1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* auditfilter.c -- filtering of audit events 3 * 4 * Copyright 2003-2004 Red Hat, Inc. 5 * Copyright 2005 Hewlett-Packard Development Company, L.P. 6 * Copyright 2005 IBM Corporation 7 */ 8 9 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 10 11 #include <linux/kernel.h> 12 #include <linux/audit.h> 13 #include <linux/kthread.h> 14 #include <linux/mutex.h> 15 #include <linux/fs.h> 16 #include <linux/namei.h> 17 #include <linux/netlink.h> 18 #include <linux/sched.h> 19 #include <linux/slab.h> 20 #include <linux/security.h> 21 #include <net/net_namespace.h> 22 #include <net/sock.h> 23 #include "audit.h" 24 25 /* 26 * Locking model: 27 * 28 * audit_filter_mutex: 29 * Synchronizes writes and blocking reads of audit's filterlist 30 * data. Rcu is used to traverse the filterlist and access 31 * contents of structs audit_entry, audit_watch and opaque 32 * LSM rules during filtering. If modified, these structures 33 * must be copied and replace their counterparts in the filterlist. 34 * An audit_parent struct is not accessed during filtering, so may 35 * be written directly provided audit_filter_mutex is held. 36 */ 37 38 /* Audit filter lists, defined in <linux/audit.h> */ 39 struct list_head audit_filter_list[AUDIT_NR_FILTERS] = { 40 LIST_HEAD_INIT(audit_filter_list[0]), 41 LIST_HEAD_INIT(audit_filter_list[1]), 42 LIST_HEAD_INIT(audit_filter_list[2]), 43 LIST_HEAD_INIT(audit_filter_list[3]), 44 LIST_HEAD_INIT(audit_filter_list[4]), 45 LIST_HEAD_INIT(audit_filter_list[5]), 46 LIST_HEAD_INIT(audit_filter_list[6]), 47 LIST_HEAD_INIT(audit_filter_list[7]), 48 #if AUDIT_NR_FILTERS != 8 49 #error Fix audit_filter_list initialiser 50 #endif 51 }; 52 static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = { 53 LIST_HEAD_INIT(audit_rules_list[0]), 54 LIST_HEAD_INIT(audit_rules_list[1]), 55 LIST_HEAD_INIT(audit_rules_list[2]), 56 LIST_HEAD_INIT(audit_rules_list[3]), 57 LIST_HEAD_INIT(audit_rules_list[4]), 58 LIST_HEAD_INIT(audit_rules_list[5]), 59 LIST_HEAD_INIT(audit_rules_list[6]), 60 LIST_HEAD_INIT(audit_rules_list[7]), 61 }; 62 63 DEFINE_MUTEX(audit_filter_mutex); 64 65 static void audit_free_lsm_field(struct audit_field *f) 66 { 67 switch (f->type) { 68 case AUDIT_SUBJ_USER: 69 case AUDIT_SUBJ_ROLE: 70 case AUDIT_SUBJ_TYPE: 71 case AUDIT_SUBJ_SEN: 72 case AUDIT_SUBJ_CLR: 73 case AUDIT_OBJ_USER: 74 case AUDIT_OBJ_ROLE: 75 case AUDIT_OBJ_TYPE: 76 case AUDIT_OBJ_LEV_LOW: 77 case AUDIT_OBJ_LEV_HIGH: 78 kfree(f->lsm_str); 79 security_audit_rule_free(f->lsm_rule); 80 } 81 } 82 83 static inline void audit_free_rule(struct audit_entry *e) 84 { 85 int i; 86 struct audit_krule *erule = &e->rule; 87 88 /* some rules don't have associated watches */ 89 if (erule->watch) 90 audit_put_watch(erule->watch); 91 if (erule->fields) 92 for (i = 0; i < erule->field_count; i++) 93 audit_free_lsm_field(&erule->fields[i]); 94 kfree(erule->fields); 95 kfree(erule->filterkey); 96 kfree(e); 97 } 98 99 void audit_free_rule_rcu(struct rcu_head *head) 100 { 101 struct audit_entry *e = container_of(head, struct audit_entry, rcu); 102 audit_free_rule(e); 103 } 104 105 /* Initialize an audit filterlist entry. */ 106 static inline struct audit_entry *audit_init_entry(u32 field_count) 107 { 108 struct audit_entry *entry; 109 struct audit_field *fields; 110 111 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 112 if (unlikely(!entry)) 113 return NULL; 114 115 fields = kcalloc(field_count, sizeof(*fields), GFP_KERNEL); 116 if (unlikely(!fields)) { 117 kfree(entry); 118 return NULL; 119 } 120 entry->rule.fields = fields; 121 122 return entry; 123 } 124 125 /* Unpack a filter field's string representation from user-space 126 * buffer. */ 127 char *audit_unpack_string(void **bufp, size_t *remain, size_t len) 128 { 129 char *str; 130 131 if (!*bufp || (len == 0) || (len > *remain)) 132 return ERR_PTR(-EINVAL); 133 134 /* Of the currently implemented string fields, PATH_MAX 135 * defines the longest valid length. 136 */ 137 if (len > PATH_MAX) 138 return ERR_PTR(-ENAMETOOLONG); 139 140 str = kmalloc(len + 1, GFP_KERNEL); 141 if (unlikely(!str)) 142 return ERR_PTR(-ENOMEM); 143 144 memcpy(str, *bufp, len); 145 str[len] = 0; 146 *bufp += len; 147 *remain -= len; 148 149 return str; 150 } 151 152 /* Translate an inode field to kernel representation. */ 153 static inline int audit_to_inode(struct audit_krule *krule, 154 struct audit_field *f) 155 { 156 if ((krule->listnr != AUDIT_FILTER_EXIT && 157 krule->listnr != AUDIT_FILTER_URING_EXIT) || 158 krule->inode_f || krule->watch || krule->tree || 159 (f->op != Audit_equal && f->op != Audit_not_equal)) 160 return -EINVAL; 161 162 krule->inode_f = f; 163 return 0; 164 } 165 166 static __u32 *classes[AUDIT_SYSCALL_CLASSES]; 167 168 int __init audit_register_class(int class, unsigned *list) 169 { 170 __u32 *p = kcalloc(AUDIT_BITMASK_SIZE, sizeof(__u32), GFP_KERNEL); 171 if (!p) 172 return -ENOMEM; 173 while (*list != ~0U) { 174 unsigned n = *list++; 175 if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) { 176 kfree(p); 177 return -EINVAL; 178 } 179 p[AUDIT_WORD(n)] |= AUDIT_BIT(n); 180 } 181 if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) { 182 kfree(p); 183 return -EINVAL; 184 } 185 classes[class] = p; 186 return 0; 187 } 188 189 int audit_match_class(int class, unsigned syscall) 190 { 191 if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32)) 192 return 0; 193 if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class])) 194 return 0; 195 return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall); 196 } 197 198 #ifdef CONFIG_AUDITSYSCALL 199 static inline int audit_match_class_bits(int class, u32 *mask) 200 { 201 int i; 202 203 if (classes[class]) { 204 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 205 if (mask[i] & classes[class][i]) 206 return 0; 207 } 208 return 1; 209 } 210 211 static int audit_match_signal(struct audit_entry *entry) 212 { 213 struct audit_field *arch = entry->rule.arch_f; 214 215 if (!arch) { 216 /* When arch is unspecified, we must check both masks on biarch 217 * as syscall number alone is ambiguous. */ 218 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL, 219 entry->rule.mask) && 220 audit_match_class_bits(AUDIT_CLASS_SIGNAL_32, 221 entry->rule.mask)); 222 } 223 224 switch (audit_classify_arch(arch->val)) { 225 case 0: /* native */ 226 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL, 227 entry->rule.mask)); 228 case 1: /* 32bit on biarch */ 229 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32, 230 entry->rule.mask)); 231 default: 232 return 1; 233 } 234 } 235 #endif 236 237 /* Common user-space to kernel rule translation. */ 238 static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule) 239 { 240 unsigned listnr; 241 struct audit_entry *entry; 242 int i, err; 243 244 err = -EINVAL; 245 listnr = rule->flags & ~AUDIT_FILTER_PREPEND; 246 switch (listnr) { 247 default: 248 goto exit_err; 249 #ifdef CONFIG_AUDITSYSCALL 250 case AUDIT_FILTER_ENTRY: 251 pr_err("AUDIT_FILTER_ENTRY is deprecated\n"); 252 goto exit_err; 253 case AUDIT_FILTER_EXIT: 254 case AUDIT_FILTER_URING_EXIT: 255 case AUDIT_FILTER_TASK: 256 #endif 257 case AUDIT_FILTER_USER: 258 case AUDIT_FILTER_EXCLUDE: 259 case AUDIT_FILTER_FS: 260 ; 261 } 262 if (unlikely(rule->action == AUDIT_POSSIBLE)) { 263 pr_err("AUDIT_POSSIBLE is deprecated\n"); 264 goto exit_err; 265 } 266 if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS) 267 goto exit_err; 268 if (rule->field_count > AUDIT_MAX_FIELDS) 269 goto exit_err; 270 271 err = -ENOMEM; 272 entry = audit_init_entry(rule->field_count); 273 if (!entry) 274 goto exit_err; 275 276 entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND; 277 entry->rule.listnr = listnr; 278 entry->rule.action = rule->action; 279 entry->rule.field_count = rule->field_count; 280 281 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 282 entry->rule.mask[i] = rule->mask[i]; 283 284 for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) { 285 int bit = AUDIT_BITMASK_SIZE * 32 - i - 1; 286 __u32 *p = &entry->rule.mask[AUDIT_WORD(bit)]; 287 __u32 *class; 288 289 if (!(*p & AUDIT_BIT(bit))) 290 continue; 291 *p &= ~AUDIT_BIT(bit); 292 class = classes[i]; 293 if (class) { 294 int j; 295 for (j = 0; j < AUDIT_BITMASK_SIZE; j++) 296 entry->rule.mask[j] |= class[j]; 297 } 298 } 299 300 return entry; 301 302 exit_err: 303 return ERR_PTR(err); 304 } 305 306 static u32 audit_ops[] = 307 { 308 [Audit_equal] = AUDIT_EQUAL, 309 [Audit_not_equal] = AUDIT_NOT_EQUAL, 310 [Audit_bitmask] = AUDIT_BIT_MASK, 311 [Audit_bittest] = AUDIT_BIT_TEST, 312 [Audit_lt] = AUDIT_LESS_THAN, 313 [Audit_gt] = AUDIT_GREATER_THAN, 314 [Audit_le] = AUDIT_LESS_THAN_OR_EQUAL, 315 [Audit_ge] = AUDIT_GREATER_THAN_OR_EQUAL, 316 }; 317 318 static u32 audit_to_op(u32 op) 319 { 320 u32 n; 321 for (n = Audit_equal; n < Audit_bad && audit_ops[n] != op; n++) 322 ; 323 return n; 324 } 325 326 /* check if an audit field is valid */ 327 static int audit_field_valid(struct audit_entry *entry, struct audit_field *f) 328 { 329 switch (f->type) { 330 case AUDIT_MSGTYPE: 331 if (entry->rule.listnr != AUDIT_FILTER_EXCLUDE && 332 entry->rule.listnr != AUDIT_FILTER_USER) 333 return -EINVAL; 334 break; 335 case AUDIT_FSTYPE: 336 if (entry->rule.listnr != AUDIT_FILTER_FS) 337 return -EINVAL; 338 break; 339 case AUDIT_PERM: 340 if (entry->rule.listnr == AUDIT_FILTER_URING_EXIT) 341 return -EINVAL; 342 break; 343 } 344 345 switch (entry->rule.listnr) { 346 case AUDIT_FILTER_FS: 347 switch (f->type) { 348 case AUDIT_FSTYPE: 349 case AUDIT_FILTERKEY: 350 break; 351 default: 352 return -EINVAL; 353 } 354 } 355 356 /* Check for valid field type and op */ 357 switch (f->type) { 358 