auditfilter.c 34 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* auditfilter.c -- filtering of audit events
  3. *
  4. * Copyright 2003-2004 Red Hat, Inc.
  5. * Copyright 2005 Hewlett-Packard Development Company, L.P.
  6. * Copyright 2005 IBM Corporation
  7. */
  8. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  9. #include <linux/kernel.h>
  10. #include <linux/audit.h>
  11. #include <linux/kthread.h>
  12. #include <linux/mutex.h>
  13. #include <linux/fs.h>
  14. #include <linux/namei.h>
  15. #include <linux/netlink.h>
  16. #include <linux/sched.h>
  17. #include <linux/slab.h>
  18. #include <linux/security.h>
  19. #include <net/net_namespace.h>
  20. #include <net/sock.h>
  21. #include "audit.h"
  22. /*
  23. * Locking model:
  24. *
  25. * audit_filter_mutex:
  26. * Synchronizes writes and blocking reads of audit's filterlist
  27. * data. Rcu is used to traverse the filterlist and access
  28. * contents of structs audit_entry, audit_watch and opaque
  29. * LSM rules during filtering. If modified, these structures
  30. * must be copied and replace their counterparts in the filterlist.
  31. * An audit_parent struct is not accessed during filtering, so may
  32. * be written directly provided audit_filter_mutex is held.
  33. */
  34. /* Audit filter lists, defined in <linux/audit.h> */
  35. struct list_head audit_filter_list[AUDIT_NR_FILTERS] = {
  36. LIST_HEAD_INIT(audit_filter_list[0]),
  37. LIST_HEAD_INIT(audit_filter_list[1]),
  38. LIST_HEAD_INIT(audit_filter_list[2]),
  39. LIST_HEAD_INIT(audit_filter_list[3]),
  40. LIST_HEAD_INIT(audit_filter_list[4]),
  41. LIST_HEAD_INIT(audit_filter_list[5]),
  42. LIST_HEAD_INIT(audit_filter_list[6]),
  43. #if AUDIT_NR_FILTERS != 7
  44. #error Fix audit_filter_list initialiser
  45. #endif
  46. };
  47. static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = {
  48. LIST_HEAD_INIT(audit_rules_list[0]),
  49. LIST_HEAD_INIT(audit_rules_list[1]),
  50. LIST_HEAD_INIT(audit_rules_list[2]),
  51. LIST_HEAD_INIT(audit_rules_list[3]),
  52. LIST_HEAD_INIT(audit_rules_list[4]),
  53. LIST_HEAD_INIT(audit_rules_list[5]),
  54. LIST_HEAD_INIT(audit_rules_list[6]),
  55. };
  56. DEFINE_MUTEX(audit_filter_mutex);
  57. static void audit_free_lsm_field(struct audit_field *f)
  58. {
  59. switch (f->type) {
  60. case AUDIT_SUBJ_USER:
  61. case AUDIT_SUBJ_ROLE:
  62. case AUDIT_SUBJ_TYPE:
  63. case AUDIT_SUBJ_SEN:
  64. case AUDIT_SUBJ_CLR:
  65. case AUDIT_OBJ_USER:
  66. case AUDIT_OBJ_ROLE:
  67. case AUDIT_OBJ_TYPE:
  68. case AUDIT_OBJ_LEV_LOW:
  69. case AUDIT_OBJ_LEV_HIGH:
  70. kfree(f->lsm_str);
  71. security_audit_rule_free(f->lsm_rule);
  72. }
  73. }
  74. static inline void audit_free_rule(struct audit_entry *e)
  75. {
  76. int i;
  77. struct audit_krule *erule = &e->rule;
  78. /* some rules don't have associated watches */
  79. if (erule->watch)
  80. audit_put_watch(erule->watch);
  81. if (erule->fields)
  82. for (i = 0; i < erule->field_count; i++)
  83. audit_free_lsm_field(&erule->fields[i]);
  84. kfree(erule->fields);
  85. kfree(erule->filterkey);
  86. kfree(e);
  87. }
  88. void audit_free_rule_rcu(struct rcu_head *head)
  89. {
  90. struct audit_entry *e = container_of(head, struct audit_entry, rcu);
  91. audit_free_rule(e);
  92. }
  93. /* Initialize an audit filterlist entry. */
  94. static inline struct audit_entry *audit_init_entry(u32 field_count)
  95. {
  96. struct audit_entry *entry;
  97. struct audit_field *fields;
  98. entry = kzalloc(sizeof(*entry), GFP_KERNEL);
  99. if (unlikely(!entry))
  100. return NULL;
  101. fields = kcalloc(field_count, sizeof(*fields), GFP_KERNEL);
  102. if (unlikely(!fields)) {
  103. kfree(entry);
  104. return NULL;
  105. }
  106. entry->rule.fields = fields;
  107. return entry;
  108. }
  109. /* Unpack a filter field's string representation from user-space
  110. * buffer. */
  111. char *audit_unpack_string(void **bufp, size_t *remain, size_t len)
  112. {
  113. char *str;
  114. if (!*bufp || (len == 0) || (len > *remain))
  115. return ERR_PTR(-EINVAL);
  116. /* Of the currently implemented string fields, PATH_MAX
  117. * defines the longest valid length.
