[thirdparty/linux.git] / kernel / audit_watch.c

// SPDX-License-Identifier: GPL-2.0-or-later
/* audit_watch.c -- watching inodes
 *
 * Copyright 2003-2009 Red Hat, Inc.
 * Copyright 2005 Hewlett-Packard Development Company, L.P.
 * Copyright 2005 IBM Corporation
 */

#include <linux/file.h>
#include <linux/kernel.h>
#include <linux/audit.h>
#include <linux/kthread.h>
#include <linux/mutex.h>
#include <linux/fs.h>
#include <linux/fsnotify_backend.h>
#include <linux/namei.h>
#include <linux/netlink.h>
#include <linux/refcount.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/security.h>
#include "audit.h"

/*
 * Reference counting:
 *
 * audit_parent: lifetime is from audit_init_parent() to receipt of an FS_IGNORED
 * 	event.  Each audit_watch holds a reference to its associated parent.
 *
 * audit_watch: if added to lists, lifetime is from audit_init_watch() to
 * 	audit_remove_watch().  Additionally, an audit_watch may exist
 * 	temporarily to assist in searching existing filter data.  Each
 * 	audit_krule holds a reference to its associated watch.
 */

struct audit_watch {
	refcount_t		count;	/* reference count */
	dev_t			dev;	/* associated superblock device */
	char			*path;	/* insertion path */
	unsigned long		ino;	/* associated inode number */
	struct audit_parent	*parent; /* associated parent */
	struct list_head	wlist;	/* entry in parent->watches list */
	struct list_head	rules;	/* anchor for krule->rlist */
};

struct audit_parent {
	struct list_head	watches; /* anchor for audit_watch->wlist */
	struct fsnotify_mark mark; /* fsnotify mark on the inode */
};

/* fsnotify handle. */
static struct fsnotify_group *audit_watch_group;

/* fsnotify events we care about. */
#define AUDIT_FS_WATCH (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
			FS_MOVE_SELF | FS_EVENT_ON_CHILD | FS_UNMOUNT)

static void audit_free_parent(struct audit_parent *parent)
{
	WARN_ON(!list_empty(&parent->watches));
	kfree(parent);
}

static void audit_watch_free_mark(struct fsnotify_mark *entry)
{
	struct audit_parent *parent;

	parent = container_of(entry, struct audit_parent, mark);
	audit_free_parent(parent);
}

static void audit_get_parent(struct audit_parent *parent)
{
	if (likely(parent))
		fsnotify_get_mark(&parent->mark);
}

static void audit_put_parent(struct audit_parent *parent)
{
	if (likely(parent))
		fsnotify_put_mark(&parent->mark);
}

/*
 * Find and return the audit_parent on the given inode.  If found a reference
 * is taken on this parent.
 */
static inline struct audit_parent *audit_find_parent(struct inode *inode)
{
	struct audit_parent *parent = NULL;
	struct fsnotify_mark *entry;

	entry = fsnotify_find_mark(&inode->i_fsnotify_marks, audit_watch_group);
	if (entry)
		parent = container_of(entry, struct audit_parent, mark);

	return parent;
}

void audit_get_watch(struct audit_watch *watch)
{
	refcount_inc(&watch->count);
}

void audit_put_watch(struct audit_watch *watch)
{
	if (refcount_dec_and_test(&watch->count)) {
		WARN_ON(watch->parent);
		WARN_ON(!list_empty(&watch->rules));
		kfree(watch->path);
		kfree(watch);
	}
}

static void audit_remove_watch(struct audit_watch *watch)
{
	list_del(&watch->wlist);
	audit_put_parent(watch->parent);
	watch->parent = NULL;
	audit_put_watch(watch); /* match initial get */
}

char *audit_watch_path(struct audit_watch *watch)
{
	return watch->path;
}

int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
{
	return (watch->ino != AUDIT_INO_UNSET) &&
		(watch->ino == ino) &&
		(watch->dev == dev);
}

/* Initialize a parent watch entry. */
static struct audit_parent *audit_init_parent(struct path *path)
{
	struct inode *inode = d_backing_inode(path->dentry);
	struct audit_parent *parent;
	int ret;

	parent = kzalloc(sizeof(*parent), GFP_KERNEL);
	if (unlikely(!parent))
		return ERR_PTR(-ENOMEM);

	INIT_LIST_HEAD(&parent->watches);

	fsnotify_init_mark(&parent->mark, audit_watch_group);
	parent->mark.mask = AUDIT_FS_WATCH;
	ret = fsnotify_add_inode_mark(&parent->mark, inode, 0);
	if (ret < 0) {
		audit_free_parent(parent);
		return ERR_PTR(ret);
	}

	return parent;
}

/* Initialize a watch entry. */
static struct audit_watch *audit_init_watch(char *path)
{
	struct audit_watch *watch;

	watch = kzalloc(sizeof(*watch), GFP_KERNEL);
	if (unlikely(!watch))
		return ERR_PTR(-ENOMEM);

