1 #include "audit.h" 2 #include <linux/inotify.h> 3 #include <linux/namei.h> 4 #include <linux/mount.h> 5 6 struct audit_tree; 7 struct audit_chunk; 8 9 struct audit_tree { 10 atomic_t count; 11 int goner; 12 struct audit_chunk *root; 13 struct list_head chunks; 14 struct list_head rules; 15 struct list_head list; 16 struct list_head same_root; 17 struct rcu_head head; 18 char pathname[]; 19 }; 20 21 struct audit_chunk { 22 struct list_head hash; 23 struct inotify_watch watch; 24 struct list_head trees; /* with root here */ 25 int dead; 26 int count; 27 atomic_long_t refs; 28 struct rcu_head head; 29 struct node { 30 struct list_head list; 31 struct audit_tree *owner; 32 unsigned index; /* index; upper bit indicates 'will prune' */ 33 } owners[]; 34 }; 35 36 static LIST_HEAD(tree_list); 37 static LIST_HEAD(prune_list); 38 39 /* 40 * One struct chunk is attached to each inode of interest. 41 * We replace struct chunk on tagging/untagging. 42 * Rules have pointer to struct audit_tree. 43 * Rules have struct list_head rlist forming a list of rules over 44 * the same tree. 45 * References to struct chunk are collected at audit_inode{,_child}() 46 * time and used in AUDIT_TREE rule matching. 47 * These references are dropped at the same time we are calling 48 * audit_free_names(), etc. 49 * 50 * Cyclic lists galore: 51 * tree.chunks anchors chunk.owners[].list hash_lock 52 * tree.rules anchors rule.rlist audit_filter_mutex 53 * chunk.trees anchors tree.same_root hash_lock 54 * chunk.hash is a hash with middle bits of watch.inode as 55 * a hash function. RCU, hash_lock 56 * 57 * tree is refcounted; one reference for "some rules on rules_list refer to 58 * it", one for each chunk with pointer to it. 59 * 60 * chunk is refcounted by embedded inotify_watch + .refs (non-zero refcount 61 * of watch contributes 1 to .refs). 62 * 63 * node.index allows to get from node.list to containing chunk. 64 * MSB of that sucker is stolen to mark taggings that we might have to 65 * revert - several operations have very unpleasant cleanup logics and 66 * that makes a difference. Some. 67 */ 68 69 static struct inotify_handle *rtree_ih; 70 71 static struct audit_tree *alloc_tree(const char *s) 72 { 73 struct audit_tree *tree; 74 75 tree = kmalloc(sizeof(struct audit_tree) + strlen(s) + 1, GFP_KERNEL); 76 if (tree) { 77 atomic_set(&tree->count, 1); 78 tree->goner = 0; 79 INIT_LIST_HEAD(&tree->chunks); 80 INIT_LIST_HEAD(&tree->rules); 81 INIT_LIST_HEAD(&tree->list); 82 INIT_LIST_HEAD(&tree->same_root); 83 tree->root = NULL; 84 strcpy(tree->pathname, s); 85 } 86 return tree; 87 } 88 89 static inline void get_tree(struct audit_tree *tree) 90 { 91 atomic_inc(&tree->count); 92 } 93 94 static void __put_tree(struct rcu_head *rcu) 95 { 96 struct audit_tree *tree = container_of(rcu, struct audit_tree, head); 97 kfree(tree); 98 } 99 100 static inline void put_tree(struct audit_tree *tree) 101 { 102 if (atomic_dec_and_test(&tree->count)) 103 call_rcu(&tree->head, __put_tree); 104 } 105 106 /* to avoid bringing the entire thing in audit.h */ 107 const char *audit_tree_path(struct audit_tree *tree) 108 { 109 return tree->pathname; 110 } 111 112 static struct audit_chunk *alloc_chunk(int count) 113 { 114 struct audit_chunk *chunk; 115 size_t size; 116 int i; 117 118 size = offsetof(struct audit_chunk, owners) + count * sizeof(struct node); 119 chunk = kzalloc(size, GFP_KERNEL); 120 if (!chunk) 121 return NULL; 122 123 INIT_LIST_HEAD(&chunk->hash); 124 INIT_LIST_HEAD(&chunk->trees); 125 chunk->count = count; 126 atomic_long_set(&chunk->refs, 1); 127 for (i = 0; i < count; i++) { 128 INIT_LIST_HEAD(&chunk->owners[i].list); 129 chunk->owners[i].index = i; 130 } 131 inotify_init_watch(&chunk->watch); 132 return chunk; 133 } 134 135 static void free_chunk(struct audit_chunk *chunk) 136 { 137 int i; 138 139 for (i = 0; i < chunk->count; i++) { 140 if (chunk->owners[i].owner) 141 put_tree(chunk->owners[i].owner); 142 } 143 kfree(chunk); 144 } 145 146 void audit_put_chunk(struct audit_chunk *chunk) 147 { 148 if (atomic_long_dec_and_test(&chunk->refs)) 149 free_chunk(chunk); 150 } 151 152 static void __put_chunk(struct rcu_head *rcu) 153 { 154 struct audit_chunk *chunk = container_of(rcu, struct audit_chunk, head); 155 audit_put_chunk(chunk); 156 } 157 158 enum {HASH_SIZE = 128}; 159 static struct list_head chunk_hash_heads[HASH_SIZE]; 160 static __cacheline_aligned_in_smp DEFINE_SPINLOCK(hash_lock); 161 162 static inline struct list_head *chunk_hash(const struct inode *inode) 163 { 164 unsigned long n = (unsigned long)inode / L1_CACHE_BYTES; 165 return chunk_hash_heads + n % HASH_SIZE; 166 } 167 168 /* hash_lock is held by caller */ 169 static void insert_hash(struct audit_chunk *chunk) 170 { 171 struct list_head *list = chunk_hash(chunk->watch.inode); 172 list_add_rcu(&chunk->hash, list); 173 } 174 175 /* called under rcu_read_lock */ 176 struct audit_chunk *audit_tree_lookup(const struct inode *inode) 177 { 178 struct list_head *list = chunk_hash(inode); 179 struct audit_chunk *p; 180 181 list_for_each_entry_rcu(p, list, hash) { 182 if (p->watch.inode == inode) { 183 atomic_long_inc(&p->refs); 184 return p; 185 } 186 } 187 return NULL; 188 } 189 190 int audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree) 191 { 192 int n; 193 for (n = 0; n < chunk->count; n++) 194 if (chunk->owners[n].owner == tree) 195 return 1; 196 return 0; 197 } 198 199 /* tagging and untagging inodes with trees */ 200 201 static struct audit_chunk *find_chunk(struct node *p) 202 { 203 int index = p->index & ~(1U<<31); 204 p -= index; 205 return container_of(p, struct audit_chunk, owners[0]); 206 } 207 208 static void untag_chunk(struct node *p) 209 { 210 struct audit_chunk *chunk = find_chunk(p); 211 struct audit_chunk *new; 212 struct audit_tree *owner; 213 int size = chunk->count - 1; 214 int i, j; 215 216 if (!pin_inotify_watch(&chunk->watch)) { 217 /* 218 * Filesystem is shutting down; all watches are getting 219 * evicted, just take it off the node list for this 220 * tree and let the eviction logics take care of the 221 * rest. 222 */ 223 owner = p->owner; 224 if (owner->root == chunk) { 225 list_del_init(&owner->same_root); 226 owner->root = NULL; 227 } 228 list_del_init(&p->list); 229 p->owner = NULL; 230 put_tree(owner); 231 return; 232 } 233 234 spin_unlock(&hash_lock); 235 236 /* 237 * pin_inotify_watch() succeeded, so the watch won't go away 238 * from under us. 239 */ 240 mutex_lock(&chunk->watch.inode->inotify_mutex); 241 if (chunk->dead) { 242 mutex_unlock(&chunk->watch.inode->inotify_mutex); 243 goto out; 244 } 245 246 owner = p->owner; 247 248 if (!size) { 249 chunk->dead = 1; 250 spin_lock(&hash_lock); 251 list_del_init(&chunk->trees); 252 if (owner->root == chunk) 253 