  118. */
  119. if (len > PATH_MAX)
  120. return ERR_PTR(-ENAMETOOLONG);
  121. str = kmalloc(len + 1, GFP_KERNEL);
  122. if (unlikely(!str))
  123. return ERR_PTR(-ENOMEM);
  124. memcpy(str, *bufp, len);
  125. str[len] = 0;
  126. *bufp += len;
  127. *remain -= len;
  128. return str;
  129. }
  130. /* Translate an inode field to kernel representation. */
  131. static inline int audit_to_inode(struct audit_krule *krule,
  132. struct audit_field *f)
  133. {
  134. if (krule->listnr != AUDIT_FILTER_EXIT ||
  135. krule->inode_f || krule->watch || krule->tree ||
  136. (f->op != Audit_equal && f->op != Audit_not_equal))
  137. return -EINVAL;
  138. krule->inode_f = f;
  139. return 0;
  140. }
  141. static __u32 *classes[AUDIT_SYSCALL_CLASSES];
  142. int __init audit_register_class(int class, unsigned *list)
  143. {
  144. __u32 *p = kcalloc(AUDIT_BITMASK_SIZE, sizeof(__u32), GFP_KERNEL);
  145. if (!p)
  146. return -ENOMEM;
  147. while (*list != ~0U) {
  148. unsigned n = *list++;
  149. if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) {
  150. kfree(p);
  151. return -EINVAL;
  152. }
  153. p[AUDIT_WORD(n)] |= AUDIT_BIT(n);
  154. }
  155. if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) {
  156. kfree(p);
  157. return -EINVAL;
  158. }
  159. classes[class] = p;
  160. return 0;
  161. }
  162. int audit_match_class(int class, unsigned syscall)
  163. {
  164. if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32))
  165. return 0;
  166. if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class]))
  167. return 0;
  168. return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall);
  169. }
  170. #ifdef CONFIG_AUDITSYSCALL
  171. static inline int audit_match_class_bits(int class, u32 *mask)
  172. {
  173. int i;
  174. if (classes[class]) {
  175. for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
  176. if (mask[i] & classes[class][i])
  177. return 0;
  178. }
  179. return 1;
  180. }
  181. static int audit_match_signal(struct audit_entry *entry)
  182. {
  183. struct audit_field *arch = entry->rule.arch_f;
  184. if (!arch) {
  185. /* When arch is unspecified, we must check both masks on biarch
  186. * as syscall number alone is ambiguous. */
  187. return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
  188. entry->rule.mask) &&
  189. audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
  190. entry->rule.mask));
  191. }
  192. switch(audit_classify_arch(arch->val)) {
  193. case 0: /* native */
  194. return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
  195. entry->rule.mask));
  196. case 1: /* 32bit on biarch */
  197. return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
  198. entry->rule.mask));
  199. default:
  200. return 1;
  201. }
  202. }
  203. #endif
  204. /* Common user-space to kernel rule translation. */
  205. static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule)
  206. {
  207. unsigned listnr;
  208. struct audit_entry *entry;
  209. int i, err;
  210. err = -EINVAL;
  211. listnr = rule->flags & ~AUDIT_FILTER_PREPEND;
  212. switch(listnr) {
  213. default:
  214. goto exit_err;
  215. #ifdef CONFIG_AUDITSYSCALL
  216. case AUDIT_FILTER_ENTRY:
  217. pr_err("AUDIT_FILTER_ENTRY is deprecated\n");
  218. goto exit_err;
  219. case AUDIT_FILTER_EXIT:
  220. case AUDIT_FILTER_TASK:
  221. #endif
  222. case AUDIT_FILTER_USER:
  223. case AUDIT_FILTER_EXCLUDE:
  224. case AUDIT_FILTER_FS:
  225. ;
  226. }
  227. if (unlikely(rule->action == AUDIT_POSSIBLE)) {
  228. pr_err("AUDIT_POSSIBLE is deprecated\n");
  229. goto exit_err;
  230. }
  231. if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS)
  232. goto exit_err;
  233. if (rule->field_count > AUDIT_MAX_FIELDS)
  234. goto exit_err;
  235. err = -ENOMEM;
  236. entry = audit_init_entry(rule->field_count);
  237. if (!entry)
  238. goto exit_err;
  239. entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;
  240. entry->rule.listnr = listnr;
  241. entry->rule.action = rule->action;
  242. entry->rule.field_count = rule->field_count;
  243. for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
  244. entry->rule.mask[i] = rule->mask[i];
  245. for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) {
  246. int bit = AUDIT_BITMASK_SIZE * 32 - i - 1;
  247. __u32 *p = &entry->rule.mask[AUDIT_WORD(bit)];
  248. __u32 *class;
  249. if (!(*p & AUDIT_BIT(bit)))
  250. continue;
  251. *p &= ~AUDIT_BIT(bit);
  252. class = classes[i];
  253. if (class) {
  254. int j;
  255. for (j = 0; j < AUDIT_BITMASK_SIZE; j++)
  256. entry->rule.mask[j] |= class[j];
  257. }
  258. }
  259. return entry;
  260. exit_err:
  261. return ERR_PTR(err);
  262. }
  263. static u32 audit_ops[] =
  264. {
  265. [Audit_equal] = AUDIT_EQUAL,
  266. [Audit_not_equal] = AUDIT_NOT_EQUAL,
  267. [Audit_bitmask] = AUDIT_BIT_MASK,
  268. [Audit_bittest] = AUDIT_BIT_TEST,
  269. [Audit_lt] = AUDIT_LESS_THAN,
  270. [Audit_gt] = AUDIT_GREATER_THAN,
  271. [Audit_le] = AUDIT_LESS_THAN_OR_EQUAL,
  272. [Audit_ge] = AUDIT_GREATER_THAN_OR_EQUAL,
  273. };
  274. static u32 audit_to_op(u32 op)
  275. {
  276. u32 n;
  277. for (n = Audit_equal; n < Audit_bad && audit_ops[n] != op; n++)
  278. ;
  279. return n;
  280. }
  281. /* check if an audit field is valid */
  282. static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
