xref: /linux/kernel/auditfilter.c (revision dc644fba3cf837f22d14991cab3c4c65af37ae21)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* auditfilter.c -- filtering of audit events
3  *
4  * Copyright 2003-2004 Red Hat, Inc.
5  * Copyright 2005 Hewlett-Packard Development Company, L.P.
6  * Copyright 2005 IBM Corporation
7  */
8 
9 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
10 
11 #include <linux/kernel.h>
12 #include <linux/audit.h>
13 #include <linux/kthread.h>
14 #include <linux/mutex.h>
15 #include <linux/fs.h>
16 #include <linux/namei.h>
17 #include <linux/netlink.h>
18 #include <linux/sched.h>
19 #include <linux/slab.h>
20 #include <linux/security.h>
21 #include <net/net_namespace.h>
22 #include <net/sock.h>
23 #include "audit.h"
24 
25 /*
26  * Locking model:
27  *
28  * audit_filter_mutex:
29  *		Synchronizes writes and blocking reads of audit's filterlist
30  *		data.  Rcu is used to traverse the filterlist and access
31  *		contents of structs audit_entry, audit_watch and opaque
32  *		LSM rules during filtering.  If modified, these structures
33  *		must be copied and replace their counterparts in the filterlist.
34  *		An audit_parent struct is not accessed during filtering, so may
35  *		be written directly provided audit_filter_mutex is held.
36  */
37 
38 /* Audit filter lists, defined in <linux/audit.h> */
39 struct list_head audit_filter_list[AUDIT_NR_FILTERS] = {
40 	LIST_HEAD_INIT(audit_filter_list[0]),
41 	LIST_HEAD_INIT(audit_filter_list[1]),
42 	LIST_HEAD_INIT(audit_filter_list[2]),
43 	LIST_HEAD_INIT(audit_filter_list[3]),
44 	LIST_HEAD_INIT(audit_filter_list[4]),
45 	LIST_HEAD_INIT(audit_filter_list[5]),
46 	LIST_HEAD_INIT(audit_filter_list[6]),
47 	LIST_HEAD_INIT(audit_filter_list[7]),
48 #if AUDIT_NR_FILTERS != 8
49 #error Fix audit_filter_list initialiser
50 #endif
51 };
52 static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = {
53 	LIST_HEAD_INIT(audit_rules_list[0]),
54 	LIST_HEAD_INIT(audit_rules_list[1]),
55 	LIST_HEAD_INIT(audit_rules_list[2]),
56 	LIST_HEAD_INIT(audit_rules_list[3]),
57 	LIST_HEAD_INIT(audit_rules_list[4]),
58 	LIST_HEAD_INIT(audit_rules_list[5]),
59 	LIST_HEAD_INIT(audit_rules_list[6]),
60 	LIST_HEAD_INIT(audit_rules_list[7]),
61 };
62 
63 DEFINE_MUTEX(audit_filter_mutex);
64 
audit_free_lsm_field(struct audit_field * f)65 static void audit_free_lsm_field(struct audit_field *f)
66 {
67 	switch (f->type) {
68 	case AUDIT_SUBJ_USER:
69 	case AUDIT_SUBJ_ROLE:
70 	case AUDIT_SUBJ_TYPE:
71 	case AUDIT_SUBJ_SEN:
72 	case AUDIT_SUBJ_CLR:
73 	case AUDIT_OBJ_USER:
74 	case AUDIT_OBJ_ROLE:
75 	case AUDIT_OBJ_TYPE:
76 	case AUDIT_OBJ_LEV_LOW:
77 	case AUDIT_OBJ_LEV_HIGH:
78 		kfree(f->lsm_str);
79 		security_audit_rule_free(f->lsm_rule);
80 	}
81 }
82 
audit_free_rule(struct audit_entry * e)83 static inline void audit_free_rule(struct audit_entry *e)
84 {
85 	int i;
86 	struct audit_krule *erule = &e->rule;
87 
88 	/* some rules don't have associated watches */
89 	if (erule->watch)
90 		audit_put_watch(erule->watch);
91 	if (erule->fields)
92 		for (i = 0; i < erule->field_count; i++)
93 			audit_free_lsm_field(&erule->fields[i]);
94 	kfree(erule->fields);
95 	kfree(erule->filterkey);
96 	kfree(e);
97 }
98 
audit_free_rule_rcu(struct rcu_head * head)99 void audit_free_rule_rcu(struct rcu_head *head)
100 {
101 	struct audit_entry *e = container_of(head, struct audit_entry, rcu);
102 	audit_free_rule(e);
103 }
104 
105 /* Initialize an audit filterlist entry. */
audit_init_entry(u32 field_count)106 static inline struct audit_entry *audit_init_entry(u32 field_count)
107 {
108 	struct audit_entry *entry;
109 	struct audit_field *fields;
110 
111 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
112 	if (unlikely(!entry))
113 		return NULL;
114 
115 	fields = kcalloc(field_count, sizeof(*fields), GFP_KERNEL);
116 	if (unlikely(!fields)) {
117 		kfree(entry);
118 		return NULL;
119 	}
120 	entry->rule.fields = fields;
121 
122 	return entry;
123 }
124 
125 /* Unpack a filter field's string representation from user-space
126  * buffer. */
audit_unpack_string(void ** bufp,size_t * remain,size_t len)127 char *audit_unpack_string(void **bufp, size_t *remain, size_t len)
128 {
129 	char *str;
130 
131 	if (!*bufp || (len == 0) || (len > *remain))
132 		return ERR_PTR(-EINVAL);
133 
134 	/* Of the currently implemented string fields, PATH_MAX
135 	 * defines the longest valid length.
