kernel/audit_tree.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include "audit.h"
   3 #include <linux/fsnotify_backend.h>
   4 #include <linux/namei.h>
   5 #include <linux/mount.h>
   6 #include <linux/kthread.h>
   7 #include <linux/refcount.h>
   8 #include <linux/slab.h>
   9
  10 struct audit_tree;
  11 struct audit_chunk;
  12
  13 struct audit_tree {
  14         refcount_t count;
  15         int goner;
  16         struct audit_chunk *root;
  17         struct list_head chunks;
  18         struct list_head rules;
  19         struct list_head list;
  20         struct list_head same_root;
  21         struct rcu_head head;
  22         char pathname[];
  23 };
  24
  25 struct audit_chunk {
  26         struct list_head hash;
  27         struct fsnotify_mark mark;
  28         struct list_head trees;         /* with root here */
  29         int dead;
  30         int count;
  31         atomic_long_t refs;
  32         struct rcu_head head;
  33         struct node {
  34                 struct list_head list;
  35                 struct audit_tree *owner;
  36                 unsigned index;         /* index; upper bit indicates 'will prune' */
  37         } owners[];
  38 };
  39
  40 static LIST_HEAD(tree_list);
  41 static LIST_HEAD(prune_list);
  42 static struct task_struct *prune_thread;
  43
  44 /*
  45  * One struct chunk is attached to each inode of interest.
  46  * We replace struct chunk on tagging/untagging.
  47  * Rules have pointer to struct audit_tree.
  48  * Rules have struct list_head rlist forming a list of rules over
  49  * the same tree.
  50  * References to struct chunk are collected at audit_inode{,_child}()
  51  * time and used in AUDIT_TREE rule matching.
  52  * These references are dropped at the same time we are calling
  53  * audit_free_names(), etc.
  54  *
  55  * Cyclic lists galore:
  56  * tree.chunks anchors chunk.owners[].list                      hash_lock
  57  * tree.rules anchors rule.rlist                                audit_filter_mutex
  58  * chunk.trees anchors tree.same_root                           hash_lock
  59  * chunk.hash is a hash with middle bits of watch.inode as
  60  * a hash function.                                             RCU, hash_lock
  61  *
  62  * tree is refcounted; one reference for "some rules on rules_list refer to
  63  * it", one for each chunk with pointer to it.
  64  *
  65  * chunk is refcounted by embedded fsnotify_mark + .refs (non-zero refcount
  66  * of watch contributes 1 to .refs).
  67  *
  68  * node.index allows to get from node.list to containing chunk.
  69  * MSB of that sucker is stolen to mark taggings that we might have to
  70  * revert - several operations have very unpleasant cleanup logics and
  71  * that makes a difference.  Some.
  72  */
  73
  74 static struct fsnotify_group *audit_tree_group;
  75
  76 static struct audit_tree *alloc_tree(const char *s)
  77 {
  78         struct audit_tree *tree;
  79
  80         tree = kmalloc(sizeof(struct audit_tree) + strlen(s) + 1, GFP_KERNEL);
  81         if (tree) {
  82                 refcount_set(&tree->count, 1);
  83                 tree->goner = 0;
  84                 INIT_LIST_HEAD(&tree->chunks);
  85                 INIT_LIST_HEAD(&tree->rules);
  86                 INIT_LIST_HEAD(&tree->list);
  87                 INIT_LIST_HEAD(&tree->same_root);
  88                 tree->root = NULL;
  89                 strcpy(tree->pathname, s);
  90         }
  91         return tree;
  92 }
  93
  94 static inline void get_tree(struct audit_tree *tree)
  95 {
  96         refcount_inc(&tree->count);
  97 }
  98
  99 static inline void put_tree(struct audit_tree *tree)
 100 {
 101         if (refcount_dec_and_test(&tree->count))
 102                 kfree_rcu(tree, head);
 103 }
 104
 105 /* to avoid bringing the entire thing in audit.h */
 106 const char *audit_tree_path(struct audit_tree *tree)
 107 {
 108         return tree->pathname;
 109 }
 110
 111 static void free_chunk(struct audit_chunk *chunk)
 112 {
 113         int i;
 114
 115         for (i = 0; i < chunk->count; i++) {
 116                 if (chunk->owners[i].owner)
 117                         put_tree(chunk->owners[i].owner);
 118         }
 119         kfree(chunk);
 120 }
 121
 122 void audit_put_chunk(struct audit_chunk *chunk)
 123 {
 124         if (atomic_long_dec_and_test(&chunk->refs))
 125                 free_chunk(chunk);
 126 }
 127
 128 static void __put_chunk(struct rcu_head *rcu)