  283. {
  284. switch (f->type) {
  285. case AUDIT_MSGTYPE:
  286. if (entry->rule.listnr != AUDIT_FILTER_EXCLUDE &&
  287. entry->rule.listnr != AUDIT_FILTER_USER)
  288. return -EINVAL;
  289. break;
  290. case AUDIT_FSTYPE:
  291. if (entry->rule.listnr != AUDIT_FILTER_FS)
  292. return -EINVAL;
  293. break;
  294. }
  295. switch (entry->rule.listnr) {
  296. case AUDIT_FILTER_FS:
  297. switch(f->type) {
  298. case AUDIT_FSTYPE:
  299. case AUDIT_FILTERKEY:
  300. break;
  301. default:
  302. return -EINVAL;
  303. }
  304. }
  305. /* Check for valid field type and op */
  306. switch (f->type) {
  307. case AUDIT_ARG0:
  308. case AUDIT_ARG1:
  309. case AUDIT_ARG2:
  310. case AUDIT_ARG3:
  311. case AUDIT_PERS: /* <uapi/linux/personality.h> */
  312. case AUDIT_DEVMINOR:
  313. /* all ops are valid */
  314. break;
  315. case AUDIT_UID:
  316. case AUDIT_EUID:
  317. case AUDIT_SUID:
  318. case AUDIT_FSUID:
  319. case AUDIT_LOGINUID:
  320. case AUDIT_OBJ_UID:
  321. case AUDIT_GID:
  322. case AUDIT_EGID:
  323. case AUDIT_SGID:
  324. case AUDIT_FSGID:
  325. case AUDIT_OBJ_GID:
  326. case AUDIT_PID:
  327. case AUDIT_MSGTYPE:
  328. case AUDIT_PPID:
  329. case AUDIT_DEVMAJOR:
  330. case AUDIT_EXIT:
  331. case AUDIT_SUCCESS:
  332. case AUDIT_INODE:
  333. case AUDIT_SESSIONID:
  334. case AUDIT_SUBJ_SEN:
  335. case AUDIT_SUBJ_CLR:
  336. case AUDIT_OBJ_LEV_LOW:
  337. case AUDIT_OBJ_LEV_HIGH:
  338. case AUDIT_SADDR_FAM:
  339. /* bit ops are only useful on syscall args */
  340. if (f->op == Audit_bitmask || f->op == Audit_bittest)
  341. return -EINVAL;
  342. break;
  343. case AUDIT_SUBJ_USER:
  344. case AUDIT_SUBJ_ROLE:
  345. case AUDIT_SUBJ_TYPE:
  346. case AUDIT_OBJ_USER:
  347. case AUDIT_OBJ_ROLE:
  348. case AUDIT_OBJ_TYPE:
  349. case AUDIT_WATCH:
  350. case AUDIT_DIR:
  351. case AUDIT_FILTERKEY:
  352. case AUDIT_LOGINUID_SET:
  353. case AUDIT_ARCH:
  354. case AUDIT_FSTYPE:
  355. case AUDIT_PERM:
  356. case AUDIT_FILETYPE:
  357. case AUDIT_FIELD_COMPARE:
  358. case AUDIT_EXE:
  359. /* only equal and not equal valid ops */
  360. if (f->op != Audit_not_equal && f->op != Audit_equal)
  361. return -EINVAL;
  362. break;
  363. default:
  364. /* field not recognized */
  365. return -EINVAL;
  366. }
  367. /* Check for select valid field values */
  368. switch (f->type) {
  369. case AUDIT_LOGINUID_SET:
  370. if ((f->val != 0) && (f->val != 1))
  371. return -EINVAL;
  372. break;
  373. case AUDIT_PERM:
  374. if (f->val & ~15)
  375. return -EINVAL;
  376. break;
  377. case AUDIT_FILETYPE:
  378. if (f->val & ~S_IFMT)
  379. return -EINVAL;
  380. break;
  381. case AUDIT_FIELD_COMPARE:
  382. if (f->val > AUDIT_MAX_FIELD_COMPARE)
  383. return -EINVAL;
  384. break;
  385. case AUDIT_SADDR_FAM:
  386. if (f->val >= AF_MAX)
  387. return -EINVAL;
  388. break;
  389. default:
  390. break;
  391. }
  392. return 0;
  393. }
  394. /* Translate struct audit_rule_data to kernel's rule representation. */
  395. static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
  396. size_t datasz)
  397. {
  398. int err = 0;
  399. struct audit_entry *entry;
  400. void *bufp;
  401. size_t remain = datasz - sizeof(struct audit_rule_data);
  402. int i;
  403. char *str;
  404. struct audit_fsnotify_mark *audit_mark;
  405. entry = audit_to_entry_common(data);
  406. if (IS_ERR(entry))
  407. goto exit_nofree;
  408. bufp = data->buf;
  409. for (i = 0; i < data->field_count; i++) {
  410. struct audit_field *f = &entry->rule.fields[i];
  411. u32 f_val;
  412. err = -EINVAL;
  413. f->op = audit_to_op(data->fieldflags[i]);
  414. if (f->op == Audit_bad)
  415. goto exit_free;
  416. f->type = data->fields[i];
  417. f_val = data->values[i];
  418. /* Support legacy tests for a valid loginuid */
  419. if ((f->type == AUDIT_LOGINUID) && (f_val == AUDIT_UID_UNSET)) {
  420. f->type = AUDIT_LOGINUID_SET;
  421. f_val = 0;
  422. entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;
  423. }
  424. err = audit_field_valid(entry, f);
  425. if (err)
  426. goto exit_free;
  427. err = -EINVAL;
  428. switch (f->type) {
  429. case AUDIT_LOGINUID:
  430. case AUDIT_UID:
  431. case AUDIT_EUID:
  432. case AUDIT_SUID:
  433. case AUDIT_FSUID:
  434. case AUDIT_OBJ_UID:
  435. f->uid = make_kuid(current_user_ns(), f_val);
  436. if (!uid_valid(f->uid))
  437. goto exit_free;
  438. break;
  439. case AUDIT_GID:
  440. case AUDIT_EGID:
  441. case AUDIT_SGID:
  442. case AUDIT_FSGID:
  443. case AUDIT_OBJ_GID:
  444. f->gid = make_kgid(current_user_ns(), f_val);
  445. if (!gid_valid(f->gid))
  446. goto exit_free;
  447. break;
  448. case AUDIT_ARCH:
  449. f->val = f_val;
  450. entry->rule.arch_f = f;
  451. break;
  452. case AUDIT_SUBJ_USER:
  453. case AUDIT_SUBJ_ROLE:
  454. case AUDIT_SUBJ_TYPE:
  455. case AUDIT_SUBJ_SEN:
  456. case AUDIT_SUBJ_CLR:
  457. case AUDIT_OBJ_USER:
  458. case AUDIT_OBJ_ROLE:
  459. case AUDIT_OBJ_TYPE:
  460. case AUDIT_OBJ_LEV_LOW:
  461. case AUDIT_OBJ_LEV_HIGH:
  462. str = audit_unpack_string(&bufp, &remain, f_val);
  463. if (IS_ERR(str)) {
  464. err = PTR_ERR(str);
  465. goto exit_free;
  466. }
  467. entry->rule.buflen += f_val;
  468. f->lsm_str = str;
  469. err = security_audit_rule_init(f->type, f->op, str,
  470. (void **)&f->lsm_rule);