	INIT_LIST_HEAD(&watch->rules);
	refcount_set(&watch->count, 1);
	watch->path = path;
	watch->dev = AUDIT_DEV_UNSET;
	watch->ino = AUDIT_INO_UNSET;

	return watch;
}

/* Translate a watch string to kernel representation. */
int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op)
{
	struct audit_watch *watch;

	if (!audit_watch_group)
		return -EOPNOTSUPP;

	if (path[0] != '/' || path[len-1] == '/' ||
	    krule->listnr != AUDIT_FILTER_EXIT ||
	    op != Audit_equal ||
	    krule->inode_f || krule->watch || krule->tree)
		return -EINVAL;

	watch = audit_init_watch(path);
	if (IS_ERR(watch))
		return PTR_ERR(watch);

	krule->watch = watch;

	return 0;
}

/* Duplicate the given audit watch.  The new watch's rules list is initialized
 * to an empty list and wlist is undefined. */
static struct audit_watch *audit_dupe_watch(struct audit_watch *old)
{
	char *path;
	struct audit_watch *new;

	path = kstrdup(old->path, GFP_KERNEL);
	if (unlikely(!path))
		return ERR_PTR(-ENOMEM);

	new = audit_init_watch(path);
	if (IS_ERR(new)) {
		kfree(path);
		goto out;
	}

	new->dev = old->dev;
	new->ino = old->ino;
	audit_get_parent(old->parent);
	new->parent = old->parent;

out:
	return new;
}

static void audit_watch_log_rule_change(struct audit_krule *r, struct audit_watch *w, char *op)
{
	struct audit_buffer *ab;

	if (!audit_enabled)
		return;
	ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE);
	if (!ab)
		return;
	audit_log_session_info(ab);
	audit_log_format(ab, "op=%s path=", op);
	audit_log_untrustedstring(ab, w->path);
	audit_log_key(ab, r->filterkey);
	audit_log_format(ab, " list=%d res=1", r->listnr);
	audit_log_end(ab);
}

/* Update inode info in audit rules based on filesystem event. */
static void audit_update_watch(struct audit_parent *parent,
			       const struct qstr *dname, dev_t dev,
			       unsigned long ino, unsigned invalidating)
{
	struct audit_watch *owatch, *nwatch, *nextw;
	struct audit_krule *r, *nextr;
	struct audit_entry *oentry, *nentry;

	mutex_lock(&audit_filter_mutex);
	/* Run all of the watches on this parent looking for the one that
	 * matches the given dname */
	list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
		if (audit_compare_dname_path(dname, owatch->path,
					     AUDIT_NAME_FULL))
			continue;

		/* If the update involves invalidating rules, do the inode-based
		 * filtering now, so we don't omit records. */
		if (invalidating && !audit_dummy_context())
			audit_filter_inodes(current, audit_context());

		/* updating ino will likely change which audit_hash_list we
		 * are on so we need a new watch for the new list */
		nwatch = audit_dupe_watch(owatch);
		if (IS_ERR(nwatch)) {
			mutex_unlock(&audit_filter_mutex);
			audit_panic("error updating watch, skipping");
			return;
		}
		nwatch->dev = dev;
		nwatch->ino = ino;

		list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) {

			oentry = container_of(r, struct audit_entry, rule);
			list_del(&oentry->rule.rlist);
			list_del_rcu(&oentry->list);

			nentry = audit_dupe_rule(&oentry->rule);
			if (IS_ERR(nentry)) {
				list_del(&oentry->rule.list);
				audit_panic("error updating watch, removing");
			} else {
				int h = audit_hash_ino((u32)ino);

				/*
				 * nentry->rule.watch == oentry->rule.watch so
				 * we must drop that reference and set it to our
				 * new watch.
				 */
				audit_put_watch(nentry->rule.watch);
				audit_get_watch(nwatch);
				nentry->rule.watch = nwatch;
				list_add(&nentry->rule.rlist, &nwatch->rules);
				list_add_rcu(&nentry->list, &audit_inode_hash[h]);
				list_replace(&oentry->rule.list,
					     &nentry->rule.list);
			}
			if (oentry->rule.exe)
				audit_remove_mark(oentry->rule.exe);

			call_rcu(&oentry->rcu, audit_free_rule_rcu);
		}

		audit_remove_watch(owatch);
		goto add_watch_to_parent; /* event applies to a single watch */
	}
	mutex_unlock(&audit_filter_mutex);
	return;

add_watch_to_parent:
	list_add(&nwatch->wlist, &parent->watches);
	mutex_unlock(&audit_filter_mutex);
	return;
}

/* Remove all watches & rules associated with a parent that is going away. */
static void audit_remove_parent_watches(struct audit_parent *parent)
{
	struct audit_watch *w, *nextw;
	struct audit_krule *r, *nextr;
	struct audit_entry *e;

	mutex_lock(&audit_filter_mutex);
	list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
		list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
			e = container_of(r, struct audit_entry, rule);
			audit_watch_log_rule_change(r, w, "remove_rule");
			if (e->rule.exe)
				audit_remove_mark(e->rule.exe);
			list_del(&r->rlist);
			list_del(&r->list);
			list_del_rcu(&e->list);
			call_rcu(&e->rcu, audit_free_rule_rcu);
		}
		audit_remove_watch(w);
	}
	mutex_unlock(&audit_filter_mutex);

