[thirdparty/linux.git] / kernel / audit_watch.c

// SPDX-License-Identifier: GPL-2.0-or-later
/* audit_watch.c -- watching inodes
 *
 * Copyright 2003-2009 Red Hat, Inc.
 * Copyright 2005 Hewlett-Packard Development Company, L.P.
 * Copyright 2005 IBM Corporation
 */

#include <linux/file.h>
#include <linux/kernel.h>
#include <linux/audit.h>
#include <linux/kthread.h>
#include <linux/mutex.h>
#include <linux/fs.h>
#include <linux/fsnotify_backend.h>
#include <linux/namei.h>
#include <linux/netlink.h>
#include <linux/refcount.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/security.h>
#include "audit.h"

/*
 * Reference counting:
 *
 * audit_parent: lifetime is from audit_init_parent() to receipt of an FS_IGNORED
 * 	event.  Each audit_watch holds a reference to its associated parent.
 *
 * audit_watch: if added to lists, lifetime is from audit_init_watch() to
 * 	audit_remove_watch().  Additionally, an audit_watch may exist
 * 	temporarily to assist in searching existing filter data.  Each
 * 	audit_krule holds a reference to its associated watch.
 */

struct audit_watch {
	refcount_t		count;	/* reference count */
	dev_t			dev;	/* associated superblock device */
	char			*path;	/* insertion path */
	unsigned long		ino;	/* associated inode number */
	struct audit_parent	*parent; /* associated parent */
	struct list_head	wlist;	/* entry in parent->watches list */
	struct list_head	rules;	/* anchor for krule->rlist */
};

struct audit_parent {
	struct list_head	watches; /* anchor for audit_watch->wlist */
	struct fsnotify_mark mark; /* fsnotify mark on the inode */
};

/* fsnotify handle. */
static struct fsnotify_group *audit_watch_group;

/* fsnotify events we care about. */
#define AUDIT_FS_WATCH (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
			FS_MOVE_SELF | FS_EVENT_ON_CHILD | FS_UNMOUNT)

static void audit_free_parent(struct audit_parent *parent)
{
	WARN_ON(!list_empty(&parent->watches));
	kfree(parent);
}

static void audit_watch_free_mark(struct fsnotify_mark *entry)
{
	struct audit_parent *parent;

	parent = container_of(entry, struct audit_parent, mark);
	audit_free_parent(parent);
}

static void audit_get_parent(struct audit_parent *parent)
{
	if (likely(parent))
		fsnotify_get_mark(&parent->mark);
}

static void audit_put_parent(struct audit_parent *parent)
{
	if (likely(parent))
		fsnotify_put_mark(&parent->mark);
}

/*
 * Find and return the audit_parent on the given inode.  If found a reference
 * is taken on this parent.
 */
static inline struct audit_parent *audit_find_parent(struct inode *inode)
{
	struct audit_parent *parent = NULL;
	struct fsnotify_mark *entry;

	entry = fsnotify_find_mark(&inode->i_fsnotify_marks, audit_watch_group);
	if (entry)
		parent = container_of(entry, struct audit_parent, mark);

	return parent;
}

void audit_get_watch(struct audit_watch *watch)
{
	refcount_inc(&watch->count);
}

void audit_put_watch(struct audit_watch *watch)
{
	if (refcount_dec_and_test(&watch->count)) {
		WARN_ON(watch->parent);
		WARN_ON(!list_empty(&watch->rules));
		kfree(watch->path);
		kfree(watch);
	}
}

static void audit_remove_watch(struct audit_watch *watch)
{
	list_del(&watch->wlist);
	audit_put_parent(watch->parent);
	watch->parent = NULL;
	audit_put_watch(watch); /* match initial get */
}

char *audit_watch_path(struct audit_watch *watch)
{
	return watch->path;
}

int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
{
	return (watch->ino != AUDIT_INO_UNSET) &&
		(watch->ino == ino) &&
		(watch->dev == dev);
}

/* Initialize a parent watch entry. */
static struct audit_parent *audit_init_parent(struct path *path)
{
	struct inode *inode = d_backing_inode(path->dentry);
	struct audit_parent *parent;
	int ret;

	parent = kzalloc(sizeof(*parent), GFP_KERNEL);
	if (unlikely(!parent))
		return ERR_PTR(-ENOMEM);

	INIT_LIST_HEAD(&parent->watches);

	fsnotify_init_mark(&parent->mark, audit_watch_group);
	parent->mark.mask = AUDIT_FS_WATCH;
	ret = fsnotify_add_inode_mark(&parent->mark, inode, 0);
	if (ret < 0) {
		audit_free_parent(parent);
		return ERR_PTR(ret);
	}

	return parent;
}

/* Initialize a watch entry. */
static struct audit_watch *audit_init_watch(char *path)
{
	struct audit_watch *watch;

	watch = kzalloc(sizeof(*watch), GFP_KERNEL);
	if (unlikely(!watch))
		return ERR_PTR(-ENOMEM);

