linux/kernel/audit_watch.c
<<
>>
Prefs
   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/* audit_watch.c -- watching inodes
   3 *
   4 * Copyright 2003-2009 Red Hat, Inc.
   5 * Copyright 2005 Hewlett-Packard Development Company, L.P.
   6 * Copyright 2005 IBM Corporation
   7 */
   8
   9#include <linux/file.h>
  10#include <linux/kernel.h>
  11#include <linux/audit.h>
  12#include <linux/kthread.h>
  13#include <linux/mutex.h>
  14#include <linux/fs.h>
  15#include <linux/fsnotify_backend.h>
  16#include <linux/namei.h>
  17#include <linux/netlink.h>
  18#include <linux/refcount.h>
  19#include <linux/sched.h>
  20#include <linux/slab.h>
  21#include <linux/security.h>
  22#include "audit.h"
  23
  24/*
  25 * Reference counting:
  26 *
  27 * audit_parent: lifetime is from audit_init_parent() to receipt of an FS_IGNORED
  28 *      event.  Each audit_watch holds a reference to its associated parent.
  29 *
  30 * audit_watch: if added to lists, lifetime is from audit_init_watch() to
  31 *      audit_remove_watch().  Additionally, an audit_watch may exist
  32 *      temporarily to assist in searching existing filter data.  Each
  33 *      audit_krule holds a reference to its associated watch.
  34 */
  35
  36struct audit_watch {
  37        refcount_t              count;  /* reference count */
  38        dev_t                   dev;    /* associated superblock device */
  39        char                    *path;  /* insertion path */
  40        unsigned long           ino;    /* associated inode number */
  41        struct audit_parent     *parent; /* associated parent */
  42        struct list_head        wlist;  /* entry in parent->watches list */
  43        struct list_head        rules;  /* anchor for krule->rlist */
  44};
  45
  46struct audit_parent {
  47        struct list_head        watches; /* anchor for audit_watch->wlist */
  48        struct fsnotify_mark mark; /* fsnotify mark on the inode */
  49};
  50
  51/* fsnotify handle. */
  52static struct fsnotify_group *audit_watch_group;
  53
  54/* fsnotify events we care about. */
  55#define AUDIT_FS_WATCH (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
  56                        FS_MOVE_SELF | FS_UNMOUNT)
  57
  58static void audit_free_parent(struct audit_parent *parent)
  59{
  60        WARN_ON(!list_empty(&parent->watches));
  61        kfree(parent);
  62}
  63
  64static void audit_watch_free_mark(struct fsnotify_mark *entry)
  65{
  66        struct audit_parent *parent;
  67
  68        parent = container_of(entry, struct audit_parent, mark);
  69        audit_free_parent(parent);
  70}
  71
  72static void audit_get_parent(struct audit_parent *parent)
  73{
  74        if (likely(parent))
  75                fsnotify_get_mark(&parent->mark);
  76}
  77
  78static void audit_put_parent(struct audit_parent *parent)
  79{
  80        if (likely(parent))
  81                fsnotify_put_mark(&parent->mark);
  82}
  83
  84/*
  85 * Find and return the audit_parent on the given inode.  If found a reference
  86 * is taken on this parent.
  87 */
  88static inline struct audit_parent *audit_find_parent(struct inode *inode)
  89{
  90        struct audit_parent *parent = NULL;
  91        struct fsnotify_mark *entry;
  92
  93        entry = fsnotify_find_mark(&inode->i_fsnotify_marks, audit_watch_group);
  94        if (entry)
  95                parent = container_of(entry, struct audit_parent, mark);
  96
  97        return parent;
  98}
  99
 100void audit_get_watch(struct audit_watch *watch)
 101{
 102        refcount_inc(&watch->count);
 103}
 104
 105void audit_put_watch(struct audit_watch *watch)
 106{
 107        if (refcount_dec_and_test(&watch->count)) {
 108                WARN_ON(watch->parent);
 109                WARN_ON(!list_empty(&watch->rules));
 110                kfree(watch->path);
 111                kfree(watch);
 112        }
 113}
 114
 115static void audit_remove_watch(struct audit_watch *watch)
 116{
 117        list_del(&watch->wlist);
 118        audit_put_parent(watch->parent);
 119        watch->parent = NULL;
 120        audit_put_watch(watch); /* match initial get */
 121}
 122
 123char *audit_watch_path(struct audit_watch *watch)
 124{
 125        return watch->path;
 126}
 127
 128int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
 129{
 130        return (watch->ino != AUDIT_INO_UNSET) &&
 131                (watch->ino == ino) &&
 132                (watch->dev == dev);
 133}
 134
 135/* Initialize a parent watch entry. */
 136static struct audit_parent *audit_init_parent(struct path *path)
 137{
 138        struct inode *inode = d_backing_inode(path->dentry);
 139        struct audit_parent *parent;
 140        int ret;
 141
 142        parent = kzalloc(sizeof(*parent), GFP_KERNEL);
 143        if (unlikely(!parent))
 144                return ERR_PTR(-ENOMEM);
 145
 146        INIT_LIST_HEAD(&parent->watches);
 147
 148        fsnotify_init_mark(&parent->mark, audit_watch_group);
 149        parent->mark.mask = AUDIT_FS_WATCH;
 150        ret = fsnotify_add_inode_mark(&parent->mark, inode, 0);
 151        if (ret < 0) {
 152                audit_free_parent(parent);
 153                return ERR_PTR(ret);
 154        }
 155