	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
}

/* Get path information necessary for adding watches. */
static int audit_get_nd(struct audit_watch *watch, struct path *parent)
{
	struct dentry *d = kern_path_locked(watch->path, parent);
	if (IS_ERR(d))
		return PTR_ERR(d);
	if (d_is_positive(d)) {
		/* update watch filter fields */
		watch->dev = d->d_sb->s_dev;
		watch->ino = d_backing_inode(d)->i_ino;
	}
	inode_unlock(d_backing_inode(parent->dentry));
	dput(d);
	return 0;
}

/* Associate the given rule with an existing parent.
 * Caller must hold audit_filter_mutex. */
static void audit_add_to_parent(struct audit_krule *krule,
				struct audit_parent *parent)
{
	struct audit_watch *w, *watch = krule->watch;
	int watch_found = 0;

	BUG_ON(!mutex_is_locked(&audit_filter_mutex));

	list_for_each_entry(w, &parent->watches, wlist) {
		if (strcmp(watch->path, w->path))
			continue;

		watch_found = 1;

		/* put krule's ref to temporary watch */
		audit_put_watch(watch);

		audit_get_watch(w);
		krule->watch = watch = w;

		audit_put_parent(parent);
		break;
	}

	if (!watch_found) {
		watch->parent = parent;

		audit_get_watch(watch);
		list_add(&watch->wlist, &parent->watches);
	}
	list_add(&krule->rlist, &watch->rules);
}

/* Find a matching watch entry, or add this one.
 * Caller must hold audit_filter_mutex. */
int audit_add_watch(struct audit_krule *krule, struct list_head **list)
{
	struct audit_watch *watch = krule->watch;
	struct audit_parent *parent;
	struct path parent_path;
	int h, ret = 0;

	/*
	 * When we will be calling audit_add_to_parent, krule->watch might have
	 * been updated and watch might have been freed.
	 * So we need to keep a reference of watch.
	 */
	audit_get_watch(watch);

	mutex_unlock(&audit_filter_mutex);

	/* Avoid calling path_lookup under audit_filter_mutex. */
	ret = audit_get_nd(watch, &parent_path);

	/* caller expects mutex locked */
	mutex_lock(&audit_filter_mutex);

	if (ret) {
		audit_put_watch(watch);
		return ret;
	}

	/* either find an old parent or attach a new one */
	parent = audit_find_parent(d_backing_inode(parent_path.dentry));
	if (!parent) {
		parent = audit_init_parent(&parent_path);
		if (IS_ERR(parent)) {
			ret = PTR_ERR(parent);
			goto error;
		}
	}

	audit_add_to_parent(krule, parent);

	h = audit_hash_ino((u32)watch->ino);
	*list = &audit_inode_hash[h];
error:
	path_put(&parent_path);
	audit_put_watch(watch);
	return ret;
}

void audit_remove_watch_rule(struct audit_krule *krule)
{
	struct audit_watch *watch = krule->watch;
	struct audit_parent *parent = watch->parent;

	list_del(&krule->rlist);

	if (list_empty(&watch->rules)) {
		/*
		 * audit_remove_watch() drops our reference to 'parent' which
		 * can get freed. Grab our own reference to be safe.
		 */
		audit_get_parent(parent);
		audit_remove_watch(watch);
		if (list_empty(&parent->watches))
			fsnotify_destroy_mark(&parent->mark, audit_watch_group);
		audit_put_parent(parent);
	}
}

/* Update watch data in audit rules based on fsnotify events. */
static int audit_watch_handle_event(struct fsnotify_group *group,
				    struct inode *to_tell,
				    u32 mask, const void *data, int data_type,
				    const struct qstr *dname, u32 cookie,
				    struct fsnotify_iter_info *iter_info)
{
	struct fsnotify_mark *inode_mark = fsnotify_iter_inode_mark(iter_info);
	const struct inode *inode = fsnotify_data_inode(data, data_type);
	struct audit_parent *parent;

	parent = container_of(inode_mark, struct audit_parent, mark);