 129 {
 130         struct audit_chunk *chunk = container_of(rcu, struct audit_chunk, head);
 131         audit_put_chunk(chunk);
 132 }
 133
 134 static void audit_tree_destroy_watch(struct fsnotify_mark *entry)
 135 {
 136         struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
 137         call_rcu(&chunk->head, __put_chunk);
 138 }
 139
 140 static struct audit_chunk *alloc_chunk(int count)
 141 {
 142         struct audit_chunk *chunk;
 143         size_t size;
 144         int i;
 145
 146         size = offsetof(struct audit_chunk, owners) + count * sizeof(struct node);
 147         chunk = kzalloc(size, GFP_KERNEL);
 148         if (!chunk)
 149                 return NULL;
 150
 151         INIT_LIST_HEAD(&chunk->hash);
 152         INIT_LIST_HEAD(&chunk->trees);
 153         chunk->count = count;
 154         atomic_long_set(&chunk->refs, 1);
 155         for (i = 0; i < count; i++) {
 156                 INIT_LIST_HEAD(&chunk->owners[i].list);
 157                 chunk->owners[i].index = i;
 158         }
 159         fsnotify_init_mark(&chunk->mark, audit_tree_group);
 160         chunk->mark.mask = FS_IN_IGNORED;
 161         return chunk;
 162 }
 163
 164 enum {HASH_SIZE = 128};
 165 static struct list_head chunk_hash_heads[HASH_SIZE];
 166 static __cacheline_aligned_in_smp DEFINE_SPINLOCK(hash_lock);
 167
 168 /* Function to return search key in our hash from inode. */
 169 static unsigned long inode_to_key(const struct inode *inode)
 170 {
 171         return (unsigned long)inode;
 172 }
 173
 174 /*
 175  * Function to return search key in our hash from chunk. Key 0 is special and
 176  * should never be present in the hash.
 177  */
 178 static unsigned long chunk_to_key(struct audit_chunk *chunk)
 179 {
 180         /*
 181          * We have a reference to the mark so it should be attached to a
 182          * connector.
 183          */
 184         if (WARN_ON_ONCE(!chunk->mark.connector))
 185                 return 0;
 186         return (unsigned long)chunk->mark.connector->inode;
 187 }
 188
 189 static inline struct list_head *chunk_hash(unsigned long key)
 190 {
 191         unsigned long n = key / L1_CACHE_BYTES;
 192         return chunk_hash_heads + n % HASH_SIZE;
 193 }
 194
 195 /* hash_lock & entry->lock is held by caller */
 196 static void insert_hash(struct audit_chunk *chunk)
 197 {
 198         unsigned long key = chunk_to_key(chunk);
 199         struct list_head *list;
 200
 201         if (!(chunk->mark.flags & FSNOTIFY_MARK_FLAG_ATTACHED))
 202                 return;
 203         list = chunk_hash(key);
 204         list_add_rcu(&chunk->hash, list);
 205 }
 206
 207 /* called under rcu_read_lock */
 208 struct audit_chunk *audit_tree_lookup(const struct inode *inode)
 209 {
 210         unsigned long key = inode_to_key(inode);
 211         struct list_head *list = chunk_hash(key);
 212         struct audit_chunk *p;
 213
 214         list_for_each_entry_rcu(p, list, hash) {
 215                 if (chunk_to_key(p) == key) {
 216                         atomic_long_inc(&p->refs);
 217                         return p;
 218                 }
 219         }
 220         return NULL;
 221 }
 222
 223 bool audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree)
 224 {
 225         int n;
 226         for (n = 0; n < chunk->count; n++)
 227                 if (chunk->owners[n].owner == tree)
 228                         return true;
 229         return false;
 230 }
 231
 232 /* tagging and untagging inodes with trees */
 233
 234 static struct audit_chunk *find_chunk(struct node *p)
 235 {
 236         int index = p->index & ~(1U<<31);
 237         p -= index;
 238         return container_of(p, struct audit_chunk, owners[0]);
 239 }
 240
 241 static void untag_chunk(struct node *p)
 242 {
 243         struct audit_chunk *chunk = find_chunk(p);
 244         struct fsnotify_mark *entry = &chunk->mark;
 245         struct audit_chunk *new = NULL;
 246         struct audit_tree *owner;
 247         int size = chunk->count - 1;
 248         int i, j;
 249
 250         fsnotify_get_mark(entry);
 251
 252         spin_unlock(&hash_lock);
 253
 254         if (size)
 255                 new = alloc_chunk(size);
 256
 257         mutex_lock(&entry->group->mark_mutex);
 258         spin_lock(&entry->lock);
 259         /*
 260          * mark_mutex protects mark from getting detached and thus also from
 261          * mark->connector->inode getting NULL.
