1#include "audit.h" 2#include <linux/fsnotify_backend.h> 3#include <linux/namei.h> 4#include <linux/mount.h> 5#include <linux/kthread.h> 6#include <linux/slab.h> 7 8struct audit_tree; 9struct audit_chunk; 10 11struct audit_tree { 12 atomic_t count; 13 int goner; 14 struct audit_chunk *root; 15 struct list_head chunks; 16 struct list_head rules; 17 struct list_head list; 18 struct list_head same_root; 19 struct rcu_head head; 20 char pathname[]; 21}; 22 23struct audit_chunk { 24 struct list_head hash; 25 struct fsnotify_mark mark; 26 struct list_head trees; /* with root here */ 27 int dead; 28 int count; 29 atomic_long_t refs; 30 struct rcu_head head; 31 struct node { 32 struct list_head list; 33 struct audit_tree *owner; 34 unsigned index; /* index; upper bit indicates 'will prune' */ 35 } owners[]; 36}; 37 38static LIST_HEAD(tree_list); 39static LIST_HEAD(prune_list); 40static struct task_struct *prune_thread; 41 42/* 43 * One struct chunk is attached to each inode of interest. 44 * We replace struct chunk on tagging/untagging. 45 * Rules have pointer to struct audit_tree. 46 * Rules have struct list_head rlist forming a list of rules over 47 * the same tree. 48 * References to struct chunk are collected at audit_inode{,_child}() 49 * time and used in AUDIT_TREE rule matching. 50 * These references are dropped at the same time we are calling 51 * audit_free_names(), etc. 52 * 53 * Cyclic lists galore: 54 * tree.chunks anchors chunk.owners[].list hash_lock 55 * tree.rules anchors rule.rlist audit_filter_mutex 56 * chunk.trees anchors tree.same_root hash_lock 57 * chunk.hash is a hash with middle bits of watch.inode as 58 * a hash function. RCU, hash_lock 59 * 60 * tree is refcounted; one reference for "some rules on rules_list refer to 61 * it", one for each chunk with pointer to it. 62 * 63 * chunk is refcounted by embedded fsnotify_mark + .refs (non-zero refcount 64 * of watch contributes 1 to .refs). 65 * 66 * node.index allows to get from node.list to containing chunk. 67 * MSB of that sucker is stolen to mark taggings that we might have to 68 * revert - several operations have very unpleasant cleanup logics and 69 * that makes a difference. Some. 70 */ 71 72static struct fsnotify_group *audit_tree_group; 73 74static struct audit_tree *alloc_tree(const char *s) 75{ 76 struct audit_tree *tree; 77 78 tree = kmalloc(sizeof(struct audit_tree) + strlen(s) + 1, GFP_KERNEL); 79 if (tree) { 80 atomic_set(&tree->count, 1); 81 tree->goner = 0; 82 INIT_LIST_HEAD(&tree->chunks); 83 INIT_LIST_HEAD(&tree->rules); 84 INIT_LIST_HEAD(&tree->list); 85 INIT_LIST_HEAD(&tree->same_root); 86 tree->root = NULL; 87 strcpy(tree->pathname, s); 88 } 89 return tree; 90} 91 92static inline void get_tree(struct audit_tree *tree) 93{ 94 atomic_inc(&tree->count); 95} 96 97static inline void put_tree(struct audit_tree *tree) 98{ 99 if (atomic_dec_and_test(&tree->count)) 100 kfree_rcu(tree, head); 101} 102 103/* to avoid bringing the entire thing in audit.h */ 104const char *audit_tree_path(struct audit_tree *tree) 105{ 106 return tree->pathname; 107} 108 109static void free_chunk(struct audit_chunk *chunk) 110{ 111 int i; 112 113 for (i = 0; i < chunk->count; i++) { 