1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* auditfilter.c -- filtering of audit events 3 * 4 * Copyright 2003-2004 Red Hat, Inc. 5 * Copyright 2005 Hewlett-Packard Development Company, L.P. 6 * Copyright 2005 IBM Corporation 7 */ 8 9 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 10 11 #include <linux/kernel.h> 12 #include <linux/audit.h> 13 #include <linux/kthread.h> 14 #include <linux/mutex.h> 15 #include <linux/fs.h> 16 #include <linux/namei.h> 17 #include <linux/netlink.h> 18 #include <linux/sched.h> 19 #include <linux/slab.h> 20 #include <linux/security.h> 21 #include <net/net_namespace.h> 22 #include <net/sock.h> 23 #include "audit.h" 24 25 /* 26 * Locking model: 27 * 28 * audit_filter_mutex: 29 * Synchronizes writes and blocking reads of audit's filterlist 30 * data. Rcu is used to traverse the filterlist and access 31 * contents of structs audit_entry, audit_watch and opaque 32 * LSM rules during filtering. If modified, these structures 33 * must be copied and replace their counterparts in the filterlist. 34 * An audit_parent struct is not accessed during filtering, so may 35 * be written directly provided audit_filter_mutex is held. 36 */ 37 38 /* Audit filter lists, defined in <linux/audit.h> */ 39 struct list_head audit_filter_list[AUDIT_NR_FILTERS] = { 40 LIST_HEAD_INIT(audit_filter_list[0]), 41 LIST_HEAD_INIT(audit_filter_list[1]), 42 LIST_HEAD_INIT(audit_filter_list[2]), 43 LIST_HEAD_INIT(audit_filter_list[3]), 44 LIST_HEAD_INIT(audit_filter_list[4]), 45 LIST_HEAD_INIT(audit_filter_list[5]), 46 LIST_HEAD_INIT(audit_filter_list[6]), 47 #if AUDIT_NR_FILTERS != 7 48 #error Fix audit_filter_list initialiser 49 #endif 50 }; 51 static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = { 52 LIST_HEAD_INIT(audit_rules_list[0]), 53 LIST_HEAD_INIT(audit_rules_list[1]), 54 LIST_HEAD_INIT(audit_rules_list[2]), 55 LIST_HEAD_INIT(audit_rules_list[3]), 56 LIST_HEAD_INIT(audit_rules_list[4]), 57 LIST_HEAD_INIT(audit_rules_list[5]), 58 LIST_HEAD_INIT(audit_rules_list[6]), 59 }; 60 61 DEFINE_MUTEX(audit_filter_mutex); 62 63 static void audit_free_lsm_field(struct audit_field *f) 64 { 65 switch (f->type) { 66 case AUDIT_SUBJ_USER: 67 case AUDIT_SUBJ_ROLE: 68 case AUDIT_SUBJ_TYPE: 69 case AUDIT_SUBJ_SEN: 70 case AUDIT_SUBJ_CLR: 71 case AUDIT_OBJ_USER: 72 case AUDIT_OBJ_ROLE: 73 case AUDIT_OBJ_TYPE: 74 case AUDIT_OBJ_LEV_LOW: 75 case AUDIT_OBJ_LEV_HIGH: 76 kfree(f->lsm_str); 77 security_audit_rule_free(f->lsm_rule); 78 } 79 } 80 81 static inline void audit_free_rule(struct audit_entry *e) 82 { 83 int i; 84 struct audit_krule *erule = &e->rule; 85 86 /* some rules don't have associated watches */ 87 if (erule->watch) 88 audit_put_watch(erule->watch); 89 if (erule->fields) 90 for (i = 0; i < erule->field_count; i++) 91 audit_free_lsm_field(&erule->fields[i]); 92 kfree(erule->fields); 93 kfree(erule->filterkey); 94 kfree(e); 95 } 96 97 void audit_free_rule_rcu(struct rcu_head *head) 98 { 99 struct audit_entry *e = container_of(head, struct audit_entry, rcu); 100 audit_free_rule(e); 101 } 102 103 /* Initialize an audit filterlist entry. */ 104 static inline struct audit_entry *audit_init_entry(u32 field_count) 105 { 106 struct audit_entry *entry; 107 struct audit_field *fields; 108 109 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 110 if (unlikely(!entry)) 111 return NULL; 112 113 fields = kcalloc(field_count, sizeof(*fields), GFP_KERNEL); 114 if (unlikely(!fields)) { 115 kfree(entry); 116 return NULL; 117 } 118 entry->rule.fields = fields; 119 120 return entry; 121 } 122 123 /* Unpack a filter field's string representation from user-space 124 * buffer. */ 125 char *audit_unpack_string(void **bufp, size_t *remain, size_t len) 126 { 127 char *str; 128 129 if (!*bufp || (len == 0) || (len > *remain)) 130 return ERR_PTR(-EINVAL); 131 132 /* Of the currently implemented string fields, PATH_MAX 133 * defines the longest valid length. 134 */ 135 if (len > PATH_MAX) 136 return ERR_PTR(-ENAMETOOLONG); 137 138 str = kmalloc(len + 1, GFP_KERNEL); 139 if (unlikely(!str)) 140 return ERR_PTR(-ENOMEM); 141 142 memcpy(str, *bufp, len); 143 str[len] = 0; 144 *bufp += len; 145 *remain -= len; 146 147 return str; 148 } 149 150 /* Translate an inode field to kernel representation. */ 151 static inline int audit_to_inode(struct audit_krule *krule, 152 struct audit_field *f) 153 { 154 if (krule->listnr != AUDIT_FILTER_EXIT || 155 krule->inode_f || krule->watch || krule->tree || 156 (f->op != Audit_equal && f->op != Audit_not_equal)) 157 return -EINVAL; 158 159 krule->inode_f = f; 160 return 0; 161 } 162 163 static __u32 *classes[AUDIT_SYSCALL_CLASSES]; 164 165 int __init audit_register_class(int class, unsigned *list) 166 { 167 __u32 *p = kcalloc(AUDIT_BITMASK_SIZE, sizeof(__u32), GFP_KERNEL); 168 if (!p) 169 return -ENOMEM; 170 while (*list != ~0U) { 171 unsigned n = *list++; 172 if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) { 173 kfree(p); 174 return -EINVAL; 175 } 176 p[AUDIT_WORD(n)] |= AUDIT_BIT(n); 177 } 178 if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) { 179 kfree(p); 180 return -EINVAL; 181 } 182 classes[class] = p; 183 return 0; 184 } 185 186 int audit_match_class(int class, unsigned syscall) 187 { 188 if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32)) 189 return 0; 190 if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class])) 191 return 0; 192 return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall); 193 } 194 195 #ifdef CONFIG_AUDITSYSCALL 196 static inline int audit_match_class_bits(int class, u32 *mask) 197 { 198 int i; 199 200 if (classes[class]) { 201 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 202 if (mask[i] & classes[class][i]) 203 return 0; 204 } 205 return 1; 206 } 207 208 static int audit_match_signal(struct audit_entry *entry) 209 { 210 struct audit_field *arch = entry->rule.arch_f; 211 212 if (!arch) { 213 /* When arch is unspecified, we must check both masks on biarch 214 * as syscall number alone is ambiguous. */ 215 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL, 216 entry->rule.mask) && 217 audit_match_class_bits(AUDIT_CLASS_SIGNAL_32, 218 entry->rule.mask)); 219 } 220 221 switch(audit_classify_arch(arch->val)) { 222 case 0: /* native */ 223 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL, 224 entry->rule.mask)); 225 case 1: /* 32bit on biarch */ 226 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32, 227 entry->rule.mask)); 228 default: 229 return 1; 230 } 231 } 232 #endif 233 234 /* Common user-space to kernel rule translation. */ 235 static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule) 236 { 237 unsigned listnr; 238 struct audit_entry *entry; 239 int i, err; 240 241 err = -EINVAL; 242 listnr = rule->flags & ~AUDIT_FILTER_PREPEND; 243 switch(listnr) { 244 default: 245 goto exit_err; 246 #ifdef CONFIG_AUDITSYSCALL 247 case AUDIT_FILTER_ENTRY: 248 pr_err("AUDIT_FILTER_ENTRY is deprecated\n"); 249 goto exit_err; 250 case AUDIT_FILTER_EXIT: 251 case AUDIT_FILTER_TASK: 252 #endif 253 case AUDIT_FILTER_USER: 254 case AUDIT_FILTER_EXCLUDE: 255 case AUDIT_FILTER_FS: 256 ; 257 } 258 if (unlikely(rule->action == AUDIT_POSSIBLE)) { 259 pr_err("AUDIT_POSSIBLE is deprecated\n"); 260 goto exit_err; 261 } 262 if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS) 263 goto exit_err; 264 if (rule->field_count > AUDIT_MAX_FIELDS) 265 goto exit_err; 266 267 err = -ENOMEM; 268 entry = audit_init_entry(rule->field_count); 269 if (!entry) 270 goto exit_err; 271 272 entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND; 273 entry->rule.listnr = listnr; 274 entry->rule.action = rule->action; 275 entry->rule.field_count = rule->field_count; 276 277 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 278 entry->rule.mask[i] = rule->mask[i]; 279 280 for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) { 281 int bit = AUDIT_BITMASK_SIZE * 32 - i - 1; 282 __u32 *p = &entry->rule.mask[AUDIT_WORD(bit)]; 283 __u32 *class; 284 285 if (!(*p & AUDIT_BIT(bit))) 286 continue; 287 *p &= ~AUDIT_BIT(bit); 288 class = classes[i]; 289 if (class) { 290 int j; 291 for (j = 0; j < AUDIT_BITMASK_SIZE; j++) 292 entry->rule.mask[j] |= class[j]; 293 } 294 } 295 296 return entry; 297 298 exit_err: 299 return ERR_PTR(err); 300 } 301 302 static u32 audit_ops[] = 303 { 304 [Audit_equal] = AUDIT_EQUAL, 305 [Audit_not_equal] = AUDIT_NOT_EQUAL, 306 [Audit_bitmask] = AUDIT_BIT_MASK, 307 [Audit_bittest] = AUDIT_BIT_TEST, 308 [Audit_lt] = AUDIT_LESS_THAN, 309 [Audit_gt] = AUDIT_GREATER_THAN, 310 [Audit_le] = AUDIT_LESS_THAN_OR_EQUAL, 311 [Audit_ge] = AUDIT_GREATER_THAN_OR_EQUAL, 312 }; 313 314 static u32 audit_to_op(u32 op) 315 { 316 u32 n; 317 for (n = Audit_equal; n < Audit_bad && audit_ops[n] != op; n++) 318 ; 319 return n; 320 } 321 322 /* check if an audit field is valid */ 323 static int audit_field_valid(struct audit_entry *entry, struct audit_field *f) 324 { 325 switch (f->type) { 326 case AUDIT_MSGTYPE: 327 if (entry->rule.listnr != AUDIT_FILTER_EXCLUDE && 328 entry->rule.listnr != AUDIT_FILTER_USER) 329 return -EINVAL; 330 break; 331 case AUDIT_FSTYPE: 332 if (entry->rule.listnr != AUDIT_FILTER_FS) 333 return -EINVAL; 334 break; 335 } 336 337 switch (entry->rule.listnr) { 338 case AUDIT_FILTER_FS: 339 switch(f->type) { 340 case AUDIT_FSTYPE: 341 case AUDIT_FILTERKEY: 342 break; 343 default: 344 return -EINVAL; 345 } 346 } 347 348 /* Check for valid field type and op */ 349 switch (f->type) { 350 case AUDIT_ARG0: 351 case AUDIT_ARG1: 352 case AUDIT_ARG2: 353 case AUDIT_ARG3: 354 case AUDIT_PERS: /* <uapi/linux/personality.h> */ 355 case AUDIT_DEVMINOR: 356 /* all ops are valid */ 357 