 262          */
 263         if (chunk->dead || !(entry->flags & FSNOTIFY_MARK_FLAG_ATTACHED)) {
 264                 spin_unlock(&entry->lock);
 265                 mutex_unlock(&entry->group->mark_mutex);
 266                 if (new)
 267                         fsnotify_put_mark(&new->mark);
 268                 goto out;
 269         }
 270
 271         owner = p->owner;
 272
 273         if (!size) {
 274                 chunk->dead = 1;
 275                 spin_lock(&hash_lock);
 276                 list_del_init(&chunk->trees);
 277                 if (owner->root == chunk)
 278                         owner->root = NULL;
 279                 list_del_init(&p->list);
 280                 list_del_rcu(&chunk->hash);
 281                 spin_unlock(&hash_lock);
 282                 spin_unlock(&entry->lock);
 283                 mutex_unlock(&entry->group->mark_mutex);
 284                 fsnotify_destroy_mark(entry, audit_tree_group);
 285                 goto out;
 286         }
 287
 288         if (!new)
 289                 goto Fallback;
 290
 291         if (fsnotify_add_inode_mark_locked(&new->mark, entry->connector->inode,
 292                                            1)) {
 293                 fsnotify_put_mark(&new->mark);
 294                 goto Fallback;
 295         }
 296
 297         chunk->dead = 1;
 298         spin_lock(&hash_lock);
 299         list_replace_init(&chunk->trees, &new->trees);
 300         if (owner->root == chunk) {
 301                 list_del_init(&owner->same_root);
 302                 owner->root = NULL;
 303         }
 304
 305         for (i = j = 0; j <= size; i++, j++) {
 306                 struct audit_tree *s;
 307                 if (&chunk->owners[j] == p) {
 308                         list_del_init(&p->list);
 309                         i--;
 310                         continue;
 311                 }
 312                 s = chunk->owners[j].owner;
 313                 new->owners[i].owner = s;
 314                 new->owners[i].index = chunk->owners[j].index - j + i;
 315                 if (!s) /* result of earlier fallback */
 316                         continue;
 317                 get_tree(s);
 318                 list_replace_init(&chunk->owners[j].list, &new->owners[i].list);
 319         }
 320
 321         list_replace_rcu(&chunk->hash, &new->hash);
 322         list_for_each_entry(owner, &new->trees, same_root)
 323                 owner->root = new;
 324         spin_unlock(&hash_lock);
 325         spin_unlock(&entry->lock);
 326         mutex_unlock(&entry->group->mark_mutex);
 327         fsnotify_destroy_mark(entry, audit_tree_group);
 328         fsnotify_put_mark(&new->mark);  /* drop initial reference */
 329         goto out;
 330
 331 Fallback:
 332         // do the best we can
 333         spin_lock(&hash_lock);
 334         if (owner->root == chunk) {
 335                 list_del_init(&owner->same_root);
 336                 owner->root = NULL;
 337         }
 338         list_del_init(&p->list);
 339         p->owner = NULL;
 340         put_tree(owner);
 341         spin_unlock(&hash_lock);
 342         spin_unlock(&entry->lock);
 343         mutex_unlock(&entry->group->mark_mutex);
 344 out:
 345         fsnotify_put_mark(entry);
 346         spin_lock(&hash_lock);
 347 }
 348
 349 static int create_chunk(struct inode *inode, struct audit_tree *tree)
 350 {
 351         struct fsnotify_mark *entry;
 352         struct audit_chunk *chunk = alloc_chunk(1);
 353         if (!chunk)
 354                 return -ENOMEM;
 355
 356         entry = &chunk->mark;
 357         if (fsnotify_add_inode_mark(entry, inode, 0)) {
 358                 fsnotify_put_mark(entry);
 359                 return -ENOSPC;
 360         }
 361
 362         spin_lock(&entry->lock);
 363         spin_lock(&hash_lock);
 364         if (tree->goner) {
 365                 spin_unlock(&hash_lock);
 366                 chunk->dead = 1;
 367                 spin_unlock(&entry->lock);
 368                 fsnotify_destroy_mark(entry, audit_tree_group);
 369                 fsnotify_put_mark(entry);
 370                 return 0;
 371         }
 372         chunk->owners[0].index = (1U << 31);
 373         chunk->owners[0].owner = tree;
 374         get_tree(tree);
 375         list_add(&chunk->owners[0].list, &tree->chunks);
 376         if (!tree->root) {
 377                 tree->root = chunk;
 378                 list_add(&tree->same_root, &chunk->trees);
 379         }
 380         insert_hash(chunk);
 381         spin_unlock(&hash_lock);
 382         spin_unlock(&entry->lock);
 383         fsnotify_put_mark(entry);       /* drop initial reference */
 384         return 0;
 385 }
 386
 387 /* the first tagged inode becomes root of tree */
 388 static int tag_chunk(struct inode *inode, struct audit_tree *tree)
 389 {
 390         struct fsnotify_mark *old_entry, *chunk_entry;
