blob: 51f3fd4c1ed3a71dd1b8cd95e6645221150f5047 [file] [log] [blame]
David Woodhousefe7752b2005-12-15 18:33:52 +00001/* auditfilter.c -- filtering of audit events
2 *
3 * Copyright 2003-2004 Red Hat, Inc.
4 * Copyright 2005 Hewlett-Packard Development Company, L.P.
5 * Copyright 2005 IBM Corporation
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 */
21
22#include <linux/kernel.h>
23#include <linux/audit.h>
24#include <linux/kthread.h>
Amy Griffisf368c07d2006-04-07 16:55:56 -040025#include <linux/mutex.h>
26#include <linux/fs.h>
27#include <linux/namei.h>
David Woodhousefe7752b2005-12-15 18:33:52 +000028#include <linux/netlink.h>
Amy Griffisf368c07d2006-04-07 16:55:56 -040029#include <linux/sched.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090030#include <linux/slab.h>
Ahmed S. Darwish2a862b32008-03-01 21:54:38 +020031#include <linux/security.h>
David Woodhousefe7752b2005-12-15 18:33:52 +000032#include "audit.h"
33
Amy Griffisf368c07d2006-04-07 16:55:56 -040034/*
35 * Locking model:
36 *
37 * audit_filter_mutex:
38 * Synchronizes writes and blocking reads of audit's filterlist
39 * data. Rcu is used to traverse the filterlist and access
40 * contents of structs audit_entry, audit_watch and opaque
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +020041 * LSM rules during filtering. If modified, these structures
Amy Griffisf368c07d2006-04-07 16:55:56 -040042 * must be copied and replace their counterparts in the filterlist.
43 * An audit_parent struct is not accessed during filtering, so may
44 * be written directly provided audit_filter_mutex is held.
45 */
46
Amy Griffisf368c07d2006-04-07 16:55:56 -040047/* Audit filter lists, defined in <linux/audit.h> */
David Woodhousefe7752b2005-12-15 18:33:52 +000048struct list_head audit_filter_list[AUDIT_NR_FILTERS] = {
49 LIST_HEAD_INIT(audit_filter_list[0]),
50 LIST_HEAD_INIT(audit_filter_list[1]),
51 LIST_HEAD_INIT(audit_filter_list[2]),
52 LIST_HEAD_INIT(audit_filter_list[3]),
53 LIST_HEAD_INIT(audit_filter_list[4]),
54 LIST_HEAD_INIT(audit_filter_list[5]),
55#if AUDIT_NR_FILTERS != 6
56#error Fix audit_filter_list initialiser
57#endif
58};
Al Viroe45aa212008-12-15 01:17:50 -050059static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = {
60 LIST_HEAD_INIT(audit_rules_list[0]),
61 LIST_HEAD_INIT(audit_rules_list[1]),
62 LIST_HEAD_INIT(audit_rules_list[2]),
63 LIST_HEAD_INIT(audit_rules_list[3]),
64 LIST_HEAD_INIT(audit_rules_list[4]),
65 LIST_HEAD_INIT(audit_rules_list[5]),
66};
David Woodhousefe7752b2005-12-15 18:33:52 +000067
Al Viro74c3cbe2007-07-22 08:04:18 -040068DEFINE_MUTEX(audit_filter_mutex);
Amy Griffisf368c07d2006-04-07 16:55:56 -040069
Amy Griffis93315ed2006-02-07 12:05:27 -050070static inline void audit_free_rule(struct audit_entry *e)
David Woodhousefe7752b2005-12-15 18:33:52 +000071{
Darrel Goeddel3dc7e312006-03-10 18:14:06 -060072 int i;
Zhenwen Xuc28bb7d2009-03-12 22:16:12 +080073 struct audit_krule *erule = &e->rule;
Eric Parisae7b8f42009-12-17 20:12:04 -050074
Amy Griffisf368c07d2006-04-07 16:55:56 -040075 /* some rules don't have associated watches */
Zhenwen Xuc28bb7d2009-03-12 22:16:12 +080076 if (erule->watch)
77 audit_put_watch(erule->watch);
78 if (erule->fields)
79 for (i = 0; i < erule->field_count; i++) {
80 struct audit_field *f = &erule->fields[i];
Ahmed S. Darwish04305e42008-04-19 09:59:43 +100081 kfree(f->lsm_str);
82 security_audit_rule_free(f->lsm_rule);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -060083 }
Zhenwen Xuc28bb7d2009-03-12 22:16:12 +080084 kfree(erule->fields);
85 kfree(erule->filterkey);
Amy Griffis93315ed2006-02-07 12:05:27 -050086 kfree(e);
David Woodhousefe7752b2005-12-15 18:33:52 +000087}
88
Al Viro74c3cbe2007-07-22 08:04:18 -040089void audit_free_rule_rcu(struct rcu_head *head)
Amy Griffis93315ed2006-02-07 12:05:27 -050090{
91 struct audit_entry *e = container_of(head, struct audit_entry, rcu);
92 audit_free_rule(e);
93}
94
Darrel Goeddel3dc7e312006-03-10 18:14:06 -060095/* Initialize an audit filterlist entry. */
96static inline struct audit_entry *audit_init_entry(u32 field_count)
97{
98 struct audit_entry *entry;
99 struct audit_field *fields;
100
101 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
102 if (unlikely(!entry))
103 return NULL;
104
105 fields = kzalloc(sizeof(*fields) * field_count, GFP_KERNEL);
106 if (unlikely(!fields)) {
107 kfree(entry);
108 return NULL;
109 }
110 entry->rule.fields = fields;
111
112 return entry;
113}
114
Amy Griffis93315ed2006-02-07 12:05:27 -0500115/* Unpack a filter field's string representation from user-space
116 * buffer. */
Al Viro74c3cbe2007-07-22 08:04:18 -0400117char *audit_unpack_string(void **bufp, size_t *remain, size_t len)
Amy Griffis93315ed2006-02-07 12:05:27 -0500118{
119 char *str;
120
121 if (!*bufp || (len == 0) || (len > *remain))
122 return ERR_PTR(-EINVAL);
123
124 /* Of the currently implemented string fields, PATH_MAX
125 * defines the longest valid length.