	INIT_LIST_HEAD(&watch->rules);
	refcount_set(&watch->count, 1);
	watch->path = path;
	watch->dev = AUDIT_DEV_UNSET;
	watch->ino = AUDIT_INO_UNSET;

	return watch;
}

/* Translate a watch string to kernel representation. */
int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op)
{
	struct audit_watch *watch;

	if (!audit_watch_group)
		return -EOPNOTSUPP;

	if (path[0] != '/' || path[len-1] == '/' ||
	    krule->listnr != AUDIT_FILTER_EXIT ||
	    op != Audit_equal ||
	    krule->inode_f || krule->watch || krule->tree)
		return -EINVAL;

	watch = audit_init_watch(path);
	if (IS_ERR(watch))
		return PTR_ERR(watch);

	krule->watch = watch;

	return 0;
}

/* Duplicate the given audit watch.  The new watch's rules list is initialized
 * to an empty list and wlist is undefined. */
static struct audit_watch *audit_dupe_watch(struct audit_watch *old)
{
	char *path;
	struct audit_watch *new;

	path = kstrdup(old->path, GFP_KERNEL);
	if (unlikely(!path))
		return ERR_PTR(-ENOMEM);

	new = audit_init_watch(path);
	if (IS_ERR(new)) {
		kfree(path);
		goto out;
	}

	new->dev = old->dev;
	new->ino = old->ino;
	audit_get_parent(old->parent);
	new->parent = old->parent;

out:
	return new;
}

static void audit_watch_log_rule_change(struct audit_krule *r, struct audit_watch *w, char *op)
{
	struct audit_buffer *ab;

	if (!audit_enabled)
		return;
	ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE);
	if (!ab)
		return;
	audit_log_session_info(ab);
	audit_log_format(ab, "op=%s path=", op);
	audit_log_untrustedstring(ab, w->path);
	audit_log_key(ab, r->filterkey);
	audit_log_format(ab, " list=%d res=1", r->listnr);
	audit_log_end(ab);
}

/* Update inode info in audit rules based on filesystem event. */
static void audit_update_watch(struct audit_parent *parent,
			       const struct qstr *dname, dev_t dev,
			       unsigned long ino, unsigned invalidating)
{
	struct audit_watch *owatch, *nwatch, *nextw;
	struct audit_krule *r, *nextr;
	struct audit_entry *oentry, *nentry;

	mutex_lock(&audit_filter_mutex);
	/* Run all of the watches on this parent looking for the one that
	 * matches the given dname */
	list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
		if (audit_compare_dname_path(dname, owatch->path,
					     AUDIT_NAME_FULL))
			continue;

		/* If the update involves invalidating rules, do the inode-based
		 * filtering now, so we don't omit records. */
		if (invalidating && !audit_dummy_context())
			audit_filter_inodes(current, audit_context());

		/* updating ino will likely change which audit_hash_list we
		 * are on so we need a new watch for the new list */
		nwatch = audit_dupe_watch(owatch);
		if (IS_ERR(nwatch)) {
			mutex_unlock(&audit_filter_mutex);
			audit_panic("error updating watch, skipping");
			return;
		}
		nwatch->dev = dev;
		nwatch->ino = ino;

		list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) {

			oentry = container_of(r, struct audit_entry, rule);
			list_del(&oentry->rule.rlist);
			list_del_rcu(&oentry->list);

			nentry = audit_dupe_rule(&oentry->rule);
			if (IS_ERR(nentry)) {
				list_del(&oentry->rule.list);
				audit_panic("error updating watch, removing");
			} else {
				int h = audit_hash_ino((u32)ino);

				/*
				 * nentry->rule.watch == oentry->rule.watch so
				 * we must drop that reference and set it to our
				 * new watch.
				 */
				audit_put_watch(nentry->rule.watch);
				audit_get_watch(nwatch);
				nentry->rule.watch = nwatch;
				list_add(&nentry->rule.rlist, &nwatch->rules);
				list_add_rcu(&nentry->list, &audit_inode_hash[h]);
				list_replace(&oentry->rule.list,
					     &nentry->rule.list);
			}
			if (oentry->rule.exe)
				audit_remove_mark(oentry->rule.exe);

			audit_watch_log_rule_change(r, owatch, "updated_rules");

			call_rcu(&oentry->rcu, audit_free_rule_rcu);
		}

		audit_remove_watch(owatch);
		goto add_watch_to_parent; /* event applies to a single watch */
	}
	mutex_unlock(&audit_filter_mutex);
	return;

add_watch_to_parent:
	list_add(&nwatch->wlist, &parent->watches);
	mutex_unlock(&audit_filter_mutex);
	return;
}

/* Remove all watches & rules associated with a parent that is going away. */
static void audit_remove_parent_watches(struct audit_parent *parent)
{
	struct audit_watch *w, *nextw;
	struct audit_krule *r, *nextr;
	struct audit_entry *e;

	mutex_lock(&audit_filter_mutex);
	list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
		list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
			e = container_of(r, struct audit_entry, rule);
			audit_watch_log_rule_change(r, w, "remove_rule");
			if (e->rule.exe)
				audit_remove_mark(e->rule.exe);
			list_del(&r->rlist);
			list_del(&r->list);
			list_del_rcu(&e->list);
			call_rcu(&e->rcu, audit_free_rule_rcu);
		}
		audit_remove_watch(w);
	}
	mutex_unlock(&audit_filter_mutex);

