Commit 4fa6b5ec authored by Jeff Layton's avatar Jeff Layton Committed by Al Viro
Browse files

audit: overhaul __audit_inode_child to accomodate retrying 



In order to accomodate retrying path-based syscalls, we need to add a
new "type" argument to audit_inode_child. This will tell us whether
we're looking for a child entry that represents a create or a delete.

If we find a parent, don't automatically assume that we need to create a
new entry. Instead, use the information we have to try to find an
existing entry first. Update it if one is found and create a new one if
not.

Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent e3d6b07b

fs/btrfs/ioctl.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -638,7 +638,7 @@ static int btrfs_may_delete(struct inode *dir,struct dentry *victim,int isdir) 
		return -ENOENT;

		return -ENOENT;





	BUG_ON(victim->d_parent->d_inode != dir);

	BUG_ON(victim->d_parent->d_inode != dir);

	audit_inode_child(dir, victim);

	audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);





	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);

	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);

	if (error)

	if (error)

fs/namei.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -2176,7 +2176,7 @@ static int may_delete(struct inode *dir,struct dentry *victim,int isdir) 
		return -ENOENT;

		return -ENOENT;





	BUG_ON(victim->d_parent->d_inode != dir);

	BUG_ON(victim->d_parent->d_inode != dir);

	audit_inode_child(dir, victim);

	audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);





	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);

	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);

	if (error)

	if (error)

include/linux/audit.h

+11 −5
Original line number Original line Diff line number Diff line
@@ -457,6 +457,8 @@ extern int audit_classify_arch(int arch); 
#define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */

#define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */

#define	AUDIT_TYPE_NORMAL	1	/* a "normal" audit record */

#define	AUDIT_TYPE_NORMAL	1	/* a "normal" audit record */

#define	AUDIT_TYPE_PARENT	2	/* a parent audit record */

#define	AUDIT_TYPE_PARENT	2	/* a parent audit record */

#define	AUDIT_TYPE_CHILD_DELETE 3	/* a child being deleted */

#define	AUDIT_TYPE_CHILD_CREATE 4	/* a child being created */





#ifdef CONFIG_AUDITSYSCALL

#ifdef CONFIG_AUDITSYSCALL

/* These are defined in auditsc.c */

/* These are defined in auditsc.c */
@@ -472,7 +474,8 @@ extern void audit_putname(const char *name); 
extern void __audit_inode(const char *name, const struct dentry *dentry,

extern void __audit_inode(const char *name, const struct dentry *dentry,

				unsigned int parent);

				unsigned int parent);

extern void __audit_inode_child(const struct inode *parent,

extern void __audit_inode_child(const struct inode *parent,

				const struct dentry *dentry);

				const struct dentry *dentry,

				const unsigned char type);

extern void __audit_seccomp(unsigned long syscall, long signr, int code);

extern void __audit_seccomp(unsigned long syscall, long signr, int code);

extern void __audit_ptrace(struct task_struct *t);

extern void __audit_ptrace(struct task_struct *t);
@@ -513,9 +516,10 @@ static inline void audit_inode(const char *name, const struct dentry *dentry, 
		__audit_inode(name, dentry, parent);

		__audit_inode(name, dentry, parent);

}

}

static inline void audit_inode_child(const struct inode *parent,

static inline void audit_inode_child(const struct inode *parent,

				     const struct dentry *dentry) {

				     const struct dentry *dentry,

				     const unsigned char type) {

	if (unlikely(!audit_dummy_context()))

	if (unlikely(!audit_dummy_context()))

		__audit_inode_child(parent, dentry);

		__audit_inode_child(parent, dentry, type);

}

}

void audit_core_dumps(long signr);

void audit_core_dumps(long signr);
@@ -667,13 +671,15 @@ static inline void __audit_inode(const char *name, const struct dentry *dentry, 
					unsigned int parent)

					unsigned int parent)

{ }

{ }

static inline void __audit_inode_child(const struct inode *parent,

static inline void __audit_inode_child(const struct inode *parent,

					const struct dentry *dentry)

					const struct dentry *dentry,

					const unsigned char type)

{ }

{ }

static inline void audit_inode(const char *name, const struct dentry *dentry,

static inline void audit_inode(const char *name, const struct dentry *dentry,

				unsigned int parent)

				unsigned int parent)