 391         struct audit_tree *owner;
 392         struct audit_chunk *chunk, *old;
 393         struct node *p;
 394         int n;
 395
 396         old_entry = fsnotify_find_mark(&inode->i_fsnotify_marks,
 397                                        audit_tree_group);
 398         if (!old_entry)
 399                 return create_chunk(inode, tree);
 400
 401         old = container_of(old_entry, struct audit_chunk, mark);
 402
 403         /* are we already there? */
 404         spin_lock(&hash_lock);
 405         for (n = 0; n < old->count; n++) {
 406                 if (old->owners[n].owner == tree) {
 407                         spin_unlock(&hash_lock);
 408                         fsnotify_put_mark(old_entry);
 409                         return 0;
 410                 }
 411         }
 412         spin_unlock(&hash_lock);
 413
 414         chunk = alloc_chunk(old->count + 1);
 415         if (!chunk) {
 416                 fsnotify_put_mark(old_entry);
 417                 return -ENOMEM;
 418         }
 419
 420         chunk_entry = &chunk->mark;
 421
 422         mutex_lock(&old_entry->group->mark_mutex);
 423         spin_lock(&old_entry->lock);
 424         /*
 425          * mark_mutex protects mark from getting detached and thus also from
 426          * mark->connector->inode getting NULL.
 427          */
 428         if (!(old_entry->flags & FSNOTIFY_MARK_FLAG_ATTACHED)) {
 429                 /* old_entry is being shot, lets just lie */
 430                 spin_unlock(&old_entry->lock);
 431                 mutex_unlock(&old_entry->group->mark_mutex);
 432                 fsnotify_put_mark(old_entry);
 433                 fsnotify_put_mark(&chunk->mark);
 434                 return -ENOENT;
 435         }
 436
 437         if (fsnotify_add_inode_mark_locked(chunk_entry,
 438                              old_entry->connector->inode, 1)) {
 439                 spin_unlock(&old_entry->lock);
 440                 mutex_unlock(&old_entry->group->mark_mutex);
 441                 fsnotify_put_mark(chunk_entry);
 442                 fsnotify_put_mark(old_entry);
 443                 return -ENOSPC;
 444         }
 445
 446         /* even though we hold old_entry->lock, this is safe since chunk_entry->lock could NEVER have been grabbed before */
 447         spin_lock(&chunk_entry->lock);
 448         spin_lock(&hash_lock);
 449
 450         /* we now hold old_entry->lock, chunk_entry->lock, and hash_lock */
 451         if (tree->goner) {
 452                 spin_unlock(&hash_lock);
 453                 chunk->dead = 1;
 454                 spin_unlock(&chunk_entry->lock);
 455                 spin_unlock(&old_entry->lock);
 456                 mutex_unlock(&old_entry->group->mark_mutex);
 457
 458                 fsnotify_destroy_mark(chunk_entry, audit_tree_group);
 459
 460                 fsnotify_put_mark(chunk_entry);
 461                 fsnotify_put_mark(old_entry);
 462                 return 0;
 463         }
 464         list_replace_init(&old->trees, &chunk->trees);
 465         for (n = 0, p = chunk->owners; n < old->count; n++, p++) {
 466                 struct audit_tree *s = old->owners[n].owner;
 467                 p->owner = s;
 468                 p->index = old->owners[n].index;
 469                 if (!s) /* result of fallback in untag */
 470                         continue;
 471                 get_tree(s);
 472                 list_replace_init(&old->owners[n].list, &p->list);
 473         }
 474         p->index = (chunk->count - 1) | (1U<<31);
 475         p->owner = tree;
 476         get_tree(tree);
 477         list_add(&p->list, &tree->chunks);
 478         list_replace_rcu(&old->hash, &chunk->hash);
 479         list_for_each_entry(owner, &chunk->trees, same_root)
 480                 owner->root = chunk;
 481         old->dead = 1;
 482         if (!tree->root) {
 483                 tree->root = chunk;
 484                 list_add(&tree->same_root, &chunk->trees);
 485         }
 486         spin_unlock(&hash_lock);
 487         spin_unlock(&chunk_entry->lock);
 488         spin_unlock(&old_entry->lock);
 489         mutex_unlock(&old_entry->group->mark_mutex);
 490         fsnotify_destroy_mark(old_entry, audit_tree_group);
 491         fsnotify_put_mark(chunk_entry); /* drop initial reference */
 492         fsnotify_put_mark(old_entry); /* pair to fsnotify_find mark_entry */
 493         return 0;
 494 }
 495
 496 static void audit_tree_log_remove_rule(struct audit_krule *rule)
 497 {
 498         struct audit_buffer *ab;
 499
 500         if (!audit_enabled)
 501                 return;
 502         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
 503         if (unlikely(!ab))
 504                 return;
 505         audit_log_format(ab, "op=remove_rule");
 506         audit_log_format(ab, " dir=");
 507         audit_log_untrustedstring(ab, rule->tree->pathname);
