audit_watch.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* audit_watch.c -- watching inodes
  3. *
  4. * Copyright 2003-2009 Red Hat, Inc.
  5. * Copyright 2005 Hewlett-Packard Development Company, L.P.
  6. * Copyright 2005 IBM Corporation
  7. */
  8. #include <linux/file.h>
  9. #include <linux/kernel.h>
  10. #include <linux/audit.h>
  11. #include <linux/kthread.h>
  12. #include <linux/mutex.h>
  13. #include <linux/fs.h>
  14. #include <linux/fsnotify_backend.h>
  15. #include <linux/namei.h>
  16. #include <linux/netlink.h>
  17. #include <linux/refcount.h>
  18. #include <linux/sched.h>
  19. #include <linux/slab.h>
  20. #include <linux/security.h>
  21. #include "audit.h"
  22. /*
  23. * Reference counting:
  24. *
  25. * audit_parent: lifetime is from audit_init_parent() to receipt of an FS_IGNORED
  26. * event. Each audit_watch holds a reference to its associated parent.
  27. *
  28. * audit_watch: if added to lists, lifetime is from audit_init_watch() to
  29. * audit_remove_watch(). Additionally, an audit_watch may exist
  30. * temporarily to assist in searching existing filter data. Each
  31. * audit_krule holds a reference to its associated watch.
  32. */
  33. struct audit_watch {
  34. refcount_t count; /* reference count */
  35. dev_t dev; /* associated superblock device */
  36. char *path; /* insertion path */
  37. unsigned long ino; /* associated inode number */
  38. struct audit_parent *parent; /* associated parent */
  39. struct list_head wlist; /* entry in parent->watches list */
  40. struct list_head rules; /* anchor for krule->rlist */
  41. };
  42. struct audit_parent {
  43. struct list_head watches; /* anchor for audit_watch->wlist */
  44. struct fsnotify_mark mark; /* fsnotify mark on the inode */
  45. };
  46. /* fsnotify handle. */
  47. static struct fsnotify_group *audit_watch_group;
  48. /* fsnotify events we care about. */
  49. #define AUDIT_FS_WATCH (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
  50. FS_MOVE_SELF | FS_UNMOUNT)
  51. static void audit_free_parent(struct audit_parent *parent)
  52. {
  53. WARN_ON(!list_empty(&parent->watches));
  54. kfree(parent);
  55. }
  56. static void audit_watch_free_mark(struct fsnotify_mark *entry)
  57. {
  58. struct audit_parent *parent;
  59. parent = container_of(entry, struct audit_parent, mark);
  60. audit_free_parent(parent);
  61. }
  62. static void audit_get_parent(struct audit_parent *parent)
  63. {
  64. if (likely(parent))
  65. fsnotify_get_mark(&parent->mark);
  66. }
  67. static void audit_put_parent(struct audit_parent *parent)
  68. {
  69. if (likely(parent))
  70. fsnotify_put_mark(&parent->mark);
  71. }
  72. /*
  73. * Find and return the audit_parent on the given inode. If found a reference
  74. * is taken on this parent.
  75. */
  76. static inline struct audit_parent *audit_find_parent(struct inode *inode)
  77. {
  78. struct audit_parent *parent = NULL;
  79. struct fsnotify_mark *entry;
  80. entry = fsnotify_find_mark(&inode->i_fsnotify_marks, audit_watch_group);
  81. if (entry)
  82. parent = container_of(entry, struct audit_parent, mark);
  83. return parent;
  84. }
  85. void audit_get_watch(struct audit_watch *watch)
  86. {
  87. refcount_inc(&watch->count);
  88. }
  89. void audit_put_watch(struct audit_watch *watch)
  90. {
  91. if (refcount_dec_and_test(&watch->count)) {
  92. WARN_ON(watch->parent);
  93. WARN_ON(!list_empty(&watch->rules));
  94. kfree(watch->path);
  95. kfree(watch);
  96. }
  97. }
  98. static void audit_remove_watch(struct audit_watch *watch)
  99. {
  100. list_del(&watch->wlist);
  101. audit_put_parent(watch->parent);
  102. watch->parent = NULL;
  103. audit_put_watch(watch); /* match initial get */
  104. }
  105. char *audit_watch_path(struct audit_watch *watch)
  106. {
  107. return watch->path;
  108. }
  109. int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
  110. {
  111. return (watch->ino != AUDIT_INO_UNSET) &&
  112. (watch->ino == ino) &&
  113. (watch->dev == dev);
  114. }
  115. /* Initialize a parent watch entry. */
  116. static struct audit_parent *audit_init_parent(struct path *path)
  117. {
  118. struct inode *inode = d_backing_inode(path->dentry);
  119. struct audit_parent *parent;
  120. int ret;
  121. parent = kzalloc(sizeof(*parent), GFP_KERNEL);
  122. if (unlikely(!parent))
  123. return ERR_PTR(-ENOMEM);
