projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
LSM/Audit: Introduce generic Audit LSM hooks
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / kernel / auditfilter.c
CommitLineData
fe7752ba
DW		 1/* auditfilter.c -- filtering of audit events
2 *
3 * Copyright 2003-2004 Red Hat, Inc.
4 * Copyright 2005 Hewlett-Packard Development Company, L.P.
5 * Copyright 2005 IBM Corporation
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 */
21
22#include <linux/kernel.h>
23#include <linux/audit.h>
24#include <linux/kthread.h>
f368c07d
AG		 25#include <linux/mutex.h>
26#include <linux/fs.h>
27#include <linux/namei.h>
fe7752ba 28#include <linux/netlink.h>
f368c07d
AG		 29#include <linux/sched.h>
30#include <linux/inotify.h>
2a862b32 31#include <linux/security.h>
3dc7e315 32#include <linux/selinux.h>
fe7752ba
DW		 33#include "audit.h"
34
f368c07d
AG		 35/*
36 * Locking model:
37 *
38 * audit_filter_mutex:
39 * Synchronizes writes and blocking reads of audit's filterlist
40 * data. Rcu is used to traverse the filterlist and access
41 * contents of structs audit_entry, audit_watch and opaque
42 * selinux rules during filtering. If modified, these structures
43 * must be copied and replace their counterparts in the filterlist.
44 * An audit_parent struct is not accessed during filtering, so may
45 * be written directly provided audit_filter_mutex is held.
46 */
47
48/*
49 * Reference counting:
50 *
51 * audit_parent: lifetime is from audit_init_parent() to receipt of an IN_IGNORED
52 * event. Each audit_watch holds a reference to its associated parent.
53 *
54 * audit_watch: if added to lists, lifetime is from audit_init_watch() to
55 * audit_remove_watch(). Additionally, an audit_watch may exist
56 * temporarily to assist in searching existing filter data. Each
57 * audit_krule holds a reference to its associated watch.
58 */
59
60struct audit_parent {
61 struct list_head ilist; /* entry in inotify registration list */
62 struct list_head watches; /* associated watches */
63 struct inotify_watch wdata; /* inotify watch data */
64 unsigned flags; /* status flags */
65};
66
67/*
68 * audit_parent status flags:
69 *
70 * AUDIT_PARENT_INVALID - set anytime rules/watches are auto-removed due to
71 * a filesystem event to ensure we're adding audit watches to a valid parent.
72 * Technically not needed for IN_DELETE_SELF or IN_UNMOUNT events, as we cannot
73 * receive them while we have nameidata, but must be used for IN_MOVE_SELF which
74 * we can receive while holding nameidata.
75 */
76#define AUDIT_PARENT_INVALID 0x001
77
78/* Audit filter lists, defined in <linux/audit.h> */
fe7752ba
DW		 79struct list_head audit_filter_list[AUDIT_NR_FILTERS] = {
80 LIST_HEAD_INIT(audit_filter_list[0]),
81 LIST_HEAD_INIT(audit_filter_list[1]),
82 LIST_HEAD_INIT(audit_filter_list[2]),
83 LIST_HEAD_INIT(audit_filter_list[3]),
84 LIST_HEAD_INIT(audit_filter_list[4]),
85 LIST_HEAD_INIT(audit_filter_list[5]),
86#if AUDIT_NR_FILTERS != 6
87#error Fix audit_filter_list initialiser
88#endif
89};
90
74c3cbe3 91DEFINE_MUTEX(audit_filter_mutex);
f368c07d
AG		 92
93/* Inotify handle */
94extern struct inotify_handle *audit_ih;
95
96/* Inotify events we care about. */
97#define AUDIT_IN_WATCH IN_MOVE|IN_CREATE|IN_DELETE|IN_DELETE_SELF|IN_MOVE_SELF
98
1a6b9f23
EP		 99extern int audit_enabled;
100
f368c07d
AG		 101void audit_free_parent(struct inotify_watch *i_watch)
102{
103 struct audit_parent *parent;
104
105 parent = container_of(i_watch, struct audit_parent, wdata);
106 WARN_ON(!list_empty(&parent->watches));
107 kfree(parent);
108}
109
110static inline void audit_get_watch(struct audit_watch *watch)
111{
112 atomic_inc(&watch->count);
113}
114
115static void audit_put_watch(struct audit_watch *watch)
116{
117 if (atomic_dec_and_test(&watch->count)) {
118 WARN_ON(watch->parent);
119 WARN_ON(!list_empty(&watch->rules));
120 kfree(watch->path);
121 kfree(watch);
122 }
123}
124
125static void audit_remove_watch(struct audit_watch *watch)
126{
127 list_del(&watch->wlist);
128 put_inotify_watch(&watch->parent->wdata);
129 watch->parent = NULL;
130 audit_put_watch(watch); /* match initial get */
131}
132
93315ed6 133static inline void audit_free_rule(struct audit_entry *e)
fe7752ba 134{
3dc7e315 135 int i;
f368c07d
AG		 136
137 /* some rules don't have associated watches */
138 if (e->rule.watch)
139 audit_put_watch(e->rule.watch);
3dc7e315
DG		 140 if (e->rule.fields)
141 for (i = 0; i < e->rule.field_count; i++) {
142 struct audit_field *f = &e->rule.fields[i];
143 kfree(f->se_str);
144 selinux_audit_rule_free(f->se_rule);
145 }
93315ed6 146 kfree(e->rule.fields);
5adc8a6a 147 kfree(e->rule.filterkey);
93315ed6
AG		 148 kfree(e);
149}
150
74c3cbe3 151void audit_free_rule_rcu(struct rcu_head *head)
93315ed6
AG		 152{
153 struct audit_entry *e = container_of(head, struct audit_entry, rcu);
154 audit_free_rule(e);
155}
156
f368c07d
AG		 157/* Initialize a parent watch entry. */
158static struct audit_parent *audit_init_parent(struct nameidata *ndp)
159{
160 struct audit_parent *parent;
161 s32 wd;
162
163 parent = kzalloc(sizeof(*parent), GFP_KERNEL);
164 if (unlikely(!parent))
165 return ERR_PTR(-ENOMEM);
166
167 INIT_LIST_HEAD(&parent->watches);
168 parent->flags = 0;
169
170 inotify_init_watch(&parent->wdata);
171 /* grab a ref so inotify watch hangs around until we take audit_filter_mutex */
172 get_inotify_watch(&parent->wdata);
4ac91378
JB		 173 wd = inotify_add_watch(audit_ih, &parent->wdata,
174 ndp->path.dentry->d_inode, AUDIT_IN_WATCH);
f368c07d
AG		 175 if (wd < 0) {
176 audit_free_parent(&parent->wdata);
177 return ERR_PTR(wd);
178 }
179
180 return parent;
181}
182
183/* Initialize a watch entry. */
184static struct audit_watch *audit_init_watch(char *path)
185{
186 struct audit_watch *watch;
187
188 watch = kzalloc(sizeof(*watch), GFP_KERNEL);
189 if (unlikely(!watch))
190 return ERR_PTR(-ENOMEM);
191
192 INIT_LIST_HEAD(&watch->rules);
193 atomic_set(&watch->count, 1);
194 watch->path = path;
195 watch->dev = (dev_t)-1;
196 watch->ino = (unsigned long)-1;
197
198 return watch;
199}
200
3dc7e315
DG		 201/* Initialize an audit filterlist entry. */
202static inline struct audit_entry *audit_init_entry(u32 field_count)
203{
204 struct audit_entry *entry;
205 struct audit_field *fields;
206
207 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
208 if (unlikely(!entry))
209 return NULL;
210
211 fields = kzalloc(sizeof(*fields) * field_count, GFP_KERNEL);
212 if (unlikely(!fields)) {
213 kfree(entry);
214 return NULL;
215 }
216 entry->rule.fields = fields;
217
218 return entry;
219}
220
93315ed6
AG		 221/* Unpack a filter field's string representation from user-space
222 * buffer. */
74c3cbe3 223char *audit_unpack_string(void **bufp, size_t *remain, size_t len)
93315ed6
AG		 224{
225 char *str;
226
227 if (!*bufp || (len == 0) || (len > *remain))
228 return ERR_PTR(-EINVAL);
229
230 /* Of the currently implemented string fields, PATH_MAX
231 * defines the longest valid length.
