auditfilter.c 43 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745
  1. /* auditfilter.c -- filtering of audit events
  2. *
  3. * Copyright 2003-2004 Red Hat, Inc.
  4. * Copyright 2005 Hewlett-Packard Development Company, L.P.
  5. * Copyright 2005 IBM Corporation
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License as published by
  9. * the Free Software Foundation; either version 2 of the License, or
  10. * (at your option) any later version.
  11. *
  12. * This program is distributed in the hope that it will be useful,
  13. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. * GNU General Public License for more details.
  16. *
  17. * You should have received a copy of the GNU General Public License
  18. * along with this program; if not, write to the Free Software
  19. * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20. */
  21. #include <linux/kernel.h>
  22. #include <linux/audit.h>
  23. #include <linux/kthread.h>
  24. #include <linux/mutex.h>
  25. #include <linux/fs.h>
  26. #include <linux/namei.h>
  27. #include <linux/netlink.h>
  28. #include <linux/sched.h>
  29. #include <linux/inotify.h>
  30. #include <linux/selinux.h>
  31. #include "audit.h"
  32. /*
  33. * Locking model:
  34. *
  35. * audit_filter_mutex:
  36. * Synchronizes writes and blocking reads of audit's filterlist
  37. * data. Rcu is used to traverse the filterlist and access
  38. * contents of structs audit_entry, audit_watch and opaque
  39. * selinux rules during filtering. If modified, these structures
  40. * must be copied and replace their counterparts in the filterlist.
  41. * An audit_parent struct is not accessed during filtering, so may
  42. * be written directly provided audit_filter_mutex is held.
  43. */
  44. /*
  45. * Reference counting:
  46. *
  47. * audit_parent: lifetime is from audit_init_parent() to receipt of an IN_IGNORED
  48. * event. Each audit_watch holds a reference to its associated parent.
  49. *
  50. * audit_watch: if added to lists, lifetime is from audit_init_watch() to
  51. * audit_remove_watch(). Additionally, an audit_watch may exist
  52. * temporarily to assist in searching existing filter data. Each
  53. * audit_krule holds a reference to its associated watch.
  54. */
  55. struct audit_parent {
  56. struct list_head ilist; /* entry in inotify registration list */
  57. struct list_head watches; /* associated watches */
  58. struct inotify_watch wdata; /* inotify watch data */
  59. unsigned flags; /* status flags */
  60. };
  61. /*
  62. * audit_parent status flags:
  63. *
  64. * AUDIT_PARENT_INVALID - set anytime rules/watches are auto-removed due to
  65. * a filesystem event to ensure we're adding audit watches to a valid parent.
  66. * Technically not needed for IN_DELETE_SELF or IN_UNMOUNT events, as we cannot
  67. * receive them while we have nameidata, but must be used for IN_MOVE_SELF which
  68. * we can receive while holding nameidata.
  69. */
  70. #define AUDIT_PARENT_INVALID 0x001
  71. /* Audit filter lists, defined in <linux/audit.h> */
  72. struct list_head audit_filter_list[AUDIT_NR_FILTERS] = {
  73. LIST_HEAD_INIT(audit_filter_list[0]),
  74. LIST_HEAD_INIT(audit_filter_list[1]),
  75. LIST_HEAD_INIT(audit_filter_list[2]),
  76. LIST_HEAD_INIT(audit_filter_list[3]),
  77. LIST_HEAD_INIT(audit_filter_list[4]),
  78. LIST_HEAD_INIT(audit_filter_list[5]),
  79. #if AUDIT_NR_FILTERS != 6
  80. #error Fix audit_filter_list initialiser
  81. #endif
  82. };
  83. static DEFINE_MUTEX(audit_filter_mutex);
  84. /* Inotify handle */
  85. extern struct inotify_handle *audit_ih;
  86. /* Inotify events we care about. */
  87. #define AUDIT_IN_WATCH IN_MOVE|IN_CREATE|IN_DELETE|IN_DELETE_SELF|IN_MOVE_SELF
  88. void audit_free_parent(struct inotify_watch *i_watch)
  89. {
  90. struct audit_parent *parent;
  91. parent = container_of(i_watch, struct audit_parent, wdata);
  92. WARN_ON(!list_empty(&parent->watches));
  93. kfree(parent);
  94. }
  95. static inline void audit_get_watch(struct audit_watch *watch)
  96. {
  97. atomic_inc(&watch->count);
  98. }
  99. static void audit_put_watch(struct audit_watch *watch)
  100. {
  101. if (atomic_dec_and_test(&watch->count)) {
  102. WARN_ON(watch->parent);
  103. WARN_ON(!list_empty(&watch->rules));
  104. kfree(watch->path);
  105. kfree(watch);
  106. }
  107. }
  108. static void audit_remove_watch(struct audit_watch *watch)
  109. {
  110. list_del(&watch->wlist);
  111. put_inotify_watch(&watch->parent->wdata);
  112. watch->parent = NULL;
  113. audit_put_watch(watch); /* match initial get */
  114. }
  115. static inline void audit_free_rule(struct audit_entry *e)
  116. {
  117. int i;
  118. /* some rules don't have associated watches */
  119. if (e->rule.watch)
  120. audit_put_watch(e->rule.watch);
  121. if (e->rule.fields)
  122. for (i = 0; i < e->rule.field_count; i++) {
  123. struct audit_field *f = &e->rule.fields[i];
  124. kfree(f->se_str);
  125. selinux_audit_rule_free(f->se_rule);
  126. }
  127. kfree(e->rule.fields);
  128. kfree(e->rule.filterkey);
  129. kfree(e);
  130. }
  131. static inline void audit_free_rule_rcu(struct rcu_head *head)
  132. {
  133. struct audit_entry *e = container_of(head, struct audit_entry, rcu);
  134. audit_free_rule(e);
  135. }
  136. /* Initialize a parent watch entry. */
  137. static struct audit_parent *audit_init_parent(struct nameidata *ndp)
  138. {
  139. struct audit_parent *parent;
  140. s32 wd;
  141. parent = kzalloc(sizeof(*parent), GFP_KERNEL);
  142. if (unlikely(!parent))
  143. return ERR_PTR(-ENOMEM);
  144. INIT_LIST_HEAD(&parent->watches);
  145. parent->flags = 0;
  146. inotify_init_watch(&parent->wdata);
  147. /* grab a ref so inotify watch hangs around until we take audit_filter_mutex */
  148. get_inotify_watch(&parent->wdata);
  149. wd = inotify_add_watch(audit_ih, &parent->wdata, ndp->dentry->d_inode,
  150. AUDIT_IN_WATCH);
  151. if (wd < 0) {
  152. audit_free_parent(&parent->wdata);
  153. return ERR_PTR(wd);
  154. }
  155. return parent;
  156. }
  157. /* Initialize a watch entry. */
  158. static struct audit_watch *audit_init_watch(char *path)
  159. {
  160. struct audit_watch *watch;
  161. watch = kzalloc(sizeof(*watch), GFP_KERNEL);
  162. if (unlikely(!watch))
  163. return ERR_PTR(-ENOMEM);
  164. INIT_LIST_HEAD(&watch->rules);
  165. atomic_set(&watch->count, 1);
  166. watch->path = path;
  167. watch->dev = (dev_t)-1;
  168. watch->ino = (unsigned long)-1;
  169. return watch;
  170. }
  171. /* Initialize an audit filterlist entry. */
  172. static inline struct audit_entry *audit_init_entry(u32 field_count)
  173. {
  174. struct audit_entry *entry;
  175. struct audit_field *fields;
  176. entry = kzalloc(sizeof(*entry), GFP_KERNEL);
  177. if (unlikely(!entry))
  178. return NULL;
  179. fields = kzalloc(sizeof(*fields) * field_count, GFP_KERNEL);
  180. if (unlikely(!fields)) {
  181. kfree(entry);
  182. return NULL;
  183. }
  184. entry->rule.fields = fields;
  185. return entry;
  186. }
  187. /* Unpack a filter field's string representation from user-space
  188. * buffer. */
  189. static char *audit_unpack_string(void **bufp, size_t *remain, size_t len)
  190. {
  191. char *str;
  192. if (!*bufp || (len == 0) || (len > *remain))
  193. return ERR_PTR(-EINVAL);
  194. /* Of the currently implemented string fields, PATH_MAX
  195. * defines the longest valid length.