  124. INIT_LIST_HEAD(&parent->watches);
  125. fsnotify_init_mark(&parent->mark, audit_watch_group);
  126. parent->mark.mask = AUDIT_FS_WATCH;
  127. ret = fsnotify_add_inode_mark(&parent->mark, inode, 0);
  128. if (ret < 0) {
  129. audit_free_parent(parent);
  130. return ERR_PTR(ret);
  131. }
  132. return parent;
  133. }
  134. /* Initialize a watch entry. */
  135. static struct audit_watch *audit_init_watch(char *path)
  136. {
  137. struct audit_watch *watch;
  138. watch = kzalloc(sizeof(*watch), GFP_KERNEL);
  139. if (unlikely(!watch))
  140. return ERR_PTR(-ENOMEM);
  141. INIT_LIST_HEAD(&watch->rules);
  142. refcount_set(&watch->count, 1);
  143. watch->path = path;
  144. watch->dev = AUDIT_DEV_UNSET;
  145. watch->ino = AUDIT_INO_UNSET;
  146. return watch;
  147. }
  148. /* Translate a watch string to kernel representation. */
  149. int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op)
  150. {
  151. struct audit_watch *watch;
  152. if (!audit_watch_group)
  153. return -EOPNOTSUPP;
  154. if (path[0] != '/' || path[len-1] == '/' ||
  155. krule->listnr != AUDIT_FILTER_EXIT ||
  156. op != Audit_equal ||
  157. krule->inode_f || krule->watch || krule->tree)
  158. return -EINVAL;
  159. watch = audit_init_watch(path);
  160. if (IS_ERR(watch))
  161. return PTR_ERR(watch);
  162. krule->watch = watch;
  163. return 0;
  164. }
  165. /* Duplicate the given audit watch. The new watch's rules list is initialized
  166. * to an empty list and wlist is undefined. */
  167. static struct audit_watch *audit_dupe_watch(struct audit_watch *old)
  168. {
  169. char *path;
  170. struct audit_watch *new;
  171. path = kstrdup(old->path, GFP_KERNEL);
  172. if (unlikely(!path))
  173. return ERR_PTR(-ENOMEM);
  174. new = audit_init_watch(path);
  175. if (IS_ERR(new)) {
  176. kfree(path);
  177. goto out;
  178. }
  179. new->dev = old->dev;
  180. new->ino = old->ino;
  181. audit_get_parent(old->parent);
  182. new->parent = old->parent;
  183. out:
  184. return new;
  185. }
  186. static void audit_watch_log_rule_change(struct audit_krule *r, struct audit_watch *w, char *op)
  187. {
  188. struct audit_buffer *ab;
  189. if (!audit_enabled)
  190. return;
  191. ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE);
  192. if (!ab)
  193. return;
  194. audit_log_session_info(ab);
  195. audit_log_format(ab, "op=%s path=", op);
  196. audit_log_untrustedstring(ab, w->path);
  197. audit_log_key(ab, r->filterkey);
  198. audit_log_format(ab, " list=%d res=1", r->listnr);
  199. audit_log_end(ab);
  200. }
  201. /* Update inode info in audit rules based on filesystem event. */
  202. static void audit_update_watch(struct audit_parent *parent,
  203. const struct qstr *dname, dev_t dev,
  204. unsigned long ino, unsigned invalidating)
  205. {
  206. struct audit_watch *owatch, *nwatch, *nextw;
  207. struct audit_krule *r, *nextr;
  208. struct audit_entry *oentry, *nentry;
  209. mutex_lock(&audit_filter_mutex);
  210. /* Run all of the watches on this parent looking for the one that
  211. * matches the given dname */
  212. list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
  213. if (audit_compare_dname_path(dname, owatch->path,
  214. AUDIT_NAME_FULL))
  215. continue;
  216. /* If the update involves invalidating rules, do the inode-based
  217. * filtering now, so we don't omit records. */
  218. if (invalidating && !audit_dummy_context())
  219. audit_filter_inodes(current, audit_context());
  220. /* updating ino will likely change which audit_hash_list we
  221. * are on so we need a new watch for the new list */
  222. nwatch = audit_dupe_watch(owatch);
  223. if (IS_ERR(nwatch)) {
  224. mutex_unlock(&audit_filter_mutex);
  225. audit_panic("error updating watch, skipping");
  226. return;
  227. }
  228. nwatch->dev = dev;
  229. nwatch->ino = ino;
  230. list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) {
  231. oentry = container_of(r, struct audit_entry, rule);
  232. list_del(&oentry->rule.rlist);
  233. list_del_rcu(&oentry->list);
  234. nentry = audit_dupe_rule(&oentry->rule);
  235. if (IS_ERR(nentry)) {
  236. list_del(&oentry->rule.list);
  237. audit_panic("error updating watch, removing");
  238. } else {
  239. int h = audit_hash_ino((u32)ino);
  240. /*
  241. * nentry->rule.watch == oentry->rule.watch so
  242. * we must drop that reference and set it to our
  243. * new watch.
