1 /* auditfilter.c -- filtering of audit events 2 * 3 * Copyright 2003-2004 Red Hat, Inc. 4 * Copyright 2005 Hewlett-Packard Development Company, L.P. 5 * Copyright 2005 IBM Corporation 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License as published by 9 * the Free Software Foundation; either version 2 of the License, or 10 * (at your option) any later version. 11 * 12 * This program is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * GNU General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License 18 * along with this program; if not, write to the Free Software 19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 20 */ 21 22 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 23 24 #include <linux/kernel.h> 25 #include <linux/audit.h> 26 #include <linux/kthread.h> 27 #include <linux/mutex.h> 28 #include <linux/fs.h> 29 #include <linux/namei.h> 30 #include <linux/netlink.h> 31 #include <linux/sched.h> 32 #include <linux/slab.h> 33 #include <linux/security.h> 34 #include <net/net_namespace.h> 35 #include <net/sock.h> 36 #include "audit.h" 37 38 /* 39 * Locking model: 40 * 41 * audit_filter_mutex: 42 * Synchronizes writes and blocking reads of audit's filterlist 43 * data. Rcu is used to traverse the filterlist and access 44 * contents of structs audit_entry, audit_watch and opaque 45 * LSM rules during filtering. If modified, these structures 46 * must be copied and replace their counterparts in the filterlist. 47 * An audit_parent struct is not accessed during filtering, so may 48 * be written directly provided audit_filter_mutex is held. 49 */ 50 51 /* Audit filter lists, defined in <linux/audit.h> */ 52 struct list_head audit_filter_list[AUDIT_NR_FILTERS] = { 53 LIST_HEAD_INIT(audit_filter_list[0]), 54 LIST_HEAD_INIT(audit_filter_list[1]), 55 LIST_HEAD_INIT(audit_filter_list[2]), 56 LIST_HEAD_INIT(audit_filter_list[3]), 57 LIST_HEAD_INIT(audit_filter_list[4]), 58 LIST_HEAD_INIT(audit_filter_list[5]), 59 LIST_HEAD_INIT(audit_filter_list[6]), 60 #if AUDIT_NR_FILTERS != 7 61 #error Fix audit_filter_list initialiser 62 #endif 63 }; 64 static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = { 65 LIST_HEAD_INIT(audit_rules_list[0]), 66 LIST_HEAD_INIT(audit_rules_list[1]), 67 LIST_HEAD_INIT(audit_rules_list[2]), 68 LIST_HEAD_INIT(audit_rules_list[3]), 69 LIST_HEAD_INIT(audit_rules_list[4]), 70 LIST_HEAD_INIT(audit_rules_list[5]), 71 LIST_HEAD_INIT(audit_rules_list[6]), 72 }; 73 74 DEFINE_MUTEX(audit_filter_mutex); 75 76 static void audit_free_lsm_field(struct audit_field *f) 77 { 78 switch (f->type) { 79 case AUDIT_SUBJ_USER: 80 case AUDIT_SUBJ_ROLE: 81 case AUDIT_SUBJ_TYPE: 82 case AUDIT_SUBJ_SEN: 83 case AUDIT_SUBJ_CLR: 84 case AUDIT_OBJ_USER: 85 case AUDIT_OBJ_ROLE: 86 case AUDIT_OBJ_TYPE: 87 case AUDIT_OBJ_LEV_LOW: 88 case AUDIT_OBJ_LEV_HIGH: 89 kfree(f->lsm_str); 90 security_audit_rule_free(f->lsm_rule); 91 } 92 } 93 94 static inline void audit_free_rule(struct audit_entry *e) 95 { 96 int i; 97 struct audit_krule *erule = &e->rule; 98 99 /* some rules don't have associated watches */ 100 if (erule->watch) 101 audit_put_watch(erule->watch); 102 if (erule->fields) 103 for (i = 0; i < erule->field_count; i++) 104 audit_free_lsm_field(&erule->fields[i]); 105 kfree(erule->fields); 106 kfree(erule->filterkey); 107 kfree(e); 108 } 109 110 void audit_free_rule_rcu(struct rcu_head *head) 111 { 112 struct audit_entry *e = container_of(head, struct audit_entry, rcu); 113 audit_free_rule(e); 114 } 115 116 /* Initialize an audit filterlist entry. */ 117 static inline struct audit_entry *audit_init_entry(u32 field_count) 118 { 119 struct audit_entry *entry; 120 struct audit_field *fields; 121 122 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 123 if (unlikely(!entry)) 124 return NULL; 125 126 fields = kcalloc(field_count, sizeof(*fields), GFP_KERNEL); 127 if (unlikely(!fields)) { 128 kfree(entry); 129 return NULL; 130 } 131 entry->rule.fields = fields; 132 133 return entry; 134 } 135 136 /* Unpack a filter field's string representation from user-space 137 * buffer. */ 138 char *audit_unpack_string(void **bufp, size_t *remain, size_t len) 139 { 140 char *str; 141 142 if (!*bufp || (len == 0) || (len > *remain)) 143 return ERR_PTR(-EINVAL); 144 145 /* Of the currently implemented string fields, PATH_MAX 146 * defines the longest valid length. 