1 /* audit_watch.c -- watching inodes
3 * Copyright 2003-2009 Red Hat, Inc.
4 * Copyright 2005 Hewlett-Packard Development Company, L.P.
5 * Copyright 2005 IBM Corporation
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 #include <linux/kernel.h>
23 #include <linux/audit.h>
24 #include <linux/kthread.h>
25 #include <linux/mutex.h>
27 #include <linux/namei.h>
28 #include <linux/netlink.h>
29 #include <linux/sched.h>
30 #include <linux/inotify.h>
31 #include <linux/security.h>
37 * audit_parent: lifetime is from audit_init_parent() to receipt of an IN_IGNORED
38 * event. Each audit_watch holds a reference to its associated parent.
40 * audit_watch: if added to lists, lifetime is from audit_init_watch() to
41 * audit_remove_watch(). Additionally, an audit_watch may exist
42 * temporarily to assist in searching existing filter data. Each
43 * audit_krule holds a reference to its associated watch.
47 atomic_t count
; /* reference count */
48 char *path
; /* insertion path */
49 dev_t dev
; /* associated superblock device */
50 unsigned long ino
; /* associated inode number */
51 struct audit_parent
*parent
; /* associated parent */
52 struct list_head wlist
; /* entry in parent->watches list */
53 struct list_head rules
; /* associated rules */
57 struct list_head ilist
; /* entry in inotify registration list */
58 struct list_head watches
; /* associated watches */
59 struct inotify_watch wdata
; /* inotify watch data */
60 unsigned flags
; /* status flags */
64 struct inotify_handle
*audit_ih
;
67 * audit_parent status flags:
69 * AUDIT_PARENT_INVALID - set anytime rules/watches are auto-removed due to
70 * a filesystem event to ensure we're adding audit watches to a valid parent.
71 * Technically not needed for IN_DELETE_SELF or IN_UNMOUNT events, as we cannot
72 * receive them while we have nameidata, but must be used for IN_MOVE_SELF which
73 * we can receive while holding nameidata.
75 #define AUDIT_PARENT_INVALID 0x001
77 /* Inotify events we care about. */
78 #define AUDIT_IN_WATCH IN_MOVE|IN_CREATE|IN_DELETE|IN_DELETE_SELF|IN_MOVE_SELF
80 static void audit_free_parent(struct inotify_watch
*i_watch
)
82 struct audit_parent
*parent
;
84 parent
= container_of(i_watch
, struct audit_parent
, wdata
);
85 WARN_ON(!list_empty(&parent
->watches
));
89 void audit_get_watch(struct audit_watch
*watch
)
91 atomic_inc(&watch
->count
);
94 void audit_put_watch(struct audit_watch
*watch
)
96 if (atomic_dec_and_test(&watch
->count
)) {
97 WARN_ON(watch
->parent
);
98 WARN_ON(!list_empty(&watch
->rules
));
104 void audit_remove_watch(struct audit_watch
*watch
)
106 list_del(&watch
->wlist
);
107 put_inotify_watch(&watch
->parent
->wdata
);
108 watch
->parent
= NULL
;
109 audit_put_watch(watch
); /* match initial get */
112 char *audit_watch_path(struct audit_watch
*watch
)
117 struct list_head
*audit_watch_rules(struct audit_watch
*watch
)
119 return &watch
->rules
;
122 unsigned long audit_watch_inode(struct audit_watch
*watch
)
127 dev_t
audit_watch_dev(struct audit_watch
*watch
)
132 /* Initialize a parent watch entry. */
133 static struct audit_parent
*audit_init_parent(struct nameidata
*ndp
)
135 struct audit_parent
*parent
;
138 parent
= kzalloc(sizeof(*parent
), GFP_KERNEL
);
139 if (unlikely(!parent
))
140 return ERR_PTR(-ENOMEM
);
