forked from Qortal/Brooklyn
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
537 lines
14 KiB
537 lines
14 KiB
// SPDX-License-Identifier: GPL-2.0-or-later |
|
/* audit_watch.c -- watching inodes |
|
* |
|
* Copyright 2003-2009 Red Hat, Inc. |
|
* Copyright 2005 Hewlett-Packard Development Company, L.P. |
|
* Copyright 2005 IBM Corporation |
|
*/ |
|
|
|
#include <linux/file.h> |
|
#include <linux/kernel.h> |
|
#include <linux/audit.h> |
|
#include <linux/kthread.h> |
|
#include <linux/mutex.h> |
|
#include <linux/fs.h> |
|
#include <linux/fsnotify_backend.h> |
|
#include <linux/namei.h> |
|
#include <linux/netlink.h> |
|
#include <linux/refcount.h> |
|
#include <linux/sched.h> |
|
#include <linux/slab.h> |
|
#include <linux/security.h> |
|
#include "audit.h" |
|
|
|
/* |
|
* Reference counting: |
|
* |
|
* audit_parent: lifetime is from audit_init_parent() to receipt of an FS_IGNORED |
|
* event. Each audit_watch holds a reference to its associated parent. |
|
* |
|
* audit_watch: if added to lists, lifetime is from audit_init_watch() to |
|
* audit_remove_watch(). Additionally, an audit_watch may exist |
|
* temporarily to assist in searching existing filter data. Each |
|
* audit_krule holds a reference to its associated watch. |
|
*/ |
|
|
|
struct audit_watch { |
|
refcount_t count; /* reference count */ |
|
dev_t dev; /* associated superblock device */ |
|
char *path; /* insertion path */ |
|
unsigned long ino; /* associated inode number */ |
|
struct audit_parent *parent; /* associated parent */ |
|
struct list_head wlist; /* entry in parent->watches list */ |
|
struct list_head rules; /* anchor for krule->rlist */ |
|
}; |
|
|
|
struct audit_parent { |
|
struct list_head watches; /* anchor for audit_watch->wlist */ |
|
struct fsnotify_mark mark; /* fsnotify mark on the inode */ |
|
}; |
|
|
|
/* fsnotify handle. */ |
|
static struct fsnotify_group *audit_watch_group; |
|
|
|
/* fsnotify events we care about. */ |
|
#define AUDIT_FS_WATCH (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\ |
|
FS_MOVE_SELF | FS_UNMOUNT) |
|
|
|
static void audit_free_parent(struct audit_parent *parent) |
|
{ |
|
WARN_ON(!list_empty(&parent->watches)); |
|
kfree(parent); |
|
} |
|
|
|
static void audit_watch_free_mark(struct fsnotify_mark *entry) |
|
{ |
|
struct audit_parent *parent; |
|
|
|
parent = container_of(entry, struct audit_parent, mark); |
|
audit_free_parent(parent); |
|
} |
|
|
|
static void audit_get_parent(struct audit_parent *parent) |
|
{ |
|
if (likely(parent)) |
|
fsnotify_get_mark(&parent->mark); |
|
} |
|
|
|
static void audit_put_parent(struct audit_parent *parent) |
|
{ |
|
if (likely(parent)) |
|
fsnotify_put_mark(&parent->mark); |
|
} |
|
|
|
/* |
|
* Find and return the audit_parent on the given inode. If found a reference |
|
* is taken on this parent. |
|
*/ |
|
static inline struct audit_parent *audit_find_parent(struct inode *inode) |
|
{ |
|
struct audit_parent *parent = NULL; |
|
struct fsnotify_mark *entry; |
|
|
|
entry = fsnotify_find_mark(&inode->i_fsnotify_marks, audit_watch_group); |
|
if (entry) |
|