break; 358 case AUDIT_UID: 359 case AUDIT_EUID: 360 case AUDIT_SUID: 361 case AUDIT_FSUID: 362 case AUDIT_LOGINUID: 363 case AUDIT_OBJ_UID: 364 case AUDIT_GID: 365 case AUDIT_EGID: 366 case AUDIT_SGID: 367 case AUDIT_FSGID: 368 case AUDIT_OBJ_GID: 369 case AUDIT_PID: 370 case AUDIT_MSGTYPE: 371 case AUDIT_PPID: 372 case AUDIT_DEVMAJOR: 373 case AUDIT_EXIT: 374 case AUDIT_SUCCESS: 375 case AUDIT_INODE: 376 case AUDIT_SESSIONID: 377 case AUDIT_SUBJ_SEN: 378 case AUDIT_SUBJ_CLR: 379 case AUDIT_OBJ_LEV_LOW: 380 case AUDIT_OBJ_LEV_HIGH: 381 case AUDIT_SADDR_FAM: 382 /* bit ops are only useful on syscall args */ 383 if (f->op == Audit_bitmask || f->op == Audit_bittest) 384 return -EINVAL; 385 break; 386 case AUDIT_SUBJ_USER: 387 case AUDIT_SUBJ_ROLE: 388 case AUDIT_SUBJ_TYPE: 389 case AUDIT_OBJ_USER: 390 case AUDIT_OBJ_ROLE: 391 case AUDIT_OBJ_TYPE: 392 case AUDIT_WATCH: 393 case AUDIT_DIR: 394 case AUDIT_FILTERKEY: 395 case AUDIT_LOGINUID_SET: 396 case AUDIT_ARCH: 397 case AUDIT_FSTYPE: 398 case AUDIT_PERM: 399 case AUDIT_FILETYPE: 400 case AUDIT_FIELD_COMPARE: 401 case AUDIT_EXE: 402 /* only equal and not equal valid ops */ 403 if (f->op != Audit_not_equal && f->op != Audit_equal) 404 return -EINVAL; 405 break; 406 default: 407 /* field not recognized */ 408 return -EINVAL; 409 } 410 411 /* Check for select valid field values */ 412 switch (f->type) { 413 case AUDIT_LOGINUID_SET: 414 if ((f->val != 0) && (f->val != 1)) 415 return -EINVAL; 416 break; 417 case AUDIT_PERM: 418 if (f->val & ~15) 419 return -EINVAL; 420 break; 421 case AUDIT_FILETYPE: 422 if (f->val & ~S_IFMT) 423 return -EINVAL; 424 break; 425 case AUDIT_FIELD_COMPARE: 426 if (f->val > AUDIT_MAX_FIELD_COMPARE) 427 return -EINVAL; 428 break; 429 case AUDIT_SADDR_FAM: 430 if (f->val >= AF_MAX) 431 return -EINVAL; 432 break; 433 default: 434 break; 435 } 436 437 return 0; 438 } 439 440 /* Translate struct audit_rule_data to kernel's rule representation. */ 441 static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, 442 size_t datasz) 443 { 444 int err = 0; 445 struct audit_entry *entry; 446 void *bufp; 447 size_t remain = datasz - sizeof(struct audit_rule_data); 448 int i; 449 char *str; 450 struct audit_fsnotify_mark *audit_mark; 451 452 entry = audit_to_entry_common(data); 453 if (IS_ERR(entry)) 454 goto exit_nofree; 455 456 bufp = data->buf; 457 for (i = 0; i < data->field_count; i++) { 458 struct audit_field *f = &entry->rule.fields[i]; 459 u32 f_val; 460 461 err = -EINVAL; 462 463 f->op = audit_to_op(data->fieldflags[i]); 464 if (f->op == Audit_bad) 465 goto exit_free; 466 467 f->type = data->fields[i]; 468 f_val = data->values[i]; 469 470 /* Support legacy tests for a valid loginuid */ 471 if ((f->type == AUDIT_LOGINUID) && (f_val == AUDIT_UID_UNSET)) { 472 f->type = AUDIT_LOGINUID_SET; 473 f_val = 0; 474 entry->rule.pflags |= AUDIT_LOGINUID_LEGACY; 475 } 476 477 err = audit_field_valid(entry, f); 478 if (err) 479 goto exit_free; 480 481 err = -EINVAL; 482 switch (f->type) { 483 case AUDIT_LOGINUID: 484 case AUDIT_UID: 485 case AUDIT_EUID: 486 case AUDIT_SUID: 487 case AUDIT_FSUID: 488 case AUDIT_OBJ_UID: 489 f->uid = make_kuid(current_user_ns(), f_val); 490 if (!uid_valid(f->uid)) 491 goto exit_free; 492 break; 493 case AUDIT_GID: 494 case AUDIT_EGID: 495 case AUDIT_SGID: 496 case AUDIT_FSGID: 497 case AUDIT_OBJ_GID: 498 f->gid = make_kgid(current_user_ns(), f_val); 499 if (!gid_valid(f->gid)) 500 goto exit_free; 501 break; 502 case AUDIT_ARCH: 503 f->val = f_val; 504 entry->rule.arch_f = f; 505 break; 506 case AUDIT_SUBJ_USER: 507 case AUDIT_SUBJ_ROLE: 508 case AUDIT_SUBJ_TYPE: 509 case AUDIT_SUBJ_SEN: 510 case AUDIT_SUBJ_CLR: 511 case AUDIT_OBJ_USER: 512 case AUDIT_OBJ_ROLE: 513 case AUDIT_OBJ_TYPE: 514 case AUDIT_OBJ_LEV_LOW: 515 case AUDIT_OBJ_LEV_HIGH: 516 str = audit_unpack_string(&bufp, &remain, f_val); 517 if (IS_ERR(str)) { 518 err = PTR_ERR(str); 519 goto exit_free; 520 } 521 entry->rule.buflen += f_val; 522 f->lsm_str = str; 523 err = security_audit_rule_init(f->type, f->op, str, 524 (void **)&f->lsm_rule); 525 /* Keep currently invalid fields around in case they 526 * become valid after a policy reload. */ 527 if (err == -EINVAL) { 528 pr_warn("audit rule for LSM \'%s\' is invalid\n", 529 str); 530 err = 0; 531 } else if (err) 532 goto exit_free; 533 break; 534 case AUDIT_WATCH: 535 str = audit_unpack_string(&bufp, &remain, f_val); 536 if (IS_ERR(str)) { 537 err = PTR_ERR(str); 538 goto exit_free; 539 } 540 err = audit_to_watch(&entry->rule, str, f_val, f->op); 541 if (err) { 542 kfree(str); 543 goto exit_free; 544 } 545 entry->rule.buflen += f_val; 546 break; 547 case AUDIT_DIR: 548 str = audit_unpack_string(&bufp, &remain, f_val); 549 if (IS_ERR(str)) { 550 err = PTR_ERR(str); 551 goto exit_free; 552 } 553 err = audit_make_tree(&entry->rule, str, f->op); 