142 INIT_LIST_HEAD(&parent
->watches
);
145 inotify_init_watch(&parent
->wdata
);
146 /* grab a ref so inotify watch hangs around until we take audit_filter_mutex */
147 get_inotify_watch(&parent
->wdata
);
148 wd
= inotify_add_watch(audit_ih
, &parent
->wdata
,
149 ndp
->path
.dentry
->d_inode
, AUDIT_IN_WATCH
);
151 audit_free_parent(&parent
->wdata
);
158 /* Initialize a watch entry. */
159 static struct audit_watch
*audit_init_watch(char *path
)
161 struct audit_watch
*watch
;
163 watch
= kzalloc(sizeof(*watch
), GFP_KERNEL
);
164 if (unlikely(!watch
))
165 return ERR_PTR(-ENOMEM
);
167 INIT_LIST_HEAD(&watch
->rules
);
168 atomic_set(&watch
->count
, 1);
170 watch
->dev
= (dev_t
)-1;
171 watch
->ino
= (unsigned long)-1;
176 /* Translate a watch string to kernel respresentation. */
177 int audit_to_watch(struct audit_krule
*krule
, char *path
, int len
, u32 op
)
179 struct audit_watch
*watch
;
184 if (path
[0] != '/' || path
[len
-1] == '/' ||
185 krule
->listnr
!= AUDIT_FILTER_EXIT
||
187 krule
->inode_f
|| krule
->watch
|| krule
->tree
)
190 watch
= audit_init_watch(path
);
192 return PTR_ERR(watch
);
194 audit_get_watch(watch
);
195 krule
->watch
= watch
;
200 /* Duplicate the given audit watch. The new watch's rules list is initialized
201 * to an empty list and wlist is undefined. */
202 static struct audit_watch
*audit_dupe_watch(struct audit_watch
*old
)
205 struct audit_watch
*new;
207 path
= kstrdup(old
->path
, GFP_KERNEL
);
209 return ERR_PTR(-ENOMEM
);
211 new = audit_init_watch(path
);
219 get_inotify_watch(&old
->parent
->wdata
);
220 new->parent
= old
->parent
;
226 static void audit_watch_log_rule_change(struct audit_krule
*r
, struct audit_watch
*w
, char *op
)
229 struct audit_buffer
*ab
;
230 ab
= audit_log_start(NULL
, GFP_NOFS
, AUDIT_CONFIG_CHANGE
);
231 audit_log_format(ab
, "auid=%u ses=%u op=",
232 audit_get_loginuid(current
),
233 audit_get_sessionid(current
));
234 audit_log_string(ab
, op
);
235 audit_log_format(ab
, " path=");
236 audit_log_untrustedstring(ab
, w
->path
);
238 audit_log_format(ab
, " key=");
239 audit_log_untrustedstring(ab
, r
->filterkey
);
241 audit_log_format(ab
, " key=(null)");
242 audit_log_format(ab
, " list=%d res=1", r
->listnr
);
247 /* Update inode info in audit rules based on filesystem event. */
248 static void audit_update_watch(struct audit_parent
*parent
,
249 const char *dname
, dev_t dev
,
250 unsigned long ino
, unsigned invalidating
)
252 struct audit_watch
*owatch
, *nwatch
, *nextw
;
253 struct audit_krule
*r
, *nextr
;
254 struct audit_entry
*oentry
, *nentry
;
256 mutex_lock(&audit_filter_mutex
);
257 list_for_each_entry_safe(owatch
, nextw
, &parent
->watches
, wlist
) {
258 if (audit_compare_dname_path(dname
, owatch
->path
, NULL
))
261 /* If the update involves invalidating rules, do the inode-based
262 * filtering now, so we don't omit records. */
263 if (invalidating
&& current
->audit_context
)
264 audit_filter_inodes(current
, current
->audit_context
);
266 nwatch
= audit_dupe_watch(owatch
);
267 if (IS_ERR(nwatch
)) {
268 mutex_unlock(&audit_filter_mutex
);
269 audit_panic("error updating watch, skipping");
275 list_for_each_entry_safe(r
, nextr
, &owatch
->rules
, rlist
) {
277 oentry
= container_of(r
, struct audit_entry
, rule
);
278 list_del(&oentry
