Audit: clean up the audit_watch split (ae7b8f41) · Commits · e / devices / android_kernel_xiaomi_nabu

kernel/audit.c

+0 −1

Original line number	Original line	Diff line number	Diff line
	@@ -56,7 +56,6 @@
	#include <net/netlink.h>		#include <net/netlink.h>
	#include <linux/skbuff.h>		#include <linux/skbuff.h>
	#include <linux/netlink.h>		#include <linux/netlink.h>
	#include <linux/inotify.h>
	#include <linux/freezer.h>		#include <linux/freezer.h>
	#include <linux/tty.h>		#include <linux/tty.h>

kernel/audit.h

+4 −9

Original line number	Original line	Diff line number	Diff line
	@@ -104,20 +104,15 @@ extern void audit_free_rule_rcu(struct rcu_head *);
	extern struct list_head audit_filter_list[];		extern struct list_head audit_filter_list[];

	/* audit watch functions */		/* audit watch functions */
	extern unsigned long audit_watch_inode(struct audit_watch *watch);
	extern dev_t audit_watch_dev(struct audit_watch *watch);
	extern void audit_put_watch(struct audit_watch *watch);		extern void audit_put_watch(struct audit_watch *watch);
	extern void audit_get_watch(struct audit_watch *watch);		extern void audit_get_watch(struct audit_watch *watch);
	extern int audit_to_watch(struct audit_krule krule, char path, int len, u32 op);		extern int audit_to_watch(struct audit_krule krule, char path, int len, u32 op);
	extern int audit_add_watch(struct audit_krule *krule);		extern int audit_add_watch(struct audit_krule krule, struct list_head *list);
	extern void audit_remove_watch(struct audit_watch *watch);
	extern void audit_remove_watch_rule(struct audit_krule krule, struct list_head list);		extern void audit_remove_watch_rule(struct audit_krule krule, struct list_head list);
	extern void audit_inotify_unregister(struct list_head *in_list);		extern void audit_watch_inotify_unregister(struct list_head *in_list);
	extern char audit_watch_path(struct audit_watch watch);		extern char audit_watch_path(struct audit_watch watch);
	extern struct list_head audit_watch_rules(struct audit_watch watch);		extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev);
			extern struct audit_entry audit_dupe_rule(struct audit_krule old);
	extern struct audit_entry audit_dupe_rule(struct audit_krule old,
	struct audit_watch *watch);

	#ifdef CONFIG_AUDIT_TREE		#ifdef CONFIG_AUDIT_TREE
	extern struct audit_chunk audit_tree_lookup(const struct inode );		extern struct audit_chunk audit_tree_lookup(const struct inode );

kernel/audit_watch.c

+39 −28

Original line number	Original line	Diff line number	Diff line
	@@ -51,12 +51,12 @@ struct audit_watch {
	unsigned long ino; /* associated inode number */		unsigned long ino; /* associated inode number */
	struct audit_parent parent; / associated parent */		struct audit_parent parent; / associated parent */
	struct list_head wlist; /* entry in parent->watches list */		struct list_head wlist; /* entry in parent->watches list */
	struct list_head rules; /* associated rules */		struct list_head rules; /* anchor for krule->rlist */
	};		};

	struct audit_parent {		struct audit_parent {
	struct list_head ilist; /* entry in inotify registration list */		struct list_head ilist; /* tmp list used to free parents */
	struct list_head watches; /* associated watches */		struct list_head watches; /* anchor for audit_watch->wlist */
	struct inotify_watch wdata; /* inotify watch data */		struct inotify_watch wdata; /* inotify watch data */
	unsigned flags; /* status flags */		unsigned flags; /* status flags */
	};		};
	@@ -78,13 +78,18 @@ struct inotify_handle *audit_ih;
	/* Inotify events we care about. */		/* Inotify events we care about. */
	#define AUDIT_IN_WATCH IN_MOVE\|IN_CREATE\|IN_DELETE\|IN_DELETE_SELF\|IN_MOVE_SELF		#define AUDIT_IN_WATCH IN_MOVE\|IN_CREATE\|IN_DELETE\|IN_DELETE_SELF\|IN_MOVE_SELF