	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
}

/* Get path information necessary for adding watches. */
static int audit_get_nd(struct audit_watch *watch, struct path *parent)
{
	struct dentry *d = kern_path_locked(watch->path, parent);
	if (IS_ERR(d))
		return PTR_ERR(d);
	inode_unlock(d_backing_inode(parent->dentry));
	if (d_is_positive(d)) {
		/* update watch filter fields */
		watch->dev = d->d_sb->s_dev;
		watch->ino = d_backing_inode(d)->i_ino;
	}
	dput(d);
	return 0;
}

/* Associate the given rule with an existing parent.
 * Caller must hold audit_filter_mutex. */
static void audit_add_to_parent(struct audit_krule *krule,
				struct audit_parent *parent)
{
	struct audit_watch *w, *watch = krule->watch;
	int watch_found = 0;

	BUG_ON(!mutex_is_locked(&audit_filter_mutex));

	list_for_each_entry(w, &parent->watches, wlist) {
		if (strcmp(watch->path, w->path))
			continue;

		watch_found = 1;

		/* put krule's ref to temporary watch */
		audit_put_watch(watch);

		audit_get_watch(w);
		krule->watch = watch = w;

		audit_put_parent(parent);
		break;
	}

	if (!watch_found) {
		watch->parent = parent;

		audit_get_watch(watch);
		list_add(&watch->wlist, &parent->watches);
	}
	list_add(&krule->rlist, &watch->rules);
}

/* Find a matching watch entry, or add this one.
 * Caller must hold audit_filter_mutex. */
int audit_add_watch(struct audit_krule *krule, struct list_head **list)
{
	struct audit_watch *watch = krule->watch;
	struct audit_parent *parent;
	struct path parent_path;
	int h, ret = 0;

	/*
	 * When we will be calling audit_add_to_parent, krule->watch might have
	 * been updated and watch might have been freed.
	 * So we need to keep a reference of watch.
	 */
	audit_get_watch(watch);

	mutex_unlock(&audit_filter_mutex);

	/* Avoid calling path_lookup under audit_filter_mutex. */
	ret = audit_get_nd(watch, &parent_path);

	/* caller expects mutex locked */
	mutex_lock(&audit_filter_mutex);

	if (ret) {
		audit_put_watch(watch);
		return ret;
	}

	/* either find an old parent or attach a new one */
	parent = audit_find_parent(d_backing_inode(parent_path.dentry));
	if (!parent) {
		parent = audit_init_parent(&parent_path);
		if (IS_ERR(parent)) {
			ret = PTR_ERR(parent);
			goto error;
		}
	}

	audit_add_to_parent(krule, parent);

	h = audit_hash_ino((u32)watch->ino);
	*list = &audit_inode_hash[h];
error:
	path_put(&parent_path);
	audit_put_watch(watch);
	return ret;
}

void audit_remove_watch_rule(struct audit_krule *krule)
{
	struct audit_watch *watch = krule->watch;
	struct audit_parent *parent = watch->parent;

	list_del(&krule->rlist);

	if (list_empty(&watch->rules)) {
		/*
		 * audit_remove_watch() drops our reference to 'parent' which
		 * can get freed. Grab our own reference to be safe.
		 */
		audit_get_parent(parent);
		audit_remove_watch(watch);
		if (list_empty(&parent->watches))
			fsnotify_destroy_mark(&parent->mark, audit_watch_group);
		audit_put_parent(parent);
	}
}

/* Update watch data in audit rules based on fsnotify events. */
static int audit_watch_handle_event(struct fsnotify_group *group,
				    struct inode *to_tell,
				    u32 mask, const void *data, int data_type,
				    const struct qstr *dname, u32 cookie,
				    struct fsnotify_iter_info *iter_info)
{
	struct fsnotify_mark *inode_mark = fsnotify_iter_inode_mark(iter_info);
	const struct inode *inode;
	struct audit_parent *parent;

	parent = container_of(inode_mark, struct audit_parent, mark);

	BUG_ON(group != audit_watch_group);

	switch (data_type) {
	case (FSNOTIFY_EVENT_PATH):
		inode = d_backing_inode(((const struct path *)data)->dentry);
		break;
	case (FSNOTIFY_EVENT_INODE):
		inode = (const struct inode *)data;
		break;
	default:
		BUG();
		inode = NULL;
		break;
	}

	if (mask & (FS_CREATE|FS_MOVED_TO) && inode)
		audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
	else if (mask & (FS_DELETE|FS_MOVED_FROM))
		audit_update_watch(parent, dname, AUDIT_DEV_UNSET, AUDIT_INO_UNSET, 1);
	else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF))
		audit_remove_parent_watches(parent);

	return 0;
}

static const struct fsnotify_ops audit_watch_fsnotify_ops = {
	.handle_event = 	audit_watch_handle_event,
	.free_mark =		audit_watch_free_mark,
};