232 */
233 if (len > PATH_MAX)
234 return ERR_PTR(-ENAMETOOLONG);
235
236 str = kmalloc(len + 1, GFP_KERNEL);
237 if (unlikely(!str))
238 return ERR_PTR(-ENOMEM);
239
240 memcpy(str, *bufp, len);
241 str[len] = 0;
242 *bufp += len;
243 *remain -= len;
244
245 return str;
246}
247
f368c07d
AG		 248/* Translate an inode field to kernel respresentation. */
249static inline int audit_to_inode(struct audit_krule *krule,
250 struct audit_field *f)
251{
252 if (krule->listnr != AUDIT_FILTER_EXIT ||
74c3cbe3 253 krule->watch || krule->inode_f || krule->tree)
f368c07d
AG		 254 return -EINVAL;
255
256 krule->inode_f = f;
257 return 0;
258}
259
260/* Translate a watch string to kernel respresentation. */
261static int audit_to_watch(struct audit_krule *krule, char *path, int len,
262 u32 op)
263{
264 struct audit_watch *watch;
265
266 if (!audit_ih)
267 return -EOPNOTSUPP;
268
269 if (path[0] != '/' || path[len-1] == '/' ||
270 krule->listnr != AUDIT_FILTER_EXIT ||
271 op & ~AUDIT_EQUAL ||
74c3cbe3 272 krule->inode_f || krule->watch || krule->tree)
f368c07d
AG		 273 return -EINVAL;
274
275 watch = audit_init_watch(path);
276 if (unlikely(IS_ERR(watch)))
277 return PTR_ERR(watch);
278
279 audit_get_watch(watch);
280 krule->watch = watch;
281
282 return 0;
283}
284
b915543b
AV		 285static __u32 *classes[AUDIT_SYSCALL_CLASSES];
286
287int __init audit_register_class(int class, unsigned *list)
288{
289 __u32 *p = kzalloc(AUDIT_BITMASK_SIZE * sizeof(__u32), GFP_KERNEL);
290 if (!p)
291 return -ENOMEM;
292 while (*list != ~0U) {
293 unsigned n = *list++;
294 if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) {
295 kfree(p);
296 return -EINVAL;
297 }
298 p[AUDIT_WORD(n)] |= AUDIT_BIT(n);
299 }
300 if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) {
301 kfree(p);
302 return -EINVAL;
303 }
304 classes[class] = p;
305 return 0;
306}
307
55669bfa
AV		 308int audit_match_class(int class, unsigned syscall)
309{
c926e4f4 310 if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32))
55669bfa
AV		 311 return 0;
312 if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class]))
313 return 0;
314 return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall);
315}
316
327b9eeb 317#ifdef CONFIG_AUDITSYSCALL
e54dc243
AG		 318static inline int audit_match_class_bits(int class, u32 *mask)
319{
320 int i;
321
322 if (classes[class]) {
323 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
324 if (mask[i] & classes[class][i])
325 return 0;
326 }
327 return 1;
328}
329
330static int audit_match_signal(struct audit_entry *entry)
331{
332 struct audit_field *arch = entry->rule.arch_f;
333
334 if (!arch) {
335 /* When arch is unspecified, we must check both masks on biarch
336 * as syscall number alone is ambiguous. */
337 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
338 entry->rule.mask) &&
339 audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
340 entry->rule.mask));
341 }
342
343 switch(audit_classify_arch(arch->val)) {
344 case 0: /* native */
345 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
346 entry->rule.mask));
347 case 1: /* 32bit on biarch */
348 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
349 entry->rule.mask));
350 default:
351 return 1;
352 }
353}
327b9eeb 354#endif
e54dc243 355
93315ed6
AG		 356/* Common user-space to kernel rule translation. */
357static inline struct audit_entry *audit_to_entry_common(struct audit_rule *rule)
358{
359 unsigned listnr;
360 struct audit_entry *entry;
93315ed6
AG		 361 int i, err;
362
363 err = -EINVAL;
364 listnr = rule->flags & ~AUDIT_FILTER_PREPEND;
365 switch(listnr) {
366 default:
367 goto exit_err;
368 case AUDIT_FILTER_USER:
369 case AUDIT_FILTER_TYPE:
370#ifdef CONFIG_AUDITSYSCALL
371 case AUDIT_FILTER_ENTRY:
372 case AUDIT_FILTER_EXIT:
373 case AUDIT_FILTER_TASK:
374#endif
375 ;
376 }
014149cc
AV		 377 if (unlikely(rule->action == AUDIT_POSSIBLE)) {
378 printk(KERN_ERR "AUDIT_POSSIBLE is deprecated\n");
379 goto exit_err;
380 }
381 if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS)
93315ed6
AG		 382 goto exit_err;
383 if (rule->field_count > AUDIT_MAX_FIELDS)
384 goto exit_err;
385
386 err = -ENOMEM;
3dc7e315
DG		 387 entry = audit_init_entry(rule->field_count);
388 if (!entry)
93315ed6 389 goto exit_err;
93315ed6
AG		 390
391 entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;
392 entry->rule.listnr = listnr;
393 entry->rule.action = rule->action;
394 entry->rule.field_count = rule->field_count;
93315ed6
AG		 395
396 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
397 entry->rule.mask[i] = rule->mask[i];
398
b915543b
AV		 399 for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) {
400 int bit = AUDIT_BITMASK_SIZE * 32 - i - 1;
401 __u32 *p = &entry->rule.mask[AUDIT_WORD(bit)];
402 __u32 *class;
403
404 if (!(*p & AUDIT_BIT(bit)))
405 continue;
406 *p &= ~AUDIT_BIT(bit);
407 class = classes[i];
408 if (class) {
409 int j;
410 for (j = 0; j < AUDIT_BITMASK_SIZE; j++)
411 entry->rule.mask[j] |= class[j];
412 }
413 }
414
93315ed6
AG		 415 return entry;
416
417exit_err:
418 return ERR_PTR(err);
419}
420
421/* Translate struct audit_rule to kernel's rule respresentation.
422 * Exists for backward compatibility with userspace. */
423static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
424{
425 struct audit_entry *entry;
f368c07d 426 struct audit_field *f;
93315ed6 427 int err = 0;
fe7752ba
DW		 428 int i;
429
93315ed6
AG		 430 entry = audit_to_entry_common(rule);
431 if (IS_ERR(entry))
432 goto exit_nofree;
433
434 for (i = 0; i < rule->field_count; i++) {
435 struct audit_field *f = &entry->rule.fields[i];
436
93315ed6
AG		 437 f->op = rule->fields[i] & (AUDIT_NEGATE|AUDIT_OPERATORS);
438 f->type = rule->fields[i] & ~(AUDIT_NEGATE|AUDIT_OPERATORS);
439 f->val = rule->values[i];
440
f368c07d 441 err = -EINVAL;
f368c07d 442 switch(f->type) {
0a73dccc 443 default:
3dc7e315 444 goto exit_free;
0a73dccc
AV		 445 case AUDIT_PID:
446 case AUDIT_UID:
447 case AUDIT_EUID:
448 case AUDIT_SUID:
449 case AUDIT_FSUID:
450 case AUDIT_GID:
451 case AUDIT_EGID:
452 case AUDIT_SGID:
453 case AUDIT_FSGID:
454 case AUDIT_LOGINUID:
455 case AUDIT_PERS:
0a73dccc 456 case AUDIT_MSGTYPE:
3b33ac31 457 case AUDIT_PPID:
0a73dccc
AV		 458 case AUDIT_DEVMAJOR:
459 case AUDIT_DEVMINOR:
460 case AUDIT_EXIT:
461 case AUDIT_SUCCESS:
74f2345b
EP		 462 /* bit ops are only useful on syscall args */
463 if (f->op == AUDIT_BIT_MASK ||
464 f->op == AUDIT_BIT_TEST) {
465 err = -EINVAL;
466 goto exit_free;
467 }
468 break;
0a73dccc
AV		 469 case AUDIT_ARG0:
470 case AUDIT_ARG1:
471 case AUDIT_ARG2:
472 case AUDIT_ARG3:
473 break;
4b8a311b
EP		 474 /* arch is only allowed to be = or != */
475 case AUDIT_ARCH:
476 if ((f->op != AUDIT_NOT_EQUAL) && (f->op != AUDIT_EQUAL)
477 && (f->op != AUDIT_NEGATE) && (f->op)) {
478 err = -EINVAL;
479 goto exit_free;
480 }
e54dc243 481 entry->rule.arch_f = f;
4b8a311b 482 break;
55669bfa
AV		 483 case AUDIT_PERM:
484 if (f->val & ~15)
485 goto exit_free;
486 break;
f368c07d
AG		 487 case AUDIT_INODE:
488 err = audit_to_inode(&entry->rule, f);
489 if (err)
490 goto exit_free;
491 break;
3dc7e315
DG		 492 }
493
93315ed6 494 entry->rule.vers_ops = (f->op & AUDIT_OPERATORS) ? 2 : 1;
d9d9ec6e
DK		 495
496 /* Support for legacy operators where
497 * AUDIT_NEGATE bit signifies != and otherwise assumes == */
93315ed6 498 if (f->op & AUDIT_NEGATE)
d9d9ec6e
DK		 499 f->op = AUDIT_NOT_EQUAL;
500 else if (!f->op)
501 f->op = AUDIT_EQUAL;
502 else if (f->op == AUDIT_OPERATORS) {
503 err = -EINVAL;
504 goto exit_free;
505 }
fe7752ba 506 }
93315ed6 507
f368c07d
AG		 508 f = entry->rule.inode_f;
509 if (f) {
510 switch(f->op) {
511 case AUDIT_NOT_EQUAL:
512 entry->rule.inode_f = NULL;
513 case AUDIT_EQUAL:
514 break;
515 default:
5422e01a 516 err = -EINVAL;
f368c07d
AG		 517 goto exit_free;
518 }
519 }
520
93315ed6
AG		 521exit_nofree:
522 return entry;
523
524exit_free:
525 audit_free_rule(entry);
526 return ERR_PTR(err);
fe7752ba
DW		 527}
528
93315ed6
AG		 529/* Translate struct audit_rule_data to kernel's rule respresentation. */
530static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
531 size_t datasz)
fe7752ba 532{
93315ed6
AG		 533 int err = 0;
534 struct audit_entry *entry;
f368c07d 535 struct audit_field *f;
93315ed6 536 void *bufp;
3dc7e315 537 size_t remain = datasz - sizeof(struct audit_rule_data);
fe7752ba 538 int i;
3dc7e315 539 char *str;
fe7752ba 540
93315ed6
AG		 541 entry = audit_to_entry_common((struct audit_rule *)data);
542 if (IS_ERR(entry))
543 goto exit_nofree;
fe7752ba 544
93315ed6
AG		 545 bufp = data->buf;
546 entry->rule.vers_ops = 2;
547 for (i = 0; i < data->field_count; i++) {
548 struct audit_field *f = &entry->rule.fields[i];
549
550 err = -EINVAL;
551 if (!(data->fieldflags[i] & AUDIT_OPERATORS) ||
552 data->fieldflags[i] & ~AUDIT_OPERATORS)
553 goto exit_free;
554
555 f->op = data->fieldflags[i] & AUDIT_OPERATORS;
556 f->type = data->fields[i];
3dc7e315
DG		 557 f->val = data->values[i];
558 f->se_str = NULL;
559 f->se_rule = NULL;
93315ed6 560 switch(f->type) {
0a73dccc
AV		 561 case AUDIT_PID:
562 case AUDIT_UID:
563 case AUDIT_EUID:
564 case AUDIT_SUID:
565 case AUDIT_FSUID:
566 case AUDIT_GID:
567 case AUDIT_EGID:
568 case AUDIT_SGID:
569 case AUDIT_FSGID:
570 case AUDIT_LOGINUID:
571 case AUDIT_PERS:
0a73dccc
AV		 572 case AUDIT_MSGTYPE:
573 case AUDIT_PPID:
574 case AUDIT_DEVMAJOR:
575 case AUDIT_DEVMINOR:
576 case AUDIT_EXIT:
577 case AUDIT_SUCCESS:
578 case AUDIT_ARG0:
579 case AUDIT_ARG1:
580 case AUDIT_ARG2:
581 case AUDIT_ARG3:
582 break;
e54dc243
AG		 583 case AUDIT_ARCH:
584 entry->rule.arch_f = f;
585 break;
3a6b9f85
DG		 586 case AUDIT_SUBJ_USER:
587 case AUDIT_SUBJ_ROLE:
588 case AUDIT_SUBJ_TYPE:
589 case AUDIT_SUBJ_SEN:
590 case AUDIT_SUBJ_CLR:
6e5a2d1d
DG		 591 case AUDIT_OBJ_USER:
592 case AUDIT_OBJ_ROLE:
593 case AUDIT_OBJ_TYPE:
594 case AUDIT_OBJ_LEV_LOW:
595 case AUDIT_OBJ_LEV_HIGH:
3dc7e315
DG		 596 str = audit_unpack_string(&bufp, &remain, f->val);
597 if (IS_ERR(str))
598 goto exit_free;
599 entry->rule.buflen += f->val;
600
601 err = selinux_audit_rule_init(f->type, f->op, str,
602 &f->se_rule);
603 /* Keep currently invalid fields around in case they
604 * become valid after a policy reload. */
605 if (err == -EINVAL) {
606 printk(KERN_WARNING "audit rule for selinux "
607 "\'%s\' is invalid\n", str);
608 err = 0;
609 }
610 if (err) {
611 kfree(str);
612 goto exit_free;
613 } else
614 f->se_str = str;
615 break;
f368c07d
AG		 616 case AUDIT_WATCH:
617 str = audit_unpack_string(&bufp, &remain, f->val);
618 if (IS_ERR(str))
619 goto exit_free;
620 entry->rule.buflen += f->val;
621
622 err = audit_to_watch(&entry->rule, str, f->val, f->op);
623 if (err) {
624 kfree(str);
625 goto exit_free;
626 }
627 break;
74c3cbe3
AV		 628 case AUDIT_DIR:
629 str = audit_unpack_string(&bufp, &remain, f->val);
630 if (IS_ERR(str))
631 goto exit_free;
632 entry->rule.buflen += f->val;
633
634 err = audit_make_tree(&entry->rule, str, f->op);
635 kfree(str);
636 if (err)
637 goto exit_free;
638 break;
f368c07d
AG		 639 case AUDIT_INODE:
640 err = audit_to_inode(&entry->rule, f);
641 if (err)
642 goto exit_free;
643 break;
5adc8a6a
AG		 644 case AUDIT_FILTERKEY:
645 err = -EINVAL;
646 if (entry->rule.filterkey || f->val > AUDIT_MAX_KEY_LEN)
647 goto exit_free;
648 str = audit_unpack_string(&bufp, &remain, f->val);
649 if (IS_ERR(str))
650 goto exit_free;
651 entry->rule.buflen += f->val;
652 entry->rule.filterkey = str;
653 break;
55669bfa
AV		 654 case AUDIT_PERM:
655 if (f->val & ~15)
656 goto exit_free;
657 break;
0a73dccc
AV		 658 default:
659 goto exit_free;
f368c07d
AG		 660 }
661 }
662
663 f = entry->rule.inode_f;
664 if (f) {
665 switch(f->op) {
666 case AUDIT_NOT_EQUAL:
667 entry->rule.inode_f = NULL;
668 case AUDIT_EQUAL:
669 break;
670 default:
5422e01a 671 err = -EINVAL;
f368c07d 672 goto exit_free;
93315ed6
AG		 673 }
674 }
675
676exit_nofree:
677 return entry;
678
679exit_free:
680 audit_free_rule(entry);
681 return ERR_PTR(err);
682}
683
684/* Pack a filter field's string representation into data block. */
74c3cbe3 685static inline size_t audit_pack_string(void **bufp, const char *str)
93315ed6
AG		 686{
687 size_t len = strlen(str);
688
689 memcpy(*bufp, str, len);
690 *bufp += len;
691
692 return len;
693}
694
695/* Translate kernel rule respresentation to struct audit_rule.