554 kfree(str); 555 if (err) 556 goto exit_free; 557 entry->rule.buflen += f_val; 558 break; 559 case AUDIT_INODE: 560 f->val = f_val; 561 err = audit_to_inode(&entry->rule, f); 562 if (err) 563 goto exit_free; 564 break; 565 case AUDIT_FILTERKEY: 566 if (entry->rule.filterkey || f_val > AUDIT_MAX_KEY_LEN) 567 goto exit_free; 568 str = audit_unpack_string(&bufp, &remain, f_val); 569 if (IS_ERR(str)) { 570 err = PTR_ERR(str); 571 goto exit_free; 572 } 573 entry->rule.buflen += f_val; 574 entry->rule.filterkey = str; 575 break; 576 case AUDIT_EXE: 577 if (entry->rule.exe || f_val > PATH_MAX) 578 goto exit_free; 579 str = audit_unpack_string(&bufp, &remain, f_val); 580 if (IS_ERR(str)) { 581 err = PTR_ERR(str); 582 goto exit_free; 583 } 584 audit_mark = audit_alloc_mark(&entry->rule, str, f_val); 585 if (IS_ERR(audit_mark)) { 586 kfree(str); 587 err = PTR_ERR(audit_mark); 588 goto exit_free; 589 } 590 entry->rule.buflen += f_val; 591 entry->rule.exe = audit_mark; 592 break; 593 default: 594 f->val = f_val; 595 break; 596 } 597 } 598 599 if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal) 600 entry->rule.inode_f = NULL; 601 602 exit_nofree: 603 return entry; 604 605 exit_free: 606 if (entry->rule.tree) 607 audit_put_tree(entry->rule.tree); /* that's the temporary one */ 608 if (entry->rule.exe) 609 audit_remove_mark(entry->rule.exe); /* that's the template one */ 610 audit_free_rule(entry); 611 return ERR_PTR(err); 612 } 613 614 /* Pack a filter field's string representation into data block. */ 615 static inline size_t audit_pack_string(void **bufp, const char *str) 616 { 617 size_t len = strlen(str); 618 619 memcpy(*bufp, str, len); 620 *bufp += len; 621 622 return len; 623 } 624 625 /* Translate kernel rule representation to struct audit_rule_data. */ 626 static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) 627 { 628 struct audit_rule_data *data; 629 void *bufp; 630 int i; 631 632 data = kmalloc(sizeof(*data) + krule->buflen, GFP_KERNEL); 633 if (unlikely(!data)) 634 return NULL; 635 memset(data, 0, sizeof(*data)); 636 637 data->flags = krule->flags | krule->listnr; 638 data->action = krule->action; 639 data->field_count = krule->field_count; 640 bufp = data->buf; 641 for (i = 0; i < data->field_count; i++) { 642 struct audit_field *f = &krule->fields[i]; 643 644 data->fields[i] = f->type; 645 data->fieldflags[i] = audit_ops[f->op]; 646 switch(f->type) { 647 case AUDIT_SUBJ_USER: 648 case AUDIT_SUBJ_ROLE: 649 case AUDIT_SUBJ_TYPE: 650 case AUDIT_SUBJ_SEN: 651 case AUDIT_SUBJ_CLR: 652 case AUDIT_OBJ_USER: 653 case AUDIT_OBJ_ROLE: 654 case AUDIT_OBJ_TYPE: 655 case AUDIT_OBJ_LEV_LOW: 656 case AUDIT_OBJ_LEV_HIGH: 657 data->buflen += data->values[i] = 658 audit_pack_string(&bufp, f->lsm_str); 659 break; 660 case AUDIT_WATCH: 661 data->buflen += data->values[i] = 662 audit_pack_string(&bufp, 663 audit_watch_path(krule->watch)); 664 break; 665 case AUDIT_DIR: 666 data->buflen += data->values[i] = 667 audit_pack_string(&bufp, 668 audit_tree_path(krule->tree)); 669 break; 670 case AUDIT_FILTERKEY: 671 data->buflen += data->values[i] = 672 audit_pack_string(&bufp, krule->filterkey); 673 break; 674 case AUDIT_EXE: 675 data->buflen += data->values[i] = 676 audit_pack_string(&bufp, audit_mark_path(krule->exe)); 677 break; 678 case AUDIT_LOGINUID_SET: 679 if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) { 680 data->fields[i] = AUDIT_LOGINUID; 681 data->values[i] = AUDIT_UID_UNSET; 682 break; 683 } 684 /* fall through - if set */ 685 default: 686 data->values[i] = f->val; 687 } 688 } 689 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i]; 690 691 return data; 692 } 693 694 /* Compare two rules in kernel format. Considered success if rules 695 * don't match. */ 696 static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b) 697 { 698 int i; 699 700 if (a->flags != b->flags || 701 a->pflags != b->pflags || 702 a->listnr != b->listnr || 703 a->action != b->action || 704 a->field_count != b->field_count) 705 return 1; 706 707 for (i = 0; i < a->field_count; i++) { 708 if (a->fields[i].type != b->fields[i].type || 709 a->fields[i].op != b->fields[i].op) 710 return 1; 711 712 switch(a->fields[i].type) { 713 case AUDIT_SUBJ_USER: 714 case AUDIT_SUBJ_ROLE: 715 case AUDIT_SUBJ_TYPE: 716 case AUDIT_SUBJ_SEN: 717 case AUDIT_SUBJ_CLR: 718 case AUDIT_OBJ_USER: 719 case AUDIT_OBJ_ROLE: 720 case AUDIT_OBJ_TYPE: 721 case AUDIT_OBJ_LEV_LOW: 722 case AUDIT_OBJ_LEV_HIGH: 723 if (strcmp(a->fields[i].lsm_str, b->fields[i].lsm_str)) 724 return 1; 725 break; 726 case AUDIT_WATCH: 727 if (strcmp(audit_watch_path(a->watch), 728 audit_watch_path(b->watch))) 729 return 1; 730 break; 731 case AUDIT_DIR: 732 if (strcmp(audit_tree_path(a->tree), 733 audit_tree_path(b->tree))) 734 return 1; 735 break; 736 case AUDIT_FILTERKEY: 737 /* both filterkeys