static int __init audit_watch_init(void)
{
	audit_watch_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops);
	if (IS_ERR(audit_watch_group)) {
		audit_watch_group = NULL;
		audit_panic("cannot create audit fsnotify group");
	}
	return 0;
}
device_initcall(audit_watch_init);

int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old)
{
	struct audit_fsnotify_mark *audit_mark;
	char *pathname;

	pathname = kstrdup(audit_mark_path(old->exe), GFP_KERNEL);
	if (!pathname)
		return -ENOMEM;

	audit_mark = audit_alloc_mark(new, pathname, strlen(pathname));
	if (IS_ERR(audit_mark)) {
		kfree(pathname);
		return PTR_ERR(audit_mark);
	}
	new->exe = audit_mark;

	return 0;
}

int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
{
	struct file *exe_file;
	unsigned long ino;
	dev_t dev;

	exe_file = get_task_exe_file(tsk);
	if (!exe_file)
		return 0;
	ino = file_inode(exe_file)->i_ino;
	dev = file_inode(exe_file)->i_sb->s_dev;
	fput(exe_file);
	return audit_mark_compare(mark, ino, dev);
}
Commit	Line	Data
1a59d1b8	1	// SPDX-License-Identifier: GPL-2.0-or-later
cfcad62c EP	2	/* audit_watch.c -- watching inodes
	3	*
	4	* Copyright 2003-2009 Red Hat, Inc.
	5	* Copyright 2005 Hewlett-Packard Development Company, L.P.
	6	* Copyright 2005 IBM Corporation
cfcad62c EP	7	*/
cfcad62c EP	8
5efc2443	9	#include <linux/file.h>
cfcad62c EP	10	#include <linux/kernel.h>
	11	#include <linux/audit.h>
	12	#include <linux/kthread.h>
	13	#include <linux/mutex.h>
	14	#include <linux/fs.h>
e9fd702a	15	#include <linux/fsnotify_backend.h>
cfcad62c EP	16	#include <linux/namei.h>
cfcad62c EP	17	#include <linux/netlink.h>
bd120ded	18	#include <linux/refcount.h>
cfcad62c	19	#include <linux/sched.h>
5a0e3ad6	20	#include <linux/slab.h>
cfcad62c EP	21	#include <linux/security.h>
	22	#include "audit.h"
	23
	24	/*
	25	* Reference counting:
	26	*
e9fd702a	27	* audit_parent: lifetime is from audit_init_parent() to receipt of an FS_IGNORED
cfcad62c EP	28	* event. Each audit_watch holds a reference to its associated parent.
	29	*
	30	* audit_watch: if added to lists, lifetime is from audit_init_watch() to
	31	* audit_remove_watch(). Additionally, an audit_watch may exist
	32	* temporarily to assist in searching existing filter data. Each
	33	* audit_krule holds a reference to its associated watch.
	34	*/
	35
	36	struct audit_watch {
bd120ded	37	refcount_t count; /* reference count */
cfcad62c	38	dev_t dev; /* associated superblock device */
e08b061e	39	char path; / insertion path */
cfcad62c EP	40	unsigned long ino; /* associated inode number */
	41	struct audit_parent parent; / associated parent */
	42	struct list_head wlist; /* entry in parent->watches list */
ae7b8f41	43	struct list_head rules; /* anchor for krule->rlist */
cfcad62c EP	44	};
	45
	46	struct audit_parent {
ae7b8f41	47	struct list_head watches; /* anchor for audit_watch->wlist */
e61ce867	48	struct fsnotify_mark mark; /* fsnotify mark on the inode */
cfcad62c EP	49	};
cfcad62c EP	50
e9fd702a	51	/* fsnotify handle. */
b8800aa5	52	static struct fsnotify_group *audit_watch_group;
cfcad62c	53
e9fd702a EP	54	/* fsnotify events we care about. */
e9fd702a EP	55	#define AUDIT_FS_WATCH (FS_MOVE \| FS_CREATE \| FS_DELETE \| FS_DELETE_SELF \|\
b5fed474	56	FS_MOVE_SELF \| FS_EVENT_ON_CHILD \| FS_UNMOUNT)
cfcad62c	57
ae7b8f41 EP	58	static void audit_free_parent(struct audit_parent *parent)
	59	{
	60	WARN_ON(!list_empty(&parent->watches));
	61	kfree(parent);
	62	}
	63
e61ce867	64	static void audit_watch_free_mark(struct fsnotify_mark *entry)
cfcad62c EP	65	{
	66	struct audit_parent *parent;
	67
e9fd702a	68	parent = container_of(entry, struct audit_parent, mark);
ae7b8f41	69	audit_free_parent(parent);
cfcad62c EP	70	}
cfcad62c EP	71
e9fd702a EP	72	static void audit_get_parent(struct audit_parent *parent)
	73	{
	74	if (likely(parent))
	75	fsnotify_get_mark(&parent->mark);
	76	}
	77
	78	static void audit_put_parent(struct audit_parent *parent)
