Re: [RFC][PATCH 1/3] (#7) updated file system auditing patches

On Friday 15 April 2005 18:56, Amy Griffis wrote: Oops. -tim diff -Nurp linux-2.6.9~orig/fs/dcache.c linux-2.6.9~audit/fs/dcache.c --- linux-2.6.9~orig/fs/dcache.c 2005-04-13 20:38:29.000000000 +0000 +++ linux-2.6.9~audit/fs/dcache.c 2005-04-13 18:46:31.000000000 +0000 @@ -31,6 +31,7 @@ #include <linux/seqlock.h> #include <linux/swap.h> #include <linux/bootmem.h> +#include <linux/audit.h> /* #define DCACHE_DEBUG 1 */ @@ -99,6 +100,7 @@ static inline void dentry_iput(struct de { struct inode *inode = dentry->d_inode; if (inode) { + audit_attach_watch(dentry, 1); dentry->d_inode = NULL; list_del_init(&dentry->d_alias); spin_unlock(&dentry->d_lock); @@ -776,6 +778,7 @@ void d_instantiate(struct dentry *entry, if (inode) list_add(&entry->d_alias, &inode->i_dentry); entry->d_inode = inode; + audit_attach_watch(entry, 0); spin_unlock(&dcache_lock); security_d_instantiate(entry, inode); } @@ -910,6 +913,7 @@ struct dentry *d_splice_alias(struct ino new = __d_find_alias(inode, 1); if (new) { BUG_ON(!(new->d_flags & DCACHE_DISCONNECTED)); + audit_attach_watch(new, 0); spin_unlock(&dcache_lock); security_d_instantiate(new, inode); d_rehash(dentry); @@ -919,6 +923,7 @@ struct dentry *d_splice_alias(struct ino /* d_instantiate takes dcache_lock, so we do it by hand */ list_add(&dentry->d_alias, &inode->i_dentry); dentry->d_inode = inode; + audit_attach_watch(dentry, 0); spin_unlock(&dcache_lock); security_d_instantiate(dentry, inode); d_rehash(dentry); @@ -1027,6 +1032,7 @@ struct dentry * __d_lookup(struct dentry if (!d_unhashed(dentry)) { atomic_inc(&dentry->d_count); found = dentry; + audit_attach_watch(found, 0); } terminate: spin_unlock(&dentry->d_lock); @@ -1230,6 +1236,8 @@ void d_move(struct dentry * dentry, stru spin_lock(&target->d_lock); } + audit_attach_watch(dentry, 1); + /* Move the dentry to the target hash queue, if on different bucket */ if (dentry->d_flags & DCACHE_UNHASHED) goto already_unhashed; @@ -1275,6 +1283,7 @@ already_unhashed: list_add(&target->d_child, &target->d_parent->d_subdirs); } + audit_attach_watch(dentry, 0); list_add(&dentry->d_child, &dentry->d_parent->d_subdirs); spin_unlock(&target->d_lock); spin_unlock(&dentry->d_lock); diff -Nurp linux-2.6.9~orig/fs/inode.c linux-2.6.9~audit/fs/inode.c --- linux-2.6.9~orig/fs/inode.c 2004-10-18 21:55:29.000000000 +0000 +++ linux-2.6.9~audit/fs/inode.c 2005-04-13 18:46:31.000000000 +0000 @@ -21,6 +21,7 @@ #include <linux/pagemap.h> #include <linux/cdev.h> #include <linux/bootmem.h> +#include <linux/audit.h> /* * This is needed for the following functions: @@ -134,9 +135,11 @@ static struct inode *alloc_inode(struct inode->i_bdev = NULL; inode->i_cdev = NULL; inode->i_rdev = 0; + inode->i_audit = NULL; inode->i_security = NULL; inode->dirtied_when = 0; - if (security_inode_alloc(inode)) { + if (audit_inode_alloc(inode) || security_inode_alloc(inode)) { + audit_inode_free(inode); if (inode->i_sb->s_op->destroy_inode) inode->i_sb->s_op->destroy_inode(inode); else @@ -174,6 +177,7 @@ void destroy_inode(struct inode *inode) { if (inode_has_buffers(inode)) BUG(); + audit_inode_free(inode); security_inode_free(inode); if (inode->i_sb->s_op->destroy_inode) inode->i_sb->s_op->destroy_inode(inode); diff -Nurp linux-2.6.9~orig/fs/namei.c linux-2.6.9~audit/fs/namei.c --- linux-2.6.9~orig/fs/namei.c 2005-04-13 20:38:29.000000000 +0000 +++ linux-2.6.9~audit/fs/namei.c 2005-04-13 18:46:31.000000000 +0000 @@ -216,6 +216,8 @@ int permission(struct inode * inode,int /* Ordinary permission routines do not understand MAY_APPEND. */ submask = mask & ~MAY_APPEND; + audit_notify_watch(inode, mask); + if (inode->i_op && inode->i_op->permission) retval = inode->i_op->permission(inode, submask, nd); else @@ -329,6 +331,8 @@ static inline int exec_permission_lite(s if (inode->i_op && inode->i_op->permission) return -EAGAIN; + audit_notify_watch(inode, MAY_EXEC); + if (current->fsuid == inode->i_uid) mode >>= 6; else if (in_group_p(inode->i_gid)) @@ -1109,6 +1113,8 @@ static inline int may_delete(struct inod BUG_ON(victim->d_parent->d_inode != dir); + audit_notify_watch(victim->d_inode, MAY_WRITE); + error = permission(dir,MAY_WRITE | MAY_EXEC, NULL); if (error) return error; @@ -1235,6 +1241,7 @@ int vfs_create(struct inode *dir, struct DQUOT_INIT(dir); error = dir->i_op->create(dir, dentry, mode, nd); if (!error) { + audit_notify_watch(dentry->d_inode, MAY_WRITE); inode_dir_notify(dir, DN_CREATE); security_inode_post_create(dir, dentry, mode); } @@ -1549,6 +1556,7 @@ int vfs_mknod(struct inode *dir, struct DQUOT_INIT(dir); error = dir->i_op->mknod(dir, dentry, mode, dev); if (!error) { + audit_notify_watch(dentry->d_inode, MAY_WRITE); inode_dir_notify(dir, DN_CREATE); security_inode_post_mknod(dir, dentry, mode, dev); } @@ -1622,6 +1630,7 @@ int vfs_mkdir(struct inode *dir, struct DQUOT_INIT(dir); error = dir->i_op->mkdir(dir, dentry, mode); if (!error) { + audit_notify_watch(dentry->d_inode, MAY_WRITE); inode_dir_notify(dir, DN_CREATE); security_inode_post_mkdir(dir,dentry, mode); } @@ -1866,6 +1875,7 @@ int vfs_symlink(struct inode *dir, struc DQUOT_INIT(dir); error = dir->i_op->symlink(dir, dentry, oldname); if (!error) { + audit_notify_watch(dentry->d_inode, MAY_WRITE); inode_dir_notify(dir, DN_CREATE); security_inode_post_symlink(dir, dentry, oldname); } @@ -1939,6 +1949,7 @@ int vfs_link(struct dentry *old_dentry, error = dir->i_op->link(old_dentry, dir, new_dentry); up(&old_dentry->d_inode->i_sem); if (!error) { + audit_notify_watch(new_dentry->d_inode, MAY_WRITE); inode_dir_notify(dir, DN_CREATE); security_inode_post_link(old_dentry, dir, new_dentry); } @@ -2062,6 +2073,7 @@ int vfs_rename_dir(struct inode *old_dir } if (!error) { d_move(old_dentry,new_dentry); + audit_notify_watch(old_dentry->d_inode, MAY_WRITE); security_inode_post_rename(old_dir, old_dentry, new_dir, new_dentry); } @@ -2090,6 +2102,7 @@ int vfs_rename_other(struct inode *old_d /* The following d_move() should become unconditional */ if (!(old_dir->i_sb->s_type->fs_flags & FS_ODD_RENAME)) d_move(old_dentry, new_dentry); + audit_notify_watch(old_dentry->d_inode, MAY_WRITE); security_inode_post_rename(old_dir, old_dentry, new_dir, new_dentry); } if (target) diff -Nurp linux-2.6.9~orig/include/linux/audit.h linux-2.6.9~audit/include/linux/audit.h --- linux-2.6.9~orig/include/linux/audit.h 2005-04-13 20:38:29.000000000 +0000 +++ linux-2.6.9~audit/include/linux/audit.h 2005-04-13 18:54:15.000000000 +0000 @@ -28,14 +28,17 @@ #include <linux/elf.h> /* Request and reply types */ -#define AUDIT_GET 1000 /* Get status */ -#define AUDIT_SET 1001 /* Set status (enable/disable/auditd) */ -#define AUDIT_LIST 1002 /* List filtering rules */ -#define AUDIT_ADD 1003 /* Add filtering rule */ -#define AUDIT_DEL 1004 /* Delete filtering rule */ -#define AUDIT_USER 1005 /* Send a message from user-space */ -#define AUDIT_LOGIN 1006 /* Define the login id and informaiton */ -#define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A REQUEST. */ +#define AUDIT_GET 1000 /* Get status */ +#define AUDIT_SET 1001 /* Set status (enable/disable/auditd) */ +#define AUDIT_LIST 1002 /* List filtering rules */ +#define AUDIT_ADD 1003 /* Add filtering rule */ +#define AUDIT_DEL 1004 /* Delete filtering rule */ +#define AUDIT_USER 1005 /* Send a message from user-space */ +#define AUDIT_LOGIN 1006 /* Define the