  471. /* Keep currently invalid fields around in case they
  472. * become valid after a policy reload. */
  473. if (err == -EINVAL) {
  474. pr_warn("audit rule for LSM \'%s\' is invalid\n",
  475. str);
  476. err = 0;
  477. } else if (err)
  478. goto exit_free;
  479. break;
  480. case AUDIT_WATCH:
  481. str = audit_unpack_string(&bufp, &remain, f_val);
  482. if (IS_ERR(str)) {
  483. err = PTR_ERR(str);
  484. goto exit_free;
  485. }
  486. err = audit_to_watch(&entry->rule, str, f_val, f->op);
  487. if (err) {
  488. kfree(str);
  489. goto exit_free;
  490. }
  491. entry->rule.buflen += f_val;
  492. break;
  493. case AUDIT_DIR:
  494. str = audit_unpack_string(&bufp, &remain, f_val);
  495. if (IS_ERR(str)) {
  496. err = PTR_ERR(str);
  497. goto exit_free;
  498. }
  499. err = audit_make_tree(&entry->rule, str, f->op);
  500. kfree(str);
  501. if (err)
  502. goto exit_free;
  503. entry->rule.buflen += f_val;
  504. break;
  505. case AUDIT_INODE:
  506. f->val = f_val;
  507. err = audit_to_inode(&entry->rule, f);
  508. if (err)
  509. goto exit_free;
  510. break;
  511. case AUDIT_FILTERKEY:
  512. if (entry->rule.filterkey || f_val > AUDIT_MAX_KEY_LEN)
  513. goto exit_free;
  514. str = audit_unpack_string(&bufp, &remain, f_val);
  515. if (IS_ERR(str)) {
  516. err = PTR_ERR(str);
  517. goto exit_free;
  518. }
  519. entry->rule.buflen += f_val;
  520. entry->rule.filterkey = str;
  521. break;
  522. case AUDIT_EXE:
  523. if (entry->rule.exe || f_val > PATH_MAX)
  524. goto exit_free;
  525. str = audit_unpack_string(&bufp, &remain, f_val);
  526. if (IS_ERR(str)) {
  527. err = PTR_ERR(str);
  528. goto exit_free;
  529. }
  530. audit_mark = audit_alloc_mark(&entry->rule, str, f_val);
  531. if (IS_ERR(audit_mark)) {
  532. kfree(str);
  533. err = PTR_ERR(audit_mark);
  534. goto exit_free;
  535. }
  536. entry->rule.buflen += f_val;
  537. entry->rule.exe = audit_mark;
  538. break;
  539. default:
  540. f->val = f_val;
  541. break;
  542. }
  543. }
  544. if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)
  545. entry->rule.inode_f = NULL;
  546. exit_nofree:
  547. return entry;
  548. exit_free:
  549. if (entry->rule.tree)
  550. audit_put_tree(entry->rule.tree); /* that's the temporary one */
  551. if (entry->rule.exe)
  552. audit_remove_mark(entry->rule.exe); /* that's the template one */
  553. audit_free_rule(entry);
  554. return ERR_PTR(err);
  555. }
  556. /* Pack a filter field's string representation into data block. */
  557. static inline size_t audit_pack_string(void **bufp, const char *str)
  558. {
  559. size_t len = strlen(str);
  560. memcpy(*bufp, str, len);
  561. *bufp += len;
  562. return len;
  563. }
  564. /* Translate kernel rule representation to struct audit_rule_data. */
  565. static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
  566. {
  567. struct audit_rule_data *data;
  568. void *bufp;
  569. int i;
  570. data = kmalloc(sizeof(*data) + krule->buflen, GFP_KERNEL);
  571. if (unlikely(!data))
  572. return NULL;
  573. memset(data, 0, sizeof(*data));
  574. data->flags = krule->flags | krule->listnr;
  575. data->action = krule->action;
  576. data->field_count = krule->field_count;
  577. bufp = data->buf;
  578. for (i = 0; i < data->field_count; i++) {
  579. struct audit_field *f = &krule->fields[i];
  580. data->fields[i] = f->type;
  581. data->fieldflags[i] = audit_ops[f->op];
  582. switch(f->type) {
  583. case AUDIT_SUBJ_USER:
  584. case AUDIT_SUBJ_ROLE:
  585. case AUDIT_SUBJ_TYPE:
  586. case AUDIT_SUBJ_SEN:
  587. case AUDIT_SUBJ_CLR:
  588. case AUDIT_OBJ_USER:
  589. case AUDIT_OBJ_ROLE:
  590. case AUDIT_OBJ_TYPE:
  591. case AUDIT_OBJ_LEV_LOW:
  592. case AUDIT_OBJ_LEV_HIGH:
  593. data->buflen += data->values[i] =
  594. audit_pack_string(&bufp, f->lsm_str);
  595. break;
  596. case AUDIT_WATCH:
  597. data->buflen += data->values[i] =
  598. audit_pack_string(&bufp,
  599. audit_watch_path(krule->watch));
  600. break;
  601. case AUDIT_DIR:
  602. data->buflen += data->values[i] =
  603. audit_pack_string(&bufp,
  604. audit_tree_path(krule->tree));
  605. break;
  606. case AUDIT_FILTERKEY:
  607. data->buflen += data->values[i] =
  608. audit_pack_string(&bufp, krule->filterkey);
  609. break;
  610. case AUDIT_EXE:
  611. data->buflen += data->values[i] =
  612. audit_pack_string(&bufp, audit_mark_path(krule->exe));
  613. break;
  614. case AUDIT_LOGINUID_SET:
  615. if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {
  616. data->fields[i] = AUDIT_LOGINUID;
  617. data->values[i] = AUDIT_UID_UNSET;
  618. break;
  619. }
  620. fallthrough; /* if set */
  621. default:
  622. data->values[i] = f->val;
  623. }
  624. }
  625. for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i];
  626. return data;
  627. }
  628. /* Compare two rules in kernel format. Considered success if rules
  629. * don't match. */
  630. static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
  631. {
  632. int i;
  633. if (a->flags != b->flags ||
  634. a->pflags != b->pflags ||
  635. a->listnr != b->listnr ||
  636. a->action != b->action ||
  637. a->field_count != b->field_count)
  638. return 1;
  639. for (i = 0; i < a->field_count; i++) {
  640. if (a->fields[i].type != b->fields[i].type ||
  641. a->fields[i].op != b->fields[i].op)
  642. return 1;