114 if (chunk->owners[i].owner) 115 put_tree(chunk->owners[i].owner); 116 } 117 kfree(chunk); 118} 119 120void audit_put_chunk(struct audit_chunk *chunk) 121{ 122 if (atomic_long_dec_and_test(&chunk->refs)) 123 free_chunk(chunk); 124} 125 126static void __put_chunk(struct rcu_head *rcu) 127{ 128 struct audit_chunk *chunk = container_of(rcu, struct audit_chunk, head); 129 audit_put_chunk(chunk); 130} 131 132static void audit_tree_destroy_watch(struct fsnotify_mark *entry) 133{ 134 struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark); 135 call_rcu(&chunk->head, __put_chunk); 136} 137 138static struct audit_chunk *alloc_chunk(int count) 139{ 140 struct audit_chunk *chunk; 141 size_t size; 142 int i; 143 144 size = offsetof(struct audit_chunk, owners) + count * sizeof(struct node); 145 chunk = kzalloc(size, GFP_KERNEL); 146 if (!chunk) 147 return NULL; 148 149 INIT_LIST_HEAD(&chunk->hash); 150 INIT_LIST_HEAD(&chunk->trees); 151 chunk->count = count; 152 atomic_long_set(&chunk->refs, 1); 153 for (i = 0; i < count; i++) { 154 INIT_LIST_HEAD(&chunk->owners[i].list); 155 chunk->owners[i].index = i; 156 } 157 fsnotify_init_mark(&chunk->mark, audit_tree_destroy_watch); 158 chunk->mark.mask = FS_IN_IGNORED; 159 return chunk; 160} 161 162enum {HASH_SIZE = 128}; 163static struct list_head chunk_hash_heads[HASH_SIZE]; 164static __cacheline_aligned_in_smp DEFINE_SPINLOCK(hash_lock); 165 166static inline struct list_head *chunk_hash(const struct inode *inode) 167{ 168 unsigned long n = (unsigned long)inode / L1_CACHE_BYTES; 169 return chunk_hash_heads + n % HASH_SIZE; 170} 171 172/* hash_lock & entry->lock is held by caller */ 173static void insert_hash(struct audit_chunk *chunk) 174{ 175 struct fsnotify_mark *entry = &chunk->mark; 176 struct list_head *list; 177 178 if (!entry->inode) 179 return; 180 list = chunk_hash(entry->inode); 181 list_add_rcu(&chunk->hash, list); 182} 183 184/* called under rcu_read_lock */ 185struct audit_chunk *audit_tree_lookup(const struct inode *inode) 186{ 187 struct list_head *list = chunk_hash(inode); 188 struct audit_chunk *p; 189 190 list_for_each_entry_rcu(p, list, hash) { 191 /* mark.inode may have gone NULL, but who cares? */ 192 if (p->mark.inode == inode) { 193 atomic_long_inc(&p->refs); 194 return p; 195 } 196 } 197 return NULL; 198} 199 200bool audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree) 201{ 202 int n; 203 for (n = 0; n < chunk->count; n++) 204 if (chunk->owners[n].owner == tree) 205 return true; 206 return false; 207} 208 209/* tagging and untagging inodes with trees */ 210 211static struct audit_chunk *find_chunk(struct node *p) 212{ 213 int index = p->index & ~(1U<<31); 214 p -= index; 215 return container_of(p, struct audit_chunk, owners[0]); 216} 217 218static void untag_chunk(struct node *p) 219{ 220 struct audit_chunk *chunk = find_chunk(p); 221 struct fsnotify_mark *entry = &chunk->mark; 222 struct audit_chunk *new = NULL; 223 struct audit_tree *owner; 224 int size = chunk->count - 1; 225 int i, j; 226 227 fsnotify_get_mark(entry); 228 229 spin_unlock(&hash_lock); 230 231 if (size) 232 new = alloc_chunk(size); 233 234 spin_lock(&entry->lock); 235 if (chunk->dead || !entry->inode) { 