parent = container_of(entry, struct audit_parent, mark); |
|
|
|
return parent; |
|
} |
|
|
|
void audit_get_watch(struct audit_watch *watch) |
|
{ |
|
refcount_inc(&watch->count); |
|
} |
|
|
|
void audit_put_watch(struct audit_watch *watch) |
|
{ |
|
if (refcount_dec_and_test(&watch->count)) { |
|
WARN_ON(watch->parent); |
|
WARN_ON(!list_empty(&watch->rules)); |
|
kfree(watch->path); |
|
kfree(watch); |
|
} |
|
} |
|
|
|
static void audit_remove_watch(struct audit_watch *watch) |
|
{ |
|
list_del(&watch->wlist); |
|
audit_put_parent(watch->parent); |
|
watch->parent = NULL; |
|
audit_put_watch(watch); /* match initial get */ |
|
} |
|
|
|
char *audit_watch_path(struct audit_watch *watch) |
|
{ |
|
return watch->path; |
|
} |
|
|
|
int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev) |
|
{ |
|
return (watch->ino != AUDIT_INO_UNSET) && |
|
(watch->ino == ino) && |
|
(watch->dev == dev); |
|
} |
|
|
|
/* Initialize a parent watch entry. */ |
|
static struct audit_parent *audit_init_parent(struct path *path) |
|
{ |
|
struct inode *inode = d_backing_inode(path->dentry); |
|
struct audit_parent *parent; |
|
int ret; |
|
|
|
parent = kzalloc(sizeof(*parent), GFP_KERNEL); |
|
if (unlikely(!parent)) |
|
return ERR_PTR(-ENOMEM); |
|
|
|
INIT_LIST_HEAD(&parent->watches); |
|
|
|
fsnotify_init_mark(&parent->mark, audit_watch_group); |
|
parent->mark.mask = AUDIT_FS_WATCH; |
|
ret = fsnotify_add_inode_mark(&parent->mark, inode, 0); |
|
if (ret < 0) { |
|
audit_free_parent(parent); |
|
return ERR_PTR(ret); |
|
} |
|
|
|
return parent; |
|
} |
|
|
|
/* Initialize a watch entry. */ |
|
static struct audit_watch *audit_init_watch(char *path) |
|
{ |
|
struct audit_watch *watch; |
|
|
|
watch = kzalloc(sizeof(*watch), GFP_KERNEL); |
|
if (unlikely(!watch)) |
|
return ERR_PTR(-ENOMEM); |
|
|
|
INIT_LIST_HEAD(&watch->rules); |
|
refcount_set(&watch->count, 1); |
|
watch->path = path; |
|
watch->dev = AUDIT_DEV_UNSET; |
|
watch->ino = AUDIT_INO_UNSET; |
|
|
|
return watch; |
|
} |
|
|
|
/* Translate a watch string to kernel representation. */ |
|
int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op) |
|
{ |
|
struct audit_watch *watch; |
|
|
|
if (!audit_watch_group) |
|
return -EOPNOTSUPP; |
|
|
|
if (path[0] != '/' || path[len-1] == '/' || |
|
krule->listnr != AUDIT_FILTER_EXIT || |
|
op != Audit_equal || |
|
krule->inode_f || krule->watch || krule->tree) |
|
return -EINVAL; |
|
|
|
watch = audit_init_watch(path); |
|
if (IS_ERR(watch)) |
|
return PTR_ERR(watch); |
|
|
|
krule->watch = watch; |
|
|
|
return 0; |
|
} |
|
|
|
/* Duplicate the given audit watch. The new watch's rules list is initialized |
|
* to an empty list and wlist is undefined. */ |
|
static struct audit_watch *audit_dupe_watch(struct audit_watch *old) |
|
{ |
|
char *path; |
|
struct audit_watch *new; |
|
|
|
path = kstrdup(old->path, GFP_KERNEL); |
|
if (unlikely(!path)) |
|
return ERR_PTR(-ENOMEM); |
|
|
|
new = audit_init_watch(path); |
|
if (IS_ERR(new)) { |
|
kfree(path); |
|
goto out; |
|
} |
|
|
|
new->dev = old->dev; |
|
new->ino = old->ino; |
|
audit_get_parent(old->parent); |
