1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* auditfilter.c -- filtering of audit events 3 * 4 * Copyright 2003-2004 Red Hat, Inc. 5 * Copyright 2005 Hewlett-Packard Development Company, L.P. 6 * Copyright 2005 IBM Corporation 7 */ 8 9 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 10 11 #include <linux/kernel.h> 12 #include <linux/audit.h> 13 #include <linux/kthread.h> 14 #include <linux/mutex.h> 15 #include <linux/fs.h> 16 #include <linux/namei.h> 17 #include <linux/netlink.h> 18 #include <linux/sched.h> 19 #include <linux/slab.h> 20 #include <linux/security.h> 21 #include <net/net_namespace.h> 22 #include <net/sock.h> 23 #include "audit.h" 24 25 /* 26 * Locking model: 27 * 28 * audit_filter_mutex: 29 * Synchronizes writes and blocking reads of audit's filterlist 30 * data. Rcu is used to traverse the filterlist and access 31 * contents of structs audit_entry, audit_watch and opaque 32 * LSM rules during filtering. If modified, these structures 33 * must be copied and replace their counterparts in the filterlist. 34 * An audit_parent struct is not accessed during filtering, so may 35 * be written directly provided audit_filter_mutex is held. 36 */ 37 38 /* Audit filter lists, defined in <linux/audit.h> */ 39 struct list_head audit_filter_list[AUDIT_NR_FILTERS] = { 40 LIST_HEAD_INIT(audit_filter_list[0]), 41 LIST_HEAD_INIT(audit_filter_list[1]), 42 LIST_HEAD_INIT(audit_filter_list[2]), 43 LIST_HEAD_INIT(audit_filter_list[3]), 44 LIST_HEAD_INIT(audit_filter_list[4]), 45 LIST_HEAD_INIT(audit_filter_list[5]), 46 LIST_HEAD_INIT(audit_filter_list[6]), 47 LIST_HEAD_INIT(audit_filter_list[7]), 48 #if AUDIT_NR_FILTERS != 8 49 #error Fix audit_filter_list initialiser 50 #endif 51 }; 52 static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = { 53 LIST_HEAD_INIT(audit_rules_list[0]), 54 LIST_HEAD_INIT(audit_rules_list[1]), 55 LIST_HEAD_INIT(audit_rules_list[2]), 56 LIST_HEAD_INIT(audit_rules_list[3]), 57 LIST_HEAD_INIT(audit_rules_list[4]), 58 LIST_HEAD_INIT(audit_rules_list[5]), 59 LIST_HEAD_INIT(audit_rules_list[6]), 60 LIST_HEAD_INIT(audit_rules_list[7]), 61 }; 62 63 DEFINE_MUTEX(audit_filter_mutex); 64 65 static void audit_free_lsm_field(struct audit_field *f) 66 { 67 switch (f->type) { 68 case AUDIT_SUBJ_USER: 69 case AUDIT_SUBJ_ROLE: 70 case AUDIT_SUBJ_TYPE: 71 case AUDIT_SUBJ_SEN: 72 case AUDIT_SUBJ_CLR: 73 case AUDIT_OBJ_USER: 74 case AUDIT_OBJ_ROLE: 75 case AUDIT_OBJ_TYPE: 76 case AUDIT_OBJ_LEV_LOW: 77 case AUDIT_OBJ_LEV_HIGH: 78 kfree(f->lsm_str); 79 security_audit_rule_free(f->lsm_rule); 80 } 81 } 82 83 static inline void audit_free_rule(struct audit_entry *e) 84 { 85 int i; 86 struct audit_krule *erule = &e->rule; 87 88 /* some rules don't have associated watches */ 89 if (erule->watch) 90 audit_put_watch(erule->watch); 91 if (erule->fields) 92 for (i = 0; i < erule->field_count; i++) 93 audit_free_lsm_field(&erule->fields[i]); 94 kfree(erule->fields); 95 kfree(erule->filterkey); 96 kfree(e); 97 } 98 99 void audit_free_rule_rcu(struct rcu_head *head) 100 { 101 struct audit_entry *e = container_of(head, struct audit_entry, rcu); 102 audit_free_rule(e); 103 } 104 105 /* Initialize an audit filterlist entry. */ 106 static inline struct audit_entry *audit_init_entry(u32 field_count) 107 { 108 struct audit_entry *entry; 109 struct audit_field *fields; 110 111 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 112 if (unlikely(!entry)) 113 return NULL; 114 115 fields = kcalloc(field_count, sizeof(*fields), GFP_KERNEL); 116 if (unlikely(!fields)) { 117 kfree(entry); 118 return NULL; 119 } 120 entry->rule.fields = fields; 121 122 return entry; 123 } 124 125 /* Unpack a filter field's string representation from user-space 126 * buffer. */ 127 char *audit_unpack_string(void **bufp, size_t *remain, size_t len) 128 { 129 char *str; 130 131 if (!*bufp || (len == 0) || (len > *remain)) 132 return ERR_PTR(-EINVAL); 133 134 /* Of the currently implemented string fields, PATH_MAX 135 * defines the longest valid length. 136 */ 137 if (len > PATH_MAX) 138 return ERR_PTR(-ENAMETOOLONG); 139 140 str = kmalloc(len + 1, GFP_KERNEL); 141 if (unlikely(!str)) 142 return ERR_PTR(-ENOMEM); 143 144 memcpy(str, *bufp, len); 145 str[len] = 0; 146 *bufp += len; 147 *remain -= len; 148 149 return str; 150 } 151 152 /* Translate an inode field to kernel representation. */ 153 static inline int audit_to_inode(struct audit_krule *krule, 154 struct audit_field *f) 155 { 156 if ((krule->listnr != AUDIT_FILTER_EXIT && 157 krule->listnr != AUDIT_FILTER_URING_EXIT) || 158 krule->inode_f || krule->watch || krule->tree || 159 (f->op != Audit_equal && f->op != Audit_not_equal)) 160 return -EINVAL; 161 162 krule->inode_f = f; 163 return 0; 164 } 165 166 static __u32 *classes[AUDIT_SYSCALL_CLASSES]; 167 168 int __init audit_register_class(int class, unsigned *list) 169 { 170 __u32 *p = kcalloc(AUDIT_BITMASK_SIZE, sizeof(__u32), GFP_KERNEL); 171 if (!p) 172 return -ENOMEM; 173 while (*list != ~0U) { 174 unsigned n = *list++; 175 if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) { 176 kfree(p); 177 return -EINVAL; 178 } 179 p[AUDIT_WORD(n)] |= AUDIT_BIT(n); 180 } 181 if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) { 182 kfree(p); 183 return -EINVAL; 184 } 185 classes[class] = p; 186 return 0; 187 } 188 189 int audit_match_class(int class, unsigned syscall) 190 { 191 if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32)) 192 return 0; 193 if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class])) 194 return 0; 195 return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall); 196 } 197 198 #ifdef CONFIG_AUDITSYSCALL 199 static inline int audit_match_class_bits(int class, u32 *mask) 200 { 201 int i; 202 203 if (classes[class]) { 204 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 205 if (mask[i] & classes[class][i]) 206 return 0; 207 } 208 return 1; 209 } 210 211 static int audit_match_signal(struct audit_entry *entry) 212 { 213 struct audit_field *arch = entry->rule.arch_f; 214 215 if (!arch) { 216 /* When arch is unspecified, we must check both masks on biarch 217 * as syscall number alone is ambiguous. */ 218 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL, 219 entry->rule.mask) && 220 audit_match_class_bits(AUDIT_CLASS_SIGNAL_32, 221 entry->rule.mask)); 222 } 223 224 switch (audit_classify_arch(arch->val)) { 225 case 0: /* native */ 226 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL, 227 entry->rule.mask)); 228 case 1: /* 32bit on biarch */ 229 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32, 230 entry->rule.mask)); 231 default: 232 return 1; 233 } 234 } 235 #endif 236 237 /* Common user-space to kernel rule translation. */ 238 static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule) 239 { 240 unsigned listnr; 241 struct audit_entry *entry; 242 int i, err; 243 244 err = -EINVAL; 245 listnr = rule->flags & ~AUDIT_FILTER_PREPEND; 246 switch (listnr) { 247 default: 248 goto exit_err; 249 #ifdef CONFIG_AUDITSYSCALL 250 case AUDIT_FILTER_ENTRY: 251 pr_err("AUDIT_FILTER_ENTRY is deprecated\n"); 252 goto exit_err; 253 case AUDIT_FILTER_EXIT: 254 case AUDIT_FILTER_URING_EXIT: 255 case AUDIT_FILTER_TASK: 256 #endif 257 case AUDIT_FILTER_USER: 258 case AUDIT_FILTER_EXCLUDE: 259 case AUDIT_FILTER_FS: 260 ; 261 } 262 if (unlikely(rule->action == AUDIT_POSSIBLE)) { 263 pr_err("AUDIT_POSSIBLE is deprecated\n"); 264 goto exit_err; 265 } 266 if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS) 267 goto exit_err; 268 if (rule->field_count > AUDIT_MAX_FIELDS) 269 goto exit_err; 270 271 err = -ENOMEM; 272 entry = audit_init_entry(rule->field_count); 273 if (!entry) 274 goto exit_err; 275 276 entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND; 277 entry->rule.listnr = listnr; 278 entry->rule.action = rule->action; 279 entry->rule.field_count = rule->field_count; 280 281 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 282 entry->rule.mask[i] = rule->mask[i]; 283 284 for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) { 285 int bit = AUDIT_BITMASK_SIZE * 32 - i - 1; 286 __u32 *p = &entry->rule.mask[AUDIT_WORD(bit)]; 287 __u32 *class; 288 289 if (!(*p & AUDIT_BIT(bit))) 290 continue; 291 *p &= ~AUDIT_BIT(bit); 292 class = classes[i]; 293 if (class) { 294 int j; 295 for (j = 0; j < AUDIT_BITMASK_SIZE; j++) 296 entry->rule.mask[j] |= class[j]; 297 } 298 } 299 300 return entry; 301 302 exit_err: 303 return ERR_PTR(err); 304 } 305 306 static u32 audit_ops[] = 307 { 308 [Audit_equal] = AUDIT_EQUAL, 309 [Audit_not_equal] = AUDIT_NOT_EQUAL, 310 [Audit_bitmask] = AUDIT_BIT_MASK, 311 [Audit_bittest] = AUDIT_BIT_TEST, 312 [Audit_lt] = AUDIT_LESS_THAN, 313 [Audit_gt] = AUDIT_GREATER_THAN, 314 [Audit_le] = AUDIT_LESS_THAN_OR_EQUAL, 315 [Audit_ge] = AUDIT_GREATER_THAN_OR_EQUAL, 316 }; 317 318 static u32 audit_to_op(u32 op) 319 { 320 u32 n; 321 for (n = Audit_equal; n < Audit_bad && audit_ops[n] != op; n++) 322 ; 323 return n; 324 } 325 326 /* check if an audit field is valid */ 327 static int audit_field_valid(struct audit_entry *entry, struct audit_field *f) 328 { 329 switch (f->type) { 330 case AUDIT_MSGTYPE: 331 if (entry->rule.listnr != AUDIT_FILTER_EXCLUDE && 332 entry->rule.listnr != AUDIT_FILTER_USER) 333 return -EINVAL; 334 break; 335 case AUDIT_FSTYPE: 336 if (entry->rule.listnr != AUDIT_FILTER_FS) 337 return -EINVAL; 338 break; 339 case AUDIT_PERM: 340 if (entry->rule.listnr == AUDIT_FILTER_URING_EXIT) 341 return -EINVAL; 342 break; 343 } 344 345 switch (entry->rule.listnr) { 346 case AUDIT_FILTER_FS: 347 switch (f->type) { 348 case AUDIT_FSTYPE: 349 case AUDIT_FILTERKEY: 350 break; 351 default: 352 return -EINVAL; 353 } 354 } 355 356 /* Check for valid field type and op */ 357 switch (f->type) { 358 case