owner->root = NULL; 254 list_del_init(&p->list); 255 list_del_rcu(&chunk->hash); 256 spin_unlock(&hash_lock); 257 inotify_evict_watch(&chunk->watch); 258 mutex_unlock(&chunk->watch.inode->inotify_mutex); 259 put_inotify_watch(&chunk->watch); 260 goto out; 261 } 262 263 new = alloc_chunk(size); 264 if (!new) 265 goto Fallback; 266 if (inotify_clone_watch(&chunk->watch, &new->watch) < 0) { 267 free_chunk(new); 268 goto Fallback; 269 } 270 271 chunk->dead = 1; 272 spin_lock(&hash_lock); 273 list_replace_init(&chunk->trees, &new->trees); 274 if (owner->root == chunk) { 275 list_del_init(&owner->same_root); 276 owner->root = NULL; 277 } 278 279 for (i = j = 0; i < size; i++, j++) { 280 struct audit_tree *s; 281 if (&chunk->owners[j] == p) { 282 list_del_init(&p->list); 283 i--; 284 continue; 285 } 286 s = chunk->owners[j].owner; 287 new->owners[i].owner = s; 288 new->owners[i].index = chunk->owners[j].index - j + i; 289 if (!s) /* result of earlier fallback */ 290 continue; 291 get_tree(s); 292 list_replace_init(&chunk->owners[i].list, &new->owners[j].list); 293 } 294 295 list_replace_rcu(&chunk->hash, &new->hash); 296 list_for_each_entry(owner, &new->trees, same_root) 297 owner->root = new; 298 spin_unlock(&hash_lock); 299 inotify_evict_watch(&chunk->watch); 300 mutex_unlock(&chunk->watch.inode->inotify_mutex); 301 put_inotify_watch(&chunk->watch); 302 goto out; 303 304 Fallback: 305 // do the best we can 306 spin_lock(&hash_lock); 307 if (owner->root == chunk) { 308 list_del_init(&owner->same_root); 309 owner->root = NULL; 310 } 311 list_del_init(&p->list); 312 p->owner = NULL; 313 put_tree(owner); 314 spin_unlock(&hash_lock); 315 mutex_unlock(&chunk->watch.inode->inotify_mutex); 316 out: 317 unpin_inotify_watch(&chunk->watch); 318 spin_lock(&hash_lock); 319 } 320 321 static int create_chunk(struct inode *inode, struct audit_tree *tree) 322 { 323 struct audit_chunk *chunk = alloc_chunk(1); 324 if (!chunk) 325 return -ENOMEM; 326 327 if (inotify_add_watch(rtree_ih, &chunk->watch, inode, IN_IGNORED | IN_DELETE_SELF) < 0) { 328 free_chunk(chunk); 329 return -ENOSPC; 330 } 331 332 mutex_lock(&inode->inotify_mutex); 333 spin_lock(&hash_lock); 334 if (tree->goner) { 335 spin_unlock(&hash_lock); 336 chunk->dead = 1; 337 inotify_evict_watch(&chunk->watch); 338 mutex_unlock(&inode->inotify_mutex); 339 put_inotify_watch(&chunk->watch); 340 return 0; 341 } 342 chunk->owners[0].index = (1U << 31); 343 chunk->owners[0].owner = tree; 344 get_tree(tree); 345 list_add(&chunk->owners[0].list, &tree->chunks); 346 if (!tree->root) { 347 tree->root = chunk; 348 list_add(&tree->same_root, &chunk->trees); 349 } 350 insert_hash(chunk); 351 spin_unlock(&hash_lock); 352 mutex_unlock(&inode->inotify_mutex); 353 return 0; 354 } 355 356 /* the first tagged inode becomes root of tree */ 357 static int tag_chunk(struct inode *inode, struct audit_tree *tree) 358 { 359 struct inotify_watch *watch; 360 struct audit_tree *owner; 361 struct audit_chunk *chunk, *old; 362 struct node *p; 363 int n; 364 365 if (inotify_find_watch(rtree_ih, inode, &watch) < 0) 366 return create_chunk(inode, tree); 367 368 old = container_of(watch, struct audit_chunk, watch); 369 370 /* are we already there? */ 371 spin_lock(&hash_lock); 372 for (n = 0; n < old->count; n++) { 373 if (old->owners[n].owner == tree) { 374 spin_unlock(&hash_lock); 375 put_inotify_watch(watch); 376 