1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* auditfilter.c -- filtering of audit events
3  *
4  * Copyright 2003-2004 Red Hat, Inc.
5  * Copyright 2005 Hewlett-Packard Development Company, L.P.
6  * Copyright 2005 IBM Corporation
7  */
8 
9 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
10 
11 #include <linux/kernel.h>
12 #include <linux/audit.h>
13 #include <linux/kthread.h>
14 #include <linux/mutex.h>
15 #include <linux/fs.h>
16 #include <linux/namei.h>
17 #include <linux/netlink.h>
18 #include <linux/sched.h>
19 #include <linux/slab.h>
20 #include <linux/security.h>
21 #include <net/net_namespace.h>
22 #include <net/sock.h>
23 #include "audit.h"
24 
25 /*
26  * Locking model:
27  *
28  * audit_filter_mutex:
29  *		Synchronizes writes and blocking reads of audit's filterlist
30  *		data.  Rcu is used to traverse the filterlist and access
31  *		contents of structs audit_entry, audit_watch and opaque
32  *		LSM rules during filtering.  If modified, these structures
33  *		must be copied and replace their counterparts in the filterlist.
34  *		An audit_parent struct is not accessed during filtering, so may
35  *		be written directly provided audit_filter_mutex is held.
36  */
37 
38 /* Audit filter lists, defined in <linux/audit.h> */
39 struct list_head audit_filter_list[AUDIT_NR_FILTERS] = {
40 	LIST_HEAD_INIT(audit_filter_list[0]),
41 	LIST_HEAD_INIT(audit_filter_list[1]),
42 	LIST_HEAD_INIT(audit_filter_list[2]),
43 	LIST_HEAD_INIT(audit_filter_list[3]),
44 	LIST_HEAD_INIT(audit_filter_list[4]),
45 	LIST_HEAD_INIT(audit_filter_list[5]),
46 	LIST_HEAD_INIT(audit_filter_list[6]),
47 	LIST_HEAD_INIT(audit_filter_list[7]),
48 #if AUDIT_NR_FILTERS != 8
49 #error Fix audit_filter_list initialiser
50 #endif
51 };
52 static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = {
53 	LIST_HEAD_INIT(audit_rules_list[0]),
54 	LIST_HEAD_INIT(audit_rules_list[1]),
55 	LIST_HEAD_INIT(audit_rules_list[2]),
56 	LIST_HEAD_INIT(audit_rules_list[3]),
57 	LIST_HEAD_INIT(audit_rules_list[4]),
58 	LIST_HEAD_INIT(audit_rules_list[5]),
59 	LIST_HEAD_INIT(audit_rules_list[6]),
60 	LIST_HEAD_INIT(audit_rules_list[7]),
61 };
62 
63 DEFINE_MUTEX(audit_filter_mutex);
64 
audit_free_lsm_field(struct audit_field * f)65 static void audit_free_lsm_field(struct audit_field *f)
66 {
67 	switch (f->type) {
68 	case AUDIT_SUBJ_USER:
69 	case AUDIT_SUBJ_ROLE:
70 	case AUDIT_SUBJ_TYPE:
71 	case AUDIT_SUBJ_SEN:
72 	case AUDIT_SUBJ_CLR:
73 	case AUDIT_OBJ_USER:
74 	case AUDIT_OBJ_ROLE:
75 	case AUDIT_OBJ_TYPE:
76 	case AUDIT_OBJ_LEV_LOW:
77 	case AUDIT_OBJ_LEV_HIGH:
78 		kfree(f->lsm_str);
79 		security_audit_rule_free(f->lsm_rule);
80 	}
81 }
82 
audit_free_rule(struct audit_entry * e)83 static inline void audit_free_rule(struct audit_entry *e)
84 {
85 	int i;
86 	struct audit_krule *erule = &e->rule;
87 
88 	/* some rules don't have associated watches */
89 	if (erule->watch)
90 		audit_put_watch(erule->watch);
91 	if (erule->fields)
92 		for (i = 0; i < erule->field_count; i++)
93 			audit_free_lsm_field(&erule->fields[i]);
94 	kfree(erule->fields);