  643. switch(a->fields[i].type) {
  644. case AUDIT_SUBJ_USER:
  645. case AUDIT_SUBJ_ROLE:
  646. case AUDIT_SUBJ_TYPE:
  647. case AUDIT_SUBJ_SEN:
  648. case AUDIT_SUBJ_CLR:
  649. case AUDIT_OBJ_USER:
  650. case AUDIT_OBJ_ROLE:
  651. case AUDIT_OBJ_TYPE:
  652. case AUDIT_OBJ_LEV_LOW:
  653. case AUDIT_OBJ_LEV_HIGH:
  654. if (strcmp(a->fields[i].lsm_str, b->fields[i].lsm_str))
  655. return 1;
  656. break;
  657. case AUDIT_WATCH:
  658. if (strcmp(audit_watch_path(a->watch),
  659. audit_watch_path(b->watch)))
  660. return 1;
  661. break;
  662. case AUDIT_DIR:
  663. if (strcmp(audit_tree_path(a->tree),
  664. audit_tree_path(b->tree)))
  665. return 1;
  666. break;
  667. case AUDIT_FILTERKEY:
  668. /* both filterkeys exist based on above type compare */
  669. if (strcmp(a->filterkey, b->filterkey))
  670. return 1;
  671. break;
  672. case AUDIT_EXE:
  673. /* both paths exist based on above type compare */
  674. if (strcmp(audit_mark_path(a->exe),
  675. audit_mark_path(b->exe)))
  676. return 1;
  677. break;
  678. case AUDIT_UID:
  679. case AUDIT_EUID:
  680. case AUDIT_SUID:
  681. case AUDIT_FSUID:
  682. case AUDIT_LOGINUID:
  683. case AUDIT_OBJ_UID:
  684. if (!uid_eq(a->fields[i].uid, b->fields[i].uid))
  685. return 1;
  686. break;
  687. case AUDIT_GID:
  688. case AUDIT_EGID:
  689. case AUDIT_SGID:
  690. case AUDIT_FSGID:
  691. case AUDIT_OBJ_GID:
  692. if (!gid_eq(a->fields[i].gid, b->fields[i].gid))
  693. return 1;
  694. break;
  695. default:
  696. if (a->fields[i].val != b->fields[i].val)
  697. return 1;
  698. }
  699. }
  700. for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
  701. if (a->mask[i] != b->mask[i])
  702. return 1;
  703. return 0;
  704. }
  705. /* Duplicate LSM field information. The lsm_rule is opaque, so must be
  706. * re-initialized. */
  707. static inline int audit_dupe_lsm_field(struct audit_field *df,
  708. struct audit_field *sf)
  709. {
  710. int ret = 0;
  711. char *lsm_str;
  712. /* our own copy of lsm_str */
  713. lsm_str = kstrdup(sf->lsm_str, GFP_KERNEL);
  714. if (unlikely(!lsm_str))
  715. return -ENOMEM;
  716. df->lsm_str = lsm_str;
  717. /* our own (refreshed) copy of lsm_rule */
  718. ret = security_audit_rule_init(df->type, df->op, df->lsm_str,
  719. (void **)&df->lsm_rule);
  720. /* Keep currently invalid fields around in case they
  721. * become valid after a policy reload. */
  722. if (ret == -EINVAL) {
  723. pr_warn("audit rule for LSM \'%s\' is invalid\n",
  724. df->lsm_str);
  725. ret = 0;
  726. }
  727. return ret;
  728. }
  729. /* Duplicate an audit rule. This will be a deep copy with the exception
  730. * of the watch - that pointer is carried over. The LSM specific fields
  731. * will be updated in the copy. The point is to be able to replace the old
  732. * rule with the new rule in the filterlist, then free the old rule.
  733. * The rlist element is undefined; list manipulations are handled apart from
  734. * the initial copy. */
  735. struct audit_entry *audit_dupe_rule(struct audit_krule *old)
  736. {
  737. u32 fcount = old->field_count;
  738. struct audit_entry *entry;
  739. struct audit_krule *new;
  740. char *fk;
  741. int i, err = 0;
  742. entry = audit_init_entry(fcount);
  743. if (unlikely(!entry))
  744. return ERR_PTR(-ENOMEM);
  745. new = &entry->rule;
  746. new->flags = old->flags;
  747. new->pflags = old->pflags;
  748. new->listnr = old->listnr;
  749. new->action = old->action;
  750. for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
  751. new->mask[i] = old->mask[i];
  752. new->prio = old->prio;
  753. new->buflen = old->buflen;
  754. new->inode_f = old->inode_f;
  755. new->field_count = old->field_count;
  756. /*
  757. * note that we are OK with not refcounting here; audit_match_tree()
  758. * never dereferences tree and we can't get false positives there
  759. * since we'd have to have rule gone from the list *and* removed
  760. * before the chunks found by lookup had been allocated, i.e. before
  761. * the beginning of list scan.
  762. */
  763. new->tree = old->tree;
  764. memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount);
  765. /* deep copy this information, updating the lsm_rule fields, because
  766. * the originals will all be freed when the old rule is freed. */
  767. for (i = 0; i < fcount; i++) {
  768. switch (new->fields[i].type) {
  769. case AUDIT_SUBJ_USER:
  770. case AUDIT_SUBJ_ROLE:
  771. case AUDIT_SUBJ_TYPE:
  772. case AUDIT_SUBJ_SEN:
  773. case AUDIT_SUBJ_CLR:
  774. case AUDIT_OBJ_USER:
  775. case AUDIT_OBJ_ROLE:
  776. case AUDIT_OBJ_TYPE:
  777. case AUDIT_OBJ_LEV_LOW:
  778. case AUDIT_OBJ_LEV_HIGH:
  779. err = audit_dupe_lsm_field(&new->fields[i],
  780. &old->fields[i]);
  781. break;
  782. case AUDIT_FILTERKEY:
  783. fk = kstrdup(old->filterkey, GFP_KERNEL);
  784. if (unlikely(!fk))
  785. err = -ENOMEM;
  786. else
  787. new->filterkey = fk;
  788. break;
  789. case AUDIT_EXE:
  790. err = audit_dupe_exe(new, old);
  791. break;
  792. }
  793. if (err) {
  794. if (new->exe)
  795. audit_remove_mark(new->exe);
  796. audit_free_rule(entry);
  797. return ERR_PTR(err);
  798. }
  799. }
  800. if (old->watch) {
  801. audit_get_watch(old->watch);
  802. new->watch = old->watch;
  803. }
  804. return entry;
  805. }
  806. /* Find an existing audit rule.