  196. */
  197. if (len > PATH_MAX)
  198. return ERR_PTR(-ENAMETOOLONG);
  199. str = kmalloc(len + 1, GFP_KERNEL);
  200. if (unlikely(!str))
  201. return ERR_PTR(-ENOMEM);
  202. memcpy(str, *bufp, len);
  203. str[len] = 0;
  204. *bufp += len;
  205. *remain -= len;
  206. return str;
  207. }
  208. /* Translate an inode field to kernel respresentation. */
  209. static inline int audit_to_inode(struct audit_krule *krule,
  210. struct audit_field *f)
  211. {
  212. if (krule->listnr != AUDIT_FILTER_EXIT ||
  213. krule->watch || krule->inode_f)
  214. return -EINVAL;
  215. krule->inode_f = f;
  216. return 0;
  217. }
  218. /* Translate a watch string to kernel respresentation. */
  219. static int audit_to_watch(struct audit_krule *krule, char *path, int len,
  220. u32 op)
  221. {
  222. struct audit_watch *watch;
  223. if (!audit_ih)
  224. return -EOPNOTSUPP;
  225. if (path[0] != '/' || path[len-1] == '/' ||
  226. krule->listnr != AUDIT_FILTER_EXIT ||
  227. op & ~AUDIT_EQUAL ||
  228. krule->inode_f || krule->watch) /* 1 inode # per rule, for hash */
  229. return -EINVAL;
  230. watch = audit_init_watch(path);
  231. if (unlikely(IS_ERR(watch)))
  232. return PTR_ERR(watch);
  233. audit_get_watch(watch);
  234. krule->watch = watch;
  235. return 0;
  236. }
  237. static __u32 *classes[AUDIT_SYSCALL_CLASSES];
  238. int __init audit_register_class(int class, unsigned *list)
  239. {
  240. __u32 *p = kzalloc(AUDIT_BITMASK_SIZE * sizeof(__u32), GFP_KERNEL);
  241. if (!p)
  242. return -ENOMEM;
  243. while (*list != ~0U) {
  244. unsigned n = *list++;
  245. if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) {
  246. kfree(p);
  247. return -EINVAL;
  248. }
  249. p[AUDIT_WORD(n)] |= AUDIT_BIT(n);
  250. }
  251. if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) {
  252. kfree(p);
  253. return -EINVAL;
  254. }
  255. classes[class] = p;
  256. return 0;
  257. }
  258. int audit_match_class(int class, unsigned syscall)
  259. {
  260. if (unlikely(syscall >= AUDIT_BITMASK_SIZE * sizeof(__u32)))
  261. return 0;
  262. if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class]))
  263. return 0;
  264. return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall);
  265. }
  266. /* Common user-space to kernel rule translation. */
  267. static inline struct audit_entry *audit_to_entry_common(struct audit_rule *rule)
  268. {
  269. unsigned listnr;
  270. struct audit_entry *entry;
  271. int i, err;
  272. err = -EINVAL;
  273. listnr = rule->flags & ~AUDIT_FILTER_PREPEND;
  274. switch(listnr) {
  275. default:
  276. goto exit_err;
  277. case AUDIT_FILTER_USER:
  278. case AUDIT_FILTER_TYPE:
  279. #ifdef CONFIG_AUDITSYSCALL
  280. case AUDIT_FILTER_ENTRY:
  281. case AUDIT_FILTER_EXIT:
  282. case AUDIT_FILTER_TASK:
  283. #endif
  284. ;
  285. }
  286. if (unlikely(rule->action == AUDIT_POSSIBLE)) {
  287. printk(KERN_ERR "AUDIT_POSSIBLE is deprecated\n");
  288. goto exit_err;
  289. }
  290. if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS)
  291. goto exit_err;
  292. if (rule->field_count > AUDIT_MAX_FIELDS)
  293. goto exit_err;
  294. err = -ENOMEM;
  295. entry = audit_init_entry(rule->field_count);
  296. if (!entry)
  297. goto exit_err;
  298. entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;
  299. entry->rule.listnr = listnr;
  300. entry->rule.action = rule->action;
  301. entry->rule.field_count = rule->field_count;
  302. for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
  303. entry->rule.mask[i] = rule->mask[i];
  304. for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) {
  305. int bit = AUDIT_BITMASK_SIZE * 32 - i - 1;
  306. __u32 *p = &entry->rule.mask[AUDIT_WORD(bit)];
  307. __u32 *class;
  308. if (!(*p & AUDIT_BIT(bit)))
  309. continue;
  310. *p &= ~AUDIT_BIT(bit);
  311. class = classes[i];
  312. if (class) {
  313. int j;
  314. for (j = 0; j < AUDIT_BITMASK_SIZE; j++)
  315. entry->rule.mask[j] |= class[j];
  316. }
  317. }
  318. return entry;
  319. exit_err:
  320. return ERR_PTR(err);
  321. }
  322. /* Translate struct audit_rule to kernel's rule respresentation.