236 spin_unlock(&entry->lock); 237 if (new) 238 free_chunk(new); 239 goto out; 240 } 241 242 owner = p->owner; 243 244 if (!size) { 245 chunk->dead = 1; 246 spin_lock(&hash_lock); 247 list_del_init(&chunk->trees); 248 if (owner->root == chunk) 249 owner->root = NULL; 250 list_del_init(&p->list); 251 list_del_rcu(&chunk->hash); 252 spin_unlock(&hash_lock); 253 spin_unlock(&entry->lock); 254 fsnotify_destroy_mark(entry, audit_tree_group); 255 goto out; 256 } 257 258 if (!new) 259 goto Fallback; 260 261 fsnotify_duplicate_mark(&new->mark, entry); 262 if (fsnotify_add_mark(&new->mark, new->mark.group, new->mark.inode, NULL, 1)) { 263 fsnotify_put_mark(&new->mark); 264 goto Fallback; 265 } 266 267 chunk->dead = 1; 268 spin_lock(&hash_lock); 269 list_replace_init(&chunk->trees, &new->trees); 270 if (owner->root == chunk) { 271 list_del_init(&owner->same_root); 272 owner->root = NULL; 273 } 274 275 for (i = j = 0; j <= size; i++, j++) { 276 struct audit_tree *s; 277 if (&chunk->owners[j] == p) { 278 list_del_init(&p->list); 279 i--; 280 continue; 281 } 282 s = chunk->owners[j].owner; 283 new->owners[i].owner = s; 284 new->owners[i].index = chunk->owners[j].index - j + i; 285 if (!s) /* result of earlier fallback */ 286 continue; 287 get_tree(s); 288 list_replace_init(&chunk->owners[j].list, &new->owners[i].list); 289 } 290 291 list_replace_rcu(&chunk->hash, &new->hash); 292 list_for_each_entry(owner, &new->trees, same_root) 293 owner->root = new; 294 spin_unlock(&hash_lock); 295 spin_unlock(&entry->lock); 296 fsnotify_destroy_mark(entry, audit_tree_group); 297 fsnotify_put_mark(&new->mark); /* drop initial reference */ 298 goto out; 299 300Fallback: 301 // do the best we can 302 spin_lock(&hash_lock); 303 if (owner->root == chunk) { 304 list_del_init(&owner->same_root); 305 owner->root = NULL; 306 } 307 list_del_init(&p->list); 308 p->owner = NULL; 309 put_tree(owner); 310 spin_unlock(&hash_lock); 311 spin_unlock(&entry->lock); 312out: 313 fsnotify_put_mark(entry); 314 spin_lock(&hash_lock); 315} 316 317static int create_chunk(struct inode *inode, struct audit_tree *tree) 318{ 319 struct fsnotify_mark *entry; 320 struct audit_chunk *chunk = alloc_chunk(1); 321 if (!chunk) 322 return -ENOMEM; 323 324 entry = &chunk->mark; 325 if (fsnotify_add_mark(entry, audit_tree_group, inode, NULL, 0)) { 326 fsnotify_put_mark(entry); 327 return -ENOSPC; 328 } 329 330 spin_lock(&entry->lock); 331 spin_lock(&hash_lock); 332 if (tree->goner) { 333 spin_unlock(&hash_lock); 334 chunk->dead = 1; 335 spin_unlock(&entry->lock); 336 fsnotify_destroy_mark(entry, audit_tree_group); 337 fsnotify_put_mark(entry); 338 return 0; 339 } 340 chunk->owners[0].index = (1U << 31); 341 chunk->owners[0].owner = tree; 342 get_tree(tree); 343 list_add(&chunk->owners[0].list, &tree->chunks); 344 if (!tree->root) { 345 tree->root = chunk; 346 list_add(&tree->same_root, &chunk->trees); 347 } 348 insert_hash(chunk); 349 spin_unlock(&hash_lock); 350 spin_unlock(&entry->lock); 351 fsnotify_put_mark(entry); /* drop initial reference */ 352 return 0; 353} 354 355/* the first tagged inode becomes root of tree */ 356static int tag_chunk(struct inode *inode, struct audit_tree *tree) 357{ 