136 	 */
137 	if (len > PATH_MAX)
138 		return ERR_PTR(-ENAMETOOLONG);
139 
140 	str = kmalloc(len + 1, GFP_KERNEL);
141 	if (unlikely(!str))
142 		return ERR_PTR(-ENOMEM);
143 
144 	memcpy(str, *bufp, len);
145 	str[len] = 0;
146 	*bufp += len;
147 	*remain -= len;
148 
149 	return str;
150 }
151 
152 /* Translate an inode field to kernel representation. */
audit_to_inode(struct audit_krule * krule,struct audit_field * f)153 static inline int audit_to_inode(struct audit_krule *krule,
154 				 struct audit_field *f)
155 {
156 	if ((krule->listnr != AUDIT_FILTER_EXIT &&
157 	     krule->listnr != AUDIT_FILTER_URING_EXIT) ||
158 	    krule->inode_f || krule->watch || krule->tree ||
159 	    (f->op != Audit_equal && f->op != Audit_not_equal))
160 		return -EINVAL;
161 
162 	krule->inode_f = f;
163 	return 0;
164 }
165 
166 static __u32 *classes[AUDIT_SYSCALL_CLASSES];
167 
audit_register_class(int class,unsigned * list)168 int __init audit_register_class(int class, unsigned *list)
169 {
170 	__u32 *p = kcalloc(AUDIT_BITMASK_SIZE, sizeof(__u32), GFP_KERNEL);
171 	if (!p)
172 		return -ENOMEM;
173 	while (*list != ~0U) {
174 		unsigned n = *list++;
175 		if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) {
176 			kfree(p);
177 			return -EINVAL;
178 		}
179 		p[AUDIT_WORD(n)] |= AUDIT_BIT(n);
180 	}
181 	if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) {
182 		kfree(p);
183 		return -EINVAL;
184 	}
185 	classes[class] = p;
186 	return 0;
187 }
188 
audit_match_class(int class,unsigned syscall)189 int audit_match_class(int class, unsigned syscall)
190 {
191 	if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32))
192 		return 0;
193 	if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class]))
194 		return 0;
195 	return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall);
196 }
197 
198 #ifdef CONFIG_AUDITSYSCALL
audit_match_class_bits(int class,u32 * mask)199 static inline int audit_match_class_bits(int class, u32 *mask)
200 {
201 	int i;
202 
203 	if (classes[class]) {
204 		for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
205 			if (mask[i] & classes[class][i])
206 				return 0;
207 	}
208 	return 1;
209 }
210 
audit_match_signal(struct audit_entry * entry)211 static int audit_match_signal(struct audit_entry *entry)
212 {
213 	struct audit_field *arch = entry->rule.arch_f;
214 
215 	if (!arch) {
216 		/* When arch is unspecified, we must check both masks on biarch
217 		 * as syscall number alone is ambiguous. */
218 		return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
219 					       entry->rule.mask) &&
220 			audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
221 					       entry->rule.mask));
222 	}
223 
224 	switch (audit_classify_arch(arch->val)) {
225 	case 0: /* native */
226 		return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
227 					       entry->rule.mask));
228 	case 1: /* 32bit on biarch */
229 		return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
230 					       entry->rule.mask));
231 	default:
232 		return 1;
233 	}
234 }
235 #endif
236 
237 /* Common user-space to kernel rule translation. */
audit_to_entry_common(struct audit_rule_data * rule)238 static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule)
239 {
240 	unsigned listnr;
241 	struct audit_entry *entry;
242 	int i, err;
243 
244 	err = -EINVAL;
245 	listnr = rule->flags & ~AUDIT_FILTER_PREPEND;
246 	switch (listnr) {
247 	default:
248 		goto exit_err;
249 #ifdef CONFIG_AUDITSYSCALL
250 	case AUDIT_FILTER_ENTRY:
251 		pr_err("AUDIT_FILTER_ENTRY is deprecated\n");
252 		goto exit_err;
253 	case AUDIT_FILTER_EXIT:
254 	case AUDIT_FILTER_URING_EXIT:
255 	case AUDIT_FILTER_TASK:
256 #endif
257 	case AUDIT_FILTER_USER:
258 	case AUDIT_FILTER_EXCLUDE:
259 	case AUDIT_FILTER_FS:
260 		;
261 	}
262 	if (unlikely(rule->action == AUDIT_POSSIBLE)) {
263 		pr_err("AUDIT_POSSIBLE is deprecated\n");
264 		goto exit_err;
265 	}
266 	if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS)
267 		goto exit_err;
268 	if (rule->field_count > AUDIT_MAX_FIELDS)
269 		goto exit_err;
270 
271 	err = -ENOMEM;
272 	entry = audit_init_entry(rule->field_count);
273 	if (!entry)
274 		goto exit_err;
275 
276 	entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;
277 	entry->rule.listnr = listnr;
278 	entry->rule.action = rule->action;
279 	entry->rule.field_count = rule->field_count;
280 
281 	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
282 		entry->rule.mask[i] = rule->mask[i];
283 
284 	for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) {
285 		int bit = AUDIT_BITMASK_SIZE * 32 - i - 1;
286 		__u32 *p = &entry->rule.mask[AUDIT_WORD(bit)];
287 		__u32 *class;
288 
289 		if (!(*p & AUDIT_BIT(bit)))
290 			continue;
291 		*p &= ~AUDIT_BIT(bit);
292 		class = classes[i];
293 		if (class) {
294 			int j;
295 			for (j = 0; j < AUDIT_BITMASK_SIZE; j++)
296 				entry->rule.mask[j] |= class[j];
297 		}
298 	}
299 
300 	return entry;
301 
302 exit_err:
303 	return ERR_PTR(err);
304 }
305 
306 static u32 audit_ops[] =
307 {
308 	[Audit_equal] = AUDIT_EQUAL,
309 	[Audit_not_equal] = AUDIT_NOT_EQUAL,
310 	[Audit_bitmask] = AUDIT_BIT_MASK,
311 	[Audit_bittest] = AUDIT_BIT_TEST,
312 	[Audit_lt] = AUDIT_LESS_THAN,
313 	[Audit_gt] = AUDIT_GREATER_THAN,
314 	[Audit_le] = AUDIT_LESS_THAN_OR_EQUAL,
315 	[Audit_ge] = AUDIT_GREATER_THAN_OR_EQUAL,
316 };
317 
audit_to_op(u32 op)318 static u32 audit_to_op(u32 op)
319 {
320 	u32 n;
321 	for (n = Audit_equal; n < Audit_bad && audit_ops[n] != op; n++)
322 		;