exist based on above type compare */ 738 if (strcmp(a->filterkey, b->filterkey)) 739 return 1; 740 break; 741 case AUDIT_EXE: 742 /* both paths exist based on above type compare */ 743 if (strcmp(audit_mark_path(a->exe), 744 audit_mark_path(b->exe))) 745 return 1; 746 break; 747 case AUDIT_UID: 748 case AUDIT_EUID: 749 case AUDIT_SUID: 750 case AUDIT_FSUID: 751 case AUDIT_LOGINUID: 752 case AUDIT_OBJ_UID: 753 if (!uid_eq(a->fields[i].uid, b->fields[i].uid)) 754 return 1; 755 break; 756 case AUDIT_GID: 757 case AUDIT_EGID: 758 case AUDIT_SGID: 759 case AUDIT_FSGID: 760 case AUDIT_OBJ_GID: 761 if (!gid_eq(a->fields[i].gid, b->fields[i].gid)) 762 return 1; 763 break; 764 default: 765 if (a->fields[i].val != b->fields[i].val) 766 return 1; 767 } 768 } 769 770 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 771 if (a->mask[i] != b->mask[i]) 772 return 1; 773 774 return 0; 775 } 776 777 /* Duplicate LSM field information. The lsm_rule is opaque, so must be 778 * re-initialized. */ 779 static inline int audit_dupe_lsm_field(struct audit_field *df, 780 struct audit_field *sf) 781 { 782 int ret = 0; 783 char *lsm_str; 784 785 /* our own copy of lsm_str */ 786 lsm_str = kstrdup(sf->lsm_str, GFP_KERNEL); 787 if (unlikely(!lsm_str)) 788 return -ENOMEM; 789 df->lsm_str = lsm_str; 790 791 /* our own (refreshed) copy of lsm_rule */ 792 ret = security_audit_rule_init(df->type, df->op, df->lsm_str, 793 (void **)&df->lsm_rule); 794 /* Keep currently invalid fields around in case they 795 * become valid after a policy reload. */ 796 if (ret == -EINVAL) { 797 pr_warn("audit rule for LSM \'%s\' is invalid\n", 798 df->lsm_str); 799 ret = 0; 800 } 801 802 return ret; 803 } 804 805 /* Duplicate an audit rule. This will be a deep copy with the exception 806 * of the watch - that pointer is carried over. The LSM specific fields 807 * will be updated in the copy. The point is to be able to replace the old 808 * rule with the new rule in the filterlist, then free the old rule. 809 * The rlist element is undefined; list manipulations are handled apart from 810 * the initial copy. */ 811 struct audit_entry *audit_dupe_rule(struct audit_krule *old) 812 { 813 u32 fcount = old->field_count; 814 struct audit_entry *entry; 815 struct audit_krule *new; 816 char *fk; 817 int i, err = 0; 818 819 entry = audit_init_entry(fcount); 820 if (unlikely(!entry)) 821 return ERR_PTR(-ENOMEM); 822 823 new = &entry->rule; 824 new->flags = old->flags; 825 new->pflags = old->pflags; 826 new->listnr = old->listnr; 827 new->action = old->action; 828 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 829 new->mask[i] = old->mask[i]; 830 new->prio = old->prio; 831 new->buflen = old->buflen; 832 new->inode_f = old->inode_f; 833 new->field_count = old->field_count; 834 835 /* 836 * note that we are OK with not refcounting here; audit_match_tree() 837 * never dereferences tree and we can't get false positives there 838 * since we'd have to have rule gone from the list *and* removed 839 * before the chunks found by lookup had been allocated, i.e. before 840 * the beginning of list scan. 841 */ 842 new->tree = old->tree; 843 memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount); 844 845 /* deep copy this information, updating the lsm_rule fields, because 846 * the originals will all be freed when the old rule is freed. */ 847 for (i = 0; i < fcount; i++) { 848 switch (new->fields[i].type) { 849 case AUDIT_SUBJ_USER: 850 case AUDIT_SUBJ_ROLE: 851 case AUDIT_SUBJ_TYPE: 852 case AUDIT_SUBJ_SEN: 853 case AUDIT_SUBJ_CLR: 854 case AUDIT_OBJ_USER: 855 case AUDIT_OBJ_ROLE: 856 case AUDIT_OBJ_TYPE: 857 case AUDIT_OBJ_LEV_LOW: 858 case AUDIT_OBJ_LEV_HIGH: 859 err = audit_dupe_lsm_field(&new->fields[i], 860 &old->fields[i]); 861 break; 862 case AUDIT_FILTERKEY: 863 fk = kstrdup(old->filterkey, GFP_KERNEL); 864 if (unlikely(!fk)) 865 err = -ENOMEM; 866 else 867 new->filterkey = fk; 868 break; 869 case AUDIT_EXE: 870 err = audit_dupe_exe(new, old); 871 break; 872 } 873 if (err) { 874 if (new->exe) 875 audit_remove_mark(new->exe); 876 audit_free_rule(entry); 877 return ERR_PTR(err); 878 } 879 } 880 881 if (old->watch) { 882 audit_get_watch(old->watch); 883 new->watch = old->watch; 884 } 885 886 return entry; 887 } 888 889 /* Find an existing audit rule. 890 * Caller must hold audit_filter_mutex to prevent stale rule data. */ 891 static struct audit_entry *audit_find_rule(struct audit_entry *entry, 892 struct list_head **p) 893 { 894 struct audit_entry *e, *found = NULL; 895 struct list_head *list; 896 int h; 897 898 if (entry->rule.inode_f) { 899 h = audit_hash_ino(entry->rule.inode_f->val); 900 *p = list = &audit_inode_hash[h]; 901 } else if (entry->rule.watch) { 902 /* we don't know the inode number, so must walk entire hash */ 903 for (h = 0; h < AUDIT_INODE_BUCKETS; h++) { 904 list = &audit_inode_hash[h]; 905 list_for_each_entry(e, list, list) 906 if (!audit_compare_rule(&entry->rule, &e->rule)) { 907 found = e; 908 goto out; 909 } 910 } 911 goto out; 912 } else { 913 *p = list = &audit_filter_list[entry->rule.listnr]; 914 } 915 916 list_for_each_entry(e, list, list) 917 if (!audit_compare_rule(&entry->rule, &e->rule)) { 918 found = e; 919 goto out; 920 } 921 922 out: 923 return found; 924 } 925 926 static u64 prio_low = ~0ULL/2; 927 static u64 prio_high = ~0ULL/2 - 1; 928 929 /* Add rule to given filterlist if not a duplicate. */ 930 static inline int audit_add_rule(struct audit_entry *entry) 931 { 932 struct audit_entry *e; 933 struct audit_watch *watch = entry->rule.watch; 934 struct audit_tree *tree = entry->rule.tree; 935 struct list_head *list; 936 int err = 0; 937 #ifdef CONFIG_AUDITSYSCALL 938 int dont_count = 0; 939 940 /* If any of these, don't count towards total */ 941 switch(entry->rule.listnr) { 942 case AUDIT_FILTER_USER: 943 case AUDIT_FILTER_EXCLUDE: 944 case AUDIT_FILTER_FS: 945 dont_count = 1; 946 } 947 #endif 948 949 mutex_lock(&audit_filter_mutex); 950 e = audit_find_rule(entry, &list); 951 if (e) { 952 mutex_unlock(&audit_filter_mutex); 953 err = -EEXIST; 954 /* normally audit_add_tree_rule() will free it on failure */ 955 if (tree) 956 audit_put_tree(tree); 957 return err; 958 } 959 960 if (watch) { 961 /* audit_filter_mutex is dropped and re-taken during this call */ 962 err = audit_add_watch(&entry->rule, &list); 963 if (err) { 964 mutex_unlock(&audit_filter_mutex); 965 /* 966 * normally audit_add_tree_rule() will free it 967 * on failure 968 */ 969 if (tree) 970 audit_put_tree(tree); 971 return err; 972 } 973 } 974 if (tree) { 975 err = audit_add_tree_rule(&entry->rule); 976 if (err) { 977 mutex_unlock(&audit_filter_mutex); 978 return err; 979 } 980 } 981 982 entry->rule.prio = ~0ULL; 983 if (entry->rule.listnr == AUDIT_FILTER_EXIT) { 984 if (entry->rule.flags & AUDIT_FILTER_PREPEND) 985 entry->rule.prio = ++prio_high; 986 else 987 entry->rule.prio = --prio_low; 988 } 989 990 if (entry->rule.flags & AUDIT_FILTER_PREPEND) { 991 list_add(&entry->rule.list, 992 &audit_rules_list[entry->rule.listnr]); 993 list_add_rcu(&entry->list, list); 994 entry->rule.flags &= ~AUDIT_FILTER_PREPEND; 995 } else { 996 list_add_tail(&entry->rule.list, 997 &audit_rules_list[entry->rule.listnr]); 998 list_add_tail_rcu(&entry->list, list); 999 } 1000 #ifdef CONFIG_AUDITSYSCALL 1001 if (!dont_count) 1002 audit_n_rules++; 1003 1004 if (!audit_match_signal(entry)) 1005 audit_signals++; 1006 #endif 1007 mutex_unlock(&audit_filter_mutex); 1008 1009 return err; 1010 } 1011 1012 /* Remove an existing rule from filterlist. */ 1013 int audit_del_rule(struct audit_entry *entry) 1014 { 1015 struct audit_entry *e; 1016 struct audit_tree *tree = entry->rule.tree; 1017 struct list_head *list; 1018 int ret = 0; 1019 #ifdef CONFIG_AUDITSYSCALL 1020 int dont_count = 0; 1021 1022 /* If any of these, don't count towards total */ 1023 switch(entry->rule.listnr) { 1024 case AUDIT_FILTER_USER: 1025 case AUDIT_FILTER_EXCLUDE: 1026 case AUDIT_FILTER_FS: 1027 dont_count = 1; 1028 } 1029 #endif 1030 1031 mutex_lock(&audit_filter_mutex); 1032 e = audit_find_rule(entry, &list); 1033 if (!e) { 1034 ret = -ENOENT; 1035 goto out; 1036 } 1037 1038 if (e->rule.watch) 1039 audit_remove_watch_rule(&e->rule); 1040 1041 if (e->rule.tree) 1042 audit_remove_tree_rule(&e->rule); 1043 1044 if (e->rule.exe) 1045 audit_remove_mark_rule(&e->rule); 1046 1047 #ifdef CONFIG_AUDITSYSCALL 1048 if (!dont_count) 1049 audit_n_rules--; 1050 1051 if (!audit_match_signal(entry)) 1052 audit_signals--; 1053 #endif 1054 1055 list_del_rcu(&e->list); 1056 list_del(&e->rule.list); 1057 call_rcu(&e->rcu, audit_free_rule_rcu); 1058 1059 out: 1060 mutex_unlock(&audit_filter_mutex); 1061 1062 if (tree) 1063 audit_put_tree(tree); /* that's the temporary one */ 1064 1065 return ret; 1066 } 1067 1068 /* List rules using struct audit_rule_data. */ 1069 static void audit_list_rules(int seq, struct sk_buff_head *q) 1070 { 1071 struct sk_buff *skb; 1072 struct audit_krule *r; 1073 int i; 1074 1075 /* This is a blocking read, so use audit_filter_mutex instead of rcu 1076 * iterator to sync with list writers. */ 1077 for (i=0; i<AUDIT_NR_FILTERS; i++) { 1078 list_for_each_entry(r, &audit_rules_list[i], list) { 1079 struct audit_rule_data *data; 1080 1081 data = audit_krule_to_data(r); 1082 if (unlikely(!data)) 1083 break; 1084 skb = audit_make_reply(seq, AUDIT_LIST_RULES, 0, 1, 1085 data, 1086 sizeof(*data) + data->buflen); 1087 if (skb) 1088 skb_queue_tail(q, skb); 1089 kfree(data); 1090 } 1091 } 1092 skb = audit_make_reply(seq, AUDIT_LIST_RULES, 1, 1, NULL, 0); 1093 if (skb) 1094 skb_queue_tail(q, skb); 1095 } 1096 1097 /* Log rule additions and removals */ 1098 static void