358 struct fsnotify_mark *old_entry, *chunk_entry; 359 struct audit_tree *owner; 360 struct audit_chunk *chunk, *old; 361 struct node *p; 362 int n; 363 364 old_entry = fsnotify_find_inode_mark(audit_tree_group, inode); 365 if (!old_entry) 366 return create_chunk(inode, tree); 367 368 old = container_of(old_entry, struct audit_chunk, mark); 369 370 /* are we already there? */ 371 spin_lock(&hash_lock); 372 for (n = 0; n < old->count; n++) { 373 if (old->owners[n].owner == tree) { 374 spin_unlock(&hash_lock); 375 fsnotify_put_mark(old_entry); 376 return 0; 377 } 378 } 379 spin_unlock(&hash_lock); 380 381 chunk = alloc_chunk(old->count + 1); 382 if (!chunk) { 383 fsnotify_put_mark(old_entry); 384 return -ENOMEM; 385 } 386 387 chunk_entry = &chunk->mark; 388 389 spin_lock(&old_entry->lock); 390 if (!old_entry->inode) { 391 /* old_entry is being shot, lets just lie */ 392 spin_unlock(&old_entry->lock); 393 fsnotify_put_mark(old_entry); 394 free_chunk(chunk); 395 return -ENOENT; 396 } 397 398 fsnotify_duplicate_mark(chunk_entry, old_entry); 399 if (fsnotify_add_mark(chunk_entry, chunk_entry->group, chunk_entry->inode, NULL, 1)) { 400 spin_unlock(&old_entry->lock); 401 fsnotify_put_mark(chunk_entry); 402 fsnotify_put_mark(old_entry); 403 return -ENOSPC; 404 } 405 406 /* even though we hold old_entry->lock, this is safe since chunk_entry->lock could NEVER have been grabbed before */ 407 spin_lock(&chunk_entry->lock); 408 spin_lock(&hash_lock); 409 410 /* we now hold old_entry->lock, chunk_entry->lock, and hash_lock */ 411 if (tree->goner) { 412 spin_unlock(&hash_lock); 413 chunk->dead = 1; 414 spin_unlock(&chunk_entry->lock); 415 spin_unlock(&old_entry->lock); 416 417 fsnotify_destroy_mark(chunk_entry, audit_tree_group); 418 419 fsnotify_put_mark(chunk_entry); 420 fsnotify_put_mark(old_entry); 421 return 0; 422 } 423 list_replace_init(&old->trees, &chunk->trees); 424 for (n = 0, p = chunk->owners; n < old->count; n++, p++) { 425 struct audit_tree *s = old->owners[n].owner; 426 p->owner = s; 427 p->index = old->owners[n].index; 428 if (!s) /* result of fallback in untag */ 429 continue; 430 get_tree(s); 431 list_replace_init(&old->owners[n].list, &p->list); 432 } 433 p->index = (chunk->count - 1) | (1U<<31); 434 p->owner = tree; 435 get_tree(tree); 436 list_add(&p->list, &tree->chunks); 437 list_replace_rcu(&old->hash, &chunk->hash); 438 list_for_each_entry(owner, &chunk->trees, same_root) 439 owner->root = chunk; 440 old->dead = 1; 441 if (!tree->root) { 442 tree->root = chunk; 443 list_add(&tree->same_root, &chunk->trees); 444 } 445 spin_unlock(&hash_lock); 446 spin_unlock(&chunk_entry->lock); 447 spin_unlock(&old_entry->lock); 448 fsnotify_destroy_mark(old_entry, audit_tree_group); 449 fsnotify_put_mark(chunk_entry); /* drop initial reference */ 450 fsnotify_put_mark(old_entry); /* pair to fsnotify_find mark_entry */ 451 return 0; 452} 453 454static void audit_tree_log_remove_rule(struct audit_krule *rule) 455{ 456 struct audit_buffer *ab; 457 458 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE); 459 if (unlikely(!ab)) 460 return; 461 audit_log_format(ab, "op="); 462 audit_log_string(ab, "remove_rule"); 463 audit_log_format(ab, " dir="); 