audit_tree.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990
  1. #include "audit.h"
  2. #include <linux/fsnotify_backend.h>
  3. #include <linux/namei.h>
  4. #include <linux/mount.h>
  5. #include <linux/kthread.h>
  6. #include <linux/slab.h>
  7. struct audit_tree;
  8. struct audit_chunk;
  9. struct audit_tree {
  10. atomic_t count;
  11. int goner;
  12. struct audit_chunk *root;
  13. struct list_head chunks;
  14. struct list_head rules;
  15. struct list_head list;
  16. struct list_head same_root;
  17. struct rcu_head head;
  18. char pathname[];
  19. };
  20. struct audit_chunk {
  21. struct list_head hash;
  22. struct fsnotify_mark mark;
  23. struct list_head trees; /* with root here */
  24. int dead;
  25. int count;
  26. atomic_long_t refs;
  27. struct rcu_head head;
  28. struct node {
  29. struct list_head list;
  30. struct audit_tree *owner;
  31. unsigned index; /* index; upper bit indicates 'will prune' */
  32. } owners[];
  33. };
  34. static LIST_HEAD(tree_list);
  35. static LIST_HEAD(prune_list);
  36. static struct task_struct *prune_thread;
  37. /*
  38. * One struct chunk is attached to each inode of interest.
  39. * We replace struct chunk on tagging/untagging.
  40. * Rules have pointer to struct audit_tree.
  41. * Rules have struct list_head rlist forming a list of rules over
  42. * the same tree.
  43. * References to struct chunk are collected at audit_inode{,_child}()
  44. * time and used in AUDIT_TREE rule matching.
  45. * These references are dropped at the same time we are calling
  46. * audit_free_names(), etc.
  47. *
  48. * Cyclic lists galore:
  49. * tree.chunks anchors chunk.owners[].list hash_lock
  50. * tree.rules anchors rule.rlist audit_filter_mutex
  51. * chunk.trees anchors tree.same_root hash_lock
  52. * chunk.hash is a hash with middle bits of watch.inode as
  53. * a hash function. RCU, hash_lock
  54. *
  55. * tree is refcounted; one reference for "some rules on rules_list refer to
  56. * it", one for each chunk with pointer to it.
  57. *
  58. * chunk is refcounted by embedded fsnotify_mark + .refs (non-zero refcount
  59. * of watch contributes 1 to .refs).
  60. *
  61. * node.index allows to get from node.list to containing chunk.
  62. * MSB of that sucker is stolen to mark taggings that we might have to
  63. * revert - several operations have very unpleasant cleanup logics and
  64. * that makes a difference. Some.
  65. */
  66. static struct fsnotify_group *audit_tree_group;
  67. static struct audit_tree *alloc_tree(const char *s)
  68. {
  69. struct audit_tree *tree;
  70. tree = kmalloc(sizeof(struct audit_tree) + strlen(s) + 1, GFP_KERNEL);
  71. if (tree) {
  72. atomic_set(&tree->count, 1);
  73. tree->goner = 0;
  74. INIT_LIST_HEAD(&tree->chunks);
  75. INIT_LIST_HEAD(&tree->rules);
  76. INIT_LIST_HEAD(&tree->list);
  77. INIT_LIST_HEAD(&tree->same_root);
  78. tree->root = NULL;
  79. strcpy(tree->pathname, s);
  80. }
  81. return tree;
  82. }
  83. static inline void get_tree(struct audit_tree *tree)
  84. {
  85. atomic_inc(&tree->count);
  86. }
  87. static inline void put_tree(struct audit_tree *tree)
  88. {
  89. if (atomic_dec_and_test(&tree->count))
  90. kfree_rcu(tree, head);
  91. }
  92. /* to avoid bringing the entire thing in audit.h */
  93. const char *audit_tree_path(struct audit_tree *tree)
  94. {
  95. return tree->pathname;
  96. }
  97. static void free_chunk(struct audit_chunk *chunk)
  98. {
  99. int i;
  100. for (i = 0; i < chunk->count; i++) {
