Commit | Line | Data |
---|---|---|
7f492942 RGB |
1 | /* audit_fsnotify.c -- tracking inodes |
2 | * | |
3 | * Copyright 2003-2009,2014-2015 Red Hat, Inc. | |
4 | * Copyright 2005 Hewlett-Packard Development Company, L.P. | |
5 | * Copyright 2005 IBM Corporation | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or modify | |
8 | * it under the terms of the GNU General Public License as published by | |
9 | * the Free Software Foundation; either version 2 of the License, or | |
10 | * (at your option) any later version. | |
11 | * | |
12 | * This program is distributed in the hope that it will be useful, | |
13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
15 | * GNU General Public License for more details. | |
16 | */ | |
17 | ||
18 | #include <linux/kernel.h> | |
19 | #include <linux/audit.h> | |
20 | #include <linux/kthread.h> | |
21 | #include <linux/mutex.h> | |
22 | #include <linux/fs.h> | |
23 | #include <linux/fsnotify_backend.h> | |
24 | #include <linux/namei.h> | |
25 | #include <linux/netlink.h> | |
26 | #include <linux/sched.h> | |
27 | #include <linux/slab.h> | |
28 | #include <linux/security.h> | |
29 | #include "audit.h" | |
30 | ||
31 | /* | |
32 | * this mark lives on the parent directory of the inode in question. | |
33 | * but dev, ino, and path are about the child | |
34 | */ | |
35 | struct audit_fsnotify_mark { | |
36 | dev_t dev; /* associated superblock device */ | |
37 | unsigned long ino; /* associated inode number */ | |
38 | char *path; /* insertion path */ | |
39 | struct fsnotify_mark mark; /* fsnotify mark on the inode */ | |
40 | struct audit_krule *rule; | |
41 | }; | |
42 | ||
43 | /* fsnotify handle. */ | |
44 | static struct fsnotify_group *audit_fsnotify_group; | |
45 | ||
46 | /* fsnotify events we care about. */ | |
47 | #define AUDIT_FS_EVENTS (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\ | |
48 | FS_MOVE_SELF | FS_EVENT_ON_CHILD) | |
49 | ||
50 | static void audit_fsnotify_mark_free(struct audit_fsnotify_mark *audit_mark) | |
51 | { | |
52 | kfree(audit_mark->path); | |
53 | kfree(audit_mark); | |
54 | } | |
55 | ||
56 | static void audit_fsnotify_free_mark(struct fsnotify_mark *mark) | |
57 | { | |
58 | struct audit_fsnotify_mark *audit_mark; | |
59 | ||
60 | audit_mark = container_of(mark, struct audit_fsnotify_mark, mark); | |
61 | audit_fsnotify_mark_free(audit_mark); | |
62 | } | |
63 | ||
64 | char *audit_mark_path(struct audit_fsnotify_mark *mark) | |
65 | { | |
66 | return mark->path; | |
67 | } | |
68 | ||
69 | int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev) | |
70 | { | |
71 | if (mark->ino == AUDIT_INO_UNSET) | |
72 | return 0; | |
73 | return (mark->ino == ino) && (mark->dev == dev); | |
74 | } | |
75 | ||
76 | static void audit_update_mark(struct audit_fsnotify_mark *audit_mark, | |
77 | struct inode *inode) | |
78 | { | |
79 | audit_mark->dev = inode ? inode->i_sb->s_dev : AUDIT_DEV_UNSET; | |
80 | audit_mark->ino = inode ? inode->i_ino : AUDIT_INO_UNSET; | |
81 | } | |
82 | ||
83 | struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len) | |
84 | { | |
85 | struct audit_fsnotify_mark *audit_mark; | |
86 | struct path path; | |
87 | struct dentry *dentry; | |
88 | struct inode *inode; | |
89 | int ret; | |
90 | ||
91 | if (pathname[0] != '/' || pathname[len-1] == '/') | |
92 | return ERR_PTR(-EINVAL); | |
93 | ||
94 | dentry = kern_path_locked(pathname, &path); | |
95 | if (IS_ERR(dentry)) | |
96 | return (void *)dentry; /* returning an error */ | |
97 | inode = path.dentry->d_inode; | |
5955102c | 98 | inode_unlock(inode); |
7f492942 RGB |
99 | |
100 | audit_mark = kzalloc(sizeof(*audit_mark), GFP_KERNEL); | |
101 | if (unlikely(!audit_mark)) { | |
102 | audit_mark = ERR_PTR(-ENOMEM); | |
103 | goto out; | |
104 | } | |
105 | ||
106 | fsnotify_init_mark(&audit_mark->mark, audit_fsnotify_free_mark); | |
107 | audit_mark->mark.mask = AUDIT_FS_EVENTS; | |
108 | audit_mark->path = pathname; | |