464 audit_log_untrustedstring(ab, rule->tree->pathname); 465 audit_log_key(ab, rule->filterkey); 466 audit_log_format(ab, " list=%d res=1", rule->listnr); 467 audit_log_end(ab); 468} 469 470static void kill_rules(struct audit_tree *tree) 471{ 472 struct audit_krule *rule, *next; 473 struct audit_entry *entry; 474 475 list_for_each_entry_safe(rule, next, &tree->rules, rlist) { 476 entry = container_of(rule, struct audit_entry, rule); 477 478 list_del_init(&rule->rlist); 479 if (rule->tree) { 480 /* not a half-baked one */ 481 audit_tree_log_remove_rule(rule); 482 if (entry->rule.exe) 483 audit_remove_mark(entry->rule.exe); 484 rule->tree = NULL; 485 list_del_rcu(&entry->list); 486 list_del(&entry->rule.list); 487 call_rcu(&entry->rcu, audit_free_rule_rcu); 488 } 489 } 490} 491 492/* 493 * finish killing struct audit_tree 494 */ 495static void prune_one(struct audit_tree *victim) 496{ 497 spin_lock(&hash_lock); 498 while (!list_empty(&victim->chunks)) { 499 struct node *p; 500 501 p = list_entry(victim->chunks.next, struct node, list); 502 503 untag_chunk(p); 504 } 505 spin_unlock(&hash_lock); 506 put_tree(victim); 507} 508 509/* trim the uncommitted chunks from tree */ 510 511static void trim_marked(struct audit_tree *tree) 512{ 513 struct list_head *p, *q; 514 spin_lock(&hash_lock); 515 if (tree->goner) { 516 spin_unlock(&hash_lock); 517 return; 518 } 519 /* reorder */ 520 for (p = tree->chunks.next; p != &tree->chunks; p = q) { 521 struct node *node = list_entry(p, struct node, list); 522 q = p->next; 523 if (node->index & (1U<<31)) { 524 list_del_init(p); 525 list_add(p, &tree->chunks); 526 } 527 } 528 529 while (!list_empty(&tree->chunks)) { 530 struct node *node; 531 532 node = list_entry(tree->chunks.next, struct node, list); 533 534 /* have we run out of marked? */ 535 if (!(node->index & (1U<<31))) 536 break; 537 538 untag_chunk(node); 539 } 540 if (!tree->root && !tree->goner) { 541 tree->goner = 1; 542 spin_unlock(&hash_lock); 543 mutex_lock(&audit_filter_mutex); 544 kill_rules(tree); 545 list_del_init(&tree->list); 546 mutex_unlock(&audit_filter_mutex); 547 prune_one(tree); 548 } else { 549 spin_unlock(&hash_lock); 550 } 551} 552 553static void audit_schedule_prune(void); 554 555/* called with audit_filter_mutex */ 556int audit_remove_tree_rule(struct audit_krule *rule) 557{ 558 struct audit_tree *tree; 559 tree = rule->tree; 560 if (tree) { 561 spin_lock(&hash_lock); 562 list_del_init(&rule->rlist); 563 if (list_empty(&tree->rules) && !tree->goner) { 564 tree->root = NULL; 565 list_del_init(&tree->same_root); 566 tree->goner = 1; 567 list_move(&tree->list, &prune_list); 568 rule->tree = NULL; 569 spin_unlock(&hash_lock); 570 audit_schedule_prune(); 571 return 1; 572 } 573 rule->tree = NULL; 574 spin_unlock(&hash_lock); 575 return 1; 576 } 577 return 0; 578} 579 580static int compare_root(struct vfsmount *mnt, void *arg) 581{ 582 return d_backing_inode(mnt->mnt_root) == arg; 583} 584 585void audit_trim_trees(void) 586{ 587 struct list_head cursor; 588 589 mutex_lock(&audit_filter_mutex); 590 list_add(&cursor, &tree_list); 591 while (cursor.next != &tree_list) { 592 struct audit_tree *tree; 593 struct path path; 594 struct