95 	kfree(erule->filterkey);
96 	kfree(e);
97 }
98 
audit_free_rule_rcu(struct rcu_head * head)99 void audit_free_rule_rcu(struct rcu_head *head)
100 {
101 	struct audit_entry *e = container_of(head, struct audit_entry, rcu);
102 	audit_free_rule(e);
103 }
104 
105 /* Initialize an audit filterlist entry. */
audit_init_entry(u32 field_count)106 static inline struct audit_entry *audit_init_entry(u32 field_count)
107 {
108 	struct audit_entry *entry;
109 	struct audit_field *fields;
110 
111 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
112 	if (unlikely(!entry))
113 		return NULL;
114 
115 	fields = kcalloc(field_count, sizeof(*fields), GFP_KERNEL);
116 	if (unlikely(!fields)) {
117 		kfree(entry);
118 		return NULL;
119 	}
120 	entry->rule.fields = fields;
121 
122 	return entry;
123 }
124 
125 /* Unpack a filter field's string representation from user-space
126  * buffer. */
audit_unpack_string(void ** bufp,size_t * remain,size_t len)127 char *audit_unpack_string(void **bufp, size_t *remain, size_t len)
128 {
129 	char *str;
130 
131 	if (!*bufp || (len == 0) || (len > *remain))
132 		return ERR_PTR(-EINVAL);
133 
134 	/* Of the currently implemented string fields, PATH_MAX
135 	 * defines the longest valid length.
136 	 */
137 	if (len > PATH_MAX)
138 		return ERR_PTR(-ENAMETOOLONG);
139 
140 	str = kmalloc(len + 1, GFP_KERNEL);
141 	if (unlikely(!str))
142 		return ERR_PTR(-ENOMEM);
143 
144 	memcpy(str, *bufp, len);
145 	str[len] = 0;
146 	*bufp += len;
147 	*remain -= len;
148 
149 	return str;
150 }
151 
152 /* Translate an inode field to kernel representation. */
audit_to_inode(struct audit_krule * krule,struct audit_field * f)153 static inline int audit_to_inode(struct audit_krule *krule,
154 				 struct audit_field *f)
155 {
156 	if ((krule->listnr != AUDIT_FILTER_EXIT &&
157 	     krule->listnr != AUDIT_FILTER_URING_EXIT) ||
158 	    krule->inode_f || krule->watch || krule->tree ||
159 	    (f->op != Audit_equal && f->op != Audit_not_equal))
160 		return -EINVAL;
161 
162 	krule->inode_f = f;
163 	return 0;
164 }
165 
166 static __u32 *classes[AUDIT_SYSCALL_CLASSES];
167 
audit_register_class(int class,unsigned * list)168 int __init audit_register_class(int class, unsigned *list)
169 {
170 	__u32 *p = kcalloc(AUDIT_BITMASK_SIZE, sizeof(__u32), GFP_KERNEL);
171 	if (!p)
172 		return -ENOMEM;
173 	while (*list != ~0U) {
174 		unsigned n = *list++;
175 		if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) {
176 			kfree(p);
177 			return -EINVAL;
178 		}
179 		p[AUDIT_WORD(n)] |= AUDIT_BIT(n);
180 	}
181 	if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) {
182 		kfree(p);
183 		return -EINVAL;
184 	}
185 	classes[class] = p;
186 	return 0;
187 }
188 
audit_match_class(int class,unsigned syscall)189 int audit_match_class(int class, unsigned syscall)
190 {
191 	if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32))
192 		return 0;
193 	if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class]))
194 		return 0;
195 	return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall);
196 }
197 