147 */ 148 if (len > PATH_MAX) 149 return ERR_PTR(-ENAMETOOLONG); 150 151 str = kmalloc(len + 1, GFP_KERNEL); 152 if (unlikely(!str)) 153 return ERR_PTR(-ENOMEM); 154 155 memcpy(str, *bufp, len); 156 str[len] = 0; 157 *bufp += len; 158 *remain -= len; 159 160 return str; 161 } 162 163 /* Translate an inode field to kernel representation. */ 164 static inline int audit_to_inode(struct audit_krule *krule, 165 struct audit_field *f) 166 { 167 if (krule->listnr != AUDIT_FILTER_EXIT || 168 krule->inode_f || krule->watch || krule->tree || 169 (f->op != Audit_equal && f->op != Audit_not_equal)) 170 return -EINVAL; 171 172 krule->inode_f = f; 173 return 0; 174 } 175 176 static __u32 *classes[AUDIT_SYSCALL_CLASSES]; 177 178 int __init audit_register_class(int class, unsigned *list) 179 { 180 __u32 *p = kcalloc(AUDIT_BITMASK_SIZE, sizeof(__u32), GFP_KERNEL); 181 if (!p) 182 return -ENOMEM; 183 while (*list != ~0U) { 184 unsigned n = *list++; 185 if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) { 186 kfree(p); 187 return -EINVAL; 188 } 189 p[AUDIT_WORD(n)] |= AUDIT_BIT(n); 190 } 191 if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) { 192 kfree(p); 193 return -EINVAL; 194 } 195 classes[class] = p; 196 return 0; 197 } 198 199 int audit_match_class(int class, unsigned syscall) 200 { 201 if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32)) 202 return 0; 203 if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class])) 204 return 0; 205 return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall); 206 } 207 208 #ifdef CONFIG_AUDITSYSCALL 209 static inline int audit_match_class_bits(int class, u32 *mask) 210 { 211 int i; 212 213 if (classes[class]) { 214 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 215 if (mask[i] & classes[class][i]) 216 return 0; 217 } 218 return 1; 219 } 220 221 static int audit_match_signal(struct audit_entry *entry) 222 { 223 struct audit_field *arch = entry->rule.arch_f; 224 225 if (!arch) { 226 /* When arch is unspecified, we must check both masks on biarch 227 * as syscall number alone is ambiguous. */ 228 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL, 229 entry->rule.mask) && 230 audit_match_class_bits(AUDIT_CLASS_SIGNAL_32, 231 entry->rule.mask)); 232 } 233 234 switch(audit_classify_arch(arch->val)) { 235 case 0: /* native */ 236 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL, 237 entry->rule.mask)); 238 case 1: /* 32bit on biarch */ 239 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32, 240 entry->rule.mask)); 241 default: 242 return 1; 243 } 244 } 245 #endif 246 247 /* Common user-space to kernel rule translation. */ 248 static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule) 249 { 250 unsigned listnr; 251 struct audit_entry *entry; 252 int i, err; 253 254 err = -EINVAL; 255 listnr = rule->flags & ~AUDIT_FILTER_PREPEND; 256 switch(listnr) { 257 default: 258 goto exit_err; 259 #ifdef CONFIG_AUDITSYSCALL 260 case AUDIT_FILTER_ENTRY: 261 if (rule->action == AUDIT_ALWAYS) 262 goto exit_err; 263 case AUDIT_FILTER_EXIT: 264 case AUDIT_FILTER_TASK: 265 #endif 266 case AUDIT_FILTER_USER: 267 case AUDIT_FILTER_TYPE: 268 case AUDIT_FILTER_FS: 269 ; 270 } 271 if (unlikely(rule->action == AUDIT_POSSIBLE)) { 272 pr_err("AUDIT_POSSIBLE is deprecated\n"); 273 goto exit_err; 274 } 275 if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS) 276 goto exit_err; 277 if (rule->field_count > AUDIT_MAX_FIELDS) 278 goto exit_err; 279 280 err = -ENOMEM; 281 entry = audit_init_entry(rule->field_count); 282 if (!entry) 283 goto exit_err; 284 285 entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND; 286 entry->rule.listnr = listnr; 287 entry->rule.action = rule->action; 288 entry->rule.field_count = rule->field_count; 289 290 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 291 entry->rule.mask[i] = rule->mask[i]; 292 293 for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) { 294 int bit = AUDIT_BITMASK_SIZE * 32 - i - 1; 295 __u32 *p = &entry->rule.mask[AUDIT_WORD(bit)]; 296 __u32 *class; 297 298 if (!(*p & AUDIT_BIT(bit))) 299 continue; 300 *p &= ~AUDIT_BIT(bit); 301 class = classes[i]; 302 if (class) { 303 int j; 304 for (j = 0; j < AUDIT_BITMASK_SIZE; j++) 305 entry->rule.mask[j] |= class[j]; 306 } 307 } 308 309 return entry; 310 311 exit_err: 312 return ERR_PTR(err); 313 } 314 315 static u32 audit_ops[] = 316 { 317 [Audit_equal] = AUDIT_EQUAL, 318 [Audit_not_equal] = AUDIT_NOT_EQUAL, 319 [Audit_bitmask] = AUDIT_BIT_MASK, 320 [Audit_bittest] = AUDIT_BIT_TEST, 321 [Audit_lt] = AUDIT_LESS_THAN, 322 [Audit_gt] = AUDIT_GREATER_THAN, 323 [Audit_le] = AUDIT_LESS_THAN_OR_EQUAL, 324 [Audit_ge] = AUDIT_GREATER_THAN_OR_EQUAL, 325 }; 326 327 static u32 audit_to_op(u32 op) 328 { 329 u32 n; 330 for (n = Audit_equal; n < Audit_bad && audit_ops[n] != op; n++) 331 ; 332 return n; 333 } 334 335 /* check if an audit field is valid */ 336 static int audit_field_valid(struct audit_entry *entry, struct audit_field *f) 337 { 338 switch(f->type) { 339 case AUDIT_MSGTYPE: 340 if (entry->rule.listnr != AUDIT_FILTER_TYPE && 341 entry->rule.listnr != AUDIT_FILTER_USER) 342 return -EINVAL; 343 break; 344 case AUDIT_FSTYPE: 345 if (entry->rule.listnr != AUDIT_FILTER_FS) 346 return -EINVAL; 347 break; 348 } 349 350 switch(entry->rule.listnr) { 