	79	{
	80	if (likely(parent))
	81	fsnotify_put_mark(&parent->mark);
	82	}
	83
	84	/*
	85	* Find and return the audit_parent on the given inode. If found a reference
	86	* is taken on this parent.
	87	*/
	88	static inline struct audit_parent audit_find_parent(struct inode inode)
	89	{
	90	struct audit_parent *parent = NULL;
e61ce867	91	struct fsnotify_mark *entry;
e9fd702a	92
b1362edf	93	entry = fsnotify_find_mark(&inode->i_fsnotify_marks, audit_watch_group);
e9fd702a EP	94	if (entry)
	95	parent = container_of(entry, struct audit_parent, mark);
	96
	97	return parent;
	98	}
	99
cfcad62c EP	100	void audit_get_watch(struct audit_watch *watch)
cfcad62c EP	101	{
bd120ded	102	refcount_inc(&watch->count);
cfcad62c EP	103	}
	104
	105	void audit_put_watch(struct audit_watch *watch)
	106	{
bd120ded	107	if (refcount_dec_and_test(&watch->count)) {
cfcad62c EP	108	WARN_ON(watch->parent);
	109	WARN_ON(!list_empty(&watch->rules));
	110	kfree(watch->path);
	111	kfree(watch);
	112	}
	113	}
	114
b8800aa5	115	static void audit_remove_watch(struct audit_watch *watch)
cfcad62c EP	116	{
cfcad62c EP	117	list_del(&watch->wlist);
e9fd702a	118	audit_put_parent(watch->parent);
cfcad62c EP	119	watch->parent = NULL;
	120	audit_put_watch(watch); /* match initial get */
	121	}
	122
	123	char audit_watch_path(struct audit_watch watch)
	124	{
	125	return watch->path;
	126	}
	127
ae7b8f41	128	int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
cfcad62c	129	{
84cb777e	130	return (watch->ino != AUDIT_INO_UNSET) &&
ae7b8f41 EP	131	(watch->ino == ino) &&
ae7b8f41 EP	132	(watch->dev == dev);
cfcad62c EP	133	}
	134
	135	/* Initialize a parent watch entry. */
15a9155f	136	static struct audit_parent audit_init_parent(struct path path)
cfcad62c	137	{
3b362157	138	struct inode *inode = d_backing_inode(path->dentry);
cfcad62c	139	struct audit_parent *parent;
e9fd702a	140	int ret;
cfcad62c EP	141
	142	parent = kzalloc(sizeof(*parent), GFP_KERNEL);
	143	if (unlikely(!parent))
	144	return ERR_PTR(-ENOMEM);
	145
	146	INIT_LIST_HEAD(&parent->watches);
cfcad62c	147
054c636e	148	fsnotify_init_mark(&parent->mark, audit_watch_group);
e9fd702a	149	parent->mark.mask = AUDIT_FS_WATCH;
b249f5be	150	ret = fsnotify_add_inode_mark(&parent->mark, inode, 0);
e9fd702a	151	if (ret < 0) {
ae7b8f41	152	audit_free_parent(parent);
e9fd702a	153	return ERR_PTR(ret);
cfcad62c EP	154	}
	155
	156	return parent;
	157	}
	158
	159	/* Initialize a watch entry. */
	160	static struct audit_watch audit_init_watch(char path)
	161	{
	162	struct audit_watch *watch;
	163
	164	watch = kzalloc(sizeof(*watch), GFP_KERNEL);
	165	if (unlikely(!watch))
	166	return ERR_PTR(-ENOMEM);
	167
	168	INIT_LIST_HEAD(&watch->rules);
bd120ded	169	refcount_set(&watch->count, 1);
cfcad62c	170	watch->path = path;
84cb777e RGB	171	watch->dev = AUDIT_DEV_UNSET;
84cb777e RGB	172	watch->ino = AUDIT_INO_UNSET;
cfcad62c EP	173
	174	return watch;
	175	}
	176
fd97646b	177	/* Translate a watch string to kernel representation. */
cfcad62c EP	178	int audit_to_watch(struct audit_krule krule, char path, int len, u32 op)
	179	{
	180	struct audit_watch *watch;
	181
e9fd702a	182	if (!audit_watch_group)
cfcad62c EP	183	return -EOPNOTSUPP;
	184
	185	if (path[0] != '/' \|\| path[len-1] == '/' \|\|
	186	krule->listnr != AUDIT_FILTER_EXIT \|\|
	187	op != Audit_equal \|\|
	188	krule->inode_f \|\| krule->watch \|\| krule->tree)
	189	return -EINVAL;
	190
	191	watch = audit_init_watch(path);
	192	if (IS_ERR(watch))
	193	return PTR_ERR(watch);
	194
cfcad62c EP	195	krule->watch = watch;
	196
	197	return 0;
	198	}
	199
	200	/* Duplicate the given audit watch. The new watch's rules list is initialized
	201	* to an empty list and wlist is undefined. */
	202	static struct audit_watch audit_dupe_watch(struct audit_watch old)
	203	{
	204	char *path;
	205	struct audit_watch *new;
	206
	207	path = kstrdup(old->path, GFP_KERNEL);
	208	if (unlikely(!path))
	209	return ERR_PTR(-ENOMEM);