  323. * Exists for backward compatibility with userspace. */
  324. static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
  325. {
  326. struct audit_entry *entry;
  327. struct audit_field *f;
  328. int err = 0;
  329. int i;
  330. entry = audit_to_entry_common(rule);
  331. if (IS_ERR(entry))
  332. goto exit_nofree;
  333. for (i = 0; i < rule->field_count; i++) {
  334. struct audit_field *f = &entry->rule.fields[i];
  335. f->op = rule->fields[i] & (AUDIT_NEGATE|AUDIT_OPERATORS);
  336. f->type = rule->fields[i] & ~(AUDIT_NEGATE|AUDIT_OPERATORS);
  337. f->val = rule->values[i];
  338. err = -EINVAL;
  339. switch(f->type) {
  340. default:
  341. goto exit_free;
  342. case AUDIT_PID:
  343. case AUDIT_UID:
  344. case AUDIT_EUID:
  345. case AUDIT_SUID:
  346. case AUDIT_FSUID:
  347. case AUDIT_GID:
  348. case AUDIT_EGID:
  349. case AUDIT_SGID:
  350. case AUDIT_FSGID:
  351. case AUDIT_LOGINUID:
  352. case AUDIT_PERS:
  353. case AUDIT_MSGTYPE:
  354. case AUDIT_PPID:
  355. case AUDIT_DEVMAJOR:
  356. case AUDIT_DEVMINOR:
  357. case AUDIT_EXIT:
  358. case AUDIT_SUCCESS:
  359. case AUDIT_ARG0:
  360. case AUDIT_ARG1:
  361. case AUDIT_ARG2:
  362. case AUDIT_ARG3:
  363. break;
  364. /* arch is only allowed to be = or != */
  365. case AUDIT_ARCH:
  366. if ((f->op != AUDIT_NOT_EQUAL) && (f->op != AUDIT_EQUAL)
  367. && (f->op != AUDIT_NEGATE) && (f->op)) {
  368. err = -EINVAL;
  369. goto exit_free;
  370. }
  371. break;
  372. case AUDIT_PERM:
  373. if (f->val & ~15)
  374. goto exit_free;
  375. break;
  376. case AUDIT_INODE:
  377. err = audit_to_inode(&entry->rule, f);
  378. if (err)
  379. goto exit_free;
  380. break;
  381. }
  382. entry->rule.vers_ops = (f->op & AUDIT_OPERATORS) ? 2 : 1;
  383. /* Support for legacy operators where
  384. * AUDIT_NEGATE bit signifies != and otherwise assumes == */
  385. if (f->op & AUDIT_NEGATE)
  386. f->op = AUDIT_NOT_EQUAL;
  387. else if (!f->op)
  388. f->op = AUDIT_EQUAL;
  389. else if (f->op == AUDIT_OPERATORS) {
  390. err = -EINVAL;
  391. goto exit_free;
  392. }
  393. }
  394. f = entry->rule.inode_f;
  395. if (f) {
  396. switch(f->op) {
  397. case AUDIT_NOT_EQUAL:
  398. entry->rule.inode_f = NULL;
  399. case AUDIT_EQUAL:
  400. break;
  401. default:
  402. err = -EINVAL;
  403. goto exit_free;
  404. }
  405. }
  406. exit_nofree:
  407. return entry;
  408. exit_free:
  409. audit_free_rule(entry);
  410. return ERR_PTR(err);
  411. }
  412. /* Translate struct audit_rule_data to kernel's rule respresentation. */
  413. static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
  414. size_t datasz)
  415. {
  416. int err = 0;
  417. struct audit_entry *entry;
  418. struct audit_field *f;
  419. void *bufp;
  420. size_t remain = datasz - sizeof(struct audit_rule_data);
  421. int i;
  422. char *str;
  423. entry = audit_to_entry_common((struct audit_rule *)data);
  424. if (IS_ERR(entry))
  425. goto exit_nofree;
  426. bufp = data->buf;
  427. entry->rule.vers_ops = 2;
  428. for (i = 0; i < data->field_count; i++) {
  429. struct audit_field *f = &entry->rule.fields[i];
  430. err = -EINVAL;
  431. if (!(data->fieldflags[i] & AUDIT_OPERATORS) ||
  432. data->fieldflags[i] & ~AUDIT_OPERATORS)
  433. goto exit_free;
  434. f->op = data->fieldflags[i] & AUDIT_OPERATORS;
  435. f->type = data->fields[i];
  436. f->val = data->values[i];
  437. f->se_str = NULL;
  438. f->se_rule = NULL;
  439. switch(f->type) {
  440. case AUDIT_PID:
  441. case AUDIT_UID:
  442. case AUDIT_EUID:
  443. case AUDIT_SUID:
  444. case AUDIT_FSUID:
  445. case AUDIT_GID:
  446. case AUDIT_EGID:
  447. case AUDIT_SGID:
  448. case AUDIT_FSGID:
  449. case AUDIT_LOGINUID:
  450. case AUDIT_PERS:
  451. case AUDIT_ARCH:
  452. case AUDIT_MSGTYPE:
  453. case AUDIT_PPID:
  454. case AUDIT_DEVMAJOR:
  455. case AUDIT_DEVMINOR:
  456. case AUDIT_EXIT:
  457. case AUDIT_SUCCESS:
  458. case AUDIT_ARG0:
  459. case AUDIT_ARG1:
  460. case AUDIT_ARG2:
  461. case AUDIT_ARG3:
  462. break;
  463. case AUDIT_SUBJ_USER:
  464. case AUDIT_SUBJ_ROLE:
  465. case AUDIT_SUBJ_TYPE:
  466. case AUDIT_SUBJ_SEN:
  467. case AUDIT_SUBJ_CLR:
  468. case AUDIT_OBJ_USER:
  469. case AUDIT_OBJ_ROLE:
  470. case AUDIT_OBJ_TYPE:
  471. case AUDIT_OBJ_LEV_LOW:
  472. case AUDIT_OBJ_LEV_HIGH:
  473. str = audit_unpack_string(&bufp, &remain, f->val);
  474. if (IS_ERR(str))
  475. goto exit_free;
  476. entry->rule.buflen += f->val;
  477. err = selinux_audit_rule_init(f->type, f->op, str,
  478. &f->se_rule);
  479. /* Keep currently invalid fields around in case they
  480. * become valid after a policy reload. */
  481. if (err == -EINVAL) {
  482. printk(KERN_WARNING "audit rule for selinux "
  483. "\'%s\' is invalid\n", str);
  484. err = 0;
  485. }
  486. if (err) {
  487. kfree(str);
  488. goto exit_free;
  489. } else
  490. f->se_str = str;
  491. break;
  492. case AUDIT_WATCH:
  493. str = audit_unpack_string(&bufp, &remain, f->val);
  494. if (IS_ERR(str))
  495. goto exit_free;
  496. entry->rule.buflen += f->val;
  497. err = audit_to_watch(&entry->rule, str, f->val, f->op);
  498. if (err) {
  499. kfree(str);
  500. goto exit_free;
  501. }
  502. break;
  503. case AUDIT_INODE:
  504. err = audit_to_inode(&entry->rule, f);
  505. if (err)
  506. goto exit_free;
  507. break;
  508. case AUDIT_FILTERKEY:
  509. err = -EINVAL;
  510. if (entry->rule.filterkey || f->val > AUDIT_MAX_KEY_LEN)
  511. goto exit_free;
  512. str = audit_unpack_string(&bufp, &remain, f->val);
  513. if (IS_ERR(str))
  514. goto exit_free;
  515. entry->rule.buflen += f->val;
  516. entry->rule.filterkey = str;
  517. break;
  518. case AUDIT_PERM:
  519. if (f->val & ~15)
  520. goto exit_free;
  521. break;
  522. default:
  523. goto exit_free;
  524. }
  525. }
  526. f = entry->rule.inode_f;
  527. if (f) {
  528. switch(f->op) {
  529. case AUDIT_NOT_EQUAL:
  530. entry->rule.inode_f = NULL;
  531. case AUDIT_EQUAL:
  532. break;
  533. default:
  534. err = -EINVAL;
  535. goto exit_free;
  536. }
  537. }
  538. exit_nofree:
  539. return entry;
  540. exit_free:
  541. audit_free_rule(entry);
  542. return ERR_PTR(err);
  543. }
  544. /* Pack a filter field's string representation into data block. */
  545. static inline size_t audit_pack_string(void **bufp, char *str)
  546. {
  547. size_t len = strlen(str);
  548. memcpy(*bufp, str, len);
  549. *bufp += len;
  550. return len;
  551. }
  552. /* Translate kernel rule respresentation to struct audit_rule.
