c942fddf8793b (Thomas Gleixner 2019-05-27 08:55:06 +0200 1) // SPDX-License-Identifier: GPL-2.0-or-later
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 2) /* audit_fsnotify.c -- tracking inodes
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 3) *
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 4) * Copyright 2003-2009,2014-2015 Red Hat, Inc.
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 5) * Copyright 2005 Hewlett-Packard Development Company, L.P.
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 6) * Copyright 2005 IBM Corporation
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 7) */
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 8)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 9) #include <linux/kernel.h>
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 10) #include <linux/audit.h>
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 11) #include <linux/kthread.h>
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 12) #include <linux/mutex.h>
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 13) #include <linux/fs.h>
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 14) #include <linux/fsnotify_backend.h>
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 15) #include <linux/namei.h>
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 16) #include <linux/netlink.h>
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 17) #include <linux/sched.h>
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 18) #include <linux/slab.h>
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 19) #include <linux/security.h>
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 20) #include "audit.h"
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 21)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 22) /*
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 23) * this mark lives on the parent directory of the inode in question.
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 24) * but dev, ino, and path are about the child
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 25) */
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 26) struct audit_fsnotify_mark {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 27) dev_t dev; /* associated superblock device */
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 28) unsigned long ino; /* associated inode number */
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 29) char *path; /* insertion path */
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 30) struct fsnotify_mark mark; /* fsnotify mark on the inode */
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 31) struct audit_krule *rule;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 32) };
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 33)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 34) /* fsnotify handle. */
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 35) static struct fsnotify_group *audit_fsnotify_group;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 36)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 37) /* fsnotify events we care about. */
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 38) #define AUDIT_FS_EVENTS (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
7dbe608016786 (Amir Goldstein 2020-07-22 15:58:43 +0300 39) FS_MOVE_SELF)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 40)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 41) static void audit_fsnotify_mark_free(struct audit_fsnotify_mark *audit_mark)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 42) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 43) kfree(audit_mark->path);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 44) kfree(audit_mark);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 45) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 46)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 47) static void audit_fsnotify_free_mark(struct fsnotify_mark *mark)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 48) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 49) struct audit_fsnotify_mark *audit_mark;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 50)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 51) audit_mark = container_of(mark, struct audit_fsnotify_mark, mark);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 52) audit_fsnotify_mark_free(audit_mark);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 53) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 54)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 55) char *audit_mark_path(struct audit_fsnotify_mark *mark)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 56) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 57) return mark->path;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 58) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 59)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 60) int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 61) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 62) if (mark->ino == AUDIT_INO_UNSET)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 63) return 0;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 64) return (mark->ino == ino) && (mark->dev == dev);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 65) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 66)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 67) static void audit_update_mark(struct audit_fsnotify_mark *audit_mark,
3cd5eca8d7a2f (Al Viro 2016-11-20 20:19:09 -0500 68) const struct inode *inode)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 69) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 70) audit_mark->dev = inode ? inode->i_sb->s_dev : AUDIT_DEV_UNSET;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 71) audit_mark->ino = inode ? inode->i_ino : AUDIT_INO_UNSET;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 72) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 73)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 74) struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 75) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 76) struct audit_fsnotify_mark *audit_mark;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 77) struct path path;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 78) struct dentry *dentry;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 79) struct inode *inode;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 80) int ret;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 81)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 82) if (pathname[0] != '/' || pathname[len-1] == '/')
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 83) return ERR_PTR(-EINVAL);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 84)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 85) dentry = kern_path_locked(pathname, &path);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 86) if (IS_ERR(dentry))
b1adbdbda458b (Al Viro 2021-01-29 21:36:33 -0500 87) return ERR_CAST(dentry); /* returning an error */
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 88) inode = path.dentry->d_inode;
5955102c9984f (Al Viro 2016-01-22 15:40:57 -0500 89) inode_unlock(inode);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 90)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 91) audit_mark = kzalloc(sizeof(*audit_mark), GFP_KERNEL);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 92) if (unlikely(!audit_mark)) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 93) audit_mark = ERR_PTR(-ENOMEM);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 94) goto out;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 95) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 96)