126 */
127 if (len > PATH_MAX)
128 return ERR_PTR(-ENAMETOOLONG);
129
130 str = kmalloc(len + 1, GFP_KERNEL);
131 if (unlikely(!str))
132 return ERR_PTR(-ENOMEM);
133
134 memcpy(str, *bufp, len);
135 str[len] = 0;
136 *bufp += len;
137 *remain -= len;
138
139 return str;
140}
141
Amy Griffisf368c07d2006-04-07 16:55:56 -0400142/* Translate an inode field to kernel respresentation. */
143static inline int audit_to_inode(struct audit_krule *krule,
144 struct audit_field *f)
145{
146 if (krule->listnr != AUDIT_FILTER_EXIT ||
Al Viro5af75d82008-12-16 05:59:26 -0500147 krule->watch || krule->inode_f || krule->tree ||
148 (f->op != Audit_equal && f->op != Audit_not_equal))
Amy Griffisf368c07d2006-04-07 16:55:56 -0400149 return -EINVAL;
150
151 krule->inode_f = f;
152 return 0;
153}
154
Al Virob9155432006-07-01 03:56:16 -0400155static __u32 *classes[AUDIT_SYSCALL_CLASSES];
156
157int __init audit_register_class(int class, unsigned *list)
158{
159 __u32 *p = kzalloc(AUDIT_BITMASK_SIZE * sizeof(__u32), GFP_KERNEL);
160 if (!p)
161 return -ENOMEM;
162 while (*list != ~0U) {
163 unsigned n = *list++;
164 if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) {
165 kfree(p);
166 return -EINVAL;
167 }
168 p[AUDIT_WORD(n)] |= AUDIT_BIT(n);
169 }
170 if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) {
171 kfree(p);
172 return -EINVAL;
173 }
174 classes[class] = p;
175 return 0;
176}
177
Al Viro55669bf2006-08-31 19:26:40 -0400178int audit_match_class(int class, unsigned syscall)
179{
Klaus Weidnerc926e4f2007-05-16 17:45:42 -0500180 if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32))
Al Viro55669bf2006-08-31 19:26:40 -0400181 return 0;
182 if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class]))
183 return 0;
184 return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall);
185}
186
Al Viro327b9ee2007-05-15 20:37:10 +0100187#ifdef CONFIG_AUDITSYSCALL
Amy Griffise54dc242007-03-29 18:01:04 -0400188static inline int audit_match_class_bits(int class, u32 *mask)
189{
190 int i;
191
192 if (classes[class]) {
193 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
194 if (mask[i] & classes[class][i])
195 return 0;
196 }
197 return 1;
198}
199
200static int audit_match_signal(struct audit_entry *entry)
201{
202 struct audit_field *arch = entry->rule.arch_f;
203
204 if (!arch) {
205 /* When arch is unspecified, we must check both masks on biarch
206 * as syscall number alone is ambiguous. */
207 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
208 entry->rule.mask) &&
209 audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
210 entry->rule.mask));
211 }
212
213 switch(audit_classify_arch(arch->val)) {
214 case 0: /* native */
215 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
216 entry->rule.mask));
217 case 1: /* 32bit on biarch */
218 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
219 entry->rule.mask));
220 default:
221 return 1;
222 }
223}
Al Viro327b9ee2007-05-15 20:37:10 +0100224#endif
Amy Griffise54dc242007-03-29 18:01:04 -0400225
Amy Griffis93315ed2006-02-07 12:05:27 -0500226/* Common user-space to kernel rule translation. */
227static inline struct audit_entry *audit_to_entry_common(struct audit_rule *rule)
228{
229 unsigned listnr;
230 struct audit_entry *entry;
Amy Griffis93315ed2006-02-07 12:05:27 -0500231 int i, err;
232
233 err = -EINVAL;
234 listnr = rule->flags & ~AUDIT_FILTER_PREPEND;
235 switch(listnr) {
236 default:
237 goto exit_err;
Amy Griffis93315ed2006-02-07 12:05:27 -0500238#ifdef CONFIG_AUDITSYSCALL
239 case AUDIT_FILTER_ENTRY:
Eric Paris7ff68e52012-01-03 14:23:07 -0500240 if (rule->action == AUDIT_ALWAYS)
241 goto exit_err;
Amy Griffis93315ed2006-02-07 12:05:27 -0500242 case AUDIT_FILTER_EXIT:
243 case AUDIT_FILTER_TASK:
244#endif
Eric Paris7ff68e52012-01-03 14:23:07 -0500245 case AUDIT_FILTER_USER:
246 case AUDIT_FILTER_TYPE:
Amy Griffis93315ed2006-02-07 12:05:27 -0500247 ;
248 }
Al Viro014149c2006-05-23 01:36:13 -0400249 if (unlikely(rule->action == AUDIT_POSSIBLE)) {
250 printk(KERN_ERR "AUDIT_POSSIBLE is deprecated\n");
251 goto exit_err;
252 }
253 if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS)
Amy Griffis93315ed2006-02-07 12:05:27 -0500254 goto exit_err;
255 if (rule->field_count > AUDIT_MAX_FIELDS)
256 goto exit_err;
257
258 err = -ENOMEM;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600259 entry = audit_init_entry(rule->field_count);
260 if (!entry)
Amy Griffis93315ed2006-02-07 12:05:27 -0500261 goto exit_err;
Amy Griffis93315ed2006-02-07 12:05:27 -0500262
263 entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;
264 entry->rule.listnr = listnr;
265 entry->rule.action = rule->action;
266 entry->rule.field_count = rule->field_count;
Amy Griffis93315ed2006-02-07 12:05:27 -0500267
268 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
269 entry->rule.mask[i] = rule->mask[i];
270
Al Virob9155432006-07-01 03:56:16 -0400271 for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) {
272 int bit = AUDIT_BITMASK_SIZE * 32 - i - 1;
273 __u32 *p = &entry->rule.mask[AUDIT_WORD(bit)];
274 __u32 *class;
275
276 if (!(*p & AUDIT_BIT(bit)))
277 continue;
278 *p &= ~AUDIT_BIT(bit);
279 class = classes[i];
280 if (class) {
281 int j;
282 for (j = 0; j < AUDIT_BITMASK_SIZE; j++)
283 entry->rule.mask[j] |= class[j];
284 }
285 }
286
Amy Griffis93315ed2006-02-07 12:05:27 -0500287 return entry;
288
289exit_err:
290 return ERR_PTR(err);
291}
292
Al Viro5af75d82008-12-16 05:59:26 -0500293static u32 audit_ops[] =
294{
295 [Audit_equal] = AUDIT_EQUAL,
296 [Audit_not_equal] = AUDIT_NOT_EQUAL,
297 [Audit_bitmask] = AUDIT_BIT_MASK,
298 [Audit_bittest] = AUDIT_BIT_TEST,
299 [Audit_lt] = AUDIT_LESS_THAN,
300 [Audit_gt] = AUDIT_GREATER_THAN,
301 [Audit_le] = AUDIT_LESS_THAN_OR_EQUAL,
302 [Audit_ge] = AUDIT_GREATER_THAN_OR_EQUAL,
303};
304
305static u32 audit_to_op(u32 op)
306{
307 u32 n;
308 for (n = Audit_equal; n < Audit_bad && audit_ops[n] != op; n++)
309 ;
310 return n;
311}
312
Eric Parisab61d382013-04-16 17:26:51 -0400313/* check if an audit field is valid */
Eric Paris62062cf2013-04-16 13:08:43 -0400314static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
Amy Griffis93315ed2006-02-07 12:05:27 -0500315{
Eric Paris62062cf2013-04-16 13:08:43 -0400316 switch(f->type) {
317 case AUDIT_MSGTYPE:
318 if (entry->rule.listnr != AUDIT_FILTER_TYPE &&
319 entry->rule.listnr != AUDIT_FILTER_USER)
320 return -EINVAL;
321 break;
322 };
Amy Griffis93315ed2006-02-07 12:05:27 -0500323
Eric Parisab61d382013-04-16 17:26:51 -0400324 switch(f->type) {
325 default:
326 return -EINVAL;
327 case AUDIT_UID:
328 case AUDIT_EUID:
329 case AUDIT_SUID:
330 case AUDIT_FSUID:
331 case AUDIT_LOGINUID:
332 case AUDIT_OBJ_UID:
333 case AUDIT_GID:
334 case AUDIT_EGID:
335 case AUDIT_SGID:
336 case AUDIT_FSGID:
337 case AUDIT_OBJ_GID:
338 case AUDIT_PID:
339 case AUDIT_PERS:
340 case AUDIT_MSGTYPE:
341 case AUDIT_PPID:
342 case AUDIT_DEVMAJOR:
343 case AUDIT_DEVMINOR:
344 case AUDIT_EXIT:
345 case AUDIT_SUCCESS:
Eric Paris78122032013-09-04 15:01:43 -0400346 case AUDIT_INODE:
Eric Parisab61d382013-04-16 17:26:51 -0400347 /* bit ops are only useful on syscall args */
348 if (f->op == Audit_bitmask || f->op == Audit_bittest)
349 return -EINVAL;
350 break;
351 case AUDIT_ARG0:
352 case AUDIT_ARG1:
353 case AUDIT_ARG2:
354 case AUDIT_ARG3:
355 case AUDIT_SUBJ_USER:
356 case AUDIT_SUBJ_ROLE:
357 case AUDIT_SUBJ_TYPE:
358 case AUDIT_SUBJ_SEN:
359 case AUDIT_SUBJ_CLR:
360 case AUDIT_OBJ_USER:
361 case AUDIT_OBJ_ROLE:
362 case AUDIT_OBJ_TYPE:
363 case AUDIT_OBJ_LEV_LOW:
364 case AUDIT_OBJ_LEV_HIGH:
365 case AUDIT_WATCH:
366 case AUDIT_DIR:
367 case AUDIT_FILTERKEY:
368 break;
Eric W. Biederman780a7652013-04-09 02:22:10 -0700369 case AUDIT_LOGINUID_SET:
370 if ((f->val != 0) && (f->val != 1))
371 return -EINVAL;
