_parent_watches(struct audit_parent *parent)
{
	struct audit_watch *w, *nextw;
	struct audit_krule *r, *nextr;
	struct audit_entry *e;

	mutex_lock(&audit_filter_mutex);
	list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
		list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
			e = container_of(r, struct audit_entry, rule);
			audit_watch_log_rule_change(r, w, "remove_rule");
			if (e->rule.exe)
				audit_remove_mark(e->rule.exe);
			list_del(&r->rlist);
			list_del(&r->list);
			list_del_rcu(&e->list);
			call_rcu(&e->rcu, audit_free_rule_rcu);
		}
		audit_remove_watch(w);
	}
	mutex_unlock(&audit_filter_mutex);

	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
135
87.10%
3
50.00%
richard guy briggs
richard guy briggs
17
10.97%
1
16.67%
lino sanfilippo
lino sanfilippo
2
1.29%
1
16.67%
burn alting
burn alting
1
0.65%
1
16.67%
Total
155
100.00%
6
100.00%

/* Get path information necessary for adding watches. */


static int audit_get_nd(struct audit_watch *watch, struct path *parent)
{
	struct dentry *d = kern_path_locked(watch->path, parent);
	if (IS_ERR(d))
		return PTR_ERR(d);
	inode_unlock(d_backing_inode(parent->dentry));
	if (d_is_positive(d)) {
		/* update watch filter fields */
		watch->dev = d->d_sb->s_dev;
		watch->ino = d_backing_inode(d)->i_ino;
	}
	dput(d);
	return 0;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
al viro
al viro
52
56.52%
4
57.14%
eric paris
eric paris
31
33.70%
2
28.57%
david howells
david howells
9
9.78%
1
14.29%
Total
92
100.00%
7
100.00%

/* Associate the given rule with an existing parent.
 * Caller must hold audit_filter_mutex. */


static void audit_add_to_parent(struct audit_krule *krule,
				struct audit_parent *parent)
{
	struct audit_watch *w, *watch = krule->watch;
	int watch_found = 0;

	BUG_ON(!mutex_is_locked(&audit_filter_mutex));

	list_for_each_entry(w, &parent->watches, wlist) {
		if (strcmp(watch->path, w->path))
			continue;

		watch_found = 1;

		/* put krule's ref to temporary watch */
		audit_put_watch(watch);

		audit_get_watch(w);
		krule->watch = watch = w;

		audit_put_parent(parent);
		break;
	}

	if (!watch_found) {
		watch->parent = parent;

		audit_get_watch(watch);
		list_add(&watch->wlist, &parent->watches);
	}
	list_add(&krule->rlist, &watch->rules);
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
129
92.14%
2
50.00%
richard guy briggs
richard guy briggs
11
7.86%
2
50.00%
Total
140
100.00%
4
100.00%

/* Find a matching watch entry, or add this one.
 * Caller must hold audit_filter_mutex. */


int audit_add_watch(struct audit_krule *krule, struct list_head **list)
{
	struct audit_watch *watch = krule->watch;
	struct audit_parent *parent;
	struct path parent_path;
	int h, ret = 0;

	mutex_unlock(&audit_filter_mutex);

	/* Avoid calling path_lookup under audit_filter_mutex. */
	ret = audit_get_nd(watch, &parent_path);

	/* caller expects mutex locked */
	mutex_lock(&audit_filter_mutex);

	if (ret)
		return ret;

	/* either find an old parent or attach a new one */
	parent = audit_find_parent(d_backing_inode(parent_path.dentry));
	if (!parent) {
		parent = audit_init_parent(&parent_path);
		if (IS_ERR(parent)) {
			ret = PTR_ERR(parent);
			goto error;
		}
	}

	audit_add_to_parent(krule, parent);

	h = audit_hash_ino((u32)watch->ino);
	*list = &audit_inode_hash[h];
error:
	path_put(&parent_path);
	return ret;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
142
89.87%
5
71.43%
al viro
al viro
13
8.23%
1
14.29%
david howells
david howells
3
1.90%
1
14.29%
Total
158
100.00%
7
100.00%



void audit_remove_watch_rule(struct audit_krule *krule)
{
	struct audit_watch *watch = krule->watch;
	struct audit_parent *parent = watch->parent;

	list_del(&krule->rlist);

	if (list_empty(&watch->rules)) {
		audit_remove_watch(watch);

		if (list_empty(&parent->watches)) {
			audit_get_parent(parent);
			fsnotify_destroy_mark(&parent->mark, audit_watch_group);
			audit_put_parent(parent);
		}
	}
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
83
97.65%
4
80.00%
lino sanfilippo
lino sanfilippo
2
2.35%
1
20.00%
Total
85
100.00%
5
100.00%