	BUG_ON(group != audit_watch_group);
	WARN_ON(!inode);

	if (mask & (FS_CREATE|FS_MOVED_TO) && inode)
		audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
	else if (mask & (FS_DELETE|FS_MOVED_FROM))
		audit_update_watch(parent, dname, AUDIT_DEV_UNSET, AUDIT_INO_UNSET, 1);
	else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF))
		audit_remove_parent_watches(parent);

	return 0;
}

static const struct fsnotify_ops audit_watch_fsnotify_ops = {
	.handle_event = 	audit_watch_handle_event,
	.free_mark =		audit_watch_free_mark,
};

static int __init audit_watch_init(void)
{
	audit_watch_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops);
	if (IS_ERR(audit_watch_group)) {
		audit_watch_group = NULL;
		audit_panic("cannot create audit fsnotify group");
	}
	return 0;
}
device_initcall(audit_watch_init);

int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old)
{
	struct audit_fsnotify_mark *audit_mark;
	char *pathname;

	pathname = kstrdup(audit_mark_path(old->exe), GFP_KERNEL);
	if (!pathname)
		return -ENOMEM;

	audit_mark = audit_alloc_mark(new, pathname, strlen(pathname));
	if (IS_ERR(audit_mark)) {
		kfree(pathname);
		return PTR_ERR(audit_mark);
	}
	new->exe = audit_mark;

	return 0;
}

int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
{
	struct file *exe_file;
	unsigned long ino;
	dev_t dev;