case AUDIT_ARG0: 359 case AUDIT_ARG1: 360 case AUDIT_ARG2: 361 case AUDIT_ARG3: 362 case AUDIT_PERS: /* <uapi/linux/personality.h> */ 363 case AUDIT_DEVMINOR: 364 /* all ops are valid */ 365 break; 366 case AUDIT_UID: 367 case AUDIT_EUID: 368 case AUDIT_SUID: 369 case AUDIT_FSUID: 370 case AUDIT_LOGINUID: 371 case AUDIT_OBJ_UID: 372 case AUDIT_GID: 373 case AUDIT_EGID: 374 case AUDIT_SGID: 375 case AUDIT_FSGID: 376 case AUDIT_OBJ_GID: 377 case AUDIT_PID: 378 case AUDIT_MSGTYPE: 379 case AUDIT_PPID: 380 case AUDIT_DEVMAJOR: 381 case AUDIT_EXIT: 382 case AUDIT_SUCCESS: 383 case AUDIT_INODE: 384 case AUDIT_SESSIONID: 385 case AUDIT_SUBJ_SEN: 386 case AUDIT_SUBJ_CLR: 387 case AUDIT_OBJ_LEV_LOW: 388 case AUDIT_OBJ_LEV_HIGH: 389 case AUDIT_SADDR_FAM: 390 /* bit ops are only useful on syscall args */ 391 if (f->op == Audit_bitmask || f->op == Audit_bittest) 392 return -EINVAL; 393 break; 394 case AUDIT_SUBJ_USER: 395 case AUDIT_SUBJ_ROLE: 396 case AUDIT_SUBJ_TYPE: 397 case AUDIT_OBJ_USER: 398 case AUDIT_OBJ_ROLE: 399 case AUDIT_OBJ_TYPE: 400 case AUDIT_WATCH: 401 case AUDIT_DIR: 402 case AUDIT_FILTERKEY: 403 case AUDIT_LOGINUID_SET: 404 case AUDIT_ARCH: 405 case AUDIT_FSTYPE: 406 case AUDIT_PERM: 407 case AUDIT_FILETYPE: 408 case AUDIT_FIELD_COMPARE: 409 case AUDIT_EXE: 410 /* only equal and not equal valid ops */ 411 if (f->op != Audit_not_equal && f->op != Audit_equal) 412 return -EINVAL; 413 break; 414 default: 415 /* field not recognized */ 416 return -EINVAL; 417 } 418 419 /* Check for select valid field values */ 420 switch (f->type) { 421 case AUDIT_LOGINUID_SET: 422 if ((f->val != 0) && (f->val != 1)) 423 return -EINVAL; 424 break; 425 case AUDIT_PERM: 426 if (f->val & ~15) 427 return -EINVAL; 428 break; 429 case AUDIT_FILETYPE: 430 if (f->val & ~S_IFMT) 431 return -EINVAL; 432 break; 433 case AUDIT_FIELD_COMPARE: 434 if (f->val > AUDIT_MAX_FIELD_COMPARE) 435 return -EINVAL; 436 break; 437 case AUDIT_SADDR_FAM: 438 if (f->val >= AF_MAX) 439 return -EINVAL; 440 break; 441 default: 442 break; 443 } 444 445 return 0; 446 } 447 448 /* Translate struct audit_rule_data to kernel's rule representation. */ 449 static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, 450 size_t datasz) 451 { 452 int err = 0; 453 struct audit_entry *entry; 454 void *bufp; 455 size_t remain = datasz - sizeof(struct audit_rule_data); 456 int i; 457 char *str; 458 struct audit_fsnotify_mark *audit_mark; 459 460 entry = audit_to_entry_common(data); 461 if (IS_ERR(entry)) 462 goto exit_nofree; 463 464 bufp = data->buf; 465 for (i = 0; i < data->field_count; i++) { 466 struct audit_field *f = &entry->rule.fields[i]; 467 u32 f_val; 468 469 err = -EINVAL; 470 471 f->op = audit_to_op(data->fieldflags[i]); 472 if (f->op == Audit_bad) 473 goto exit_free; 474 475 f->type = data->fields[i]; 476 f_val = data->values[i]; 477 478 /* Support legacy tests for a valid loginuid */ 479 if ((f->type == AUDIT_LOGINUID) && (f_val == AUDIT_UID_UNSET)) { 480 f->type = AUDIT_LOGINUID_SET; 481 f_val = 0; 482 entry->rule.pflags |= AUDIT_LOGINUID_LEGACY; 483 } 484 485 err = audit_field_valid(entry, f); 486 if (err) 487 goto exit_free; 488 489 err = -EINVAL; 490 switch (f->type) { 491 case AUDIT_LOGINUID: 492 case AUDIT_UID: 493 case AUDIT_EUID: 494 case AUDIT_SUID: 495 case AUDIT_FSUID: 496 case AUDIT_OBJ_UID: 497 f->uid = make_kuid(current_user_ns(), f_val); 498 if (!uid_valid(f->uid)) 499 goto exit_free; 500 break; 501 case AUDIT_GID: 502 case AUDIT_EGID: 503 case AUDIT_SGID: 504 case AUDIT_FSGID: 505 case AUDIT_OBJ_GID: 506 f->gid = make_kgid(current_user_ns(), f_val); 507 if (!gid_valid(f->gid)) 508 goto exit_free; 509 break; 510 case AUDIT_ARCH: 511 f->val = f_val; 512 entry->rule.arch_f = f; 513 break; 514 case AUDIT_SUBJ_USER: 515 case AUDIT_SUBJ_ROLE: 516 case AUDIT_SUBJ_TYPE: 517 case AUDIT_SUBJ_SEN: 518 case AUDIT_SUBJ_CLR: 519 case AUDIT_OBJ_USER: 520 case AUDIT_OBJ_ROLE: 521 case AUDIT_OBJ_TYPE: 522 case AUDIT_OBJ_LEV_LOW: 523 case AUDIT_OBJ_LEV_HIGH: 524 str = audit_unpack_string(&bufp, &remain, f_val); 525 if (IS_ERR(str)) { 526 err = PTR_ERR(str); 527 goto exit_free; 528 } 529 entry->rule.buflen += f_val; 530 f->lsm_str = str; 531 err = security_audit_rule_init(f->type, f->op, str, 532 (void **)&f->lsm_rule); 533 /* Keep currently invalid fields around in case they 534 * become valid after a policy reload. */ 535 if (err == -EINVAL) { 536 pr_warn("audit rule for LSM \'%s\' is invalid\n", 537 str); 538 err = 0; 539 } else if (err) 540 goto exit_free; 541 break; 542 case AUDIT_WATCH: 543 str = audit_unpack_string(&bufp, &remain, f_val); 544 if (IS_ERR(str)) { 545 err = PTR_ERR(str); 546 goto exit_free; 547 } 548 err = audit_to_watch(&entry->rule, str, f_val, f->op); 549 if (err) { 550 kfree(str); 551 goto exit_free; 552 } 553 entry->rule.buflen += f_val; 554 break; 555 case AUDIT_DIR: 556 str = audit_unpack_string(&bufp, &remain, f_val); 557 if (IS_ERR(str)) { 558 err = PTR_ERR(str); 559 goto exit_free; 560 } 561 err = audit_make_tree(&entry->rule, str, f->op); 562 kfree(str); 563 if (err) 564 goto exit_free; 565 entry->rule.buflen += f_val; 566 break; 567 case AUDIT_INODE: 568 f->val = f_val; 569 err = audit_to_inode(&entry->rule, f); 570 if (err) 571 goto exit_free; 572 break; 573 case AUDIT_FILTERKEY: 574 if (entry->rule.filterkey || f_val > AUDIT_MAX_KEY_LEN) 575 goto exit_free; 576 str = audit_unpack_string(&bufp, &remain, f_val); 577 if (IS_ERR(str)) { 578 err = PTR_ERR(str); 579 goto exit_free; 580 } 581 entry->rule.buflen += f_val; 582 entry->rule.filterkey = str; 583 break; 584 case AUDIT_EXE: 585 if (entry->rule.exe || f_val > PATH_MAX) 586 goto exit_free; 587 str = audit_unpack_string(&bufp, &remain, f_val); 588 if (IS_ERR(str)) { 589 err = PTR_ERR(str); 590 goto exit_free; 591 } 592 audit_mark = audit_alloc_mark(&entry->rule, str, f_val); 593 if (IS_ERR(audit_mark)) { 594 kfree(str); 595 err = PTR_ERR(audit_mark); 596 goto exit_free; 597 } 598 entry->rule.buflen += f_val; 599 entry->rule.exe = audit_mark; 600 break; 601 default: 602 f->val = f_val; 603 break; 604 } 605 } 606 607 if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal) 608 entry->rule.inode_f = NULL; 609 610 exit_nofree: 611 return entry; 612 613 exit_free: 614 if (entry->rule.tree) 615 audit_put_tree(entry->rule.tree); /* that's the temporary one */ 616 if (entry->rule.exe) 617 audit_remove_mark(entry->rule.exe); /* that's the template one */ 618 audit_free_rule(entry); 619 return ERR_PTR(err); 620 } 621 622 /* Pack a filter field's string representation into data block. */ 623 static inline size_t audit_pack_string(void **bufp, const char *str) 624 { 625 size_t len = strlen(str); 626 627 memcpy(*bufp, str, len); 628 *bufp += len; 629 630 return len; 631 } 632 633 /* Translate kernel rule representation to struct audit_rule_data. */ 634 static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) 635 { 636 struct audit_rule_data *data; 637 void *bufp; 638 int i; 639 640 data = kmalloc(struct_size(data, buf, krule->buflen), GFP_KERNEL); 641 if (unlikely(!data)) 642 return NULL; 643 memset(data, 0, sizeof(*data)); 644 645 data->flags = krule->flags | krule->listnr; 646 data->action = krule->action; 647 data->field_count = krule->field_count; 648 bufp = data->buf; 649 for (i = 0; i < data->field_count; i++) { 650 struct audit_field *f = &krule->fields[i]; 651 652 data->fields[i] = f->type; 653 data->fieldflags[i] = audit_ops[f->op]; 654 switch (f->type) { 655 case AUDIT_SUBJ_USER: 656 case AUDIT_SUBJ_ROLE: 657 case AUDIT_SUBJ_TYPE: 658 case AUDIT_SUBJ_SEN: 659 case AUDIT_SUBJ_CLR: 660 case AUDIT_OBJ_USER: 661 case AUDIT_OBJ_ROLE: 662 case AUDIT_OBJ_TYPE: 663 case AUDIT_OBJ_LEV_LOW: 664 case AUDIT_OBJ_LEV_HIGH: 665 data->buflen += data->values[i] = 666 audit_pack_string(&bufp, f->lsm_str); 667 break; 668 case AUDIT_WATCH: 669 data->buflen += data->values[i] = 670 audit_pack_string(&bufp, 671 audit_watch_path(krule->watch)); 672 break; 673 case AUDIT_DIR: 674 data->buflen += data->values[i] = 675 audit_pack_string(&bufp, 676 audit_tree_path(krule->tree)); 677 break; 678 case AUDIT_FILTERKEY: 679 data->buflen += data->values[i] = 680 audit_pack_string(&bufp, krule->filterkey); 681 break; 682 case AUDIT_EXE: 683 data->buflen += data->values[i] = 684 audit_pack_string(&bufp, audit_mark_path(krule->exe)); 685 break; 686 case AUDIT_LOGINUID_SET: 687 if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) { 688 data->fields[i] = AUDIT_LOGINUID; 689 data->values[i] = AUDIT_UID_UNSET; 690 break; 691 } 692 fallthrough; /* if set */ 693 default: 694 data->values[i] = f->val; 695 } 696 } 697 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 698 data->mask[i] = krule->mask[i]; 699 700 return data; 701 } 702 703 /* Compare two rules in kernel format. Considered success if rules 704 * don't match. */ 705 static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b) 706 { 707 int i; 708 709 if (a->flags != b->flags || 710 a->pflags != b->pflags || 711 a->listnr != b->listnr || 712 a->action != b->action || 713 a->field_count != b->field_count) 714 return 1; 715 716 for (i = 0; i < a->field_count; i++) { 717 if (a->fields[i].type != b->fields[i].type || 718 a->fields[i].op != b->fields[i].op) 719 return 1; 720 721 switch (a->fields[i].type) { 722 case AUDIT_SUBJ_USER: 723 case AUDIT_SUBJ_ROLE: 724 case AUDIT_SUBJ_TYPE: 725 case AUDIT_SUBJ_SEN: 726 case AUDIT_SUBJ_CLR: 727 case AUDIT_OBJ_USER: 728 case AUDIT_OBJ_ROLE: 729 case AUDIT_OBJ_TYPE: 730 case AUDIT_OBJ_LEV_LOW: 731 case AUDIT_OBJ_LEV_HIGH: 732 if (strcmp(a->fields[i].lsm_str, b->fields[i].lsm_str)) 733 return 1; 734 break; 735 case AUDIT_WATCH: 736 if (strcmp(audit_watch_path(a->watch), 737 audit_watch_path(b->watch))) 738 return 1; 739 break; 740 case