  553. * Exists for backward compatibility with userspace. */
  554. static struct audit_rule *audit_krule_to_rule(struct audit_krule *krule)
  555. {
  556. struct audit_rule *rule;
  557. int i;
  558. rule = kzalloc(sizeof(*rule), GFP_KERNEL);
  559. if (unlikely(!rule))
  560. return NULL;
  561. rule->flags = krule->flags | krule->listnr;
  562. rule->action = krule->action;
  563. rule->field_count = krule->field_count;
  564. for (i = 0; i < rule->field_count; i++) {
  565. rule->values[i] = krule->fields[i].val;
  566. rule->fields[i] = krule->fields[i].type;
  567. if (krule->vers_ops == 1) {
  568. if (krule->fields[i].op & AUDIT_NOT_EQUAL)
  569. rule->fields[i] |= AUDIT_NEGATE;
  570. } else {
  571. rule->fields[i] |= krule->fields[i].op;
  572. }
  573. }
  574. for (i = 0; i < AUDIT_BITMASK_SIZE; i++) rule->mask[i] = krule->mask[i];
  575. return rule;
  576. }
  577. /* Translate kernel rule respresentation to struct audit_rule_data. */
  578. static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
  579. {
  580. struct audit_rule_data *data;
  581. void *bufp;
  582. int i;
  583. data = kmalloc(sizeof(*data) + krule->buflen, GFP_KERNEL);
  584. if (unlikely(!data))
  585. return NULL;
  586. memset(data, 0, sizeof(*data));
  587. data->flags = krule->flags | krule->listnr;
  588. data->action = krule->action;
  589. data->field_count = krule->field_count;
  590. bufp = data->buf;
  591. for (i = 0; i < data->field_count; i++) {
  592. struct audit_field *f = &krule->fields[i];
  593. data->fields[i] = f->type;
  594. data->fieldflags[i] = f->op;
  595. switch(f->type) {
  596. case AUDIT_SUBJ_USER:
  597. case AUDIT_SUBJ_ROLE:
  598. case AUDIT_SUBJ_TYPE:
  599. case AUDIT_SUBJ_SEN:
  600. case AUDIT_SUBJ_CLR:
  601. case AUDIT_OBJ_USER:
  602. case AUDIT_OBJ_ROLE:
  603. case AUDIT_OBJ_TYPE:
  604. case AUDIT_OBJ_LEV_LOW:
  605. case AUDIT_OBJ_LEV_HIGH:
  606. data->buflen += data->values[i] =
  607. audit_pack_string(&bufp, f->se_str);
  608. break;
  609. case AUDIT_WATCH:
  610. data->buflen += data->values[i] =
  611. audit_pack_string(&bufp, krule->watch->path);
  612. break;
  613. case AUDIT_FILTERKEY:
  614. data->buflen += data->values[i] =
  615. audit_pack_string(&bufp, krule->filterkey);
  616. break;
  617. default:
  618. data->values[i] = f->val;
  619. }
  620. }
  621. for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i];
  622. return data;
  623. }
  624. /* Compare two rules in kernel format. Considered success if rules
  625. * don't match. */
  626. static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
  627. {
  628. int i;
  629. if (a->flags != b->flags ||
  630. a->listnr != b->listnr ||
  631. a->action != b->action ||
  632. a->field_count != b->field_count)
  633. return 1;
  634. for (i = 0; i < a->field_count; i++) {
  635. if (a->fields[i].type != b->fields[i].type ||
  636. a->fields[i].op != b->fields[i].op)
  637. return 1;
  638. switch(a->fields[i].type) {
  639. case AUDIT_SUBJ_USER:
  640. case AUDIT_SUBJ_ROLE:
  641. case AUDIT_SUBJ_TYPE:
  642. case AUDIT_SUBJ_SEN:
  643. case AUDIT_SUBJ_CLR:
  644. case AUDIT_OBJ_USER:
  645. case AUDIT_OBJ_ROLE:
  646. case AUDIT_OBJ_TYPE:
  647. case AUDIT_OBJ_LEV_LOW:
  648. case AUDIT_OBJ_LEV_HIGH:
  649. if (strcmp(a->fields[i].se_str, b->fields[i].se_str))
  650. return 1;
  651. break;
  652. case AUDIT_WATCH:
  653. if (strcmp(a->watch->path, b->watch->path))
  654. return 1;
  655. break;
  656. case AUDIT_FILTERKEY:
  657. /* both filterkeys exist based on above type compare */
  658. if (strcmp(a->filterkey, b->filterkey))
  659. return 1;
  660. break;
  661. default:
  662. if (a->fields[i].val != b->fields[i].val)
  663. return 1;
  664. }
  665. }
  666. for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
  667. if (a->mask[i] != b->mask[i])
  668. return 1;
  669. return 0;
  670. }
  671. /* Duplicate the given audit watch. The new watch's rules list is initialized
  672. * to an empty list and wlist is undefined. */
  673. static struct audit_watch *audit_dupe_watch(struct audit_watch *old)
  674. {
  675. char *path;
  676. struct audit_watch *new;
  677. path = kstrdup(old->path, GFP_KERNEL);
  678. if (unlikely(!path))
  679. return ERR_PTR(-ENOMEM);
  680. new = audit_init_watch(path);
  681. if (unlikely(IS_ERR(new))) {
  682. kfree(path);
  683. goto out;
  684. }
  685. new->dev = old->dev;
  686. new->ino = old->ino;
  687. get_inotify_watch(&old->parent->wdata);
  688. new->parent = old->parent;
  689. out:
  690. return new;
  691. }
  692. /* Duplicate selinux field information. The se_rule is opaque, so must be
  693. * re-initialized. */
  694. static inline int audit_dupe_selinux_field(struct audit_field *df,
  695. struct audit_field *sf)
  696. {
  697. int ret = 0;
  698. char *se_str;
  699. /* our own copy of se_str */
  700. se_str = kstrdup(sf->se_str, GFP_KERNEL);
  701. if (unlikely(!se_str))
  702. return -ENOMEM;
  703. df->se_str = se_str;
  704. /* our own (refreshed) copy of se_rule */
  705. ret = selinux_audit_rule_init(df->type, df->op, df->se_str,
  706. &df->se_rule);
  707. /* Keep currently invalid fields around in case they
  708. * become valid after a policy reload. */
  709. if (ret == -EINVAL) {
  710. printk(KERN_WARNING "audit rule for selinux \'%s\' is "
  711. "invalid\n", df->se_str);
  712. ret = 0;
  713. }
  714. return ret;
  715. }
  716. /* Duplicate an audit rule. This will be a deep copy with the exception
  717. * of the watch - that pointer is carried over. The selinux specific fields
  718. * will be updated in the copy. The point is to be able to replace the old
  719. * rule with the new rule in the filterlist, then free the old rule.
  720. * The rlist element is undefined; list manipulations are handled apart from
  721. * the initial copy. */
  722. static struct audit_entry *audit_dupe_rule(struct audit_krule *old,
  723. struct audit_watch *watch)
  724. {
  725. u32 fcount = old->field_count;
  726. struct audit_entry *entry;
  727. struct audit_krule *new;
  728. char *fk;
  729. int i, err = 0;
  730. entry = audit_init_entry(fcount);
  731. if (unlikely(!entry))
  732. return ERR_PTR(-ENOMEM);
  733. new = &entry->rule;
  734. new->vers_ops = old->vers_ops;
  735. new->flags = old->flags;
  736. new->listnr = old->listnr;
  737. new->action = old->action;
  738. for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
  739. new->mask[i] = old->mask[i];
  740. new->buflen = old->buflen;
  741. new->inode_f = old->inode_f;
  742. new->watch = NULL;
  743. new->field_count = old->field_count;
  744. memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount);
  745. /* deep copy this information, updating the se_rule fields, because
  746. * the originals will all be freed when the old rule is freed. */
  747. for (i = 0; i < fcount; i++) {
  748. switch (new->fields[i].type) {
  749. case AUDIT_SUBJ_USER:
  750. case AUDIT_SUBJ_ROLE:
  751. case AUDIT_SUBJ_TYPE:
  752. case AUDIT_SUBJ_SEN:
  753. case AUDIT_SUBJ_CLR:
  754. case AUDIT_OBJ_USER:
  755. case AUDIT_OBJ_ROLE:
  756. case AUDIT_OBJ_TYPE:
  757. case AUDIT_OBJ_LEV_LOW:
  758. case AUDIT_OBJ_LEV_HIGH:
  759. err = audit_dupe_selinux_field(&new->fields[i],
  760. &old->fields[i]);
  761. break;
  762. case AUDIT_FILTERKEY:
  763. fk = kstrdup(old->filterkey, GFP_KERNEL);
  764. if (unlikely(!fk))
  765. err = -ENOMEM;
  766. else
  767. new->filterkey = fk;
  768. }
  769. if (err) {
  770. audit_free_rule(entry);
  771. return ERR_PTR(err);
  772. }
  773. }
  774. if (watch) {
  775. audit_get_watch(watch);
  776. new->watch = watch;
  777. }
  778. return entry;
  779. }
  780. /* Update inode info in audit rules based on filesystem event. */
  781. static void audit_update_watch(struct audit_parent *parent,
  782. const char *dname, dev_t dev,
  783. unsigned long ino, unsigned invalidating)
  784. {
  785. struct audit_watch *owatch, *nwatch, *nextw;
  786. struct audit_krule *r, *nextr;
  787. struct audit_entry *oentry, *nentry;
  788. struct audit_buffer *ab;
  789. mutex_lock(&audit_filter_mutex);
  790. list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
  791. if (audit_compare_dname_path(dname, owatch->path, NULL))
  792. continue;
  793. /* If the update involves invalidating rules, do the inode-based
  794. * filtering now, so we don't omit records. */
  795. if (invalidating &&
  796. audit_filter_inodes(current, current->audit_context) == AUDIT_RECORD_CONTEXT)
  797. audit_set_auditable(current->audit_context);
  798. nwatch = audit_dupe_watch(owatch);
  799. if (unlikely(IS_ERR(nwatch))) {
  800. mutex_unlock(&audit_filter_mutex);
  801. audit_panic("error updating watch, skipping");
  802. return;
  803. }
  804. nwatch->dev = dev;
  805. nwatch->ino = ino;
  806. list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) {
  807. oentry = container_of(r, struct audit_entry, rule);
  808. list_del(&oentry->rule.rlist);
  809. list_del_rcu(&oentry->list);
  810. nentry = audit_dupe_rule(&oentry->rule, nwatch);
  811. if (unlikely(IS_ERR(nentry)))
  812. audit_panic("error updating watch, removing");
  813. else {
  814. int h = audit_hash_ino((u32)ino);
  815. list_add(&nentry->rule.rlist, &nwatch->rules);
  816. list_add_rcu(&nentry->list, &audit_inode_hash[h]);
  817. }
  818. call_rcu(&oentry->rcu, audit_free_rule_rcu);
  819. }
  820. ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
  821. audit_log_format(ab, "op=updated rules specifying path=");
  822. audit_log_untrustedstring(ab, owatch->path);
  823. audit_log_format(ab, " with dev=%u ino=%lu\n", dev, ino);
  824. audit_log_format(ab, " list=%d res=1", r->listnr);
  825. audit_log_end(ab);
  826. audit_remove_watch(owatch);
  827. goto add_watch_to_parent; /* event applies to a single watch */
  828. }
  829. mutex_unlock(&audit_filter_mutex);
  830. return;
  831. add_watch_to_parent:
  832. list_add(&nwatch->wlist, &parent->watches);
  833. mutex_unlock(&audit_filter_mutex);
  834. return;
  835. }
  836. /* Remove all watches & rules associated with a parent that is going away. */
  837. static void audit_remove_parent_watches(struct audit_parent *parent)
  838. {
  839. struct audit_watch *w, *nextw;
  840. struct audit_krule *r, *nextr;
  841. struct audit_entry *e;
  842. struct audit_buffer *ab;
  843. mutex_lock(&audit_filter_mutex);
  844. parent->flags |= AUDIT_PARENT_INVALID;
  845. list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
  846. list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
  847. e = container_of(r, struct audit_entry, rule);
  848. ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
  849. audit_log_format(ab, "op=remove rule path=");
  850. audit_log_untrustedstring(ab, w->path);
  851. if (r->filterkey) {
  852. audit_log_format(ab, " key=");
  853. audit_log_untrustedstring(ab, r->filterkey);
  854. } else
  855. audit_log_format(ab, " key=(null)");
  856. audit_log_format(ab, " list=%d res=1", r->listnr);
  857. audit_log_end(ab);
  858. list_del(&r->rlist);
  859. list_del_rcu(&e->list);
  860. call_rcu(&e->rcu, audit_free_rule_rcu);
  861. }
  862. audit_remove_watch(w);
  863. }
  864. mutex_unlock(&audit_filter_mutex);
  865. }
  866. /* Unregister inotify watches for parents on in_list.
  867. * Generates an IN_IGNORED event. */
  868. static void audit_inotify_unregister(struct list_head *in_list)
  869. {
  870. struct audit_parent *p, *n;
  871. list_for_each_entry_safe(p, n, in_list, ilist) {
  872. list_del(&p->ilist);
  873. inotify_rm_watch(audit_ih, &p->wdata);
  874. /* the put matching the get in audit_do_del_rule() */
  875. put_inotify_watch(&p->wdata);
  876. }
  877. }
  878. /* Find an existing audit rule.
  879. * Caller must hold audit_filter_mutex to prevent stale rule data. */
  880. static struct audit_entry *audit_find_rule(struct audit_entry *entry,
  881. struct list_head *list)
  882. {
  883. struct audit_entry *e, *found = NULL;
  884. int h;
  885. if (entry->rule.watch) {
  886. /* we don't know the inode number, so must walk entire hash */
  887. for (h = 0; h < AUDIT_INODE_BUCKETS; h++) {
  888. list = &audit_inode_hash[h];
  889. list_for_each_entry(e, list, list)
  890. if (!audit_compare_rule(&entry->rule, &e->rule)) {
  891. found = e;
  892. goto out;
  893. }
  894. }
  895. goto out;
  896. }
  897. list_for_each_entry(e, list, list)
  898. if (!audit_compare_rule(&entry->rule, &e->rule)) {
  899. found = e;
  900. goto out;
  901. }
  902. out:
  903. return found;
  904. }
  905. /* Get path information necessary for adding watches. */
  906. static int audit_get_nd(char *path, struct nameidata **ndp,
  907. struct nameidata **ndw)
  908. {
  909. struct nameidata *ndparent, *ndwatch;
  910. int err;
  911. ndparent = kmalloc(sizeof(*ndparent), GFP_KERNEL);
  912. if (unlikely(!ndparent))
  913. return -ENOMEM;
  914. ndwatch = kmalloc(sizeof(*ndwatch), GFP_KERNEL);
  915. if (unlikely(!ndwatch)) {
  916. kfree(ndparent);
  917. return -ENOMEM;
  918. }
  919. err = path_lookup(path, LOOKUP_PARENT, ndparent);
  920. if (err) {
  921. kfree(ndparent);
  922. kfree(ndwatch);
  923. return err;
  924. }
  925. err = path_lookup(path, 0, ndwatch);
  926. if (err) {
  927. kfree(ndwatch);
  928. ndwatch = NULL;
  929. }
  930. *ndp = ndparent;
  931. *ndw = ndwatch;
  932. return 0;
  933. }
  934. /* Release resources used for watch path information. */
  935. static void audit_put_nd(struct nameidata *ndp, struct nameidata *ndw)
  936. {
  937. if (ndp) {
  938. path_release(ndp);
  939. kfree(ndp);
  940. }
  941. if (ndw) {
  942. path_release(ndw);
  943. kfree(ndw);
  944. }
  945. }
  946. /* Associate the given rule with an existing parent inotify_watch.
  947. * Caller must hold audit_filter_mutex. */
  948. static void audit_add_to_parent(struct audit_krule *krule,
  949. struct audit_parent *parent)
  950. {
  951. struct audit_watch *w, *watch = krule->watch;
  952. int watch_found = 0;
  953. list_for_each_entry(w, &parent->watches, wlist) {
  954. if (strcmp(watch->path, w->path))
  955. continue;
  956. watch_found = 1;
  957. /* put krule's and initial refs to temporary watch */
  958. audit_put_watch(watch);
  959. audit_put_watch(watch);
  960. audit_get_watch(w);
  961. krule->watch = watch = w;
  962. break;
  963. }
  964. if (!watch_found) {
  965. get_inotify_watch(&parent->wdata);
  966. watch->parent = parent;
  967. list_add(&watch->wlist, &parent->watches);
  968. }
  969. list_add(&krule->rlist, &watch->rules);
  970. }
  971. /* Find a matching watch entry, or add this one.