	static void audit_free_parent(struct inotify_watch *i_watch)		static void audit_free_parent(struct audit_parent *parent)
			{
			WARN_ON(!list_empty(&parent->watches));
			kfree(parent);
			}

			static void audit_destroy_watch(struct inotify_watch *i_watch)
	{		{
	struct audit_parent *parent;		struct audit_parent *parent;

	parent = container_of(i_watch, struct audit_parent, wdata);		parent = container_of(i_watch, struct audit_parent, wdata);
	WARN_ON(!list_empty(&parent->watches));		audit_free_parent(parent);
	kfree(parent);
	}		}

	void audit_get_watch(struct audit_watch *watch)		void audit_get_watch(struct audit_watch *watch)
	@@ -115,19 +120,11 @@ char audit_watch_path(struct audit_watch watch)
	return watch->path;		return watch->path;
	}		}

	struct list_head audit_watch_rules(struct audit_watch watch)		int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
	{
	return &watch->rules;
	}

	unsigned long audit_watch_inode(struct audit_watch *watch)
	{
	return watch->ino;
	}

	dev_t audit_watch_dev(struct audit_watch *watch)
	{		{
	return watch->dev;		return (watch->ino != (unsigned long)-1) &&
			(watch->ino == ino) &&
			(watch->dev == dev);
	}		}

	/* Initialize a parent watch entry. */		/* Initialize a parent watch entry. */
	@@ -149,7 +146,7 @@ static struct audit_parent audit_init_parent(struct nameidata ndp)
	wd = inotify_add_watch(audit_ih, &parent->wdata,		wd = inotify_add_watch(audit_ih, &parent->wdata,
	ndp->path.dentry->d_inode, AUDIT_IN_WATCH);		ndp->path.dentry->d_inode, AUDIT_IN_WATCH);
	if (wd < 0) {		if (wd < 0) {
	audit_free_parent(&parent->wdata);		audit_free_parent(parent);
	return ERR_PTR(wd);		return ERR_PTR(wd);
	}		}

	@@ -251,15 +248,19 @@ static void audit_update_watch(struct audit_parent *parent,
	struct audit_entry oentry, nentry;		struct audit_entry oentry, nentry;

	mutex_lock(&audit_filter_mutex);		mutex_lock(&audit_filter_mutex);
			/* Run all of the watches on this parent looking for the one that
			* matches the given dname */
	list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {		list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
	if (audit_compare_dname_path(dname, owatch->path, NULL))		if (audit_compare_dname_path(dname, owatch->path, NULL))
	continue;		continue;

	/* If the update involves invalidating rules, do the inode-based		/* If the update involves invalidating rules, do the inode-based
	* filtering now, so we don't omit records. */		* filtering now, so we don't omit records. */
	if (invalidating && current->audit_context)		if (invalidating && !audit_dummy_context())
	audit_filter_inodes(current, current->audit_context);		audit_filter_inodes(current, current->audit_context);

			/* updating ino will likely change which audit_hash_list we
			* are on so we need a new watch for the new list */
	nwatch = audit_dupe_watch(owatch);		nwatch = audit_dupe_watch(owatch);
	if (IS_ERR(nwatch)) {		if (IS_ERR(nwatch)) {
	mutex_unlock(&audit_filter_mutex);		mutex_unlock(&audit_filter_mutex);
	@@ -275,12 +276,21 @@ static void audit_update_watch(struct audit_parent *parent,
	list_del(&oentry->rule.rlist);		list_del(&oentry->rule.rlist);
	list_del_rcu(&oentry->list);		list_del_rcu(&oentry->list);

	nentry = audit_dupe_rule(&oentry->rule, nwatch);		nentry = audit_dupe_rule(&oentry->rule);
	if (IS_ERR(nentry)) {		if (IS_ERR(nentry)) {
	list_del(&oentry->rule.list);		list_del(&oentry->rule.list);
	audit_panic("error updating watch, removing");		audit_panic("error updating watch, removing");
	} else {		} else {
	int h = audit_hash_ino((u32)ino);		int h = audit_hash_ino((u32)ino);