return 0; 377 } 378 } 379 spin_unlock(&hash_lock); 380 381 chunk = alloc_chunk(old->count + 1); 382 if (!chunk) 383 return -ENOMEM; 384 385 mutex_lock(&inode->inotify_mutex); 386 if (inotify_clone_watch(&old->watch, &chunk->watch) < 0) { 387 mutex_unlock(&inode->inotify_mutex); 388 free_chunk(chunk); 389 return -ENOSPC; 390 } 391 spin_lock(&hash_lock); 392 if (tree->goner) { 393 spin_unlock(&hash_lock); 394 chunk->dead = 1; 395 inotify_evict_watch(&chunk->watch); 396 mutex_unlock(&inode->inotify_mutex); 397 put_inotify_watch(&chunk->watch); 398 return 0; 399 } 400 list_replace_init(&old->trees, &chunk->trees); 401 for (n = 0, p = chunk->owners; n < old->count; n++, p++) { 402 struct audit_tree *s = old->owners[n].owner; 403 p->owner = s; 404 p->index = old->owners[n].index; 405 if (!s) /* result of fallback in untag */ 406 continue; 407 get_tree(s); 408 list_replace_init(&old->owners[n].list, &p->list); 409 } 410 p->index = (chunk->count - 1) | (1U<<31); 411 p->owner = tree; 412 get_tree(tree); 413 list_add(&p->list, &tree->chunks); 414 list_replace_rcu(&old->hash, &chunk->hash); 415 list_for_each_entry(owner, &chunk->trees, same_root) 416 owner->root = chunk; 417 old->dead = 1; 418 if (!tree->root) { 419 tree->root = chunk; 420 list_add(&tree->same_root, &chunk->trees); 421 } 422 spin_unlock(&hash_lock); 423 inotify_evict_watch(&old->watch); 424 mutex_unlock(&inode->inotify_mutex); 425 put_inotify_watch(&old->watch); 426 return 0; 427 } 428 429 static void kill_rules(struct audit_tree *tree) 430 { 431 struct audit_krule *rule, *next; 432 struct audit_entry *entry; 433 struct audit_buffer *ab; 434 435 list_for_each_entry_safe(rule, next, &tree->rules, rlist) { 436 entry = container_of(rule, struct audit_entry, rule); 437 438 list_del_init(&rule->rlist); 439 if (rule->tree) { 440 /* not a half-baked one */ 441 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE); 442 audit_log_format(ab, "op=remove rule dir="); 443 audit_log_untrustedstring(ab, rule->tree->pathname); 444 if (rule->filterkey) { 445 audit_log_format(ab, " key="); 446 audit_log_untrustedstring(ab, rule->filterkey); 447 } else 448 audit_log_format(ab, " key=(null)"); 449 audit_log_format(ab, " list=%d res=1", rule->listnr); 450 audit_log_end(ab); 451 rule->tree = NULL; 452 list_del_rcu(&entry->list); 453 call_rcu(&entry->rcu, audit_free_rule_rcu); 454 } 455 } 456 } 457 458 /* 459 * finish killing struct audit_tree 460 */ 461 static void prune_one(struct audit_tree *victim) 462 { 463 spin_lock(&hash_lock); 464 while (!list_empty(&victim->chunks)) { 465 struct node *p; 466 467 p = list_entry(victim->chunks.next, struct node, list); 468 469 untag_chunk(p); 470 } 471 spin_unlock(&hash_lock); 472 put_tree(victim); 473 } 474 475 /* trim the uncommitted chunks from tree */ 476 477 static void trim_marked(struct audit_tree *tree) 478 { 479 struct list_head *p, *q; 480 spin_lock(&hash_lock); 481 if (tree->goner) { 482 spin_unlock(&hash_lock); 483 return; 484 } 485 /* reorder */ 486 for (p = tree->chunks.next; p != &tree->chunks; p = q) { 487 struct node *node = list_entry(p, struct node, list); 488 q = p->next; 489 if (node->index & (1U<<31)) { 490 list_del_init(p); 491 list_add(p, &tree->chunks); 492 } 493 } 494 495 while (!list_empty(&tree->chunks)) { 496 struct node *node; 497 498 node = list_entry(tree->chunks.next, struct node, list); 499 500 /* have we run out of marked? */ 501 if (!