  244. */
  245. audit_put_watch(nentry->rule.watch);
  246. audit_get_watch(nwatch);
  247. nentry->rule.watch = nwatch;
  248. list_add(&nentry->rule.rlist, &nwatch->rules);
  249. list_add_rcu(&nentry->list, &audit_inode_hash[h]);
  250. list_replace(&oentry->rule.list,
  251. &nentry->rule.list);
  252. }
  253. if (oentry->rule.exe)
  254. audit_remove_mark(oentry->rule.exe);
  255. call_rcu(&oentry->rcu, audit_free_rule_rcu);
  256. }
  257. audit_remove_watch(owatch);
  258. goto add_watch_to_parent; /* event applies to a single watch */
  259. }
  260. mutex_unlock(&audit_filter_mutex);
  261. return;
  262. add_watch_to_parent:
  263. list_add(&nwatch->wlist, &parent->watches);
  264. mutex_unlock(&audit_filter_mutex);
  265. return;
  266. }
  267. /* Remove all watches & rules associated with a parent that is going away. */
  268. static void audit_remove_parent_watches(struct audit_parent *parent)
  269. {
  270. struct audit_watch *w, *nextw;
  271. struct audit_krule *r, *nextr;
  272. struct audit_entry *e;
  273. mutex_lock(&audit_filter_mutex);
  274. list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
  275. list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
  276. e = container_of(r, struct audit_entry, rule);
  277. audit_watch_log_rule_change(r, w, "remove_rule");
  278. if (e->rule.exe)
  279. audit_remove_mark(e->rule.exe);
  280. list_del(&r->rlist);
  281. list_del(&r->list);
  282. list_del_rcu(&e->list);
  283. call_rcu(&e->rcu, audit_free_rule_rcu);
  284. }
  285. audit_remove_watch(w);
  286. }
  287. mutex_unlock(&audit_filter_mutex);
  288. fsnotify_destroy_mark(&parent->mark, audit_watch_group);
  289. }
  290. /* Get path information necessary for adding watches. */
  291. static int audit_get_nd(struct audit_watch *watch, struct path *parent)
  292. {
  293. struct dentry *d = kern_path_locked(watch->path, parent);
  294. if (IS_ERR(d))
  295. return PTR_ERR(d);
  296. if (d_is_positive(d)) {
  297. /* update watch filter fields */
  298. watch->dev = d->d_sb->s_dev;
  299. watch->ino = d_backing_inode(d)->i_ino;
  300. }
  301. inode_unlock(d_backing_inode(parent->dentry));
  302. dput(d);
  303. return 0;
  304. }
  305. /* Associate the given rule with an existing parent.
  306. * Caller must hold audit_filter_mutex. */
  307. static void audit_add_to_parent(struct audit_krule *krule,
  308. struct audit_parent *parent)
  309. {
  310. struct audit_watch *w, *watch = krule->watch;
  311. int watch_found = 0;
  312. BUG_ON(!mutex_is_locked(&audit_filter_mutex));
  313. list_for_each_entry(w, &parent->watches, wlist) {
  314. if (strcmp(watch->path, w->path))
  315. continue;
  316. watch_found = 1;
  317. /* put krule's ref to temporary watch */
  318. audit_put_watch(watch);
  319. audit_get_watch(w);
  320. krule->watch = watch = w;
  321. audit_put_parent(parent);
  322. break;
  323. }
  324. if (!watch_found) {
  325. watch->parent = parent;
  326. audit_get_watch(watch);
  327. list_add(&watch->wlist, &parent->watches);
  328. }
  329. list_add(&krule->rlist, &watch->rules);
  330. }
  331. /* Find a matching watch entry, or add this one.