			/*
			* nentry->rule.watch == oentry->rule.watch so
			* we must drop that reference and set it to our
			* new watch.
			*/
			audit_put_watch(nentry->rule.watch);
			audit_get_watch(nwatch);
			nentry->rule.watch = nwatch;
	list_add(&nentry->rule.rlist, &nwatch->rules);		list_add(&nentry->rule.rlist, &nwatch->rules);
	list_add_rcu(&nentry->list, &audit_inode_hash[h]);		list_add_rcu(&nentry->list, &audit_inode_hash[h]);
	list_replace(&oentry->rule.list,		list_replace(&oentry->rule.list,
	@@ -329,14 +339,14 @@ static void audit_remove_parent_watches(struct audit_parent *parent)

	/* Unregister inotify watches for parents on in_list.		/* Unregister inotify watches for parents on in_list.
	* Generates an IN_IGNORED event. */		* Generates an IN_IGNORED event. */
	void audit_inotify_unregister(struct list_head *in_list)		void audit_watch_inotify_unregister(struct list_head *in_list)
	{		{
	struct audit_parent p, n;		struct audit_parent p, n;

	list_for_each_entry_safe(p, n, in_list, ilist) {		list_for_each_entry_safe(p, n, in_list, ilist) {
	list_del(&p->ilist);		list_del(&p->ilist);
	inotify_rm_watch(audit_ih, &p->wdata);		inotify_rm_watch(audit_ih, &p->wdata);
	/* the unpin matching the pin in audit_do_del_rule() */		/* the unpin matching the pin in audit_remove_watch_rule() */
	unpin_inotify_watch(&p->wdata);		unpin_inotify_watch(&p->wdata);
	}		}
	}		}
	@@ -423,13 +433,13 @@ static void audit_add_to_parent(struct audit_krule *krule,

	/* Find a matching watch entry, or add this one.		/* Find a matching watch entry, or add this one.
	* Caller must hold audit_filter_mutex. */		* Caller must hold audit_filter_mutex. */
	int audit_add_watch(struct audit_krule *krule)		int audit_add_watch(struct audit_krule krule, struct list_head *list)
	{		{
	struct audit_watch *watch = krule->watch;		struct audit_watch *watch = krule->watch;
	struct inotify_watch *i_watch;		struct inotify_watch *i_watch;
	struct audit_parent *parent;		struct audit_parent *parent;
	struct nameidata ndp = NULL, ndw = NULL;		struct nameidata ndp = NULL, ndw = NULL;
	int ret = 0;		int h, ret = 0;

	mutex_unlock(&audit_filter_mutex);		mutex_unlock(&audit_filter_mutex);

	@@ -475,6 +485,8 @@ int audit_add_watch(struct audit_krule *krule)
	/* match get in audit_init_parent or inotify_find_watch */		/* match get in audit_init_parent or inotify_find_watch */
	put_inotify_watch(&parent->wdata);		put_inotify_watch(&parent->wdata);

			h = audit_hash_ino((u32)watch->ino);
			*list = &audit_inode_hash[h];
	error:		error:
	audit_put_nd(ndp, ndw); /* NULL args OK */		audit_put_nd(ndp, ndw); /* NULL args OK */
	return ret;		return ret;
	@@ -514,8 +526,7 @@ static void audit_handle_ievent(struct inotify_watch *i_watch, u32 wd, u32 mask,
	parent = container_of(i_watch, struct audit_parent, wdata);		parent = container_of(i_watch, struct audit_parent, wdata);

	if (mask & (IN_CREATE\|IN_MOVED_TO) && inode)		if (mask & (IN_CREATE\|IN_MOVED_TO) && inode)
	audit_update_watch(parent, dname, inode->i_sb->s_dev,		audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
	inode->i_ino, 0);
	else if (mask & (IN_DELETE\|IN_MOVED_FROM))		else if (mask & (IN_DELETE\|IN_MOVED_FROM))
	audit_update_watch(parent, dname, (dev_t)-1, (unsigned long)-1, 1);		audit_update_watch(parent, dname, (dev_t)-1, (unsigned long)-1, 1);
	/* inotify automatically removes the watch and sends IN_IGNORED */		/* inotify automatically removes the watch and sends IN_IGNORED */
	@@ -531,7 +542,7 @@ static void audit_handle_ievent(struct inotify_watch *i_watch, u32 wd, u32 mask,