	exe_file = get_task_exe_file(tsk);
	if (!exe_file)
		return 0;
	ino = file_inode(exe_file)->i_ino;
	dev = file_inode(exe_file)->i_sb->s_dev;
	fput(exe_file);
	return audit_mark_compare(mark, ino, dev);
}
Commit	Line	Data
1a59d1b8	1	// SPDX-License-Identifier: GPL-2.0-or-later
cfcad62c EP	2	/* audit_watch.c -- watching inodes
	3	*
	4	* Copyright 2003-2009 Red Hat, Inc.
	5	* Copyright 2005 Hewlett-Packard Development Company, L.P.
	6	* Copyright 2005 IBM Corporation
cfcad62c EP	7	*/
cfcad62c EP	8
5efc2443	9	#include <linux/file.h>
cfcad62c EP	10	#include <linux/kernel.h>
	11	#include <linux/audit.h>
	12	#include <linux/kthread.h>
	13	#include <linux/mutex.h>
	14	#include <linux/fs.h>
e9fd702a	15	#include <linux/fsnotify_backend.h>
cfcad62c EP	16	#include <linux/namei.h>
cfcad62c EP	17	#include <linux/netlink.h>
bd120ded	18	#include <linux/refcount.h>
cfcad62c	19	#include <linux/sched.h>
5a0e3ad6	20	#include <linux/slab.h>
cfcad62c EP	21	#include <linux/security.h>
	22	#include "audit.h"
	23
	24	/*
	25	* Reference counting:
	26	*
e9fd702a	27	* audit_parent: lifetime is from audit_init_parent() to receipt of an FS_IGNORED
cfcad62c EP	28	* event. Each audit_watch holds a reference to its associated parent.
	29	*
	30	* audit_watch: if added to lists, lifetime is from audit_init_watch() to
	31	* audit_remove_watch(). Additionally, an audit_watch may exist
	32	* temporarily to assist in searching existing filter data. Each
	33	* audit_krule holds a reference to its associated watch.
	34	*/
	35
	36	struct audit_watch {
bd120ded	37	refcount_t count; /* reference count */
cfcad62c	38	dev_t dev; /* associated superblock device */
e08b061e	39	char path; / insertion path */
cfcad62c EP	40	unsigned long ino; /* associated inode number */
	41	struct audit_parent parent; / associated parent */
	42	struct list_head wlist; /* entry in parent->watches list */
ae7b8f41	43	struct list_head rules; /* anchor for krule->rlist */
cfcad62c EP	44	};
	45
	46	struct audit_parent {
ae7b8f41	47	struct list_head watches; /* anchor for audit_watch->wlist */
e61ce867	48	struct fsnotify_mark mark; /* fsnotify mark on the inode */
cfcad62c EP	49	};
cfcad62c EP	50
e9fd702a	51	/* fsnotify handle. */
b8800aa5	52	static struct fsnotify_group *audit_watch_group;
cfcad62c	53
e9fd702a EP	54	/* fsnotify events we care about. */
e9fd702a EP	55	#define AUDIT_FS_WATCH (FS_MOVE \| FS_CREATE \| FS_DELETE \| FS_DELETE_SELF \|\
b5fed474	56	FS_MOVE_SELF \| FS_EVENT_ON_CHILD \| FS_UNMOUNT)
cfcad62c	57
ae7b8f41 EP	58	static void audit_free_parent(struct audit_parent *parent)
	59	{
	60	WARN_ON(!list_empty(&parent->watches));
	61	kfree(parent);
	62	}
	63
e61ce867	64	static void audit_watch_free_mark(struct fsnotify_mark *entry)
cfcad62c EP	65	{
	66	struct audit_parent *parent;
	67
e9fd702a	68	parent = container_of(entry, struct audit_parent, mark);
ae7b8f41	69	audit_free_parent(parent);
cfcad62c EP	70	}
cfcad62c EP	71
e9fd702a EP	72	static void audit_get_parent(struct audit_parent *parent)
	73	{
	74	if (likely(parent))
	75	fsnotify_get_mark(&parent->mark);
	76	}
	77
	78	static void audit_put_parent(struct audit_parent *parent)
	79	{
	80	if (likely(parent))
	81	fsnotify_put_mark(&parent->mark);
	82	}
	83
	84	/*
	85	* Find and return the audit_parent on the given inode. If found a reference
	86	* is taken on this parent.
	87	*/
	88	static inline struct audit_parent audit_find_parent(struct inode inode)
	89	{
	90	struct audit_parent *parent = NULL;
e61ce867	91	struct fsnotify_mark *entry;
e9fd702a	92
b1362edf	93	entry = fsnotify_find_mark(&inode->i_fsnotify_marks, audit_watch_group);
e9fd702a EP	94	if (entry)
	95	parent = container_of(entry, struct audit_parent, mark);
	96
	97	return parent;
	98	}
	99
cfcad62c EP	100	void audit_get_watch(struct audit_watch *watch)
cfcad62c EP	101	{
bd120ded	102	refcount_inc(&watch->count);
cfcad62c EP	103	}
	104
	105	void audit_put_watch(struct audit_watch *watch)
	106	{
bd120ded	107	if (refcount_dec_and_test(&watch->count)) {
cfcad62c EP	108	WARN_ON(watch->parent);
	109	WARN_ON(!list_empty(&watch->rules));
	110	kfree(watch->path);
	111	kfree(watch);
	112	}
	113	}
	114
b8800aa5	115	static void audit_remove_watch(struct audit_watch *watch)
cfcad62c EP	116	{
cfcad62c EP	117	list_del(&watch->wlist);
e9fd702a	118	audit_put_parent(watch->parent);
cfcad62c EP	119	watch->parent = NULL;
	120	audit_put_watch(watch); /* match initial get */
	121	}
	122
	123	char audit_watch_path(struct audit_watch watch)
	124	{
	125	return watch->path;
	126	}
	127
ae7b8f41	128	int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
cfcad62c	129	{
84cb777e	130	return (watch->ino != AUDIT_INO_UNSET) &&