 156        return parent;
 157}
 158
 159/* Initialize a watch entry. */
 160static struct audit_watch *audit_init_watch(char *path)
 161{
 162        struct audit_watch *watch;
 163
 164        watch = kzalloc(sizeof(*watch), GFP_KERNEL);
 165        if (unlikely(!watch))
 166                return ERR_PTR(-ENOMEM);
 167
 168        INIT_LIST_HEAD(&watch->rules);
 169        refcount_set(&watch->count, 1);
 170        watch->path = path;
 171        watch->dev = AUDIT_DEV_UNSET;
 172        watch->ino = AUDIT_INO_UNSET;
 173
 174        return watch;
 175}
 176
 177/* Translate a watch string to kernel representation. */
 178int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op)
 179{
 180        struct audit_watch *watch;
 181
 182        if (!audit_watch_group)
 183                return -EOPNOTSUPP;
 184
 185        if (path[0] != '/' || path[len-1] == '/' ||
 186            krule->listnr != AUDIT_FILTER_EXIT ||
 187            op != Audit_equal ||
 188            krule->inode_f || krule->watch || krule->tree)
 189                return -EINVAL;
 190
 191        watch = audit_init_watch(path);
 192        if (IS_ERR(watch))
 193                return PTR_ERR(watch);
 194
 195        krule->watch = watch;
 196
 197        return 0;
 198}
 199
 200/* Duplicate the given audit watch.  The new watch's rules list is initialized
 201 * to an empty list and wlist is undefined. */
 202static struct audit_watch *audit_dupe_watch(struct audit_watch *old)
 203{
 204        char *path;
 205        struct audit_watch *new;
 206
 207        path = kstrdup(old->path, GFP_KERNEL);
 208        if (unlikely(!path))
 209                return ERR_PTR(-ENOMEM);
 210
 211        new = audit_init_watch(path);
 212        if (IS_ERR(new)) {
 213                kfree(path);
 214                goto out;
 215        }
 216
 217        new->dev = old->dev;
 218        new->ino = old->ino;
 219        audit_get_parent(old->parent);
 220        new->parent = old->parent;
 221
 222out:
 223        return new;
 224}
 225
 226static void audit_watch_log_rule_change(struct audit_krule *r, struct audit_watch *w, char *op)
 227{
 228        struct audit_buffer *ab;
 229
 230        if (!audit_enabled)
 231                return;
 232        ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE);
 233        if (!ab)
 234                return;
 235        audit_log_session_info(ab);
 236        audit_log_format(ab, "op=%s path=", op);
 237        audit_log_untrustedstring(ab, w->path);
 238        audit_log_key(ab, r->filterkey);
 239        audit_log_format(ab, " list=%d res=1", r->listnr);
 240        audit_log_end(ab);
 241}
 242
 243/* Update inode info in audit rules based on filesystem event. */
 244static void audit_update_watch(struct audit_parent *parent,
 245                               const struct qstr *dname, dev_t dev,
 246                               unsigned long ino, unsigned invalidating)
 247{
 248        struct audit_watch *owatch, *nwatch, *nextw;
 249        struct audit_krule *r, *nextr;
 250        struct audit_entry *oentry, *nentry;
 251
 252        mutex_lock(&audit_filter_mutex);
 253        /* Run all of the watches on this parent looking for the one that
 254         * matches the given dname */
 255        list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
 256                if (audit_compare_dname_path(dname, owatch->path,
 257                                             AUDIT_NAME_FULL))
 258                        continue;
 259
 260                /* If the update involves invalidating rules, do the inode-based
 261                 * filtering now, so we don't omit records. */
 262                if (invalidating && !audit_dummy_context())
 263                        audit_filter_inodes(current, audit_context());
 264
 265                /* updating ino will likely change which audit_hash_list we
 266                 * are on so we need a new watch for the new list */
 267                nwatch = audit_dupe_watch(owatch);
 268                if (IS_ERR(nwatch)) {
 269                        mutex_unlock(&audit_filter_mutex);
 270                        audit_panic("error updating watch, skipping");
 271                        return;
 272                }
 273                nwatch->dev = dev;
 274                nwatch->ino = ino;
 275
 276                list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) {
 277
 278                        oentry = container_of(r, struct audit_entry, rule);
 279                        list_del(&oentry->rule.rlist);
 280                        list_del_rcu(&oentry->list);
 281
 282                        nentry = audit_dupe_rule(&oentry->rule);
 283                        if (IS_ERR(nentry)) {
 284                                list_del(&oentry->rule.list);
 285                                audit_panic("error updating watch, removing");
 286                        } else {
 287                                int h = audit_hash_ino((u32)ino);
 288
 289                                /*
 290                                 * nentry->rule.watch == oentry->rule.watch so
 291                                 * we must drop that reference and set it to our
 292                                 * new watch.