audit_log_rule_change(char *action, struct audit_krule *rule, int res) 1099 { 1100 struct audit_buffer *ab; 1101 1102 if (!audit_enabled) 1103 return; 1104 1105 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONFIG_CHANGE); 1106 if (!ab) 1107 return; 1108 audit_log_session_info(ab); 1109 audit_log_task_context(ab); 1110 audit_log_format(ab, " op=%s", action); 1111 audit_log_key(ab, rule->filterkey); 1112 audit_log_format(ab, " list=%d res=%d", rule->listnr, res); 1113 audit_log_end(ab); 1114 } 1115 1116 /** 1117 * audit_rule_change - apply all rules to the specified message type 1118 * @type: audit message type 1119 * @seq: netlink audit message sequence (serial) number 1120 * @data: payload data 1121 * @datasz: size of payload data 1122 */ 1123 int audit_rule_change(int type, int seq, void *data, size_t datasz) 1124 { 1125 int err = 0; 1126 struct audit_entry *entry; 1127 1128 switch (type) { 1129 case AUDIT_ADD_RULE: 1130 entry = audit_data_to_entry(data, datasz); 1131 if (IS_ERR(entry)) 1132 return PTR_ERR(entry); 1133 err = audit_add_rule(entry); 1134 audit_log_rule_change("add_rule", &entry->rule, !err); 1135 break; 1136 case AUDIT_DEL_RULE: 1137 entry = audit_data_to_entry(data, datasz); 1138 if (IS_ERR(entry)) 1139 return PTR_ERR(entry); 1140 err = audit_del_rule(entry); 1141 audit_log_rule_change("remove_rule", &entry->rule, !err); 1142 break; 1143 default: 1144 WARN_ON(1); 1145 return -EINVAL; 1146 } 1147 1148 if (err || type == AUDIT_DEL_RULE) { 1149 if (entry->rule.exe) 1150 audit_remove_mark(entry->rule.exe); 1151 audit_free_rule(entry); 1152 } 1153 1154 return err; 1155 } 1156 1157 /** 1158 * audit_list_rules_send - list the audit rules 1159 * @request_skb: skb of request we are replying to (used to target the reply) 1160 * @seq: netlink audit message sequence (serial) number 1161 */ 1162 int audit_list_rules_send(struct sk_buff *request_skb, int seq) 1163 { 1164 u32 portid = NETLINK_CB(request_skb).portid; 1165 struct net *net = sock_net(NETLINK_CB(request_skb).sk); 1166 struct task_struct *tsk; 1167 struct audit_netlink_list *dest; 1168 int err = 0; 1169 1170 /* We can't just spew out the rules here because we might fill 1171 * the available socket buffer space and deadlock waiting for 1172 * auditctl to read from it... which isn't ever going to 1173 * happen if we're actually running in the context of auditctl 1174 * trying to _send_ the stuff */ 1175 1176 dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL); 1177 if (!dest) 1178 return -ENOMEM; 1179 dest->net = get_net(net); 1180 dest->portid = portid; 1181 skb_queue_head_init(&dest->q); 1182 1183 mutex_lock(&audit_filter_mutex); 1184 audit_list_rules(seq, &dest->q); 1185 mutex_unlock(&audit_filter_mutex); 1186 1187 tsk = kthread_run(audit_send_list, dest, "audit_send_list"); 1188 if (IS_ERR(tsk)) { 1189 skb_queue_purge(&dest->q); 1190 kfree(dest); 1191 err = PTR_ERR(tsk); 1192 } 1193 1194 return err; 1195 } 1196 1197 int audit_comparator(u32 left, u32 op, u32 right) 1198 { 1199 switch (op) { 1200 case Audit_equal: 1201 return (left == right); 1202 case Audit_not_equal: 1203 return (left != right); 1204 case Audit_lt: 1205 return (left < right); 1206 case Audit_le: 1207 return (left <= right); 1208 case Audit_gt: 1209 return (left > right); 1210 case Audit_ge: 1211 return (left >= right); 1212 case Audit_bitmask: 1213 return (left & right); 1214 case Audit_bittest: 1215 return ((left & right) == right); 1216 default: 1217 return 0; 1218 } 1219 } 1220 1221 int audit_uid_comparator(kuid_t left, u32 op, kuid_t right) 1222 { 1223 switch (op) { 1224 case Audit_equal: 1225 return uid_eq(left, right); 1226 case Audit_not_equal: 1227 return !uid_eq(left, right); 1228 case Audit_lt: 1229 return uid_lt(left, right); 1230 case Audit_le: 1231 return uid_lte(left, right); 1232 case Audit_gt: 1233 return uid_gt(left, right); 1234 case Audit_ge: 1235 return uid_gte(left, right); 1236 case Audit_bitmask: 1237 case Audit_bittest: 1238 default: 1239 return 0; 1240 } 1241 } 1242 1243 int audit_gid_comparator(kgid_t left, u32 op, kgid_t right) 1244 { 1245 switch (op) { 1246 case Audit_equal: 1247 return gid_eq(left, right); 1248 case Audit_not_equal: 1249 return !gid_eq(left, right); 1250 case Audit_lt: 1251 return gid_lt(left, right); 1252 case Audit_le: 1253 return gid_lte(left, right); 1254 case Audit_gt: 1255 return gid_gt(left, right); 1256 case Audit_ge: 1257 return gid_gte(left, right); 1258 case Audit_bitmask: 1259 case Audit_bittest: 1260 default: 1261 return 0; 1262 } 1263 } 1264 1265 /** 1266 * parent_len - find the length of the parent portion of a pathname 1267 * @path: pathname of which to determine length 1268 */ 1269 int parent_len(const char *path) 1270 { 1271 int plen; 1272 const char *p; 1273 1274 plen = strlen(path); 1275 1276 if (plen == 0) 1277 return plen; 1278 1279 /* disregard trailing slashes */ 1280 p = path + plen - 1; 1281 while ((*p == '/') && (p > path)) 1282 p--; 1283 1284 /* walk backward until we find the next slash or hit beginning */ 1285 while ((*p != '/') && (p > path)) 1286 p--; 1287 1288 /* did we find a slash? Then increment to include it in path */ 1289 if (*p == '/') 1290 p++; 1291 1292 return p - path; 1293 } 1294 1295 /** 1296 * audit_compare_dname_path - compare given dentry name with last component in 1297 * given path. Return of 0 indicates a match. 