->rule
.rlist
);
279 list_del_rcu(&oentry
->list
);
281 nentry
= audit_dupe_rule(&oentry
->rule
, nwatch
);
282 if (IS_ERR(nentry
)) {
283 list_del(&oentry
->rule
.list
);
284 audit_panic("error updating watch, removing");
286 int h
= audit_hash_ino((u32
)ino
);
287 list_add(&nentry
->rule
.rlist
, &nwatch
->rules
);
288 list_add_rcu(&nentry
->list
, &audit_inode_hash
[h
]);
289 list_replace(&oentry
->rule
.list
,
293 audit_watch_log_rule_change(r
, owatch
, "updated rules");
295 call_rcu(&oentry
->rcu
, audit_free_rule_rcu
);
298 audit_remove_watch(owatch
);
299 goto add_watch_to_parent
; /* event applies to a single watch */
301 mutex_unlock(&audit_filter_mutex
);
305 list_add(&nwatch
->wlist
, &parent
->watches
);
306 mutex_unlock(&audit_filter_mutex
);
310 /* Remove all watches & rules associated with a parent that is going away. */
311 static void audit_remove_parent_watches(struct audit_parent
*parent
)
313 struct audit_watch
*w
, *nextw
;
314 struct audit_krule
*r
, *nextr
;
315 struct audit_entry
*e
;
317 mutex_lock(&audit_filter_mutex
);
318 parent
->flags
|= AUDIT_PARENT_INVALID
;
319 list_for_each_entry_safe(w
, nextw
, &parent
->watches
, wlist
) {
320 list_for_each_entry_safe(r
, nextr
, &w
->rules
, rlist
) {
321 e
= container_of(r
, struct audit_entry
, rule
);
322 audit_watch_log_rule_change(r
, w
, "remove rule");
325 list_del_rcu(&e
->list
);
326 call_rcu(&e
->rcu
, audit_free_rule_rcu
);
328 audit_remove_watch(w
);
330 mutex_unlock(&audit_filter_mutex
);
333 /* Unregister inotify watches for parents on in_list.
334 * Generates an IN_IGNORED event. */
335 void audit_inotify_unregister(struct list_head
*in_list
)
337 struct audit_parent
*p
, *n
;
339 list_for_each_entry_safe(p
, n
, in_list
, ilist
) {
341 inotify_rm_watch(audit_ih
, &p
->wdata
);
342 /* the unpin matching the pin in audit_do_del_rule() */
343 unpin_inotify_watch(&p
->wdata
);
347 /* Get path information necessary for adding watches. */
348 static int audit_get_nd(char *path
, struct nameidata
**ndp
, struct nameidata
**ndw
)
350 struct nameidata
*ndparent
, *ndwatch
;
353 ndparent
= kmalloc(sizeof(*ndparent
), GFP_KERNEL
);
354 if (unlikely(!ndparent
))
357 ndwatch
= kmalloc(sizeof(*ndwatch
), GFP_KERNEL
);
358 if (unlikely(!ndwatch
)) {
363 err
= path_lookup(path
, LOOKUP_PARENT
, ndparent
);
370 err
= path_lookup(path
, 0, ndwatch
);
382 /* Release resources used for watch path information. */
383 static void audit_put_nd(struct nameidata
*ndp
, struct nameidata
*ndw
)
386 path_put(&ndp
->path
);
390 path_put(&ndw
->path
);
395 /* Associate the given rule with an existing parent inotify_watch.
396 * Caller must hold audit_filter_mutex. */
397 static void audit_add_to_parent(struct audit_krule
*krule
,
398 struct audit_parent
*parent
)
400 struct audit_watch
*w
, *watch
= krule
->watch
;
403 list_for_each_entry(w
, &parent
->watches
, wlist
) {
404 if (strcmp(watch
->path
, w
->path
))
409 /* put krule's and initial refs to temporary watch */
410 audit_put_watch(watch
);
411 audit_put_watch(watch
);
414 krule
->watch
= watch
= w
;
419 get_inotify_watch(&parent
->wdata
);
420 watch
->parent
= parent
;
422 list_add(&watch
->wlist
, &parent
->watches
);
424 list_add(&krule
->rlist
, &watch
->rules
);
427 /* Find a matching watch entry, or add this one.