372 /* FALL THROUGH */
Eric Parisab61d382013-04-16 17:26:51 -0400373 case AUDIT_ARCH:
374 if (f->op != Audit_not_equal && f->op != Audit_equal)
375 return -EINVAL;
376 break;
377 case AUDIT_PERM:
378 if (f->val & ~15)
379 return -EINVAL;
380 break;
381 case AUDIT_FILETYPE:
382 if (f->val & ~S_IFMT)
383 return -EINVAL;
384 break;
385 case AUDIT_FIELD_COMPARE:
386 if (f->val > AUDIT_MAX_FIELD_COMPARE)
387 return -EINVAL;
388 break;
389 };
Eric Paris62062cf2013-04-16 13:08:43 -0400390 return 0;
Amy Griffis93315ed2006-02-07 12:05:27 -0500391}
392
393/* Translate struct audit_rule_data to kernel's rule respresentation. */
394static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
395 size_t datasz)
396{
397 int err = 0;
398 struct audit_entry *entry;
399 void *bufp;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600400 size_t remain = datasz - sizeof(struct audit_rule_data);
Amy Griffis93315ed2006-02-07 12:05:27 -0500401 int i;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600402 char *str;
Amy Griffis93315ed2006-02-07 12:05:27 -0500403
404 entry = audit_to_entry_common((struct audit_rule *)data);
405 if (IS_ERR(entry))
406 goto exit_nofree;
407
408 bufp = data->buf;
409 entry->rule.vers_ops = 2;
410 for (i = 0; i < data->field_count; i++) {
411 struct audit_field *f = &entry->rule.fields[i];
412
413 err = -EINVAL;
Al Viro5af75d82008-12-16 05:59:26 -0500414
415 f->op = audit_to_op(data->fieldflags[i]);
416 if (f->op == Audit_bad)
Amy Griffis93315ed2006-02-07 12:05:27 -0500417 goto exit_free;
418
Amy Griffis93315ed2006-02-07 12:05:27 -0500419 f->type = data->fields[i];
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600420 f->val = data->values[i];
Eric W. Biedermanca57ec02012-09-11 02:18:08 -0700421 f->uid = INVALID_UID;
422 f->gid = INVALID_GID;
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000423 f->lsm_str = NULL;
424 f->lsm_rule = NULL;
Eric Paris62062cf2013-04-16 13:08:43 -0400425
Eric W. Biederman780a7652013-04-09 02:22:10 -0700426 /* Support legacy tests for a valid loginuid */
Richard Guy Briggs42f74462013-05-20 15:08:18 -0400427 if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {
Eric W. Biederman780a7652013-04-09 02:22:10 -0700428 f->type = AUDIT_LOGINUID_SET;
429 f->val = 0;
430 }
431
Eric Paris62062cf2013-04-16 13:08:43 -0400432 err = audit_field_valid(entry, f);
433 if (err)
434 goto exit_free;
435
436 err = -EINVAL;
Eric Parisab61d382013-04-16 17:26:51 -0400437 switch (f->type) {
Eric W. Biederman780a7652013-04-09 02:22:10 -0700438 case AUDIT_LOGINUID:
Al Viro0a73dcc2006-06-05 08:15:59 -0400439 case AUDIT_UID:
440 case AUDIT_EUID:
441 case AUDIT_SUID:
442 case AUDIT_FSUID:
Eric W. Biedermanca57ec02012-09-11 02:18:08 -0700443 case AUDIT_OBJ_UID:
Eric W. Biedermanca57ec02012-09-11 02:18:08 -0700444 f->uid = make_kuid(current_user_ns(), f->val);
445 if (!uid_valid(f->uid))
446 goto exit_free;
447 break;
Al Viro0a73dcc2006-06-05 08:15:59 -0400448 case AUDIT_GID:
449 case AUDIT_EGID:
450 case AUDIT_SGID:
451 case AUDIT_FSGID:
Eric W. Biedermanca57ec02012-09-11 02:18:08 -0700452 case AUDIT_OBJ_GID:
Eric W. Biedermanca57ec02012-09-11 02:18:08 -0700453 f->gid = make_kgid(current_user_ns(), f->val);
454 if (!gid_valid(f->gid))
455 goto exit_free;
456 break;
Amy Griffise54dc242007-03-29 18:01:04 -0400457 case AUDIT_ARCH:
458 entry->rule.arch_f = f;
459 break;
Darrel Goeddel3a6b9f82006-06-29 16:56:39 -0500460 case AUDIT_SUBJ_USER:
461 case AUDIT_SUBJ_ROLE:
462 case AUDIT_SUBJ_TYPE:
463 case AUDIT_SUBJ_SEN:
464 case AUDIT_SUBJ_CLR:
Darrel Goeddel6e5a2d12006-06-29 16:57:08 -0500465 case AUDIT_OBJ_USER:
466 case AUDIT_OBJ_ROLE:
467 case AUDIT_OBJ_TYPE:
468 case AUDIT_OBJ_LEV_LOW:
469 case AUDIT_OBJ_LEV_HIGH:
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600470 str = audit_unpack_string(&bufp, &remain, f->val);
471 if (IS_ERR(str))
472 goto exit_free;
473 entry->rule.buflen += f->val;
474
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +0200475 err = security_audit_rule_init(f->type, f->op, str,
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000476 (void **)&f->lsm_rule);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600477 /* Keep currently invalid fields around in case they
478 * become valid after a policy reload. */
479 if (err == -EINVAL) {
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +0200480 printk(KERN_WARNING "audit rule for LSM "
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600481 "\'%s\' is invalid\n", str);
482 err = 0;
483 }
484 if (err) {
485 kfree(str);
486 goto exit_free;
487 } else
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000488 f->lsm_str = str;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600489 break;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400490 case AUDIT_WATCH:
491 str = audit_unpack_string(&bufp, &remain, f->val);
492 if (IS_ERR(str))
493 goto exit_free;
494 entry->rule.buflen += f->val;
495
496 err = audit_to_watch(&entry->rule, str, f->val, f->op);
497 if (err) {
498 kfree(str);
499 goto exit_free;
500 }
501 break;
Al Viro74c3cbe2007-07-22 08:04:18 -0400502 case AUDIT_DIR:
503 str = audit_unpack_string(&bufp, &remain, f->val);
504 if (IS_ERR(str))
505 goto exit_free;
506 entry->rule.buflen += f->val;
507
508 err = audit_make_tree(&entry->rule, str, f->op);
509 kfree(str);
510 if (err)
511 goto exit_free;
512 break;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400513 case AUDIT_INODE:
514 err = audit_to_inode(&entry->rule, f);
515 if (err)
516 goto exit_free;
517 break;
Amy Griffis5adc8a62006-06-14 18:45:21 -0400518 case AUDIT_FILTERKEY:
Amy Griffis5adc8a62006-06-14 18:45:21 -0400519 if (entry->rule.filterkey || f->val > AUDIT_MAX_KEY_LEN)
520 goto exit_free;
521 str = audit_unpack_string(&bufp, &remain, f->val);
522 if (IS_ERR(str))
523 goto exit_free;
524 entry->rule.buflen += f->val;
525 entry->rule.filterkey = str;
526 break;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400527 }
528 }
529
Al Viro5af75d82008-12-16 05:59:26 -0500530 if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)
531 entry->rule.inode_f = NULL;
Amy Griffis93315ed2006-02-07 12:05:27 -0500532
533exit_nofree:
534 return entry;
535
536exit_free:
Chen Gang373e0f32013-04-29 15:05:18 -0700537 if (entry->rule.watch)
538 audit_put_watch(entry->rule.watch); /* matches initial get */
539 if (entry->rule.tree)
540 audit_put_tree(entry->rule.tree); /* that's the temporary one */
Amy Griffis93315ed2006-02-07 12:05:27 -0500541 audit_free_rule(entry);
542 return ERR_PTR(err);
543}
544
545/* Pack a filter field's string representation into data block. */
Al Viro74c3cbe2007-07-22 08:04:18 -0400546static inline size_t audit_pack_string(void **bufp, const char *str)
Amy Griffis93315ed2006-02-07 12:05:27 -0500547{
548 size_t len = strlen(str);
549
550 memcpy(*bufp, str, len);
551 *bufp += len;
552
553 return len;
554}
555
Amy Griffis93315ed2006-02-07 12:05:27 -0500556/* Translate kernel rule respresentation to struct audit_rule_data. */
557static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
558{
559 struct audit_rule_data *data;
560 void *bufp;
561 int i;
562
563 data = kmalloc(sizeof(*data) + krule->buflen, GFP_KERNEL);
564 if (unlikely(!data))
Amy Griffis0a3b4832006-05-02 15:06:01 -0400565 return NULL;
Amy Griffis93315ed2006-02-07 12:05:27 -0500566 memset(data, 0, sizeof(*data));
567
568 data->flags = krule->flags | krule->listnr;
569 data->action = krule->action;
570 data->field_count = krule->field_count;
571 bufp = data->buf;
572 for (i = 0; i < data->field_count; i++) {
573 struct audit_field *f = &krule->fields[i];
574
575 data->fields[i] = f->type;
Al Viro5af75d82008-12-16 05:59:26 -0500576 data->fieldflags[i] = audit_ops[f->op];
Amy Griffis93315ed2006-02-07 12:05:27 -0500577 switch(f->type) {