323 	return n;
324 }
325 
326 /* check if an audit field is valid */
audit_field_valid(struct audit_entry * entry,struct audit_field * f)327 static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
328 {
329 	switch (f->type) {
330 	case AUDIT_MSGTYPE:
331 		if (entry->rule.listnr != AUDIT_FILTER_EXCLUDE &&
332 		    entry->rule.listnr != AUDIT_FILTER_USER)
333 			return -EINVAL;
334 		break;
335 	case AUDIT_FSTYPE:
336 		if (entry->rule.listnr != AUDIT_FILTER_FS)
337 			return -EINVAL;
338 		break;
339 	case AUDIT_PERM:
340 		if (entry->rule.listnr == AUDIT_FILTER_URING_EXIT)
341 			return -EINVAL;
342 		break;
343 	}
344 
345 	switch (entry->rule.listnr) {
346 	case AUDIT_FILTER_FS:
347 		switch (f->type) {
348 		case AUDIT_FSTYPE:
349 		case AUDIT_FILTERKEY:
350 			break;
351 		default:
352 			return -EINVAL;
353 		}
354 	}
355 
356 	/* Check for valid field type and op */
357 	switch (f->type) {
358 	case AUDIT_ARG0:
359 	case AUDIT_ARG1:
360 	case AUDIT_ARG2:
361 	case AUDIT_ARG3:
362 	case AUDIT_PERS: /* <uapi/linux/personality.h> */
363 	case AUDIT_DEVMINOR:
364 		/* all ops are valid */
365 		break;
366 	case AUDIT_UID:
367 	case AUDIT_EUID:
368 	case AUDIT_SUID:
369 	case AUDIT_FSUID:
370 	case AUDIT_LOGINUID:
371 	case AUDIT_OBJ_UID:
372 	case AUDIT_GID:
373 	case AUDIT_EGID:
374 	case AUDIT_SGID:
375 	case AUDIT_FSGID:
376 	case AUDIT_OBJ_GID:
377 	case AUDIT_PID:
378 	case AUDIT_MSGTYPE:
379 	case AUDIT_PPID:
380 	case AUDIT_DEVMAJOR:
381 	case AUDIT_EXIT:
382 	case AUDIT_SUCCESS:
383 	case AUDIT_INODE:
384 	case AUDIT_SESSIONID:
385 	case AUDIT_SUBJ_SEN:
386 	case AUDIT_SUBJ_CLR:
387 	case AUDIT_OBJ_LEV_LOW:
388 	case AUDIT_OBJ_LEV_HIGH:
389 	case AUDIT_SADDR_FAM:
390 		/* bit ops are only useful on syscall args */
391 		if (f->op == Audit_bitmask || f->op == Audit_bittest)
392 			return -EINVAL;
393 		break;
394 	case AUDIT_SUBJ_USER:
395 	case AUDIT_SUBJ_ROLE:
396 	case AUDIT_SUBJ_TYPE:
397 	case AUDIT_OBJ_USER:
398 	case AUDIT_OBJ_ROLE:
399 	case AUDIT_OBJ_TYPE:
400 	case AUDIT_WATCH:
401 	case AUDIT_DIR:
402 	case AUDIT_FILTERKEY:
403 	case AUDIT_LOGINUID_SET:
404 	case AUDIT_ARCH:
405 	case AUDIT_FSTYPE:
406 	case AUDIT_PERM:
407 	case AUDIT_FILETYPE:
408 	case AUDIT_FIELD_COMPARE:
409 	case AUDIT_EXE:
410 		/* only equal and not equal valid ops */
411 		if (f->op != Audit_not_equal && f->op != Audit_equal)
412 			return -EINVAL;
413 		break;
414 	default:
415 		/* field not recognized */
416 		return -EINVAL;
417 	}
418 
419 	/* Check for select valid field values */
420 	switch (f->type) {
421 	case AUDIT_LOGINUID_SET:
422 		if ((f->val != 0) && (f->val != 1))
423 			return -EINVAL;
424 		break;
425 	case AUDIT_PERM:
426 		if (f->val & ~15)
427 			return -EINVAL;
428 		break;
429 	case AUDIT_FILETYPE:
430 		if (f->val & ~S_IFMT)
431 			return -EINVAL;
432 		break;
433 	case AUDIT_FIELD_COMPARE:
434 		if (f->val > AUDIT_MAX_FIELD_COMPARE)
435 			return -EINVAL;
436 		break;
437 	case AUDIT_SADDR_FAM:
438 		if (f->val >= AF_MAX)
439 			return -EINVAL;
440 		break;
441 	default:
442 		break;
443 	}
444 
445 	return 0;
446 }
447 
448 /* Translate struct audit_rule_data to kernel's rule representation. */
audit_data_to_entry(struct audit_rule_data * data,size_t datasz)449 static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
450 					       size_t datasz)
451 {
452 	int err = 0;
453 	struct audit_entry *entry;
454 	void *bufp;
455 	size_t remain = datasz - sizeof(struct audit_rule_data);
456 	int i;
457 	char *str;
458 	struct audit_fsnotify_mark *audit_mark;
459 
460 	entry = audit_to_entry_common(data);
461 	if (IS_ERR(entry))
462 		goto exit_nofree;
463 
464 	bufp = data->buf;
465 	for (i = 0; i < data->field_count; i++) {
466 		struct audit_field *f = &entry->rule.fields[i];
467 		u32 f_val;
468 
469 		err = -EINVAL;
470 
471 		f->op = audit_to_op(data->fieldflags[i]);
472 		if (f->op == Audit_bad)
473 			goto exit_free;
474 
475 		f->type = data->fields[i];
476 		f_val = data->values[i];
477 
478 		/* Support legacy tests for a valid loginuid */
479 		if ((f->type == AUDIT_LOGINUID) && (f_val == AUDIT_UID_UNSET)) {
480 			f->type = AUDIT_LOGINUID_SET;
481 			f_val = 0;
482 			entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;
483 		}
484 
485 		err = audit_field_valid(entry, f);
486 		if (err)
487 			goto exit_free;
488 
489 		err = -EINVAL;
490 		switch (f->type) {
491 		case AUDIT_LOGINUID:
492 		case AUDIT_UID:
493 		case AUDIT_EUID:
494 		case AUDIT_SUID:
495 		case AUDIT_FSUID:
496 		case AUDIT_OBJ_UID:
497 			f->uid = make_kuid(current_user_ns(), f_val);
498 			if (!uid_valid(f->uid))
499 				goto exit_free;
500 			break;
501 		case AUDIT_GID:
502 		case AUDIT_EGID:
503 		case AUDIT_SGID:
504 		case AUDIT_FSGID:
505 		case AUDIT_OBJ_GID:
506 			f->gid = make_kgid(current_user_ns(), f_val);
507 			if (!gid_valid(f->gid))
508 				goto exit_free;
509 			break;
510 		case AUDIT_ARCH:
511 			f->val = f_val;
512 			entry->rule.arch_f = f;
513 			break;
514 		case AUDIT_SUBJ_USER:
515 		case AUDIT_SUBJ_ROLE:
516 		case AUDIT_SUBJ_TYPE:
517 		case AUDIT_SUBJ_SEN:
518 		case AUDIT_SUBJ_CLR:
519 		case AUDIT_OBJ_USER:
520 		case AUDIT_OBJ_ROLE:
521 		case AUDIT_OBJ_TYPE:
522 		case AUDIT_OBJ_LEV_LOW:
523 		case AUDIT_OBJ_LEV_HIGH:
524 			str = audit_unpack_string(&bufp, &remain, f_val);
525 			if (IS_ERR(str)) {
526 				err = PTR_ERR(str);
527 				goto exit_free;
528 			}
529 			entry->rule.buflen += f_val;
530 			f->lsm_str = str;
531 			err = security_audit_rule_init(f->type, f->op, str,