351 case AUDIT_FILTER_FS: 352 switch(f->type) { 353 case AUDIT_FSTYPE: 354 case AUDIT_FILTERKEY: 355 break; 356 default: 357 return -EINVAL; 358 } 359 } 360 361 switch(f->type) { 362 default: 363 return -EINVAL; 364 case AUDIT_UID: 365 case AUDIT_EUID: 366 case AUDIT_SUID: 367 case AUDIT_FSUID: 368 case AUDIT_LOGINUID: 369 case AUDIT_OBJ_UID: 370 case AUDIT_GID: 371 case AUDIT_EGID: 372 case AUDIT_SGID: 373 case AUDIT_FSGID: 374 case AUDIT_OBJ_GID: 375 case AUDIT_PID: 376 case AUDIT_PERS: 377 case AUDIT_MSGTYPE: 378 case AUDIT_PPID: 379 case AUDIT_DEVMAJOR: 380 case AUDIT_DEVMINOR: 381 case AUDIT_EXIT: 382 case AUDIT_SUCCESS: 383 case AUDIT_INODE: 384 case AUDIT_SESSIONID: 385 /* bit ops are only useful on syscall args */ 386 if (f->op == Audit_bitmask || f->op == Audit_bittest) 387 return -EINVAL; 388 break; 389 case AUDIT_ARG0: 390 case AUDIT_ARG1: 391 case AUDIT_ARG2: 392 case AUDIT_ARG3: 393 case AUDIT_SUBJ_USER: 394 case AUDIT_SUBJ_ROLE: 395 case AUDIT_SUBJ_TYPE: 396 case AUDIT_SUBJ_SEN: 397 case AUDIT_SUBJ_CLR: 398 case AUDIT_OBJ_USER: 399 case AUDIT_OBJ_ROLE: 400 case AUDIT_OBJ_TYPE: 401 case AUDIT_OBJ_LEV_LOW: 402 case AUDIT_OBJ_LEV_HIGH: 403 case AUDIT_WATCH: 404 case AUDIT_DIR: 405 case AUDIT_FILTERKEY: 406 break; 407 case AUDIT_LOGINUID_SET: 408 if ((f->val != 0) && (f->val != 1)) 409 return -EINVAL; 410 /* FALL THROUGH */ 411 case AUDIT_ARCH: 412 case AUDIT_FSTYPE: 413 if (f->op != Audit_not_equal && f->op != Audit_equal) 414 return -EINVAL; 415 break; 416 case AUDIT_PERM: 417 if (f->val & ~15) 418 return -EINVAL; 419 break; 420 case AUDIT_FILETYPE: 421 if (f->val & ~S_IFMT) 422 return -EINVAL; 423 break; 424 case AUDIT_FIELD_COMPARE: 425 if (f->val > AUDIT_MAX_FIELD_COMPARE) 426 return -EINVAL; 427 break; 428 case AUDIT_EXE: 429 if (f->op != Audit_equal) 430 return -EINVAL; 431 if (entry->rule.listnr != AUDIT_FILTER_EXIT) 432 return -EINVAL; 433 break; 434 } 435 return 0; 436 } 437 438 /* Translate struct audit_rule_data to kernel's rule representation. */ 439 static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, 440 size_t datasz) 441 { 442 int err = 0; 443 struct audit_entry *entry; 444 void *bufp; 445 size_t remain = datasz - sizeof(struct audit_rule_data); 446 int i; 447 char *str; 448 struct audit_fsnotify_mark *audit_mark; 449 450 entry = audit_to_entry_common(data); 451 if (IS_ERR(entry)) 452 goto exit_nofree; 453 454 bufp = data->buf; 455 for (i = 0; i < data->field_count; i++) { 456 struct audit_field *f = &entry->rule.fields[i]; 457 458 err = -EINVAL; 459 460 f->op = audit_to_op(data->fieldflags[i]); 461 if (f->op == Audit_bad) 462 goto exit_free; 463 464 f->type = data->fields[i]; 465 f->val = data->values[i]; 466 467 /* Support legacy tests for a valid loginuid */ 468 if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) { 469 f->type = AUDIT_LOGINUID_SET; 470 f->val = 0; 471 entry->rule.pflags |= AUDIT_LOGINUID_LEGACY; 472 } 473 474 err = audit_field_valid(entry, f); 475 if (err) 476 goto exit_free; 477 478 err = -EINVAL; 479 switch (f->type) { 480 case AUDIT_LOGINUID: 481 case AUDIT_UID: 482 case AUDIT_EUID: 483 case AUDIT_SUID: 484 case AUDIT_FSUID: 485 case AUDIT_OBJ_UID: 486 f->uid = make_kuid(current_user_ns(), f->val); 487 if (!uid_valid(f->uid)) 488 goto exit_free; 489 break; 490 case AUDIT_GID: 491 case AUDIT_EGID: 492 case AUDIT_SGID: 493 case AUDIT_FSGID: 494 case AUDIT_OBJ_GID: 495 f->gid = make_kgid(current_user_ns(), f->val); 496 if (!gid_valid(f->gid)) 497 goto exit_free; 498 break; 499 case AUDIT_SESSIONID: 500 case AUDIT_ARCH: 501 entry->rule.arch_f = f; 502 break; 503 case AUDIT_SUBJ_USER: 504 case AUDIT_SUBJ_ROLE: 505 case AUDIT_SUBJ_TYPE: 506 case AUDIT_SUBJ_SEN: 507 case AUDIT_SUBJ_CLR: 508 case AUDIT_OBJ_USER: 509 case AUDIT_OBJ_ROLE: 510 case AUDIT_OBJ_TYPE: 511 case AUDIT_OBJ_LEV_LOW: 512 case AUDIT_OBJ_LEV_HIGH: 513 str = audit_unpack_string(&bufp, &remain, f->val); 514 if (IS_ERR(str)) 515 goto exit_free; 516 entry->rule.buflen += f->val; 517 518 err = security_audit_rule_init(f->type, f->op, str, 519 (void **)&f->lsm_rule); 520 /* Keep currently invalid fields around in case they 521 * become valid after a policy reload. */ 522 if (err == -EINVAL) { 523 pr_warn("audit rule for LSM \'%s\' is invalid\n", 524 str); 525 err = 0; 526 } 527 if (err) { 528 kfree(str); 529 goto exit_free; 530 } else 531 f->lsm_str = str; 532 break; 533 case AUDIT_WATCH: 534 str = audit_unpack_string(&bufp, &remain, f->val); 535 if (IS_ERR(str)) 536 goto exit_free; 537 entry->rule.buflen += f->val; 538 539 err = audit_to_watch(&entry->rule, str, f->val, f->op); 540 if (err) { 541 kfree(str); 542 goto exit_free; 543 } 544 break; 545 case AUDIT_DIR: 546 str = audit_unpack_string(&bufp, &remain, f->val); 547 if (IS_ERR(str)) 548 goto exit_free; 549 entry->rule.buflen += f->val; 