|
new->parent = old->parent; |
|
|
|
out: |
|
return new; |
|
} |
|
|
|
static void audit_watch_log_rule_change(struct audit_krule *r, struct audit_watch *w, char *op) |
|
{ |
|
struct audit_buffer *ab; |
|
|
|
if (!audit_enabled) |
|
return; |
|
ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE); |
|
if (!ab) |
|
return; |
|
audit_log_session_info(ab); |
|
audit_log_format(ab, "op=%s path=", op); |
|
audit_log_untrustedstring(ab, w->path); |
|
audit_log_key(ab, r->filterkey); |
|
audit_log_format(ab, " list=%d res=1", r->listnr); |
|
audit_log_end(ab); |
|
} |
|
|
|
/* Update inode info in audit rules based on filesystem event. */ |
|
static void audit_update_watch(struct audit_parent *parent, |
|
const struct qstr *dname, dev_t dev, |
|
unsigned long ino, unsigned invalidating) |
|
{ |
|
struct audit_watch *owatch, *nwatch, *nextw; |
|
struct audit_krule *r, *nextr; |
|
struct audit_entry *oentry, *nentry; |
|
|
|
mutex_lock(&audit_filter_mutex); |
|
/* Run all of the watches on this parent looking for the one that |
|
* matches the given dname */ |
|
list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) { |
|
if (audit_compare_dname_path(dname, owatch->path, |
|
AUDIT_NAME_FULL)) |
|
continue; |
|
|
|
/* If the update involves invalidating rules, do the inode-based |
|
* filtering now, so we don't omit records. */ |
|
if (invalidating && !audit_dummy_context()) |
|
audit_filter_inodes(current, audit_context()); |
|
|
|
/* updating ino will likely change which audit_hash_list we |
|
* are on so we need a new watch for the new list */ |
|
nwatch = audit_dupe_watch(owatch); |
|
if (IS_ERR(nwatch)) { |
|
mutex_unlock(&audit_filter_mutex); |
|
audit_panic("error updating watch, skipping"); |
|
return; |
|
} |
|
nwatch->dev = dev; |
|
nwatch->ino = ino; |
|
|
|
list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) { |
|
|
|
oentry = container_of(r, struct audit_entry, rule); |
|
list_del(&oentry->rule.rlist); |
|
list_del_rcu(&oentry->list); |
|
|
|
nentry = audit_dupe_rule(&oentry->rule); |
|
if (IS_ERR(nentry)) { |
|
list_del(&oentry->rule.list); |
|
audit_panic("error updating watch, removing"); |
|
} else { |
|
int h = audit_hash_ino((u32)ino); |
|
|
|
/* |
|
* nentry->rule.watch == oentry->rule.watch so |
|
* we must drop that reference and set it to our |
|
* new watch. |
|
*/ |
|
audit_put_watch(nentry->rule.watch); |
|
audit_get_watch(nwatch); |
|
nentry->rule.watch = nwatch; |
|
list_add(&nentry->rule.rlist, &nwatch->rules); |
|
list_add_rcu(&nentry->list, &audit_inode_hash[h]); |
|
list_replace(&oentry->rule.list, |
|
&nentry->rule.list); |
|
} |
|
if (oentry->rule.exe) |
|
audit_remove_mark(oentry->rule.exe); |
|
|
|
call_rcu(&oentry->rcu, audit_free_rule_rcu); |
|
} |
|
|
|
audit_remove_watch(owatch); |
|
goto add_watch_to_parent; /* event applies to a single watch */ |
|
} |
|
mutex_unlock(&audit_filter_mutex); |
|
return; |
|
|
|
add_watch_to_parent: |
|
list_add(&nwatch->wlist, &parent->watches); |
|
mutex_unlock(&audit_filter_mutex); |
|
return; |
|
} |
|
|
|
/* Remove all watches & rules associated with a parent that is going away. */ |