AUDIT_ARG0: 359 case AUDIT_ARG1: 360 case AUDIT_ARG2: 361 case AUDIT_ARG3: 362 case AUDIT_PERS: /* <uapi/linux/personality.h> */ 363 case AUDIT_DEVMINOR: 364 /* all ops are valid */ 365 break; 366 case AUDIT_UID: 367 case AUDIT_EUID: 368 case AUDIT_SUID: 369 case AUDIT_FSUID: 370 case AUDIT_LOGINUID: 371 case AUDIT_OBJ_UID: 372 case AUDIT_GID: 373 case AUDIT_EGID: 374 case AUDIT_SGID: 375 case AUDIT_FSGID: 376 case AUDIT_OBJ_GID: 377 case AUDIT_PID: 378 case AUDIT_MSGTYPE: 379 case AUDIT_PPID: 380 case AUDIT_DEVMAJOR: 381 case AUDIT_EXIT: 382 case AUDIT_SUCCESS: 383 case AUDIT_INODE: 384 case AUDIT_SESSIONID: 385 case AUDIT_SUBJ_SEN: 386 case AUDIT_SUBJ_CLR: 387 case AUDIT_OBJ_LEV_LOW: 388 case AUDIT_OBJ_LEV_HIGH: 389 case AUDIT_SADDR_FAM: 390 /* bit ops are only useful on syscall args */ 391 if (f->op == Audit_bitmask || f->op == Audit_bittest) 392 return -EINVAL; 393 break; 394 case AUDIT_SUBJ_USER: 395 case AUDIT_SUBJ_ROLE: 396 case AUDIT_SUBJ_TYPE: 397 case AUDIT_OBJ_USER: 398 case AUDIT_OBJ_ROLE: 399 case AUDIT_OBJ_TYPE: 400 case AUDIT_WATCH: 401 case AUDIT_DIR: 402 case AUDIT_FILTERKEY: 403 case AUDIT_LOGINUID_SET: 404 case AUDIT_ARCH: 405 case AUDIT_FSTYPE: 406 case AUDIT_PERM: 407 case AUDIT_FILETYPE: 408 case AUDIT_FIELD_COMPARE: 409 case AUDIT_EXE: 410 /* only equal and not equal valid ops */ 411 if (f->op != Audit_not_equal && f->op != Audit_equal) 412 return -EINVAL; 413 break; 414 default: 415 /* field not recognized */ 416 return -EINVAL; 417 } 418 419 /* Check for select valid field values */ 420 switch (f->type) { 421 case AUDIT_LOGINUID_SET: 422 if ((f->val != 0) && (f->val != 1)) 423 return -EINVAL; 424 break; 425 case AUDIT_PERM: 426 if (f->val & ~15) 427 return -EINVAL; 428 break; 429 case AUDIT_FILETYPE: 430 if (f->val & ~S_IFMT) 431 return -EINVAL; 432 break; 433 case AUDIT_FIELD_COMPARE: 434 if (f->val > AUDIT_MAX_FIELD_COMPARE) 435 return -EINVAL; 436 break; 437 case AUDIT_SADDR_FAM: 438 if (f->val >= AF_MAX) 439 return -EINVAL; 440 break; 441 default: 442 break; 443 } 444 445 return 0; 446 } 447 448 /* Translate struct audit_rule_data to kernel's rule representation. */ 449 static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, 450 size_t datasz) 451 { 452 int err = 0; 453 struct audit_entry *entry; 454 void *bufp; 455 size_t remain = datasz - sizeof(struct audit_rule_data); 456 int i; 457 char *str; 458 struct audit_fsnotify_mark *audit_mark; 459 460 entry = audit_to_entry_common(data); 461 if (IS_ERR(entry)) 462 goto exit_nofree; 463 464 bufp = data->buf; 465 for (i = 0; i < data->field_count; i++) { 466 struct audit_field *f = &entry->rule.fields[i]; 467 u32 f_val; 468 469 err = -EINVAL; 470 471 f->op = audit_to_op(data->fieldflags[i]); 472 if (f->op == Audit_bad) 473 goto exit_free; 474 475 f->type = data->fields[i]; 476 f_val = data->values[i]; 477 478 /* Support legacy tests for a valid loginuid */ 479 if ((f->type == AUDIT_LOGINUID) && (f_val == AUDIT_UID_UNSET)) { 480 f->type = AUDIT_LOGINUID_SET; 481 f_val = 0; 482 entry->rule.pflags |= AUDIT_LOGINUID_LEGACY; 483 } 484 485 err = audit_field_valid(entry, f); 486 if (err) 487 goto exit_free; 488 489 err = -EINVAL; 490 switch (f->type) { 491 case AUDIT_LOGINUID: 492 case AUDIT_UID: 493 case AUDIT_EUID: 494 case AUDIT_SUID: 495 case AUDIT_FSUID: 496 case AUDIT_OBJ_UID: 497 f->uid = make_kuid(current_user_ns(), f_val); 498 if (!uid_valid(f->uid)) 499 goto exit_free; 500 break; 501 case AUDIT_GID: 502 case AUDIT_EGID: 503 case AUDIT_SGID: 504 case AUDIT_FSGID: 505 case AUDIT_OBJ_GID: 506 f->gid = make_kgid(current_user_ns(), f_val); 507 if (!gid_valid(f->gid)) 508 goto exit_free; 509 break; 510 case AUDIT_ARCH: 511 f->val = f_val; 512 entry->rule.arch_f = f; 513 break; 514 case AUDIT_SUBJ_USER: 515 case AUDIT_SUBJ_ROLE: 516 case AUDIT_SUBJ_TYPE: 517 case AUDIT_SUBJ_SEN: 518 case AUDIT_SUBJ_CLR: 519 case AUDIT_OBJ_USER: 520 case AUDIT_OBJ_ROLE: 521 case AUDIT_OBJ_TYPE: 522 case AUDIT_OBJ_LEV_LOW: 523 case AUDIT_OBJ_LEV_HIGH: 524 str = audit_unpack_string(&bufp, &remain, f_val); 525 if (IS_ERR(str)) { 526 err = PTR_ERR(str); 527 goto exit_free; 528 } 529 entry->rule.buflen += f_val; 530 f->lsm_str = str; 531 err = security_audit_rule_init(f->type, f->op, str, 532 (void **)&f->lsm_rule, 533 GFP_KERNEL); 534 /* Keep currently invalid fields around in case they 535 * become valid after a policy reload. */ 536 if (err == -EINVAL) { 537 pr_warn("audit rule for LSM \'%s\' is invalid\n", 538 str); 539 err = 0; 540 } else if (err) 541 goto exit_free; 542 break; 543 case AUDIT_WATCH: 544 str = audit_unpack_string(&bufp, &remain, f_val); 545 if (IS_ERR(str)) { 546 err = PTR_ERR(str); 547 goto exit_free; 548 } 549 err = audit_to_watch(&entry->rule, str, f_val, f->op); 550 if (err) { 551 kfree(str); 552 goto exit_free; 553 } 554 entry->rule.buflen += f_val; 555 break; 556 case AUDIT_DIR: 557 str = audit_unpack_string(&bufp, &remain, f_val); 558 if (IS_ERR(str)) { 559 err = PTR_ERR(str); 560 goto exit_free; 561 } 562 err = audit_make_tree(&entry->rule, str, f->op); 563 kfree(str); 564 if (err) 565 goto exit_free; 566 entry->rule.buflen += f_val; 567 break; 568 case AUDIT_INODE: 569 f->val = f_val; 570 err = audit_to_inode(&entry->rule, f); 571 if (err) 572 goto exit_free; 573 break; 574 case AUDIT_FILTERKEY: 575 if (entry->rule.filterkey || f_val > AUDIT_MAX_KEY_LEN) 576 goto exit_free; 577 str = audit_unpack_string(&bufp, &remain, f_val); 578 if (IS_ERR(str)) { 579 err = PTR_ERR(str); 580 goto exit_free; 581 } 582 entry->rule.buflen += f_val; 583 entry->rule.filterkey = str; 584 break; 585 case AUDIT_EXE: 586 if (entry->rule.exe || f_val > PATH_MAX) 587 goto exit_free; 588 str = audit_unpack_string(&bufp, &remain, f_val); 589 if (IS_ERR(str)) { 590 err = PTR_ERR(str); 591 goto exit_free; 592 } 593 audit_mark = audit_alloc_mark(&entry->rule, str, f_val); 594 if (IS_ERR(audit_mark)) { 595 kfree(str); 596 err = PTR_ERR(audit_mark); 597 goto exit_free; 598 } 599 entry->rule.buflen += f_val; 600 entry->rule.exe = audit_mark; 601 break; 602 default: 603 f->val = f_val; 604 break; 605 } 606 } 607 608 if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal) 609 entry->rule.inode_f = NULL; 610 611 exit_nofree: 612 return entry; 613 614 exit_free: 615 if (entry->rule.tree) 616 audit_put_tree(entry->rule.tree); /* that's the temporary one */ 617 if (entry->rule.exe) 618 audit_remove_mark(entry->rule.exe); /* that's the template one */ 619 audit_free_rule(entry); 620 return ERR_PTR(err); 621 } 622 623 /* Pack a filter field's string representation into data block. */ 624 static inline size_t audit_pack_string(void **bufp, const char *str) 625 { 626 size_t len = strlen(str); 627 628 memcpy(*bufp, str, len); 629 *bufp += len; 630 631 return len; 632 } 633 634 /* Translate kernel rule representation to struct audit_rule_data. */ 635 static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) 636 { 637 struct audit_rule_data *data; 638 void *bufp; 639 int i; 640 641 data = kmalloc(struct_size(data, buf, krule->buflen), GFP_KERNEL); 642 if (unlikely(!data)) 643 return NULL; 644 memset(data, 0, sizeof(*data)); 645 646 data->flags = krule->flags | krule->listnr; 647 data->action = krule->action; 648 data->field_count = krule->field_count; 649 bufp = data->buf; 650 for (i = 0; i < data->field_count; i++) { 651 struct audit_field *f = &krule->fields[i]; 652 653 data->fields[i] = f->type; 654 data->fieldflags[i] = audit_ops[f->op]; 655 switch (f->type) { 656 case AUDIT_SUBJ_USER: 657 case AUDIT_SUBJ_ROLE: 658 case AUDIT_SUBJ_TYPE: 659 case AUDIT_SUBJ_SEN: 660 case AUDIT_SUBJ_CLR: 661 case AUDIT_OBJ_USER: 662 case AUDIT_OBJ_ROLE: 663 case AUDIT_OBJ_TYPE: 664 case AUDIT_OBJ_LEV_LOW: 665 case AUDIT_OBJ_LEV_HIGH: 666 data->buflen += data->values[i] = 667 audit_pack_string(&bufp, f->lsm_str); 668 break; 669 case AUDIT_WATCH: 670 data->buflen += data->values[i] = 671 audit_pack_string(&bufp, 672 audit_watch_path(krule->watch)); 673 break; 674 case AUDIT_DIR: 675 data->buflen += data->values[i] = 676 audit_pack_string(&bufp, 677 audit_tree_path(krule->tree)); 678 break; 679 case AUDIT_FILTERKEY: 680 data->buflen += data->values[i] = 681 audit_pack_string(&bufp, krule->filterkey); 682 break; 683 case AUDIT_EXE: 684 data->buflen += data->values[i] = 685 audit_pack_string(&bufp, audit_mark_path(krule->exe)); 686 break; 687 case AUDIT_LOGINUID_SET: 688 if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) { 689 data->fields[i] = AUDIT_LOGINUID; 690 data->values[i] = AUDIT_UID_UNSET; 691 break; 692 } 693 fallthrough; /* if set */ 694 default: 695 data->values[i] = f->val; 696 } 697 } 698 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 699 data->mask[i] = krule->mask[i]; 700 701 return data; 702 } 703 704 /* Compare two rules in kernel format. Considered success if rules 705 * don't match. */ 706 static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b) 707 { 708 int i; 709 710 if (a->flags != b->flags || 711 a->pflags != b->pflags || 712 a->listnr != b->listnr || 713 a->action != b->action || 714 a->field_count != b->field_count) 715 return 1; 716 717 for (i = 0; i < a->field_count; i++) { 718 if (a->fields[i].type != b->fields[i].type || 719 a->fields[i].op != b->fields[i].op) 720 return 1; 721 722 switch (a->fields[i].type) { 723 case AUDIT_SUBJ_USER: 724 case AUDIT_SUBJ_ROLE: 725 case AUDIT_SUBJ_TYPE: 726 case AUDIT_SUBJ_SEN: 727 case AUDIT_SUBJ_CLR: 728 case AUDIT_OBJ_USER: 729 case AUDIT_OBJ_ROLE: 730 case AUDIT_OBJ_TYPE: 731 case AUDIT_OBJ_LEV_LOW: 732 case AUDIT_OBJ_LEV_HIGH: 733 if (strcmp(a->fields[i].lsm_str, b->fields[i].lsm_str)) 734 return 1; 735 break; 736 case AUDIT_WATCH: 737 if (strcmp(audit_watch_path(a->watch), 738 audit_watch_path(b->watch))) 739 return 1; 740 break; 741 case