{ }

{ }

static inline void audit_inode_child(const struct inode *parent,

static inline void audit_inode_child(const struct inode *parent,

				     const struct dentry *dentry)

				     const struct dentry *dentry,

				     const unsigned char type)

{ }

{ }

static inline void audit_core_dumps(long signr)

static inline void audit_core_dumps(long signr)

{ }

{ }

include/linux/fsnotify.h

+4 −4
Original line number Original line Diff line number Diff line
@@ -109,7 +109,7 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir, 




	if (source)

	if (source)

		fsnotify(source, FS_MOVE_SELF, moved->d_inode, FSNOTIFY_EVENT_INODE, NULL, 0);

		fsnotify(source, FS_MOVE_SELF, moved->d_inode, FSNOTIFY_EVENT_INODE, NULL, 0);

	audit_inode_child(new_dir, moved);

	audit_inode_child(new_dir, moved, AUDIT_TYPE_CHILD_CREATE);

}

}





/*

/*
@@ -155,7 +155,7 @@ static inline void fsnotify_inoderemove(struct inode *inode) 
 */

 */

static inline void fsnotify_create(struct inode *inode, struct dentry *dentry)

static inline void fsnotify_create(struct inode *inode, struct dentry *dentry)

{

{

	audit_inode_child(inode, dentry);

	audit_inode_child(inode, dentry, AUDIT_TYPE_CHILD_CREATE);





	fsnotify(inode, FS_CREATE, dentry->d_inode, FSNOTIFY_EVENT_INODE, dentry->d_name.name, 0);

	fsnotify(inode, FS_CREATE, dentry->d_inode, FSNOTIFY_EVENT_INODE, dentry->d_name.name, 0);

}

}
@@ -168,7 +168,7 @@ static inline void fsnotify_create(struct inode *inode, struct dentry *dentry) 
static inline void fsnotify_link(struct inode *dir, struct inode *inode, struct dentry *new_dentry)

static inline void fsnotify_link(struct inode *dir, struct inode *inode, struct dentry *new_dentry)

{

{

	fsnotify_link_count(inode);

	fsnotify_link_count(inode);

	audit_inode_child(dir, new_dentry);

	audit_inode_child(dir, new_dentry, AUDIT_TYPE_CHILD_CREATE);





	fsnotify(dir, FS_CREATE, inode, FSNOTIFY_EVENT_INODE, new_dentry->d_name.name, 0);

	fsnotify(dir, FS_CREATE, inode, FSNOTIFY_EVENT_INODE, new_dentry->d_name.name, 0);

}

}
@@ -181,7 +181,7 @@ static inline void fsnotify_mkdir(struct inode *inode, struct dentry *dentry) 
	__u32 mask = (FS_CREATE | FS_ISDIR);

	__u32 mask = (FS_CREATE | FS_ISDIR);

	struct inode *d_inode = dentry->d_inode;

	struct inode *d_inode = dentry->d_inode;





	audit_inode_child(inode, dentry);

	audit_inode_child(inode, dentry, AUDIT_TYPE_CHILD_CREATE);





	fsnotify(inode, mask, d_inode, FSNOTIFY_EVENT_INODE, dentry->d_name.name, 0);

	fsnotify(inode, mask, d_inode, FSNOTIFY_EVENT_INODE, dentry->d_name.name, 0);

}

}

kernel/auditsc.c

+30 −27
Original line number Original line Diff line number Diff line
@@ -2189,6 +2189,7 @@ out: 
 * __audit_inode_child - collect inode info for created/removed objects

 * __audit_inode_child - collect inode info for created/removed objects

 * @parent: inode of dentry parent

 * @parent: inode of dentry parent

 * @dentry: dentry being audited

 * @dentry: dentry being audited

 * @type:   AUDIT_TYPE_* value that we're looking for

 *

 *

 * For syscalls that create or remove filesystem objects, audit_inode

 * For syscalls that create or remove filesystem objects, audit_inode

 * can only collect information for the filesystem object's parent.

 * can only collect information for the filesystem object's parent.
@@ -2199,13 +2200,13 @@ out: 
 * unsuccessful attempts.

 * unsuccessful attempts.

