Commit bfcec708 authored by Jeff Layton's avatar Jeff Layton Committed by Al Viro
Browse files

audit: set the name_len in audit_inode for parent lookups 



Currently, this gets set mostly by happenstance when we call into
audit_inode_child. While that might be a little more efficient, it seems
wrong. If the syscall ends up failing before audit_inode_child ever gets
called, then you'll have an audit_names record that shows the full path
but has the parent inode info attached.

Fix this by passing in a parent flag when we call audit_inode that gets
set to the value of LOOKUP_PARENT. We can then fix up the pathname for
the audit entry correctly from the get-go.

While we're at it, clean up the no-op macro for audit_inode in the
!CONFIG_AUDITSYSCALL case.

Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 78e2e802

fs/namei.c

+7 −7
Original line number Diff line number Diff line
@@ -1973,7 +1973,7 @@ static int do_path_lookup(int dfd, const char *name, 
		retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);



	if (likely(!retval))

		audit_inode(name, nd->path.dentry);

		audit_inode(name, nd->path.dentry, flags & LOOKUP_PARENT);

	return retval;

}
@@ -2648,7 +2648,7 @@ static int do_last(struct nameidata *nd, struct path *path, 
		error = complete_walk(nd);

		if (error)

			return error;

		audit_inode(pathname, nd->path.dentry);

		audit_inode(pathname, nd->path.dentry, 0);

		if (open_flag & O_CREAT) {

			error = -EISDIR;

			goto out;
@@ -2658,7 +2658,7 @@ static int do_last(struct nameidata *nd, struct path *path, 
		error = complete_walk(nd);

		if (error)

			return error;

		audit_inode(pathname, dir);

		audit_inode(pathname, dir, 0);

		goto finish_open;

	}
@@ -2687,7 +2687,7 @@ static int do_last(struct nameidata *nd, struct path *path, 
		if (error)

			return error;



		audit_inode(pathname, dir);

		audit_inode(pathname, dir, 0);

		error = -EISDIR;

		/* trailing slashes? */

		if (nd->last.name[nd->last.len])
@@ -2717,7 +2717,7 @@ retry_lookup: 
		    !S_ISREG(file->f_path.dentry->d_inode->i_mode))

			will_truncate = false;



		audit_inode(pathname, file->f_path.dentry);

		audit_inode(pathname, file->f_path.dentry, 0);

		goto opened;

	}
@@ -2734,7 +2734,7 @@ retry_lookup: 
	 * create/update audit record if it already exists.

	 */

	if (path->dentry->d_inode)

		audit_inode(pathname, path->dentry);

		audit_inode(pathname, path->dentry, 0);



	/*

	 * If atomic_open() acquired write access it is dropped now due to
@@ -2799,7 +2799,7 @@ finish_lookup: 
	error = -ENOTDIR;

	if ((nd->flags & LOOKUP_DIRECTORY) && !nd->inode->i_op->lookup)

		goto out;

	audit_inode(pathname, nd->path.dentry);

	audit_inode(pathname, nd->path.dentry, 0);

finish_open:

	if (!S_ISREG(nd->inode->i_mode))

		will_truncate = false;

fs/open.c

+2 −2
Original line number Diff line number Diff line
@@ -478,7 +478,7 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd, umode_t, mode) 


	file = fget(fd);

	if (file) {

		audit_inode(NULL, file->f_path.dentry);

		audit_inode(NULL, file->f_path.dentry, 0);

		err = chmod_common(&file->f_path, mode);

		fput(file);

	}
@@ -588,7 +588,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group) 
	error = mnt_want_write_file(f.file);

	if (error)

		goto out_fput;

	audit_inode(NULL, f.file->f_path.dentry);

	audit_inode(NULL, f.file->f_path.dentry, 0);

	error = chown_common(&f.file->f_path, user, group);

	mnt_drop_write_file(f.file);

out_fput:

fs/xattr.c

+4 −4
Original line number Diff line number Diff line
@@ -412,7 +412,7 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name, 
	if (!f.file)

		return error;

	dentry = f.file->f_path.dentry;

	audit_inode(NULL, dentry);

	audit_inode(NULL, dentry, 0);

	error = mnt_want_write_file(f.file);

	if (!error) {

		error = setxattr(dentry, name, value, size, flags);
@@ -507,7 +507,7 @@ SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name, 


	if (!f.file)

		return error;

	audit_inode(NULL, f.file->f_path.dentry);

	audit_inode(NULL, f.file->f_path.dentry, 0);

	error = getxattr(f.file->f_path.dentry, name, value, size);