  972. * Caller must hold audit_filter_mutex. */
  973. static int audit_add_watch(struct audit_krule *krule, struct nameidata *ndp,
  974. struct nameidata *ndw)
  975. {
  976. struct audit_watch *watch = krule->watch;
  977. struct inotify_watch *i_watch;
  978. struct audit_parent *parent;
  979. int ret = 0;
  980. /* update watch filter fields */
  981. if (ndw) {
  982. watch->dev = ndw->dentry->d_inode->i_sb->s_dev;
  983. watch->ino = ndw->dentry->d_inode->i_ino;
  984. }
  985. /* The audit_filter_mutex must not be held during inotify calls because
  986. * we hold it during inotify event callback processing. If an existing
  987. * inotify watch is found, inotify_find_watch() grabs a reference before
  988. * returning.
  989. */
  990. mutex_unlock(&audit_filter_mutex);
  991. if (inotify_find_watch(audit_ih, ndp->dentry->d_inode, &i_watch) < 0) {
  992. parent = audit_init_parent(ndp);
  993. if (IS_ERR(parent)) {
  994. /* caller expects mutex locked */
  995. mutex_lock(&audit_filter_mutex);
  996. return PTR_ERR(parent);
  997. }
  998. } else
  999. parent = container_of(i_watch, struct audit_parent, wdata);
  1000. mutex_lock(&audit_filter_mutex);
  1001. /* parent was moved before we took audit_filter_mutex */
  1002. if (parent->flags & AUDIT_PARENT_INVALID)
  1003. ret = -ENOENT;
  1004. else
  1005. audit_add_to_parent(krule, parent);
  1006. /* match get in audit_init_parent or inotify_find_watch */
  1007. put_inotify_watch(&parent->wdata);
  1008. return ret;
  1009. }
  1010. /* Add rule to given filterlist if not a duplicate. */
  1011. static inline int audit_add_rule(struct audit_entry *entry,
  1012. struct list_head *list)
  1013. {
  1014. struct audit_entry *e;
  1015. struct audit_field *inode_f = entry->rule.inode_f;
  1016. struct audit_watch *watch = entry->rule.watch;
  1017. struct nameidata *ndp, *ndw;
  1018. int h, err, putnd_needed = 0;
  1019. #ifdef CONFIG_AUDITSYSCALL
  1020. int dont_count = 0;
  1021. /* If either of these, don't count towards total */
  1022. if (entry->rule.listnr == AUDIT_FILTER_USER ||
  1023. entry->rule.listnr == AUDIT_FILTER_TYPE)
  1024. dont_count = 1;
  1025. #endif
  1026. if (inode_f) {
  1027. h = audit_hash_ino(inode_f->val);
  1028. list = &audit_inode_hash[h];
  1029. }
  1030. mutex_lock(&audit_filter_mutex);
  1031. e = audit_find_rule(entry, list);
  1032. mutex_unlock(&audit_filter_mutex);
  1033. if (e) {
  1034. err = -EEXIST;
  1035. goto error;
  1036. }
  1037. /* Avoid calling path_lookup under audit_filter_mutex. */
  1038. if (watch) {
  1039. err = audit_get_nd(watch->path, &ndp, &ndw);
  1040. if (err)
  1041. goto error;
  1042. putnd_needed = 1;
  1043. }
  1044. mutex_lock(&audit_filter_mutex);
  1045. if (watch) {
  1046. /* audit_filter_mutex is dropped and re-taken during this call */
  1047. err = audit_add_watch(&entry->rule, ndp, ndw);
  1048. if (err) {
  1049. mutex_unlock(&audit_filter_mutex);
  1050. goto error;
  1051. }
  1052. h = audit_hash_ino((u32)watch->ino);
  1053. list = &audit_inode_hash[h];
  1054. }
  1055. if (entry->rule.flags & AUDIT_FILTER_PREPEND) {
  1056. list_add_rcu(&entry->list, list);
  1057. entry->rule.flags &= ~AUDIT_FILTER_PREPEND;
  1058. } else {
  1059. list_add_tail_rcu(&entry->list, list);
  1060. }
  1061. #ifdef CONFIG_AUDITSYSCALL
  1062. if (!dont_count)
  1063. audit_n_rules++;
  1064. #endif
  1065. mutex_unlock(&audit_filter_mutex);
  1066. if (putnd_needed)
  1067. audit_put_nd(ndp, ndw);
  1068. return 0;
  1069. error:
  1070. if (putnd_needed)
  1071. audit_put_nd(ndp, ndw);
  1072. if (watch)
  1073. audit_put_watch(watch); /* tmp watch, matches initial get */
  1074. return err;
  1075. }
  1076. /* Remove an existing rule from filterlist. */
  1077. static inline int audit_del_rule(struct audit_entry *entry,
  1078. struct list_head *list)
  1079. {
  1080. struct audit_entry *e;
  1081. struct audit_field *inode_f = entry->rule.inode_f;
  1082. struct audit_watch *watch, *tmp_watch = entry->rule.watch;
  1083. LIST_HEAD(inotify_list);
  1084. int h, ret = 0;
  1085. #ifdef CONFIG_AUDITSYSCALL
  1086. int dont_count = 0;
  1087. /* If either of these, don't count towards total */
  1088. if (entry->rule.listnr == AUDIT_FILTER_USER ||
  1089. entry->rule.listnr == AUDIT_FILTER_TYPE)
  1090. dont_count = 1;
  1091. #endif
  1092. if (inode_f) {
  1093. h = audit_hash_ino(inode_f->val);
  1094. list = &audit_inode_hash[h];
  1095. }
  1096. mutex_lock(&audit_filter_mutex);
  1097. e = audit_find_rule(entry, list);
  1098. if (!e) {
  1099. mutex_unlock(&audit_filter_mutex);
  1100. ret = -ENOENT;
  1101. goto out;
  1102. }
  1103. watch = e->rule.watch;
  1104. if (watch) {
  1105. struct audit_parent *parent = watch->parent;
  1106. list_del(&e->rule.rlist);
  1107. if (list_empty(&watch->rules)) {
  1108. audit_remove_watch(watch);
  1109. if (list_empty(&parent->watches)) {
  1110. /* Put parent on the inotify un-registration
  1111. * list. Grab a reference before releasing
  1112. * audit_filter_mutex, to be released in
  1113. * audit_inotify_unregister(). */
  1114. list_add(&parent->ilist, &inotify_list);
  1115. get_inotify_watch(&parent->wdata);
  1116. }
  1117. }
  1118. }
  1119. list_del_rcu(&e->list);
  1120. call_rcu(&e->rcu, audit_free_rule_rcu);
  1121. #ifdef CONFIG_AUDITSYSCALL
  1122. if (!dont_count)
  1123. audit_n_rules--;
  1124. #endif
  1125. mutex_unlock(&audit_filter_mutex);
  1126. if (!list_empty(&inotify_list))
  1127. audit_inotify_unregister(&inotify_list);
  1128. out:
  1129. if (tmp_watch)
  1130. audit_put_watch(tmp_watch); /* match initial get */
  1131. return ret;
  1132. }
  1133. /* List rules using struct audit_rule. Exists for backward
  1134. * compatibility with userspace. */
  1135. static void audit_list(int pid, int seq, struct sk_buff_head *q)
  1136. {
  1137. struct sk_buff *skb;
  1138. struct audit_entry *entry;
  1139. int i;
  1140. /* This is a blocking read, so use audit_filter_mutex instead of rcu
  1141. * iterator to sync with list writers. */
  1142. for (i=0; i<AUDIT_NR_FILTERS; i++) {
  1143. list_for_each_entry(entry, &audit_filter_list[i], list) {
  1144. struct audit_rule *rule;
  1145. rule = audit_krule_to_rule(&entry->rule);
  1146. if (unlikely(!rule))
  1147. break;
  1148. skb = audit_make_reply(pid, seq, AUDIT_LIST, 0, 1,