532 						       (void **)&f->lsm_rule,
533 						       GFP_KERNEL);
534 			/* Keep currently invalid fields around in case they
535 			 * become valid after a policy reload. */
536 			if (err == -EINVAL) {
537 				pr_warn("audit rule for LSM \'%s\' is invalid\n",
538 					str);
539 				err = 0;
540 			} else if (err)
541 				goto exit_free;
542 			break;
543 		case AUDIT_WATCH:
544 			str = audit_unpack_string(&bufp, &remain, f_val);
545 			if (IS_ERR(str)) {
546 				err = PTR_ERR(str);
547 				goto exit_free;
548 			}
549 			err = audit_to_watch(&entry->rule, str, f_val, f->op);
550 			if (err) {
551 				kfree(str);
552 				goto exit_free;
553 			}
554 			entry->rule.buflen += f_val;
555 			break;
556 		case AUDIT_DIR:
557 			str = audit_unpack_string(&bufp, &remain, f_val);
558 			if (IS_ERR(str)) {
559 				err = PTR_ERR(str);
560 				goto exit_free;
561 			}
562 			err = audit_make_tree(&entry->rule, str, f->op);
563 			kfree(str);
564 			if (err)
565 				goto exit_free;
566 			entry->rule.buflen += f_val;
567 			break;
568 		case AUDIT_INODE:
569 			f->val = f_val;
570 			err = audit_to_inode(&entry->rule, f);
571 			if (err)
572 				goto exit_free;
573 			break;
574 		case AUDIT_FILTERKEY:
575 			if (entry->rule.filterkey || f_val > AUDIT_MAX_KEY_LEN)
576 				goto exit_free;
577 			str = audit_unpack_string(&bufp, &remain, f_val);
578 			if (IS_ERR(str)) {
579 				err = PTR_ERR(str);
580 				goto exit_free;
581 			}
582 			entry->rule.buflen += f_val;
583 			entry->rule.filterkey = str;
584 			break;
585 		case AUDIT_EXE:
586 			if (entry->rule.exe || f_val > PATH_MAX)
587 				goto exit_free;
588 			str = audit_unpack_string(&bufp, &remain, f_val);
589 			if (IS_ERR(str)) {
590 				err = PTR_ERR(str);
591 				goto exit_free;
592 			}
593 			audit_mark = audit_alloc_mark(&entry->rule, str, f_val);
594 			if (IS_ERR(audit_mark)) {
595 				kfree(str);
596 				err = PTR_ERR(audit_mark);
597 				goto exit_free;
598 			}
599 			entry->rule.buflen += f_val;
600 			entry->rule.exe = audit_mark;
601 			break;
602 		default:
603 			f->val = f_val;
604 			break;
605 		}
606 	}
607 
608 	if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)
609 		entry->rule.inode_f = NULL;
610 
611 exit_nofree:
612 	return entry;
613 
614 exit_free:
615 	if (entry->rule.tree)
616 		audit_put_tree(entry->rule.tree); /* that's the temporary one */
617 	if (entry->rule.exe)
618 		audit_remove_mark(entry->rule.exe); /* that's the template one */
619 	audit_free_rule(entry);
620 	return ERR_PTR(err);
621 }
622 
623 /* Pack a filter field's string representation into data block. */
audit_pack_string(void ** bufp,const char * str)624 static inline size_t audit_pack_string(void **bufp, const char *str)
625 {
626 	size_t len = strlen(str);
627 
628 	memcpy(*bufp, str, len);
629 	*bufp += len;
630 
631 	return len;
632 }
633 
634 /* Translate kernel rule representation to struct audit_rule_data. */
audit_krule_to_data(struct audit_krule * krule)635 static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
636 {
637 	struct audit_rule_data *data;
638 	void *bufp;
639 	int i;
640 
641 	data = kmalloc(struct_size(data, buf, krule->buflen), GFP_KERNEL);
642 	if (unlikely(!data))
643 		return NULL;
644 	memset(data, 0, sizeof(*data));
645 
646 	data->flags = krule->flags | krule->listnr;
647 	data->action = krule->action;
648 	data->field_count = krule->field_count;
649 	bufp = data->buf;
650 	for (i = 0; i < data->field_count; i++) {
651 		struct audit_field *f = &krule->fields[i];
652 
653 		data->fields[i] = f->type;
654 		data->fieldflags[i] = audit_ops[f->op];
655 		switch (f->type) {
656 		case AUDIT_SUBJ_USER:
657 		case AUDIT_SUBJ_ROLE:
658 		case AUDIT_SUBJ_TYPE:
659 		case AUDIT_SUBJ_SEN:
660 		case AUDIT_SUBJ_CLR:
661 		case AUDIT_OBJ_USER:
662 		case AUDIT_OBJ_ROLE:
663 		case AUDIT_OBJ_TYPE:
664 		case AUDIT_OBJ_LEV_LOW:
665 		case AUDIT_OBJ_LEV_HIGH:
666 			data->buflen += data->values[i] =
667 				audit_pack_string(&bufp, f->lsm_str);
668 			break;
669 		case AUDIT_WATCH:
670 			data->buflen += data->values[i] =
671 				audit_pack_string(&bufp,
672 						  audit_watch_path(krule->watch));
673 			break;
674 		case AUDIT_DIR:
675 			data->buflen += data->values[i] =
676 				audit_pack_string(&bufp,
677 						  audit_tree_path(krule->tree));
678 			break;
679 		case AUDIT_FILTERKEY:
680 			data->buflen += data->values[i] =
681 				audit_pack_string(&bufp, krule->filterkey);
682 			break;
683 		case AUDIT_EXE:
684 			data->buflen += data->values[i] =
685 				audit_pack_string(&bufp, audit_mark_path(krule->exe));
686 			break;
687 		case AUDIT_LOGINUID_SET:
688 			if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {
689 				data->fields[i] = AUDIT_LOGINUID;
690 				data->values[i] = AUDIT_UID_UNSET;
691 				break;
692 			}
693 			fallthrough;	/* if set */
694 		default:
695 			data->values[i] = f->val;
696 		}
697 	}
698 	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
699 		data->mask[i] = krule->mask[i];
700 
701 	return data;
702 }
703 
704 /* Compare two rules in kernel format.  Considered success if rules
705  * don't match. */
audit_compare_rule(struct audit_krule * a,struct audit_krule * b)706 static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
707 {
708 	int i;
709 
710 	if (a->flags != b->flags ||
711 	    a->pflags != b->pflags ||
712 	    a->listnr != b->listnr ||
713 	    a->action != b->action ||
714 	    a->field_count != b->field_count)
715 		return 1;
716 
717 	for (i = 0; i < a->field_count; i++) {