vfsmount *root_mnt; 595 struct node *node; 596 int err; 597 598 tree = container_of(cursor.next, struct audit_tree, list); 599 get_tree(tree); 600 list_del(&cursor); 601 list_add(&cursor, &tree->list); 602 mutex_unlock(&audit_filter_mutex); 603 604 err = kern_path(tree->pathname, 0, &path); 605 if (err) 606 goto skip_it; 607 608 root_mnt = collect_mounts(&path); 609 path_put(&path); 610 if (IS_ERR(root_mnt)) 611 goto skip_it; 612 613 spin_lock(&hash_lock); 614 list_for_each_entry(node, &tree->chunks, list) { 615 struct audit_chunk *chunk = find_chunk(node); 616 /* this could be NULL if the watch is dying else where... */ 617 struct inode *inode = chunk->mark.inode; 618 node->index |= 1U<<31; 619 if (iterate_mounts(compare_root, inode, root_mnt)) 620 node->index &= ~(1U<<31); 621 } 622 spin_unlock(&hash_lock); 623 trim_marked(tree); 624 drop_collected_mounts(root_mnt); 625skip_it: 626 put_tree(tree); 627 mutex_lock(&audit_filter_mutex); 628 } 629 list_del(&cursor); 630 mutex_unlock(&audit_filter_mutex); 631} 632 633int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op) 634{ 635 636 if (pathname[0] != '/' || 637 rule->listnr != AUDIT_FILTER_EXIT || 638 op != Audit_equal || 639 rule->inode_f || rule->watch || rule->tree) 640 return -EINVAL; 641 rule->tree = alloc_tree(pathname); 642 if (!rule->tree) 643 return -ENOMEM; 644 return 0; 645} 646 647void audit_put_tree(struct audit_tree *tree) 648{ 649 put_tree(tree); 650} 651 652static int tag_mount(struct vfsmount *mnt, void *arg) 653{ 654 return tag_chunk(d_backing_inode(mnt->mnt_root), arg); 655} 656 657/* 658 * That gets run when evict_chunk() ends up needing to kill audit_tree. 659 * Runs from a separate thread. 660 */ 661static int prune_tree_thread(void *unused) 662{ 663 for (;;) { 664 set_current_state(TASK_INTERRUPTIBLE); 665 if (list_empty(&prune_list)) 666 schedule(); 667 __set_current_state(TASK_RUNNING); 668 669 mutex_lock(&audit_cmd_mutex); 670 mutex_lock(&audit_filter_mutex); 671 672 while (!list_empty(&prune_list)) { 673 struct audit_tree *victim; 674 675 victim = list_entry(prune_list.next, 676 struct audit_tree, list); 677 list_del_init(&victim->list); 678 679 mutex_unlock(&audit_filter_mutex); 680 681 prune_one(victim); 682 683 mutex_lock(&audit_filter_mutex); 684 } 685 686 mutex_unlock(&audit_filter_mutex); 687 mutex_unlock(&audit_cmd_mutex); 688 } 689 return 0; 690} 691 692static int audit_launch_prune(void) 693{ 694 if (prune_thread) 695 return 0; 696 prune_thread = kthread_create(prune_tree_thread, NULL, 697 "audit_prune_tree"); 698 if (IS_ERR(prune_thread)) { 699 pr_err("cannot start thread audit_prune_tree"); 700 prune_thread = NULL; 701 return -ENOMEM; 702 } else { 703 wake_up_process(prune_thread); 704 return 0; 705 } 706} 707 708/* called with audit_filter_mutex */ 709int audit_add_tree_rule(struct audit_krule *rule) 710{ 711 struct audit_tree *seed = rule->tree, *tree; 712 struct path path; 713 struct vfsmount *mnt; 714 int err; 715 716 rule->tree = NULL; 717 list_for_each_entry(tree, &tree_list, list) { 718 if (!strcmp(seed->pathname, tree->pathname)) { 719 put_tree(seed); 720 rule->tree = tree; 721 list_add(&rule->rlist, &tree->rules); 722 return 0; 723 } 