(node->index & (1U<<31))) 502 break; 503 504 untag_chunk(node); 505 } 506 if (!tree->root && !tree->goner) { 507 tree->goner = 1; 508 spin_unlock(&hash_lock); 509 mutex_lock(&audit_filter_mutex); 510 kill_rules(tree); 511 list_del_init(&tree->list); 512 mutex_unlock(&audit_filter_mutex); 513 prune_one(tree); 514 } else { 515 spin_unlock(&hash_lock); 516 } 517 } 518 519 /* called with audit_filter_mutex */ 520 int audit_remove_tree_rule(struct audit_krule *rule) 521 { 522 struct audit_tree *tree; 523 tree = rule->tree; 524 if (tree) { 525 spin_lock(&hash_lock); 526 list_del_init(&rule->rlist); 527 if (list_empty(&tree->rules) && !tree->goner) { 528 tree->root = NULL; 529 list_del_init(&tree->same_root); 530 tree->goner = 1; 531 list_move(&tree->list, &prune_list); 532 rule->tree = NULL; 533 spin_unlock(&hash_lock); 534 audit_schedule_prune(); 535 return 1; 536 } 537 rule->tree = NULL; 538 spin_unlock(&hash_lock); 539 return 1; 540 } 541 return 0; 542 } 543 544 void audit_trim_trees(void) 545 { 546 struct list_head cursor; 547 548 mutex_lock(&audit_filter_mutex); 549 list_add(&cursor, &tree_list); 550 while (cursor.next != &tree_list) { 551 struct audit_tree *tree; 552 struct path path; 553 struct vfsmount *root_mnt; 554 struct node *node; 555 struct list_head list; 556 int err; 557 558 tree = container_of(cursor.next, struct audit_tree, list); 559 get_tree(tree); 560 list_del(&cursor); 561 list_add(&cursor, &tree->list); 562 mutex_unlock(&audit_filter_mutex); 563 564 err = kern_path(tree->pathname, 0, &path); 565 if (err) 566 goto skip_it; 567 568 root_mnt = collect_mounts(path.mnt, path.dentry); 569 path_put(&path); 570 if (!root_mnt) 571 goto skip_it; 572 573 list_add_tail(&list, &root_mnt->mnt_list); 574 spin_lock(&hash_lock); 575 list_for_each_entry(node, &tree->chunks, list) { 576 struct audit_chunk *chunk = find_chunk(node); 577 struct inode *inode = chunk->watch.inode; 578 struct vfsmount *mnt; 579 node->index |= 1U<<31; 580 list_for_each_entry(mnt, &list, mnt_list) { 581 if (mnt->mnt_root->d_inode == inode) { 582 node->index &= ~(1U<<31); 583 break; 584 } 585 } 586 } 587 spin_unlock(&hash_lock); 588 trim_marked(tree); 589 put_tree(tree); 590 list_del_init(&list); 591 drop_collected_mounts(root_mnt); 592 skip_it: 593 mutex_lock(&audit_filter_mutex); 594 } 595 list_del(&cursor); 596 mutex_unlock(&audit_filter_mutex); 597 } 598 599 static int is_under(struct vfsmount *mnt, struct dentry *dentry, 600 struct path *path) 601 { 602 if (mnt != path->mnt) { 603 for (;;) { 604 if (mnt->mnt_parent == mnt) 605 return 0; 606 if (mnt->mnt_parent == path->mnt) 607 break; 608 mnt = mnt->mnt_parent; 609 } 610 dentry = mnt->mnt_mountpoint; 611 } 612 return is_subdir(dentry, path->dentry); 613 } 614 615 int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op) 616 { 617 618 if (pathname[0] != '/' || 619 rule->listnr != AUDIT_FILTER_EXIT || 620 op & ~AUDIT_EQUAL || 621 rule->inode_f || rule->watch || rule->tree) 622 return -EINVAL; 623 rule->tree = alloc_tree(pathname); 624 if (!rule->tree) 625 return -ENOMEM; 626 return 0; 627 } 628 629 void audit_put_tree(struct audit_tree *tree) 630 { 631 put_tree(tree); 632 } 633 634 /* called with audit_filter_mutex */ 635 int audit_add_tree_rule(struct audit_krule *rule) 636 { 637 struct audit_tree *seed = rule->tree, *tree; 638 struct path path; 639 struct