718 		if (a->fields[i].type != b->fields[i].type ||
719 		    a->fields[i].op != b->fields[i].op)
720 			return 1;
721 
722 		switch (a->fields[i].type) {
723 		case AUDIT_SUBJ_USER:
724 		case AUDIT_SUBJ_ROLE:
725 		case AUDIT_SUBJ_TYPE:
726 		case AUDIT_SUBJ_SEN:
727 		case AUDIT_SUBJ_CLR:
728 		case AUDIT_OBJ_USER:
729 		case AUDIT_OBJ_ROLE:
730 		case AUDIT_OBJ_TYPE:
731 		case AUDIT_OBJ_LEV_LOW:
732 		case AUDIT_OBJ_LEV_HIGH:
733 			if (strcmp(a->fields[i].lsm_str, b->fields[i].lsm_str))
734 				return 1;
735 			break;
736 		case AUDIT_WATCH:
737 			if (strcmp(audit_watch_path(a->watch),
738 				   audit_watch_path(b->watch)))
739 				return 1;
740 			break;
741 		case AUDIT_DIR:
742 			if (strcmp(audit_tree_path(a->tree),
743 				   audit_tree_path(b->tree)))
744 				return 1;
745 			break;
746 		case AUDIT_FILTERKEY:
747 			/* both filterkeys exist based on above type compare */
748 			if (strcmp(a->filterkey, b->filterkey))
749 				return 1;
750 			break;
751 		case AUDIT_EXE:
752 			/* both paths exist based on above type compare */
753 			if (strcmp(audit_mark_path(a->exe),
754 				   audit_mark_path(b->exe)))
755 				return 1;
756 			break;
757 		case AUDIT_UID:
758 		case AUDIT_EUID:
759 		case AUDIT_SUID:
760 		case AUDIT_FSUID:
761 		case AUDIT_LOGINUID:
762 		case AUDIT_OBJ_UID:
763 			if (!uid_eq(a->fields[i].uid, b->fields[i].uid))
764 				return 1;
765 			break;
766 		case AUDIT_GID:
767 		case AUDIT_EGID:
768 		case AUDIT_SGID:
769 		case AUDIT_FSGID:
770 		case AUDIT_OBJ_GID:
771 			if (!gid_eq(a->fields[i].gid, b->fields[i].gid))
772 				return 1;
773 			break;
774 		default:
775 			if (a->fields[i].val != b->fields[i].val)
776 				return 1;
777 		}
778 	}
779 
780 	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
781 		if (a->mask[i] != b->mask[i])
782 			return 1;
783 
784 	return 0;
785 }
786 
787 /* Duplicate LSM field information.  The lsm_rule is opaque, so must be
788  * re-initialized. */
audit_dupe_lsm_field(struct audit_field * df,struct audit_field * sf)789 static inline int audit_dupe_lsm_field(struct audit_field *df,
790 					   struct audit_field *sf)
791 {
792 	int ret;
793 	char *lsm_str;
794 
795 	/* our own copy of lsm_str */
796 	lsm_str = kstrdup(sf->lsm_str, GFP_KERNEL);
797 	if (unlikely(!lsm_str))
798 		return -ENOMEM;
799 	df->lsm_str = lsm_str;
800 
801 	/* our own (refreshed) copy of lsm_rule */
802 	ret = security_audit_rule_init(df->type, df->op, df->lsm_str,
803 				       (void **)&df->lsm_rule, GFP_KERNEL);
804 	/* Keep currently invalid fields around in case they
805 	 * become valid after a policy reload. */
806 	if (ret == -EINVAL) {
807 		pr_warn("audit rule for LSM \'%s\' is invalid\n",
808 			df->lsm_str);
809 		ret = 0;
810 	}
811 
812 	return ret;
813 }
814 
815 /* Duplicate an audit rule.  This will be a deep copy with the exception
816  * of the watch - that pointer is carried over.  The LSM specific fields
817  * will be updated in the copy.  The point is to be able to replace the old
818  * rule with the new rule in the filterlist, then free the old rule.
819  * The rlist element is undefined; list manipulations are handled apart from
820  * the initial copy. */
audit_dupe_rule(struct audit_krule * old)821 struct audit_entry *audit_dupe_rule(struct audit_krule *old)
822 {
823 	u32 fcount = old->field_count;
824 	struct audit_entry *entry;
825 	struct audit_krule *new;
826 	char *fk;
827 	int i, err = 0;
828 
829 	entry = audit_init_entry(fcount);
830 	if (unlikely(!entry))
831 		return ERR_PTR(-ENOMEM);
832 
833 	new = &entry->rule;
834 	new->flags = old->flags;
835 	new->pflags = old->pflags;
836 	new->listnr = old->listnr;
837 	new->action = old->action;
838 	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
839 		new->mask[i] = old->mask[i];
840 	new->prio = old->prio;
841 	new->buflen = old->buflen;
842 	new->inode_f = old->inode_f;
843 	new->field_count = old->field_count;
844 
845 	/*
846 	 * note that we are OK with not refcounting here; audit_match_tree()
847 	 * never dereferences tree and we can't get false positives there
848 	 * since we'd have to have rule gone from the list *and* removed
849 	 * before the chunks found by lookup had been allocated, i.e. before
850 	 * the beginning of list scan.
851 	 */
852 	new->tree = old->tree;
853 	memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount);
854 
855 	/* deep copy this information, updating the lsm_rule fields, because
856 	 * the originals will all be freed when the old rule is freed. */
857 	for (i = 0; i < fcount; i++) {
858 		switch (new->fields[i].type) {
859 		case AUDIT_SUBJ_USER:
860 		case AUDIT_SUBJ_ROLE:
861 		case AUDIT_SUBJ_TYPE:
862 		case AUDIT_SUBJ_SEN:
863 		case AUDIT_SUBJ_CLR:
864 		case AUDIT_OBJ_USER:
865 		case AUDIT_OBJ_ROLE:
866 		case AUDIT_OBJ_TYPE:
867 		case AUDIT_OBJ_LEV_LOW:
868 		case AUDIT_OBJ_LEV_HIGH:
869 			err = audit_dupe_lsm_field(&new->fields[i],
870 						       &old->fields[i]);
871 			break;
872 		case AUDIT_FILTERKEY:
873 			fk = kstrdup(old->filterkey, GFP_KERNEL);
874 			if (unlikely(!fk))
875 				err = -ENOMEM;
876 			else
877 				new->filterkey = fk;
878 			break;
879 		case AUDIT_EXE:
880 			err = audit_dupe_exe(new, old);
881 			break;
882 		}
883 		if (err) {
884 			if (new->exe)
885 				audit_remove_mark(new->exe);
886 			audit_free_rule(entry);
887 			return ERR_PTR(err);
888 		}
889 	}
890 
891 	if (old->watch) {
892 		audit_get_watch(old->watch);
893 		new->watch = old->watch;
894 	}
895 
896 	return entry;
897 }
898 
899 /* Find an existing audit rule.