198 #ifdef CONFIG_AUDITSYSCALL
audit_match_class_bits(int class,u32 * mask)199 static inline int audit_match_class_bits(int class, u32 *mask)
200 {
201 	int i;
202 
203 	if (classes[class]) {
204 		for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
205 			if (mask[i] & classes[class][i])
206 				return 0;
207 	}
208 	return 1;
209 }
210 
audit_match_signal(struct audit_entry * entry)211 static int audit_match_signal(struct audit_entry *entry)
212 {
213 	struct audit_field *arch = entry->rule.arch_f;
214 
215 	if (!arch) {
216 		/* When arch is unspecified, we must check both masks on biarch
217 		 * as syscall number alone is ambiguous. */
218 		return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
219 					       entry->rule.mask) &&
220 			audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
221 					       entry->rule.mask));
222 	}
223 
224 	switch(audit_classify_arch(arch->val)) {
225 	case 0: /* native */
226 		return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
227 					       entry->rule.mask));
228 	case 1: /* 32bit on biarch */
229 		return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
230 					       entry->rule.mask));
231 	default:
232 		return 1;
233 	}
234 }
235 #endif
236 
237 /* Common user-space to kernel rule translation. */
audit_to_entry_common(struct audit_rule_data * rule)238 static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule)
239 {
240 	unsigned listnr;
241 	struct audit_entry *entry;
242 	int i, err;
243 
244 	err = -EINVAL;
245 	listnr = rule->flags & ~AUDIT_FILTER_PREPEND;
246 	switch(listnr) {
247 	default:
248 		goto exit_err;
249 #ifdef CONFIG_AUDITSYSCALL
250 	case AUDIT_FILTER_ENTRY:
251 		pr_err("AUDIT_FILTER_ENTRY is deprecated\n");
252 		goto exit_err;
253 	case AUDIT_FILTER_EXIT:
254 	case AUDIT_FILTER_URING_EXIT:
255 	case AUDIT_FILTER_TASK:
256 #endif
257 	case AUDIT_FILTER_USER:
258 	case AUDIT_FILTER_EXCLUDE:
259 	case AUDIT_FILTER_FS:
260 		;
261 	}
262 	if (unlikely(rule->action == AUDIT_POSSIBLE)) {
263 		pr_err("AUDIT_POSSIBLE is deprecated\n");
264 		goto exit_err;
265 	}
266 	if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS)
267 		goto exit_err;
268 	if (rule->field_count > AUDIT_MAX_FIELDS)
269 		goto exit_err;
270 
271 	err = -ENOMEM;
272 	entry = audit_init_entry(rule->field_count);
273 	if (!entry)
274 		goto exit_err;
275 
276 	entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;
277 	entry->rule.listnr = listnr;
278 	entry->rule.action = rule->action;
279 	entry->rule.field_count = rule->field_count;
280 
281 	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
282 		entry->rule.mask[i] = rule->mask[i];
283 
284 	for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) {
285 		int bit = AUDIT_BITMASK_SIZE * 32 - i - 1;
286 		__u32 *p = &entry->rule.mask[AUDIT_WORD(bit)];
287 		__u32 *class;
288 
289 		if (!(*p & AUDIT_BIT(bit)))
290 			continue;
291 		*p &= ~AUDIT_BIT(bit);
292 		class = classes[i];
293 		if (class) {
294 			int j;
295 			for (j = 0; j < AUDIT_BITMASK_SIZE; j++)
296 				entry->rule.mask[j] |= class[j];
297 		}
298 	}