  807. * Caller must hold audit_filter_mutex to prevent stale rule data. */
  808. static struct audit_entry *audit_find_rule(struct audit_entry *entry,
  809. struct list_head **p)
  810. {
  811. struct audit_entry *e, *found = NULL;
  812. struct list_head *list;
  813. int h;
  814. if (entry->rule.inode_f) {
  815. h = audit_hash_ino(entry->rule.inode_f->val);
  816. *p = list = &audit_inode_hash[h];
  817. } else if (entry->rule.watch) {
  818. /* we don't know the inode number, so must walk entire hash */
  819. for (h = 0; h < AUDIT_INODE_BUCKETS; h++) {
  820. list = &audit_inode_hash[h];
  821. list_for_each_entry(e, list, list)
  822. if (!audit_compare_rule(&entry->rule, &e->rule)) {
  823. found = e;
  824. goto out;
  825. }
  826. }
  827. goto out;
  828. } else {
  829. *p = list = &audit_filter_list[entry->rule.listnr];
  830. }
  831. list_for_each_entry(e, list, list)
  832. if (!audit_compare_rule(&entry->rule, &e->rule)) {
  833. found = e;
  834. goto out;
  835. }
  836. out:
  837. return found;
  838. }
  839. static u64 prio_low = ~0ULL/2;
  840. static u64 prio_high = ~0ULL/2 - 1;
  841. /* Add rule to given filterlist if not a duplicate. */
  842. static inline int audit_add_rule(struct audit_entry *entry)
  843. {
  844. struct audit_entry *e;
  845. struct audit_watch *watch = entry->rule.watch;
  846. struct audit_tree *tree = entry->rule.tree;
  847. struct list_head *list;
  848. int err = 0;
  849. #ifdef CONFIG_AUDITSYSCALL
  850. int dont_count = 0;
  851. /* If any of these, don't count towards total */
  852. switch(entry->rule.listnr) {
  853. case AUDIT_FILTER_USER:
  854. case AUDIT_FILTER_EXCLUDE:
  855. case AUDIT_FILTER_FS:
  856. dont_count = 1;
  857. }
  858. #endif
  859. mutex_lock(&audit_filter_mutex);
  860. e = audit_find_rule(entry, &list);
  861. if (e) {
  862. mutex_unlock(&audit_filter_mutex);
  863. err = -EEXIST;
  864. /* normally audit_add_tree_rule() will free it on failure */
  865. if (tree)
  866. audit_put_tree(tree);
  867. return err;
  868. }
  869. if (watch) {
  870. /* audit_filter_mutex is dropped and re-taken during this call */
  871. err = audit_add_watch(&entry->rule, &list);
  872. if (err) {
  873. mutex_unlock(&audit_filter_mutex);
  874. /*
  875. * normally audit_add_tree_rule() will free it
  876. * on failure
  877. */
  878. if (tree)
  879. audit_put_tree(tree);
  880. return err;
  881. }
  882. }
  883. if (tree) {
  884. err = audit_add_tree_rule(&entry->rule);
  885. if (err) {
  886. mutex_unlock(&audit_filter_mutex);
  887. return err;
  888. }
  889. }
  890. entry->rule.prio = ~0ULL;
  891. if (entry->rule.listnr == AUDIT_FILTER_EXIT) {
  892. if (entry->rule.flags & AUDIT_FILTER_PREPEND)
  893. entry->rule.prio = ++prio_high;
  894. else
  895. entry->rule.prio = --prio_low;
  896. }
  897. if (entry->rule.flags & AUDIT_FILTER_PREPEND) {
  898. list_add(&entry->rule.list,
  899. &audit_rules_list[entry->rule.listnr]);
  900. list_add_rcu(&entry->list, list);
  901. entry->rule.flags &= ~AUDIT_FILTER_PREPEND;
  902. } else {
  903. list_add_tail(&entry->rule.list,
  904. &audit_rules_list[entry->rule.listnr]);
  905. list_add_tail_rcu(&entry->list, list);
  906. }
  907. #ifdef CONFIG_AUDITSYSCALL
  908. if (!dont_count)
  909. audit_n_rules++;
  910. if (!audit_match_signal(entry))
  911. audit_signals++;
  912. #endif
  913. mutex_unlock(&audit_filter_mutex);
  914. return err;
  915. }
  916. /* Remove an existing rule from filterlist. */
  917. int audit_del_rule(struct audit_entry *entry)
  918. {
  919. struct audit_entry *e;
  920. struct audit_tree *tree = entry->rule.tree;
  921. struct list_head *list;
  922. int ret = 0;
  923. #ifdef CONFIG_AUDITSYSCALL
  924. int dont_count = 0;
  925. /* If any of these, don't count towards total */
  926. switch(entry->rule.listnr) {
  927. case AUDIT_FILTER_USER:
  928. case AUDIT_FILTER_EXCLUDE:
  929. case AUDIT_FILTER_FS:
  930. dont_count = 1;
  931. }
  932. #endif
  933. mutex_lock(&audit_filter_mutex);
  934. e = audit_find_rule(entry, &list);
  935. if (!e) {
  936. ret = -ENOENT;
  937. goto out;
  938. }
  939. if (e->rule.watch)
  940. audit_remove_watch_rule(&e->rule);
  941. if (e->rule.tree)
  942. audit_remove_tree_rule(&e->rule);
  943. if (e->rule.exe)
  944. audit_remove_mark_rule(&e->rule);
  945. #ifdef CONFIG_AUDITSYSCALL
  946. if (!dont_count)
  947. audit_n_rules--;
  948. if (!audit_match_signal(entry))
  949. audit_signals--;
  950. #endif
  951. list_del_rcu(&e->list);
  952. list_del(&e->rule.list);
  953. call_rcu(&e->rcu, audit_free_rule_rcu);
  954. out:
  955. mutex_unlock(&audit_filter_mutex);
  956. if (tree)
  957. audit_put_tree(tree); /* that's the temporary one */
  958. return ret;
  959. }
  960. /* List rules using struct audit_rule_data. */
  961. static void audit_list_rules(int seq, struct sk_buff_head *q)
  962. {
  963. struct sk_buff *skb;
  964. struct audit_krule *r;
  965. int i;
  966. /* This is a blocking read, so use audit_filter_mutex instead of rcu
  967. * iterator to sync with list writers. */
  968. for (i=0; i<AUDIT_NR_FILTERS; i++) {
  969. list_for_each_entry(r, &audit_rules_list[i], list) {
  970. struct audit_rule_data *data;
  971. data = audit_krule_to_data(r);
  972. if (unlikely(!data))
  973. break;
  974. skb = audit_make_reply(seq, AUDIT_LIST_RULES, 0, 1,
  975. data,
  976. sizeof(*data) + data->buflen);
  977. if (skb)
  978. skb_queue_tail(q, skb);
  979. kfree(data);
  980. }
  981. }
  982. skb = audit_make_reply(seq, AUDIT_LIST_RULES, 1, 1, NULL, 0);
  983. if (skb)
  984. skb_queue_tail(q, skb);
  985. }
  986. /* Log rule additions and removals */