 508         audit_log_key(ab, rule->filterkey);
 509         audit_log_format(ab, " list=%d res=1", rule->listnr);
 510         audit_log_end(ab);
 511 }
 512
 513 static void kill_rules(struct audit_tree *tree)
 514 {
 515         struct audit_krule *rule, *next;
 516         struct audit_entry *entry;
 517
 518         list_for_each_entry_safe(rule, next, &tree->rules, rlist) {
 519                 entry = container_of(rule, struct audit_entry, rule);
 520
 521                 list_del_init(&rule->rlist);
 522                 if (rule->tree) {
 523                         /* not a half-baked one */
 524                         audit_tree_log_remove_rule(rule);
 525                         if (entry->rule.exe)
 526                                 audit_remove_mark(entry->rule.exe);
 527                         rule->tree = NULL;
 528                         list_del_rcu(&entry->list);
 529                         list_del(&entry->rule.list);
 530                         call_rcu(&entry->rcu, audit_free_rule_rcu);
 531                 }
 532         }
 533 }
 534
 535 /*
 536  * finish killing struct audit_tree
 537  */
 538 static void prune_one(struct audit_tree *victim)
 539 {
 540         spin_lock(&hash_lock);
 541         while (!list_empty(&victim->chunks)) {
 542                 struct node *p;
 543
 544                 p = list_entry(victim->chunks.next, struct node, list);
 545
 546                 untag_chunk(p);
 547         }
 548         spin_unlock(&hash_lock);
 549         put_tree(victim);
 550 }
 551
 552 /* trim the uncommitted chunks from tree */
 553
 554 static void trim_marked(struct audit_tree *tree)
 555 {
 556         struct list_head *p, *q;
 557         spin_lock(&hash_lock);
 558         if (tree->goner) {
 559                 spin_unlock(&hash_lock);
 560                 return;
 561         }
 562         /* reorder */
 563         for (p = tree->chunks.next; p != &tree->chunks; p = q) {
 564                 struct node *node = list_entry(p, struct node, list);
 565                 q = p->next;
 566                 if (node->index & (1U<<31)) {
 567                         list_del_init(p);
 568                         list_add(p, &tree->chunks);
 569                 }
 570         }
 571
 572         while (!list_empty(&tree->chunks)) {
 573                 struct node *node;
 574
 575                 node = list_entry(tree->chunks.next, struct node, list);
 576
 577                 /* have we run out of marked? */
 578                 if (!(node->index & (1U<<31)))
 579                         break;
 580
 581                 untag_chunk(node);
 582         }
 583         if (!tree->root && !tree->goner) {
 584                 tree->goner = 1;
 585                 spin_unlock(&hash_lock);
 586                 mutex_lock(&audit_filter_mutex);
 587                 kill_rules(tree);
 588                 list_del_init(&tree->list);
 589                 mutex_unlock(&audit_filter_mutex);
 590                 prune_one(tree);
 591         } else {
 592                 spin_unlock(&hash_lock);
 593         }
 594 }
 595
 596 static void audit_schedule_prune(void);
 597
 598 /* called with audit_filter_mutex */
 599 int audit_remove_tree_rule(struct audit_krule *rule)
 600 {
 601         struct audit_tree *tree;
 602         tree = rule->tree;
 603         if (tree) {
 604                 spin_lock(&hash_lock);
 605                 list_del_init(&rule->rlist);
 606                 if (list_empty(&tree->rules) && !tree->goner) {
 607                         tree->root = NULL;
 608                         list_del_init(&tree->same_root);
 609                         tree->goner = 1;
 610                         list_move(&tree->list, &prune_list);
 611                         rule->tree = NULL;
 612                         spin_unlock(&hash_lock);
 613                         audit_schedule_prune();
 614                         return 1;
 615                 }
 616                 rule->tree = NULL;
 617                 spin_unlock(&hash_lock);
 618                 return 1;
 619         }
 620         return 0;
 621 }
 622
 623 static int compare_root(struct vfsmount *mnt, void *arg)
 624 {
 625         return inode_to_key(d_backing_inode(mnt->mnt_root)) ==
 626                (unsigned long)arg;
 627 }
 628
 629 void audit_trim_trees(void)
 630 {
 631         struct list_head cursor;
 632
 633         mutex_lock(&audit_filter_mutex);
 634         list_add(&cursor, &tree_list);
 635         while (cursor.next != &tree_list) {
 636                 struct audit_tree *tree;
 637                 struct path path;
 638                 struct vfsmount *root_mnt;
 639                 struct node *node;
 640                 int err;
 641
 642                 tree = container_of(cursor.next, struct audit_tree, list);
 643                 get_tree(tree);
 644                 list_del(&cursor);