ae7b8f41 EP	131	(watch->ino == ino) &&
ae7b8f41 EP	132	(watch->dev == dev);
cfcad62c EP	133	}
	134
	135	/* Initialize a parent watch entry. */
15a9155f	136	static struct audit_parent audit_init_parent(struct path path)
cfcad62c	137	{
3b362157	138	struct inode *inode = d_backing_inode(path->dentry);
cfcad62c	139	struct audit_parent *parent;
e9fd702a	140	int ret;
cfcad62c EP	141
	142	parent = kzalloc(sizeof(*parent), GFP_KERNEL);
	143	if (unlikely(!parent))
	144	return ERR_PTR(-ENOMEM);
	145
	146	INIT_LIST_HEAD(&parent->watches);
cfcad62c	147
054c636e	148	fsnotify_init_mark(&parent->mark, audit_watch_group);
e9fd702a	149	parent->mark.mask = AUDIT_FS_WATCH;
b249f5be	150	ret = fsnotify_add_inode_mark(&parent->mark, inode, 0);
e9fd702a	151	if (ret < 0) {
ae7b8f41	152	audit_free_parent(parent);
e9fd702a	153	return ERR_PTR(ret);
cfcad62c EP	154	}
	155
	156	return parent;
	157	}
	158
	159	/* Initialize a watch entry. */
	160	static struct audit_watch audit_init_watch(char path)
	161	{
	162	struct audit_watch *watch;
	163
	164	watch = kzalloc(sizeof(*watch), GFP_KERNEL);
	165	if (unlikely(!watch))
	166	return ERR_PTR(-ENOMEM);
	167
	168	INIT_LIST_HEAD(&watch->rules);
bd120ded	169	refcount_set(&watch->count, 1);
cfcad62c	170	watch->path = path;
84cb777e RGB	171	watch->dev = AUDIT_DEV_UNSET;
84cb777e RGB	172	watch->ino = AUDIT_INO_UNSET;
cfcad62c EP	173
	174	return watch;
	175	}
	176
fd97646b	177	/* Translate a watch string to kernel representation. */
cfcad62c EP	178	int audit_to_watch(struct audit_krule krule, char path, int len, u32 op)
	179	{
	180	struct audit_watch *watch;
	181
e9fd702a	182	if (!audit_watch_group)
cfcad62c EP	183	return -EOPNOTSUPP;
	184
	185	if (path[0] != '/' \|\| path[len-1] == '/' \|\|
	186	krule->listnr != AUDIT_FILTER_EXIT \|\|
	187	op != Audit_equal \|\|
	188	krule->inode_f \|\| krule->watch \|\| krule->tree)
	189	return -EINVAL;
	190
	191	watch = audit_init_watch(path);
	192	if (IS_ERR(watch))
	193	return PTR_ERR(watch);
	194
cfcad62c EP	195	krule->watch = watch;
	196
	197	return 0;
	198	}
	199
	200	/* Duplicate the given audit watch. The new watch's rules list is initialized
	201	* to an empty list and wlist is undefined. */
	202	static struct audit_watch audit_dupe_watch(struct audit_watch old)
	203	{
	204	char *path;
	205	struct audit_watch *new;
	206
	207	path = kstrdup(old->path, GFP_KERNEL);
	208	if (unlikely(!path))
	209	return ERR_PTR(-ENOMEM);
	210
	211	new = audit_init_watch(path);
	212	if (IS_ERR(new)) {
	213	kfree(path);
	214	goto out;
	215	}
	216
	217	new->dev = old->dev;
	218	new->ino = old->ino;
e9fd702a	219	audit_get_parent(old->parent);
cfcad62c EP	220	new->parent = old->parent;
	221
	222	out:
	223	return new;
	224	}
	225
	226	static void audit_watch_log_rule_change(struct audit_krule r, struct audit_watch w, char *op)
	227	{
4fa7f086 RGB	228	struct audit_buffer *ab;
	229
	230	if (!audit_enabled)
	231	return;
626abcd1	232	ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE);
4fa7f086 RGB	233	if (!ab)
4fa7f086 RGB	234	return;
a2c97da1	235	audit_log_session_info(ab);
d0a3f18a	236	audit_log_format(ab, "op=%s path=", op);
4fa7f086 RGB	237	audit_log_untrustedstring(ab, w->path);
	238	audit_log_key(ab, r->filterkey);
	239	audit_log_format(ab, " list=%d res=1", r->listnr);
	240	audit_log_end(ab);
cfcad62c EP	241	}
	242
	243	/* Update inode info in audit rules based on filesystem event. */
	244	static void audit_update_watch(struct audit_parent *parent,
6921d4eb	245	const struct qstr *dname, dev_t dev,
cfcad62c EP	246	unsigned long ino, unsigned invalidating)
	247	{
	248	struct audit_watch owatch, nwatch, *nextw;
	249	struct audit_krule r, nextr;
	250	struct audit_entry oentry, nentry;
	251
	252	mutex_lock(&audit_filter_mutex);
ae7b8f41 EP	253	/* Run all of the watches on this parent looking for the one that
ae7b8f41 EP	254	* matches the given dname */
cfcad62c	255	list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
795d673a	256	if (audit_compare_dname_path(dname, owatch->path,
e3d6b07b	257	AUDIT_NAME_FULL))
cfcad62c EP	258	continue;
	259
	260	/* If the update involves invalidating rules, do the inode-based
	261	* filtering now, so we don't omit records. */
ae7b8f41	262	if (invalidating && !audit_dummy_context())
cdfb6b34	263	audit_filter_inodes(current, audit_context());
cfcad62c	264
ae7b8f41 EP	265	/* updating ino will likely change which audit_hash_list we
ae7b8f41 EP	266	* are on so we need a new watch for the new list */
cfcad62c EP	267	nwatch = audit_dupe_watch(owatch);
	268	if (IS_ERR(nwatch)) {
	269	mutex_unlock(&audit_filter_mutex);