	fdput(f);

	return error;
@@ -586,7 +586,7 @@ SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size) 


	if (!f.file)

		return error;

	audit_inode(NULL, f.file->f_path.dentry);

	audit_inode(NULL, f.file->f_path.dentry, 0);

	error = listxattr(f.file->f_path.dentry, list, size);

	fdput(f);

	return error;
@@ -655,7 +655,7 @@ SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name) 
	if (!f.file)

		return error;

	dentry = f.file->f_path.dentry;

	audit_inode(NULL, dentry);

	audit_inode(NULL, dentry, 0);

	error = mnt_want_write_file(f.file);

	if (!error) {

		error = removexattr(dentry, name);

include/linux/audit.h

+10 −5
Original line number Diff line number Diff line
@@ -456,6 +456,7 @@ extern int audit_classify_arch(int arch); 
/* audit_names->type values */

#define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */

#define	AUDIT_TYPE_NORMAL	1	/* a "normal" audit record */

#define	AUDIT_TYPE_PARENT	2	/* a parent audit record */



#ifdef CONFIG_AUDITSYSCALL

/* These are defined in auditsc.c */
@@ -468,7 +469,8 @@ extern void __audit_syscall_entry(int arch, 
extern void __audit_syscall_exit(int ret_success, long ret_value);

extern void __audit_getname(const char *name);

extern void audit_putname(const char *name);

extern void __audit_inode(const char *name, const struct dentry *dentry);

extern void __audit_inode(const char *name, const struct dentry *dentry,

				unsigned int parent);

extern void __audit_inode_child(const struct inode *parent,

				const struct dentry *dentry);

extern void __audit_seccomp(unsigned long syscall, long signr, int code);
@@ -505,9 +507,10 @@ static inline void audit_getname(const char *name) 
	if (unlikely(!audit_dummy_context()))

		__audit_getname(name);

}

static inline void audit_inode(const char *name, const struct dentry *dentry) {

static inline void audit_inode(const char *name, const struct dentry *dentry,

				unsigned int parent) {

	if (unlikely(!audit_dummy_context()))

		__audit_inode(name, dentry);

		__audit_inode(name, dentry, parent);

}

static inline void audit_inode_child(const struct inode *parent,

				     const struct dentry *dentry) {
@@ -660,12 +663,14 @@ static inline void audit_getname(const char *name) 
{ }

static inline void audit_putname(const char *name)

{ }

static inline void __audit_inode(const char *name, const struct dentry *dentry)

static inline void __audit_inode(const char *name, const struct dentry *dentry,

					unsigned int parent)

{ }

static inline void __audit_inode_child(const struct inode *parent,

					const struct dentry *dentry)

{ }

static inline void audit_inode(const char *name, const struct dentry *dentry)

static inline void audit_inode(const char *name, const struct dentry *dentry,

				unsigned int parent)

{ }

static inline void audit_inode_child(const struct inode *parent,

				     const struct dentry *dentry)

ipc/mqueue.c

+4 −4
Original line number Diff line number Diff line
@@ -804,7 +804,7 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, umode_t, mode, 


	if (oflag & O_CREAT) {

		if (path.dentry->d_inode) {	/* entry already exists */

			audit_inode(name, path.dentry);

			audit_inode(name, path.dentry, 0);

			if (oflag & O_EXCL) {

				error = -EEXIST;

				goto out;
@@ -824,7 +824,7 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, umode_t, mode, 
			error = -ENOENT;

			goto out;

		}

		audit_inode(name, path.dentry);

		audit_inode(name, path.dentry, 0);

		filp = do_open(&path, oflag);

	}
@@ -978,7 +978,7 @@ SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr, 
		goto out_fput;

	}

	info = MQUEUE_I(inode);

	audit_inode(NULL, f.file->f_path.dentry);

	audit_inode(NULL, f.file->f_path.dentry, 0);



	if (unlikely(!(f.file->f_mode & FMODE_WRITE))) {

		ret = -EBADF;
@@ -1094,7 +1094,7 @@ SYSCALL_DEFINE5(mq_timedreceive, mqd_t, mqdes, char __user *, u_msg_ptr, 
		goto out_fput;

	}

	info = MQUEUE_I(inode);

	audit_inode(NULL, f.file->f_path.dentry);

	audit_inode(NULL, f.file->f_path.dentry, 0);



	if (unlikely(!(f.file->f_mode & FMODE_READ))) {

		ret = -EBADF;

CRA Git | Maintained and supported by SUSTech CRA and CCSE