054c636e5c805 (Jan Kara 2016-12-21 18:06:12 +0100 97) fsnotify_init_mark(&audit_mark->mark, audit_fsnotify_group);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 98) audit_mark->mark.mask = AUDIT_FS_EVENTS;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 99) audit_mark->path = pathname;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 100) audit_update_mark(audit_mark, dentry->d_inode);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 101) audit_mark->rule = krule;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 102)
b249f5be61658 (Amir Goldstein 2018-04-20 16:10:55 -0700 103) ret = fsnotify_add_inode_mark(&audit_mark->mark, inode, true);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 104) if (ret < 0) {
7b1293234084d (Jan Kara 2016-12-21 18:32:48 +0100 105) fsnotify_put_mark(&audit_mark->mark);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 106) audit_mark = ERR_PTR(ret);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 107) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 108) out:
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 109) dput(dentry);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 110) path_put(&path);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 111) return audit_mark;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 112) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 113)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 114) static void audit_mark_log_rule_change(struct audit_fsnotify_mark *audit_mark, char *op)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 115) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 116) struct audit_buffer *ab;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 117) struct audit_krule *rule = audit_mark->rule;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 118)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 119) if (!audit_enabled)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 120) return;
626abcd13d4ea (Richard Guy Briggs 2019-01-18 17:42:48 -0500 121) ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 122) if (unlikely(!ab))
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 123) return;
a2c97da11cdb9 (Richard Guy Briggs 2018-11-16 16:30:10 -0500 124) audit_log_session_info(ab);
d0a3f18a70f2d (Paul Moore 2018-08-02 17:56:50 -0400 125) audit_log_format(ab, " op=%s path=", op);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 126) audit_log_untrustedstring(ab, audit_mark->path);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 127) audit_log_key(ab, rule->filterkey);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 128) audit_log_format(ab, " list=%d res=1", rule->listnr);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 129) audit_log_end(ab);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 130) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 131)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 132) void audit_remove_mark(struct audit_fsnotify_mark *audit_mark)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 133) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 134) fsnotify_destroy_mark(&audit_mark->mark, audit_fsnotify_group);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 135) fsnotify_put_mark(&audit_mark->mark);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 136) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 137)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 138) void audit_remove_mark_rule(struct audit_krule *krule)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 139) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 140) struct audit_fsnotify_mark *mark = krule->exe;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 141)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 142) audit_remove_mark(mark);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 143) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 144)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 145) static void audit_autoremove_mark_rule(struct audit_fsnotify_mark *audit_mark)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 146) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 147) struct audit_krule *rule = audit_mark->rule;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 148) struct audit_entry *entry = container_of(rule, struct audit_entry, rule);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 149)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 150) audit_mark_log_rule_change(audit_mark, "autoremove_rule");
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 151) audit_del_rule(entry);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 152) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 153)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 154) /* Update mark data in audit rules based on fsnotify events. */
b9a1b9772509c (Amir Goldstein 2020-07-22 15:58:48 +0300 155) static int audit_mark_handle_event(struct fsnotify_mark *inode_mark, u32 mask,
b9a1b9772509c (Amir Goldstein 2020-07-22 15:58:48 +0300 156) struct inode *inode, struct inode *dir,
950cc0d2bef07 (Amir Goldstein 2020-12-02 14:07:07 +0200 157) const struct qstr *dname, u32 cookie)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 158) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 159) struct audit_fsnotify_mark *audit_mark;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 160)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 161) audit_mark = container_of(inode_mark, struct audit_fsnotify_mark, mark);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 162)
b9a1b9772509c (Amir Goldstein 2020-07-22 15:58:48 +0300 163) if (WARN_ON_ONCE(inode_mark->group != audit_fsnotify_group) ||
b9a1b9772509c (Amir Goldstein 2020-07-22 15:58:48 +0300 164) WARN_ON_ONCE(!inode))
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 165) return 0;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 166)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 167) if (mask & (FS_CREATE|FS_MOVED_TO|FS_DELETE|FS_MOVED_FROM)) {
795d673af1afa (Al Viro 2019-04-26 14:11:05 -0400 168) if (audit_compare_dname_path(dname, audit_mark->path, AUDIT_NAME_FULL))
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 169) return 0;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 170) audit_update_mark(audit_mark, inode);
b9a1b9772509c (Amir Goldstein 2020-07-22 15:58:48 +0300 171) } else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF)) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 172) audit_autoremove_mark_rule(audit_mark);
b9a1b9772509c (Amir Goldstein 2020-07-22 15:58:48 +0300 173) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 174)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 175) return 0;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 176) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 177)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 178) static const struct fsnotify_ops audit_mark_fsnotify_ops = {
b9a1b9772509c (Amir Goldstein 2020-07-22 15:58:48 +0300 179) .handle_inode_event = audit_mark_handle_event,
054c636e5c805 (Jan Kara 2016-12-21 18:06:12 +0100 180) .free_mark = audit_fsnotify_free_mark,
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 181) };
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 182)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 183) static int __init audit_fsnotify_init(void)
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 184) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 185) audit_fsnotify_group = fsnotify_alloc_group(&audit_mark_fsnotify_ops);
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 186) if (IS_ERR(audit_fsnotify_group)) {
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 187) audit_fsnotify_group = NULL;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 188) audit_panic("cannot create audit fsnotify group");
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 189) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 190) return 0;
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 191) }
7f49294282c49 (Richard Guy Briggs 2015-08-05 16:29:36 -0400 192) device_initcall(audit_fsnotify_init);
VisionFive2 Linux kernel
StarFive Tech Linux Kernel for VisionFive (JH7110) boards (mirror)
More than 9999 Commits
33 Branches
55 Tags