AUDIT_DIR: 742 if (strcmp(audit_tree_path(a->tree), 743 audit_tree_path(b->tree))) 744 return 1; 745 break; 746 case AUDIT_FILTERKEY: 747 /* both filterkeys exist based on above type compare */ 748 if (strcmp(a->filterkey, b->filterkey)) 749 return 1; 750 break; 751 case AUDIT_EXE: 752 /* both paths exist based on above type compare */ 753 if (strcmp(audit_mark_path(a->exe), 754 audit_mark_path(b->exe))) 755 return 1; 756 break; 757 case AUDIT_UID: 758 case AUDIT_EUID: 759 case AUDIT_SUID: 760 case AUDIT_FSUID: 761 case AUDIT_LOGINUID: 762 case AUDIT_OBJ_UID: 763 if (!uid_eq(a->fields[i].uid, b->fields[i].uid)) 764 return 1; 765 break; 766 case AUDIT_GID: 767 case AUDIT_EGID: 768 case AUDIT_SGID: 769 case AUDIT_FSGID: 770 case AUDIT_OBJ_GID: 771 if (!gid_eq(a->fields[i].gid, b->fields[i].gid)) 772 return 1; 773 break; 774 default: 775 if (a->fields[i].val != b->fields[i].val) 776 return 1; 777 } 778 } 779 780 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 781 if (a->mask[i] != b->mask[i]) 782 return 1; 783 784 return 0; 785 } 786 787 /* Duplicate LSM field information. The lsm_rule is opaque, so must be 788 * re-initialized. */ 789 static inline int audit_dupe_lsm_field(struct audit_field *df, 790 struct audit_field *sf) 791 { 792 int ret; 793 char *lsm_str; 794 795 /* our own copy of lsm_str */ 796 lsm_str = kstrdup(sf->lsm_str, GFP_KERNEL); 797 if (unlikely(!lsm_str)) 798 return -ENOMEM; 799 df->lsm_str = lsm_str; 800 801 /* our own (refreshed) copy of lsm_rule */ 802 ret = security_audit_rule_init(df->type, df->op, df->lsm_str, 803 (void **)&df->lsm_rule, GFP_KERNEL); 804 /* Keep currently invalid fields around in case they 805 * become valid after a policy reload. */ 806 if (ret == -EINVAL) { 807 pr_warn("audit rule for LSM \'%s\' is invalid\n", 808 df->lsm_str); 809 ret = 0; 810 } 811 812 return ret; 813 } 814 815 /* Duplicate an audit rule. This will be a deep copy with the exception 816 * of the watch - that pointer is carried over. The LSM specific fields 817 * will be updated in the copy. The point is to be able to replace the old 818 * rule with the new rule in the filterlist, then free the old rule. 819 * The rlist element is undefined; list manipulations are handled apart from 820 * the initial copy. */ 821 struct audit_entry *audit_dupe_rule(struct audit_krule *old) 822 { 823 u32 fcount = old->field_count; 824 struct audit_entry *entry; 825 struct audit_krule *new; 826 char *fk; 827 int i, err = 0; 828 829 entry = audit_init_entry(fcount); 830 if (unlikely(!entry)) 831 return ERR_PTR(-ENOMEM); 832 833 new = &entry->rule; 834 new->flags = old->flags; 835 new->pflags = old->pflags; 836 new->listnr = old->listnr; 837 new->action = old->action; 838 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 839 new->mask[i] = old->mask[i]; 840 new->prio = old->prio; 841 new->buflen = old->buflen; 842 new->inode_f = old->inode_f; 843 new->field_count = old->field_count; 844 845 /* 846 * note that we are OK with not refcounting here; audit_match_tree() 847 * never dereferences tree and we can't get false positives there 848 * since we'd have to have rule gone from the list *and* removed 849 * before the chunks found by lookup had been allocated, i.e. before 850 * the beginning of list scan. 851 */ 852 new->tree = old->tree; 853 memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount); 854 855 /* deep copy this information, updating the lsm_rule fields, because 856 * the originals will all be freed when the old rule is freed. */ 857 for (i = 0; i < fcount; i++) { 858 switch (new->fields[i].type) { 859 case AUDIT_SUBJ_USER: 860 case AUDIT_SUBJ_ROLE: 861 case AUDIT_SUBJ_TYPE: 862 case AUDIT_SUBJ_SEN: 863 case AUDIT_SUBJ_CLR: 864 case AUDIT_OBJ_USER: 865 case AUDIT_OBJ_ROLE: 866 case AUDIT_OBJ_TYPE: 867 case AUDIT_OBJ_LEV_LOW: 868 case AUDIT_OBJ_LEV_HIGH: 869 err = audit_dupe_lsm_field(&new->fields[i], 870 &old->fields[i]); 871 break; 872 case AUDIT_FILTERKEY: 873 fk = kstrdup(old->filterkey, GFP_KERNEL); 874 if (unlikely(!fk)) 875 err = -ENOMEM; 876 else 877 new->filterkey = fk; 878 break; 879 case AUDIT_EXE: 880 err = audit_dupe_exe(new, old); 881 break; 882 } 883 if (err) { 884 if (new->exe) 885 audit_remove_mark(new->exe); 886 audit_free_rule(entry); 887 return ERR_PTR(err); 888 } 889 } 890 891 if (old->watch) { 892 audit_get_watch(old->watch); 893 new->watch = old->watch; 894 } 895 896 return entry; 897 } 898 899 /* Find an existing audit rule. 900 * Caller must hold audit_filter_mutex to prevent stale rule data. */ 901 static struct audit_entry *audit_find_rule(struct audit_entry *entry, 902 struct list_head **p) 903 { 904 struct audit_entry *e, *found = NULL; 905 struct list_head *list; 906 int h; 907 908 if (entry->rule.inode_f) { 909 h = audit_hash_ino(entry->rule.inode_f->val); 910 *p = list = &audit_inode_hash[h]; 911 } else if (entry->rule.watch) { 912 /* we