	270	audit_panic("error updating watch, skipping");
	271	return;
	272	}
	273	nwatch->dev = dev;
	274	nwatch->ino = ino;
	275
	276	list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) {
	277
	278	oentry = container_of(r, struct audit_entry, rule);
	279	list_del(&oentry->rule.rlist);
	280	list_del_rcu(&oentry->list);
	281
ae7b8f41	282	nentry = audit_dupe_rule(&oentry->rule);
cfcad62c EP	283	if (IS_ERR(nentry)) {
	284	list_del(&oentry->rule.list);
	285	audit_panic("error updating watch, removing");
	286	} else {
	287	int h = audit_hash_ino((u32)ino);
ae7b8f41 EP	288
	289	/*
	290	* nentry->rule.watch == oentry->rule.watch so
	291	* we must drop that reference and set it to our
	292	* new watch.
	293	*/
	294	audit_put_watch(nentry->rule.watch);
	295	audit_get_watch(nwatch);
	296	nentry->rule.watch = nwatch;
cfcad62c EP	297	list_add(&nentry->rule.rlist, &nwatch->rules);
	298	list_add_rcu(&nentry->list, &audit_inode_hash[h]);
	299	list_replace(&oentry->rule.list,
	300	&nentry->rule.list);
	301	}
34d99af5 RGB	302	if (oentry->rule.exe)
34d99af5 RGB	303	audit_remove_mark(oentry->rule.exe);
cfcad62c	304
cfcad62c EP	305	call_rcu(&oentry->rcu, audit_free_rule_rcu);
	306	}
	307
	308	audit_remove_watch(owatch);
	309	goto add_watch_to_parent; /* event applies to a single watch */
	310	}
	311	mutex_unlock(&audit_filter_mutex);
	312	return;
	313
	314	add_watch_to_parent:
	315	list_add(&nwatch->wlist, &parent->watches);
	316	mutex_unlock(&audit_filter_mutex);
	317	return;
	318	}
	319
	320	/* Remove all watches & rules associated with a parent that is going away. */
	321	static void audit_remove_parent_watches(struct audit_parent *parent)
	322	{
	323	struct audit_watch w, nextw;
	324	struct audit_krule r, nextr;
	325	struct audit_entry *e;
	326
	327	mutex_lock(&audit_filter_mutex);
cfcad62c EP	328	list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
	329	list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
	330	e = container_of(r, struct audit_entry, rule);
e7df61f4	331	audit_watch_log_rule_change(r, w, "remove_rule");
34d99af5 RGB	332	if (e->rule.exe)
34d99af5 RGB	333	audit_remove_mark(e->rule.exe);
cfcad62c EP	334	list_del(&r->rlist);
	335	list_del(&r->list);
	336	list_del_rcu(&e->list);
	337	call_rcu(&e->rcu, audit_free_rule_rcu);
	338	}
	339	audit_remove_watch(w);
	340	}
	341	mutex_unlock(&audit_filter_mutex);
e9fd702a	342
e2a29943	343	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
cfcad62c EP	344	}
cfcad62c EP	345
cfcad62c	346	/* Get path information necessary for adding watches. */
15a9155f	347	static int audit_get_nd(struct audit_watch watch, struct path parent)
cfcad62c	348	{
79714f72 AV	349	struct dentry *d = kern_path_locked(watch->path, parent);
79714f72 AV	350	if (IS_ERR(d))
15a9155f	351	return PTR_ERR(d);
3b362157	352	if (d_is_positive(d)) {
15a9155f	353	/* update watch filter fields */
fc64005c	354	watch->dev = d->d_sb->s_dev;
3b362157	355	watch->ino = d_backing_inode(d)->i_ino;
cfcad62c	356	}
69924b89	357	inode_unlock(d_backing_inode(parent->dentry));
15a9155f	358	dput(d);
cfcad62c EP	359	return 0;
	360	}
	361
e9fd702a	362	/* Associate the given rule with an existing parent.
cfcad62c EP	363	* Caller must hold audit_filter_mutex. */
	364	static void audit_add_to_parent(struct audit_krule *krule,
	365	struct audit_parent *parent)
	366	{
	367	struct audit_watch w, watch = krule->watch;
	368	int watch_found = 0;
	369
e9fd702a EP	370	BUG_ON(!mutex_is_locked(&audit_filter_mutex));
e9fd702a EP	371
cfcad62c EP	372	list_for_each_entry(w, &parent->watches, wlist) {
	373	if (strcmp(watch->path, w->path))
	374	continue;
	375
	376	watch_found = 1;
	377
f8259b26	378	/* put krule's ref to temporary watch */
cfcad62c EP	379	audit_put_watch(watch);
	380
	381	audit_get_watch(w);
	382	krule->watch = watch = w;
aa7c043d RGB	383
aa7c043d RGB	384	audit_put_parent(parent);
cfcad62c EP	385	break;
	386	}
	387
	388	if (!watch_found) {
cfcad62c EP	389	watch->parent = parent;
cfcad62c EP	390
f8259b26	391	audit_get_watch(watch);
cfcad62c EP	392	list_add(&watch->wlist, &parent->watches);
	393	}
	394	list_add(&krule->rlist, &watch->rules);
	395	}
	396
	397	/* Find a matching watch entry, or add this one.
	398	* Caller must hold audit_filter_mutex. */
ae7b8f41	399	int audit_add_watch(struct audit_krule krule, struct list_head *list)
cfcad62c EP	400	{
cfcad62c EP	401	struct audit_watch *watch = krule->watch;
cfcad62c	402	struct audit_parent *parent;
15a9155f	403	struct path parent_path;
ae7b8f41	404	int h, ret = 0;
cfcad62c	405
baa2a4fd RC	406	/*
	407	* When we will be calling audit_add_to_parent, krule->watch might have
	408	* been updated and watch might have been freed.