 */

 */

void __audit_inode_child(const struct inode *parent,

void __audit_inode_child(const struct inode *parent,

			 const struct dentry *dentry)

			 const struct dentry *dentry,

			 const unsigned char type)

{

{

	struct audit_context *context = current->audit_context;

	struct audit_context *context = current->audit_context;

	const char *found_parent = NULL, *found_child = NULL;

	const struct inode *inode = dentry->d_inode;

	const struct inode *inode = dentry->d_inode;

	const char *dname = dentry->d_name.name;

	const char *dname = dentry->d_name.name;

	struct audit_names *n;

	struct audit_names *n, *found_parent = NULL, *found_child = NULL;





	if (!context->in_syscall)

	if (!context->in_syscall)

		return;

		return;
@@ -2213,63 +2214,65 @@ void __audit_inode_child(const struct inode *parent, 
	if (inode)

	if (inode)

		handle_one(inode);

		handle_one(inode);





	/* parent is more likely, look for it first */

	/* look for a parent entry first */

	list_for_each_entry(n, &context->names_list, list) {

	list_for_each_entry(n, &context->names_list, list) {

		if (!n->name)

		if (!n->name || n->type != AUDIT_TYPE_PARENT)

			continue;

			continue;





		if (n->ino == parent->i_ino &&

		if (n->ino == parent->i_ino &&

		    !audit_compare_dname_path(dname, n->name, n->name_len)) {

		    !audit_compare_dname_path(dname, n->name, n->name_len)) {

			found_parent = n->name;

			found_parent = n;

			goto add_names;

			break;

		}

		}

	}

	}





	/* no matching parent, look for matching child */

	/* is there a matching child entry? */

	list_for_each_entry(n, &context->names_list, list) {

	list_for_each_entry(n, &context->names_list, list) {

		if (!n->name)

		/* can only match entries that have a name */

		if (!n->name || n->type != type)

			continue;



		/* if we found a parent, make sure this one is a child of it */

		if (found_parent && (n->name != found_parent->name))

			continue;

			continue;





		/* strcmp() is the more likely scenario */

		if (!strcmp(dname, n->name) ||

		if (!strcmp(dname, n->name) ||

		    !audit_compare_dname_path(dname, n->name,

		    !audit_compare_dname_path(dname, n->name,

						found_parent ?

						found_parent->name_len :

						AUDIT_NAME_FULL)) {

						AUDIT_NAME_FULL)) {

			if (inode)

			found_child = n;

				audit_copy_inode(n, dentry, inode);

			break;

			else

				n->ino = (unsigned long)-1;

			n->type = AUDIT_TYPE_NORMAL;

			found_child = n->name;

			goto add_names;

		}

		}

	}

	}





add_names:

	if (!found_parent) {

	if (!found_parent) {

		n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);

		/* create a new, "anonymous" parent record */

		n = audit_alloc_name(context, AUDIT_TYPE_PARENT);

		if (!n)

		if (!n)

			return;

			return;

		audit_copy_inode(n, NULL, parent);

		audit_copy_inode(n, NULL, parent);

	}

	}





	if (!found_child) {

	if (!found_child) {

		n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);

		found_child = audit_alloc_name(context, type);

		if (!n)

		if (!found_child)

			return;

			return;





		/* Re-use the name belonging to the slot for a matching parent

		/* Re-use the name belonging to the slot for a matching parent

		 * directory. All names for this context are relinquished in

		 * directory. All names for this context are relinquished in

		 * audit_free_names() */

		 * audit_free_names() */

		if (found_parent) {

		if (found_parent) {

			n->name = found_parent;

			found_child->name = found_parent->name;

			n->name_len = AUDIT_NAME_FULL;

			found_child->name_len = AUDIT_NAME_FULL;

			/* don't call __putname() */

			/* don't call __putname() */

			n->name_put = false;

			found_child->name_put = false;

		}

		}



		if (inode)

			audit_copy_inode(n, dentry, inode);

	}

	}

	if (inode)

		audit_copy_inode(found_child, dentry, inode);

	else

		found_child->ino = (unsigned long)-1;

}

}

EXPORT_SYMBOL_GPL(__audit_inode_child);

EXPORT_SYMBOL_GPL(__audit_inode_child);

CRA Git | Maintained and supported by SUSTech CRA and CCSE