900  * Caller must hold audit_filter_mutex to prevent stale rule data. */
audit_find_rule(struct audit_entry * entry,struct list_head ** p)901 static struct audit_entry *audit_find_rule(struct audit_entry *entry,
902 					   struct list_head **p)
903 {
904 	struct audit_entry *e, *found = NULL;
905 	struct list_head *list;
906 	int h;
907 
908 	if (entry->rule.inode_f) {
909 		h = audit_hash_ino(entry->rule.inode_f->val);
910 		*p = list = &audit_inode_hash[h];
911 	} else if (entry->rule.watch) {
912 		/* we don't know the inode number, so must walk entire hash */
913 		for (h = 0; h < AUDIT_INODE_BUCKETS; h++) {
914 			list = &audit_inode_hash[h];
915 			list_for_each_entry(e, list, list)
916 				if (!audit_compare_rule(&entry->rule, &e->rule)) {
917 					found = e;
918 					goto out;
919 				}
920 		}
921 		goto out;
922 	} else {
923 		*p = list = &audit_filter_list[entry->rule.listnr];
924 	}
925 
926 	list_for_each_entry(e, list, list)
927 		if (!audit_compare_rule(&entry->rule, &e->rule)) {
928 			found = e;
929 			goto out;
930 		}
931 
932 out:
933 	return found;
934 }
935 
936 static u64 prio_low = ~0ULL/2;
937 static u64 prio_high = ~0ULL/2 - 1;
938 
939 /* Add rule to given filterlist if not a duplicate. */
audit_add_rule(struct audit_entry * entry)940 static inline int audit_add_rule(struct audit_entry *entry)
941 {
942 	struct audit_entry *e;
943 	struct audit_watch *watch = entry->rule.watch;
944 	struct audit_tree *tree = entry->rule.tree;
945 	struct list_head *list;
946 	int err = 0;
947 #ifdef CONFIG_AUDITSYSCALL
948 	int dont_count = 0;
949 
950 	/* If any of these, don't count towards total */
951 	switch (entry->rule.listnr) {
952 	case AUDIT_FILTER_USER:
953 	case AUDIT_FILTER_EXCLUDE:
954 	case AUDIT_FILTER_FS:
955 		dont_count = 1;
956 	}
957 #endif
958 
959 	mutex_lock(&audit_filter_mutex);
960 	e = audit_find_rule(entry, &list);
961 	if (e) {
962 		mutex_unlock(&audit_filter_mutex);
963 		err = -EEXIST;
964 		/* normally audit_add_tree_rule() will free it on failure */
965 		if (tree)
966 			audit_put_tree(tree);
967 		return err;
968 	}
969 
970 	if (watch) {
971 		/* audit_filter_mutex is dropped and re-taken during this call */
972 		err = audit_add_watch(&entry->rule, &list);
973 		if (err) {
974 			mutex_unlock(&audit_filter_mutex);
975 			/*
976 			 * normally audit_add_tree_rule() will free it
977 			 * on failure
978 			 */
979 			if (tree)
980 				audit_put_tree(tree);
981 			return err;
982 		}
983 	}
984 	if (tree) {
985 		err = audit_add_tree_rule(&entry->rule);
986 		if (err) {
987 			mutex_unlock(&audit_filter_mutex);
988 			return err;
989 		}
990 	}
991 
992 	entry->rule.prio = ~0ULL;
993 	if (entry->rule.listnr == AUDIT_FILTER_EXIT ||
994 	    entry->rule.listnr == AUDIT_FILTER_URING_EXIT) {
995 		if (entry->rule.flags & AUDIT_FILTER_PREPEND)
996 			entry->rule.prio = ++prio_high;
997 		else
998 			entry->rule.prio = --prio_low;
999 	}
1000 
1001 	if (entry->rule.flags & AUDIT_FILTER_PREPEND) {
1002 		list_add(&entry->rule.list,
1003 			 &audit_rules_list[entry->rule.listnr]);
1004 		list_add_rcu(&entry->list, list);
1005 		entry->rule.flags &= ~AUDIT_FILTER_PREPEND;
1006 	} else {
1007 		list_add_tail(&entry->rule.list,
1008 			      &audit_rules_list[entry->rule.listnr]);
1009 		list_add_tail_rcu(&entry->list, list);
1010 	}
1011 #ifdef CONFIG_AUDITSYSCALL
1012 	if (!dont_count)
1013 		audit_n_rules++;
1014 
1015 	if (!audit_match_signal(entry))
1016 		audit_signals++;
1017 #endif
1018 	mutex_unlock(&audit_filter_mutex);
1019 
1020 	return err;
1021 }
1022 
1023 /* Remove an existing rule from filterlist. */
audit_del_rule(struct audit_entry * entry)1024 int audit_del_rule(struct audit_entry *entry)
1025 {
1026 	struct audit_entry  *e;
1027 	struct audit_tree *tree = entry->rule.tree;
1028 	struct list_head *list;
1029 	int ret = 0;
1030 #ifdef CONFIG_AUDITSYSCALL
1031 	int dont_count = 0;
1032 
1033 	/* If any of these, don't count towards total */
1034 	switch (entry->rule.listnr) {
1035 	case AUDIT_FILTER_USER:
1036 	case AUDIT_FILTER_EXCLUDE:
1037 	case AUDIT_FILTER_FS:
1038 		dont_count = 1;
1039 	}
1040 #endif
1041 
1042 	mutex_lock(&audit_filter_mutex);
1043 	e = audit_find_rule(entry, &list);
1044 	if (!e) {
1045 		ret = -ENOENT;
1046 		goto out;
1047 	}
1048 
1049 	if (e->rule.watch)
1050 		audit_remove_watch_rule(&e->rule);
1051 
1052 	if (e->rule.tree)
1053 		audit_remove_tree_rule(&e->rule);
1054 
1055 	if (e->rule.exe)
1056 		audit_remove_mark_rule(&e->rule);
1057 
1058 #ifdef CONFIG_AUDITSYSCALL
1059 	if (!dont_count)
1060 		audit_n_rules--;
1061 
1062 	if (!audit_match_signal(entry))
1063 		audit_signals--;
1064 #endif
1065 
1066 	list_del_rcu(&e->list);
1067 	list_del(&e->rule.list);
1068 	call_rcu(&e->rcu, audit_free_rule_rcu);
1069 
1070 out:
1071 	mutex_unlock(&audit_filter_mutex);
1072 
1073 	if (tree)
1074 		audit_put_tree(tree);	/* that's the temporary one */
1075 
1076 	return ret;
1077 }
1078 
1079 /* List rules using struct audit_rule_data. */
audit_list_rules(int seq,struct sk_buff_head * q)1080 static void audit_list_rules(int seq, struct sk_buff_head *q)
1081 {
1082 	struct sk_buff *skb;
1083 	struct audit_krule *r;
1084 	int i;
1085 
1086 	/* This is a blocking read, so use audit_filter_mutex instead of rcu
1087 	 * iterator to sync with list writers. */
1088 	for (i = 0; i < AUDIT_NR_FILTERS; i++) {
1089 		list_for_each_entry(r, &audit_rules_list[i], list) {
1090 			struct audit_rule_data *data;
1091 
1092 			data = audit_krule_to_data(r);
1093 			if (unlikely(!data))
1094 				break;
1095 			skb = audit_make_reply(seq, AUDIT_LIST_RULES, 0, 1,
1096 					       data,
1097 					       struct_size(data, buf, data->buflen));
1098 			if (skb)
1099 				skb_queue_tail(q, skb);
1100 			kfree(data);
1101 		}
1102 	}
1103 	skb = audit_make_reply(seq, AUDIT_LIST_RULES, 1, 1, NULL, 0);
1104 	if (skb)
1105 		skb_queue_tail(q, skb);
1106 }
1107 
1108 /* Log rule additions and removals */