696 * Exists for backward compatibility with userspace. */
697static struct audit_rule *audit_krule_to_rule(struct audit_krule *krule)
698{
699 struct audit_rule *rule;
700 int i;
701
4668edc3 702 rule = kzalloc(sizeof(*rule), GFP_KERNEL);
93315ed6 703 if (unlikely(!rule))
0a3b483e 704 return NULL;
93315ed6
AG		 705
706 rule->flags = krule->flags | krule->listnr;
707 rule->action = krule->action;
708 rule->field_count = krule->field_count;
709 for (i = 0; i < rule->field_count; i++) {
710 rule->values[i] = krule->fields[i].val;
711 rule->fields[i] = krule->fields[i].type;
712
713 if (krule->vers_ops == 1) {
714 if (krule->fields[i].op & AUDIT_NOT_EQUAL)
715 rule->fields[i] |= AUDIT_NEGATE;
716 } else {
717 rule->fields[i] |= krule->fields[i].op;
718 }
719 }
720 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) rule->mask[i] = krule->mask[i];
721
722 return rule;
723}
fe7752ba 724
93315ed6
AG		 725/* Translate kernel rule respresentation to struct audit_rule_data. */
726static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
727{
728 struct audit_rule_data *data;
729 void *bufp;
730 int i;
731
732 data = kmalloc(sizeof(*data) + krule->buflen, GFP_KERNEL);
733 if (unlikely(!data))
0a3b483e 734 return NULL;
93315ed6
AG		 735 memset(data, 0, sizeof(*data));
736
737 data->flags = krule->flags | krule->listnr;
738 data->action = krule->action;
739 data->field_count = krule->field_count;
740 bufp = data->buf;
741 for (i = 0; i < data->field_count; i++) {
742 struct audit_field *f = &krule->fields[i];
743
744 data->fields[i] = f->type;
745 data->fieldflags[i] = f->op;
746 switch(f->type) {
3a6b9f85
DG		 747 case AUDIT_SUBJ_USER:
748 case AUDIT_SUBJ_ROLE:
749 case AUDIT_SUBJ_TYPE:
750 case AUDIT_SUBJ_SEN:
751 case AUDIT_SUBJ_CLR:
6e5a2d1d
DG		 752 case AUDIT_OBJ_USER:
753 case AUDIT_OBJ_ROLE:
754 case AUDIT_OBJ_TYPE:
755 case AUDIT_OBJ_LEV_LOW:
756 case AUDIT_OBJ_LEV_HIGH:
3dc7e315
DG		 757 data->buflen += data->values[i] =
758 audit_pack_string(&bufp, f->se_str);
759 break;
f368c07d
AG		 760 case AUDIT_WATCH:
761 data->buflen += data->values[i] =
762 audit_pack_string(&bufp, krule->watch->path);
763 break;
74c3cbe3
AV		 764 case AUDIT_DIR:
765 data->buflen += data->values[i] =
766 audit_pack_string(&bufp,
767 audit_tree_path(krule->tree));
768 break;
5adc8a6a
AG		 769 case AUDIT_FILTERKEY:
770 data->buflen += data->values[i] =
771 audit_pack_string(&bufp, krule->filterkey);
772 break;
93315ed6
AG		 773 default:
774 data->values[i] = f->val;
775 }
776 }
777 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i];
778
779 return data;
780}
781
782/* Compare two rules in kernel format. Considered success if rules
783 * don't match. */
784static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
785{
786 int i;
787
788 if (a->flags != b->flags ||
789 a->listnr != b->listnr ||
790 a->action != b->action ||
791 a->field_count != b->field_count)
fe7752ba
DW		 792 return 1;
793
794 for (i = 0; i < a->field_count; i++) {
93315ed6
AG		 795 if (a->fields[i].type != b->fields[i].type ||
796 a->fields[i].op != b->fields[i].op)
fe7752ba 797 return 1;
93315ed6
AG		 798
799 switch(a->fields[i].type) {
3a6b9f85
DG		 800 case AUDIT_SUBJ_USER:
801 case AUDIT_SUBJ_ROLE:
802 case AUDIT_SUBJ_TYPE:
803 case AUDIT_SUBJ_SEN:
804 case AUDIT_SUBJ_CLR:
6e5a2d1d
DG		 805 case AUDIT_OBJ_USER:
806 case AUDIT_OBJ_ROLE:
807 case AUDIT_OBJ_TYPE:
808 case AUDIT_OBJ_LEV_LOW:
809 case AUDIT_OBJ_LEV_HIGH:
3dc7e315
DG		 810 if (strcmp(a->fields[i].se_str, b->fields[i].se_str))
811 return 1;
812 break;
f368c07d
AG		 813 case AUDIT_WATCH:
814 if (strcmp(a->watch->path, b->watch->path))
815 return 1;
816 break;
74c3cbe3
AV		 817 case AUDIT_DIR:
818 if (strcmp(audit_tree_path(a->tree),
819 audit_tree_path(b->tree)))
820 return 1;
821 break;
5adc8a6a
AG		 822 case AUDIT_FILTERKEY:
823 /* both filterkeys exist based on above type compare */
824 if (strcmp(a->filterkey, b->filterkey))
825 return 1;
826 break;
93315ed6
AG		 827 default:
828 if (a->fields[i].val != b->fields[i].val)
829 return 1;
830 }
fe7752ba
DW		 831 }
832
833 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
834 if (a->mask[i] != b->mask[i])
835 return 1;
836
837 return 0;
838}
839
f368c07d
AG		 840/* Duplicate the given audit watch. The new watch's rules list is initialized
841 * to an empty list and wlist is undefined. */
842static struct audit_watch *audit_dupe_watch(struct audit_watch *old)
843{
844 char *path;
845 struct audit_watch *new;
846
847 path = kstrdup(old->path, GFP_KERNEL);
848 if (unlikely(!path))
849 return ERR_PTR(-ENOMEM);
850
851 new = audit_init_watch(path);
852 if (unlikely(IS_ERR(new))) {
853 kfree(path);
854 goto out;
855 }
856
857 new->dev = old->dev;
858 new->ino = old->ino;
859 get_inotify_watch(&old->parent->wdata);
860 new->parent = old->parent;
861
862out:
863 return new;
864}
865
3dc7e315
DG		 866/* Duplicate selinux field information. The se_rule is opaque, so must be
867 * re-initialized. */
868static inline int audit_dupe_selinux_field(struct audit_field *df,
869 struct audit_field *sf)
870{
871 int ret = 0;
872 char *se_str;
873
874 /* our own copy of se_str */
875 se_str = kstrdup(sf->se_str, GFP_KERNEL);
3e1fbd12
AM		 876 if (unlikely(!se_str))
877 return -ENOMEM;
3dc7e315
DG		 878 df->se_str = se_str;
879
880 /* our own (refreshed) copy of se_rule */
881 ret = selinux_audit_rule_init(df->type, df->op, df->se_str,
882 &df->se_rule);
883 /* Keep currently invalid fields around in case they
884 * become valid after a policy reload. */
885 if (ret == -EINVAL) {
886 printk(KERN_WARNING "audit rule for selinux \'%s\' is "
887 "invalid\n", df->se_str);
888 ret = 0;
889 }
890
891 return ret;
892}
893
894/* Duplicate an audit rule. This will be a deep copy with the exception
895 * of the watch - that pointer is carried over. The selinux specific fields
896 * will be updated in the copy. The point is to be able to replace the old
f368c07d
AG		 897 * rule with the new rule in the filterlist, then free the old rule.
898 * The rlist element is undefined; list manipulations are handled apart from
899 * the initial copy. */
900static struct audit_entry *audit_dupe_rule(struct audit_krule *old,
901 struct audit_watch *watch)
3dc7e315
DG		 902{
903 u32 fcount = old->field_count;
904 struct audit_entry *entry;
905 struct audit_krule *new;
5adc8a6a 906 char *fk;
3dc7e315
DG		 907 int i, err = 0;
908
909 entry = audit_init_entry(fcount);
910 if (unlikely(!entry))
911 return ERR_PTR(-ENOMEM);
912
913 new = &entry->rule;
914 new->vers_ops = old->vers_ops;
915 new->flags = old->flags;
916 new->listnr = old->listnr;
917 new->action = old->action;
918 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
919 new->mask[i] = old->mask[i];
920 new->buflen = old->buflen;
f368c07d
AG		 921 new->inode_f = old->inode_f;
922 new->watch = NULL;
3dc7e315 923 new->field_count = old->field_count;
74c3cbe3
AV		 924 /*
925 * note that we are OK with not refcounting here; audit_match_tree()
926 * never dereferences tree and we can't get false positives there
927 * since we'd have to have rule gone from the list *and* removed
928 * before the chunks found by lookup had been allocated, i.e. before
929 * the beginning of list scan.