 645                 list_add(&cursor, &tree->list);
 646                 mutex_unlock(&audit_filter_mutex);
 647
 648                 err = kern_path(tree->pathname, 0, &path);
 649                 if (err)
 650                         goto skip_it;
 651
 652                 root_mnt = collect_mounts(&path);
 653                 path_put(&path);
 654                 if (IS_ERR(root_mnt))
 655                         goto skip_it;
 656
 657                 spin_lock(&hash_lock);
 658                 list_for_each_entry(node, &tree->chunks, list) {
 659                         struct audit_chunk *chunk = find_chunk(node);
 660                         /* this could be NULL if the watch is dying else where... */
 661                         node->index |= 1U<<31;
 662                         if (iterate_mounts(compare_root,
 663                                            (void *)chunk_to_key(chunk),
 664                                            root_mnt))
 665                                 node->index &= ~(1U<<31);
 666                 }
 667                 spin_unlock(&hash_lock);
 668                 trim_marked(tree);
 669                 drop_collected_mounts(root_mnt);
 670 skip_it:
 671                 put_tree(tree);
 672                 mutex_lock(&audit_filter_mutex);
 673         }
 674         list_del(&cursor);
 675         mutex_unlock(&audit_filter_mutex);
 676 }
 677
 678 int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op)
 679 {
 680
 681         if (pathname[0] != '/' ||
 682             rule->listnr != AUDIT_FILTER_EXIT ||
 683             op != Audit_equal ||
 684             rule->inode_f || rule->watch || rule->tree)
 685                 return -EINVAL;
 686         rule->tree = alloc_tree(pathname);
 687         if (!rule->tree)
 688                 return -ENOMEM;
 689         return 0;
 690 }
 691
 692 void audit_put_tree(struct audit_tree *tree)
 693 {
 694         put_tree(tree);
 695 }
 696
 697 static int tag_mount(struct vfsmount *mnt, void *arg)
 698 {
 699         return tag_chunk(d_backing_inode(mnt->mnt_root), arg);
 700 }
 701
 702 /*
 703  * That gets run when evict_chunk() ends up needing to kill audit_tree.
 704  * Runs from a separate thread.
 705  */
 706 static int prune_tree_thread(void *unused)
 707 {
 708         for (;;) {
 709                 if (list_empty(&prune_list)) {
 710                         set_current_state(TASK_INTERRUPTIBLE);
 711                         schedule();
 712                 }
 713
 714                 audit_ctl_lock();
 715                 mutex_lock(&audit_filter_mutex);
 716
 717                 while (!list_empty(&prune_list)) {
 718                         struct audit_tree *victim;
 719
 720                         victim = list_entry(prune_list.next,
 721                                         struct audit_tree, list);
 722                         list_del_init(&victim->list);
 723
 724                         mutex_unlock(&audit_filter_mutex);
 725
 726                         prune_one(victim);
 727
 728                         mutex_lock(&audit_filter_mutex);
 729                 }
 730
 731                 mutex_unlock(&audit_filter_mutex);
 732                 audit_ctl_unlock();
 733         }
 734         return 0;
 735 }
 736
 737 static int audit_launch_prune(void)
 738 {
 739         if (prune_thread)
 740                 return 0;
 741         prune_thread = kthread_run(prune_tree_thread, NULL,
 742                                 "audit_prune_tree");
 743         if (IS_ERR(prune_thread)) {
 744                 pr_err("cannot start thread audit_prune_tree");
 745                 prune_thread = NULL;
 746                 return -ENOMEM;
 747         }
 748         return 0;
 749 }
 750
 751 /* called with audit_filter_mutex */
 752 int audit_add_tree_rule(struct audit_krule *rule)
 753 {
 754         struct audit_tree *seed = rule->tree, *tree;
 755         struct path path;
 756         struct vfsmount *mnt;
 757         int err;
 758
 759         rule->tree = NULL;
 760         list_for_each_entry(tree, &tree_list, list) {
 761                 if (!strcmp(seed->pathname, tree->pathname)) {
 762                         put_tree(seed);
 763                         rule->tree = tree;
 764                         list_add(&rule->rlist, &tree->rules);
 765                         return 0;
 766                 }
 767         }
 768         tree = seed;
 769         list_add(&tree->list, &tree_list);
 770         list_add(&rule->rlist, &tree->rules);
 771         /* do not set rule->tree yet */
 772         mutex_unlock(&audit_filter_mutex);
 773
 774         if (unlikely(!prune_thread)) {
 775                 err = audit_launch_prune();
 776                 if (err)
 777                         goto Err;
 778         }
 779
 780         err = kern_path(tree->pathname, 0, &path);
 781         if (err)
 782                 goto Err;