  332. * Caller must hold audit_filter_mutex. */
  333. int audit_add_watch(struct audit_krule *krule, struct list_head **list)
  334. {
  335. struct audit_watch *watch = krule->watch;
  336. struct audit_parent *parent;
  337. struct path parent_path;
  338. int h, ret = 0;
  339. /*
  340. * When we will be calling audit_add_to_parent, krule->watch might have
  341. * been updated and watch might have been freed.
  342. * So we need to keep a reference of watch.
  343. */
  344. audit_get_watch(watch);
  345. mutex_unlock(&audit_filter_mutex);
  346. /* Avoid calling path_lookup under audit_filter_mutex. */
  347. ret = audit_get_nd(watch, &parent_path);
  348. /* caller expects mutex locked */
  349. mutex_lock(&audit_filter_mutex);
  350. if (ret) {
  351. audit_put_watch(watch);
  352. return ret;
  353. }
  354. /* either find an old parent or attach a new one */
  355. parent = audit_find_parent(d_backing_inode(parent_path.dentry));
  356. if (!parent) {
  357. parent = audit_init_parent(&parent_path);
  358. if (IS_ERR(parent)) {
  359. ret = PTR_ERR(parent);
  360. goto error;
  361. }
  362. }
  363. audit_add_to_parent(krule, parent);
  364. h = audit_hash_ino((u32)watch->ino);
  365. *list = &audit_inode_hash[h];
  366. error:
  367. path_put(&parent_path);
  368. audit_put_watch(watch);
  369. return ret;
  370. }
  371. void audit_remove_watch_rule(struct audit_krule *krule)
  372. {
  373. struct audit_watch *watch = krule->watch;
  374. struct audit_parent *parent = watch->parent;
  375. list_del(&krule->rlist);
  376. if (list_empty(&watch->rules)) {
  377. /*
  378. * audit_remove_watch() drops our reference to 'parent' which
  379. * can get freed. Grab our own reference to be safe.
  380. */
  381. audit_get_parent(parent);
  382. audit_remove_watch(watch);
  383. if (list_empty(&parent->watches))
  384. fsnotify_destroy_mark(&parent->mark, audit_watch_group);
  385. audit_put_parent(parent);
  386. }
  387. }
  388. /* Update watch data in audit rules based on fsnotify events. */
  389. static int audit_watch_handle_event(struct fsnotify_mark *inode_mark, u32 mask,
  390. struct inode *inode, struct inode *dir,
  391. const struct qstr *dname, u32 cookie)
  392. {
  393. struct audit_parent *parent;
  394. parent = container_of(inode_mark, struct audit_parent, mark);
  395. if (WARN_ON_ONCE(inode_mark->group != audit_watch_group) ||
  396. WARN_ON_ONCE(!inode))
  397. return 0;
  398. if (mask & (FS_CREATE|FS_MOVED_TO) && inode)
  399. audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
  400. else if (mask & (FS_DELETE|FS_MOVED_FROM))
  401. audit_update_watch(parent, dname, AUDIT_DEV_UNSET, AUDIT_INO_UNSET, 1);
  402. else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF))
  403. audit_remove_parent_watches(parent);
  404. return 0;
  405. }
  406. static const struct fsnotify_ops audit_watch_fsnotify_ops = {
  407. .handle_inode_event = audit_watch_handle_event,
  408. .free_mark = audit_watch_free_mark,
  409. };
  410. static int __init audit_watch_init(void)
  411. {
  412. audit_watch_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops);
  413. if (IS_ERR(audit_watch_group)) {
  414. audit_watch_group = NULL;
  415. audit_panic("cannot create audit fsnotify group");
  416. }
  417. return 0;
  418. }
  419. device_initcall(audit_watch_init);
  420. int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old)
  421. {
  422. struct audit_fsnotify_mark *audit_mark;
  423. char *pathname;
  424. pathname = kstrdup(audit_mark_path(old->exe), GFP_KERNEL);
  425. if (!pathname)
  426. return -ENOMEM;
  427. audit_mark = audit_alloc_mark(new, pathname, strlen(pathname));
  428. if (IS_ERR(audit_mark)) {
  429. kfree(pathname);
  430. return PTR_ERR(audit_mark);
  431. }
  432. new->exe = audit_mark;
  433. return 0;
  434. }
  435. int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
  436. {
  437. struct file *exe_file;
  438. unsigned long ino;
  439. dev_t dev;
  440. exe_file = get_task_exe_file(tsk);
  441. if (!exe_file)
  442. return 0;
  443. ino = file_inode(exe_file)->i_ino;
  444. dev = file_inode(exe_file)->i_sb->s_dev;
  445. fput(exe_file);
  446. return audit_mark_compare(mark, ino, dev);
  447. }