AUDIT_DIR: 741 if (strcmp(audit_tree_path(a->tree), 742 audit_tree_path(b->tree))) 743 return 1; 744 break; 745 case AUDIT_FILTERKEY: 746 /* both filterkeys exist based on above type compare */ 747 if (strcmp(a->filterkey, b->filterkey)) 748 return 1; 749 break; 750 case AUDIT_EXE: 751 /* both paths exist based on above type compare */ 752 if (strcmp(audit_mark_path(a->exe), 753 audit_mark_path(b->exe))) 754 return 1; 755 break; 756 case AUDIT_UID: 757 case AUDIT_EUID: 758 case AUDIT_SUID: 759 case AUDIT_FSUID: 760 case AUDIT_LOGINUID: 761 case AUDIT_OBJ_UID: 762 if (!uid_eq(a->fields[i].uid, b->fields[i].uid)) 763 return 1; 764 break; 765 case AUDIT_GID: 766 case AUDIT_EGID: 767 case AUDIT_SGID: 768 case AUDIT_FSGID: 769 case AUDIT_OBJ_GID: 770 if (!gid_eq(a->fields[i].gid, b->fields[i].gid)) 771 return 1; 772 break; 773 default: 774 if (a->fields[i].val != b->fields[i].val) 775 return 1; 776 } 777 } 778 779 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 780 if (a->mask[i] != b->mask[i]) 781 return 1; 782 783 return 0; 784 } 785 786 /* Duplicate LSM field information. The lsm_rule is opaque, so must be 787 * re-initialized. */ 788 static inline int audit_dupe_lsm_field(struct audit_field *df, 789 struct audit_field *sf) 790 { 791 int ret; 792 char *lsm_str; 793 794 /* our own copy of lsm_str */ 795 lsm_str = kstrdup(sf->lsm_str, GFP_KERNEL); 796 if (unlikely(!lsm_str)) 797 return -ENOMEM; 798 df->lsm_str = lsm_str; 799 800 /* our own (refreshed) copy of lsm_rule */ 801 ret = security_audit_rule_init(df->type, df->op, df->lsm_str, 802 (void **)&df->lsm_rule); 803 /* Keep currently invalid fields around in case they 804 * become valid after a policy reload. */ 805 if (ret == -EINVAL) { 806 pr_warn("audit rule for LSM \'%s\' is invalid\n", 807 df->lsm_str); 808 ret = 0; 809 } 810 811 return ret; 812 } 813 814 /* Duplicate an audit rule. This will be a deep copy with the exception 815 * of the watch - that pointer is carried over. The LSM specific fields 816 * will be updated in the copy. The point is to be able to replace the old 817 * rule with the new rule in the filterlist, then free the old rule. 818 * The rlist element is undefined; list manipulations are handled apart from 819 * the initial copy. */ 820 struct audit_entry *audit_dupe_rule(struct audit_krule *old) 821 { 822 u32 fcount = old->field_count; 823 struct audit_entry *entry; 824 struct audit_krule *new; 825 char *fk; 826 int i, err = 0; 827 828 entry = audit_init_entry(fcount); 829 if (unlikely(!entry)) 830 return ERR_PTR(-ENOMEM); 831 832 new = &entry->rule; 833 new->flags = old->flags; 834 new->pflags = old->pflags; 835 new->listnr = old->listnr; 836 new->action = old->action; 837 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 838 new->mask[i] = old->mask[i]; 839 new->prio = old->prio; 840 new->buflen = old->buflen; 841 new->inode_f = old->inode_f; 842 new->field_count = old->field_count; 843 844 /* 845 * note that we are OK with not refcounting here; audit_match_tree() 846 * never dereferences tree and we can't get false positives there 847 * since we'd have to have rule gone from the list *and* removed 848 * before the chunks found by lookup had been allocated, i.e. before 849 * the beginning of list scan. 850 */ 851 new->tree = old->tree; 852 memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount); 853 854 /* deep copy this information, updating the lsm_rule fields, because 855 * the originals will all be freed when the old rule is freed. */ 856 for (i = 0; i < fcount; i++) { 857 switch (new->fields[i].type) { 858 case AUDIT_SUBJ_USER: 859 case AUDIT_SUBJ_ROLE: 860 case AUDIT_SUBJ_TYPE: 861 case AUDIT_SUBJ_SEN: 862 case AUDIT_SUBJ_CLR: 863 case AUDIT_OBJ_USER: 864 case AUDIT_OBJ_ROLE: 865 case AUDIT_OBJ_TYPE: 866 case AUDIT_OBJ_LEV_LOW: 867 case AUDIT_OBJ_LEV_HIGH: 868 err = audit_dupe_lsm_field(&new->fields[i], 869 &old->fields[i]); 870 break; 871 case AUDIT_FILTERKEY: 872 fk = kstrdup(old->filterkey, GFP_KERNEL); 873 if (unlikely(!fk)) 874 err = -ENOMEM; 875 else 876 new->filterkey = fk; 877 break; 878 case AUDIT_EXE: 879 err = audit_dupe_exe(new, old); 880 break; 881 } 882 if (err) { 883 if (new->exe) 884 audit_remove_mark(new->exe); 885 audit_free_rule(entry); 886 return ERR_PTR(err); 887 } 888 } 889 890 if (old->watch) { 891 audit_get_watch(old->watch); 892 new->watch = old->watch; 893 } 894 895 return entry; 896 } 897 898 /* Find an existing audit rule. 899 * Caller must hold audit_filter_mutex to prevent stale rule data. */ 900 static struct audit_entry *audit_find_rule(struct audit_entry *entry, 901 struct list_head **p) 902 { 903 struct audit_entry *e, *found = NULL; 904 struct list_head *list; 905 int h; 906 907 if (entry->rule.inode_f) { 908 h = audit_hash_ino(entry->rule.inode_f->val); 909 *p = list = &audit_inode_hash[h]; 910 } else if (entry->rule.watch) { 911 /* we don't know