109 | audit_update_mark(audit_mark, dentry->d_inode); | |
110 | audit_mark->rule = krule; | |
111 | ||
112 | ret = fsnotify_add_mark(&audit_mark->mark, audit_fsnotify_group, inode, NULL, true); | |
113 | if (ret < 0) { | |
114 | audit_fsnotify_mark_free(audit_mark); | |
115 | audit_mark = ERR_PTR(ret); | |
116 | } | |
117 | out: | |
118 | dput(dentry); | |
119 | path_put(&path); | |
120 | return audit_mark; | |
121 | } | |
122 | ||
123 | static void audit_mark_log_rule_change(struct audit_fsnotify_mark *audit_mark, char *op) | |
124 | { | |
125 | struct audit_buffer *ab; | |
126 | struct audit_krule *rule = audit_mark->rule; | |
127 | ||
128 | if (!audit_enabled) | |
129 | return; | |
130 | ab = audit_log_start(NULL, GFP_NOFS, AUDIT_CONFIG_CHANGE); | |
131 | if (unlikely(!ab)) | |
132 | return; | |
133 | audit_log_format(ab, "auid=%u ses=%u op=", | |
134 | from_kuid(&init_user_ns, audit_get_loginuid(current)), | |
135 | audit_get_sessionid(current)); | |
136 | audit_log_string(ab, op); | |
137 | audit_log_format(ab, " path="); | |
138 | audit_log_untrustedstring(ab, audit_mark->path); | |
139 | audit_log_key(ab, rule->filterkey); | |
140 | audit_log_format(ab, " list=%d res=1", rule->listnr); | |
141 | audit_log_end(ab); | |
142 | } | |
143 | ||
144 | void audit_remove_mark(struct audit_fsnotify_mark *audit_mark) | |
145 | { | |
146 | fsnotify_destroy_mark(&audit_mark->mark, audit_fsnotify_group); | |
147 | fsnotify_put_mark(&audit_mark->mark); | |
148 | } | |
149 | ||
150 | void audit_remove_mark_rule(struct audit_krule *krule) | |
151 | { | |
152 | struct audit_fsnotify_mark *mark = krule->exe; | |
153 | ||
154 | audit_remove_mark(mark); | |
155 | } | |
156 | ||
157 | static void audit_autoremove_mark_rule(struct audit_fsnotify_mark *audit_mark) | |
158 | { | |
159 | struct audit_krule *rule = audit_mark->rule; | |
160 | struct audit_entry *entry = container_of(rule, struct audit_entry, rule); | |
161 | ||
162 | audit_mark_log_rule_change(audit_mark, "autoremove_rule"); | |
163 | audit_del_rule(entry); | |
164 | } | |
165 | ||
166 | /* Update mark data in audit rules based on fsnotify events. */ | |
167 | static int audit_mark_handle_event(struct fsnotify_group *group, | |
168 | struct inode *to_tell, | |
169 | struct fsnotify_mark *inode_mark, | |
170 | struct fsnotify_mark *vfsmount_mark, | |
171 | u32 mask, void *data, int data_type, | |
172 | const unsigned char *dname, u32 cookie) | |
173 | { | |
174 | struct audit_fsnotify_mark *audit_mark; | |
175 | struct inode *inode = NULL; | |
176 | ||
177 | audit_mark = container_of(inode_mark, struct audit_fsnotify_mark, mark); | |
178 | ||
179 | BUG_ON(group != audit_fsnotify_group); | |
180 | ||
181 | switch (data_type) { | |
182 | case (FSNOTIFY_EVENT_PATH): | |
183 | inode = ((struct path *)data)->dentry->d_inode; | |
184 | break; | |
185 | case (FSNOTIFY_EVENT_INODE): | |
186 | inode = (struct inode *)data; | |
187 | break; | |
188 | default: | |
189 | BUG(); | |
190 | return 0; | |
191 | }; | |
192 | ||
193 | if (mask & (FS_CREATE|FS_MOVED_TO|FS_DELETE|FS_MOVED_FROM)) { | |
194 | if (audit_compare_dname_path(dname, audit_mark->path, AUDIT_NAME_FULL)) | |
195 | return 0; | |
196 | audit_update_mark(audit_mark, inode); | |
197 | } else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF)) | |
198 | audit_autoremove_mark_rule(audit_mark); | |
199 | ||
200 | return 0; | |
201 | } | |
202 | ||
203 | static const struct fsnotify_ops audit_mark_fsnotify_ops = { | |
204 | .handle_event = audit_mark_handle_event, | |
205 | }; | |
206 | ||
207 | static int __init audit_fsnotify_init(void) | |
208 | { | |
209 | audit_fsnotify_group = fsnotify_alloc_group(&audit_mark_fsnotify_ops); | |
210 | if (IS_ERR(audit_fsnotify_group)) { | |
211 | audit_fsnotify_group = NULL; | |
212 | audit_panic("cannot create audit fsnotify group"); | |
213 | } | |
214 | return 0; | |
215 | } | |
216 | device_initcall(audit_fsnotify_init); |