|
static void audit_remove_parent_watches(struct audit_parent *parent) |
|
{ |
|
struct audit_watch *w, *nextw; |
|
struct audit_krule *r, *nextr; |
|
struct audit_entry *e; |
|
|
|
mutex_lock(&audit_filter_mutex); |
|
list_for_each_entry_safe(w, nextw, &parent->watches, wlist) { |
|
list_for_each_entry_safe(r, nextr, &w->rules, rlist) { |
|
e = container_of(r, struct audit_entry, rule); |
|
audit_watch_log_rule_change(r, w, "remove_rule"); |
|
if (e->rule.exe) |
|
audit_remove_mark(e->rule.exe); |
|
list_del(&r->rlist); |
|
list_del(&r->list); |
|
list_del_rcu(&e->list); |
|
call_rcu(&e->rcu, audit_free_rule_rcu); |
|
} |
|
audit_remove_watch(w); |
|
} |
|
mutex_unlock(&audit_filter_mutex); |
|
|
|
fsnotify_destroy_mark(&parent->mark, audit_watch_group); |
|
} |
|
|
|
/* Get path information necessary for adding watches. */ |
|
static int audit_get_nd(struct audit_watch *watch, struct path *parent) |
|
{ |
|
struct dentry *d = kern_path_locked(watch->path, parent); |
|
if (IS_ERR(d)) |
|
return PTR_ERR(d); |
|
if (d_is_positive(d)) { |
|
/* update watch filter fields */ |
|
watch->dev = d->d_sb->s_dev; |
|
watch->ino = d_backing_inode(d)->i_ino; |
|
} |
|
inode_unlock(d_backing_inode(parent->dentry)); |
|
dput(d); |
|
return 0; |
|
} |
|
|
|
/* Associate the given rule with an existing parent. |
|
* Caller must hold audit_filter_mutex. */ |
|
static void audit_add_to_parent(struct audit_krule *krule, |
|
struct audit_parent *parent) |
|
{ |
|
struct audit_watch *w, *watch = krule->watch; |
|
int watch_found = 0; |
|
|
|
BUG_ON(!mutex_is_locked(&audit_filter_mutex)); |
|
|
|
list_for_each_entry(w, &parent->watches, wlist) { |
|
if (strcmp(watch->path, w->path)) |
|
continue; |
|
|
|
watch_found = 1; |
|
|
|
/* put krule's ref to temporary watch */ |
|
audit_put_watch(watch); |
|
|
|
audit_get_watch(w); |
|
krule->watch = watch = w; |
|
|
|
audit_put_parent(parent); |
|
break; |
|
} |
|
|
|
if (!watch_found) { |
|
watch->parent = parent; |
|
|
|
audit_get_watch(watch); |
|
list_add(&watch->wlist, &parent->watches); |
|
} |
|
list_add(&krule->rlist, &watch->rules); |
|
} |
|
|
|
/* Find a matching watch entry, or add this one. |
|
* Caller must hold audit_filter_mutex. */ |
|
int audit_add_watch(struct audit_krule *krule, struct list_head **list) |
|
{ |
|
struct audit_watch *watch = krule->watch; |
|
struct audit_parent *parent; |
|
struct path parent_path; |
|
int h, ret = 0; |
|
|
|
/* |
|
* When we will be calling audit_add_to_parent, krule->watch might have |
|
* been updated and watch might have been freed. |
|
* So we need to keep a reference of watch. |
|
*/ |
|
audit_get_watch(watch); |
|
|
|
mutex_unlock(&audit_filter_mutex); |
|
|
|
/* Avoid calling path_lookup under audit_filter_mutex. */ |
|
ret = audit_get_nd(watch, &parent_path); |
|
|
|
/* caller expects mutex locked */ |
|
mutex_lock(&audit_filter_mutex); |
|
|
|
if (ret) { |
|
audit_put_watch(watch); |
|
return ret; |
|
} |
|
|
|
/* either find an old parent or attach a new one */ |
|
parent = audit_find_parent(d_backing_inode(parent_path.dentry)); |