login id and informaiton */ +#define AUDIT_WATCH_INS 1007 /* Insert file/dir watch entry */ +#define AUDIT_WATCH_REM 1008 /* Remove file/dir watch entry */ +#define AUDIT_WATCH_LIST 1009 /* List all watches */ +#define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A REQUEST. */ /* Rule flags */ #define AUDIT_PER_TASK 0x01 /* Apply rule at task creation (not syscall) */ @@ -132,6 +135,9 @@ #define AUDIT_ARCH_V850 (EM_V850|__AUDIT_ARCH_LE) #define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) +/* 32 byte max key size */ +#define AUDIT_FILTERKEY_MAX 32 + #ifndef __KERNEL__ struct audit_message { struct nlmsghdr nlh; @@ -159,8 +165,41 @@ struct audit_rule { /* for AUDIT_LIST, __u32 values[AUDIT_MAX_FIELDS]; }; +/* Structure to transport watch data to and from the kernel */ + +struct audit_transport { + __u32 dev; + __u32 perms; + __u32 valid; + __u32 pathlen; + __u32 fklen; + char buf[0]; +}; + #ifdef __KERNEL__ +struct audit_data { + struct audit_wentry *wentry; + struct hlist_head watchlist; + rwlock_t lock; +}; + +struct audit_watch { + dev_t dev; /* Superblock device */ + __u32 perms; /* Permissions filtering */ + char *name; /* Watch point beneath parent */ + char *path; /* Insertion path */ + char *filterkey; /* An arbitrary filtering key */ +}; + +struct audit_wentry { + struct hlist_node w_node; + struct hlist_node w_master; + struct audit_watch *w_watch; + atomic_t w_count; + +}; + struct audit_buffer; struct audit_context; struct inode; @@ -190,6 +229,7 @@ extern void audit_get_stamp(struct audit extern int audit_set_loginuid(struct audit_context *ctx, uid_t loginuid); extern uid_t audit_get_loginuid(struct audit_context *ctx); extern int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode); +extern int audit_notify_watch(struct inode *inode, int mask); #else #define audit_alloc(t) ({ 0; }) #define audit_free(t) do { ; } while (0) @@ -200,6 +240,28 @@ extern int audit_ipc_perms(unsigned long #define audit_inode(n,i) do { ; } while (0) #define audit_get_loginuid(c) ({ -1; }) #define audit_ipc_perms(q,u,g,m) ({ 0; }) +#define audit_notify_watch(i,m) ({ 0; }) +#endif + +#ifdef CONFIG_AUDITFILESYSTEM +extern int audit_list_watches(int pid, int seq); +extern int audit_receive_watch(int type, int pid, int uid, int seq, + struct audit_transport *req); +extern int audit_filesystem_init(void); +extern int audit_inode_alloc(struct inode *inode); +extern void audit_inode_free(struct inode *inode); +extern void audit_attach_watch(struct dentry *dentry, int remove); +extern void audit_wentry_put(struct audit_wentry *wentry); +extern struct audit_wentry *audit_wentry_get(struct audit_wentry *wentry); +#else +#define audit_list_watches(p,s) ({ -EOPNOTSUPP; }) +#define audit_receive_watch(t,p,u,s,r) ({ -EOPNOTSUPP; }) +#define audit_filesystem_init() ({ 0; }) +#define audit_inode_alloc(i) ({ 0; }) +#define audit_inode_free(i) do { ; } while(0) +#define audit_attach_watch(d,r) do { ; } while (0) +#define audit_wentry_put(w) do { ; } while(0) +#define audit_wentry_get(w) ({ 0; }) #endif #ifdef CONFIG_AUDIT diff -Nurp linux-2.6.9~orig/include/linux/fs.h linux-2.6.9~audit/include/linux/fs.h --- linux-2.6.9~orig/include/linux/fs.h 2005-04-13 20:38:29.000000000 +0000 +++ linux-2.6.9~audit/include/linux/fs.h 2005-04-13 20:07:25.000000000 +0000 @@ -220,6 +220,7 @@ extern int leases_enable, dir_notify_ena #include <linux/list.h> #include <linux/radix-tree.h> #include <linux/init.h> +include <linux/audit.h> #include <asm/semaphore.h> #include <asm/byteorder.h> @@ -461,6 +462,8 @@ struct inode { unsigned long i_dnotify_mask; /* Directory notify events */ struct dnotify_struct *i_dnotify; /* for directory notifications */ + struct