  101. if (chunk->owners[i].owner)
  102. put_tree(chunk->owners[i].owner);
  103. }
  104. kfree(chunk);
  105. }
  106. void audit_put_chunk(struct audit_chunk *chunk)
  107. {
  108. if (atomic_long_dec_and_test(&chunk->refs))
  109. free_chunk(chunk);
  110. }
  111. static void __put_chunk(struct rcu_head *rcu)
  112. {
  113. struct audit_chunk *chunk = container_of(rcu, struct audit_chunk, head);
  114. audit_put_chunk(chunk);
  115. }
  116. static void audit_tree_destroy_watch(struct fsnotify_mark *entry)
  117. {
  118. struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
  119. call_rcu(&chunk->head, __put_chunk);
  120. }
  121. static struct audit_chunk *alloc_chunk(int count)
  122. {
  123. struct audit_chunk *chunk;
  124. size_t size;
  125. int i;
  126. size = offsetof(struct audit_chunk, owners) + count * sizeof(struct node);
  127. chunk = kzalloc(size, GFP_KERNEL);
  128. if (!chunk)
  129. return NULL;
  130. INIT_LIST_HEAD(&chunk->hash);
  131. INIT_LIST_HEAD(&chunk->trees);
  132. chunk->count = count;
  133. atomic_long_set(&chunk->refs, 1);
  134. for (i = 0; i < count; i++) {
  135. INIT_LIST_HEAD(&chunk->owners[i].list);
  136. chunk->owners[i].index = i;
  137. }
  138. fsnotify_init_mark(&chunk->mark, audit_tree_destroy_watch);
  139. chunk->mark.mask = FS_IN_IGNORED;
  140. return chunk;
  141. }
  142. enum {HASH_SIZE = 128};
  143. static struct list_head chunk_hash_heads[HASH_SIZE];
  144. static __cacheline_aligned_in_smp DEFINE_SPINLOCK(hash_lock);
  145. static inline struct list_head *chunk_hash(const struct inode *inode)
  146. {
  147. unsigned long n = (unsigned long)inode / L1_CACHE_BYTES;
  148. return chunk_hash_heads + n % HASH_SIZE;
  149. }
  150. /* hash_lock & entry->lock is held by caller */
  151. static void insert_hash(struct audit_chunk *chunk)
  152. {
  153. struct fsnotify_mark *entry = &chunk->mark;
  154. struct list_head *list;
  155. if (!entry->inode)
  156. return;
  157. list = chunk_hash(entry->inode);
  158. list_add_rcu(&chunk->hash, list);
  159. }
  160. /* called under rcu_read_lock */
  161. struct audit_chunk *audit_tree_lookup(const struct inode *inode)
  162. {
  163. struct list_head *list = chunk_hash(inode);
  164. struct audit_chunk *p;
  165. list_for_each_entry_rcu(p, list, hash) {
  166. /* mark.inode may have gone NULL, but who cares? */
  167. if (p->mark.inode == inode) {
  168. atomic_long_inc(&p->refs);
  169. return p;
  170. }
  171. }
  172. return NULL;
  173. }
  174. bool audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree)
  175. {
  176. int n;
  177. for (n = 0; n < chunk->count; n++)
  178. if (chunk->owners[n].owner == tree)
  179. return true;
  180. return false;
  181. }
  182. /* tagging and untagging inodes with trees */
  183. static struct audit_chunk *find_chunk(struct node *p)
  184. {
  185. int index = p->index & ~(1U<<31);
  186. p -= index;
  187. return container_of(p, struct audit_chunk, owners[0]);
  188. }
  189. static void untag_chunk(struct node *p)
  190. {
  191. struct audit_chunk *chunk = find_chunk(p);
  192. struct fsnotify_mark *entry = &chunk->mark;
  193. struct audit_chunk *new = NULL;
  194. struct audit_tree *owner;
  195. int size = chunk->count - 1;
  196. int i, j;
  197. fsnotify_get_mark(entry);
  198. spin_unlock(&hash_lock);
  199. if (size)
  200. new = alloc_chunk(size);
  201. spin_lock(&entry->lock);
  202. if (chunk->dead || !entry->inode) {
  203. spin_unlock(&entry->lock);
  204. if (new)
  205. free_chunk(new);