	210
	211	new = audit_init_watch(path);
	212	if (IS_ERR(new)) {
	213	kfree(path);
	214	goto out;
	215	}
	216
	217	new->dev = old->dev;
	218	new->ino = old->ino;
e9fd702a	219	audit_get_parent(old->parent);
cfcad62c EP	220	new->parent = old->parent;
	221
	222	out:
	223	return new;
	224	}
	225
	226	static void audit_watch_log_rule_change(struct audit_krule r, struct audit_watch w, char *op)
	227	{
4fa7f086 RGB	228	struct audit_buffer *ab;
	229
	230	if (!audit_enabled)
	231	return;
626abcd1	232	ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE);
4fa7f086 RGB	233	if (!ab)
4fa7f086 RGB	234	return;
a2c97da1	235	audit_log_session_info(ab);
d0a3f18a	236	audit_log_format(ab, "op=%s path=", op);
4fa7f086 RGB	237	audit_log_untrustedstring(ab, w->path);
	238	audit_log_key(ab, r->filterkey);
	239	audit_log_format(ab, " list=%d res=1", r->listnr);
	240	audit_log_end(ab);
cfcad62c EP	241	}
	242
	243	/* Update inode info in audit rules based on filesystem event. */
	244	static void audit_update_watch(struct audit_parent *parent,
6921d4eb	245	const struct qstr *dname, dev_t dev,
cfcad62c EP	246	unsigned long ino, unsigned invalidating)
	247	{
	248	struct audit_watch owatch, nwatch, *nextw;
	249	struct audit_krule r, nextr;
	250	struct audit_entry oentry, nentry;
	251
	252	mutex_lock(&audit_filter_mutex);
ae7b8f41 EP	253	/* Run all of the watches on this parent looking for the one that
ae7b8f41 EP	254	* matches the given dname */
cfcad62c	255	list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
795d673a	256	if (audit_compare_dname_path(dname, owatch->path,
e3d6b07b	257	AUDIT_NAME_FULL))
cfcad62c EP	258	continue;
	259
	260	/* If the update involves invalidating rules, do the inode-based
	261	* filtering now, so we don't omit records. */
ae7b8f41	262	if (invalidating && !audit_dummy_context())
cdfb6b34	263	audit_filter_inodes(current, audit_context());
cfcad62c	264
ae7b8f41 EP	265	/* updating ino will likely change which audit_hash_list we
ae7b8f41 EP	266	* are on so we need a new watch for the new list */
cfcad62c EP	267	nwatch = audit_dupe_watch(owatch);
	268	if (IS_ERR(nwatch)) {
	269	mutex_unlock(&audit_filter_mutex);
	270	audit_panic("error updating watch, skipping");
	271	return;
	272	}
	273	nwatch->dev = dev;
	274	nwatch->ino = ino;
	275
	276	list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) {
	277
	278	oentry = container_of(r, struct audit_entry, rule);
	279	list_del(&oentry->rule.rlist);
	280	list_del_rcu(&oentry->list);
	281
ae7b8f41	282	nentry = audit_dupe_rule(&oentry->rule);
cfcad62c EP	283	if (IS_ERR(nentry)) {
	284	list_del(&oentry->rule.list);
	285	audit_panic("error updating watch, removing");
	286	} else {
	287	int h = audit_hash_ino((u32)ino);
ae7b8f41 EP	288
	289	/*
	290	* nentry->rule.watch == oentry->rule.watch so
	291	* we must drop that reference and set it to our
	292	* new watch.
	293	*/
	294	audit_put_watch(nentry->rule.watch);
	295	audit_get_watch(nwatch);
	296	nentry->rule.watch = nwatch;
cfcad62c EP	297	list_add(&nentry->rule.rlist, &nwatch->rules);
	298	list_add_rcu(&nentry->list, &audit_inode_hash[h]);
	299	list_replace(&oentry->rule.list,
	300	&nentry->rule.list);
	301	}
34d99af5 RGB	302	if (oentry->rule.exe)
34d99af5 RGB	303	audit_remove_mark(oentry->rule.exe);
cfcad62c	304
e7df61f4	305	audit_watch_log_rule_change(r, owatch, "updated_rules");
cfcad62c EP	306
	307	call_rcu(&oentry->rcu, audit_free_rule_rcu);
	308	}
	309
	310	audit_remove_watch(owatch);
	311	goto add_watch_to_parent; /* event applies to a single watch */
	312	}
	313	mutex_unlock(&audit_filter_mutex);
	314	return;
	315
	316	add_watch_to_parent:
	317	list_add(&nwatch->wlist, &parent->watches);
	318	mutex_unlock(&audit_filter_mutex);
	319	return;
	320	}
	321
	322	/* Remove all watches & rules associated with a parent that is going away. */
	323	static void audit_remove_parent_watches(struct audit_parent *parent)
	324	{
	325	struct audit_watch w, nextw;