audit_data *i_audit; + unsigned long i_state; unsigned long dirtied_when; /* jiffies of first dirtying */ diff -Nurp linux-2.6.9~orig/init/Kconfig linux-2.6.9~audit/init/Kconfig --- linux-2.6.9~orig/init/Kconfig 2005-04-13 20:38:29.000000000 +0000 +++ linux-2.6.9~audit/init/Kconfig 2005-04-13 18:46:31.000000000 +0000 @@ -186,6 +186,16 @@ config LOG_BUF_SHIFT 13 => 8 KB 12 => 4 KB +config AUDITFILESYSTEM + bool "Enable file system auditing support" + depends on AUDITSYSCALL + default n + help + Enable file system auditing for regular files and directories. + When a targeted file or directory is accessed, an audit record + is generated describing the inode accessed, how it was accessed, + and by whom (ie: pid and system call). + config HOTPLUG bool "Support for hot-pluggable devices" if !ARCH_S390 default ARCH_S390 diff -Nurp linux-2.6.9~orig/kernel/Makefile linux-2.6.9~audit/kernel/Makefile --- linux-2.6.9~orig/kernel/Makefile 2005-04-13 20:38:25.000000000 +0000 +++ linux-2.6.9~audit/kernel/Makefile 2005-04-13 18:46:31.000000000 +0000 @@ -25,6 +25,7 @@ obj-$(CONFIG_IKCONFIG_PROC) += configs.o obj-$(CONFIG_STOP_MACHINE) += stop_machine.o obj-$(CONFIG_AUDIT) += audit.o obj-$(CONFIG_AUDITSYSCALL) += auditsc.o +obj-$(CONFIG_AUDITFILESYSTEM) += auditfs.o obj-$(CONFIG_KPROBES) += kprobes.o ifneq ($(CONFIG_IA64),y) diff -Nurp linux-2.6.9~orig/kernel/audit.c linux-2.6.9~audit/kernel/audit.c --- linux-2.6.9~orig/kernel/audit.c 2005-04-13 20:38:29.000000000 +0000 +++ linux-2.6.9~audit/kernel/audit.c 2005-04-13 18:49:24.000000000 +0000 @@ -318,6 +318,9 @@ static int audit_netlink_ok(kernel_cap_t case AUDIT_SET: case AUDIT_ADD: case AUDIT_DEL: + case AUDIT_WATCH_INS: + case AUDIT_WATCH_REM: + case AUDIT_WATCH_LIST: if (!cap_raised(eff_cap, CAP_AUDIT_CONTROL)) err = -EPERM; break; @@ -419,6 +422,17 @@ static int audit_receive_msg(struct sk_b default: err = -EINVAL; break; + case AUDIT_WATCH_LIST: + err = audit_list_watches(NETLINK_CB(skb).pid, seq); + break; + case AUDIT_WATCH_INS: + case AUDIT_WATCH_REM: + if (nlh->nlmsg_len < sizeof(struct audit_transport)) + return -EINVAL; + err = audit_receive_watch(nlh->nlmsg_type, + NETLINK_CB(skb).pid, + uid, seq, data); + break; } return err < 0 ? err : 0; diff -Nurp linux-2.6.9~orig/kernel/auditfs.c linux-2.6.9~audit/kernel/auditfs.c --- linux-2.6.9~orig/kernel/auditfs.c 1970-01-01 00:00:00.000000000 +0000 +++ linux-2.6.9~audit/kernel/auditfs.c 2005-04-13 18:46:31.000000000 +0000 @@ -0,0 +1,560 @@ +/* auditfs.c -- Filesystem auditing support -*- linux-c -*- + * Implements filesystem auditing support, depends on kernel/auditsc.c + * + * Copyright 2005 International Business Machines Corp. (IBM) + * All Rights Reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA + * 02111-1307 USA + * + * Written by Timothy R. Chavez <chavezt(a)us.ibm.com&gt; + * + */ + +#include <linux/init.h> +#include <linux/fs.h> +#include <linux/sched.h> +#include <linux/kernel.h> +#include <linux/namei.h> +#include <linux/mount.h> +#include <linux/list.h> +#include <linux/slab.h> +#include <linux/audit.h> +#include <asm/uaccess.h> + +kmem_cache_t *audit_watch_cache; +kmem_cache_t *audit_wentry_cache; + +spinlock_t audit_master_watchlist_lock; +HLIST_HEAD(audit_master_watchlist); + + +/* Private Interface */ + +static inline struct audit_wentry *audit_wentry_fetch(const char *name, + struct audit_data *data) +{ + struct audit_wentry *wentry, *ret = NULL; + struct hlist_node *pos; + + hlist_for_each_entry(wentry, pos, &data->watchlist, w_node) + if(!strcmp(wentry->w_watch->name, name)) { + ret = audit_wentry_get(wentry); + break; + } + + return ret; +} + +static inline struct audit_wentry *audit_wentry_fetch_lock(const char *name, + struct audit_data *data) +{ + struct audit_wentry *ret = NULL; + + if (name && data) { + read_lock(&data->lock); + ret = audit_wentry_fetch(name, data); + read_unlock(&data->lock); + } + + return ret; +} + +static inline struct audit_watch *audit_watch_alloc(void) +{ + struct audit_watch *watch; + + watch = kmem_cache_alloc(audit_watch_cache, GFP_KERNEL); + if (watch) { + watch->name = NULL; + watch->filterkey = NULL; + watch->perms = 0; + } + + return watch; +} + +static inline void audit_watch_free(struct audit_watch *watch) +{ + if (watch) { + kfree(watch->name); + kfree(watch->filterkey); + kmem_cache_free(audit_watch_cache, watch); + } +} + +static inline struct audit_watch *audit_create_watch(const char *path, + const char *name, + const char *filterkey, + __u32 perms, dev_t dev) +{ + struct audit_watch *err = NULL; + struct audit_watch *watch = NULL; + + err = ERR_PTR(-ENOMEM); + watch = audit_watch_alloc(); + if (watch) { + watch->path = kmalloc(strlen(path)+1, GFP_KERNEL); + if (!watch->path) + goto audit_create_watch_fail; + strcpy(watch->path, path); + watch->name = kmalloc(strlen(name)+1, GFP_KERNEL); + if (!watch->name) + goto audit_create_watch_fail; + strcpy(watch->name, name); + + if (filterkey) { + watch->filterkey = kmalloc(strlen(filterkey)+1, + GFP_KERNEL); + if (!watch->filterkey) + goto audit_create_watch_fail; + strcpy(watch->filterkey, filterkey); + } + + watch->dev = dev; + watch->perms = perms; + + goto audit_create_watch_exit; + } + + +audit_create_watch_fail: + audit_watch_free(watch); + watch = err; +audit_create_watch_exit: + return watch; +} + +static inline struct audit_wentry *audit_wentry_alloc(void) +{ + struct audit_wentry *wentry; + + wentry = kmem_cache_alloc(audit_wentry_cache, GFP_KERNEL); + if (wentry) { + atomic_set(&wentry->w_count, 1); + wentry->w_watch = NULL; + } + + return wentry; +} + +static inline void audit_wentry_free(struct audit_wentry *wentry) +{ + if (wentry) { + audit_watch_free(wentry->w_watch); + kmem_cache_free(audit_wentry_cache, wentry); + } +} + +static inline void audit_master_insert(struct audit_wentry *wentry) +{ + wentry = audit_wentry_get(wentry); + if (wentry) { + spin_lock(&audit_master_watchlist_lock); + hlist_add_head(&wentry->w_master, &audit_master_watchlist); + spin_unlock(&audit_master_watchlist_lock); + } +} + +/* + * Remove entry from the master watchlist. To ensure synchronized removal + * from both the directory watchlist and master watchlist, watchlist_lock + * should first be held so that audit_master_remove cannot be called on + * the same wentry. + */ + +static inline void audit_master_remove(struct audit_wentry *wentry) +{ + if (wentry) { + spin_lock(&audit_master_watchlist_lock); + hlist_del_init(&wentry->w_master); + audit_wentry_put(wentry); + spin_unlock(&audit_master_watchlist_lock); + } +} + + +/* The only time the new wentry gets updated is when it is inaccessible + * (out of the list). + */ +static inline int audit_create_wentry(const char *path, + const char *name, + const char *filterkey, + __u32 perms, dev_t dev, + struct audit_data *data) +{ + int ret; + struct audit_wentry *wentry = NULL; + struct audit_wentry *new = NULL; + + ret = -ENOMEM; + new = audit_wentry_alloc(); + if (!new) + goto audit_create_wentry_fail; + + new->w_watch = audit_create_watch(path, name, filterkey, perms, dev); + if (IS_ERR(new->w_watch)) { + ret = PTR_ERR(new->w_watch); + new->w_watch = NULL; + goto audit_create_wentry_fail; + } + + ret = 0; + write_lock(&data->lock); + wentry = audit_wentry_fetch(name, data); + if (!wentry) { + audit_master_insert(new); + hlist_add_head(&new->w_node, &data->watchlist); + write_unlock(&data->lock); + goto