  1149. rule, sizeof(*rule));
  1150. if (skb)
  1151. skb_queue_tail(q, skb);
  1152. kfree(rule);
  1153. }
  1154. }
  1155. for (i = 0; i < AUDIT_INODE_BUCKETS; i++) {
  1156. list_for_each_entry(entry, &audit_inode_hash[i], list) {
  1157. struct audit_rule *rule;
  1158. rule = audit_krule_to_rule(&entry->rule);
  1159. if (unlikely(!rule))
  1160. break;
  1161. skb = audit_make_reply(pid, seq, AUDIT_LIST, 0, 1,
  1162. rule, sizeof(*rule));
  1163. if (skb)
  1164. skb_queue_tail(q, skb);
  1165. kfree(rule);
  1166. }
  1167. }
  1168. skb = audit_make_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0);
  1169. if (skb)
  1170. skb_queue_tail(q, skb);
  1171. }
  1172. /* List rules using struct audit_rule_data. */
  1173. static void audit_list_rules(int pid, int seq, struct sk_buff_head *q)
  1174. {
  1175. struct sk_buff *skb;
  1176. struct audit_entry *e;
  1177. int i;
  1178. /* This is a blocking read, so use audit_filter_mutex instead of rcu
  1179. * iterator to sync with list writers. */
  1180. for (i=0; i<AUDIT_NR_FILTERS; i++) {
  1181. list_for_each_entry(e, &audit_filter_list[i], list) {
  1182. struct audit_rule_data *data;
  1183. data = audit_krule_to_data(&e->rule);
  1184. if (unlikely(!data))
  1185. break;
  1186. skb = audit_make_reply(pid, seq, AUDIT_LIST_RULES, 0, 1,
  1187. data, sizeof(*data) + data->buflen);
  1188. if (skb)
  1189. skb_queue_tail(q, skb);
  1190. kfree(data);
  1191. }
  1192. }
  1193. for (i=0; i< AUDIT_INODE_BUCKETS; i++) {
  1194. list_for_each_entry(e, &audit_inode_hash[i], list) {
  1195. struct audit_rule_data *data;
  1196. data = audit_krule_to_data(&e->rule);
  1197. if (unlikely(!data))
  1198. break;
  1199. skb = audit_make_reply(pid, seq, AUDIT_LIST_RULES, 0, 1,
  1200. data, sizeof(*data) + data->buflen);
  1201. if (skb)
  1202. skb_queue_tail(q, skb);
  1203. kfree(data);
  1204. }
  1205. }
  1206. skb = audit_make_reply(pid, seq, AUDIT_LIST_RULES, 1, 1, NULL, 0);
  1207. if (skb)
  1208. skb_queue_tail(q, skb);
  1209. }
  1210. /* Log rule additions and removals */
  1211. static void audit_log_rule_change(uid_t loginuid, u32 sid, char *action,
  1212. struct audit_krule *rule, int res)
  1213. {
  1214. struct audit_buffer *ab;
  1215. ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
  1216. if (!ab)
  1217. return;
  1218. audit_log_format(ab, "auid=%u", loginuid);
  1219. if (sid) {
  1220. char *ctx = NULL;
  1221. u32 len;
  1222. if (selinux_sid_to_string(sid, &ctx, &len))
  1223. audit_log_format(ab, " ssid=%u", sid);
  1224. else
  1225. audit_log_format(ab, " subj=%s", ctx);
  1226. kfree(ctx);
  1227. }
  1228. audit_log_format(ab, " op=%s rule key=", action);
  1229. if (rule->filterkey)
  1230. audit_log_untrustedstring(ab, rule->filterkey);
  1231. else
  1232. audit_log_format(ab, "(null)");
  1233. audit_log_format(ab, " list=%d res=%d", rule->listnr, res);
  1234. audit_log_end(ab);
  1235. }
  1236. /**
  1237. * audit_receive_filter - apply all rules to the specified message type
  1238. * @type: audit message type
  1239. * @pid: target pid for netlink audit messages
  1240. * @uid: target uid for netlink audit messages
  1241. * @seq: netlink audit message sequence (serial) number
  1242. * @data: payload data
  1243. * @datasz: size of payload data
  1244. * @loginuid: loginuid of sender
  1245. * @sid: SE Linux Security ID of sender
  1246. */
  1247. int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
  1248. size_t datasz, uid_t loginuid, u32 sid)
  1249. {
  1250. struct task_struct *tsk;
  1251. struct audit_netlink_list *dest;
  1252. int err = 0;
  1253. struct audit_entry *entry;
  1254. switch (type) {
  1255. case AUDIT_LIST:
  1256. case AUDIT_LIST_RULES:
  1257. /* We can't just spew out the rules here because we might fill
  1258. * the available socket buffer space and deadlock waiting for
  1259. * auditctl to read from it... which isn't ever going to
  1260. * happen if we're actually running in the context of auditctl
  1261. * trying to _send_ the stuff */
  1262. dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL);
  1263. if (!dest)
  1264. return -ENOMEM;
  1265. dest->pid = pid;
  1266. skb_queue_head_init(&dest->q);
  1267. mutex_lock(&audit_filter_mutex);
  1268. if (type == AUDIT_LIST)
  1269. audit_list(pid, seq, &dest->q);
  1270. else
  1271. audit_list_rules(pid, seq, &dest->q);
  1272. mutex_unlock(&audit_filter_mutex);
  1273. tsk = kthread_run(audit_send_list, dest, "audit_send_list");
  1274. if (IS_ERR(tsk)) {
  1275. skb_queue_purge(&dest->q);
  1276. kfree(dest);
  1277. err = PTR_ERR(tsk);
  1278. }
  1279. break;
  1280. case AUDIT_ADD:
  1281. case AUDIT_ADD_RULE:
  1282. if (type == AUDIT_ADD)
  1283. entry = audit_rule_to_entry(data);
  1284. else
  1285. entry = audit_data_to_entry(data, datasz);
  1286. if (IS_ERR(entry))
  1287. return PTR_ERR(entry);
  1288. err = audit_add_rule(entry,
  1289. &audit_filter_list[entry->rule.listnr]);
  1290. audit_log_rule_change(loginuid, sid, "add", &entry->rule, !err);
  1291. if (err)
  1292. audit_free_rule(entry);
  1293. break;
  1294. case AUDIT_DEL:
  1295. case AUDIT_DEL_RULE:
  1296. if (type == AUDIT_DEL)
  1297. entry = audit_rule_to_entry(data);
  1298. else
  1299. entry = audit_data_to_entry(data, datasz);
  1300. if (IS_ERR(entry))
  1301. return PTR_ERR(entry);
  1302. err = audit_del_rule(entry,
  1303. &audit_filter_list[entry->rule.listnr]);
  1304. audit_log_rule_change(loginuid, sid, "remove", &entry->rule,
  1305. !err);
  1306. audit_free_rule(entry);
  1307. break;
  1308. default:
  1309. return -EINVAL;
  1310. }
  1311. return err;
  1312. }
  1313. int audit_comparator(const u32 left, const u32 op, const u32 right)
  1314. {
  1315. switch (op) {
  1316. case AUDIT_EQUAL:
  1317. return (left == right);
  1318. case AUDIT_NOT_EQUAL:
  1319. return (left != right);
  1320. case AUDIT_LESS_THAN:
  1321. return (left < right);
  1322. case AUDIT_LESS_THAN_OR_EQUAL:
  1323. return (left <= right);
  1324. case AUDIT_GREATER_THAN:
  1325. return (left > right);
  1326. case AUDIT_GREATER_THAN_OR_EQUAL:
  1327. return (left >= right);
  1328. }
  1329. BUG();
  1330. return 0;
  1331. }
  1332. /* Compare given dentry name with last component in given path,
  1333. * return of 0 indicates a match. */
  1334. int audit_compare_dname_path(const char *dname, const char *path,