  206. goto out;
  207. }
  208. owner = p->owner;
  209. if (!size) {
  210. chunk->dead = 1;
  211. spin_lock(&hash_lock);
  212. list_del_init(&chunk->trees);
  213. if (owner->root == chunk)
  214. owner->root = NULL;
  215. list_del_init(&p->list);
  216. list_del_rcu(&chunk->hash);
  217. spin_unlock(&hash_lock);
  218. spin_unlock(&entry->lock);
  219. fsnotify_destroy_mark(entry, audit_tree_group);
  220. goto out;
  221. }
  222. if (!new)
  223. goto Fallback;
  224. fsnotify_duplicate_mark(&new->mark, entry);
  225. if (fsnotify_add_mark(&new->mark, new->mark.group, new->mark.inode, NULL, 1)) {
  226. fsnotify_put_mark(&new->mark);
  227. goto Fallback;
  228. }
  229. chunk->dead = 1;
  230. spin_lock(&hash_lock);
  231. list_replace_init(&chunk->trees, &new->trees);
  232. if (owner->root == chunk) {
  233. list_del_init(&owner->same_root);
  234. owner->root = NULL;
  235. }
  236. for (i = j = 0; j <= size; i++, j++) {
  237. struct audit_tree *s;
  238. if (&chunk->owners[j] == p) {
  239. list_del_init(&p->list);
  240. i--;
  241. continue;
  242. }
  243. s = chunk->owners[j].owner;
  244. new->owners[i].owner = s;
  245. new->owners[i].index = chunk->owners[j].index - j + i;
  246. if (!s) /* result of earlier fallback */
  247. continue;
  248. get_tree(s);
  249. list_replace_init(&chunk->owners[j].list, &new->owners[i].list);
  250. }
  251. list_replace_rcu(&chunk->hash, &new->hash);
  252. list_for_each_entry(owner, &new->trees, same_root)
  253. owner->root = new;
  254. spin_unlock(&hash_lock);
  255. spin_unlock(&entry->lock);
  256. fsnotify_destroy_mark(entry, audit_tree_group);
  257. fsnotify_put_mark(&new->mark); /* drop initial reference */
  258. goto out;
  259. Fallback:
  260. // do the best we can
  261. spin_lock(&hash_lock);
  262. if (owner->root == chunk) {
  263. list_del_init(&owner->same_root);
  264. owner->root = NULL;
  265. }
  266. list_del_init(&p->list);
  267. p->owner = NULL;
  268. put_tree(owner);
  269. spin_unlock(&hash_lock);
  270. spin_unlock(&entry->lock);
  271. out:
  272. fsnotify_put_mark(entry);
  273. spin_lock(&hash_lock);
  274. }
  275. static int create_chunk(struct inode *inode, struct audit_tree *tree)
  276. {
  277. struct fsnotify_mark *entry;
  278. struct audit_chunk *chunk = alloc_chunk(1);
  279. if (!chunk)
  280. return -ENOMEM;
  281. entry = &chunk->mark;
  282. if (fsnotify_add_mark(entry, audit_tree_group, inode, NULL, 0)) {
  283. fsnotify_put_mark(entry);
  284. return -ENOSPC;
  285. }
  286. spin_lock(&entry->lock);
  287. spin_lock(&hash_lock);
  288. if (tree->goner) {
  289. spin_unlock(&hash_lock);
  290. chunk->dead = 1;
  291. spin_unlock(&entry->lock);
  292. fsnotify_destroy_mark(entry, audit_tree_group);
  293. fsnotify_put_mark(entry);
  294. return 0;
  295. }
  296. chunk->owners[0].index = (1U << 31);
  297. chunk->owners[0].owner = tree;
  298. get_tree(tree);
  299. list_add(&chunk->owners[0].list, &tree->chunks);
  300. if (!tree->root) {
  301. tree->root = chunk;
  302. list_add(&tree->same_root, &chunk->trees);
  303. }
  304. insert_hash(chunk);
  305. spin_unlock(&hash_lock);
  306. spin_unlock(&entry->lock);
  307. fsnotify_put_mark(entry); /* drop initial reference */
  308. return 0;
  309. }
  310. /* the first tagged inode becomes root of tree */
  311. static int tag_chunk(struct inode *inode, struct audit_tree *tree)
  312. {
  313. struct fsnotify_mark *old_entry, *chunk_entry;
  314. struct audit_tree *owner;
  315. struct audit_chunk *chunk, *old;