audit_create_wentry_exit; + } + audit_wentry_put(wentry); + write_unlock(&data->lock); + + ret = -EEXIST; + +audit_create_wentry_fail: + audit_wentry_put(new); +audit_create_wentry_exit: + return ret; +} + +/* Caller must hold watchlist_lock */ + +static inline void audit_destroy_wentry(struct audit_wentry *wentry) +{ + if (wentry) { + audit_master_remove(wentry); + hlist_del_init(&wentry->w_node); + audit_wentry_put(wentry); + } +} + + +/* Caller must hold data->lock */ + +static inline void audit_drain_watchlist(struct audit_data *data) +{ + struct audit_wentry *wentry; + struct hlist_node *pos, *buf; + + hlist_for_each_entry_safe(wentry, pos, buf, &data->watchlist, w_node) + audit_destroy_wentry(wentry); +} + +static inline struct audit_data *audit_data_alloc(void) +{ + struct audit_data *data; + + data = kmalloc(sizeof(struct audit_data), GFP_KERNEL); + if (data) { + data->wentry = NULL; + INIT_HLIST_HEAD(&data->watchlist); + data->lock = RW_LOCK_UNLOCKED; + } + + return data; +} + +static inline void audit_data_free(struct audit_data *data) +{ + if (data) { + write_lock(&data->lock); + audit_drain_watchlist(data); + audit_wentry_put(data->wentry); + write_unlock(&data->lock); + kfree(data); + } +} + +static inline int audit_insert_watch(char *path, char *filterkey, __u32 perms) +{ + int ret; + struct nameidata nd; + + ret = path_lookup(path, LOOKUP_PARENT|LOOKUP_FOLLOW, &nd); + if (ret < 0) + goto audit_insert_watch_exit; + + ret = -EPERM; + if (nd.last_type != LAST_NORM || !nd.last.name) + goto audit_insert_watch_release; + + ret = audit_create_wentry(path, nd.last.name, filterkey, perms, + nd.dentry->d_inode->i_sb->s_dev, + nd.dentry->d_inode->i_audit); + /* __d_lookup will attach the audit data, if nd.last.name exists. */ + d_lookup(nd.dentry, &nd.last); + +audit_insert_watch_release: + path_release(&nd); +audit_insert_watch_exit: + return ret; +} + +static inline int audit_remove_watch(char *path) +{ + int ret; + struct nameidata nd; + struct audit_data *data; + struct audit_wentry *wentry; + + ret = path_lookup(path, LOOKUP_PARENT|LOOKUP_FOLLOW, &nd); + if (ret < 0) + goto audit_remove_watch_exit; + + ret = -EPERM; + if (nd.last_type != LAST_NORM || !nd.last.name) + goto audit_remove_watch_release; + + data = nd.dentry->d_inode->i_audit; + + write_lock(&data->lock); + wentry = audit_wentry_fetch(nd.last.name, data); + if (!wentry) { + write_unlock(&data->lock); + goto audit_remove_watch_release; + } + audit_destroy_wentry(wentry); + audit_wentry_put(wentry); + write_unlock(&data->lock); + + ret = 0; + +audit_remove_watch_release: + path_release(&nd); +audit_remove_watch_exit: + return ret; +} + +struct audit_wentry *audit_wentry_get(struct audit_wentry *wentry) +{ + if (wentry) { + BUG_ON(!atomic_read(&wentry->w_count)); + atomic_inc(&wentry->w_count); + } + + return wentry; +} + +void audit_wentry_put(struct audit_wentry *wentry) +{ + if (wentry && atomic_dec_and_test(&wentry->w_count)) + audit_wentry_free(wentry); +} + +/* + * Hook appears in fs/dcache.c: + * d_move(), + * d_delete(), + * d_instantiate(), + * d_splice_alias() + * __d_lookup() + */ +void audit_attach_watch(struct dentry *dentry, int remove) +{ + struct audit_wentry *wentry; + struct audit_data *data, *parent; + + if (!dentry || !dentry->d_inode) + return; + + if (!dentry->d_parent || !dentry->d_parent->d_inode) + return; + + data = dentry->d_inode->i_audit; + parent = dentry->d_parent->d_inode->i_audit; + + wentry = audit_wentry_fetch_lock(dentry->d_name.name, parent); + + write_lock(&data->lock); + /* FIXME: long watchlist == too much spinning? */ + if (remove) { + audit_drain_watchlist(data); + if (wentry && data->wentry) { + if (!strcmp(wentry->w_watch->name, + data->wentry->w_watch->name)) { + audit_wentry_put(data->wentry); + dentry->d_inode->i_audit->wentry = NULL; + } + } + } else if (!data->wentry || hlist_unhashed(&data->wentry->w_node)) { + audit_wentry_put(data->wentry); + dentry->d_inode->i_audit->wentry = audit_wentry_get(wentry); + } + audit_wentry_put(wentry); + write_unlock(&data->lock); +} + +int audit_send_watch(int pid, int seq, struct audit_watch *watch) +{ + int ret; + void *memblk; + unsigned int offset; + unsigned int total; + struct audit_data *data; + struct audit_wentry *wentry; + struct audit_transport req; + struct nameidata nd; + + req.valid = 0; + req.dev = watch->dev; + req.perms = watch->perms; + req.pathlen = strlen(watch->path) + 1; + req.fklen = strlen(watch->filterkey) + 1; + + ret = -ENOMEM; + total = sizeof(req) + req.pathlen + req.fklen; + memblk = kmalloc(total, GFP_KERNEL); + if (!memblk) + goto audit_send_watch_exit; + + /* See if path to watch is valid */ + ret = path_lookup(watch->path, LOOKUP_PARENT|LOOKUP_FOLLOW, &nd); + if (!ret) { + data = nd.dentry->d_inode->i_audit; + wentry = audit_wentry_fetch_lock(watch->name, data); + if (wentry && nd.dentry->d_inode->i_sb->s_dev == watch->dev) { + req.valid = 1; + audit_wentry_put(wentry); + } + path_release(&nd); + } + + /* Payload */ + memcpy(memblk, &req, sizeof(req)); + offset = total - req.fklen; + memcpy(memblk + offset, watch->filterkey, req.fklen); + offset = offset - req.pathlen; + memcpy(memblk + offset, watch->path, req.pathlen); + + audit_send_reply(pid, seq, AUDIT_WATCH_LIST, 0, 1, memblk, total); + + kfree(memblk); + +audit_send_watch_exit: + return ret; +} + +int audit_list_watches(int pid, int seq) +{ + int ret = 0; + struct audit_wentry *wentry; + struct hlist_node *pos; + + spin_lock(&audit_master_watchlist_lock); + hlist_for_each_entry(wentry, pos, &audit_master_watchlist, w_master) { + ret = audit_send_watch(pid, seq, wentry->w_watch); + if (ret < 0) + break; + } + spin_unlock(&audit_master_watchlist_lock); + + audit_send_reply(pid, seq, AUDIT_WATCH_LIST, 1, 1, NULL, 0); + + return ret; +} + +int audit_receive_watch(int type, int pid, int uid, int seq, + struct audit_transport *req) +{ + int ret = 0; + char *path = NULL; + char *filterkey = NULL; + + ret = -ENOMEM; + path = kmalloc(req->pathlen, GFP_KERNEL); + if (!path) + goto audit_receive_watch_exit; + strncpy(path, req->buf, req->pathlen); + + if (req->fklen) { + filterkey = kmalloc(req->fklen, GFP_KERNEL); + if (!filterkey) + goto audit_receive_watch_exit; + } + strncpy(filterkey, req->buf+req->pathlen, req->fklen); + + ret = -EINVAL; + if (!path || strlen(path) + 1 > PATH_MAX) + goto audit_receive_watch_exit; + + /* Includes terminating '\0' */ + if (req->fklen > AUDIT_FILTERKEY_MAX) + goto audit_receive_watch_exit; + + if (req->perms > (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND)) + goto audit_receive_watch_exit; + + switch (type) { + case AUDIT_WATCH_INS: + ret = audit_insert_watch(path, filterkey, req->perms); + break; + case AUDIT_WATCH_REM: + ret = audit_remove_watch(path); + break; + default: + ret = -EINVAL; + } + +audit_receive_watch_exit: + kfree(path); + kfree(filterkey); + return ret; +} + +int audit_inode_alloc(struct inode *inode) +{ + if (inode) { + inode->i_audit = audit_data_alloc(); + if (!inode->i_audit) + return ENOMEM; + } + + return 0; +} + +void audit_inode_free(struct inode *inode) +{ + if (inode) + audit_data_free(inode->i_audit); +} + +int audit_filesystem_init() +{ + int ret = 0; + + audit_watch_cache = + kmem_cache_create("audit_watch_cache", + sizeof(struct audit_watch), 0, 0, NULL, NULL); + if (!audit_watch_cache) + goto audit_filesystem_init_fail; + + audit_wentry_cache = + kmem_cache_create("audit_wentry_cache", + sizeof(struct audit_wentry), 0, 0, NULL, NULL); + if (!audit_wentry_cache) + goto audit_filesystem_init_fail; + + goto audit_filesystem_init_exit; + +audit_filesystem_init_fail: + ret = -ENOMEM; + kmem_cache_destroy(audit_watch_cache); + kmem_cache_destroy(audit_wentry_cache); +audit_filesystem_init_exit: + return ret; + +} diff -Nurp linux-2.6.9~orig/kernel/auditsc.c linux-2.6.9~audit/kernel/auditsc.c --- linux-2.6.9~orig/kernel/auditsc.c 2005-04-13 20:38:29.000000000 +0000 +++ linux-2.6.9~audit/kernel/auditsc.c 2005-04-13 18:46:31.000000000 +0000 @@ -102,6 +102,7 @@ struct audit_aux_data { }; #define AUDIT_AUX_IPCPERM 0 +#define AUDIT_AUX_WATCH 1 struct audit_aux_data_ipcctl { struct audit_aux_data d; @@ -112,6 +113,16 @@ struct audit_aux_data_ipcctl { mode_t mode; }; +struct audit_aux_data_watched { + struct audit_aux_data link; + struct audit_wentry *wentry; + unsigned long ino; + int mask; + uid_t uid; + gid_t gid; + dev_t dev; + dev_t rdev; +}; /* The per-task audit context. */ struct audit_context { @@ -697,6 +708,24 @@ static void audit_log_exit(struct audit_ audit_log_format(ab, " qbytes=%lx uid=%d gid=%d mode=%x", axi->qbytes, axi->uid, axi->gid, axi->mode); + break; + } + + case AUDIT_AUX_WATCH: { + struct audit_aux_data_watched *axi = (void *)aux; + audit_log_format(ab, " name="); + audit_log_untrustedstring(ab, axi->wentry->w_watch->name); + audit_log_format(ab, + " filterkey=%s perm=%u perm_mask=%d" + " inode=%lu inode_uid=%d inode_gid=%d" + " inode_dev=%02x:%02x inode_rdev=%02x:%02x", + axi->wentry->w_watch->filterkey, + axi->wentry->w_watch->perms, + axi->mask, axi->ino, axi->uid, axi->gid, + MAJOR(axi->dev), MINOR(axi->dev), + MAJOR(axi->rdev), MINOR(axi->rdev)); + audit_wentry_put(axi->wentry); + break; } } audit_log_end(ab); @@ -1055,3 +1084,52 @@ int audit_ipc_perms(unsigned long qbytes context->aux = (void *)ax; return 0; } + +int audit_notify_watch(struct inode *inode, int mask) +{ + int ret = 0; + struct audit_context *context = current->audit_context; + struct audit_aux_data_watched *ax; + struct audit_wentry *wentry = NULL; + + if (likely(!context)) + goto audit_notify_watch_fail; + + if (!inode) + goto audit_notify_watch_fail; + + wentry = audit_wentry_get(inode->i_audit->wentry); + if (!wentry) + goto audit_notify_watch_fail; + + if (mask && (wentry->w_watch->perms && !(wentry->w_watch->perms&mask))) + goto audit_notify_watch_fail; + + ret = -ENOMEM; + ax = kmalloc(sizeof(*ax), GFP_KERNEL); + if (!ax) + goto audit_notify_watch_fail; + + ret = 0; + if (context->in_syscall && !context->auditable) + context->auditable = 1; + + ax->wentry = wentry; + ax->mask = mask; + ax->ino = inode->i_ino; + ax->uid = inode->i_uid; + ax->gid = inode->i_gid; + ax->dev = inode->i_sb->s_dev; + ax->rdev = inode->i_rdev; + + ax->link.type = AUDIT_AUX_WATCH; + ax->link.next = context->aux; + context->aux = (void *)ax; + + goto audit_notify_watch_exit; + +audit_notify_watch_fail: + audit_wentry_put(wentry); +audit_notify_watch_exit: + return ret; +} diff -Nurp linux-2.6.9~orig/security/selinux/nlmsgtab.c linux-2.6.9~audit/security/selinux/nlmsgtab.c --- linux-2.6.9~orig/security/selinux/nlmsgtab.c 2004-10-18 21:54:55.000000000 +0000 +++ linux-2.6.9~audit/security/selinux/nlmsgtab.c 2005-04-13 18:46:31.000000000 +0000 @@ -95,6 +95,9 @@ static struct nlmsg_perm nlmsg_audit_per { AUDIT_DEL, NETLINK_AUDIT_SOCKET__NLMSG_WRITE }, { AUDIT_USER, NETLINK_AUDIT_SOCKET__NLMSG_WRITE }, { AUDIT_LOGIN, NETLINK_AUDIT_SOCKET__NLMSG_WRITE }, + { AUDIT_WATCH_INS, NETLINK_AUDIT_SOCKET__NLMSG_WRITE }, + { AUDIT_WATCH_REM, NETLINK_AUDIT_SOCKET__NLMSG_WRITE }, + { AUDIT_WATCH_LIST, NETLINK_AUDIT_SOCKET__NLMSG_WRITE }, };