550 551 err = audit_make_tree(&entry->rule, str, f->op); 552 kfree(str); 553 if (err) 554 goto exit_free; 555 break; 556 case AUDIT_INODE: 557 err = audit_to_inode(&entry->rule, f); 558 if (err) 559 goto exit_free; 560 break; 561 case AUDIT_FILTERKEY: 562 if (entry->rule.filterkey || f->val > AUDIT_MAX_KEY_LEN) 563 goto exit_free; 564 str = audit_unpack_string(&bufp, &remain, f->val); 565 if (IS_ERR(str)) 566 goto exit_free; 567 entry->rule.buflen += f->val; 568 entry->rule.filterkey = str; 569 break; 570 case AUDIT_EXE: 571 if (entry->rule.exe || f->val > PATH_MAX) 572 goto exit_free; 573 str = audit_unpack_string(&bufp, &remain, f->val); 574 if (IS_ERR(str)) { 575 err = PTR_ERR(str); 576 goto exit_free; 577 } 578 entry->rule.buflen += f->val; 579 580 audit_mark = audit_alloc_mark(&entry->rule, str, f->val); 581 if (IS_ERR(audit_mark)) { 582 kfree(str); 583 err = PTR_ERR(audit_mark); 584 goto exit_free; 585 } 586 entry->rule.exe = audit_mark; 587 break; 588 } 589 } 590 591 if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal) 592 entry->rule.inode_f = NULL; 593 594 exit_nofree: 595 return entry; 596 597 exit_free: 598 if (entry->rule.tree) 599 audit_put_tree(entry->rule.tree); /* that's the temporary one */ 600 if (entry->rule.exe) 601 audit_remove_mark(entry->rule.exe); /* that's the template one */ 602 audit_free_rule(entry); 603 return ERR_PTR(err); 604 } 605 606 /* Pack a filter field's string representation into data block. */ 607 static inline size_t audit_pack_string(void **bufp, const char *str) 608 { 609 size_t len = strlen(str); 610 611 memcpy(*bufp, str, len); 612 *bufp += len; 613 614 return len; 615 } 616 617 /* Translate kernel rule representation to struct audit_rule_data. */ 618 static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) 619 { 620 struct audit_rule_data *data; 621 void *bufp; 622 int i; 623 624 data = kmalloc(sizeof(*data) + krule->buflen, GFP_KERNEL); 625 if (unlikely(!data)) 626 return NULL; 627 memset(data, 0, sizeof(*data)); 628 629 data->flags = krule->flags | krule->listnr; 630 data->action = krule->action; 631 data->field_count = krule->field_count; 632 bufp = data->buf; 633 for (i = 0; i < data->field_count; i++) { 634 struct audit_field *f = &krule->fields[i]; 635 636 data->fields[i] = f->type; 637 data->fieldflags[i] = audit_ops[f->op]; 638 switch(f->type) { 639 case AUDIT_SUBJ_USER: 640 case AUDIT_SUBJ_ROLE: 641 case AUDIT_SUBJ_TYPE: 642 case AUDIT_SUBJ_SEN: 643 case AUDIT_SUBJ_CLR: 644 case AUDIT_OBJ_USER: 645 case AUDIT_OBJ_ROLE: 646 case AUDIT_OBJ_TYPE: 647 case AUDIT_OBJ_LEV_LOW: 648 case AUDIT_OBJ_LEV_HIGH: 649 data->buflen += data->values[i] = 650 audit_pack_string(&bufp, f->lsm_str); 651 break; 652 case AUDIT_WATCH: 653 data->buflen += data->values[i] = 654 audit_pack_string(&bufp, 655 audit_watch_path(krule->watch)); 656 break; 657 case AUDIT_DIR: 658 data->buflen += data->values[i] = 659 audit_pack_string(&bufp, 660 audit_tree_path(krule->tree)); 661 break; 662 case AUDIT_FILTERKEY: 663 data->buflen += data->values[i] = 664 audit_pack_string(&bufp, krule->filterkey); 665 break; 666 case AUDIT_EXE: 667 data->buflen += data->values[i] = 668 audit_pack_string(&bufp, audit_mark_path(krule->exe)); 669 break; 670 case AUDIT_LOGINUID_SET: 671 if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) { 672 data->fields[i] = AUDIT_LOGINUID; 673 data->values[i] = AUDIT_UID_UNSET; 674 break; 675 } 676 /* fallthrough if set */ 677 default: 678 data->values[i] = f->val; 679 } 680 } 681 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i]; 682 683 return data; 684 } 685 686 /* Compare two rules in kernel format. Considered success if rules 687 * don't match. */ 688 static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b) 689 { 690 int i; 691 692 if (a->flags != b->flags || 693 a->pflags != b->pflags || 694 a->listnr != b->listnr || 695 a->action != b->action || 696 a->field_count != b->field_count) 697 return 1; 698 699 for (i = 0; i < a->field_count; i++) { 700 if (a->fields[i].type != b->fields[i].type || 701 a->fields[i].op != b->fields[i].op) 702 return 1; 703 704 switch(a->fields[i].type) { 705 case AUDIT_SUBJ_USER: 706 case AUDIT_SUBJ_ROLE: 707 case AUDIT_SUBJ_TYPE: 708 case AUDIT_SUBJ_SEN: 709 case AUDIT_SUBJ_CLR: 710 case AUDIT_OBJ_USER: 711 case AUDIT_OBJ_ROLE: 712 case AUDIT_OBJ_TYPE: 713 case AUDIT_OBJ_LEV_LOW: 714 case AUDIT_OBJ_LEV_HIGH: 715 if (strcmp(a->fields[i].lsm_str, b->fields[i].lsm_str)) 716 return 1; 717 break; 718 case AUDIT_WATCH: 719 if (strcmp(audit_watch_path(a->watch), 720 audit_watch_path(b->watch))) 721 return 1; 722 break; 723 case AUDIT_DIR: 724 if (strcmp(audit_tree_path(a->tree), 725 audit_tree_path(b->tree))) 726 return 1; 727 break; 728 case AUDIT_FILTERKEY: 729 /* both filterkeys exist based on above type compare */ 730 if (strcmp(a->filterkey, b->filterkey)) 731 return 1; 732 break; 733 case AUDIT_EXE: 734 /* both paths exist based on above type compare */ 735 if (strcmp(audit_mark_path(a->exe), 736 audit_mark_path(b->exe))) 737 return 1; 738 break; 739 case AUDIT_UID: 740 case AUDIT_EUID: 741 case AUDIT_SUID: 742 case AUDIT_FSUID: 743 case AUDIT_LOGINUID: 744 case AUDIT_OBJ_UID: 745 if (!uid_eq(a->fields[i].uid, b->fields[i].uid)) 746 return 1; 747 break; 748 case AUDIT_GID: 749 case AUDIT_EGID: 750 case AUDIT_SGID: 751 case AUDIT_FSGID: 752 case AUDIT_OBJ_GID: 753 if (!gid_eq(a->fields[i].gid, b->fields[i].gid)) 754 return 1; 755 break; 756 default: 757 if (a->fields[i].val != b->fields[i].val) 758 return 1; 759 } 760 } 761 762 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 763 if (a->mask[i] != b->mask[i]) 764 return 1; 765 766 return 0; 767 } 768 769 /* Duplicate LSM field information. The lsm_rule is opaque, so must be 770 * re-initialized. */ 771 static inline int audit_dupe_lsm_field(struct audit_field *df, 772 struct audit_field *sf) 773 { 774 int ret = 0; 775 char *lsm_str; 776 777 /* our own copy of lsm_str */ 778 lsm_str = kstrdup(sf->lsm_str, GFP_KERNEL); 779 if (unlikely(!lsm_str)) 780 return -ENOMEM; 781 df->lsm_str = lsm_str; 782 783 /* our own (refreshed) copy of lsm_rule */ 784 ret = security_audit_rule_init(df->type, df->op, df->lsm_str, 785 (void **)&df->lsm_rule); 786 /* Keep currently invalid fields around in case they 787 * become valid after a policy reload. */ 788 if (ret == -EINVAL) { 789 pr_warn("audit rule for LSM \'%s\' is invalid\n", 790 df->lsm_str); 791 ret = 0; 792 } 793 794 return ret; 795 } 796 797 /* Duplicate an audit rule. This will be a deep copy with the exception 798 * of the watch - that pointer is carried over. The LSM specific fields 799 * will be updated in the copy. The point is to be able to replace the old 800 * rule with the new rule in the filterlist, then free the old rule. 801 * The rlist element is undefined; list manipulations are handled apart from 802 * the initial copy. */ 803 struct audit_entry *audit_dupe_rule(struct audit_krule *old) 804 { 805 u32 fcount = old->field_count; 806 struct audit_entry *entry; 807 struct audit_krule *new; 808 char *fk; 809 int i, err = 0; 810 811 entry = audit_init_entry(fcount); 812 if (unlikely(!entry)) 813 return ERR_PTR(-ENOMEM); 814 815 new = &entry->rule; 816 new->flags = old->flags; 817 new->pflags = old->pflags; 818 new->listnr = old->listnr; 819 new->action = old->action; 820 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 821 new->mask[i] = old->mask[i]; 822 new->prio = old->prio; 823 new->buflen = old->buflen; 824 new->inode_f = old->inode_f; 825 new->field_count = old->field_count; 826 827 /* 828 * note that we are OK with not refcounting here; audit_match_tree() 829 * never dereferences tree and we can't get false positives there 830 * since we'd have to have rule gone from the list *and* removed 831 * before the chunks found by lookup had been allocated, i.e. before 832 * the beginning of list scan. 833 */ 834 new->tree = old->tree; 835 memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount); 836 837 /* deep copy this information, updating the lsm_rule fields, because 838 * the originals will all be freed when the old rule is freed. */ 839 for (i = 0; i < fcount; i++) { 840 switch (new->fields[i].type) { 841 case AUDIT_SUBJ_USER: 842 case AUDIT_SUBJ_ROLE: 843 case AUDIT_SUBJ_TYPE: 844 case AUDIT_SUBJ_SEN: 845 case AUDIT_SUBJ_CLR: 846 case AUDIT_OBJ_USER: 847 case AUDIT_OBJ_ROLE: 848 case AUDIT_OBJ_TYPE: 849 case AUDIT_OBJ_LEV_LOW: 850 case AUDIT_OBJ_LEV_HIGH: 851 err = audit_dupe_lsm_field(&new->fields[i], 852 &old->fields[i]); 853 break; 854 case AUDIT_FILTERKEY: 855 fk = kstrdup(old->filterkey, GFP_KERNEL); 856 if (unlikely(!fk)) 857 err = -ENOMEM; 858 else 859 new->filterkey = fk; 860 break; 861 case AUDIT_EXE: 862 err = audit_dupe_exe(new, old); 863 break; 864 } 865 if (err) { 866 if (new->exe) 867 audit_remove_mark(new->exe); 868 audit_free_rule(entry); 869 return ERR_PTR(err); 870 } 871 } 872 873 if (old->watch) { 874 audit_get_watch(old->watch); 875 new->watch = old->watch; 876 } 877 878 return entry; 879 } 880 881 /* Find an existing audit rule. 882 * Caller must hold audit_filter_mutex to prevent stale rule data. */ 883 static struct audit_entry *audit_find_rule(struct audit_entry *entry, 884 struct list_head **p) 885 { 886 struct audit_entry *e, *found = NULL; 887 struct list_head *list; 888 int h; 889 890 if (entry->rule.inode_f) { 891 h = audit_hash_ino(entry->rule.inode_f->val); 892 *p = list = &audit_inode_hash[h]; 893 } else if (entry->rule.watch) { 894 /* we don't know the inode number, so must walk entire hash */ 895 for (h = 0; h < AUDIT_INODE_BUCKETS; h++) { 896 list = &audit_inode_hash[h]; 897 