  316. struct node *p;
  317. int n;
  318. old_entry = fsnotify_find_inode_mark(audit_tree_group, inode);
  319. if (!old_entry)
  320. return create_chunk(inode, tree);
  321. old = container_of(old_entry, struct audit_chunk, mark);
  322. /* are we already there? */
  323. spin_lock(&hash_lock);
  324. for (n = 0; n < old->count; n++) {
  325. if (old->owners[n].owner == tree) {
  326. spin_unlock(&hash_lock);
  327. fsnotify_put_mark(old_entry);
  328. return 0;
  329. }
  330. }
  331. spin_unlock(&hash_lock);
  332. chunk = alloc_chunk(old->count + 1);
  333. if (!chunk) {
  334. fsnotify_put_mark(old_entry);
  335. return -ENOMEM;
  336. }
  337. chunk_entry = &chunk->mark;
  338. spin_lock(&old_entry->lock);
  339. if (!old_entry->inode) {
  340. /* old_entry is being shot, lets just lie */
  341. spin_unlock(&old_entry->lock);
  342. fsnotify_put_mark(old_entry);
  343. free_chunk(chunk);
  344. return -ENOENT;
  345. }
  346. fsnotify_duplicate_mark(chunk_entry, old_entry);
  347. if (fsnotify_add_mark(chunk_entry, chunk_entry->group, chunk_entry->inode, NULL, 1)) {
  348. spin_unlock(&old_entry->lock);
  349. fsnotify_put_mark(chunk_entry);
  350. fsnotify_put_mark(old_entry);
  351. return -ENOSPC;
  352. }
  353. /* even though we hold old_entry->lock, this is safe since chunk_entry->lock could NEVER have been grabbed before */
  354. spin_lock(&chunk_entry->lock);
  355. spin_lock(&hash_lock);
  356. /* we now hold old_entry->lock, chunk_entry->lock, and hash_lock */
  357. if (tree->goner) {
  358. spin_unlock(&hash_lock);
  359. chunk->dead = 1;
  360. spin_unlock(&chunk_entry->lock);
  361. spin_unlock(&old_entry->lock);
  362. fsnotify_destroy_mark(chunk_entry, audit_tree_group);
  363. fsnotify_put_mark(chunk_entry);
  364. fsnotify_put_mark(old_entry);
  365. return 0;
  366. }
  367. list_replace_init(&old->trees, &chunk->trees);
  368. for (n = 0, p = chunk->owners; n < old->count; n++, p++) {
  369. struct audit_tree *s = old->owners[n].owner;
  370. p->owner = s;
  371. p->index = old->owners[n].index;
  372. if (!s) /* result of fallback in untag */
  373. continue;
  374. get_tree(s);
  375. list_replace_init(&old->owners[n].list, &p->list);
  376. }
  377. p->index = (chunk->count - 1) | (1U<<31);
  378. p->owner = tree;
  379. get_tree(tree);
  380. list_add(&p->list, &tree->chunks);
  381. list_replace_rcu(&old->hash, &chunk->hash);
  382. list_for_each_entry(owner, &chunk->trees, same_root)
  383. owner->root = chunk;
  384. old->dead = 1;
  385. if (!tree->root) {
  386. tree->root = chunk;
  387. list_add(&tree->same_root, &chunk->trees);
  388. }
  389. spin_unlock(&hash_lock);
  390. spin_unlock(&chunk_entry->lock);
  391. spin_unlock(&old_entry->lock);
  392. fsnotify_destroy_mark(old_entry, audit_tree_group);
  393. fsnotify_put_mark(chunk_entry); /* drop initial reference */
  394. fsnotify_put_mark(old_entry); /* pair to fsnotify_find mark_entry */
  395. return 0;
  396. }
  397. static void audit_tree_log_remove_rule(struct audit_krule *rule)
  398. {
  399. struct audit_buffer *ab;
  400. ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
  401. if (unlikely(!ab))
  402. return;
  403. audit_log_format(ab, "op=");
  404. audit_log_string(ab, "remove_rule");
  405. audit_log_format(ab, " dir=");
  406. audit_log_untrustedstring(ab, rule->tree->pathname);
  407. audit_log_key(ab, rule->filterkey);
  408. audit_log_format(ab, " list=%d res=1", rule->listnr);
  409. audit_log_end(ab);
  410. }
  411. static void kill_rules(struct audit_tree *tree)