	static const struct inotify_operations audit_inotify_ops = {		static const struct inotify_operations audit_inotify_ops = {
	.handle_event = audit_handle_ievent,		.handle_event = audit_handle_ievent,
	.destroy_watch = audit_free_parent,		.destroy_watch = audit_destroy_watch,
	};		};

	static int __init audit_watch_init(void)		static int __init audit_watch_init(void)

kernel/auditfilter.c

+15 −26

Original line number	Original line	Diff line number	Diff line
	@@ -71,6 +71,7 @@ static inline void audit_free_rule(struct audit_entry *e)
	{		{
	int i;		int i;
	struct audit_krule *erule = &e->rule;		struct audit_krule *erule = &e->rule;

	/* some rules don't have associated watches */		/* some rules don't have associated watches */
	if (erule->watch)		if (erule->watch)
	audit_put_watch(erule->watch);		audit_put_watch(erule->watch);
	@@ -746,8 +747,7 @@ static inline int audit_dupe_lsm_field(struct audit_field *df,
	* rule with the new rule in the filterlist, then free the old rule.		* rule with the new rule in the filterlist, then free the old rule.
	* The rlist element is undefined; list manipulations are handled apart from		* The rlist element is undefined; list manipulations are handled apart from
	* the initial copy. */		* the initial copy. */
	struct audit_entry audit_dupe_rule(struct audit_krule old,		struct audit_entry audit_dupe_rule(struct audit_krule old)
	struct audit_watch *watch)
	{		{
	u32 fcount = old->field_count;		u32 fcount = old->field_count;
	struct audit_entry *entry;		struct audit_entry *entry;
	@@ -769,8 +769,8 @@ struct audit_entry audit_dupe_rule(struct audit_krule old,
	new->prio = old->prio;		new->prio = old->prio;
	new->buflen = old->buflen;		new->buflen = old->buflen;
	new->inode_f = old->inode_f;		new->inode_f = old->inode_f;
	new->watch = NULL;
	new->field_count = old->field_count;		new->field_count = old->field_count;

	/*		/*
	* note that we are OK with not refcounting here; audit_match_tree()		* note that we are OK with not refcounting here; audit_match_tree()
	* never dereferences tree and we can't get false positives there		* never dereferences tree and we can't get false positives there
	@@ -811,9 +811,9 @@ struct audit_entry audit_dupe_rule(struct audit_krule old,
	}		}
	}		}

	if (watch) {		if (old->watch) {
	audit_get_watch(watch);		audit_get_watch(old->watch);
	new->watch = watch;		new->watch = old->watch;
	}		}

	return entry;		return entry;
	@@ -866,7 +866,7 @@ static inline int audit_add_rule(struct audit_entry *entry)
	struct audit_watch *watch = entry->rule.watch;		struct audit_watch *watch = entry->rule.watch;
	struct audit_tree *tree = entry->rule.tree;		struct audit_tree *tree = entry->rule.tree;
	struct list_head *list;		struct list_head *list;
	int h, err;		int err;
	#ifdef CONFIG_AUDITSYSCALL		#ifdef CONFIG_AUDITSYSCALL
	int dont_count = 0;		int dont_count = 0;

	@@ -889,15 +889,11 @@ static inline int audit_add_rule(struct audit_entry *entry)

	if (watch) {		if (watch) {
	/* audit_filter_mutex is dropped and re-taken during this call */		/* audit_filter_mutex is dropped and re-taken during this call */
	err = audit_add_watch(&entry->rule);		err = audit_add_watch(&entry->rule, &list);
	if (err) {		if (err) {
	mutex_unlock(&audit_filter_mutex);		mutex_unlock(&audit_filter_mutex);
	goto error;		goto error;
	}		}
	/* entry->rule.watch may have changed during audit_add_watch() */
	watch = entry->rule.watch;
	h = audit_hash_ino((u32)audit_watch_inode(watch));
	list = &audit_inode_hash[h];
	}		}
	if (tree) {		if (tree) {
	err = audit_add_tree_rule(&entry->rule);		err = audit_add_tree_rule(&entry->rule);
	@@ -949,7 +945,7 @@ static inline int audit_del_rule(struct audit_entry *entry)
	struct audit_watch *watch = entry->rule.watch;		struct audit_watch *watch = entry->rule.watch;
	struct audit_tree *tree = entry->rule.tree;		struct audit_tree *tree = entry->rule.tree;
	struct list_head *list;		struct list_head *list;
	LIST_HEAD(inotify_list);		LIST_HEAD(inotify_unregister_list);
	int ret = 0;		int ret = 0;
	#ifdef CONFIG_AUDITSYSCALL		#ifdef CONFIG_AUDITSYSCALL
	int dont_count = 0;		int dont_count = 0;
	@@ -969,7 +965,7 @@ static inline int audit_del_rule(struct audit_entry *entry)
	}		}