1298 * @dname: dentry name that we're comparing 1299 * @path: full pathname that we're comparing 1300 * @parentlen: length of the parent if known. Passing in AUDIT_NAME_FULL 1301 * here indicates that we must compute this value. 1302 */ 1303 int audit_compare_dname_path(const struct qstr *dname, const char *path, int parentlen) 1304 { 1305 int dlen, pathlen; 1306 const char *p; 1307 1308 dlen = dname->len; 1309 pathlen = strlen(path); 1310 if (pathlen < dlen) 1311 return 1; 1312 1313 parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen; 1314 if (pathlen - parentlen != dlen) 1315 return 1; 1316 1317 p = path + parentlen; 1318 1319 return strncmp(p, dname->name, dlen); 1320 } 1321 1322 int audit_filter(int msgtype, unsigned int listtype) 1323 { 1324 struct audit_entry *e; 1325 int ret = 1; /* Audit by default */ 1326 1327 rcu_read_lock(); 1328 list_for_each_entry_rcu(e, &audit_filter_list[listtype], list) { 1329 int i, result = 0; 1330 1331 for (i = 0; i < e->rule.field_count; i++) { 1332 struct audit_field *f = &e->rule.fields[i]; 1333 pid_t pid; 1334 u32 sid; 1335 1336 switch (f->type) { 1337 case AUDIT_PID: 1338 pid = task_pid_nr(current); 1339 result = audit_comparator(pid, f->op, f->val); 1340 break; 1341 case AUDIT_UID: 1342 result = audit_uid_comparator(current_uid(), f->op, f->uid); 1343 break; 1344 case AUDIT_GID: 1345 result = audit_gid_comparator(current_gid(), f->op, f->gid); 1346 break; 1347 case AUDIT_LOGINUID: 1348 result = audit_uid_comparator(audit_get_loginuid(current), 1349 f->op, f->uid); 1350 break; 1351 case AUDIT_LOGINUID_SET: 1352 result = audit_comparator(audit_loginuid_set(current), 1353 f->op, f->val); 1354 break; 1355 case AUDIT_MSGTYPE: 1356 result = audit_comparator(msgtype, f->op, f->val); 1357 break; 1358 case AUDIT_SUBJ_USER: 1359 case AUDIT_SUBJ_ROLE: 1360 case AUDIT_SUBJ_TYPE: 1361 case AUDIT_SUBJ_SEN: 1362 case AUDIT_SUBJ_CLR: 1363 if (f->lsm_rule) { 1364 security_task_getsecid(current, &sid); 1365 result = security_audit_rule_match(sid, 1366 f->type, f->op, f->lsm_rule); 1367 } 1368 break; 1369 case AUDIT_EXE: 1370 result = audit_exe_compare(current, e->rule.exe); 1371 if (f->op == Audit_not_equal) 1372 result = !result; 1373 break; 1374 default: 1375 goto unlock_and_return; 1376 } 1377 if (result < 0) /* error */ 1378 goto unlock_and_return; 1379 if (!result) 1380 break; 1381 } 1382 if (result > 0) { 1383 if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_EXCLUDE) 1384 ret = 0; 1385 break; 1386 } 1387 } 1388 unlock_and_return: 1389 rcu_read_unlock(); 1390 return ret; 1391 } 1392 1393 static int update_lsm_rule(struct audit_krule *r) 1394 { 1395 struct audit_entry *entry = container_of(r, struct audit_entry, rule); 1396 struct audit_entry *nentry; 1397 int err = 0; 1398 1399 if (!security_audit_rule_known(r)) 1400 return 0; 1401 1402 nentry = audit_dupe_rule(r); 1403 if (entry->rule.exe) 1404 audit_remove_mark(entry->rule.exe); 1405 if (IS_ERR(nentry)) { 1406 /* save the first error encountered for the 1407 * return value */ 1408 err = PTR_ERR(nentry); 1409 audit_panic("error updating LSM filters"); 1410 if (r->watch) 1411 list_del(&r->rlist); 1412 list_del_rcu(&entry->list); 1413 list_del(&r->list); 1414 } else { 1415 if (r->watch || r->tree) 1416 list_replace_init(&r->rlist, &nentry->rule.rlist); 1417 list_replace_rcu(&entry->list, &nentry->list); 1418 list_replace(&r->list, &nentry->rule.list); 1419 } 1420 call_rcu(&entry->rcu, audit_free_rule_rcu); 1421 1422 return err; 1423 } 1424 1425 /* This function will re-initialize the lsm_rule field of all applicable rules. 1426 * It will traverse the filter lists serarching for rules that contain LSM 1427 * specific filter fields. When such a rule is found, it is copied, the 1428 * LSM field is re-initialized, and the old rule is replaced with the 1429 * updated rule. */ 1430 int audit_update_lsm_rules(void) 1431 { 1432 struct audit_krule *r, *n; 1433 int i, err = 0; 1434 1435 /* audit_filter_mutex synchronizes the writers */ 1436 mutex_lock(&audit_filter_mutex); 1437 1438 for (i = 0; i < AUDIT_NR_FILTERS; i++) { 1439 list_for_each_entry_safe(r, n, &audit_rules_list[i], list) { 1440 int res = update_lsm_rule(r); 1441 if (!err) 1442 err = res; 1443 } 1444 } 1445 mutex_unlock(&audit_filter_mutex); 1446 1447 return err; 1448 } 1449