724 } 725 tree = seed; 726 list_add(&tree->list, &tree_list); 727 list_add(&rule->rlist, &tree->rules); 728 /* do not set rule->tree yet */ 729 mutex_unlock(&audit_filter_mutex); 730 731 if (unlikely(!prune_thread)) { 732 err = audit_launch_prune(); 733 if (err) 734 goto Err; 735 } 736 737 err = kern_path(tree->pathname, 0, &path); 738 if (err) 739 goto Err; 740 mnt = collect_mounts(&path); 741 path_put(&path); 742 if (IS_ERR(mnt)) { 743 err = PTR_ERR(mnt); 744 goto Err; 745 } 746 747 get_tree(tree); 748 err = iterate_mounts(tag_mount, tree, mnt); 749 drop_collected_mounts(mnt); 750 751 if (!err) { 752 struct node *node; 753 spin_lock(&hash_lock); 754 list_for_each_entry(node, &tree->chunks, list) 755 node->index &= ~(1U<<31); 756 spin_unlock(&hash_lock); 757 } else { 758 trim_marked(tree); 759 goto Err; 760 } 761 762 mutex_lock(&audit_filter_mutex); 763 if (list_empty(&rule->rlist)) { 764 put_tree(tree); 765 return -ENOENT; 766 } 767 rule->tree = tree; 768 put_tree(tree); 769 770 return 0; 771Err: 772 mutex_lock(&audit_filter_mutex); 773 list_del_init(&tree->list); 774 list_del_init(&tree->rules); 775 put_tree(tree); 776 return err; 777} 778 779int audit_tag_tree(char *old, char *new) 780{ 781 struct list_head cursor, barrier; 782 int failed = 0; 783 struct path path1, path2; 784 struct vfsmount *tagged; 785 int err; 786 787 err = kern_path(new, 0, &path2); 788 if (err) 789 return err; 790 tagged = collect_mounts(&path2); 791 path_put(&path2); 792 if (IS_ERR(tagged)) 793 return PTR_ERR(tagged); 794 795 err = kern_path(old, 0, &path1); 796 if (err) { 797 drop_collected_mounts(tagged); 798 return err; 799 } 800 801 mutex_lock(&audit_filter_mutex); 802 list_add(&barrier, &tree_list); 803 list_add(&cursor, &barrier); 804 805 while (cursor.next != &tree_list) { 806 struct audit_tree *tree; 807 int good_one = 0; 808 809 tree = container_of(cursor.next, struct audit_tree, list); 810 get_tree(tree); 811 list_del(&cursor); 812 list_add(&cursor, &tree->list); 813 mutex_unlock(&audit_filter_mutex); 814 815 err = kern_path(tree->pathname, 0, &path2); 816 if (!err) { 817 good_one = path_is_under(&path1, &path2); 818 path_put(&path2); 819 } 820 821 if (!good_one) { 822 put_tree(tree); 823 mutex_lock(&audit_filter_mutex); 824 continue; 825 } 826 827 failed = iterate_mounts(tag_mount, tree, tagged); 828 if (failed) { 829 put_tree(tree); 830 mutex_lock(&audit_filter_mutex); 831 break; 832 } 833 834 mutex_lock(&audit_filter_mutex); 835 spin_lock(&hash_lock); 836 if (!tree->goner) { 837 list_del(&tree->list); 838 list_add(&tree->list, &tree_list); 839 } 840 spin_unlock(&hash_lock); 841 put_tree(tree); 842 } 843 844 while (barrier.prev != &tree_list) { 845 struct audit_tree *tree; 846 847 tree = container_of(barrier.prev, struct audit_tree, list); 848 get_tree(tree); 849 list_del(&tree->list); 850 list_add(&tree->list, &barrier); 851 mutex_unlock(&audit_filter_mutex); 852 853 if (!failed) { 854 struct node *node; 855 spin_lock(&hash_lock); 856 list_for_each_entry(node, &tree->chunks, list) 857 node->index &= ~(1U<<31); 858 spin_unlock(&hash_lock); 859 } else { 860 trim_marked(tree); 861 } 862 863 put_tree(tree); 864 mutex_lock(&audit_filter_mutex); 865 } 866 list_del(&barrier); 867 list_del(&cursor); 868 mutex_unlock(&audit_filter_mutex); 869 path_put(&path1); 870 drop_collected_mounts(tagged); 871 return failed; 872} 873 874 875static void audit_schedule_prune(void) 876{ 877 wake_up_process(prune_thread); 878} 879 880/* 881 * ... and that one is done if evict_chunk() decides to delay until the end 882 * of syscall. Runs synchronously. 