|
if (!parent) { |
|
parent = audit_init_parent(&parent_path); |
|
if (IS_ERR(parent)) { |
|
ret = PTR_ERR(parent); |
|
goto error; |
|
} |
|
} |
|
|
|
audit_add_to_parent(krule, parent); |
|
|
|
h = audit_hash_ino((u32)watch->ino); |
|
*list = &audit_inode_hash[h]; |
|
error: |
|
path_put(&parent_path); |
|
audit_put_watch(watch); |
|
return ret; |
|
} |
|
|
|
void audit_remove_watch_rule(struct audit_krule *krule) |
|
{ |
|
struct audit_watch *watch = krule->watch; |
|
struct audit_parent *parent = watch->parent; |
|
|
|
list_del(&krule->rlist); |
|
|
|
if (list_empty(&watch->rules)) { |
|
/* |
|
* audit_remove_watch() drops our reference to 'parent' which |
|
* can get freed. Grab our own reference to be safe. |
|
*/ |
|
audit_get_parent(parent); |
|
audit_remove_watch(watch); |
|
if (list_empty(&parent->watches)) |
|
fsnotify_destroy_mark(&parent->mark, audit_watch_group); |
|
audit_put_parent(parent); |
|
} |
|
} |
|
|
|
/* Update watch data in audit rules based on fsnotify events. */ |
|
static int audit_watch_handle_event(struct fsnotify_mark *inode_mark, u32 mask, |
|
struct inode *inode, struct inode *dir, |
|
const struct qstr *dname, u32 cookie) |
|
{ |
|
struct audit_parent *parent; |
|
|
|
parent = container_of(inode_mark, struct audit_parent, mark); |
|
|
|
if (WARN_ON_ONCE(inode_mark->group != audit_watch_group) || |
|
WARN_ON_ONCE(!inode)) |
|
return 0; |
|
|
|
if (mask & (FS_CREATE|FS_MOVED_TO) && inode) |
|
audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0); |
|
else if (mask & (FS_DELETE|FS_MOVED_FROM)) |
|
audit_update_watch(parent, dname, AUDIT_DEV_UNSET, AUDIT_INO_UNSET, 1); |
|
else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF)) |
|
audit_remove_parent_watches(parent); |
|
|
|
return 0; |
|
} |
|
|
|
static const struct fsnotify_ops audit_watch_fsnotify_ops = { |
|
.handle_inode_event = audit_watch_handle_event, |
|
.free_mark = audit_watch_free_mark, |
|
}; |
|
|
|
static int __init audit_watch_init(void) |
|
{ |
|
audit_watch_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops); |
|
if (IS_ERR(audit_watch_group)) { |
|
audit_watch_group = NULL; |
|
audit_panic("cannot create audit fsnotify group"); |
|
} |
|
return 0; |
|
} |
|
device_initcall(audit_watch_init); |
|
|
|
int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old) |
|
{ |
|
struct audit_fsnotify_mark *audit_mark; |
|
char *pathname; |
|
|
|
pathname = kstrdup(audit_mark_path(old->exe), GFP_KERNEL); |
|
if (!pathname) |
|
return -ENOMEM; |
|
|
|
audit_mark = audit_alloc_mark(new, pathname, strlen(pathname)); |
|
if (IS_ERR(audit_mark)) { |
|
kfree(pathname); |
|
return PTR_ERR(audit_mark); |
|
} |
|
new->exe = audit_mark; |
|
|
|
return 0; |
|
} |
|
|
|
int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark) |
|
{ |
|
struct file *exe_file; |
|
unsigned long ino; |
|
dev_t dev; |
|
|
|
exe_file = get_task_exe_file(tsk); |
|
if (!exe_file) |
|
return 0; |
|
ino = file_inode(exe_file)->i_ino; |
|
dev = file_inode(exe_file)->i_sb->s_dev; |
|
fput(exe_file); |
|
return audit_mark_compare(mark, ino, dev); |
|
}
|
|
|