	if (e->rule.watch)		if (e->rule.watch)
	audit_remove_watch_rule(&e->rule, &inotify_list);		audit_remove_watch_rule(&e->rule, &inotify_unregister_list);

	if (e->rule.tree)		if (e->rule.tree)
	audit_remove_tree_rule(&e->rule);		audit_remove_tree_rule(&e->rule);
	@@ -987,8 +983,8 @@ static inline int audit_del_rule(struct audit_entry *entry)
	#endif		#endif
	mutex_unlock(&audit_filter_mutex);		mutex_unlock(&audit_filter_mutex);

	if (!list_empty(&inotify_list))		if (!list_empty(&inotify_unregister_list))
	audit_inotify_unregister(&inotify_list);		audit_watch_inotify_unregister(&inotify_unregister_list);

	out:		out:
	if (watch)		if (watch)
	@@ -1323,30 +1319,23 @@ static int update_lsm_rule(struct audit_krule *r)
	{		{
	struct audit_entry *entry = container_of(r, struct audit_entry, rule);		struct audit_entry *entry = container_of(r, struct audit_entry, rule);
	struct audit_entry *nentry;		struct audit_entry *nentry;
	struct audit_watch *watch;
	struct audit_tree *tree;
	int err = 0;		int err = 0;

	if (!security_audit_rule_known(r))		if (!security_audit_rule_known(r))
	return 0;		return 0;

	watch = r->watch;		nentry = audit_dupe_rule(r);
	tree = r->tree;
	nentry = audit_dupe_rule(r, watch);
	if (IS_ERR(nentry)) {		if (IS_ERR(nentry)) {
	/* save the first error encountered for the		/* save the first error encountered for the
	* return value */		* return value */
	err = PTR_ERR(nentry);		err = PTR_ERR(nentry);
	audit_panic("error updating LSM filters");		audit_panic("error updating LSM filters");
	if (watch)		if (r->watch)
	list_del(&r->rlist);		list_del(&r->rlist);
	list_del_rcu(&entry->list);		list_del_rcu(&entry->list);
	list_del(&r->list);		list_del(&r->list);
	} else {		} else {
	if (watch) {		if (r->watch \|\| r->tree)
	list_add(&nentry->rule.rlist, audit_watch_rules(watch));
	list_del(&r->rlist);
	} else if (tree)
	list_replace_init(&r->rlist, &nentry->rule.rlist);		list_replace_init(&r->rlist, &nentry->rule.rlist);
	list_replace_rcu(&entry->list, &nentry->list);		list_replace_rcu(&entry->list, &nentry->list);
	list_replace(&r->list, &nentry->rule.list);		list_replace(&r->list, &nentry->rule.list);

kernel/auditsc.c

+2 −3

Original line number	Original line	Diff line number	Diff line
	@@ -549,9 +549,8 @@ static int audit_filter_rules(struct task_struct *tsk,
	}		}
	break;		break;
	case AUDIT_WATCH:		case AUDIT_WATCH:
	if (name && audit_watch_inode(rule->watch) != (unsigned long)-1)		if (name)
	result = (name->dev == audit_watch_dev(rule->watch) &&		result = audit_watch_compare(rule->watch, name->ino, name->dev);
	name->ino == audit_watch_inode(rule->watch));
	break;		break;
	case AUDIT_DIR:		case AUDIT_DIR:
	if (ctx)		if (ctx)