Darrel Goeddel3a6b9f82006-06-29 16:56:39 -0500578 case AUDIT_SUBJ_USER:
579 case AUDIT_SUBJ_ROLE:
580 case AUDIT_SUBJ_TYPE:
581 case AUDIT_SUBJ_SEN:
582 case AUDIT_SUBJ_CLR:
Darrel Goeddel6e5a2d12006-06-29 16:57:08 -0500583 case AUDIT_OBJ_USER:
584 case AUDIT_OBJ_ROLE:
585 case AUDIT_OBJ_TYPE:
586 case AUDIT_OBJ_LEV_LOW:
587 case AUDIT_OBJ_LEV_HIGH:
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600588 data->buflen += data->values[i] =
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000589 audit_pack_string(&bufp, f->lsm_str);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600590 break;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400591 case AUDIT_WATCH:
592 data->buflen += data->values[i] =
Eric Pariscfcad622009-06-11 14:31:36 -0400593 audit_pack_string(&bufp,
594 audit_watch_path(krule->watch));
Amy Griffisf368c07d2006-04-07 16:55:56 -0400595 break;
Al Viro74c3cbe2007-07-22 08:04:18 -0400596 case AUDIT_DIR:
597 data->buflen += data->values[i] =
598 audit_pack_string(&bufp,
599 audit_tree_path(krule->tree));
600 break;
Amy Griffis5adc8a62006-06-14 18:45:21 -0400601 case AUDIT_FILTERKEY:
602 data->buflen += data->values[i] =
603 audit_pack_string(&bufp, krule->filterkey);
604 break;
Amy Griffis93315ed2006-02-07 12:05:27 -0500605 default:
606 data->values[i] = f->val;
607 }
608 }
609 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i];
610
611 return data;
612}
613
614/* Compare two rules in kernel format. Considered success if rules
615 * don't match. */
616static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
David Woodhousefe7752b2005-12-15 18:33:52 +0000617{
618 int i;
619
Amy Griffis93315ed2006-02-07 12:05:27 -0500620 if (a->flags != b->flags ||
621 a->listnr != b->listnr ||
622 a->action != b->action ||
623 a->field_count != b->field_count)
David Woodhousefe7752b2005-12-15 18:33:52 +0000624 return 1;
625
626 for (i = 0; i < a->field_count; i++) {
Amy Griffis93315ed2006-02-07 12:05:27 -0500627 if (a->fields[i].type != b->fields[i].type ||
628 a->fields[i].op != b->fields[i].op)
David Woodhousefe7752b2005-12-15 18:33:52 +0000629 return 1;
Amy Griffis93315ed2006-02-07 12:05:27 -0500630
631 switch(a->fields[i].type) {
Darrel Goeddel3a6b9f82006-06-29 16:56:39 -0500632 case AUDIT_SUBJ_USER:
633 case AUDIT_SUBJ_ROLE:
634 case AUDIT_SUBJ_TYPE:
635 case AUDIT_SUBJ_SEN:
636 case AUDIT_SUBJ_CLR:
Darrel Goeddel6e5a2d12006-06-29 16:57:08 -0500637 case AUDIT_OBJ_USER:
638 case AUDIT_OBJ_ROLE:
639 case AUDIT_OBJ_TYPE:
640 case AUDIT_OBJ_LEV_LOW:
641 case AUDIT_OBJ_LEV_HIGH:
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000642 if (strcmp(a->fields[i].lsm_str, b->fields[i].lsm_str))
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600643 return 1;
644 break;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400645 case AUDIT_WATCH:
Eric Pariscfcad622009-06-11 14:31:36 -0400646 if (strcmp(audit_watch_path(a->watch),
647 audit_watch_path(b->watch)))
Amy Griffisf368c07d2006-04-07 16:55:56 -0400648 return 1;
649 break;
Al Viro74c3cbe2007-07-22 08:04:18 -0400650 case AUDIT_DIR:
651 if (strcmp(audit_tree_path(a->tree),
652 audit_tree_path(b->tree)))
653 return 1;
654 break;
Amy Griffis5adc8a62006-06-14 18:45:21 -0400655 case AUDIT_FILTERKEY:
656 /* both filterkeys exist based on above type compare */
657 if (strcmp(a->filterkey, b->filterkey))
658 return 1;
659 break;
Eric W. Biedermanca57ec02012-09-11 02:18:08 -0700660 case AUDIT_UID:
661 case AUDIT_EUID:
662 case AUDIT_SUID:
663 case AUDIT_FSUID:
664 case AUDIT_LOGINUID:
665 case AUDIT_OBJ_UID:
666 if (!uid_eq(a->fields[i].uid, b->fields[i].uid))
667 return 1;
668 break;
669 case AUDIT_GID:
670 case AUDIT_EGID:
671 case AUDIT_SGID:
672 case AUDIT_FSGID:
673 case AUDIT_OBJ_GID:
674 if (!gid_eq(a->fields[i].gid, b->fields[i].gid))
675 return 1;
676 break;
Amy Griffis93315ed2006-02-07 12:05:27 -0500677 default:
678 if (a->fields[i].val != b->fields[i].val)
679 return 1;
680 }
David Woodhousefe7752b2005-12-15 18:33:52 +0000681 }
682
683 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
684 if (a->mask[i] != b->mask[i])
685 return 1;
686
687 return 0;
688}
689
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000690/* Duplicate LSM field information. The lsm_rule is opaque, so must be
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600691 * re-initialized. */
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +0200692static inline int audit_dupe_lsm_field(struct audit_field *df,
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600693 struct audit_field *sf)
694{
695 int ret = 0;
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000696 char *lsm_str;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600697
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000698 /* our own copy of lsm_str */
699 lsm_str = kstrdup(sf->lsm_str, GFP_KERNEL);
700 if (unlikely(!lsm_str))
Akinobu Mita3e1fbd12006-12-22 01:10:02 -0800701 return -ENOMEM;
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000702 df->lsm_str = lsm_str;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600703
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000704 /* our own (refreshed) copy of lsm_rule */
705 ret = security_audit_rule_init(df->type, df->op, df->lsm_str,
706 (void **)&df->lsm_rule);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600707 /* Keep currently invalid fields around in case they
708 * become valid after a policy reload. */
709 if (ret == -EINVAL) {
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +0200710 printk(KERN_WARNING "audit rule for LSM \'%s\' is "
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000711 "invalid\n", df->lsm_str);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600712 ret = 0;
713 }
714
715 return ret;
716}
717
718/* Duplicate an audit rule. This will be a deep copy with the exception
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +0200719 * of the watch - that pointer is carried over. The LSM specific fields
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600720 * will be updated in the copy. The point is to be able to replace the old
Amy Griffisf368c07d2006-04-07 16:55:56 -0400721 * rule with the new rule in the filterlist, then free the old rule.
722 * The rlist element is undefined; list manipulations are handled apart from
723 * the initial copy. */
Eric Parisae7b8f42009-12-17 20:12:04 -0500724struct audit_entry *audit_dupe_rule(struct audit_krule *old)
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600725{
726 u32 fcount = old->field_count;
727 struct audit_entry *entry;
728 struct audit_krule *new;
Amy Griffis5adc8a62006-06-14 18:45:21 -0400729 char *fk;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600730 int i, err = 0;
731
732 entry = audit_init_entry(fcount);
733 if (unlikely(!entry))
734 return ERR_PTR(-ENOMEM);
735
736 new = &entry->rule;
737 new->vers_ops = old->vers_ops;
738 new->flags = old->flags;
739 new->listnr = old->listnr;
740 new->action = old->action;
741 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
742 new->mask[i] = old->mask[i];
Al Viro0590b932008-12-14 23:45:27 -0500743 new->prio = old->prio;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600744 new->buflen = old->buflen;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400745 new->inode_f = old->inode_f;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600746 new->field_count = old->field_count;
Eric Parisae7b8f42009-12-17 20:12:04 -0500747
Al Viro74c3cbe2007-07-22 08:04:18 -0400748 /*
749 * note that we are OK with not refcounting here; audit_match_tree()
750 * never dereferences tree and we can't get false positives there
751 * since we'd have to have rule gone from the list *and* removed
752 * before the chunks found by lookup had been allocated, i.e. before
753 * the beginning of list scan.