vfsmount *mnt, *p; 640 struct list_head list; 641 int err; 642 643 list_for_each_entry(tree, &tree_list, list) { 644 if (!strcmp(seed->pathname, tree->pathname)) { 645 put_tree(seed); 646 rule->tree = tree; 647 list_add(&rule->rlist, &tree->rules); 648 return 0; 649 } 650 } 651 tree = seed; 652 list_add(&tree->list, &tree_list); 653 list_add(&rule->rlist, &tree->rules); 654 /* do not set rule->tree yet */ 655 mutex_unlock(&audit_filter_mutex); 656 657 err = kern_path(tree->pathname, 0, &path); 658 if (err) 659 goto Err; 660 mnt = collect_mounts(path.mnt, path.dentry); 661 path_put(&path); 662 if (!mnt) { 663 err = -ENOMEM; 664 goto Err; 665 } 666 list_add_tail(&list, &mnt->mnt_list); 667 668 get_tree(tree); 669 list_for_each_entry(p, &list, mnt_list) { 670 err = tag_chunk(p->mnt_root->d_inode, tree); 671 if (err) 672 break; 673 } 674 675 list_del(&list); 676 drop_collected_mounts(mnt); 677 678 if (!err) { 679 struct node *node; 680 spin_lock(&hash_lock); 681 list_for_each_entry(node, &tree->chunks, list) 682 node->index &= ~(1U<<31); 683 spin_unlock(&hash_lock); 684 } else { 685 trim_marked(tree); 686 goto Err; 687 } 688 689 mutex_lock(&audit_filter_mutex); 690 if (list_empty(&rule->rlist)) { 691 put_tree(tree); 692 return -ENOENT; 693 } 694 rule->tree = tree; 695 put_tree(tree); 696 697 return 0; 698 Err: 699 mutex_lock(&audit_filter_mutex); 700 list_del_init(&tree->list); 701 list_del_init(&tree->rules); 702 put_tree(tree); 703 return err; 704 } 705 706 int audit_tag_tree(char *old, char *new) 707 { 708 struct list_head cursor, barrier; 709 int failed = 0; 710 struct path path; 711 struct vfsmount *tagged; 712 struct list_head list; 713 struct vfsmount *mnt; 714 struct dentry *dentry; 715 int err; 716 717 err = kern_path(new, 0, &path); 718 if (err) 719 return err; 720 tagged = collect_mounts(path.mnt, path.dentry); 721 path_put(&path); 722 if (!tagged) 723 return -ENOMEM; 724 725 err = kern_path(old, 0, &path); 726 if (err) { 727 drop_collected_mounts(tagged); 728 return err; 729 } 730 mnt = mntget(path.mnt); 731 dentry = dget(path.dentry); 732 path_put(&path); 733 734 if (dentry == tagged->mnt_root && dentry == mnt->mnt_root) 735 follow_up(&mnt, &dentry); 736 737 list_add_tail(&list, &tagged->mnt_list); 738 739 mutex_lock(&audit_filter_mutex); 740 list_add(&barrier, &tree_list); 741 list_add(&cursor, &barrier); 742 743 while (cursor.next != &tree_list) { 744 struct audit_tree *tree; 745 struct vfsmount *p; 746 747 tree = container_of(cursor.next, struct audit_tree, list); 748 get_tree(tree); 749 list_del(&cursor); 750 list_add(&cursor, &tree->list); 751 mutex_unlock(&audit_filter_mutex); 752 753 err = kern_path(tree->pathname, 0, &path); 754 if (err) { 755 put_tree(tree); 756 mutex_lock(&audit_filter_mutex); 757 continue; 758 } 759 760 spin_lock(&vfsmount_lock); 761 if (!is_under(mnt, dentry, &path)) { 762 spin_unlock(&vfsmount_lock); 763 path_put(&path); 764 put_tree(tree); 765 mutex_lock(&audit_filter_mutex); 766 continue; 767 } 768 spin_unlock(&vfsmount_lock); 769 path_put(&path); 770 771 list_for_each_entry(p, &list, mnt_list) { 772 failed = tag_chunk(p->mnt_root->d_inode, tree); 773 if (failed) 774 break; 775 } 776 777 if (failed) { 778 put_tree(tree); 779 mutex_lock(&audit_filter_mutex); 780 break; 781 } 782 783 mutex_lock(&audit_filter_mutex); 784 spin_lock(&hash_lock); 785 if (!tree->goner) { 786 