  412. {
  413. struct audit_krule *rule, *next;
  414. struct audit_entry *entry;
  415. list_for_each_entry_safe(rule, next, &tree->rules, rlist) {
  416. entry = container_of(rule, struct audit_entry, rule);
  417. list_del_init(&rule->rlist);
  418. if (rule->tree) {
  419. /* not a half-baked one */
  420. audit_tree_log_remove_rule(rule);
  421. if (entry->rule.exe)
  422. audit_remove_mark(entry->rule.exe);
  423. rule->tree = NULL;
  424. list_del_rcu(&entry->list);
  425. list_del(&entry->rule.list);
  426. call_rcu(&entry->rcu, audit_free_rule_rcu);
  427. }
  428. }
  429. }
  430. /*
  431. * finish killing struct audit_tree
  432. */
  433. static void prune_one(struct audit_tree *victim)
  434. {
  435. spin_lock(&hash_lock);
  436. while (!list_empty(&victim->chunks)) {
  437. struct node *p;
  438. p = list_entry(victim->chunks.next, struct node, list);
  439. untag_chunk(p);
  440. }
  441. spin_unlock(&hash_lock);
  442. put_tree(victim);
  443. }
  444. /* trim the uncommitted chunks from tree */
  445. static void trim_marked(struct audit_tree *tree)
  446. {
  447. struct list_head *p, *q;
  448. spin_lock(&hash_lock);
  449. if (tree->goner) {
  450. spin_unlock(&hash_lock);
  451. return;
  452. }
  453. /* reorder */
  454. for (p = tree->chunks.next; p != &tree->chunks; p = q) {
  455. struct node *node = list_entry(p, struct node, list);
  456. q = p->next;
  457. if (node->index & (1U<<31)) {
  458. list_del_init(p);
  459. list_add(p, &tree->chunks);
  460. }
  461. }
  462. while (!list_empty(&tree->chunks)) {
  463. struct node *node;
  464. node = list_entry(tree->chunks.next, struct node, list);
  465. /* have we run out of marked? */
  466. if (!(node->index & (1U<<31)))
  467. break;
  468. untag_chunk(node);
  469. }
  470. if (!tree->root && !tree->goner) {
  471. tree->goner = 1;
  472. spin_unlock(&hash_lock);
  473. mutex_lock(&audit_filter_mutex);
  474. kill_rules(tree);
  475. list_del_init(&tree->list);
  476. mutex_unlock(&audit_filter_mutex);
  477. prune_one(tree);
  478. } else {
  479. spin_unlock(&hash_lock);
  480. }
  481. }
  482. static void audit_schedule_prune(void);
  483. /* called with audit_filter_mutex */
  484. int audit_remove_tree_rule(struct audit_krule *rule)
  485. {
  486. struct audit_tree *tree;
  487. tree = rule->tree;
  488. if (tree) {
  489. spin_lock(&hash_lock);
  490. list_del_init(&rule->rlist);
  491. if (list_empty(&tree->rules) && !tree->goner) {
  492. tree->root = NULL;
  493. list_del_init(&tree->same_root);
  494. tree->goner = 1;
  495. list_move(&tree->list, &prune_list);
  496. rule->tree = NULL;
  497. spin_unlock(&hash_lock);
  498. audit_schedule_prune();
  499. return 1;
  500. }
  501. rule->tree = NULL;
  502. spin_unlock(&hash_lock);
  503. return 1;
  504. }
  505. return 0;
  506. }
  507. static int compare_root(struct vfsmount *mnt, void *arg)
  508. {
  509. return d_backing_inode(mnt->mnt_root) == arg;
  510. }
  511. void audit_trim_trees(void)
  512. {
  513. struct list_head cursor;
  514. mutex_lock(&audit_filter_mutex);
  515. list_add(&cursor, &tree_list);
  516. while (cursor.next != &tree_list) {
  517. struct audit_tree *tree;
  518. struct path path;
  519. struct vfsmount *root_mnt;
  520. struct node *node;
  521. int err;
  522. tree = container_of(cursor.next, struct audit_tree, list);
  523. get_tree(tree);
  524. list_del(&cursor);
  525. list_add(&cursor, &tree->list);
  526. mutex_unlock(&audit_filter_mutex);
  527. err = kern_path(tree->pathname, 0, &path);