  1335. int *dirlen)
  1336. {
  1337. int dlen, plen;
  1338. const char *p;
  1339. if (!dname || !path)
  1340. return 1;
  1341. dlen = strlen(dname);
  1342. plen = strlen(path);
  1343. if (plen < dlen)
  1344. return 1;
  1345. /* disregard trailing slashes */
  1346. p = path + plen - 1;
  1347. while ((*p == '/') && (p > path))
  1348. p--;
  1349. /* find last path component */
  1350. p = p - dlen + 1;
  1351. if (p < path)
  1352. return 1;
  1353. else if (p > path) {
  1354. if (*--p != '/')
  1355. return 1;
  1356. else
  1357. p++;
  1358. }
  1359. /* return length of path's directory component */
  1360. if (dirlen)
  1361. *dirlen = p - path;
  1362. return strncmp(p, dname, dlen);
  1363. }
  1364. static int audit_filter_user_rules(struct netlink_skb_parms *cb,
  1365. struct audit_krule *rule,
  1366. enum audit_state *state)
  1367. {
  1368. int i;
  1369. for (i = 0; i < rule->field_count; i++) {
  1370. struct audit_field *f = &rule->fields[i];
  1371. int result = 0;
  1372. switch (f->type) {
  1373. case AUDIT_PID:
  1374. result = audit_comparator(cb->creds.pid, f->op, f->val);
  1375. break;
  1376. case AUDIT_UID:
  1377. result = audit_comparator(cb->creds.uid, f->op, f->val);
  1378. break;
  1379. case AUDIT_GID:
  1380. result = audit_comparator(cb->creds.gid, f->op, f->val);
  1381. break;
  1382. case AUDIT_LOGINUID:
  1383. result = audit_comparator(cb->loginuid, f->op, f->val);
  1384. break;
  1385. }
  1386. if (!result)
  1387. return 0;
  1388. }
  1389. switch (rule->action) {
  1390. case AUDIT_NEVER: *state = AUDIT_DISABLED; break;
  1391. case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break;
  1392. }
  1393. return 1;
  1394. }
  1395. int audit_filter_user(struct netlink_skb_parms *cb, int type)
  1396. {
  1397. enum audit_state state = AUDIT_DISABLED;
  1398. struct audit_entry *e;
  1399. int ret = 1;
  1400. rcu_read_lock();
  1401. list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_USER], list) {
  1402. if (audit_filter_user_rules(cb, &e->rule, &state)) {
  1403. if (state == AUDIT_DISABLED)
  1404. ret = 0;
  1405. break;
  1406. }
  1407. }
  1408. rcu_read_unlock();
  1409. return ret; /* Audit by default */
  1410. }
  1411. int audit_filter_type(int type)
  1412. {
  1413. struct audit_entry *e;
  1414. int result = 0;
  1415. rcu_read_lock();
  1416. if (list_empty(&audit_filter_list[AUDIT_FILTER_TYPE]))
  1417. goto unlock_and_return;
  1418. list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE],
  1419. list) {
  1420. int i;
  1421. for (i = 0; i < e->rule.field_count; i++) {
  1422. struct audit_field *f = &e->rule.fields[i];
  1423. if (f->type == AUDIT_MSGTYPE) {
  1424. result = audit_comparator(type, f->op, f->val);
  1425. if (!result)
  1426. break;
  1427. }
  1428. }
  1429. if (result)
  1430. goto unlock_and_return;
  1431. }
  1432. unlock_and_return:
  1433. rcu_read_unlock();
  1434. return result;
  1435. }
  1436. /* Check to see if the rule contains any selinux fields. Returns 1 if there
  1437. are selinux fields specified in the rule, 0 otherwise. */
  1438. static inline int audit_rule_has_selinux(struct audit_krule *rule)
  1439. {
  1440. int i;
  1441. for (i = 0; i < rule->field_count; i++) {
  1442. struct audit_field *f = &rule->fields[i];
  1443. switch (f->type) {
  1444. case AUDIT_SUBJ_USER:
  1445. case AUDIT_SUBJ_ROLE:
  1446. case AUDIT_SUBJ_TYPE:
  1447. case AUDIT_SUBJ_SEN:
  1448. case AUDIT_SUBJ_CLR:
  1449. case AUDIT_OBJ_USER:
  1450. case AUDIT_OBJ_ROLE:
  1451. case AUDIT_OBJ_TYPE:
  1452. case AUDIT_OBJ_LEV_LOW:
  1453. case AUDIT_OBJ_LEV_HIGH:
  1454. return 1;
  1455. }
  1456. }
  1457. return 0;
  1458. }
  1459. /* This function will re-initialize the se_rule field of all applicable rules.
  1460. * It will traverse the filter lists serarching for rules that contain selinux
  1461. * specific filter fields. When such a rule is found, it is copied, the
  1462. * selinux field is re-initialized, and the old rule is replaced with the
  1463. * updated rule. */
  1464. int selinux_audit_rule_update(void)
  1465. {
  1466. struct audit_entry *entry, *n, *nentry;
  1467. struct audit_watch *watch;
  1468. int i, err = 0;
  1469. /* audit_filter_mutex synchronizes the writers */
  1470. mutex_lock(&audit_filter_mutex);
  1471. for (i = 0; i < AUDIT_NR_FILTERS; i++) {
  1472. list_for_each_entry_safe(entry, n, &audit_filter_list[i], list) {
  1473. if (!audit_rule_has_selinux(&entry->rule))
  1474. continue;
  1475. watch = entry->rule.watch;
  1476. nentry = audit_dupe_rule(&entry->rule, watch);
  1477. if (unlikely(IS_ERR(nentry))) {
  1478. /* save the first error encountered for the
  1479. * return value */
  1480. if (!err)
  1481. err = PTR_ERR(nentry);
  1482. audit_panic("error updating selinux filters");
  1483. if (watch)
  1484. list_del(&entry->rule.rlist);
  1485. list_del_rcu(&entry->list);
  1486. } else {
  1487. if (watch) {
  1488. list_add(&nentry->rule.rlist,
  1489. &watch->rules);
  1490. list_del(&entry->rule.rlist);
  1491. }
  1492. list_replace_rcu(&entry->list, &nentry->list);
  1493. }
  1494. call_rcu(&entry->rcu, audit_free_rule_rcu);
  1495. }
  1496. }
  1497. mutex_unlock(&audit_filter_mutex);
  1498. return err;
  1499. }
  1500. /* Update watch data in audit rules based on inotify events. */
  1501. void audit_handle_ievent(struct inotify_watch *i_watch, u32 wd, u32 mask,
  1502. u32 cookie, const char *dname, struct inode *inode)
  1503. {
  1504. struct audit_parent *parent;
  1505. parent = container_of(i_watch, struct audit_parent, wdata);
  1506. if (mask & (IN_CREATE|IN_MOVED_TO) && inode)
  1507. audit_update_watch(parent, dname, inode->i_sb->s_dev,
  1508. inode->i_ino, 0);
  1509. else if (mask & (IN_DELETE|IN_MOVED_FROM))
  1510. audit_update_watch(parent, dname, (dev_t)-1, (unsigned long)-1, 1);
  1511. /* inotify automatically removes the watch and sends IN_IGNORED */
  1512. else if (mask & (IN_DELETE_SELF|IN_UNMOUNT))
  1513. audit_remove_parent_watches(parent);
  1514. /* inotify does not remove the watch, so remove it manually */
  1515. else if(mask & IN_MOVE_SELF) {
  1516. audit_remove_parent_watches(parent);
  1517. inotify_remove_watch_locked(audit_ih, i_watch);
  1518. } else if (mask & IN_IGNORED)
  1519. put_inotify_watch(i_watch);
  1520. }