930 */
931 new->tree = old->tree;
3dc7e315
DG		 932 memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount);
933
934 /* deep copy this information, updating the se_rule fields, because
935 * the originals will all be freed when the old rule is freed. */
936 for (i = 0; i < fcount; i++) {
937 switch (new->fields[i].type) {
3a6b9f85
DG		 938 case AUDIT_SUBJ_USER:
939 case AUDIT_SUBJ_ROLE:
940 case AUDIT_SUBJ_TYPE:
941 case AUDIT_SUBJ_SEN:
942 case AUDIT_SUBJ_CLR:
6e5a2d1d
DG		 943 case AUDIT_OBJ_USER:
944 case AUDIT_OBJ_ROLE:
945 case AUDIT_OBJ_TYPE:
946 case AUDIT_OBJ_LEV_LOW:
947 case AUDIT_OBJ_LEV_HIGH:
3dc7e315
DG		 948 err = audit_dupe_selinux_field(&new->fields[i],
949 &old->fields[i]);
5adc8a6a
AG		 950 break;
951 case AUDIT_FILTERKEY:
952 fk = kstrdup(old->filterkey, GFP_KERNEL);
953 if (unlikely(!fk))
954 err = -ENOMEM;
955 else
956 new->filterkey = fk;
3dc7e315
DG		 957 }
958 if (err) {
959 audit_free_rule(entry);
960 return ERR_PTR(err);
961 }
962 }
963
f368c07d
AG		 964 if (watch) {
965 audit_get_watch(watch);
966 new->watch = watch;
967 }
968
3dc7e315
DG		 969 return entry;
970}
971
f368c07d
AG		 972/* Update inode info in audit rules based on filesystem event. */
973static void audit_update_watch(struct audit_parent *parent,
974 const char *dname, dev_t dev,
975 unsigned long ino, unsigned invalidating)
976{
977 struct audit_watch *owatch, *nwatch, *nextw;
978 struct audit_krule *r, *nextr;
979 struct audit_entry *oentry, *nentry;
f368c07d
AG		 980
981 mutex_lock(&audit_filter_mutex);
982 list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
9c937dcc 983 if (audit_compare_dname_path(dname, owatch->path, NULL))
f368c07d
AG		 984 continue;
985
986 /* If the update involves invalidating rules, do the inode-based
987 * filtering now, so we don't omit records. */
7b018b28 988 if (invalidating && current->audit_context &&
f368c07d
AG		 989 audit_filter_inodes(current, current->audit_context) == AUDIT_RECORD_CONTEXT)
990 audit_set_auditable(current->audit_context);
991
992 nwatch = audit_dupe_watch(owatch);
993 if (unlikely(IS_ERR(nwatch))) {
994 mutex_unlock(&audit_filter_mutex);
995 audit_panic("error updating watch, skipping");
996 return;
997 }
998 nwatch->dev = dev;
999 nwatch->ino = ino;
1000
1001 list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) {
1002
1003 oentry = container_of(r, struct audit_entry, rule);
1004 list_del(&oentry->rule.rlist);
1005 list_del_rcu(&oentry->list);
1006
1007 nentry = audit_dupe_rule(&oentry->rule, nwatch);
1008 if (unlikely(IS_ERR(nentry)))
1009 audit_panic("error updating watch, removing");
1010 else {
1011 int h = audit_hash_ino((u32)ino);
1012 list_add(&nentry->rule.rlist, &nwatch->rules);
1013 list_add_rcu(&nentry->list, &audit_inode_hash[h]);
1014 }
1015
1016 call_rcu(&oentry->rcu, audit_free_rule_rcu);
1017 }
1018
1a6b9f23
EP		 1019 if (audit_enabled) {
1020 struct audit_buffer *ab;
1021 ab = audit_log_start(NULL, GFP_KERNEL,
1022 AUDIT_CONFIG_CHANGE);
1023 audit_log_format(ab,
1024 "op=updated rules specifying path=");
1025 audit_log_untrustedstring(ab, owatch->path);
1026 audit_log_format(ab, " with dev=%u ino=%lu\n",
1027 dev, ino);
1028 audit_log_format(ab, " list=%d res=1", r->listnr);
1029 audit_log_end(ab);
1030 }
f368c07d
AG		 1031 audit_remove_watch(owatch);
1032 goto add_watch_to_parent; /* event applies to a single watch */
1033 }
1034 mutex_unlock(&audit_filter_mutex);
1035 return;
1036
1037add_watch_to_parent:
1038 list_add(&nwatch->wlist, &parent->watches);
1039 mutex_unlock(&audit_filter_mutex);
1040 return;
1041}
1042
1043/* Remove all watches & rules associated with a parent that is going away. */
1044static void audit_remove_parent_watches(struct audit_parent *parent)
1045{
1046 struct audit_watch *w, *nextw;
1047 struct audit_krule *r, *nextr;
1048 struct audit_entry *e;
1049
1050 mutex_lock(&audit_filter_mutex);
1051 parent->flags |= AUDIT_PARENT_INVALID;
1052 list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
1053 list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
1054 e = container_of(r, struct audit_entry, rule);
1a6b9f23
EP		 1055 if (audit_enabled) {
1056 struct audit_buffer *ab;
1057 ab = audit_log_start(NULL, GFP_KERNEL,
1058 AUDIT_CONFIG_CHANGE);
1059 audit_log_format(ab, "op=remove rule path=");
1060 audit_log_untrustedstring(ab, w->path);
1061 if (r->filterkey) {
1062 audit_log_format(ab, " key=");
1063 audit_log_untrustedstring(ab,
1064 r->filterkey);
1065 } else
1066 audit_log_format(ab, " key=(null)");
1067 audit_log_format(ab, " list=%d res=1",
1068 r->listnr);
1069 audit_log_end(ab);
1070 }
f368c07d
AG		 1071 list_del(&r->rlist);
1072 list_del_rcu(&e->list);
1073 call_rcu(&e->rcu, audit_free_rule_rcu);
f368c07d
AG		 1074 }
1075 audit_remove_watch(w);
1076 }
1077 mutex_unlock(&audit_filter_mutex);
1078}
1079
1080/* Unregister inotify watches for parents on in_list.
1081 * Generates an IN_IGNORED event. */
1082static void audit_inotify_unregister(struct list_head *in_list)
1083{
1084 struct audit_parent *p, *n;
1085
1086 list_for_each_entry_safe(p, n, in_list, ilist) {
1087 list_del(&p->ilist);
1088 inotify_rm_watch(audit_ih, &p->wdata);
1089 /* the put matching the get in audit_do_del_rule() */
1090 put_inotify_watch(&p->wdata);
1091 }
1092}
1093
1094/* Find an existing audit rule.
1095 * Caller must hold audit_filter_mutex to prevent stale rule data. */
1096static struct audit_entry *audit_find_rule(struct audit_entry *entry,
1097 struct list_head *list)
1098{
1099 struct audit_entry *e, *found = NULL;
1100 int h;
1101
1102 if (entry->rule.watch) {
1103 /* we don't know the inode number, so must walk entire hash */
1104 for (h = 0; h < AUDIT_INODE_BUCKETS; h++) {
1105 list = &audit_inode_hash[h];
1106 list_for_each_entry(e, list, list)
1107 if (!audit_compare_rule(&entry->rule, &e->rule)) {
1108 found = e;
1109 goto out;
1110 }
1111 }
1112 goto out;
1113 }
1114
1115 list_for_each_entry(e, list, list)
1116 if (!audit_compare_rule(&entry->rule, &e->rule)) {
1117 found = e;
1118 goto out;
1119 }
1120
1121out:
1122 return found;
1123}
1124
1125/* Get path information necessary for adding watches. */
1126static int audit_get_nd(char *path, struct nameidata **ndp,
1127 struct nameidata **ndw)
1128{
1129 struct nameidata *ndparent, *ndwatch;
1130 int err;
1131
1132 ndparent = kmalloc(sizeof(*ndparent), GFP_KERNEL);
1133 if (unlikely(!ndparent))
1134 return -ENOMEM;
1135
1136 ndwatch = kmalloc(sizeof(*ndwatch), GFP_KERNEL);
1137 if (unlikely(!ndwatch)) {
1138 kfree(ndparent);
1139 return -ENOMEM;
1140 }
1141
1142 err = path_lookup(path, LOOKUP_PARENT, ndparent);
1143 if (err) {
1144 kfree(ndparent);
1145 kfree(ndwatch);
1146 return err;
1147 }
1148
1149 err = path_lookup(path, 0, ndwatch);
1150 if (err) {
1151 kfree(ndwatch);
1152 ndwatch = NULL;
1153 }
1154
1155 *ndp = ndparent;
1156 *ndw = ndwatch;
1157
1158 return 0;
1159}
1160
1161/* Release resources used for watch path information. */
1162static void audit_put_nd(struct nameidata *ndp, struct nameidata *ndw)
1163{
1164 if (ndp) {
1d957f9b 1165 path_put(&ndp->path);
f368c07d
AG		 1166 kfree(ndp);
1167 }
1168 if (ndw) {
1d957f9b 1169 path_put(&ndw->path);
f368c07d
AG		 1170 kfree(ndw);
1171 }
1172}
1173
1174/* Associate the given rule with an existing parent inotify_watch.
1175 * Caller must hold audit_filter_mutex. */
1176static void audit_add_to_parent(struct audit_krule *krule,
1177 struct audit_parent *parent)
1178{
1179 struct audit_watch *w, *watch = krule->watch;
1180 int watch_found = 0;
1181
1182 list_for_each_entry(w, &parent->watches, wlist) {
1183 if (strcmp(watch->path, w->path))
1184 continue;
1185
1186 watch_found = 1;
1187
1188 /* put krule's and initial refs to temporary watch */
1189 audit_put_watch(watch);
1190 audit_put_watch(watch);
1191
1192 audit_get_watch(w);
1193 krule->watch = watch = w;
1194 break;
1195 }
1196
1197 if (!watch_found) {
1198 get_inotify_watch(&parent->wdata);
1199 watch->parent = parent;
1200
1201 list_add(&watch->wlist, &parent->watches);
1202 }
1203 list_add(&krule->rlist, &watch->rules);
1204}
1205
1206/* Find a matching watch entry, or add this one.
1207 * Caller must hold audit_filter_mutex. */
1208static int audit_add_watch(struct audit_krule *krule, struct nameidata *ndp,
1209 struct nameidata *ndw)
1210{
1211 struct audit_watch *watch = krule->watch;
1212 struct inotify_watch *i_watch;
1213 struct audit_parent *parent;
1214 int ret = 0;
1215
1216 /* update watch filter fields */
1217 if (ndw) {
4ac91378
JB		 1218 watch->dev = ndw->path.dentry->d_inode->i_sb->s_dev;
1219 watch->ino = ndw->path.dentry->d_inode->i_ino;
f368c07d
AG		 1220 }
1221
1222 /* The audit_filter_mutex must not be held during inotify calls because
1223 * we hold it during inotify event callback processing. If an existing
1224 * inotify watch is found, inotify_find_watch() grabs a reference before
1225 * returning.