428 * Caller must hold audit_filter_mutex. */
429 int audit_add_watch(struct audit_krule
*krule
)
431 struct audit_watch
*watch
= krule
->watch
;
432 struct inotify_watch
*i_watch
;
433 struct audit_parent
*parent
;
434 struct nameidata
*ndp
= NULL
, *ndw
= NULL
;
437 mutex_unlock(&audit_filter_mutex
);
439 /* Avoid calling path_lookup under audit_filter_mutex. */
440 ret
= audit_get_nd(watch
->path
, &ndp
, &ndw
);
442 /* caller expects mutex locked */
443 mutex_lock(&audit_filter_mutex
);
447 /* update watch filter fields */
449 watch
->dev
= ndw
->path
.dentry
->d_inode
->i_sb
->s_dev
;
450 watch
->ino
= ndw
->path
.dentry
->d_inode
->i_ino
;
453 /* The audit_filter_mutex must not be held during inotify calls because
454 * we hold it during inotify event callback processing. If an existing
455 * inotify watch is found, inotify_find_watch() grabs a reference before
458 if (inotify_find_watch(audit_ih
, ndp
->path
.dentry
->d_inode
,
460 parent
= audit_init_parent(ndp
);
461 if (IS_ERR(parent
)) {
462 /* caller expects mutex locked */
463 mutex_lock(&audit_filter_mutex
);
464 ret
= PTR_ERR(parent
);
468 parent
= container_of(i_watch
, struct audit_parent
, wdata
);
470 mutex_lock(&audit_filter_mutex
);
472 /* parent was moved before we took audit_filter_mutex */
473 if (parent
->flags
& AUDIT_PARENT_INVALID
)
476 audit_add_to_parent(krule
, parent
);
478 /* match get in audit_init_parent or inotify_find_watch */
479 put_inotify_watch(&parent
->wdata
);
482 audit_put_nd(ndp
, ndw
); /* NULL args OK */
487 void audit_remove_watch_rule(struct audit_krule
*krule
, struct list_head
*list
)
489 struct audit_watch
*watch
= krule
->watch
;
490 struct audit_parent
*parent
= watch
->parent
;
492 list_del(&krule
->rlist
);
494 if (list_empty(&watch
->rules
)) {
495 audit_remove_watch(watch
);
497 if (list_empty(&parent
->watches
)) {
498 /* Put parent on the inotify un-registration
499 * list. Grab a reference before releasing
500 * audit_filter_mutex, to be released in
501 * audit_inotify_unregister().
502 * If filesystem is going away, just leave
503 * the sucker alone, eviction will take
505 if (pin_inotify_watch(&parent
->wdata
))
506 list_add(&parent
->ilist
, list
);
511 /* Update watch data in audit rules based on inotify events. */
512 static void audit_handle_ievent(struct inotify_watch
*i_watch
, u32 wd
, u32 mask
,
513 u32 cookie
, const char *dname
, struct inode
*inode
)
515 struct audit_parent
*parent
;
517 parent
= container_of(i_watch
, struct audit_parent
, wdata
);
519 if (mask
& (IN_CREATE
|IN_MOVED_TO
) && inode
)
520 audit_update_watch(parent
, dname
, inode
->i_sb
->s_dev
,
522 else if (mask
& (IN_DELETE
|IN_MOVED_FROM
))
523 audit_update_watch(parent
, dname
, (dev_t
)-1, (unsigned long)-1, 1);
524 /* inotify automatically removes the watch and sends IN_IGNORED */
525 else if (mask
& (IN_DELETE_SELF
|IN_UNMOUNT
))
526 audit_remove_parent_watches(parent
);
527 /* inotify does not remove the watch, so remove it manually */
528 else if(mask
& IN_MOVE_SELF
) {
529 audit_remove_parent_watches(parent
);
530 inotify_remove_watch_locked(audit_ih
, i_watch
);
531 } else if (mask
& IN_IGNORED
)
532 put_inotify_watch(i_watch
);
535 static const struct inotify_operations audit_inotify_ops
= {
536 .handle_event
= audit_handle_ievent
,
537 .destroy_watch
= audit_free_parent
,
540 static int __init
audit_watch_init(void)
542 audit_ih
= inotify_init(&audit_inotify_ops
);
543 if (IS_ERR(audit_ih
))
544 audit_panic("cannot initialize inotify handle");
547 subsys_initcall(audit_watch_init
);