  528. if (err)
  529. goto skip_it;
  530. root_mnt = collect_mounts(&path);
  531. path_put(&path);
  532. if (IS_ERR(root_mnt))
  533. goto skip_it;
  534. spin_lock(&hash_lock);
  535. list_for_each_entry(node, &tree->chunks, list) {
  536. struct audit_chunk *chunk = find_chunk(node);
  537. /* this could be NULL if the watch is dying else where... */
  538. struct inode *inode = chunk->mark.inode;
  539. node->index |= 1U<<31;
  540. if (iterate_mounts(compare_root, inode, root_mnt))
  541. node->index &= ~(1U<<31);
  542. }
  543. spin_unlock(&hash_lock);
  544. trim_marked(tree);
  545. drop_collected_mounts(root_mnt);
  546. skip_it:
  547. put_tree(tree);
  548. mutex_lock(&audit_filter_mutex);
  549. }
  550. list_del(&cursor);
  551. mutex_unlock(&audit_filter_mutex);
  552. }
  553. int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op)
  554. {
  555. if (pathname[0] != '/' ||
  556. rule->listnr != AUDIT_FILTER_EXIT ||
  557. op != Audit_equal ||
  558. rule->inode_f || rule->watch || rule->tree)
  559. return -EINVAL;
  560. rule->tree = alloc_tree(pathname);
  561. if (!rule->tree)
  562. return -ENOMEM;
  563. return 0;
  564. }
  565. void audit_put_tree(struct audit_tree *tree)
  566. {
  567. put_tree(tree);
  568. }
  569. static int tag_mount(struct vfsmount *mnt, void *arg)
  570. {
  571. return tag_chunk(d_backing_inode(mnt->mnt_root), arg);
  572. }
  573. /*
  574. * That gets run when evict_chunk() ends up needing to kill audit_tree.
  575. * Runs from a separate thread.
  576. */
  577. static int prune_tree_thread(void *unused)
  578. {
  579. for (;;) {
  580. set_current_state(TASK_INTERRUPTIBLE);
  581. if (list_empty(&prune_list))
  582. schedule();
  583. __set_current_state(TASK_RUNNING);
  584. mutex_lock(&audit_cmd_mutex);
  585. mutex_lock(&audit_filter_mutex);
  586. while (!list_empty(&prune_list)) {
  587. struct audit_tree *victim;
  588. victim = list_entry(prune_list.next,
  589. struct audit_tree, list);
  590. list_del_init(&victim->list);
  591. mutex_unlock(&audit_filter_mutex);
  592. prune_one(victim);
  593. mutex_lock(&audit_filter_mutex);
  594. }
  595. mutex_unlock(&audit_filter_mutex);
  596. mutex_unlock(&audit_cmd_mutex);
  597. }
  598. return 0;
  599. }
  600. static int audit_launch_prune(void)
  601. {
  602. if (prune_thread)
  603. return 0;
  604. prune_thread = kthread_create(prune_tree_thread, NULL,
  605. "audit_prune_tree");
  606. if (IS_ERR(prune_thread)) {
  607. pr_err("cannot start thread audit_prune_tree");
  608. prune_thread = NULL;
  609. return -ENOMEM;
  610. } else {
  611. wake_up_process(prune_thread);
  612. return 0;
  613. }
  614. }
  615. /* called with audit_filter_mutex */
  616. int audit_add_tree_rule(struct audit_krule *rule)
  617. {
  618. struct audit_tree *seed = rule->tree, *tree;
  619. struct path path;
  620. struct vfsmount *mnt;
  621. int err;
  622. rule->tree = NULL;
  623. list_for_each_entry(tree, &tree_list, list) {
  624. if (!strcmp(seed->pathname, tree->pathname)) {
  625. put_tree(seed);
  626. rule->tree = tree;
  627. list_add(&rule->rlist, &tree->rules);
  628. return 0;
  629. }
  630. }
  631. tree = seed;
  632. list_add(&tree->list, &tree_list);
  633. list_add(&rule->rlist, &tree->rules);
  634. /* do not set rule->tree yet */
  635. mutex_unlock(&audit_filter_mutex);
  636. if (unlikely(!prune_thread)) {
  637. err = audit_launch_prune();
  638. if (err)
  639. goto Err;
  640. }
  641. err = kern_path(tree->pathname, 0, &path);