list_for_each_entry(e, list, list) 898 if (!audit_compare_rule(&entry->rule, &e->rule)) { 899 found = e; 900 goto out; 901 } 902 } 903 goto out; 904 } else { 905 *p = list = &audit_filter_list[entry->rule.listnr]; 906 } 907 908 list_for_each_entry(e, list, list) 909 if (!audit_compare_rule(&entry->rule, &e->rule)) { 910 found = e; 911 goto out; 912 } 913 914 out: 915 return found; 916 } 917 918 static u64 prio_low = ~0ULL/2; 919 static u64 prio_high = ~0ULL/2 - 1; 920 921 /* Add rule to given filterlist if not a duplicate. */ 922 static inline int audit_add_rule(struct audit_entry *entry) 923 { 924 struct audit_entry *e; 925 struct audit_watch *watch = entry->rule.watch; 926 struct audit_tree *tree = entry->rule.tree; 927 struct list_head *list; 928 int err = 0; 929 #ifdef CONFIG_AUDITSYSCALL 930 int dont_count = 0; 931 932 /* If any of these, don't count towards total */ 933 switch(entry->rule.listnr) { 934 case AUDIT_FILTER_USER: 935 case AUDIT_FILTER_TYPE: 936 case AUDIT_FILTER_FS: 937 dont_count = 1; 938 } 939 #endif 940 941 mutex_lock(&audit_filter_mutex); 942 e = audit_find_rule(entry, &list); 943 if (e) { 944 mutex_unlock(&audit_filter_mutex); 945 err = -EEXIST; 946 /* normally audit_add_tree_rule() will free it on failure */ 947 if (tree) 948 audit_put_tree(tree); 949 return err; 950 } 951 952 if (watch) { 953 /* audit_filter_mutex is dropped and re-taken during this call */ 954 err = audit_add_watch(&entry->rule, &list); 955 if (err) { 956 mutex_unlock(&audit_filter_mutex); 957 /* 958 * normally audit_add_tree_rule() will free it 959 * on failure 960 */ 961 if (tree) 962 audit_put_tree(tree); 963 return err; 964 } 965 } 966 if (tree) { 967 err = audit_add_tree_rule(&entry->rule); 968 if (err) { 969 mutex_unlock(&audit_filter_mutex); 970 return err; 971 } 972 } 973 974 entry->rule.prio = ~0ULL; 975 if (entry->rule.listnr == AUDIT_FILTER_EXIT) { 976 if (entry->rule.flags & AUDIT_FILTER_PREPEND) 977 entry->rule.prio = ++prio_high; 978 else 979 entry->rule.prio = --prio_low; 980 } 981 982 if (entry->rule.flags & AUDIT_FILTER_PREPEND) { 983 list_add(&entry->rule.list, 984 &audit_rules_list[entry->rule.listnr]); 985 list_add_rcu(&entry->list, list); 986 entry->rule.flags &= ~AUDIT_FILTER_PREPEND; 987 } else { 988 list_add_tail(&entry->rule.list, 989 &audit_rules_list[entry->rule.listnr]); 990 list_add_tail_rcu(&entry->list, list); 991 } 992 #ifdef CONFIG_AUDITSYSCALL 993 if (!dont_count) 994 audit_n_rules++; 995 996 if (!audit_match_signal(entry)) 997 audit_signals++; 998 #endif 999 mutex_unlock(&audit_filter_mutex); 1000 1001 return err; 1002 } 1003 1004 /* Remove an existing rule from filterlist. */ 1005 int audit_del_rule(struct audit_entry *entry) 1006 { 1007 struct audit_entry *e; 1008 struct audit_tree *tree = entry->rule.tree; 1009 struct list_head *list; 1010 int ret = 0; 1011 #ifdef CONFIG_AUDITSYSCALL 1012 int dont_count = 0; 1013 1014 /* If any of these, don't count towards total */ 1015 switch(entry->rule.listnr) { 1016 case AUDIT_FILTER_USER: 1017 case AUDIT_FILTER_TYPE: 1018 case AUDIT_FILTER_FS: 1019 dont_count = 1; 1020 } 1021 #endif 1022 1023 mutex_lock(&audit_filter_mutex); 1024 e = audit_find_rule(entry, &list); 1025 if (!e) { 1026 ret = -ENOENT; 1027 goto out; 1028 } 1029 1030 if (e->rule.watch) 1031 audit_remove_watch_rule(&e->rule); 1032 1033 if (e->rule.tree) 1034 audit_remove_tree_rule(&e->rule); 1035 1036 if (e->rule.exe) 1037 audit_remove_mark_rule(&e->rule); 1038 1039 #ifdef CONFIG_AUDITSYSCALL 1040 if (!dont_count) 1041 audit_n_rules--; 1042 1043 if (!audit_match_signal(entry)) 1044 audit_signals--; 1045 #endif 1046 1047 list_del_rcu(&e->list); 1048 list_del(&e->rule.list); 1049 call_rcu(&e->rcu, audit_free_rule_rcu); 1050 1051 out: 1052 mutex_unlock(&audit_filter_mutex); 1053 1054 if (tree) 1055 audit_put_tree(tree); /* that's the temporary one */ 1056 1057 return ret; 1058 } 1059 1060 /* List rules using struct audit_rule_data. */ 1061 static void audit_list_rules(int seq, struct sk_buff_head *q) 1062 { 1063 struct sk_buff *skb; 1064 struct audit_krule *r; 1065 int i; 1066 1067 /* This is a blocking read, so use audit_filter_mutex instead of rcu 1068 * iterator to sync with list writers. */ 1069 for (i=0; i<AUDIT_NR_FILTERS; i++) { 1070 list_for_each_entry(r, &audit_rules_list[i], list) { 1071 struct audit_rule_data *data; 1072 1073 data = audit_krule_to_data(r); 1074 if (unlikely(!data)) 1075 break; 1076 skb = audit_make_reply(seq, AUDIT_LIST_RULES, 0, 1, 1077 data, 1078 sizeof(*data) + data->buflen); 1079 if (skb) 1080 skb_queue_tail(q, skb); 1081 kfree(data); 1082 } 1083 } 1084 skb = audit_make_reply(seq, AUDIT_LIST_RULES, 1, 1, NULL, 0); 1085 if (skb) 1086 skb_queue_tail(q, skb); 1087 } 1088 1089 /* Log rule additions and removals */ 1090 static void audit_log_rule_change(char *action, struct audit_krule *rule, int res) 1091 { 1092 struct audit_buffer *ab; 1093 uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(current)); 1094 unsigned int sessionid = audit_get_sessionid(current); 1095 1096 if (!audit_enabled) 1097 return; 1098 1099 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE); 1100 if (!ab) 1101 return; 1102 audit_log_format(ab, "auid=%u ses=%u" ,loginuid, sessionid); 1103 audit_log_task_context(ab); 1104 audit_log_format(ab, " op=%s", action); 1105 audit_log_key(ab, rule->filterkey); 1106 audit_log_format(ab, " list=%d res=%d", rule->listnr, res); 1107 audit_log_end(ab); 1108 } 1109 1110 /** 1111 * audit_rule_change - apply all rules to the specified message type 1112 * @type: audit message type 1113 * @seq: netlink audit message sequence (serial) number 1114 * @data: payload data 1115 * @datasz: size of payload data 1116 */ 1117 int audit_rule_change(int type, int seq, void *data, size_t datasz) 1118 { 1119 int err = 0; 1120 struct audit_entry *entry; 1121 1122 entry = audit_data_to_entry(data, datasz); 1123 if (IS_ERR(entry)) 1124 return PTR_ERR(entry); 1125 1126 switch (type) { 1127 case AUDIT_ADD_RULE: 1128 err = audit_add_rule(entry); 1129 audit_log_rule_change("add_rule", &entry->rule, !err); 1130 break; 1131 case AUDIT_DEL_RULE: 1132 err = audit_del_rule(entry); 1133 audit_log_rule_change("remove_rule", &entry->rule, !err); 1134 break; 1135 default: 1136 err = -EINVAL; 1137 WARN_ON(1); 1138 } 1139 1140 if (err || type == AUDIT_DEL_RULE) { 1141 if (entry->rule.exe) 1142 audit_remove_mark(entry->rule.exe); 1143 audit_free_rule(entry); 1144 } 1145 1146 return err; 1147 } 1148 1149 /** 1150 * audit_list_rules_send - list the audit rules 1151 * @request_skb: skb of request we are replying to (used to target the reply) 1152 * @seq: netlink audit message sequence (serial) number 1153 */ 1154 int audit_list_rules_send(struct sk_buff *request_skb, int seq) 1155 { 1156 u32 portid = NETLINK_CB(request_skb).portid; 1157 struct net *net = sock_net(NETLINK_CB(request_skb).sk); 1158 struct task_struct *tsk; 1159 struct audit_netlink_list *dest; 1160 int err = 0; 1161 1162 /* We can't just spew out the rules here because we might fill 1163 * the available socket buffer space and deadlock waiting for 1164 * auditctl to read from it... which isn't ever going to 1165 * happen if we're actually running in the context of auditctl 1166 * trying to _send_ the stuff */ 1167 1168 dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL); 1169 if (!dest) 1170 return -ENOMEM; 1171 dest->net = get_net(net); 1172 dest->portid = portid; 1173 skb_queue_head_init(&dest->q); 1174 1175 mutex_lock(&audit_filter_mutex); 1176 audit_list_rules(seq, &dest->q); 1177 mutex_unlock(&audit_filter_mutex); 1178 1179 tsk = kthread_run(audit_send_list, dest, "audit_send_list"); 1180 if (IS_ERR(tsk)) { 1181 skb_queue_purge(&dest->q); 1182 kfree(dest); 1183 err = PTR_ERR(tsk); 1184 } 1185 1186 return err; 1187 } 1188 1189 int audit_comparator(u32 left, u32 op, u32 right) 1190 { 1191 switch (op) { 1192 case Audit_equal: 1193 return (left == right); 1194 case Audit_not_equal: 1195 return (left != right); 1196 case Audit_lt: 1197 return (left < right); 1198 case Audit_le: 1199 return (left <= right); 1200 case Audit_gt: 1201 return (left > right); 1202 case Audit_ge: 1203 return (left >= right); 1204 case Audit_bitmask: 1205 return (left & right); 1206 case Audit_bittest: 1207 return ((left & right) == right); 1208 default: 1209 BUG(); 1210 return 0; 1211 } 1212 } 1213 1214 int audit_uid_comparator(kuid_t left, u32 op, kuid_t right) 1215 { 1216 switch (op) { 1217 case Audit_equal: 1218 return uid_eq(left, right); 1219 case Audit_not_equal: 1220 return !uid_eq(left, right); 1221 case Audit_lt: 1222 return uid_lt(left, right); 1223 case Audit_le: 1224 return uid_lte(left, right); 1225 case Audit_gt: 1226 return uid_gt(left, right); 1227 case Audit_ge: 1228 return uid_gte(left, right); 1229 case Audit_bitmask: 1230 case Audit_bittest: 1231 default: 1232 BUG(); 1233 return 0; 1234 } 1235 } 1236 1237 int audit_gid_comparator(kgid_t left, u32 op, kgid_t right) 1238 { 1239 switch (op) { 1240 case Audit_equal: 1241 return gid_eq(left, right); 1242 case Audit_not_equal: 1243 return !gid_eq(left, right); 1244 case Audit_lt: 1245 return gid_lt(left, right); 1246 case Audit_le: 1247 return gid_lte(left, right); 1248 case Audit_gt: 1249 return gid_gt(left, right); 1250 case Audit_ge: 1251 return gid_gte(left, right); 1252 case Audit_bitmask: 1253 case Audit_bittest: 1254 default: 1255 BUG(); 1256 return 0; 1257 } 1258 } 1259 1260 /** 1261 * parent_len - find the length of the parent portion of a pathname 1262 * @path: pathname of which to determine length 1263 */ 1264 int parent_len(const char *path) 1265 { 1266 int plen; 1267 const char *p; 1268 1269 plen = strlen(path); 1270 1271 if (plen == 0) 1272 return plen; 1273 1274 /* disregard trailing slashes */ 1275 p = path + plen - 1; 1276 while ((*p == '/') && (p > path)) 1277 p--; 1278 1279 /* walk backward until we find the next slash or hit beginning */ 1280 while ((*p != '/') && (p > path)) 1281 p--; 1282 1283 /* did we find a slash? Then increment to include it in path */ 1284 if (*p == '/') 1285 p++; 1286 1287 return p - path; 1288 } 1289 1290 /** 1291 * audit_compare_dname_path - compare given dentry name with last component in 1292 * given path. Return of 0 indicates a match. 