  987. static void audit_log_rule_change(char *action, struct audit_krule *rule, int res)
  988. {
  989. struct audit_buffer *ab;
  990. if (!audit_enabled)
  991. return;
  992. ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONFIG_CHANGE);
  993. if (!ab)
  994. return;
  995. audit_log_session_info(ab);
  996. audit_log_task_context(ab);
  997. audit_log_format(ab, " op=%s", action);
  998. audit_log_key(ab, rule->filterkey);
  999. audit_log_format(ab, " list=%d res=%d", rule->listnr, res);
  1000. audit_log_end(ab);
  1001. }
  1002. /**
  1003. * audit_rule_change - apply all rules to the specified message type
  1004. * @type: audit message type
  1005. * @seq: netlink audit message sequence (serial) number
  1006. * @data: payload data
  1007. * @datasz: size of payload data
  1008. */
  1009. int audit_rule_change(int type, int seq, void *data, size_t datasz)
  1010. {
  1011. int err = 0;
  1012. struct audit_entry *entry;
  1013. switch (type) {
  1014. case AUDIT_ADD_RULE:
  1015. entry = audit_data_to_entry(data, datasz);
  1016. if (IS_ERR(entry))
  1017. return PTR_ERR(entry);
  1018. err = audit_add_rule(entry);
  1019. audit_log_rule_change("add_rule", &entry->rule, !err);
  1020. break;
  1021. case AUDIT_DEL_RULE:
  1022. entry = audit_data_to_entry(data, datasz);
  1023. if (IS_ERR(entry))
  1024. return PTR_ERR(entry);
  1025. err = audit_del_rule(entry);
  1026. audit_log_rule_change("remove_rule", &entry->rule, !err);
  1027. break;
  1028. default:
  1029. WARN_ON(1);
  1030. return -EINVAL;
  1031. }
  1032. if (err || type == AUDIT_DEL_RULE) {
  1033. if (entry->rule.exe)
  1034. audit_remove_mark(entry->rule.exe);
  1035. audit_free_rule(entry);
  1036. }
  1037. return err;
  1038. }
  1039. /**
  1040. * audit_list_rules_send - list the audit rules
  1041. * @request_skb: skb of request we are replying to (used to target the reply)
  1042. * @seq: netlink audit message sequence (serial) number
  1043. */
  1044. int audit_list_rules_send(struct sk_buff *request_skb, int seq)
  1045. {
  1046. struct task_struct *tsk;
  1047. struct audit_netlink_list *dest;
  1048. /* We can't just spew out the rules here because we might fill
  1049. * the available socket buffer space and deadlock waiting for
  1050. * auditctl to read from it... which isn't ever going to
  1051. * happen if we're actually running in the context of auditctl
  1052. * trying to _send_ the stuff */
  1053. dest = kmalloc(sizeof(*dest), GFP_KERNEL);
  1054. if (!dest)
  1055. return -ENOMEM;
  1056. dest->net = get_net(sock_net(NETLINK_CB(request_skb).sk));
  1057. dest->portid = NETLINK_CB(request_skb).portid;
  1058. skb_queue_head_init(&dest->q);
  1059. mutex_lock(&audit_filter_mutex);
  1060. audit_list_rules(seq, &dest->q);
  1061. mutex_unlock(&audit_filter_mutex);
  1062. tsk = kthread_run(audit_send_list_thread, dest, "audit_send_list");
  1063. if (IS_ERR(tsk)) {
  1064. skb_queue_purge(&dest->q);
  1065. put_net(dest->net);
  1066. kfree(dest);
  1067. return PTR_ERR(tsk);
  1068. }
  1069. return 0;
  1070. }
  1071. int audit_comparator(u32 left, u32 op, u32 right)
  1072. {
  1073. switch (op) {
  1074. case Audit_equal:
  1075. return (left == right);
  1076. case Audit_not_equal:
  1077. return (left != right);
  1078. case Audit_lt:
  1079. return (left < right);
  1080. case Audit_le:
  1081. return (left <= right);
  1082. case Audit_gt:
  1083. return (left > right);
  1084. case Audit_ge:
  1085. return (left >= right);
  1086. case Audit_bitmask:
  1087. return (left & right);
  1088. case Audit_bittest:
  1089. return ((left & right) == right);
  1090. default:
  1091. return 0;
  1092. }
  1093. }
  1094. int audit_uid_comparator(kuid_t left, u32 op, kuid_t right)
  1095. {
  1096. switch (op) {
  1097. case Audit_equal:
  1098. return uid_eq(left, right);
  1099. case Audit_not_equal:
  1100. return !uid_eq(left, right);
  1101. case Audit_lt:
  1102. return uid_lt(left, right);
  1103. case Audit_le:
  1104. return uid_lte(left, right);
  1105. case Audit_gt:
  1106. return uid_gt(left, right);
  1107. case Audit_ge:
  1108. return uid_gte(left, right);
  1109. case Audit_bitmask:
  1110. case Audit_bittest:
  1111. default:
  1112. return 0;
  1113. }
  1114. }
  1115. int audit_gid_comparator(kgid_t left, u32 op, kgid_t right)
  1116. {
  1117. switch (op) {
  1118. case Audit_equal:
  1119. return gid_eq(left, right);
  1120. case Audit_not_equal:
  1121. return !gid_eq(left, right);
  1122. case Audit_lt:
  1123. return gid_lt(left, right);
  1124. case Audit_le:
  1125. return gid_lte(left, right);
  1126. case Audit_gt:
  1127. return gid_gt(left, right);
  1128. case Audit_ge:
  1129. return gid_gte(left, right);
  1130. case Audit_bitmask:
  1131. case Audit_bittest:
  1132. default:
  1133. return 0;
  1134. }
  1135. }
  1136. /**
  1137. * parent_len - find the length of the parent portion of a pathname
  1138. * @path: pathname of which to determine length
  1139. */
  1140. int parent_len(const char *path)
  1141. {
  1142. int plen;
  1143. const char *p;
  1144. plen = strlen(path);
  1145. if (plen == 0)
  1146. return plen;
  1147. /* disregard trailing slashes */
  1148. p = path + plen - 1;
  1149. while ((*p == '/') && (p > path))
  1150. p--;
  1151. /* walk backward until we find the next slash or hit beginning */
  1152. while ((*p != '/') && (p > path))
  1153. p--;
  1154. /* did we find a slash? Then increment to include it in path */
  1155. if (*p == '/')
  1156. p++;
  1157. return p - path;
  1158. }
  1159. /**
  1160. * audit_compare_dname_path - compare given dentry name with last component in
  1161. * given path. Return of 0 indicates a match.