	326	struct audit_krule r, nextr;
	327	struct audit_entry *e;
	328
	329	mutex_lock(&audit_filter_mutex);
cfcad62c EP	330	list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
	331	list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
	332	e = container_of(r, struct audit_entry, rule);
e7df61f4	333	audit_watch_log_rule_change(r, w, "remove_rule");
34d99af5 RGB	334	if (e->rule.exe)
34d99af5 RGB	335	audit_remove_mark(e->rule.exe);
cfcad62c EP	336	list_del(&r->rlist);
	337	list_del(&r->list);
	338	list_del_rcu(&e->list);
	339	call_rcu(&e->rcu, audit_free_rule_rcu);
	340	}
	341	audit_remove_watch(w);
	342	}
	343	mutex_unlock(&audit_filter_mutex);
e9fd702a	344
e2a29943	345	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
cfcad62c EP	346	}
cfcad62c EP	347
cfcad62c	348	/* Get path information necessary for adding watches. */
15a9155f	349	static int audit_get_nd(struct audit_watch watch, struct path parent)
cfcad62c	350	{
79714f72 AV	351	struct dentry *d = kern_path_locked(watch->path, parent);
79714f72 AV	352	if (IS_ERR(d))
15a9155f	353	return PTR_ERR(d);
5955102c	354	inode_unlock(d_backing_inode(parent->dentry));
3b362157	355	if (d_is_positive(d)) {
15a9155f	356	/* update watch filter fields */
fc64005c	357	watch->dev = d->d_sb->s_dev;
3b362157	358	watch->ino = d_backing_inode(d)->i_ino;
cfcad62c	359	}
15a9155f	360	dput(d);
cfcad62c EP	361	return 0;
	362	}
	363
e9fd702a	364	/* Associate the given rule with an existing parent.
cfcad62c EP	365	* Caller must hold audit_filter_mutex. */
	366	static void audit_add_to_parent(struct audit_krule *krule,
	367	struct audit_parent *parent)
	368	{
	369	struct audit_watch w, watch = krule->watch;
	370	int watch_found = 0;
	371
e9fd702a EP	372	BUG_ON(!mutex_is_locked(&audit_filter_mutex));
e9fd702a EP	373
cfcad62c EP	374	list_for_each_entry(w, &parent->watches, wlist) {
	375	if (strcmp(watch->path, w->path))
	376	continue;
	377
	378	watch_found = 1;
	379
f8259b26	380	/* put krule's ref to temporary watch */
cfcad62c EP	381	audit_put_watch(watch);
	382
	383	audit_get_watch(w);
	384	krule->watch = watch = w;
aa7c043d RGB	385
aa7c043d RGB	386	audit_put_parent(parent);
cfcad62c EP	387	break;
	388	}
	389
	390	if (!watch_found) {
cfcad62c EP	391	watch->parent = parent;
cfcad62c EP	392
f8259b26	393	audit_get_watch(watch);
cfcad62c EP	394	list_add(&watch->wlist, &parent->watches);
	395	}
	396	list_add(&krule->rlist, &watch->rules);
	397	}
	398
	399	/* Find a matching watch entry, or add this one.
	400	* Caller must hold audit_filter_mutex. */
ae7b8f41	401	int audit_add_watch(struct audit_krule krule, struct list_head *list)
cfcad62c EP	402	{
cfcad62c EP	403	struct audit_watch *watch = krule->watch;
cfcad62c	404	struct audit_parent *parent;
15a9155f	405	struct path parent_path;
ae7b8f41	406	int h, ret = 0;
cfcad62c	407
baa2a4fd RC	408	/*
	409	* When we will be calling audit_add_to_parent, krule->watch might have
	410	* been updated and watch might have been freed.
	411	* So we need to keep a reference of watch.
	412	*/
	413	audit_get_watch(watch);
	414
35fe4d0b EP	415	mutex_unlock(&audit_filter_mutex);
	416
	417	/* Avoid calling path_lookup under audit_filter_mutex. */
15a9155f	418	ret = audit_get_nd(watch, &parent_path);
35fe4d0b	419
15a9155f	420	/* caller expects mutex locked */
e118e9c5 EP	421	mutex_lock(&audit_filter_mutex);
e118e9c5 EP	422
baa2a4fd RC	423	if (ret) {
baa2a4fd RC	424	audit_put_watch(watch);
15a9155f	425	return ret;
baa2a4fd	426	}
cfcad62c	427
e118e9c5	428	/* either find an old parent or attach a new one */
3b362157	429	parent = audit_find_parent(d_backing_inode(parent_path.dentry));
e9fd702a	430	if (!parent) {
15a9155f	431	parent = audit_init_parent(&parent_path);
cfcad62c	432	if (IS_ERR(parent)) {
35fe4d0b EP	433	ret = PTR_ERR(parent);
35fe4d0b EP	434	goto error;
cfcad62c	435	}
e9fd702a	436	}
cfcad62c	437
e118e9c5	438	audit_add_to_parent(krule, parent);
cfcad62c	439
ae7b8f41 EP	440	h = audit_hash_ino((u32)watch->ino);