1226 */
1227 mutex_unlock(&audit_filter_mutex);
1228
4ac91378
JB		 1229 if (inotify_find_watch(audit_ih, ndp->path.dentry->d_inode,
1230 &i_watch) < 0) {
f368c07d
AG		 1231 parent = audit_init_parent(ndp);
1232 if (IS_ERR(parent)) {
1233 /* caller expects mutex locked */
1234 mutex_lock(&audit_filter_mutex);
1235 return PTR_ERR(parent);
1236 }
1237 } else
1238 parent = container_of(i_watch, struct audit_parent, wdata);
1239
1240 mutex_lock(&audit_filter_mutex);
1241
1242 /* parent was moved before we took audit_filter_mutex */
1243 if (parent->flags & AUDIT_PARENT_INVALID)
1244 ret = -ENOENT;
1245 else
1246 audit_add_to_parent(krule, parent);
1247
1248 /* match get in audit_init_parent or inotify_find_watch */
1249 put_inotify_watch(&parent->wdata);
1250 return ret;
1251}
1252
1253/* Add rule to given filterlist if not a duplicate. */
93315ed6 1254static inline int audit_add_rule(struct audit_entry *entry,
f368c07d 1255 struct list_head *list)
fe7752ba 1256{
93315ed6 1257 struct audit_entry *e;
f368c07d
AG		 1258 struct audit_field *inode_f = entry->rule.inode_f;
1259 struct audit_watch *watch = entry->rule.watch;
74c3cbe3 1260 struct audit_tree *tree = entry->rule.tree;
6f686d3d
JG		 1261 struct nameidata *ndp = NULL, *ndw = NULL;
1262 int h, err;
471a5c7c
AV		 1263#ifdef CONFIG_AUDITSYSCALL
1264 int dont_count = 0;
1265
1266 /* If either of these, don't count towards total */
1267 if (entry->rule.listnr == AUDIT_FILTER_USER ||
1268 entry->rule.listnr == AUDIT_FILTER_TYPE)
1269 dont_count = 1;
1270#endif
f368c07d
AG		 1271
1272 if (inode_f) {
1273 h = audit_hash_ino(inode_f->val);
1274 list = &audit_inode_hash[h];
1275 }
1276
1277 mutex_lock(&audit_filter_mutex);
1278 e = audit_find_rule(entry, list);
1279 mutex_unlock(&audit_filter_mutex);
1280 if (e) {
1281 err = -EEXIST;
74c3cbe3
AV		 1282 /* normally audit_add_tree_rule() will free it on failure */
1283 if (tree)
1284 audit_put_tree(tree);
f368c07d
AG		 1285 goto error;
1286 }
fe7752ba 1287
f368c07d
AG		 1288 /* Avoid calling path_lookup under audit_filter_mutex. */
1289 if (watch) {
1290 err = audit_get_nd(watch->path, &ndp, &ndw);
1291 if (err)
1292 goto error;
f368c07d
AG		 1293 }
1294
1295 mutex_lock(&audit_filter_mutex);
1296 if (watch) {
1297 /* audit_filter_mutex is dropped and re-taken during this call */
1298 err = audit_add_watch(&entry->rule, ndp, ndw);
1299 if (err) {
1300 mutex_unlock(&audit_filter_mutex);
1301 goto error;
1302 }
1303 h = audit_hash_ino((u32)watch->ino);
1304 list = &audit_inode_hash[h];
fe7752ba 1305 }
74c3cbe3
AV		 1306 if (tree) {
1307 err = audit_add_tree_rule(&entry->rule);
1308 if (err) {
1309 mutex_unlock(&audit_filter_mutex);
1310 goto error;
1311 }
1312 }
fe7752ba 1313
fe7752ba 1314 if (entry->rule.flags & AUDIT_FILTER_PREPEND) {
fe7752ba 1315 list_add_rcu(&entry->list, list);
6a2bceec 1316 entry->rule.flags &= ~AUDIT_FILTER_PREPEND;
fe7752ba
DW		 1317 } else {
1318 list_add_tail_rcu(&entry->list, list);
1319 }
471a5c7c
AV		 1320#ifdef CONFIG_AUDITSYSCALL
1321 if (!dont_count)
1322 audit_n_rules++;
e54dc243
AG		 1323
1324 if (!audit_match_signal(entry))
1325 audit_signals++;
471a5c7c 1326#endif
f368c07d 1327 mutex_unlock(&audit_filter_mutex);
fe7752ba 1328
6f686d3d 1329 audit_put_nd(ndp, ndw); /* NULL args OK */
f368c07d
AG		 1330 return 0;
1331
1332error:
6f686d3d 1333 audit_put_nd(ndp, ndw); /* NULL args OK */
f368c07d
AG		 1334 if (watch)
1335 audit_put_watch(watch); /* tmp watch, matches initial get */
1336 return err;
fe7752ba
DW		 1337}
1338
f368c07d 1339/* Remove an existing rule from filterlist. */
93315ed6 1340static inline int audit_del_rule(struct audit_entry *entry,
fe7752ba
DW		 1341 struct list_head *list)
1342{
1343 struct audit_entry *e;
f368c07d
AG		 1344 struct audit_field *inode_f = entry->rule.inode_f;
1345 struct audit_watch *watch, *tmp_watch = entry->rule.watch;
74c3cbe3 1346 struct audit_tree *tree = entry->rule.tree;
f368c07d
AG		 1347 LIST_HEAD(inotify_list);
1348 int h, ret = 0;
471a5c7c
AV		 1349#ifdef CONFIG_AUDITSYSCALL
1350 int dont_count = 0;
1351
1352 /* If either of these, don't count towards total */
1353 if (entry->rule.listnr == AUDIT_FILTER_USER ||
1354 entry->rule.listnr == AUDIT_FILTER_TYPE)
1355 dont_count = 1;
1356#endif
f368c07d
AG		 1357
1358 if (inode_f) {
1359 h = audit_hash_ino(inode_f->val);
1360 list = &audit_inode_hash[h];
1361 }
fe7752ba 1362
f368c07d
AG		 1363 mutex_lock(&audit_filter_mutex);
1364 e = audit_find_rule(entry, list);
1365 if (!e) {
1366 mutex_unlock(&audit_filter_mutex);
1367 ret = -ENOENT;
1368 goto out;
1369 }
1370
1371 watch = e->rule.watch;
1372 if (watch) {
1373 struct audit_parent *parent = watch->parent;
1374
1375 list_del(&e->rule.rlist);
1376
1377 if (list_empty(&watch->rules)) {
1378 audit_remove_watch(watch);
1379
1380 if (list_empty(&parent->watches)) {
1381 /* Put parent on the inotify un-registration
1382 * list. Grab a reference before releasing
1383 * audit_filter_mutex, to be released in
1384 * audit_inotify_unregister(). */
1385 list_add(&parent->ilist, &inotify_list);
1386 get_inotify_watch(&parent->wdata);
1387 }
fe7752ba
DW		 1388 }
1389 }
f368c07d 1390
74c3cbe3
AV		 1391 if (e->rule.tree)
1392 audit_remove_tree_rule(&e->rule);
1393
f368c07d
AG		 1394 list_del_rcu(&e->list);
1395 call_rcu(&e->rcu, audit_free_rule_rcu);
1396
471a5c7c
AV		 1397#ifdef CONFIG_AUDITSYSCALL
1398 if (!dont_count)
1399 audit_n_rules--;
e54dc243
AG		 1400
1401 if (!audit_match_signal(entry))
1402 audit_signals--;
471a5c7c 1403#endif
f368c07d
AG		 1404 mutex_unlock(&audit_filter_mutex);
1405
1406 if (!list_empty(&inotify_list))
1407 audit_inotify_unregister(&inotify_list);
1408
1409out:
1410 if (tmp_watch)
1411 audit_put_watch(tmp_watch); /* match initial get */
74c3cbe3
AV		 1412 if (tree)
1413 audit_put_tree(tree); /* that's the temporary one */
f368c07d
AG		 1414
1415 return ret;
fe7752ba
DW		 1416}
1417
93315ed6
AG		 1418/* List rules using struct audit_rule. Exists for backward
1419 * compatibility with userspace. */
9044e6bc 1420static void audit_list(int pid, int seq, struct sk_buff_head *q)
fe7752ba 1421{
9044e6bc 1422 struct sk_buff *skb;
fe7752ba
DW		 1423 struct audit_entry *entry;
1424 int i;
1425
f368c07d
AG		 1426 /* This is a blocking read, so use audit_filter_mutex instead of rcu
1427 * iterator to sync with list writers. */
fe7752ba 1428 for (i=0; i<AUDIT_NR_FILTERS; i++) {
93315ed6
AG		 1429 list_for_each_entry(entry, &audit_filter_list[i], list) {
1430 struct audit_rule *rule;
1431
1432 rule = audit_krule_to_rule(&entry->rule);
1433 if (unlikely(!rule))
1434 break;
9044e6bc 1435 skb = audit_make_reply(pid, seq, AUDIT_LIST, 0, 1,
93315ed6 1436 rule, sizeof(*rule));
9044e6bc
AV		 1437 if (skb)
1438 skb_queue_tail(q, skb);
93315ed6
AG		 1439 kfree(rule);
1440 }