don't know the inode number, so must walk entire hash */ 913 for (h = 0; h < AUDIT_INODE_BUCKETS; h++) { 914 list = &audit_inode_hash[h]; 915 list_for_each_entry(e, list, list) 916 if (!audit_compare_rule(&entry->rule, &e->rule)) { 917 found = e; 918 goto out; 919 } 920 } 921 goto out; 922 } else { 923 *p = list = &audit_filter_list[entry->rule.listnr]; 924 } 925 926 list_for_each_entry(e, list, list) 927 if (!audit_compare_rule(&entry->rule, &e->rule)) { 928 found = e; 929 goto out; 930 } 931 932 out: 933 return found; 934 } 935 936 static u64 prio_low = ~0ULL/2; 937 static u64 prio_high = ~0ULL/2 - 1; 938 939 /* Add rule to given filterlist if not a duplicate. */ 940 static inline int audit_add_rule(struct audit_entry *entry) 941 { 942 struct audit_entry *e; 943 struct audit_watch *watch = entry->rule.watch; 944 struct audit_tree *tree = entry->rule.tree; 945 struct list_head *list; 946 int err = 0; 947 #ifdef CONFIG_AUDITSYSCALL 948 int dont_count = 0; 949 950 /* If any of these, don't count towards total */ 951 switch (entry->rule.listnr) { 952 case AUDIT_FILTER_USER: 953 case AUDIT_FILTER_EXCLUDE: 954 case AUDIT_FILTER_FS: 955 dont_count = 1; 956 } 957 #endif 958 959 mutex_lock(&audit_filter_mutex); 960 e = audit_find_rule(entry, &list); 961 if (e) { 962 mutex_unlock(&audit_filter_mutex); 963 err = -EEXIST; 964 /* normally audit_add_tree_rule() will free it on failure */ 965 if (tree) 966 audit_put_tree(tree); 967 return err; 968 } 969 970 if (watch) { 971 /* audit_filter_mutex is dropped and re-taken during this call */ 972 err = audit_add_watch(&entry->rule, &list); 973 if (err) { 974 mutex_unlock(&audit_filter_mutex); 975 /* 976 * normally audit_add_tree_rule() will free it 977 * on failure 978 */ 979 if (tree) 980 audit_put_tree(tree); 981 return err; 982 } 983 } 984 if (tree) { 985 err = audit_add_tree_rule(&entry->rule); 986 if (err) { 987 mutex_unlock(&audit_filter_mutex); 988 return err; 989 } 990 } 991 992 entry->rule.prio = ~0ULL; 993 if (entry->rule.listnr == AUDIT_FILTER_EXIT || 994 entry->rule.listnr == AUDIT_FILTER_URING_EXIT) { 995 if (entry->rule.flags & AUDIT_FILTER_PREPEND) 996 entry->rule.prio = ++prio_high; 997 else 998 entry->rule.prio = --prio_low; 999 } 1000 1001 if (entry->rule.flags & AUDIT_FILTER_PREPEND) { 1002 list_add(&entry->rule.list, 1003 &audit_rules_list[entry->rule.listnr]); 1004 list_add_rcu(&entry->list, list); 1005 entry->rule.flags &= ~AUDIT_FILTER_PREPEND; 1006 } else { 1007 list_add_tail(&entry->rule.list, 1008 &audit_rules_list[entry->rule.listnr]); 1009 list_add_tail_rcu(&entry->list, list); 1010 } 1011 #ifdef CONFIG_AUDITSYSCALL 1012 if (!dont_count) 1013 audit_n_rules++; 1014 1015 if (!audit_match_signal(entry)) 1016 audit_signals++; 1017 #endif 1018 mutex_unlock(&audit_filter_mutex); 1019 1020 return err; 1021 } 1022 1023 /* Remove an existing rule from filterlist. */ 1024 int audit_del_rule(struct audit_entry *entry) 1025 { 1026 struct audit_entry *e; 1027 struct audit_tree *tree = entry->rule.tree; 1028 struct list_head *list; 1029 int ret = 0; 1030 #ifdef CONFIG_AUDITSYSCALL 1031 int dont_count = 0; 1032 1033 /* If any of these, don't count towards total */ 1034 switch (entry->rule.listnr) { 1035 case AUDIT_FILTER_USER: 1036 case AUDIT_FILTER_EXCLUDE: 1037 case AUDIT_FILTER_FS: 1038 dont_count = 1; 1039 } 1040 #endif 1041 1042 mutex_lock(&audit_filter_mutex); 1043 e = audit_find_rule(entry, &list); 1044 if (!e) { 1045 ret = -ENOENT; 1046 goto out; 1047 } 1048 1049 if (e->rule.watch) 1050 audit_remove_watch_rule(&e->rule); 1051 1052 if (e->rule.tree) 1053 audit_remove_tree_rule(&e->rule); 1054 1055 if (e->rule.exe) 1056 audit_remove_mark_rule(&e->rule); 1057 1058 #ifdef CONFIG_AUDITSYSCALL 1059 if (!dont_count) 1060 audit_n_rules--; 1061 1062 if (!audit_match_signal(entry)) 1063 audit_signals--; 1064 #endif 1065 1066 list_del_rcu(&e->list); 1067 list_del(&e->rule.list); 1068 call_rcu(&e->rcu, audit_free_rule_rcu); 1069 1070 out: 1071 mutex_unlock(&audit_filter_mutex); 1072 1073 if (tree) 1074 audit_put_tree(tree); /* that's the temporary one */ 1075 1076 return ret; 1077 } 1078 1079 /* List rules using struct audit_rule_data. */ 1080 static void audit_list_rules(int seq, struct sk_buff_head *q) 1081 { 1082 struct sk_buff *skb; 1083 struct audit_krule *r; 1084 int i; 1085 1086 /* This is a blocking read, so use audit_filter_mutex instead of rcu 1087 * iterator to sync with list writers. */ 1088 for (i = 0; i < AUDIT_NR_FILTERS; i++) { 1089 list_for_each_entry(r, &audit_rules_list[i], list) { 1090 struct audit_rule_data *data; 1091 1092 data = audit_krule_to_data(r); 1093 if (unlikely(!data)) 1094 break; 1095 skb = audit_make_reply(seq, AUDIT_LIST_RULES, 0, 1, 1096 data, 1097 struct_size(data, buf, data->buflen)); 1098 if (skb) 1099 skb_queue_tail(q, skb); 1100 kfree(data); 1101 } 1102 } 1103 skb = audit_make_reply(seq, AUDIT_LIST_RULES, 