883 */ 884void audit_kill_trees(struct list_head *list) 885{ 886 mutex_lock(&audit_cmd_mutex); 887 mutex_lock(&audit_filter_mutex); 888 889 while (!list_empty(list)) { 890 struct audit_tree *victim; 891 892 victim = list_entry(list->next, struct audit_tree, list); 893 kill_rules(victim); 894 list_del_init(&victim->list); 895 896 mutex_unlock(&audit_filter_mutex); 897 898 prune_one(victim); 899 900 mutex_lock(&audit_filter_mutex); 901 } 902 903 mutex_unlock(&audit_filter_mutex); 904 mutex_unlock(&audit_cmd_mutex); 905} 906 907/* 908 * Here comes the stuff asynchronous to auditctl operations 909 */ 910 911static void evict_chunk(struct audit_chunk *chunk) 912{ 913 struct audit_tree *owner; 914 struct list_head *postponed = audit_killed_trees(); 915 int need_prune = 0; 916 int n; 917 918 if (chunk->dead) 919 return; 920 921 chunk->dead = 1; 922 mutex_lock(&audit_filter_mutex); 923 spin_lock(&hash_lock); 924 while (!list_empty(&chunk->trees)) { 925 owner = list_entry(chunk->trees.next, 926 struct audit_tree, same_root); 927 owner->goner = 1; 928 owner->root = NULL; 929 list_del_init(&owner->same_root); 930 spin_unlock(&hash_lock); 931 if (!postponed) { 932 kill_rules(owner); 933 list_move(&owner->list, &prune_list); 934 need_prune = 1; 935 } else { 936 list_move(&owner->list, postponed); 937 } 938 spin_lock(&hash_lock); 939 } 940 list_del_rcu(&chunk->hash); 941 for (n = 0; n < chunk->count; n++) 942 list_del_init(&chunk->owners[n].list); 943 spin_unlock(&hash_lock); 944 mutex_unlock(&audit_filter_mutex); 945 if (need_prune) 946 audit_schedule_prune(); 947} 948 949static int audit_tree_handle_event(struct fsnotify_group *group, 950 struct inode *to_tell, 951 struct fsnotify_mark *inode_mark, 952 struct fsnotify_mark *vfsmount_mark, 953 u32 mask, void *data, int data_type, 954 const unsigned char *file_name, u32 cookie) 955{ 956 return 0; 957} 958 959static void audit_tree_freeing_mark(struct fsnotify_mark *entry, struct fsnotify_group *group) 960{ 961 struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark); 962 963 evict_chunk(chunk); 964 965 /* 966 * We are guaranteed to have at least one reference to the mark from 967 * either the inode or the caller of fsnotify_destroy_mark(). 968 */ 969 BUG_ON(atomic_read(&entry->refcnt) < 1); 970} 971 972static const struct fsnotify_ops audit_tree_ops = { 973 .handle_event = audit_tree_handle_event, 974 .freeing_mark = audit_tree_freeing_mark, 975}; 976 977static int __init audit_tree_init(void) 978{ 979 int i; 980 981 audit_tree_group = fsnotify_alloc_group(&audit_tree_ops); 982 if (IS_ERR(audit_tree_group)) 983 audit_panic("cannot initialize fsnotify group for rectree watches"); 984 985 for (i = 0; i < HASH_SIZE; i++) 986 INIT_LIST_HEAD(&chunk_hash_heads[i]); 987 988 return 0; 989} 990__initcall(audit_tree_init); 991