fe7752ba 1441 }
f368c07d
AG		 1442 for (i = 0; i < AUDIT_INODE_BUCKETS; i++) {
1443 list_for_each_entry(entry, &audit_inode_hash[i], list) {
1444 struct audit_rule *rule;
1445
1446 rule = audit_krule_to_rule(&entry->rule);
1447 if (unlikely(!rule))
1448 break;
1449 skb = audit_make_reply(pid, seq, AUDIT_LIST, 0, 1,
1450 rule, sizeof(*rule));
1451 if (skb)
1452 skb_queue_tail(q, skb);
1453 kfree(rule);
1454 }
1455 }
9044e6bc
AV		 1456 skb = audit_make_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0);
1457 if (skb)
1458 skb_queue_tail(q, skb);
fe7752ba
DW		 1459}
1460
93315ed6 1461/* List rules using struct audit_rule_data. */
9044e6bc 1462static void audit_list_rules(int pid, int seq, struct sk_buff_head *q)
93315ed6 1463{
9044e6bc 1464 struct sk_buff *skb;
93315ed6
AG		 1465 struct audit_entry *e;
1466 int i;
1467
f368c07d
AG		 1468 /* This is a blocking read, so use audit_filter_mutex instead of rcu
1469 * iterator to sync with list writers. */
93315ed6
AG		 1470 for (i=0; i<AUDIT_NR_FILTERS; i++) {
1471 list_for_each_entry(e, &audit_filter_list[i], list) {
1472 struct audit_rule_data *data;
1473
1474 data = audit_krule_to_data(&e->rule);
1475 if (unlikely(!data))
1476 break;
9044e6bc 1477 skb = audit_make_reply(pid, seq, AUDIT_LIST_RULES, 0, 1,
f368c07d
AG		 1478 data, sizeof(*data) + data->buflen);
1479 if (skb)
1480 skb_queue_tail(q, skb);
1481 kfree(data);
1482 }
1483 }
1484 for (i=0; i< AUDIT_INODE_BUCKETS; i++) {
1485 list_for_each_entry(e, &audit_inode_hash[i], list) {
1486 struct audit_rule_data *data;
1487
1488 data = audit_krule_to_data(&e->rule);
1489 if (unlikely(!data))
1490 break;
1491 skb = audit_make_reply(pid, seq, AUDIT_LIST_RULES, 0, 1,
1492 data, sizeof(*data) + data->buflen);
9044e6bc
AV		 1493 if (skb)
1494 skb_queue_tail(q, skb);
93315ed6
AG		 1495 kfree(data);
1496 }
1497 }
9044e6bc
AV		 1498 skb = audit_make_reply(pid, seq, AUDIT_LIST_RULES, 1, 1, NULL, 0);
1499 if (skb)
1500 skb_queue_tail(q, skb);
93315ed6
AG		 1501}
1502
5adc8a6a
AG		 1503/* Log rule additions and removals */
1504static void audit_log_rule_change(uid_t loginuid, u32 sid, char *action,
1505 struct audit_krule *rule, int res)
1506{
1507 struct audit_buffer *ab;
1508
1a6b9f23
EP		 1509 if (!audit_enabled)
1510 return;
1511
5adc8a6a
AG		 1512 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
1513 if (!ab)
1514 return;
1515 audit_log_format(ab, "auid=%u", loginuid);
1516 if (sid) {
1517 char *ctx = NULL;
1518 u32 len;
2a862b32 1519 if (security_secid_to_secctx(sid, &ctx, &len))
5adc8a6a 1520 audit_log_format(ab, " ssid=%u", sid);
2a862b32 1521 else {
5adc8a6a 1522 audit_log_format(ab, " subj=%s", ctx);
2a862b32
AD		 1523 security_release_secctx(ctx, len);
1524 }
5adc8a6a 1525 }
a17b4ad7 1526 audit_log_format(ab, " op=%s rule key=", action);
5adc8a6a
AG		 1527 if (rule->filterkey)
1528 audit_log_untrustedstring(ab, rule->filterkey);
1529 else
1530 audit_log_format(ab, "(null)");
1531 audit_log_format(ab, " list=%d res=%d", rule->listnr, res);
1532 audit_log_end(ab);
1533}
1534
fe7752ba
DW		 1535/**
1536 * audit_receive_filter - apply all rules to the specified message type
1537 * @type: audit message type
1538 * @pid: target pid for netlink audit messages
1539 * @uid: target uid for netlink audit messages
1540 * @seq: netlink audit message sequence (serial) number
1541 * @data: payload data
93315ed6 1542 * @datasz: size of payload data
fe7752ba 1543 * @loginuid: loginuid of sender
ce29b682 1544 * @sid: SE Linux Security ID of sender
fe7752ba
DW		 1545 */
1546int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
ce29b682 1547 size_t datasz, uid_t loginuid, u32 sid)
fe7752ba
DW		 1548{
1549 struct task_struct *tsk;
9044e6bc 1550 struct audit_netlink_list *dest;
93315ed6
AG		 1551 int err = 0;
1552 struct audit_entry *entry;
fe7752ba
DW		 1553
1554 switch (type) {
1555 case AUDIT_LIST:
93315ed6 1556 case AUDIT_LIST_RULES:
fe7752ba
DW		 1557 /* We can't just spew out the rules here because we might fill
1558 * the available socket buffer space and deadlock waiting for
1559 * auditctl to read from it... which isn't ever going to
1560 * happen if we're actually running in the context of auditctl
1561 * trying to _send_ the stuff */
9ce34218 1562
9044e6bc 1563 dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL);
fe7752ba
DW		 1564 if (!dest)
1565 return -ENOMEM;
9044e6bc
AV		 1566 dest->pid = pid;
1567 skb_queue_head_init(&dest->q);
fe7752ba 1568
f368c07d 1569 mutex_lock(&audit_filter_mutex);
93315ed6 1570 if (type == AUDIT_LIST)
9044e6bc 1571 audit_list(pid, seq, &dest->q);
93315ed6 1572 else
9044e6bc 1573 audit_list_rules(pid, seq, &dest->q);
f368c07d 1574 mutex_unlock(&audit_filter_mutex);
9044e6bc
AV		 1575
1576 tsk = kthread_run(audit_send_list, dest, "audit_send_list");
fe7752ba 1577 if (IS_ERR(tsk)) {
9044e6bc 1578 skb_queue_purge(&dest->q);
fe7752ba
DW		 1579 kfree(dest);
1580 err = PTR_ERR(tsk);
1581 }
1582 break;
1583 case AUDIT_ADD:
93315ed6
AG		 1584 case AUDIT_ADD_RULE:
1585 if (type == AUDIT_ADD)
1586 entry = audit_rule_to_entry(data);
1587 else
1588 entry = audit_data_to_entry(data, datasz);
1589 if (IS_ERR(entry))
1590 return PTR_ERR(entry);
1591
1592 err = audit_add_rule(entry,
1593 &audit_filter_list[entry->rule.listnr]);
5adc8a6a 1594 audit_log_rule_change(loginuid, sid, "add", &entry->rule, !err);
5d330108
AV		 1595
1596 if (err)
93315ed6 1597 audit_free_rule(entry);
fe7752ba
DW		 1598 break;
1599 case AUDIT_DEL:
93315ed6
AG		 1600 case AUDIT_DEL_RULE:
1601 if (type == AUDIT_DEL)
1602 entry = audit_rule_to_entry(data);
1603 else
1604 entry = audit_data_to_entry(data, datasz);
1605 if (IS_ERR(entry))
1606 return PTR_ERR(entry);
1607
1608 err = audit_del_rule(entry,
1609 &audit_filter_list[entry->rule.listnr]);
5adc8a6a
AG		 1610 audit_log_rule_change(loginuid, sid, "remove", &entry->rule,
1611 !err);
5d330108 1612
93315ed6 1613 audit_free_rule(entry);
fe7752ba
DW		 1614 break;
1615 default:
1616 return -EINVAL;
1617 }
1618
1619 return err;
1620}
1621
1622int audit_comparator(const u32 left, const u32 op, const u32 right)
1623{
1624 switch (op) {
1625 case AUDIT_EQUAL:
1626 return (left == right);
1627 case AUDIT_NOT_EQUAL:
1628 return (left != right);
1629 case AUDIT_LESS_THAN:
1630 return (left < right);
1631 case AUDIT_LESS_THAN_OR_EQUAL:
1632 return (left <= right);
1633 case AUDIT_GREATER_THAN:
1634 return (left > right);
1635 case AUDIT_GREATER_THAN_OR_EQUAL:
1636 return (left >= right);
74f2345b
EP		 1637 case AUDIT_BIT_MASK:
1638 return (left & right);
1639 case AUDIT_BIT_TEST:
1640 return ((left & right) == right);
fe7752ba 1641 }
d9d9ec6e
DK		 1642 BUG();
1643 return 0;
fe7752ba
DW		 1644}
1645
f368c07d
AG		 1646/* Compare given dentry name with last component in given path,
1647 * return of 0 indicates a match. */