1, 1, NULL, 0); 1104 if (skb) 1105 skb_queue_tail(q, skb); 1106 } 1107 1108 /* Log rule additions and removals */ 1109 static void audit_log_rule_change(char *action, struct audit_krule *rule, int res) 1110 { 1111 struct audit_buffer *ab; 1112 1113 if (!audit_enabled) 1114 return; 1115 1116 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONFIG_CHANGE); 1117 if (!ab) 1118 return; 1119 audit_log_session_info(ab); 1120 audit_log_task_context(ab); 1121 audit_log_format(ab, " op=%s", action); 1122 audit_log_key(ab, rule->filterkey); 1123 audit_log_format(ab, " list=%d res=%d", rule->listnr, res); 1124 audit_log_end(ab); 1125 } 1126 1127 /** 1128 * audit_rule_change - apply all rules to the specified message type 1129 * @type: audit message type 1130 * @seq: netlink audit message sequence (serial) number 1131 * @data: payload data 1132 * @datasz: size of payload data 1133 */ 1134 int audit_rule_change(int type, int seq, void *data, size_t datasz) 1135 { 1136 int err = 0; 1137 struct audit_entry *entry; 1138 1139 switch (type) { 1140 case AUDIT_ADD_RULE: 1141 entry = audit_data_to_entry(data, datasz); 1142 if (IS_ERR(entry)) 1143 return PTR_ERR(entry); 1144 err = audit_add_rule(entry); 1145 audit_log_rule_change("add_rule", &entry->rule, !err); 1146 break; 1147 case AUDIT_DEL_RULE: 1148 entry = audit_data_to_entry(data, datasz); 1149 if (IS_ERR(entry)) 1150 return PTR_ERR(entry); 1151 err = audit_del_rule(entry); 1152 audit_log_rule_change("remove_rule", &entry->rule, !err); 1153 break; 1154 default: 1155 WARN_ON(1); 1156 return -EINVAL; 1157 } 1158 1159 if (err || type == AUDIT_DEL_RULE) { 1160 if (entry->rule.exe) 1161 audit_remove_mark(entry->rule.exe); 1162 audit_free_rule(entry); 1163 } 1164 1165 return err; 1166 } 1167 1168 /** 1169 * audit_list_rules_send - list the audit rules 1170 * @request_skb: skb of request we are replying to (used to target the reply) 1171 * @seq: netlink audit message sequence (serial) number 1172 */ 1173 int audit_list_rules_send(struct sk_buff *request_skb, int seq) 1174 { 1175 struct task_struct *tsk; 1176 struct audit_netlink_list *dest; 1177 1178 /* We can't just spew out the rules here because we might fill 1179 * the available socket buffer space and deadlock waiting for 1180 * auditctl to read from it... which isn't ever going to 1181 * happen if we're actually running in the context of auditctl 1182 * trying to _send_ the stuff */ 1183 1184 dest = kmalloc(sizeof(*dest), GFP_KERNEL); 1185 if (!dest) 1186 return -ENOMEM; 1187 dest->net = get_net(sock_net(NETLINK_CB(request_skb).sk)); 1188 dest->portid = NETLINK_CB(request_skb).portid; 1189 skb_queue_head_init(&dest->q); 1190 1191 mutex_lock(&audit_filter_mutex); 1192 audit_list_rules(seq, &dest->q); 1193 mutex_unlock(&audit_filter_mutex); 1194 1195 tsk = kthread_run(audit_send_list_thread, dest, "audit_send_list"); 1196 if (IS_ERR(tsk)) { 1197 skb_queue_purge(&dest->q); 1198 put_net(dest->net); 1199 kfree(dest); 1200 return PTR_ERR(tsk); 1201 } 1202 1203 return 0; 1204 } 1205 1206 int audit_comparator(u32 left, u32 op, u32 right) 1207 { 1208 switch (op) { 1209 case Audit_equal: 1210 return (left == right); 1211 case Audit_not_equal: 1212 return (left != right); 1213 case Audit_lt: 1214 return (left < right); 1215 case Audit_le: 1216 return (left <= right); 1217 case Audit_gt: 1218 return (left > right); 1219 case Audit_ge: 1220 return (left >= right); 1221 case Audit_bitmask: 1222 return (left & right); 1223 case Audit_bittest: 1224 return ((left & right) == right); 1225 default: 1226 return 0; 1227 } 1228 } 1229 1230 int audit_uid_comparator(kuid_t left, u32 op, kuid_t right) 1231 { 1232 switch (op) { 1233 case Audit_equal: 1234 return uid_eq(left, right); 1235 case Audit_not_equal: 1236 return !uid_eq(left, right); 1237 case Audit_lt: 1238 return uid_lt(left, right); 1239 case Audit_le: 1240 return uid_lte(left, right); 1241 case Audit_gt: 1242 return uid_gt(left, right); 1243 case Audit_ge: 1244 return uid_gte(left, right); 1245 case Audit_bitmask: 1246 case Audit_bittest: 1247 default: 1248 return 0; 1249 } 1250 } 1251 1252 int audit_gid_comparator(kgid_t left, u32 op, kgid_t right) 1253 { 1254 switch (op) { 1255 case Audit_equal: 1256 return gid_eq(left, right); 1257 case Audit_not_equal: 1258 return !gid_eq(left, right); 1259 case Audit_lt: 1260 return gid_lt(left, right); 1261 case Audit_le: 1262 return gid_lte(left, right); 1263 case Audit_gt: 1264 return gid_gt(left, right); 1265 case Audit_ge: 1266 return gid_gte(left, right); 1267 case Audit_bitmask: 1268 case Audit_bittest: 1269 default: 1270 return 0; 1271 } 1272 } 1273 1274 /** 1275 * parent_len - find the length of the parent portion of a pathname 1276 * @path: pathname of which to determine length 1277 */ 1278 int parent_len(const char *path) 1279 { 1280 int plen; 1281 const char *p; 1282 1283 plen = strlen(path); 1284 1285 if (plen == 0) 1286 return plen; 1287 1288 /* disregard trailing slashes */ 1289 p = path + plen - 1; 1290 while ((*p == '/') && (p > path)) 1291 p--; 1292 1293 /* walk backward until we find the next slash or hit beginning */ 1294 while ((*p != '/') && (p > path)) 1295 p--; 1296 1297 /* did we find a slash? Then increment to include it in path */ 1298 if (*p == '/') 1299 p++; 1300 1301 return p - path; 1302 } 1303 1304 /** 1305 * audit_compare_dname_path - compare given dentry name with last component in 1306 * given path. Return of 0 indicates a match. 