the inode number, so must walk entire hash */ 912 for (h = 0; h < AUDIT_INODE_BUCKETS; h++) { 913 list = &audit_inode_hash[h]; 914 list_for_each_entry(e, list, list) 915 if (!audit_compare_rule(&entry->rule, &e->rule)) { 916 found = e; 917 goto out; 918 } 919 } 920 goto out; 921 } else { 922 *p = list = &audit_filter_list[entry->rule.listnr]; 923 } 924 925 list_for_each_entry(e, list, list) 926 if (!audit_compare_rule(&entry->rule, &e->rule)) { 927 found = e; 928 goto out; 929 } 930 931 out: 932 return found; 933 } 934 935 static u64 prio_low = ~0ULL/2; 936 static u64 prio_high = ~0ULL/2 - 1; 937 938 /* Add rule to given filterlist if not a duplicate. */ 939 static inline int audit_add_rule(struct audit_entry *entry) 940 { 941 struct audit_entry *e; 942 struct audit_watch *watch = entry->rule.watch; 943 struct audit_tree *tree = entry->rule.tree; 944 struct list_head *list; 945 int err = 0; 946 #ifdef CONFIG_AUDITSYSCALL 947 int dont_count = 0; 948 949 /* If any of these, don't count towards total */ 950 switch (entry->rule.listnr) { 951 case AUDIT_FILTER_USER: 952 case AUDIT_FILTER_EXCLUDE: 953 case AUDIT_FILTER_FS: 954 dont_count = 1; 955 } 956 #endif 957 958 mutex_lock(&audit_filter_mutex); 959 e = audit_find_rule(entry, &list); 960 if (e) { 961 mutex_unlock(&audit_filter_mutex); 962 err = -EEXIST; 963 /* normally audit_add_tree_rule() will free it on failure */ 964 if (tree) 965 audit_put_tree(tree); 966 return err; 967 } 968 969 if (watch) { 970 /* audit_filter_mutex is dropped and re-taken during this call */ 971 err = audit_add_watch(&entry->rule, &list); 972 if (err) { 973 mutex_unlock(&audit_filter_mutex); 974 /* 975 * normally audit_add_tree_rule() will free it 976 * on failure 977 */ 978 if (tree) 979 audit_put_tree(tree); 980 return err; 981 } 982 } 983 if (tree) { 984 err = audit_add_tree_rule(&entry->rule); 985 if (err) { 986 mutex_unlock(&audit_filter_mutex); 987 return err; 988 } 989 } 990 991 entry->rule.prio = ~0ULL; 992 if (entry->rule.listnr == AUDIT_FILTER_EXIT || 993 entry->rule.listnr == AUDIT_FILTER_URING_EXIT) { 994 if (entry->rule.flags & AUDIT_FILTER_PREPEND) 995 entry->rule.prio = ++prio_high; 996 else 997 entry->rule.prio = --prio_low; 998 } 999 1000 if (entry->rule.flags & AUDIT_FILTER_PREPEND) { 1001 list_add(&entry->rule.list, 1002 &audit_rules_list[entry->rule.listnr]); 1003 list_add_rcu(&entry->list, list); 1004 entry->rule.flags &= ~AUDIT_FILTER_PREPEND; 1005 } else { 1006 list_add_tail(&entry->rule.list, 1007 &audit_rules_list[entry->rule.listnr]); 1008 list_add_tail_rcu(&entry->list, list); 1009 } 1010 #ifdef CONFIG_AUDITSYSCALL 1011 if (!dont_count) 1012 audit_n_rules++; 1013 1014 if (!audit_match_signal(entry)) 1015 audit_signals++; 1016 #endif 1017 mutex_unlock(&audit_filter_mutex); 1018 1019 return err; 1020 } 1021 1022 /* Remove an existing rule from filterlist. */ 1023 int audit_del_rule(struct audit_entry *entry) 1024 { 1025 struct audit_entry *e; 1026 struct audit_tree *tree = entry->rule.tree; 1027 struct list_head *list; 1028 int ret = 0; 1029 #ifdef CONFIG_AUDITSYSCALL 1030 int dont_count = 0; 1031 1032 /* If any of these, don't count towards total */ 1033 switch (entry->rule.listnr) { 1034 case AUDIT_FILTER_USER: 1035 case AUDIT_FILTER_EXCLUDE: 1036 case AUDIT_FILTER_FS: 1037 dont_count = 1; 1038 } 1039 #endif 1040 1041 mutex_lock(&audit_filter_mutex); 1042 e = audit_find_rule(entry, &list); 1043 if (!e) { 1044 ret = -ENOENT; 1045 goto out; 1046 } 1047 1048 if (e->rule.watch) 1049 audit_remove_watch_rule(&e->rule); 1050 1051 if (e->rule.tree) 1052 audit_remove_tree_rule(&e->rule); 1053 1054 if (e->rule.exe) 1055 audit_remove_mark_rule(&e->rule); 1056 1057 #ifdef CONFIG_AUDITSYSCALL 1058 if (!dont_count) 1059 audit_n_rules--; 1060 1061 if (!audit_match_signal(entry)) 1062 audit_signals--; 1063 #endif 1064 1065 list_del_rcu(&e->list); 1066 list_del(&e->rule.list); 1067 call_rcu(&e->rcu, audit_free_rule_rcu); 1068 1069 out: 1070 mutex_unlock(&audit_filter_mutex); 1071 1072 if (tree) 1073 audit_put_tree(tree); /* that's the temporary one */ 1074 1075 return ret; 1076 } 1077 1078 /* List rules using struct audit_rule_data. */ 1079 static void audit_list_rules(int seq, struct sk_buff_head *q) 1080 { 1081 struct sk_buff *skb; 1082 struct audit_krule *r; 1083 int i; 1084 1085 /* This is a blocking read, so use audit_filter_mutex instead of rcu 1086 * iterator to sync with list writers. */ 1087 for (i = 0; i < AUDIT_NR_FILTERS; i++) { 1088 list_for_each_entry(r, &audit_rules_list[i], list) { 1089 struct audit_rule_data *data; 1090 1091 data = audit_krule_to_data(r); 1092 if (unlikely(!data)) 1093 break; 1094 skb = audit_make_reply(seq, AUDIT_LIST_RULES, 0, 1, 1095 data, 1096 struct_size(data, buf, data->buflen)); 1097 if (skb) 1098 skb_queue_tail(q, skb); 1099 kfree(data); 1100 } 1101 } 1102 skb = audit_make_reply(seq, AUDIT_LIST_RULES, 