  1162. * @dname: dentry name that we're comparing
  1163. * @path: full pathname that we're comparing
  1164. * @parentlen: length of the parent if known. Passing in AUDIT_NAME_FULL
  1165. * here indicates that we must compute this value.
  1166. */
  1167. int audit_compare_dname_path(const struct qstr *dname, const char *path, int parentlen)
  1168. {
  1169. int dlen, pathlen;
  1170. const char *p;
  1171. dlen = dname->len;
  1172. pathlen = strlen(path);
  1173. if (pathlen < dlen)
  1174. return 1;
  1175. parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen;
  1176. if (pathlen - parentlen != dlen)
  1177. return 1;
  1178. p = path + parentlen;
  1179. return strncmp(p, dname->name, dlen);
  1180. }
  1181. int audit_filter(int msgtype, unsigned int listtype)
  1182. {
  1183. struct audit_entry *e;
  1184. int ret = 1; /* Audit by default */
  1185. rcu_read_lock();
  1186. list_for_each_entry_rcu(e, &audit_filter_list[listtype], list) {
  1187. int i, result = 0;
  1188. for (i = 0; i < e->rule.field_count; i++) {
  1189. struct audit_field *f = &e->rule.fields[i];
  1190. pid_t pid;
  1191. u32 sid;
  1192. switch (f->type) {
  1193. case AUDIT_PID:
  1194. pid = task_pid_nr(current);
  1195. result = audit_comparator(pid, f->op, f->val);
  1196. break;
  1197. case AUDIT_UID:
  1198. result = audit_uid_comparator(current_uid(), f->op, f->uid);
  1199. break;
  1200. case AUDIT_GID:
  1201. result = audit_gid_comparator(current_gid(), f->op, f->gid);
  1202. break;
  1203. case AUDIT_LOGINUID:
  1204. result = audit_uid_comparator(audit_get_loginuid(current),
  1205. f->op, f->uid);
  1206. break;
  1207. case AUDIT_LOGINUID_SET:
  1208. result = audit_comparator(audit_loginuid_set(current),
  1209. f->op, f->val);
  1210. break;
  1211. case AUDIT_MSGTYPE:
  1212. result = audit_comparator(msgtype, f->op, f->val);
  1213. break;
  1214. case AUDIT_SUBJ_USER:
  1215. case AUDIT_SUBJ_ROLE:
  1216. case AUDIT_SUBJ_TYPE:
  1217. case AUDIT_SUBJ_SEN:
  1218. case AUDIT_SUBJ_CLR:
  1219. if (f->lsm_rule) {
  1220. security_task_getsecid(current, &sid);
  1221. result = security_audit_rule_match(sid,
  1222. f->type, f->op, f->lsm_rule);
  1223. }
  1224. break;
  1225. case AUDIT_EXE:
  1226. result = audit_exe_compare(current, e->rule.exe);
  1227. if (f->op == Audit_not_equal)
  1228. result = !result;
  1229. break;
  1230. default:
  1231. goto unlock_and_return;
  1232. }
  1233. if (result < 0) /* error */
  1234. goto unlock_and_return;
  1235. if (!result)
  1236. break;
  1237. }
  1238. if (result > 0) {
  1239. if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_EXCLUDE)
  1240. ret = 0;
  1241. break;
  1242. }
  1243. }
  1244. unlock_and_return:
  1245. rcu_read_unlock();
  1246. return ret;
  1247. }
  1248. static int update_lsm_rule(struct audit_krule *r)
  1249. {
  1250. struct audit_entry *entry = container_of(r, struct audit_entry, rule);
  1251. struct audit_entry *nentry;
  1252. int err = 0;
  1253. if (!security_audit_rule_known(r))
  1254. return 0;
  1255. nentry = audit_dupe_rule(r);
  1256. if (entry->rule.exe)
  1257. audit_remove_mark(entry->rule.exe);
  1258. if (IS_ERR(nentry)) {
  1259. /* save the first error encountered for the
  1260. * return value */
  1261. err = PTR_ERR(nentry);
  1262. audit_panic("error updating LSM filters");
  1263. if (r->watch)
  1264. list_del(&r->rlist);
  1265. list_del_rcu(&entry->list);
  1266. list_del(&r->list);
  1267. } else {
  1268. if (r->watch || r->tree)
  1269. list_replace_init(&r->rlist, &nentry->rule.rlist);
  1270. list_replace_rcu(&entry->list, &nentry->list);
  1271. list_replace(&r->list, &nentry->rule.list);
  1272. }
  1273. call_rcu(&entry->rcu, audit_free_rule_rcu);
  1274. return err;
  1275. }
  1276. /* This function will re-initialize the lsm_rule field of all applicable rules.
  1277. * It will traverse the filter lists serarching for rules that contain LSM
  1278. * specific filter fields. When such a rule is found, it is copied, the
  1279. * LSM field is re-initialized, and the old rule is replaced with the
  1280. * updated rule. */
  1281. int audit_update_lsm_rules(void)
  1282. {
  1283. struct audit_krule *r, *n;
  1284. int i, err = 0;
  1285. /* audit_filter_mutex synchronizes the writers */
  1286. mutex_lock(&audit_filter_mutex);
  1287. for (i = 0; i < AUDIT_NR_FILTERS; i++) {
  1288. list_for_each_entry_safe(r, n, &audit_rules_list[i], list) {
  1289. int res = update_lsm_rule(r);
  1290. if (!err)
  1291. err = res;
  1292. }
  1293. }
  1294. mutex_unlock(&audit_filter_mutex);
  1295. return err;
  1296. }