 783         mnt = collect_mounts(&path);
 784         path_put(&path);
 785         if (IS_ERR(mnt)) {
 786                 err = PTR_ERR(mnt);
 787                 goto Err;
 788         }
 789
 790         get_tree(tree);
 791         err = iterate_mounts(tag_mount, tree, mnt);
 792         drop_collected_mounts(mnt);
 793
 794         if (!err) {
 795                 struct node *node;
 796                 spin_lock(&hash_lock);
 797                 list_for_each_entry(node, &tree->chunks, list)
 798                         node->index &= ~(1U<<31);
 799                 spin_unlock(&hash_lock);
 800         } else {
 801                 trim_marked(tree);
 802                 goto Err;
 803         }
 804
 805         mutex_lock(&audit_filter_mutex);
 806         if (list_empty(&rule->rlist)) {
 807                 put_tree(tree);
 808                 return -ENOENT;
 809         }
 810         rule->tree = tree;
 811         put_tree(tree);
 812
 813         return 0;
 814 Err:
 815         mutex_lock(&audit_filter_mutex);
 816         list_del_init(&tree->list);
 817         list_del_init(&tree->rules);
 818         put_tree(tree);
 819         return err;
 820 }
 821
 822 int audit_tag_tree(char *old, char *new)
 823 {
 824         struct list_head cursor, barrier;
 825         int failed = 0;
 826         struct path path1, path2;
 827         struct vfsmount *tagged;
 828         int err;
 829
 830         err = kern_path(new, 0, &path2);
 831         if (err)
 832                 return err;
 833         tagged = collect_mounts(&path2);
 834         path_put(&path2);
 835         if (IS_ERR(tagged))
 836                 return PTR_ERR(tagged);
 837
 838         err = kern_path(old, 0, &path1);
 839         if (err) {
 840                 drop_collected_mounts(tagged);
 841                 return err;
 842         }
 843
 844         mutex_lock(&audit_filter_mutex);
 845         list_add(&barrier, &tree_list);
 846         list_add(&cursor, &barrier);
 847
 848         while (cursor.next != &tree_list) {
 849                 struct audit_tree *tree;
 850                 int good_one = 0;
 851
 852                 tree = container_of(cursor.next, struct audit_tree, list);
 853                 get_tree(tree);
 854                 list_del(&cursor);
 855                 list_add(&cursor, &tree->list);
 856                 mutex_unlock(&audit_filter_mutex);
 857
 858                 err = kern_path(tree->pathname, 0, &path2);
 859                 if (!err) {
 860                         good_one = path_is_under(&path1, &path2);
 861                         path_put(&path2);
 862                 }
 863
 864                 if (!good_one) {
 865                         put_tree(tree);
 866                         mutex_lock(&audit_filter_mutex);
 867                         continue;
 868                 }
 869
 870                 failed = iterate_mounts(tag_mount, tree, tagged);
 871                 if (failed) {
 872                         put_tree(tree);
 873                         mutex_lock(&audit_filter_mutex);
 874                         break;
 875                 }
 876
 877                 mutex_lock(&audit_filter_mutex);
 878                 spin_lock(&hash_lock);
 879                 if (!tree->goner) {
 880                         list_del(&tree->list);
 881                         list_add(&tree->list, &tree_list);
 882                 }
 883                 spin_unlock(&hash_lock);
 884                 put_tree(tree);
 885         }
 886
 887         while (barrier.prev != &tree_list) {
 888                 struct audit_tree *tree;
 889
 890                 tree = container_of(barrier.prev, struct audit_tree, list);
 891                 get_tree(tree);
 892                 list_del(&tree->list);
 893                 list_add(&tree->list, &barrier);
 894                 mutex_unlock(&audit_filter_mutex);
 895
 896                 if (!failed) {
 897                         struct node *node;
 898                         spin_lock(&hash_lock);
 899                         list_for_each_entry(node, &tree->chunks, list)
 900                                 node->index &= ~(1U<<31);
 901                         spin_unlock(&hash_lock);
 902                 } else {
 903                         trim_marked(tree);
 904                 }
 905
 906                 put_tree(tree);
 907                 mutex_lock(&audit_filter_mutex);
 908         }
 909         list_del(&barrier);
 910         list_del(&cursor);
 911         mutex_unlock(&audit_filter_mutex);
 912         path_put(&path1);
 913         drop_collected_mounts(tagged);
 914         return failed;
 915 }
 916
 917
 918 static void audit_schedule_prune(void)
 919 {
 920         wake_up_process(prune_thread);
 921 }
 922
 923 /*
 924  * ... and that one is done if evict_chunk() decides to delay until the end
 925  * of syscall.  Runs synchronously.