audit_log_rule_change(char * action,struct audit_krule * rule,int res)1109 static void audit_log_rule_change(char *action, struct audit_krule *rule, int res)
1110 {
1111 	struct audit_buffer *ab;
1112 
1113 	if (!audit_enabled)
1114 		return;
1115 
1116 	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONFIG_CHANGE);
1117 	if (!ab)
1118 		return;
1119 	audit_log_session_info(ab);
1120 	audit_log_task_context(ab);
1121 	audit_log_format(ab, " op=%s", action);
1122 	audit_log_key(ab, rule->filterkey);
1123 	audit_log_format(ab, " list=%d res=%d", rule->listnr, res);
1124 	audit_log_end(ab);
1125 }
1126 
1127 /**
1128  * audit_rule_change - apply all rules to the specified message type
1129  * @type: audit message type
1130  * @seq: netlink audit message sequence (serial) number
1131  * @data: payload data
1132  * @datasz: size of payload data
1133  */
audit_rule_change(int type,int seq,void * data,size_t datasz)1134 int audit_rule_change(int type, int seq, void *data, size_t datasz)
1135 {
1136 	int err = 0;
1137 	struct audit_entry *entry;
1138 
1139 	switch (type) {
1140 	case AUDIT_ADD_RULE:
1141 		entry = audit_data_to_entry(data, datasz);
1142 		if (IS_ERR(entry))
1143 			return PTR_ERR(entry);
1144 		err = audit_add_rule(entry);
1145 		audit_log_rule_change("add_rule", &entry->rule, !err);
1146 		break;
1147 	case AUDIT_DEL_RULE:
1148 		entry = audit_data_to_entry(data, datasz);
1149 		if (IS_ERR(entry))
1150 			return PTR_ERR(entry);
1151 		err = audit_del_rule(entry);
1152 		audit_log_rule_change("remove_rule", &entry->rule, !err);
1153 		break;
1154 	default:
1155 		WARN_ON(1);
1156 		return -EINVAL;
1157 	}
1158 
1159 	if (err || type == AUDIT_DEL_RULE) {
1160 		if (entry->rule.exe)
1161 			audit_remove_mark(entry->rule.exe);
1162 		audit_free_rule(entry);
1163 	}
1164 
1165 	return err;
1166 }
1167 
1168 /**
1169  * audit_list_rules_send - list the audit rules
1170  * @request_skb: skb of request we are replying to (used to target the reply)
1171  * @seq: netlink audit message sequence (serial) number
1172  */
audit_list_rules_send(struct sk_buff * request_skb,int seq)1173 int audit_list_rules_send(struct sk_buff *request_skb, int seq)
1174 {
1175 	struct task_struct *tsk;
1176 	struct audit_netlink_list *dest;
1177 
1178 	/* We can't just spew out the rules here because we might fill
1179 	 * the available socket buffer space and deadlock waiting for
1180 	 * auditctl to read from it... which isn't ever going to
1181 	 * happen if we're actually running in the context of auditctl
1182 	 * trying to _send_ the stuff */
1183 
1184 	dest = kmalloc(sizeof(*dest), GFP_KERNEL);
1185 	if (!dest)
1186 		return -ENOMEM;
1187 	dest->net = get_net(sock_net(NETLINK_CB(request_skb).sk));
1188 	dest->portid = NETLINK_CB(request_skb).portid;
1189 	skb_queue_head_init(&dest->q);
1190 
1191 	mutex_lock(&audit_filter_mutex);
1192 	audit_list_rules(seq, &dest->q);
1193 	mutex_unlock(&audit_filter_mutex);
1194 
1195 	tsk = kthread_run(audit_send_list_thread, dest, "audit_send_list");
1196 	if (IS_ERR(tsk)) {
1197 		skb_queue_purge(&dest->q);
1198 		put_net(dest->net);
1199 		kfree(dest);
1200 		return PTR_ERR(tsk);
1201 	}
1202 
1203 	return 0;
1204 }
1205 
audit_comparator(u32 left,u32 op,u32 right)1206 int audit_comparator(u32 left, u32 op, u32 right)
1207 {
1208 	switch (op) {
1209 	case Audit_equal:
1210 		return (left == right);
1211 	case Audit_not_equal:
1212 		return (left != right);
1213 	case Audit_lt:
1214 		return (left < right);
1215 	case Audit_le:
1216 		return (left <= right);
1217 	case Audit_gt:
1218 		return (left > right);
1219 	case Audit_ge:
1220 		return (left >= right);
1221 	case Audit_bitmask:
1222 		return (left & right);
1223 	case Audit_bittest:
1224 		return ((left & right) == right);
1225 	default:
1226 		return 0;
1227 	}
1228 }
1229 
audit_uid_comparator(kuid_t left,u32 op,kuid_t right)1230 int audit_uid_comparator(kuid_t left, u32 op, kuid_t right)
1231 {
1232 	switch (op) {
1233 	case Audit_equal:
1234 		return uid_eq(left, right);
1235 	case Audit_not_equal:
1236 		return !uid_eq(left, right);
1237 	case Audit_lt:
1238 		return uid_lt(left, right);
1239 	case Audit_le:
1240 		return uid_lte(left, right);
1241 	case Audit_gt:
1242 		return uid_gt(left, right);
1243 	case Audit_ge:
1244 		return uid_gte(left, right);
1245 	case Audit_bitmask:
1246 	case Audit_bittest:
1247 	default:
1248 		return 0;
1249 	}
1250 }
1251 
audit_gid_comparator(kgid_t left,u32 op,kgid_t right)1252 int audit_gid_comparator(kgid_t left, u32 op, kgid_t right)
1253 {
1254 	switch (op) {
1255 	case Audit_equal:
1256 		return gid_eq(left, right);
1257 	case Audit_not_equal:
1258 		return !gid_eq(left, right);
1259 	case Audit_lt:
1260 		return gid_lt(left, right);
1261 	case Audit_le:
1262 		return gid_lte(left, right);
1263 	case Audit_gt:
1264 		return gid_gt(left, right);
1265 	case Audit_ge:
1266 		return gid_gte(left, right);
1267 	case Audit_bitmask:
1268 	case Audit_bittest:
1269 	default:
1270 		return 0;
1271 	}
1272 }
1273 
1274 /**
1275  * parent_len - find the length of the parent portion of a pathname
1276  * @path: pathname of which to determine length
1277  */
parent_len(const char * path)1278 int parent_len(const char *path)
1279 {
1280 	int plen;
1281 	const char *p;
1282 
1283 	plen = strlen(path);
1284 
1285 	if (plen == 0)
1286 		return plen;
1287 
1288 	/* disregard trailing slashes */
1289 	p = path + plen - 1;
1290 	while ((*p == '/') && (p > path))
1291 		p--;
1292 
1293 	/* walk backward until we find the next slash or hit beginning */
1294 	while ((*p != '/') && (p > path))
1295 		p--;
1296 
1297 	/* did we find a slash? Then increment to include it in path */
1298 	if (*p == '/')
1299 		p++;
1300 
1301 	return p - path;
1302 }
1303 
1304 /**
1305  * audit_compare_dname_path - compare given dentry name with last component in
1306  * 			      given path. Return of 0 indicates a match.