1, 1, NULL, 0); 1103 if (skb) 1104 skb_queue_tail(q, skb); 1105 } 1106 1107 /* Log rule additions and removals */ 1108 static void audit_log_rule_change(char *action, struct audit_krule *rule, int res) 1109 { 1110 struct audit_buffer *ab; 1111 1112 if (!audit_enabled) 1113 return; 1114 1115 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONFIG_CHANGE); 1116 if (!ab) 1117 return; 1118 audit_log_session_info(ab); 1119 audit_log_task_context(ab); 1120 audit_log_format(ab, " op=%s", action); 1121 audit_log_key(ab, rule->filterkey); 1122 audit_log_format(ab, " list=%d res=%d", rule->listnr, res); 1123 audit_log_end(ab); 1124 } 1125 1126 /** 1127 * audit_rule_change - apply all rules to the specified message type 1128 * @type: audit message type 1129 * @seq: netlink audit message sequence (serial) number 1130 * @data: payload data 1131 * @datasz: size of payload data 1132 */ 1133 int audit_rule_change(int type, int seq, void *data, size_t datasz) 1134 { 1135 int err = 0; 1136 struct audit_entry *entry; 1137 1138 switch (type) { 1139 case AUDIT_ADD_RULE: 1140 entry = audit_data_to_entry(data, datasz); 1141 if (IS_ERR(entry)) 1142 return PTR_ERR(entry); 1143 err = audit_add_rule(entry); 1144 audit_log_rule_change("add_rule", &entry->rule, !err); 1145 break; 1146 case AUDIT_DEL_RULE: 1147 entry = audit_data_to_entry(data, datasz); 1148 if (IS_ERR(entry)) 1149 return PTR_ERR(entry); 1150 err = audit_del_rule(entry); 1151 audit_log_rule_change("remove_rule", &entry->rule, !err); 1152 break; 1153 default: 1154 WARN_ON(1); 1155 return -EINVAL; 1156 } 1157 1158 if (err || type == AUDIT_DEL_RULE) { 1159 if (entry->rule.exe) 1160 audit_remove_mark(entry->rule.exe); 1161 audit_free_rule(entry); 1162 } 1163 1164 return err; 1165 } 1166 1167 /** 1168 * audit_list_rules_send - list the audit rules 1169 * @request_skb: skb of request we are replying to (used to target the reply) 1170 * @seq: netlink audit message sequence (serial) number 1171 */ 1172 int audit_list_rules_send(struct sk_buff *request_skb, int seq) 1173 { 1174 struct task_struct *tsk; 1175 struct audit_netlink_list *dest; 1176 1177 /* We can't just spew out the rules here because we might fill 1178 * the available socket buffer space and deadlock waiting for 1179 * auditctl to read from it... which isn't ever going to 1180 * happen if we're actually running in the context of auditctl 1181 * trying to _send_ the stuff */ 1182 1183 dest = kmalloc(sizeof(*dest), GFP_KERNEL); 1184 if (!dest) 1185 return -ENOMEM; 1186 dest->net = get_net(sock_net(NETLINK_CB(request_skb).sk)); 1187 dest->portid = NETLINK_CB(request_skb).portid; 1188 skb_queue_head_init(&dest->q); 1189 1190 mutex_lock(&audit_filter_mutex); 1191 audit_list_rules(seq, &dest->q); 1192 mutex_unlock(&audit_filter_mutex); 1193 1194 tsk = kthread_run(audit_send_list_thread, dest, "audit_send_list"); 1195 if (IS_ERR(tsk)) { 1196 skb_queue_purge(&dest->q); 1197 put_net(dest->net); 1198 kfree(dest); 1199 return PTR_ERR(tsk); 1200 } 1201 1202 return 0; 1203 } 1204 1205 int audit_comparator(u32 left, u32 op, u32 right) 1206 { 1207 switch (op) { 1208 case Audit_equal: 1209 return (left == right); 1210 case Audit_not_equal: 1211 return (left != right); 1212 case Audit_lt: 1213 return (left < right); 1214 case Audit_le: 1215 return (left <= right); 1216 case Audit_gt: 1217 return (left > right); 1218 case Audit_ge: 1219 return (left >= right); 1220 case Audit_bitmask: 1221 return (left & right); 1222 case Audit_bittest: 1223 return ((left & right) == right); 1224 default: 1225 return 0; 1226 } 1227 } 1228 1229 int audit_uid_comparator(kuid_t left, u32 op, kuid_t right) 1230 { 1231 switch (op) { 1232 case Audit_equal: 1233 return uid_eq(left, right); 1234 case Audit_not_equal: 1235 return !uid_eq(left, right); 1236 case Audit_lt: 1237 return uid_lt(left, right); 1238 case Audit_le: 1239 return uid_lte(left, right); 1240 case Audit_gt: 1241 return uid_gt(left, right); 1242 case Audit_ge: 1243 return uid_gte(left, right); 1244 case Audit_bitmask: 1245 case Audit_bittest: 1246 default: 1247 return 0; 1248 } 1249 } 1250 1251 int audit_gid_comparator(kgid_t left, u32 op, kgid_t right) 1252 { 1253 switch (op) { 1254 case Audit_equal: 1255 return gid_eq(left, right); 1256 case Audit_not_equal: 1257 return !gid_eq(left, right); 1258 case Audit_lt: 1259 return gid_lt(left, right); 1260 case Audit_le: 1261 return gid_lte(left, right); 1262 case Audit_gt: 1263 return gid_gt(left, right); 1264 case Audit_ge: 1265 return gid_gte(left, right); 1266 case Audit_bitmask: 1267 case Audit_bittest: 1268 default: 1269 return 0; 1270 } 1271 } 1272 1273 /** 1274 * parent_len - find the length of the parent portion of a pathname 1275 * @path: pathname of which to determine length 1276 */ 1277 int parent_len(const char *path) 1278 { 1279 int plen; 1280 const char *p; 1281 1282 plen = strlen(path); 1283 1284 if (plen == 0) 1285 return plen; 1286 1287 /* disregard trailing slashes */ 1288 p = path + plen - 1; 1289 while ((*p == '/') && (p > path)) 1290 p--; 1291 1292 /* walk backward until we find the next slash or hit beginning */ 1293 while ((*p != '/') && (p > path)) 1294 p--; 1295 1296 /* did we find a slash? Then increment to include it in path */ 1297 if (*p == '/') 1298 p++; 1299 1300 return p - path; 1301 } 1302 1303 /** 1304 * audit_compare_dname_path - compare given dentry name with last component in 1305 * given path. Return of 0 indicates a match. 