	409	* So we need to keep a reference of watch.
	410	*/
	411	audit_get_watch(watch);
	412
35fe4d0b EP	413	mutex_unlock(&audit_filter_mutex);
	414
	415	/* Avoid calling path_lookup under audit_filter_mutex. */
15a9155f	416	ret = audit_get_nd(watch, &parent_path);
35fe4d0b	417
15a9155f	418	/* caller expects mutex locked */
e118e9c5 EP	419	mutex_lock(&audit_filter_mutex);
e118e9c5 EP	420
baa2a4fd RC	421	if (ret) {
baa2a4fd RC	422	audit_put_watch(watch);
15a9155f	423	return ret;
baa2a4fd	424	}
cfcad62c	425
e118e9c5	426	/* either find an old parent or attach a new one */
3b362157	427	parent = audit_find_parent(d_backing_inode(parent_path.dentry));
e9fd702a	428	if (!parent) {
15a9155f	429	parent = audit_init_parent(&parent_path);
cfcad62c	430	if (IS_ERR(parent)) {
35fe4d0b EP	431	ret = PTR_ERR(parent);
35fe4d0b EP	432	goto error;
cfcad62c	433	}
e9fd702a	434	}
cfcad62c	435
e118e9c5	436	audit_add_to_parent(krule, parent);
cfcad62c	437
ae7b8f41 EP	438	h = audit_hash_ino((u32)watch->ino);
ae7b8f41 EP	439	*list = &audit_inode_hash[h];
35fe4d0b	440	error:
15a9155f	441	path_put(&parent_path);
baa2a4fd	442	audit_put_watch(watch);
cfcad62c EP	443	return ret;
	444	}
	445
a05fb6cc	446	void audit_remove_watch_rule(struct audit_krule *krule)
cfcad62c EP	447	{
	448	struct audit_watch *watch = krule->watch;
	449	struct audit_parent *parent = watch->parent;
	450
	451	list_del(&krule->rlist);
	452
	453	if (list_empty(&watch->rules)) {
d76036ab JK	454	/*
	455	* audit_remove_watch() drops our reference to 'parent' which
	456	* can get freed. Grab our own reference to be safe.
	457	*/
	458	audit_get_parent(parent);
cfcad62c	459	audit_remove_watch(watch);
d76036ab	460	if (list_empty(&parent->watches))
e2a29943	461	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
d76036ab	462	audit_put_parent(parent);
cfcad62c EP	463	}
	464	}
	465
e9fd702a	466	/* Update watch data in audit rules based on fsnotify events. */
3a9b16b4	467	static int audit_watch_handle_event(struct fsnotify_group *group,
7053aee2	468	struct inode *to_tell,
3cd5eca8	469	u32 mask, const void *data, int data_type,
e43e9c33	470	const struct qstr *dname, u32 cookie,
9385a84d	471	struct fsnotify_iter_info *iter_info)
e9fd702a	472	{
5b0457ad	473	struct fsnotify_mark *inode_mark = fsnotify_iter_inode_mark(iter_info);
aa93bdc5	474	const struct inode *inode = fsnotify_data_inode(data, data_type);
cfcad62c EP	475	struct audit_parent *parent;
cfcad62c EP	476
ce8f76fb	477	parent = container_of(inode_mark, struct audit_parent, mark);
e9fd702a	478
4cd76a47	479	BUG_ON(group != audit_watch_group);
aa93bdc5	480	WARN_ON(!inode);
cfcad62c	481
e9fd702a	482	if (mask & (FS_CREATE\|FS_MOVED_TO) && inode)
6921d4eb	483	audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
e9fd702a	484	else if (mask & (FS_DELETE\|FS_MOVED_FROM))
6921d4eb	485	audit_update_watch(parent, dname, AUDIT_DEV_UNSET, AUDIT_INO_UNSET, 1);
e9fd702a	486	else if (mask & (FS_DELETE_SELF\|FS_UNMOUNT\|FS_MOVE_SELF))
cfcad62c	487	audit_remove_parent_watches(parent);
e9fd702a EP	488
	489	return 0;
	490	}
	491
e9fd702a	492	static const struct fsnotify_ops audit_watch_fsnotify_ops = {
e9fd702a	493	.handle_event = audit_watch_handle_event,
054c636e	494	.free_mark = audit_watch_free_mark,
cfcad62c EP	495	};
	496
	497	static int __init audit_watch_init(void)
	498	{
0d2e2a1d	499	audit_watch_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops);
e9fd702a EP	500	if (IS_ERR(audit_watch_group)) {
	501	audit_watch_group = NULL;
	502	audit_panic("cannot create audit fsnotify group");
	503	}
cfcad62c EP	504	return 0;
cfcad62c EP	505	}
1a3aedbc	506	device_initcall(audit_watch_init);
34d99af5 RGB	507
	508	int audit_dupe_exe(struct audit_krule new, struct audit_krule old)
	509	{
	510	struct audit_fsnotify_mark *audit_mark;
	511	char *pathname;
	512
	513	pathname = kstrdup(audit_mark_path(old->exe), GFP_KERNEL);
	514	if (!pathname)
	515	return -ENOMEM;
	516
	517	audit_mark = audit_alloc_mark(new, pathname, strlen(pathname));
	518	if (IS_ERR(audit_mark)) {
	519	kfree(pathname);
	520	return PTR_ERR(audit_mark);
	521	}
	522	new->exe = audit_mark;
	523
	524	return 0;
	525	}
	526
	527	int audit_exe_compare(struct task_struct tsk, struct audit_fsnotify_mark mark)
	528	{
15ce414b RGB	529	struct file *exe_file;
	530	unsigned long ino;
	531	dev_t dev;
	532
5efc2443 MG	533	exe_file = get_task_exe_file(tsk);
	534	if (!exe_file)
	535	return 0;
45063097 AV	536	ino = file_inode(exe_file)->i_ino;
45063097 AV	537	dev = file_inode(exe_file)->i_sb->s_dev;
5efc2443	538	fput(exe_file);
34d99af5 RGB	539	return audit_mark_compare(mark, ino, dev);
34d99af5 RGB	540	}