 926  */
 927 void audit_kill_trees(struct list_head *list)
 928 {
 929         audit_ctl_lock();
 930         mutex_lock(&audit_filter_mutex);
 931
 932         while (!list_empty(list)) {
 933                 struct audit_tree *victim;
 934
 935                 victim = list_entry(list->next, struct audit_tree, list);
 936                 kill_rules(victim);
 937                 list_del_init(&victim->list);
 938
 939                 mutex_unlock(&audit_filter_mutex);
 940
 941                 prune_one(victim);
 942
 943                 mutex_lock(&audit_filter_mutex);
 944         }
 945
 946         mutex_unlock(&audit_filter_mutex);
 947         audit_ctl_unlock();
 948 }
 949
 950 /*
 951  *  Here comes the stuff asynchronous to auditctl operations
 952  */
 953
 954 static void evict_chunk(struct audit_chunk *chunk)
 955 {
 956         struct audit_tree *owner;
 957         struct list_head *postponed = audit_killed_trees();
 958         int need_prune = 0;
 959         int n;
 960
 961         if (chunk->dead)
 962                 return;
 963
 964         chunk->dead = 1;
 965         mutex_lock(&audit_filter_mutex);
 966         spin_lock(&hash_lock);
 967         while (!list_empty(&chunk->trees)) {
 968                 owner = list_entry(chunk->trees.next,
 969                                    struct audit_tree, same_root);
 970                 owner->goner = 1;
 971                 owner->root = NULL;
 972                 list_del_init(&owner->same_root);
 973                 spin_unlock(&hash_lock);
 974                 if (!postponed) {
 975                         kill_rules(owner);
 976                         list_move(&owner->list, &prune_list);
 977                         need_prune = 1;
 978                 } else {
 979                         list_move(&owner->list, postponed);
 980                 }
 981                 spin_lock(&hash_lock);
 982         }
 983         list_del_rcu(&chunk->hash);
 984         for (n = 0; n < chunk->count; n++)
 985                 list_del_init(&chunk->owners[n].list);
 986         spin_unlock(&hash_lock);
 987         mutex_unlock(&audit_filter_mutex);
 988         if (need_prune)
 989                 audit_schedule_prune();
 990 }
 991
 992 static int audit_tree_handle_event(struct fsnotify_group *group,
 993                                    struct inode *to_tell,
 994                                    u32 mask, const void *data, int data_type,
 995                                    const unsigned char *file_name, u32 cookie,
 996                                    struct fsnotify_iter_info *iter_info)
 997 {
 998         return 0;
 999 }
1000
1001 static void audit_tree_freeing_mark(struct fsnotify_mark *entry, struct fsnotify_group *group)
1002 {
1003         struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
1004
1005         evict_chunk(chunk);
1006
1007         /*
1008          * We are guaranteed to have at least one reference to the mark from
1009          * either the inode or the caller of fsnotify_destroy_mark().
1010          */
1011         BUG_ON(refcount_read(&entry->refcnt) < 1);
1012 }
1013
1014 static const struct fsnotify_ops audit_tree_ops = {
1015         .handle_event = audit_tree_handle_event,
1016         .freeing_mark = audit_tree_freeing_mark,
1017         .free_mark = audit_tree_destroy_watch,
1018 };
1019
1020 static int __init audit_tree_init(void)
1021 {
1022         int i;
1023
1024         audit_tree_group = fsnotify_alloc_group(&audit_tree_ops);
1025         if (IS_ERR(audit_tree_group))
1026                 audit_panic("cannot initialize fsnotify group for rectree watches");
1027
1028         for (i = 0; i < HASH_SIZE; i++)
1029                 INIT_LIST_HEAD(&chunk_hash_heads[i]);
1030
1031         return 0;
1032 }
1033 __initcall(audit_tree_init);