/* Update watch data in audit rules based on fsnotify events. */


static int audit_watch_handle_event(struct fsnotify_group *group,
				    struct inode *to_tell,
				    struct fsnotify_mark *inode_mark,
				    struct fsnotify_mark *vfsmount_mark,
				    u32 mask, void *data, int data_type,
				    const unsigned char *dname, u32 cookie)
{
	struct inode *inode;
	struct audit_parent *parent;

	parent = container_of(inode_mark, struct audit_parent, mark);

	BUG_ON(group != audit_watch_group);

	switch (data_type) {
	case (FSNOTIFY_EVENT_PATH):
		inode = d_backing_inode(((struct path *)data)->dentry);
		break;
	case (FSNOTIFY_EVENT_INODE):
		inode = (struct inode *)data;
		break;
	default:
		BUG();
		inode = NULL;
		break;
	};

	if (mask & (FS_CREATE|FS_MOVED_TO) && inode)
		audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
	else if (mask & (FS_DELETE|FS_MOVED_FROM))
		audit_update_watch(parent, dname, AUDIT_DEV_UNSET, AUDIT_INO_UNSET, 1);
	else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF))
		audit_remove_parent_watches(parent);

	return 0;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
161
79.31%
5
50.00%
jan kara
jan kara
35
17.24%
2
20.00%
david howells
david howells
3
1.48%
1
10.00%
richard guy briggs
richard guy briggs
2
0.99%
1
10.00%
linus torvalds
linus torvalds
2
0.99%
1
10.00%
Total
203
100.00%
10
100.00%


static const struct fsnotify_ops audit_watch_fsnotify_ops = {
	.handle_event = 	audit_watch_handle_event,
};



static int __init audit_watch_init(void)
{
	audit_watch_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops);
	if (IS_ERR(audit_watch_group)) {
		audit_watch_group = NULL;
		audit_panic("cannot create audit fsnotify group");
	}
	return 0;
}
Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
38
100.00%
3
100.00%
Total
38
100.00%
3
100.00%


device_initcall(audit_watch_init);



int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old)
{
	struct audit_fsnotify_mark *audit_mark;
	char *pathname;

	pathname = kstrdup(audit_mark_path(old->exe), GFP_KERNEL);
	if (!pathname)
		return -ENOMEM;

	audit_mark = audit_alloc_mark(new, pathname, strlen(pathname));
	if (IS_ERR(audit_mark)) {
		kfree(pathname);
		return PTR_ERR(audit_mark);
	}
	new->exe = audit_mark;

	return 0;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
richard guy briggs
richard guy briggs
90
100.00%
1
100.00%
Total
90
100.00%
1
100.00%



int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
{
	struct file *exe_file;
	unsigned long ino;
	dev_t dev;

	rcu_read_lock();
	exe_file = rcu_dereference(tsk->mm->exe_file);
	ino = exe_file->f_inode->i_ino;
	dev = exe_file->f_inode->i_sb->s_dev;
	rcu_read_unlock();
	return audit_mark_compare(mark, ino, dev);
}
Contributors
Person
Tokens
Prop
Commits
CommitProp
richard guy briggs
richard guy briggs
72
100.00%
2
100.00%
Total
72
100.00%
2
100.00%

Overall Contributors
Person
Tokens
Prop
Commits
CommitProp
eric paris
eric paris
2063
85.04%
17
44.74%
richard guy briggs
richard guy briggs
212
8.74%
5
13.16%
al viro
al viro
68
2.80%
4
10.53%
jan kara
jan kara
35
1.44%
2
5.26%
david howells
david howells
18
0.74%
1
2.63%
kees cook
kees cook
9
0.37%
1
2.63%
eric w. biederman
eric w. biederman
6
0.25%
1
2.63%
lino sanfilippo
lino sanfilippo
4
0.16%
1
2.63%
stephen hemminger
stephen hemminger
2
0.08%
1
2.63%
linus torvalds
linus torvalds
2
0.08%
1
2.63%
burn alting
burn alting
2
0.08%
1
2.63%
jeff layton
jeff layton
2
0.08%
1
2.63%
tejun heo
tejun heo
2
0.08%
1
2.63%
wei yuan
wei yuan
1
0.04%
1
2.63%
Total
2426
100.00%
38
100.00%
  
Directory: kernel

Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.