1307  * @dname:	dentry name that we're comparing
1308  * @path:	full pathname that we're comparing
1309  * @parentlen:	length of the parent if known. Passing in AUDIT_NAME_FULL
1310  * 		here indicates that we must compute this value.
1311  */
audit_compare_dname_path(const struct qstr * dname,const char * path,int parentlen)1312 int audit_compare_dname_path(const struct qstr *dname, const char *path, int parentlen)
1313 {
1314 	int dlen, pathlen;
1315 	const char *p;
1316 
1317 	dlen = dname->len;
1318 	pathlen = strlen(path);
1319 	if (pathlen < dlen)
1320 		return 1;
1321 
1322 	parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen;
1323 	if (pathlen - parentlen != dlen)
1324 		return 1;
1325 
1326 	p = path + parentlen;
1327 
1328 	return strncmp(p, dname->name, dlen);
1329 }
1330 
audit_filter(int msgtype,unsigned int listtype)1331 int audit_filter(int msgtype, unsigned int listtype)
1332 {
1333 	struct audit_entry *e;
1334 	int ret = 1; /* Audit by default */
1335 
1336 	rcu_read_lock();
1337 	list_for_each_entry_rcu(e, &audit_filter_list[listtype], list) {
1338 		int i, result = 0;
1339 
1340 		for (i = 0; i < e->rule.field_count; i++) {
1341 			struct audit_field *f = &e->rule.fields[i];
1342 			pid_t pid;
1343 			u32 sid;
1344 
1345 			switch (f->type) {
1346 			case AUDIT_PID:
1347 				pid = task_tgid_nr(current);
1348 				result = audit_comparator(pid, f->op, f->val);
1349 				break;
1350 			case AUDIT_UID:
1351 				result = audit_uid_comparator(current_uid(), f->op, f->uid);
1352 				break;
1353 			case AUDIT_GID:
1354 				result = audit_gid_comparator(current_gid(), f->op, f->gid);
1355 				break;
1356 			case AUDIT_LOGINUID:
1357 				result = audit_uid_comparator(audit_get_loginuid(current),
1358 							      f->op, f->uid);
1359 				break;
1360 			case AUDIT_LOGINUID_SET:
1361 				result = audit_comparator(audit_loginuid_set(current),
1362 							  f->op, f->val);
1363 				break;
1364 			case AUDIT_MSGTYPE:
1365 				result = audit_comparator(msgtype, f->op, f->val);
1366 				break;
1367 			case AUDIT_SUBJ_USER:
1368 			case AUDIT_SUBJ_ROLE:
1369 			case AUDIT_SUBJ_TYPE:
1370 			case AUDIT_SUBJ_SEN:
1371 			case AUDIT_SUBJ_CLR:
1372 				if (f->lsm_rule) {
1373 					security_current_getsecid_subj(&sid);
1374 					result = security_audit_rule_match(sid,
1375 						   f->type, f->op, f->lsm_rule);
1376 				}
1377 				break;
1378 			case AUDIT_EXE:
1379 				result = audit_exe_compare(current, e->rule.exe);
1380 				if (f->op == Audit_not_equal)
1381 					result = !result;
1382 				break;
1383 			default:
1384 				goto unlock_and_return;
1385 			}
1386 			if (result < 0) /* error */
1387 				goto unlock_and_return;
1388 			if (!result)
1389 				break;
1390 		}
1391 		if (result > 0) {
1392 			if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_EXCLUDE)
1393 				ret = 0;
1394 			break;
1395 		}
1396 	}
1397 unlock_and_return:
1398 	rcu_read_unlock();
1399 	return ret;
1400 }
1401 
update_lsm_rule(struct audit_krule * r)1402 static int update_lsm_rule(struct audit_krule *r)
1403 {
1404 	struct audit_entry *entry = container_of(r, struct audit_entry, rule);
1405 	struct audit_entry *nentry;
1406 	int err = 0;
1407 
1408 	if (!security_audit_rule_known(r))
1409 		return 0;
1410 
1411 	nentry = audit_dupe_rule(r);
1412 	if (entry->rule.exe)
1413 		audit_remove_mark(entry->rule.exe);
1414 	if (IS_ERR(nentry)) {
1415 		/* save the first error encountered for the
1416 		 * return value */
1417 		err = PTR_ERR(nentry);
1418 		audit_panic("error updating LSM filters");
1419 		if (r->watch)
1420 			list_del(&r->rlist);
1421 		list_del_rcu(&entry->list);
1422 		list_del(&r->list);
1423 	} else {
1424 		if (r->watch || r->tree)
1425 			list_replace_init(&r->rlist, &nentry->rule.rlist);
1426 		list_replace_rcu(&entry->list, &nentry->list);
1427 		list_replace(&r->list, &nentry->rule.list);
1428 	}
1429 	call_rcu(&entry->rcu, audit_free_rule_rcu);
1430 
1431 	return err;
1432 }
1433 
1434 /* This function will re-initialize the lsm_rule field of all applicable rules.
1435  * It will traverse the filter lists serarching for rules that contain LSM
1436  * specific filter fields.  When such a rule is found, it is copied, the
1437  * LSM field is re-initialized, and the old rule is replaced with the
1438  * updated rule. */
audit_update_lsm_rules(void)1439 int audit_update_lsm_rules(void)
1440 {
1441 	struct audit_krule *r, *n;
1442 	int i, err = 0;
1443 
1444 	/* audit_filter_mutex synchronizes the writers */
1445 	mutex_lock(&audit_filter_mutex);
1446 
1447 	for (i = 0; i < AUDIT_NR_FILTERS; i++) {
1448 		list_for_each_entry_safe(r, n, &audit_rules_list[i], list) {
1449 			int res = update_lsm_rule(r);
1450 			if (!err)
1451 				err = res;
1452 		}
1453 	}
1454 	mutex_unlock(&audit_filter_mutex);
1455 
1456 	return err;
1457 }
1458