754 */
755 new->tree = old->tree;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600756 memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount);
757
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000758 /* deep copy this information, updating the lsm_rule fields, because
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600759 * the originals will all be freed when the old rule is freed. */
760 for (i = 0; i < fcount; i++) {
761 switch (new->fields[i].type) {
Darrel Goeddel3a6b9f82006-06-29 16:56:39 -0500762 case AUDIT_SUBJ_USER:
763 case AUDIT_SUBJ_ROLE:
764 case AUDIT_SUBJ_TYPE:
765 case AUDIT_SUBJ_SEN:
766 case AUDIT_SUBJ_CLR:
Darrel Goeddel6e5a2d12006-06-29 16:57:08 -0500767 case AUDIT_OBJ_USER:
768 case AUDIT_OBJ_ROLE:
769 case AUDIT_OBJ_TYPE:
770 case AUDIT_OBJ_LEV_LOW:
771 case AUDIT_OBJ_LEV_HIGH:
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +0200772 err = audit_dupe_lsm_field(&new->fields[i],
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600773 &old->fields[i]);
Amy Griffis5adc8a62006-06-14 18:45:21 -0400774 break;
775 case AUDIT_FILTERKEY:
776 fk = kstrdup(old->filterkey, GFP_KERNEL);
777 if (unlikely(!fk))
778 err = -ENOMEM;
779 else
780 new->filterkey = fk;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600781 }
782 if (err) {
783 audit_free_rule(entry);
784 return ERR_PTR(err);
785 }
786 }
787
Eric Parisae7b8f42009-12-17 20:12:04 -0500788 if (old->watch) {
789 audit_get_watch(old->watch);
790 new->watch = old->watch;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400791 }
792
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600793 return entry;
794}
795
Amy Griffisf368c07d2006-04-07 16:55:56 -0400796/* Find an existing audit rule.
797 * Caller must hold audit_filter_mutex to prevent stale rule data. */
798static struct audit_entry *audit_find_rule(struct audit_entry *entry,
Al Viro36c4f1b12008-12-15 01:50:28 -0500799 struct list_head **p)
Amy Griffisf368c07d2006-04-07 16:55:56 -0400800{
801 struct audit_entry *e, *found = NULL;
Al Viro36c4f1b12008-12-15 01:50:28 -0500802 struct list_head *list;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400803 int h;
804
Al Viro36c4f1b12008-12-15 01:50:28 -0500805 if (entry->rule.inode_f) {
806 h = audit_hash_ino(entry->rule.inode_f->val);
807 *p = list = &audit_inode_hash[h];
808 } else if (entry->rule.watch) {
Amy Griffisf368c07d2006-04-07 16:55:56 -0400809 /* we don't know the inode number, so must walk entire hash */
810 for (h = 0; h < AUDIT_INODE_BUCKETS; h++) {
811 list = &audit_inode_hash[h];
812 list_for_each_entry(e, list, list)
813 if (!audit_compare_rule(&entry->rule, &e->rule)) {
814 found = e;
815 goto out;
816 }
817 }
818 goto out;
Al Viro36c4f1b12008-12-15 01:50:28 -0500819 } else {
820 *p = list = &audit_filter_list[entry->rule.listnr];
Amy Griffisf368c07d2006-04-07 16:55:56 -0400821 }
822
823 list_for_each_entry(e, list, list)
824 if (!audit_compare_rule(&entry->rule, &e->rule)) {
825 found = e;
826 goto out;
827 }
828
829out:
830 return found;
831}
832
Al Viro0590b932008-12-14 23:45:27 -0500833static u64 prio_low = ~0ULL/2;
834static u64 prio_high = ~0ULL/2 - 1;
835
Amy Griffisf368c07d2006-04-07 16:55:56 -0400836/* Add rule to given filterlist if not a duplicate. */
Al Viro36c4f1b12008-12-15 01:50:28 -0500837static inline int audit_add_rule(struct audit_entry *entry)
Amy Griffisf368c07d2006-04-07 16:55:56 -0400838{
839 struct audit_entry *e;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400840 struct audit_watch *watch = entry->rule.watch;
Al Viro74c3cbe2007-07-22 08:04:18 -0400841 struct audit_tree *tree = entry->rule.tree;
Al Viro36c4f1b12008-12-15 01:50:28 -0500842 struct list_head *list;
Eric Parisae7b8f42009-12-17 20:12:04 -0500843 int err;
Al Viro471a5c72006-07-10 08:29:24 -0400844#ifdef CONFIG_AUDITSYSCALL
845 int dont_count = 0;
846
847 /* If either of these, don't count towards total */
848 if (entry->rule.listnr == AUDIT_FILTER_USER ||
849 entry->rule.listnr == AUDIT_FILTER_TYPE)
850 dont_count = 1;
851#endif
Amy Griffisf368c07d2006-04-07 16:55:56 -0400852
Amy Griffisf368c07d2006-04-07 16:55:56 -0400853 mutex_lock(&audit_filter_mutex);
Al Viro36c4f1b12008-12-15 01:50:28 -0500854 e = audit_find_rule(entry, &list);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400855 if (e) {
Eric Paris35fe4d02009-06-11 14:31:36 -0400856 mutex_unlock(&audit_filter_mutex);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400857 err = -EEXIST;
Al Viro74c3cbe2007-07-22 08:04:18 -0400858 /* normally audit_add_tree_rule() will free it on failure */
859 if (tree)
860 audit_put_tree(tree);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400861 goto error;
862 }
863
Amy Griffisf368c07d2006-04-07 16:55:56 -0400864 if (watch) {
865 /* audit_filter_mutex is dropped and re-taken during this call */
Eric Parisae7b8f42009-12-17 20:12:04 -0500866 err = audit_add_watch(&entry->rule, &list);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400867 if (err) {
868 mutex_unlock(&audit_filter_mutex);
Chen Gang2f992ee2013-07-08 15:59:38 -0700869 /*
870 * normally audit_add_tree_rule() will free it
871 * on failure
872 */
873 if (tree)
874 audit_put_tree(tree);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400875 goto error;
876 }
David Woodhousefe7752b2005-12-15 18:33:52 +0000877 }
Al Viro74c3cbe2007-07-22 08:04:18 -0400878 if (tree) {
879 err = audit_add_tree_rule(&entry->rule);
880 if (err) {
881 mutex_unlock(&audit_filter_mutex);
882 goto error;
883 }
884 }
David Woodhousefe7752b2005-12-15 18:33:52 +0000885
Al Viro0590b932008-12-14 23:45:27 -0500886 entry->rule.prio = ~0ULL;
887 if (entry->rule.listnr == AUDIT_FILTER_EXIT) {
888 if (entry->rule.flags & AUDIT_FILTER_PREPEND)
889 entry->rule.prio = ++prio_high;
890 else
891 entry->rule.prio = --prio_low;
892 }
893
David Woodhousefe7752b2005-12-15 18:33:52 +0000894 if (entry->rule.flags & AUDIT_FILTER_PREPEND) {
Al Viroe45aa212008-12-15 01:17:50 -0500895 list_add(&entry->rule.list,
896 &audit_rules_list[entry->rule.listnr]);
David Woodhousefe7752b2005-12-15 18:33:52 +0000897 list_add_rcu(&entry->list, list);
Amy Griffis6a2bcee2006-06-02 13:16:01 -0400898 entry->rule.flags &= ~AUDIT_FILTER_PREPEND;
David Woodhousefe7752b2005-12-15 18:33:52 +0000899 } else {
Al Viroe45aa212008-12-15 01:17:50 -0500900 list_add_tail(&entry->rule.list,
901 &audit_rules_list[entry->rule.listnr]);
David Woodhousefe7752b2005-12-15 18:33:52 +0000902 list_add_tail_rcu(&entry->list, list);
903 }
Al Viro471a5c72006-07-10 08:29:24 -0400904#ifdef CONFIG_AUDITSYSCALL
905 if (!dont_count)
906 audit_n_rules++;