1293 * @dname: dentry name that we're comparing 1294 * @path: full pathname that we're comparing 1295 * @parentlen: length of the parent if known. Passing in AUDIT_NAME_FULL 1296 * here indicates that we must compute this value. 1297 */ 1298 int audit_compare_dname_path(const char *dname, const char *path, int parentlen) 1299 { 1300 int dlen, pathlen; 1301 const char *p; 1302 1303 dlen = strlen(dname); 1304 pathlen = strlen(path); 1305 if (pathlen < dlen) 1306 return 1; 1307 1308 parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen; 1309 if (pathlen - parentlen != dlen) 1310 return 1; 1311 1312 p = path + parentlen; 1313 1314 return strncmp(p, dname, dlen); 1315 } 1316 1317 int audit_filter(int msgtype, unsigned int listtype) 1318 { 1319 struct audit_entry *e; 1320 int ret = 1; /* Audit by default */ 1321 1322 rcu_read_lock(); 1323 if (list_empty(&audit_filter_list[listtype])) 1324 goto unlock_and_return; 1325 list_for_each_entry_rcu(e, &audit_filter_list[listtype], list) { 1326 int i, result = 0; 1327 1328 for (i = 0; i < e->rule.field_count; i++) { 1329 struct audit_field *f = &e->rule.fields[i]; 1330 pid_t pid; 1331 u32 sid; 1332 1333 switch (f->type) { 1334 case AUDIT_PID: 1335 pid = task_pid_nr(current); 1336 result = audit_comparator(pid, f->op, f->val); 1337 break; 1338 case AUDIT_UID: 1339 result = audit_uid_comparator(current_uid(), f->op, f->uid); 1340 break; 1341 case AUDIT_GID: 1342 result = audit_gid_comparator(current_gid(), f->op, f->gid); 1343 break; 1344 case AUDIT_LOGINUID: 1345 result = audit_uid_comparator(audit_get_loginuid(current), 1346 f->op, f->uid); 1347 break; 1348 case AUDIT_LOGINUID_SET: 1349 result = audit_comparator(audit_loginuid_set(current), 1350 f->op, f->val); 1351 break; 1352 case AUDIT_MSGTYPE: 1353 result = audit_comparator(msgtype, f->op, f->val); 1354 break; 1355 case AUDIT_SUBJ_USER: 1356 case AUDIT_SUBJ_ROLE: 1357 case AUDIT_SUBJ_TYPE: 1358 case AUDIT_SUBJ_SEN: 1359 case AUDIT_SUBJ_CLR: 1360 if (f->lsm_rule) { 1361 security_task_getsecid(current, &sid); 1362 result = security_audit_rule_match(sid, 1363 f->type, f->op, f->lsm_rule, NULL); 1364 } 1365 break; 1366 default: 1367 goto unlock_and_return; 1368 } 1369 if (result < 0) /* error */ 1370 goto unlock_and_return; 1371 if (!result) 1372 break; 1373 } 1374 if (result > 0) { 1375 if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_TYPE) 1376 ret = 0; 1377 break; 1378 } 1379 } 1380 unlock_and_return: 1381 rcu_read_unlock(); 1382 return ret; 1383 } 1384 1385 static int update_lsm_rule(struct audit_krule *r) 1386 { 1387 struct audit_entry *entry = container_of(r, struct audit_entry, rule); 1388 struct audit_entry *nentry; 1389 int err = 0; 1390 1391 if (!security_audit_rule_known(r)) 1392 return 0; 1393 1394 nentry = audit_dupe_rule(r); 1395 if (entry->rule.exe) 1396 audit_remove_mark(entry->rule.exe); 1397 if (IS_ERR(nentry)) { 1398 /* save the first error encountered for the 1399 * return value */ 1400 err = PTR_ERR(nentry); 1401 audit_panic("error updating LSM filters"); 1402 if (r->watch) 1403 list_del(&r->rlist); 1404 list_del_rcu(&entry->list); 1405 list_del(&r->list); 1406 } else { 1407 if (r->watch || r->tree) 1408 list_replace_init(&r->rlist, &nentry->rule.rlist); 1409 list_replace_rcu(&entry->list, &nentry->list); 1410 list_replace(&r->list, &nentry->rule.list); 1411 } 1412 call_rcu(&entry->rcu, audit_free_rule_rcu); 1413 1414 return err; 1415 } 1416 1417 /* This function will re-initialize the lsm_rule field of all applicable rules. 1418 * It will traverse the filter lists serarching for rules that contain LSM 1419 * specific filter fields. When such a rule is found, it is copied, the 1420 * LSM field is re-initialized, and the old rule is replaced with the 1421 * updated rule. */ 1422 int audit_update_lsm_rules(void) 1423 { 1424 struct audit_krule *r, *n; 1425 int i, err = 0; 1426 1427 /* audit_filter_mutex synchronizes the writers */ 1428 mutex_lock(&audit_filter_mutex); 1429 1430 for (i = 0; i < AUDIT_NR_FILTERS; i++) { 1431 list_for_each_entry_safe(r, n, &audit_rules_list[i], list) { 1432 int res = update_lsm_rule(r); 1433 if (!err) 1434 err = res; 1435 } 1436 } 1437 mutex_unlock(&audit_filter_mutex); 1438 1439 return err; 1440 } 1441