1306 * @dname: dentry name that we're comparing 1307 * @path: full pathname that we're comparing 1308 * @parentlen: length of the parent if known. Passing in AUDIT_NAME_FULL 1309 * here indicates that we must compute this value. 1310 */ 1311 int audit_compare_dname_path(const struct qstr *dname, const char *path, int parentlen) 1312 { 1313 int dlen, pathlen; 1314 const char *p; 1315 1316 dlen = dname->len; 1317 pathlen = strlen(path); 1318 if (pathlen < dlen) 1319 return 1; 1320 1321 parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen; 1322 if (pathlen - parentlen != dlen) 1323 return 1; 1324 1325 p = path + parentlen; 1326 1327 return strncmp(p, dname->name, dlen); 1328 } 1329 1330 int audit_filter(int msgtype, unsigned int listtype) 1331 { 1332 struct audit_entry *e; 1333 int ret = 1; /* Audit by default */ 1334 1335 rcu_read_lock(); 1336 list_for_each_entry_rcu(e, &audit_filter_list[listtype], list) { 1337 int i, result = 0; 1338 1339 for (i = 0; i < e->rule.field_count; i++) { 1340 struct audit_field *f = &e->rule.fields[i]; 1341 pid_t pid; 1342 u32 sid; 1343 1344 switch (f->type) { 1345 case AUDIT_PID: 1346 pid = task_pid_nr(current); 1347 result = audit_comparator(pid, f->op, f->val); 1348 break; 1349 case AUDIT_UID: 1350 result = audit_uid_comparator(current_uid(), f->op, f->uid); 1351 break; 1352 case AUDIT_GID: 1353 result = audit_gid_comparator(current_gid(), f->op, f->gid); 1354 break; 1355 case AUDIT_LOGINUID: 1356 result = audit_uid_comparator(audit_get_loginuid(current), 1357 f->op, f->uid); 1358 break; 1359 case AUDIT_LOGINUID_SET: 1360 result = audit_comparator(audit_loginuid_set(current), 1361 f->op, f->val); 1362 break; 1363 case AUDIT_MSGTYPE: 1364 result = audit_comparator(msgtype, f->op, f->val); 1365 break; 1366 case AUDIT_SUBJ_USER: 1367 case AUDIT_SUBJ_ROLE: 1368 case AUDIT_SUBJ_TYPE: 1369 case AUDIT_SUBJ_SEN: 1370 case AUDIT_SUBJ_CLR: 1371 if (f->lsm_rule) { 1372 security_current_getsecid_subj(&sid); 1373 result = security_audit_rule_match(sid, 1374 f->type, f->op, f->lsm_rule); 1375 } 1376 break; 1377 case AUDIT_EXE: 1378 result = audit_exe_compare(current, e->rule.exe); 1379 if (f->op == Audit_not_equal) 1380 result = !result; 1381 break; 1382 default: 1383 goto unlock_and_return; 1384 } 1385 if (result < 0) /* error */ 1386 goto unlock_and_return; 1387 if (!result) 1388 break; 1389 } 1390 if (result > 0) { 1391 if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_EXCLUDE) 1392 ret = 0; 1393 break; 1394 } 1395 } 1396 unlock_and_return: 1397 rcu_read_unlock(); 1398 return ret; 1399 } 1400 1401 static int update_lsm_rule(struct audit_krule *r) 1402 { 1403 struct audit_entry *entry = container_of(r, struct audit_entry, rule); 1404 struct audit_entry *nentry; 1405 int err = 0; 1406 1407 if (!security_audit_rule_known(r)) 1408 return 0; 1409 1410 nentry = audit_dupe_rule(r); 1411 if (entry->rule.exe) 1412 audit_remove_mark(entry->rule.exe); 1413 if (IS_ERR(nentry)) { 1414 /* save the first error encountered for the 1415 * return value */ 1416 err = PTR_ERR(nentry); 1417 audit_panic("error updating LSM filters"); 1418 if (r->watch) 1419 list_del(&r->rlist); 1420 list_del_rcu(&entry->list); 1421 list_del(&r->list); 1422 } else { 1423 if (r->watch || r->tree) 1424 list_replace_init(&r->rlist, &nentry->rule.rlist); 1425 list_replace_rcu(&entry->list, &nentry->list); 1426 list_replace(&r->list, &nentry->rule.list); 1427 } 1428 call_rcu(&entry->rcu, audit_free_rule_rcu); 1429 1430 return err; 1431 } 1432 1433 /* This function will re-initialize the lsm_rule field of all applicable rules. 1434 * It will traverse the filter lists serarching for rules that contain LSM 1435 * specific filter fields. When such a rule is found, it is copied, the 1436 * LSM field is re-initialized, and the old rule is replaced with the 1437 * updated rule. */ 1438 int audit_update_lsm_rules(void) 1439 { 1440 struct audit_krule *r, *n; 1441 int i, err = 0; 1442 1443 /* audit_filter_mutex synchronizes the writers */ 1444 mutex_lock(&audit_filter_mutex); 1445 1446 for (i = 0; i < AUDIT_NR_FILTERS; i++) { 1447 list_for_each_entry_safe(r, n, &audit_rules_list[i], list) { 1448 int res = update_lsm_rule(r); 1449 if (!err) 1450 err = res; 1451 } 1452 } 1453 mutex_unlock(&audit_filter_mutex); 1454 1455 return err; 1456 } 1457