1307 * @dname: dentry name that we're comparing 1308 * @path: full pathname that we're comparing 1309 * @parentlen: length of the parent if known. Passing in AUDIT_NAME_FULL 1310 * here indicates that we must compute this value. 1311 */ 1312 int audit_compare_dname_path(const struct qstr *dname, const char *path, int parentlen) 1313 { 1314 int dlen, pathlen; 1315 const char *p; 1316 1317 dlen = dname->len; 1318 pathlen = strlen(path); 1319 if (pathlen < dlen) 1320 return 1; 1321 1322 parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen; 1323 if (pathlen - parentlen != dlen) 1324 return 1; 1325 1326 p = path + parentlen; 1327 1328 return strncmp(p, dname->name, dlen); 1329 } 1330 1331 int audit_filter(int msgtype, unsigned int listtype) 1332 { 1333 struct audit_entry *e; 1334 int ret = 1; /* Audit by default */ 1335 1336 rcu_read_lock(); 1337 list_for_each_entry_rcu(e, &audit_filter_list[listtype], list) { 1338 int i, result = 0; 1339 1340 for (i = 0; i < e->rule.field_count; i++) { 1341 struct audit_field *f = &e->rule.fields[i]; 1342 pid_t pid; 1343 u32 sid; 1344 1345 switch (f->type) { 1346 case AUDIT_PID: 1347 pid = task_pid_nr(current); 1348 result = audit_comparator(pid, f->op, f->val); 1349 break; 1350 case AUDIT_UID: 1351 result = audit_uid_comparator(current_uid(), f->op, f->uid); 1352 break; 1353 case AUDIT_GID: 1354 result = audit_gid_comparator(current_gid(), f->op, f->gid); 1355 break; 1356 case AUDIT_LOGINUID: 1357 result = audit_uid_comparator(audit_get_loginuid(current), 1358 f->op, f->uid); 1359 break; 1360 case AUDIT_LOGINUID_SET: 1361 result = audit_comparator(audit_loginuid_set(current), 1362 f->op, f->val); 1363 break; 1364 case AUDIT_MSGTYPE: 1365 result = audit_comparator(msgtype, f->op, f->val); 1366 break; 1367 case AUDIT_SUBJ_USER: 1368 case AUDIT_SUBJ_ROLE: 1369 case AUDIT_SUBJ_TYPE: 1370 case AUDIT_SUBJ_SEN: 1371 case AUDIT_SUBJ_CLR: 1372 if (f->lsm_rule) { 1373 security_current_getsecid_subj(&sid); 1374 result = security_audit_rule_match(sid, 1375 f->type, f->op, f->lsm_rule); 1376 } 1377 break; 1378 case AUDIT_EXE: 1379 result = audit_exe_compare(current, e->rule.exe); 1380 if (f->op == Audit_not_equal) 1381 result = !result; 1382 break; 1383 default: 1384 goto unlock_and_return; 1385 } 1386 if (result < 0) /* error */ 1387 goto unlock_and_return; 1388 if (!result) 1389 break; 1390 } 1391 if (result > 0) { 1392 if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_EXCLUDE) 1393 ret = 0; 1394 break; 1395 } 1396 } 1397 unlock_and_return: 1398 rcu_read_unlock(); 1399 return ret; 1400 } 1401 1402 static int update_lsm_rule(struct audit_krule *r) 1403 { 1404 struct audit_entry *entry = container_of(r, struct audit_entry, rule); 1405 struct audit_entry *nentry; 1406 int err = 0; 1407 1408 if (!security_audit_rule_known(r)) 1409 return 0; 1410 1411 nentry = audit_dupe_rule(r); 1412 if (entry->rule.exe) 1413 audit_remove_mark(entry->rule.exe); 1414 if (IS_ERR(nentry)) { 1415 /* save the first error encountered for the 1416 * return value */ 1417 err = PTR_ERR(nentry); 1418 audit_panic("error updating LSM filters"); 1419 if (r->watch) 1420 list_del(&r->rlist); 1421 list_del_rcu(&entry->list); 1422 list_del(&r->list); 1423 } else { 1424 if (r->watch || r->tree) 1425 list_replace_init(&r->rlist, &nentry->rule.rlist); 1426 list_replace_rcu(&entry->list, &nentry->list); 1427 list_replace(&r->list, &nentry->rule.list); 1428 } 1429 call_rcu(&entry->rcu, audit_free_rule_rcu); 1430 1431 return err; 1432 } 1433 1434 /* This function will re-initialize the lsm_rule field of all applicable rules. 1435 * It will traverse the filter lists serarching for rules that contain LSM 1436 * specific filter fields. When such a rule is found, it is copied, the 1437 * LSM field is re-initialized, and the old rule is replaced with the 1438 * updated rule. */ 1439 int audit_update_lsm_rules(void) 1440 { 1441 struct audit_krule *r, *n; 1442 int i, err = 0; 1443 1444 /* audit_filter_mutex synchronizes the writers */ 1445 mutex_lock(&audit_filter_mutex); 1446 1447 for (i = 0; i < AUDIT_NR_FILTERS; i++) { 1448 list_for_each_entry_safe(r, n, &audit_rules_list[i], list) { 1449 int res = update_lsm_rule(r); 1450 if (!err) 1451 err = res; 1452 } 1453 } 1454 mutex_unlock(&audit_filter_mutex); 1455 1456 return err; 1457 } 1458