ae7b8f41 EP	441	*list = &audit_inode_hash[h];
35fe4d0b	442	error:
15a9155f	443	path_put(&parent_path);
baa2a4fd	444	audit_put_watch(watch);
cfcad62c EP	445	return ret;
	446	}
	447
a05fb6cc	448	void audit_remove_watch_rule(struct audit_krule *krule)
cfcad62c EP	449	{
	450	struct audit_watch *watch = krule->watch;
	451	struct audit_parent *parent = watch->parent;
	452
	453	list_del(&krule->rlist);
	454
	455	if (list_empty(&watch->rules)) {
d76036ab JK	456	/*
	457	* audit_remove_watch() drops our reference to 'parent' which
	458	* can get freed. Grab our own reference to be safe.
	459	*/
	460	audit_get_parent(parent);
cfcad62c	461	audit_remove_watch(watch);
d76036ab	462	if (list_empty(&parent->watches))
e2a29943	463	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
d76036ab	464	audit_put_parent(parent);
cfcad62c EP	465	}
	466	}
	467
e9fd702a	468	/* Update watch data in audit rules based on fsnotify events. */
3a9b16b4	469	static int audit_watch_handle_event(struct fsnotify_group *group,
7053aee2	470	struct inode *to_tell,
3cd5eca8	471	u32 mask, const void *data, int data_type,
e43e9c33	472	const struct qstr *dname, u32 cookie,
9385a84d	473	struct fsnotify_iter_info *iter_info)
e9fd702a	474	{
5b0457ad	475	struct fsnotify_mark *inode_mark = fsnotify_iter_inode_mark(iter_info);
3cd5eca8	476	const struct inode *inode;
cfcad62c EP	477	struct audit_parent *parent;
cfcad62c EP	478
ce8f76fb	479	parent = container_of(inode_mark, struct audit_parent, mark);
e9fd702a	480
4cd76a47	481	BUG_ON(group != audit_watch_group);
e9fd702a	482
7053aee2	483	switch (data_type) {
2069601b	484	case (FSNOTIFY_EVENT_PATH):
3cd5eca8	485	inode = d_backing_inode(((const struct path *)data)->dentry);
e9fd702a EP	486	break;
e9fd702a EP	487	case (FSNOTIFY_EVENT_INODE):
3cd5eca8	488	inode = (const struct inode *)data;
e9fd702a EP	489	break;
	490	default:
	491	BUG();
	492	inode = NULL;
	493	break;
9aab4f4e	494	}
cfcad62c	495
e9fd702a	496	if (mask & (FS_CREATE\|FS_MOVED_TO) && inode)
6921d4eb	497	audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
e9fd702a	498	else if (mask & (FS_DELETE\|FS_MOVED_FROM))
6921d4eb	499	audit_update_watch(parent, dname, AUDIT_DEV_UNSET, AUDIT_INO_UNSET, 1);
e9fd702a	500	else if (mask & (FS_DELETE_SELF\|FS_UNMOUNT\|FS_MOVE_SELF))
cfcad62c	501	audit_remove_parent_watches(parent);
e9fd702a EP	502
	503	return 0;
	504	}
	505
e9fd702a	506	static const struct fsnotify_ops audit_watch_fsnotify_ops = {
e9fd702a	507	.handle_event = audit_watch_handle_event,
054c636e	508	.free_mark = audit_watch_free_mark,
cfcad62c EP	509	};
	510
	511	static int __init audit_watch_init(void)
	512	{
0d2e2a1d	513	audit_watch_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops);
e9fd702a EP	514	if (IS_ERR(audit_watch_group)) {
	515	audit_watch_group = NULL;
	516	audit_panic("cannot create audit fsnotify group");
	517	}
cfcad62c EP	518	return 0;
cfcad62c EP	519	}
1a3aedbc	520	device_initcall(audit_watch_init);
34d99af5 RGB	521
	522	int audit_dupe_exe(struct audit_krule new, struct audit_krule old)
	523	{
	524	struct audit_fsnotify_mark *audit_mark;
	525	char *pathname;
	526
	527	pathname = kstrdup(audit_mark_path(old->exe), GFP_KERNEL);
	528	if (!pathname)
	529	return -ENOMEM;
	530
	531	audit_mark = audit_alloc_mark(new, pathname, strlen(pathname));
	532	if (IS_ERR(audit_mark)) {
	533	kfree(pathname);
	534	return PTR_ERR(audit_mark);
	535	}
	536	new->exe = audit_mark;
	537
	538	return 0;
	539	}
	540
	541	int audit_exe_compare(struct task_struct tsk, struct audit_fsnotify_mark mark)
	542	{
15ce414b RGB	543	struct file *exe_file;
	544	unsigned long ino;
	545	dev_t dev;
	546
5efc2443 MG	547	exe_file = get_task_exe_file(tsk);
	548	if (!exe_file)
	549	return 0;
45063097 AV	550	ino = file_inode(exe_file)->i_ino;
45063097 AV	551	dev = file_inode(exe_file)->i_sb->s_dev;
5efc2443	552	fput(exe_file);
34d99af5 RGB	553	return audit_mark_compare(mark, ino, dev);
34d99af5 RGB	554	}