Amy Griffise54dc242007-03-29 18:01:04 -0400907
908 if (!audit_match_signal(entry))
909 audit_signals++;
Al Viro471a5c72006-07-10 08:29:24 -0400910#endif
Amy Griffisf368c07d2006-04-07 16:55:56 -0400911 mutex_unlock(&audit_filter_mutex);
David Woodhousefe7752b2005-12-15 18:33:52 +0000912
Amy Griffisf368c07d2006-04-07 16:55:56 -0400913 return 0;
914
915error:
Amy Griffisf368c07d2006-04-07 16:55:56 -0400916 if (watch)
917 audit_put_watch(watch); /* tmp watch, matches initial get */
918 return err;
David Woodhousefe7752b2005-12-15 18:33:52 +0000919}
920
Amy Griffisf368c07d2006-04-07 16:55:56 -0400921/* Remove an existing rule from filterlist. */
Al Viro36c4f1b12008-12-15 01:50:28 -0500922static inline int audit_del_rule(struct audit_entry *entry)
David Woodhousefe7752b2005-12-15 18:33:52 +0000923{
924 struct audit_entry *e;
Eric Pariscfcad622009-06-11 14:31:36 -0400925 struct audit_watch *watch = entry->rule.watch;
Al Viro74c3cbe2007-07-22 08:04:18 -0400926 struct audit_tree *tree = entry->rule.tree;
Al Viro36c4f1b12008-12-15 01:50:28 -0500927 struct list_head *list;
Al Viro36c4f1b12008-12-15 01:50:28 -0500928 int ret = 0;
Al Viro471a5c72006-07-10 08:29:24 -0400929#ifdef CONFIG_AUDITSYSCALL
930 int dont_count = 0;
931
932 /* If either of these, don't count towards total */
933 if (entry->rule.listnr == AUDIT_FILTER_USER ||
934 entry->rule.listnr == AUDIT_FILTER_TYPE)
935 dont_count = 1;
936#endif
David Woodhousefe7752b2005-12-15 18:33:52 +0000937
Amy Griffisf368c07d2006-04-07 16:55:56 -0400938 mutex_lock(&audit_filter_mutex);
Al Viro36c4f1b12008-12-15 01:50:28 -0500939 e = audit_find_rule(entry, &list);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400940 if (!e) {
941 mutex_unlock(&audit_filter_mutex);
942 ret = -ENOENT;
943 goto out;
944 }
945
Eric Pariscfcad622009-06-11 14:31:36 -0400946 if (e->rule.watch)
Eric Parisa05fb6c2009-12-17 20:12:05 -0500947 audit_remove_watch_rule(&e->rule);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400948
Al Viro74c3cbe2007-07-22 08:04:18 -0400949 if (e->rule.tree)
950 audit_remove_tree_rule(&e->rule);
951
Amy Griffisf368c07d2006-04-07 16:55:56 -0400952 list_del_rcu(&e->list);
Al Viroe45aa212008-12-15 01:17:50 -0500953 list_del(&e->rule.list);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400954 call_rcu(&e->rcu, audit_free_rule_rcu);
955
Al Viro471a5c72006-07-10 08:29:24 -0400956#ifdef CONFIG_AUDITSYSCALL
957 if (!dont_count)
958 audit_n_rules--;
Amy Griffise54dc242007-03-29 18:01:04 -0400959
960 if (!audit_match_signal(entry))
961 audit_signals--;
Al Viro471a5c72006-07-10 08:29:24 -0400962#endif
Amy Griffisf368c07d2006-04-07 16:55:56 -0400963 mutex_unlock(&audit_filter_mutex);
964
Amy Griffisf368c07d2006-04-07 16:55:56 -0400965out:
Eric Pariscfcad622009-06-11 14:31:36 -0400966 if (watch)
967 audit_put_watch(watch); /* match initial get */
Al Viro74c3cbe2007-07-22 08:04:18 -0400968 if (tree)
969 audit_put_tree(tree); /* that's the temporary one */
Amy Griffisf368c07d2006-04-07 16:55:56 -0400970
971 return ret;
David Woodhousefe7752b2005-12-15 18:33:52 +0000972}
973
Amy Griffis93315ed2006-02-07 12:05:27 -0500974/* List rules using struct audit_rule_data. */
Al Viro9044e6b2006-05-22 01:09:24 -0400975static void audit_list_rules(int pid, int seq, struct sk_buff_head *q)
Amy Griffis93315ed2006-02-07 12:05:27 -0500976{
Al Viro9044e6b2006-05-22 01:09:24 -0400977 struct sk_buff *skb;
Al Viroe45aa212008-12-15 01:17:50 -0500978 struct audit_krule *r;
Amy Griffis93315ed2006-02-07 12:05:27 -0500979 int i;
980
Amy Griffisf368c07d2006-04-07 16:55:56 -0400981 /* This is a blocking read, so use audit_filter_mutex instead of rcu
982 * iterator to sync with list writers. */
Amy Griffis93315ed2006-02-07 12:05:27 -0500983 for (i=0; i<AUDIT_NR_FILTERS; i++) {
Al Viroe45aa212008-12-15 01:17:50 -0500984 list_for_each_entry(r, &audit_rules_list[i], list) {
Amy Griffis93315ed2006-02-07 12:05:27 -0500985 struct audit_rule_data *data;
986
Al Viroe45aa212008-12-15 01:17:50 -0500987 data = audit_krule_to_data(r);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400988 if (unlikely(!data))
989 break;
990 skb = audit_make_reply(pid, seq, AUDIT_LIST_RULES, 0, 1,
991 data, sizeof(*data) + data->buflen);
Al Viro9044e6b2006-05-22 01:09:24 -0400992 if (skb)
993 skb_queue_tail(q, skb);
Amy Griffis93315ed2006-02-07 12:05:27 -0500994 kfree(data);
995 }
996 }
Al Viro9044e6b2006-05-22 01:09:24 -0400997 skb = audit_make_reply(pid, seq, AUDIT_LIST_RULES, 1, 1, NULL, 0);
998 if (skb)
999 skb_queue_tail(q, skb);
Amy Griffis93315ed2006-02-07 12:05:27 -05001000}
1001
Amy Griffis5adc8a62006-06-14 18:45:21 -04001002/* Log rule additions and removals */
Eric Parisdc9eb692013-04-19 13:23:09 -04001003static void audit_log_rule_change(char *action, struct audit_krule *rule, int res)
Amy Griffis5adc8a62006-06-14 18:45:21 -04001004{
1005 struct audit_buffer *ab;
Eric Parisdc9eb692013-04-19 13:23:09 -04001006 uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(current));
1007 u32 sessionid = audit_get_sessionid(current);
Amy Griffis5adc8a62006-06-14 18:45:21 -04001008
Eric Paris1a6b9f22008-01-07 17:09:31 -05001009 if (!audit_enabled)
1010 return;
1011
Amy Griffis5adc8a62006-06-14 18:45:21 -04001012 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
1013 if (!ab)
1014 return;
Eric Parisdc9eb692013-04-19 13:23:09 -04001015 audit_log_format(ab, "auid=%u ses=%u" ,loginuid, sessionid);
Eric Parisb122c372013-04-19 15:00:33 -04001016 audit_log_task_context(ab);
Eric Paris9d960982009-06-11 14:31:37 -04001017 audit_log_format(ab, " op=");
1018 audit_log_string(ab, action);
1019 audit_log_key(ab, rule->filterkey);
Amy Griffis5adc8a62006-06-14 18:45:21 -04001020 audit_log_format(ab, " list=%d res=%d", rule->listnr, res);
1021 audit_log_end(ab);
1022}
1023
David Woodhousefe7752b2005-12-15 18:33:52 +00001024/**
1025 * audit_receive_filter - apply all rules to the specified message type
1026 * @type: audit message type
1027 * @pid: target pid for netlink audit messages
David Woodhousefe7752b2005-12-15 18:33:52 +00001028 * @seq: netlink audit message sequence (serial) number
1029 * @data: payload data
Amy Griffis93315ed2006-02-07 12:05:27 -05001030 * @datasz: size of payload data
David Woodhousefe7752b2005-12-15 18:33:52 +00001031 */
Eric Parisdc9eb692013-04-19 13:23:09 -04001032int audit_receive_filter(int type, int pid, int seq, void *data, size_t datasz)
David Woodhousefe7752b2005-12-15 18:33:52 +00001033{
1034 struct task_struct *tsk;
Al Viro9044e6b2006-05-22 01:09:24 -04001035 struct audit_netlink_list *dest;