9c937dcc
AG		 1648int audit_compare_dname_path(const char *dname, const char *path,
1649 int *dirlen)
f368c07d
AG		 1650{
1651 int dlen, plen;
1652 const char *p;
1653
1654 if (!dname || !path)
1655 return 1;
1656
1657 dlen = strlen(dname);
1658 plen = strlen(path);
1659 if (plen < dlen)
1660 return 1;
1661
1662 /* disregard trailing slashes */
1663 p = path + plen - 1;
1664 while ((*p == '/') && (p > path))
1665 p--;
1666
1667 /* find last path component */
1668 p = p - dlen + 1;
1669 if (p < path)
1670 return 1;
1671 else if (p > path) {
1672 if (*--p != '/')
1673 return 1;
1674 else
1675 p++;
1676 }
fe7752ba 1677
9c937dcc
AG		 1678 /* return length of path's directory component */
1679 if (dirlen)
1680 *dirlen = p - path;
f368c07d
AG		 1681 return strncmp(p, dname, dlen);
1682}
fe7752ba
DW		 1683
1684static int audit_filter_user_rules(struct netlink_skb_parms *cb,
93315ed6 1685 struct audit_krule *rule,
fe7752ba
DW		 1686 enum audit_state *state)
1687{
1688 int i;
1689
1690 for (i = 0; i < rule->field_count; i++) {
93315ed6 1691 struct audit_field *f = &rule->fields[i];
fe7752ba
DW		 1692 int result = 0;
1693
93315ed6 1694 switch (f->type) {
fe7752ba 1695 case AUDIT_PID:
93315ed6 1696 result = audit_comparator(cb->creds.pid, f->op, f->val);
fe7752ba
DW		 1697 break;
1698 case AUDIT_UID:
93315ed6 1699 result = audit_comparator(cb->creds.uid, f->op, f->val);
fe7752ba
DW		 1700 break;
1701 case AUDIT_GID:
93315ed6 1702 result = audit_comparator(cb->creds.gid, f->op, f->val);
fe7752ba
DW		 1703 break;
1704 case AUDIT_LOGINUID:
93315ed6 1705 result = audit_comparator(cb->loginuid, f->op, f->val);
fe7752ba
DW		 1706 break;
1707 }
1708
1709 if (!result)
1710 return 0;
1711 }
1712 switch (rule->action) {
1713 case AUDIT_NEVER: *state = AUDIT_DISABLED; break;
fe7752ba
DW		 1714 case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break;
1715 }
1716 return 1;
1717}
1718
1719int audit_filter_user(struct netlink_skb_parms *cb, int type)
1720{
11f57ced 1721 enum audit_state state = AUDIT_DISABLED;
fe7752ba 1722 struct audit_entry *e;
fe7752ba
DW		 1723 int ret = 1;
1724
1725 rcu_read_lock();
1726 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_USER], list) {
1727 if (audit_filter_user_rules(cb, &e->rule, &state)) {
1728 if (state == AUDIT_DISABLED)
1729 ret = 0;
1730 break;
1731 }
1732 }
1733 rcu_read_unlock();
1734
1735 return ret; /* Audit by default */
1736}
1737
1738int audit_filter_type(int type)
1739{
1740 struct audit_entry *e;
1741 int result = 0;
9ce34218 1742
fe7752ba
DW		 1743 rcu_read_lock();
1744 if (list_empty(&audit_filter_list[AUDIT_FILTER_TYPE]))
1745 goto unlock_and_return;
1746
1747 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE],
1748 list) {
fe7752ba 1749 int i;
93315ed6
AG		 1750 for (i = 0; i < e->rule.field_count; i++) {
1751 struct audit_field *f = &e->rule.fields[i];
1752 if (f->type == AUDIT_MSGTYPE) {
1753 result = audit_comparator(type, f->op, f->val);
fe7752ba
DW		 1754 if (!result)
1755 break;
1756 }
1757 }
1758 if (result)
1759 goto unlock_and_return;
1760 }
1761unlock_and_return:
1762 rcu_read_unlock();
1763 return result;
1764}
3dc7e315
DG		 1765
1766/* Check to see if the rule contains any selinux fields. Returns 1 if there
1767 are selinux fields specified in the rule, 0 otherwise. */
1768static inline int audit_rule_has_selinux(struct audit_krule *rule)
1769{
1770 int i;
1771
1772 for (i = 0; i < rule->field_count; i++) {
1773 struct audit_field *f = &rule->fields[i];
1774 switch (f->type) {
3a6b9f85
DG		 1775 case AUDIT_SUBJ_USER:
1776 case AUDIT_SUBJ_ROLE:
1777 case AUDIT_SUBJ_TYPE:
1778 case AUDIT_SUBJ_SEN:
1779 case AUDIT_SUBJ_CLR:
6e5a2d1d
DG		 1780 case AUDIT_OBJ_USER:
1781 case AUDIT_OBJ_ROLE:
1782 case AUDIT_OBJ_TYPE:
1783 case AUDIT_OBJ_LEV_LOW:
1784 case AUDIT_OBJ_LEV_HIGH:
3dc7e315
DG		 1785 return 1;
1786 }
1787 }
1788
1789 return 0;
1790}
1791
1792/* This function will re-initialize the se_rule field of all applicable rules.
1793 * It will traverse the filter lists serarching for rules that contain selinux
1794 * specific filter fields. When such a rule is found, it is copied, the
1795 * selinux field is re-initialized, and the old rule is replaced with the
1796 * updated rule. */
1797int selinux_audit_rule_update(void)
1798{
1799 struct audit_entry *entry, *n, *nentry;
f368c07d 1800 struct audit_watch *watch;
74c3cbe3 1801 struct audit_tree *tree;
3dc7e315
DG		 1802 int i, err = 0;
1803
f368c07d
AG		 1804 /* audit_filter_mutex synchronizes the writers */
1805 mutex_lock(&audit_filter_mutex);
3dc7e315
DG		 1806
1807 for (i = 0; i < AUDIT_NR_FILTERS; i++) {
1808 list_for_each_entry_safe(entry, n, &audit_filter_list[i], list) {
1809 if (!audit_rule_has_selinux(&entry->rule))
1810 continue;
1811
f368c07d 1812 watch = entry->rule.watch;
74c3cbe3 1813 tree = entry->rule.tree;
f368c07d 1814 nentry = audit_dupe_rule(&entry->rule, watch);
3dc7e315
DG		 1815 if (unlikely(IS_ERR(nentry))) {
1816 /* save the first error encountered for the
1817 * return value */
1818 if (!err)
1819 err = PTR_ERR(nentry);
1820 audit_panic("error updating selinux filters");
f368c07d
AG		 1821 if (watch)
1822 list_del(&entry->rule.rlist);
3dc7e315
DG		 1823 list_del_rcu(&entry->list);
1824 } else {
f368c07d
AG		 1825 if (watch) {
1826 list_add(&nentry->rule.rlist,
1827 &watch->rules);
1828 list_del(&entry->rule.rlist);
74c3cbe3
AV		 1829 } else if (tree)
1830 list_replace_init(&entry->rule.rlist,
1831 &nentry->rule.rlist);
3dc7e315
DG		 1832 list_replace_rcu(&entry->list, &nentry->list);
1833 }
1834 call_rcu(&entry->rcu, audit_free_rule_rcu);
1835 }
1836 }
1837
f368c07d 1838 mutex_unlock(&audit_filter_mutex);
3dc7e315
DG		 1839
1840 return err;
1841}
f368c07d
AG		 1842
1843/* Update watch data in audit rules based on inotify events. */
1844void audit_handle_ievent(struct inotify_watch *i_watch, u32 wd, u32 mask,
1845 u32 cookie, const char *dname, struct inode *inode)
1846{
1847 struct audit_parent *parent;
1848
1849 parent = container_of(i_watch, struct audit_parent, wdata);
1850
1851 if (mask & (IN_CREATE|IN_MOVED_TO) && inode)
1852 audit_update_watch(parent, dname, inode->i_sb->s_dev,
1853 inode->i_ino, 0);
1854 else if (mask & (IN_DELETE|IN_MOVED_FROM))
1855 audit_update_watch(parent, dname, (dev_t)-1, (unsigned long)-1, 1);
1856 /* inotify automatically removes the watch and sends IN_IGNORED */
1857 else if (mask & (IN_DELETE_SELF|IN_UNMOUNT))
1858 audit_remove_parent_watches(parent);
1859 /* inotify does not remove the watch, so remove it manually */
1860 else if(mask & IN_MOVE_SELF) {
1861 audit_remove_parent_watches(parent);
1862 inotify_remove_watch_locked(audit_ih, i_watch);
1863 } else if (mask & IN_IGNORED)
1864 put_inotify_watch(i_watch);
1865}
kernel source for telekom puls (alcatel/mediatek)