  642. if (err)
  643. goto Err;
  644. mnt = collect_mounts(&path);
  645. path_put(&path);
  646. if (IS_ERR(mnt)) {
  647. err = PTR_ERR(mnt);
  648. goto Err;
  649. }
  650. get_tree(tree);
  651. err = iterate_mounts(tag_mount, tree, mnt);
  652. drop_collected_mounts(mnt);
  653. if (!err) {
  654. struct node *node;
  655. spin_lock(&hash_lock);
  656. list_for_each_entry(node, &tree->chunks, list)
  657. node->index &= ~(1U<<31);
  658. spin_unlock(&hash_lock);
  659. } else {
  660. trim_marked(tree);
  661. goto Err;
  662. }
  663. mutex_lock(&audit_filter_mutex);
  664. if (list_empty(&rule->rlist)) {
  665. put_tree(tree);
  666. return -ENOENT;
  667. }
  668. rule->tree = tree;
  669. put_tree(tree);
  670. return 0;
  671. Err:
  672. mutex_lock(&audit_filter_mutex);
  673. list_del_init(&tree->list);
  674. list_del_init(&tree->rules);
  675. put_tree(tree);
  676. return err;
  677. }
  678. int audit_tag_tree(char *old, char *new)
  679. {
  680. struct list_head cursor, barrier;
  681. int failed = 0;
  682. struct path path1, path2;
  683. struct vfsmount *tagged;
  684. int err;
  685. err = kern_path(new, 0, &path2);
  686. if (err)
  687. return err;
  688. tagged = collect_mounts(&path2);
  689. path_put(&path2);
  690. if (IS_ERR(tagged))
  691. return PTR_ERR(tagged);
  692. err = kern_path(old, 0, &path1);
  693. if (err) {
  694. drop_collected_mounts(tagged);
  695. return err;
  696. }
  697. mutex_lock(&audit_filter_mutex);
  698. list_add(&barrier, &tree_list);
  699. list_add(&cursor, &barrier);
  700. while (cursor.next != &tree_list) {
  701. struct audit_tree *tree;
  702. int good_one = 0;
  703. tree = container_of(cursor.next, struct audit_tree, list);
  704. get_tree(tree);
  705. list_del(&cursor);
  706. list_add(&cursor, &tree->list);
  707. mutex_unlock(&audit_filter_mutex);
  708. err = kern_path(tree->pathname, 0, &path2);
  709. if (!err) {
  710. good_one = path_is_under(&path1, &path2);
  711. path_put(&path2);
  712. }
  713. if (!good_one) {
  714. put_tree(tree);
  715. mutex_lock(&audit_filter_mutex);
  716. continue;
  717. }
  718. failed = iterate_mounts(tag_mount, tree, tagged);
  719. if (failed) {
  720. put_tree(tree);
  721. mutex_lock(&audit_filter_mutex);
  722. break;
  723. }
  724. mutex_lock(&audit_filter_mutex);
  725. spin_lock(&hash_lock);
  726. if (!tree->goner) {
  727. list_del(&tree->list);
  728. list_add(&tree->list, &tree_list);
  729. }
  730. spin_unlock(&hash_lock);
  731. put_tree(tree);
  732. }
  733. while (barrier.prev != &tree_list) {
  734. struct audit_tree *tree;
  735. tree = container_of(barrier.prev, struct audit_tree, list);
  736. get_tree(tree);
  737. list_del(&tree->list);
  738. list_add(&tree->list, &barrier);
  739. mutex_unlock(&audit_filter_mutex);
  740. if (!failed) {
  741. struct node *node;
  742. spin_lock(&hash_lock);
  743. list_for_each_entry(node, &tree->chunks, list)
  744. node->index &= ~(1U<<31);
  745. spin_unlock(&hash_lock);
  746. } else {
  747. trim_marked(tree);
  748. }
  749. put_tree(tree);
  750. mutex_lock(&audit_filter_mutex);
  751. }
  752. list_del(&barrier);
  753. list_del(&cursor);
  754. mutex_unlock(&audit_filter_mutex);
  755. path_put(&path1);
  756. drop_collected_mounts(tagged);
  757. return failed;
  758. }
  759. static void audit_schedule_prune(void)
  760. {
  761. wake_up_process(prune_thread);
  762. }
  763. /*
  764. * ... and that one is done if evict_chunk() decides to delay until the end
  765. * of syscall. Runs synchronously.