Amy Griffis93315ed2006-02-07 12:05:27 -05001036 int err = 0;
1037 struct audit_entry *entry;
David Woodhousefe7752b2005-12-15 18:33:52 +00001038
1039 switch (type) {
Amy Griffis93315ed2006-02-07 12:05:27 -05001040 case AUDIT_LIST_RULES:
David Woodhousefe7752b2005-12-15 18:33:52 +00001041 /* We can't just spew out the rules here because we might fill
1042 * the available socket buffer space and deadlock waiting for
1043 * auditctl to read from it... which isn't ever going to
1044 * happen if we're actually running in the context of auditctl
1045 * trying to _send_ the stuff */
Daniel Walker9ce34212007-10-18 03:06:06 -07001046
Al Viro9044e6b2006-05-22 01:09:24 -04001047 dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL);
David Woodhousefe7752b2005-12-15 18:33:52 +00001048 if (!dest)
1049 return -ENOMEM;
Al Viro9044e6b2006-05-22 01:09:24 -04001050 dest->pid = pid;
1051 skb_queue_head_init(&dest->q);
David Woodhousefe7752b2005-12-15 18:33:52 +00001052
Amy Griffisf368c07d2006-04-07 16:55:56 -04001053 mutex_lock(&audit_filter_mutex);
Eric Paris18900902013-04-18 19:16:36 -04001054 audit_list_rules(pid, seq, &dest->q);
Amy Griffisf368c07d2006-04-07 16:55:56 -04001055 mutex_unlock(&audit_filter_mutex);
Al Viro9044e6b2006-05-22 01:09:24 -04001056
1057 tsk = kthread_run(audit_send_list, dest, "audit_send_list");
David Woodhousefe7752b2005-12-15 18:33:52 +00001058 if (IS_ERR(tsk)) {
Al Viro9044e6b2006-05-22 01:09:24 -04001059 skb_queue_purge(&dest->q);
David Woodhousefe7752b2005-12-15 18:33:52 +00001060 kfree(dest);
1061 err = PTR_ERR(tsk);
1062 }
1063 break;
Amy Griffis93315ed2006-02-07 12:05:27 -05001064 case AUDIT_ADD_RULE:
Eric Paris18900902013-04-18 19:16:36 -04001065 entry = audit_data_to_entry(data, datasz);
Amy Griffis93315ed2006-02-07 12:05:27 -05001066 if (IS_ERR(entry))
1067 return PTR_ERR(entry);
David Woodhousefe7752b2005-12-15 18:33:52 +00001068
Al Viro36c4f1b12008-12-15 01:50:28 -05001069 err = audit_add_rule(entry);
Eric Parisdc9eb692013-04-19 13:23:09 -04001070 audit_log_rule_change("add rule", &entry->rule, !err);
Steve Grubb5d330102006-01-09 09:48:17 -05001071 if (err)
Amy Griffis93315ed2006-02-07 12:05:27 -05001072 audit_free_rule(entry);
David Woodhousefe7752b2005-12-15 18:33:52 +00001073 break;
Amy Griffis93315ed2006-02-07 12:05:27 -05001074 case AUDIT_DEL_RULE:
Eric Paris18900902013-04-18 19:16:36 -04001075 entry = audit_data_to_entry(data, datasz);
Amy Griffis93315ed2006-02-07 12:05:27 -05001076 if (IS_ERR(entry))
1077 return PTR_ERR(entry);
David Woodhousefe7752b2005-12-15 18:33:52 +00001078
Al Viro36c4f1b12008-12-15 01:50:28 -05001079 err = audit_del_rule(entry);
Eric Parisdc9eb692013-04-19 13:23:09 -04001080 audit_log_rule_change("remove rule", &entry->rule, !err);
Amy Griffis93315ed2006-02-07 12:05:27 -05001081 audit_free_rule(entry);
David Woodhousefe7752b2005-12-15 18:33:52 +00001082 break;
1083 default:
1084 return -EINVAL;
1085 }
1086
1087 return err;
1088}
1089
Al Viro5af75d82008-12-16 05:59:26 -05001090int audit_comparator(u32 left, u32 op, u32 right)
David Woodhousefe7752b2005-12-15 18:33:52 +00001091{
1092 switch (op) {
Al Viro5af75d82008-12-16 05:59:26 -05001093 case Audit_equal:
David Woodhousefe7752b2005-12-15 18:33:52 +00001094 return (left == right);
Al Viro5af75d82008-12-16 05:59:26 -05001095 case Audit_not_equal:
David Woodhousefe7752b2005-12-15 18:33:52 +00001096 return (left != right);
Al Viro5af75d82008-12-16 05:59:26 -05001097 case Audit_lt:
David Woodhousefe7752b2005-12-15 18:33:52 +00001098 return (left < right);
Al Viro5af75d82008-12-16 05:59:26 -05001099 case Audit_le:
David Woodhousefe7752b2005-12-15 18:33:52 +00001100 return (left <= right);
Al Viro5af75d82008-12-16 05:59:26 -05001101 case Audit_gt:
David Woodhousefe7752b2005-12-15 18:33:52 +00001102 return (left > right);
Al Viro5af75d82008-12-16 05:59:26 -05001103 case Audit_ge:
David Woodhousefe7752b2005-12-15 18:33:52 +00001104 return (left >= right);
Al Viro5af75d82008-12-16 05:59:26 -05001105 case Audit_bitmask:
Eric Paris74f23452007-06-04 17:00:14 -04001106 return (left & right);
Al Viro5af75d82008-12-16 05:59:26 -05001107 case Audit_bittest:
Eric Paris74f23452007-06-04 17:00:14 -04001108 return ((left & right) == right);
Al Viro5af75d82008-12-16 05:59:26 -05001109 default:
1110 BUG();
1111 return 0;
David Woodhousefe7752b2005-12-15 18:33:52 +00001112 }
1113}
1114
Eric W. Biedermanca57ec02012-09-11 02:18:08 -07001115int audit_uid_comparator(kuid_t left, u32 op, kuid_t right)
1116{
1117 switch (op) {
1118 case Audit_equal:
1119 return uid_eq(left, right);
1120 case Audit_not_equal:
1121 return !uid_eq(left, right);
1122 case Audit_lt:
1123 return uid_lt(left, right);
1124 case Audit_le:
1125 return uid_lte(left, right);
1126 case Audit_gt:
1127 return uid_gt(left, right);
1128 case Audit_ge:
1129 return uid_gte(left, right);
1130 case Audit_bitmask:
1131 case Audit_bittest:
1132 default:
1133 BUG();
1134 return 0;
1135 }
1136}
1137
1138int audit_gid_comparator(kgid_t left, u32 op, kgid_t right)
1139{
1140 switch (op) {
1141 case Audit_equal:
1142 return gid_eq(left, right);
1143 case Audit_not_equal:
1144 return !gid_eq(left, right);
1145 case Audit_lt:
1146 return gid_lt(left, right);
1147 case Audit_le:
1148 return gid_lte(left, right);
1149 case Audit_gt:
1150 return gid_gt(left, right);
1151 case Audit_ge:
1152 return gid_gte(left, right);
1153 case Audit_bitmask:
1154 case Audit_bittest:
1155 default:
1156 BUG();
1157 return 0;
1158 }
1159}
1160
Jeff Laytonbfcec702012-10-10 15:25:23 -04001161/**
1162 * parent_len - find the length of the parent portion of a pathname
1163 * @path: pathname of which to determine length
1164 */
1165int parent_len(const char *path)
1166{
1167 int plen;
1168 const char *p;
1169
1170 plen = strlen(path);
1171
1172 if (plen == 0)
1173 return plen;
1174
1175 /* disregard trailing slashes */
1176 p = path + plen - 1;
1177 while ((*p == '/') && (p > path))
1178 p--;
1179
1180 /* walk backward until we find the next slash or hit beginning */
1181 while ((*p != '/') && (p > path))
1182 p--;
1183
1184 /* did we find a slash? Then increment to include it in path */
1185 if (*p == '/')
1186 p++;
1187
1188 return p - path;
1189}
1190
Jeff Laytone3d6b072012-10-10 15:25:25 -04001191/**
1192 * audit_compare_dname_path - compare given dentry name with last component in
1193 * given path. Return of 0 indicates a match.
1194 * @dname: dentry name that we're comparing
1195 * @path: full pathname that we're comparing
1196 * @parentlen: length of the parent if known. Passing in AUDIT_NAME_FULL
1197 * here indicates that we must compute this value.