 293                                 */
 294                                audit_put_watch(nentry->rule.watch);
 295                                audit_get_watch(nwatch);
 296                                nentry->rule.watch = nwatch;
 297                                list_add(&nentry->rule.rlist, &nwatch->rules);
 298                                list_add_rcu(&nentry->list, &audit_inode_hash[h]);
 299                                list_replace(&oentry->rule.list,
 300                                             &nentry->rule.list);
 301                        }
 302                        if (oentry->rule.exe)
 303                                audit_remove_mark(oentry->rule.exe);
 304
 305                        call_rcu(&oentry->rcu, audit_free_rule_rcu);
 306                }
 307
 308                audit_remove_watch(owatch);
 309                goto add_watch_to_parent; /* event applies to a single watch */
 310        }
 311        mutex_unlock(&audit_filter_mutex);
 312        return;
 313
 314add_watch_to_parent:
 315        list_add(&nwatch->wlist, &parent->watches);
 316        mutex_unlock(&audit_filter_mutex);
 317        return;
 318}
 319
 320/* Remove all watches & rules associated with a parent that is going away. */
 321static void audit_remove_parent_watches(struct audit_parent *parent)
 322{
 323        struct audit_watch *w, *nextw;
 324        struct audit_krule *r, *nextr;
 325        struct audit_entry *e;
 326
 327        mutex_lock(&audit_filter_mutex);
 328        list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
 329                list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
 330                        e = container_of(r, struct audit_entry, rule);
 331                        audit_watch_log_rule_change(r, w, "remove_rule");
 332                        if (e->rule.exe)
 333                                audit_remove_mark(e->rule.exe);
 334                        list_del(&r->rlist);
 335                        list_del(&r->list);
 336                        list_del_rcu(&e->list);
 337                        call_rcu(&e->rcu, audit_free_rule_rcu);
 338                }
 339                audit_remove_watch(w);
 340        }
 341        mutex_unlock(&audit_filter_mutex);
 342
 343        fsnotify_destroy_mark(&parent->mark, audit_watch_group);
 344}
 345
 346/* Get path information necessary for adding watches. */
 347static int audit_get_nd(struct audit_watch *watch, struct path *parent)
 348{
 349        struct dentry *d = kern_path_locked(watch->path, parent);
 350        if (IS_ERR(d))
 351                return PTR_ERR(d);
 352        if (d_is_positive(d)) {
 353                /* update watch filter fields */
 354                watch->dev = d->d_sb->s_dev;
 355                watch->ino = d_backing_inode(d)->i_ino;
 356        }
 357        inode_unlock(d_backing_inode(parent->dentry));
 358        dput(d);
 359        return 0;
 360}
 361
 362/* Associate the given rule with an existing parent.
 363 * Caller must hold audit_filter_mutex. */
 364static void audit_add_to_parent(struct audit_krule *krule,
 365                                struct audit_parent *parent)
 366{
 367        struct audit_watch *w, *watch = krule->watch;
 368        int watch_found = 0;
 369
 370        BUG_ON(!mutex_is_locked(&audit_filter_mutex));
 371
 372        list_for_each_entry(w, &parent->watches, wlist) {
 373                if (strcmp(watch->path, w->path))
 374                        continue;
 375
 376                watch_found = 1;
 377
 378                /* put krule's ref to temporary watch */
 379                audit_put_watch(watch);
 380
 381                audit_get_watch(w);
 382                krule->watch = watch = w;
 383
 384                audit_put_parent(parent);
 385                break;
 386        }
 387
 388        if (!watch_found) {
 389                watch->parent = parent;
 390
 391                audit_get_watch(watch);
 392                list_add(&watch->wlist, &parent->watches);
 393        }
 394        list_add(&krule->rlist, &watch->rules);
 395}
 396
 397/* Find a matching watch entry, or add this one.