  766. */
  767. void audit_kill_trees(struct list_head *list)
  768. {
  769. mutex_lock(&audit_cmd_mutex);
  770. mutex_lock(&audit_filter_mutex);
  771. while (!list_empty(list)) {
  772. struct audit_tree *victim;
  773. victim = list_entry(list->next, struct audit_tree, list);
  774. kill_rules(victim);
  775. list_del_init(&victim->list);
  776. mutex_unlock(&audit_filter_mutex);
  777. prune_one(victim);
  778. mutex_lock(&audit_filter_mutex);
  779. }
  780. mutex_unlock(&audit_filter_mutex);
  781. mutex_unlock(&audit_cmd_mutex);
  782. }
  783. /*
  784. * Here comes the stuff asynchronous to auditctl operations
  785. */
  786. static void evict_chunk(struct audit_chunk *chunk)
  787. {
  788. struct audit_tree *owner;
  789. struct list_head *postponed = audit_killed_trees();
  790. int need_prune = 0;
  791. int n;
  792. if (chunk->dead)
  793. return;
  794. chunk->dead = 1;
  795. mutex_lock(&audit_filter_mutex);
  796. spin_lock(&hash_lock);
  797. while (!list_empty(&chunk->trees)) {
  798. owner = list_entry(chunk->trees.next,
  799. struct audit_tree, same_root);
  800. owner->goner = 1;
  801. owner->root = NULL;
  802. list_del_init(&owner->same_root);
  803. spin_unlock(&hash_lock);
  804. if (!postponed) {
  805. kill_rules(owner);
  806. list_move(&owner->list, &prune_list);
  807. need_prune = 1;
  808. } else {
  809. list_move(&owner->list, postponed);
  810. }
  811. spin_lock(&hash_lock);
  812. }
  813. list_del_rcu(&chunk->hash);
  814. for (n = 0; n < chunk->count; n++)
  815. list_del_init(&chunk->owners[n].list);
  816. spin_unlock(&hash_lock);
  817. mutex_unlock(&audit_filter_mutex);
  818. if (need_prune)
  819. audit_schedule_prune();
  820. }
  821. static int audit_tree_handle_event(struct fsnotify_group *group,
  822. struct inode *to_tell,
  823. struct fsnotify_mark *inode_mark,
  824. struct fsnotify_mark *vfsmount_mark,
  825. u32 mask, void *data, int data_type,
  826. const unsigned char *file_name, u32 cookie)
  827. {
  828. return 0;
  829. }
  830. static void audit_tree_freeing_mark(struct fsnotify_mark *entry, struct fsnotify_group *group)
  831. {
  832. struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
  833. evict_chunk(chunk);
  834. /*
  835. * We are guaranteed to have at least one reference to the mark from
  836. * either the inode or the caller of fsnotify_destroy_mark().
  837. */
  838. BUG_ON(atomic_read(&entry->refcnt) < 1);
  839. }
  840. static const struct fsnotify_ops audit_tree_ops = {
  841. .handle_event = audit_tree_handle_event,
  842. .freeing_mark = audit_tree_freeing_mark,
  843. };
  844. static int __init audit_tree_init(void)
  845. {
  846. int i;
  847. audit_tree_group = fsnotify_alloc_group(&audit_tree_ops);
  848. if (IS_ERR(audit_tree_group))
  849. audit_panic("cannot initialize fsnotify group for rectree watches");
  850. for (i = 0; i < HASH_SIZE; i++)
  851. INIT_LIST_HEAD(&chunk_hash_heads[i]);
  852. return 0;
  853. }
  854. __initcall(audit_tree_init);