1198 */
1199int audit_compare_dname_path(const char *dname, const char *path, int parentlen)
Amy Griffisf368c07d2006-04-07 16:55:56 -04001200{
Jeff Laytone3d6b072012-10-10 15:25:25 -04001201 int dlen, pathlen;
Amy Griffisf368c07d2006-04-07 16:55:56 -04001202 const char *p;
David Woodhousefe7752b2005-12-15 18:33:52 +00001203
Amy Griffisf368c07d2006-04-07 16:55:56 -04001204 dlen = strlen(dname);
Eric Paris29e9a342012-10-10 15:25:24 -04001205 pathlen = strlen(path);
1206 if (pathlen < dlen)
Amy Griffisf368c07d2006-04-07 16:55:56 -04001207 return 1;
1208
Jeff Laytone3d6b072012-10-10 15:25:25 -04001209 parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen;
Eric Paris29e9a342012-10-10 15:25:24 -04001210 if (pathlen - parentlen != dlen)
Amy Griffisf368c07d2006-04-07 16:55:56 -04001211 return 1;
Eric Paris29e9a342012-10-10 15:25:24 -04001212
1213 p = path + parentlen;
Amy Griffisf368c07d2006-04-07 16:55:56 -04001214
1215 return strncmp(p, dname, dlen);
1216}
David Woodhousefe7752b2005-12-15 18:33:52 +00001217
Eric Paris62062cf2013-04-16 13:08:43 -04001218static int audit_filter_user_rules(struct audit_krule *rule, int type,
David Woodhousefe7752b2005-12-15 18:33:52 +00001219 enum audit_state *state)
1220{
1221 int i;
1222
1223 for (i = 0; i < rule->field_count; i++) {
Amy Griffis93315ed2006-02-07 12:05:27 -05001224 struct audit_field *f = &rule->fields[i];
David Woodhousefe7752b2005-12-15 18:33:52 +00001225 int result = 0;
Patrick McHardyc53fa1e2011-03-03 10:55:40 -08001226 u32 sid;
David Woodhousefe7752b2005-12-15 18:33:52 +00001227
Amy Griffis93315ed2006-02-07 12:05:27 -05001228 switch (f->type) {
David Woodhousefe7752b2005-12-15 18:33:52 +00001229 case AUDIT_PID:
Eric W. Biederman02276bd2012-09-10 23:10:16 -07001230 result = audit_comparator(task_pid_vnr(current), f->op, f->val);
David Woodhousefe7752b2005-12-15 18:33:52 +00001231 break;
1232 case AUDIT_UID:
Eric W. Biedermanca57ec02012-09-11 02:18:08 -07001233 result = audit_uid_comparator(current_uid(), f->op, f->uid);
David Woodhousefe7752b2005-12-15 18:33:52 +00001234 break;
1235 case AUDIT_GID:
Eric W. Biedermanca57ec02012-09-11 02:18:08 -07001236 result = audit_gid_comparator(current_gid(), f->op, f->gid);
David Woodhousefe7752b2005-12-15 18:33:52 +00001237 break;
1238 case AUDIT_LOGINUID:
Eric W. Biedermanca57ec02012-09-11 02:18:08 -07001239 result = audit_uid_comparator(audit_get_loginuid(current),
1240 f->op, f->uid);
David Woodhousefe7752b2005-12-15 18:33:52 +00001241 break;
Eric W. Biederman780a7652013-04-09 02:22:10 -07001242 case AUDIT_LOGINUID_SET:
1243 result = audit_comparator(audit_loginuid_set(current),
1244 f->op, f->val);
1245 break;
Eric Paris62062cf2013-04-16 13:08:43 -04001246 case AUDIT_MSGTYPE:
1247 result = audit_comparator(type, f->op, f->val);
1248 break;
Miloslav Trmacd29be152010-09-16 18:14:11 -04001249 case AUDIT_SUBJ_USER:
1250 case AUDIT_SUBJ_ROLE:
1251 case AUDIT_SUBJ_TYPE:
1252 case AUDIT_SUBJ_SEN:
1253 case AUDIT_SUBJ_CLR:
Patrick McHardyc53fa1e2011-03-03 10:55:40 -08001254 if (f->lsm_rule) {
1255 security_task_getsecid(current, &sid);
1256 result = security_audit_rule_match(sid,
Miloslav Trmacd29be152010-09-16 18:14:11 -04001257 f->type,
1258 f->op,
1259 f->lsm_rule,
1260 NULL);
Patrick McHardyc53fa1e2011-03-03 10:55:40 -08001261 }
Miloslav Trmacd29be152010-09-16 18:14:11 -04001262 break;
David Woodhousefe7752b2005-12-15 18:33:52 +00001263 }
1264
1265 if (!result)
1266 return 0;
1267 }
1268 switch (rule->action) {
1269 case AUDIT_NEVER: *state = AUDIT_DISABLED; break;
David Woodhousefe7752b2005-12-15 18:33:52 +00001270 case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break;
1271 }
1272 return 1;
1273}
1274
Eric Paris62062cf2013-04-16 13:08:43 -04001275int audit_filter_user(int type)
David Woodhousefe7752b2005-12-15 18:33:52 +00001276{
Ingo Molnar11f57ce2007-02-10 01:46:09 -08001277 enum audit_state state = AUDIT_DISABLED;
David Woodhousefe7752b2005-12-15 18:33:52 +00001278 struct audit_entry *e;
David Woodhousefe7752b2005-12-15 18:33:52 +00001279 int ret = 1;
1280
1281 rcu_read_lock();
1282 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_USER], list) {
Eric Paris62062cf2013-04-16 13:08:43 -04001283 if (audit_filter_user_rules(&e->rule, type, &state)) {
David Woodhousefe7752b2005-12-15 18:33:52 +00001284 if (state == AUDIT_DISABLED)
1285 ret = 0;
1286 break;
1287 }
1288 }
1289 rcu_read_unlock();
1290
1291 return ret; /* Audit by default */
1292}
1293
1294int audit_filter_type(int type)
1295{
1296 struct audit_entry *e;
1297 int result = 0;
Daniel Walker9ce34212007-10-18 03:06:06 -07001298
David Woodhousefe7752b2005-12-15 18:33:52 +00001299 rcu_read_lock();
1300 if (list_empty(&audit_filter_list[AUDIT_FILTER_TYPE]))
1301 goto unlock_and_return;
1302
1303 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE],
1304 list) {
David Woodhousefe7752b2005-12-15 18:33:52 +00001305 int i;
Amy Griffis93315ed2006-02-07 12:05:27 -05001306 for (i = 0; i < e->rule.field_count; i++) {
1307 struct audit_field *f = &e->rule.fields[i];
1308 if (f->type == AUDIT_MSGTYPE) {
1309 result = audit_comparator(type, f->op, f->val);
David Woodhousefe7752b2005-12-15 18:33:52 +00001310 if (!result)
1311 break;
1312 }
1313 }
1314 if (result)
1315 goto unlock_and_return;
1316 }
1317unlock_and_return:
1318 rcu_read_unlock();
1319 return result;
1320}
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001321
Al Viroe45aa212008-12-15 01:17:50 -05001322static int update_lsm_rule(struct audit_krule *r)
Al Viro1a9d0792008-12-14 12:04:02 -05001323{
Al Viroe45aa212008-12-15 01:17:50 -05001324 struct audit_entry *entry = container_of(r, struct audit_entry, rule);
Al Viro1a9d0792008-12-14 12:04:02 -05001325 struct audit_entry *nentry;
Al Viro1a9d0792008-12-14 12:04:02 -05001326 int err = 0;
1327
Al Viroe45aa212008-12-15 01:17:50 -05001328 if (!security_audit_rule_known(r))
Al Viro1a9d0792008-12-14 12:04:02 -05001329 return 0;
1330
Eric Parisae7b8f42009-12-17 20:12:04 -05001331 nentry = audit_dupe_rule(r);
Al Viro1a9d0792008-12-14 12:04:02 -05001332 if (IS_ERR(nentry)) {
1333 /* save the first error encountered for the
1334 * return value */
1335 err = PTR_ERR(nentry);
1336 audit_panic("error updating LSM filters");
Eric Parisae7b8f42009-12-17 20:12:04 -05001337 if (r->watch)
Al Viroe45aa212008-12-15 01:17:50 -05001338 list_del(&r->rlist);
Al Viro1a9d0792008-12-14 12:04:02 -05001339 list_del_rcu(&entry->list);
Al Viroe45aa212008-12-15 01:17:50 -05001340 list_del(&r->list);
Al Viro1a9d0792008-12-14 12:04:02 -05001341 } else {
Eric Parisae7b8f42009-12-17 20:12:04 -05001342 if (r->watch || r->tree)
Al Viroe45aa212008-12-15 01:17:50 -05001343 list_replace_init(&r->rlist, &nentry->rule.rlist);
Al Viro1a9d0792008-12-14 12:04:02 -05001344 list_replace_rcu(&entry->list, &nentry->list);
Al Viroe45aa212008-12-15 01:17:50 -05001345 list_replace(&r->list, &nentry->rule.list);
Al Viro1a9d0792008-12-14 12:04:02 -05001346 }
1347 call_rcu(&entry->rcu, audit_free_rule_rcu);
1348
1349 return err;
1350}
1351
Ahmed S. Darwish04305e42008-04-19 09:59:43 +10001352/* This function will re-initialize the lsm_rule field of all applicable rules.
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +02001353 * It will traverse the filter lists serarching for rules that contain LSM
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001354 * specific filter fields. When such a rule is found, it is copied, the
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +02001355 * LSM field is re-initialized, and the old rule is replaced with the
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001356 * updated rule. */
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +02001357int audit_update_lsm_rules(void)
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001358{
Al Viroe45aa212008-12-15 01:17:50 -05001359 struct audit_krule *r, *n;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001360 int i, err = 0;
1361
Amy Griffisf368c07d2006-04-07 16:55:56 -04001362 /* audit_filter_mutex synchronizes the writers */
1363 mutex_lock(&audit_filter_mutex);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001364
1365 for (i = 0; i < AUDIT_NR_FILTERS; i++) {
Al Viroe45aa212008-12-15 01:17:50 -05001366 list_for_each_entry_safe(r, n, &audit_rules_list[i], list) {
1367 int res = update_lsm_rule(r);
Al Viro1a9d0792008-12-14 12:04:02 -05001368 if (!err)
1369 err = res;
1370 }
1371 }
Amy Griffisf368c07d2006-04-07 16:55:56 -04001372 mutex_unlock(&audit_filter_mutex);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001373
1374 return err;
1375}