 398 * Caller must hold audit_filter_mutex. */
 399int audit_add_watch(struct audit_krule *krule, struct list_head **list)
 400{
 401        struct audit_watch *watch = krule->watch;
 402        struct audit_parent *parent;
 403        struct path parent_path;
 404        int h, ret = 0;
 405
 406        /*
 407         * When we will be calling audit_add_to_parent, krule->watch might have
 408         * been updated and watch might have been freed.
 409         * So we need to keep a reference of watch.
 410         */
 411        audit_get_watch(watch);
 412
 413        mutex_unlock(&audit_filter_mutex);
 414
 415        /* Avoid calling path_lookup under audit_filter_mutex. */
 416        ret = audit_get_nd(watch, &parent_path);
 417
 418        /* caller expects mutex locked */
 419        mutex_lock(&audit_filter_mutex);
 420
 421        if (ret) {
 422                audit_put_watch(watch);
 423                return ret;
 424        }
 425
 426        /* either find an old parent or attach a new one */
 427        parent = audit_find_parent(d_backing_inode(parent_path.dentry));
 428        if (!parent) {
 429                parent = audit_init_parent(&parent_path);
 430                if (IS_ERR(parent)) {
 431                        ret = PTR_ERR(parent);
 432                        goto error;
 433                }
 434        }
 435
 436        audit_add_to_parent(krule, parent);
 437
 438        h = audit_hash_ino((u32)watch->ino);
 439        *list = &audit_inode_hash[h];
 440error:
 441        path_put(&parent_path);
 442        audit_put_watch(watch);
 443        return ret;
 444}
 445
 446void audit_remove_watch_rule(struct audit_krule *krule)
 447{
 448        struct audit_watch *watch = krule->watch;
 449        struct audit_parent *parent = watch->parent;
 450
 451        list_del(&krule->rlist);
 452
 453        if (list_empty(&watch->rules)) {
 454                /*
 455                 * audit_remove_watch() drops our reference to 'parent' which
 456                 * can get freed. Grab our own reference to be safe.
 457                 */
 458                audit_get_parent(parent);
 459                audit_remove_watch(watch);
 460                if (list_empty(&parent->watches))
 461                        fsnotify_destroy_mark(&parent->mark, audit_watch_group);
 462                audit_put_parent(parent);
 463        }
 464}
 465
 466/* Update watch data in audit rules based on fsnotify events. */
 467static int audit_watch_handle_event(struct fsnotify_mark *inode_mark, u32 mask,
 468                                    struct inode *inode, struct inode *dir,
 469                                    const struct qstr *dname)
 470{
 471        struct audit_parent *parent;
 472
 473        parent = container_of(inode_mark, struct audit_parent, mark);
 474
 475        if (WARN_ON_ONCE(inode_mark->group != audit_watch_group) ||
 476            WARN_ON_ONCE(!inode))
 477                return 0;
 478
 479        if (mask & (FS_CREATE|FS_MOVED_TO) && inode)
 480                audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
 481        else if (mask & (FS_DELETE|FS_MOVED_FROM))
 482                audit_update_watch(parent, dname, AUDIT_DEV_UNSET, AUDIT_INO_UNSET, 1);
 483        else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF))
 484                audit_remove_parent_watches(parent);
 485
 486        return 0;
 487}
 488
 489static const struct fsnotify_ops audit_watch_fsnotify_ops = {
 490        .handle_inode_event =   audit_watch_handle_event,
 491        .free_mark =            audit_watch_free_mark,
 492};
 493
 494static int __init audit_watch_init(void)
 495{
 496        audit_watch_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops);
 497        if (IS_ERR(audit_watch_group)) {
 498                audit_watch_group = NULL;
 499                audit_panic("cannot create audit fsnotify group");
 500        }
 501        return 0;
 502}
 503device_initcall(audit_watch_init);
 504
 505int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old)
 506{
 507        struct audit_fsnotify_mark *audit_mark;
 508        char *pathname;
 509
 510        pathname = kstrdup(audit_mark_path(old->exe), GFP_KERNEL);
 511        if (!pathname)
 512                return -ENOMEM;
 513
 514        audit_mark = audit_alloc_mark(new, pathname, strlen(pathname));
 515        if (IS_ERR(audit_mark)) {
 516                kfree(pathname);
 517                return PTR_ERR(audit_mark);
 518        }
 519        new->exe = audit_mark;
 520
 521        return 0;
 522}
 523
 524int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
 525{
 526        struct file *exe_file;
 527        unsigned long ino;
 528        dev_t dev;
 529
 530        exe_file = get_task_exe_file(tsk);
 531        if (!exe_file)
 532                return 0;
 533        ino = file_inode(exe_file)->i_ino;
 534        dev = file_inode(exe_file)->i_sb->s_dev;
 535        fput(exe_file);
 536        return audit_mark_compare(mark, ino, dev);
 537}
 538