list_del(&tree->list); 787 list_add(&tree->list, &tree_list); 788 } 789 spin_unlock(&hash_lock); 790 put_tree(tree); 791 } 792 793 while (barrier.prev != &tree_list) { 794 struct audit_tree *tree; 795 796 tree = container_of(barrier.prev, struct audit_tree, list); 797 get_tree(tree); 798 list_del(&tree->list); 799 list_add(&tree->list, &barrier); 800 mutex_unlock(&audit_filter_mutex); 801 802 if (!failed) { 803 struct node *node; 804 spin_lock(&hash_lock); 805 list_for_each_entry(node, &tree->chunks, list) 806 node->index &= ~(1U<<31); 807 spin_unlock(&hash_lock); 808 } else { 809 trim_marked(tree); 810 } 811 812 put_tree(tree); 813 mutex_lock(&audit_filter_mutex); 814 } 815 list_del(&barrier); 816 list_del(&cursor); 817 list_del(&list); 818 mutex_unlock(&audit_filter_mutex); 819 dput(dentry); 820 mntput(mnt); 821 drop_collected_mounts(tagged); 822 return failed; 823 } 824 825 /* 826 * That gets run when evict_chunk() ends up needing to kill audit_tree. 827 * Runs from a separate thread, with audit_cmd_mutex held. 828 */ 829 void audit_prune_trees(void) 830 { 831 mutex_lock(&audit_filter_mutex); 832 833 while (!list_empty(&prune_list)) { 834 struct audit_tree *victim; 835 836 victim = list_entry(prune_list.next, struct audit_tree, list); 837 list_del_init(&victim->list); 838 839 mutex_unlock(&audit_filter_mutex); 840 841 prune_one(victim); 842 843 mutex_lock(&audit_filter_mutex); 844 } 845 846 mutex_unlock(&audit_filter_mutex); 847 } 848 849 /* 850 * Here comes the stuff asynchronous to auditctl operations 851 */ 852 853 /* inode->inotify_mutex is locked */ 854 static void evict_chunk(struct audit_chunk *chunk) 855 { 856 struct audit_tree *owner; 857 int n; 858 859 if (chunk->dead) 860 return; 861 862 chunk->dead = 1; 863 mutex_lock(&audit_filter_mutex); 864 spin_lock(&hash_lock); 865 while (!list_empty(&chunk->trees)) { 866 owner = list_entry(chunk->trees.next, 867 struct audit_tree, same_root); 868 owner->goner = 1; 869 owner->root = NULL; 870 list_del_init(&owner->same_root); 871 spin_unlock(&hash_lock); 872 kill_rules(owner); 873 list_move(&owner->list, &prune_list); 874 audit_schedule_prune(); 875 spin_lock(&hash_lock); 876 } 877 list_del_rcu(&chunk->hash); 878 for (n = 0; n < chunk->count; n++) 879 list_del_init(&chunk->owners[n].list); 880 spin_unlock(&hash_lock); 881 mutex_unlock(&audit_filter_mutex); 882 } 883 884 static void handle_event(struct inotify_watch *watch, u32 wd, u32 mask, 885 u32 cookie, const char *dname, struct inode *inode) 886 { 887 struct audit_chunk *chunk = container_of(watch, struct audit_chunk, watch); 888 889 if (mask & IN_IGNORED) { 890 evict_chunk(chunk); 891 put_inotify_watch(watch); 892 } 893 } 894 895 static void destroy_watch(struct inotify_watch *watch) 896 { 897 struct audit_chunk *chunk = container_of(watch, struct audit_chunk, watch); 898 call_rcu(&chunk->head, __put_chunk); 899 } 900 901 static const struct inotify_operations rtree_inotify_ops = { 902 .handle_event = handle_event, 903 .destroy_watch = destroy_watch, 904 }; 905 906 static int __init audit_tree_init(void) 907 { 908 int i; 909 910 rtree_ih = inotify_init(&rtree_inotify_ops); 911 if (IS_ERR(rtree_ih)) 912 audit_panic("cannot initialize inotify handle for rectree watches"); 913 914 for (i = 0; i < HASH_SIZE; i++) 915 INIT_LIST_HEAD(&chunk_hash_heads[i]); 916 917 return 0; 918 } 919 __initcall(audit_tree_init); 920