299 
300 	return entry;
301 
302 exit_err:
303 	return ERR_PTR(err);
304 }
305 
306 static u32 audit_ops[] =
307 {
308 	[Audit_equal] = AUDIT_EQUAL,
309 	[Audit_not_equal] = AUDIT_NOT_EQUAL,
310 	[Audit_bitmask] = AUDIT_BIT_MASK,
311 	[Audit_bittest] = AUDIT_BIT_TEST,
312 	[Audit_lt] = AUDIT_LESS_THAN,
313 	[Audit_gt] = AUDIT_GREATER_THAN,
314 	[Audit_le] = AUDIT_LESS_THAN_OR_EQUAL,
315 	[Audit_ge] = AUDIT_GREATER_THAN_OR_EQUAL,
316 };
317 
audit_to_op(u32 op)318 static u32 audit_to_op(u32 op)
319 {
320 	u32 n;
321 	for (n = Audit_equal; n < Audit_bad && audit_ops[n] != op; n++)
322 		;
323 	return n;
324 }
325 
326 /* check if an audit field is valid */
audit_field_valid(struct audit_entry * entry,struct audit_field * f)327 static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
328 {
329 	switch (f->type) {
330 	case AUDIT_MSGTYPE:
331 		if (entry->rule.listnr != AUDIT_FILTER_EXCLUDE &&
332 		    entry->rule.listnr != AUDIT_FILTER_USER)
333 			return -EINVAL;
334 		break;
335 	case AUDIT_FSTYPE:
336 		if (entry->rule.listnr != AUDIT_FILTER_FS)
337 			return -EINVAL;
338 		break;
339 	case AUDIT_PERM:
340 		if (entry->rule.listnr == AUDIT_FILTER_URING_EXIT)
341 			return -EINVAL;
342 		break;
343 	}
344 
345 	switch (entry->rule.listnr) {
346 	case AUDIT_FILTER_FS:
347 		switch(f->type) {
348 		case AUDIT_FSTYPE:
349 		case AUDIT_FILTERKEY:
350 			break;
351 		default:
352 			return -EINVAL;
353 		}
354 	}
355 
356 	/* Check for valid field type and op */
357 	switch (f->type) {
358 	case AUDIT_ARG0:
359 	case AUDIT_ARG1:
360 	case AUDIT_ARG2:
361 	case AUDIT_ARG3:
362 	case AUDIT_PERS: /* <uapi/linux/personality.h> */
363 	case AUDIT_DEVMINOR:
364 		/* all ops are valid */
365 		break;
366 	case AUDIT_UID:
367 	case AUDIT_EUID:
368 	case AUDIT_SUID:
369 	case AUDIT_FSUID:
370 	case AUDIT_LOGINUID:
371 	case AUDIT_OBJ_UID:
372 	case AUDIT_GID:
373 	case AUDIT_EGID:
374 	case AUDIT_SGID:
375 	case AUDIT_FSGID:
376 	case AUDIT_OBJ_GID:
377 	case AUDIT_PID:
378 	case AUDIT_MSGTYPE:
379 	case AUDIT_PPID:
380 	case AUDIT_DEVMAJOR:
381 	case AUDIT_EXIT:
382 	case AUDIT_SUCCESS:
383 	case AUDIT_INODE:
384 	case AUDIT_SESSIONID:
385 	case AUDIT_SUBJ_SEN:
386 	case AUDIT_SUBJ_CLR:
387 	case AUDIT_OBJ_LEV_LOW:
388 	case AUDIT_OBJ_LEV_HIGH:
389 	case AUDIT_SADDR_FAM:
390 		/* bit ops are only useful on syscall args */
391 		if (f->op == Audit_bitmask || f->op == Audit_bittest)
392 			return -EINVAL;
393 		break;
394 	case AUDIT_SUBJ_USER:
395 	case AUDIT_SUBJ_ROLE:
396 	case AUDIT_SUBJ_TYPE:
397 	case AUDIT_OBJ_USER:
398 	case AUDIT_OBJ_ROLE:
399 	case AUDIT_OBJ_TYPE:
400 	case AUDIT_WATCH:
401 	case AUDIT_DIR:
402 	case AUDIT_FILTERKEY:
403 	case AUDIT_LOGINUID_SET:
404 	case AUDIT_ARCH:
405 	case AUDIT_FSTYPE:
406 	case AUDIT_PERM:
407 	case AUDIT_FILETYPE:
408 	case AUDIT_FIELD_COMPARE:
409 	case AUDIT_EXE:
410 		/* only equal and not equal valid ops */
411 		if (f->op != Audit_not_equal && f->op != Audit_equal)
412 			return -EINVAL;
413 		break;
414 	default:
415 		/* field not recognized */
416 		return -EINVAL;
417 	}
418 
419 	/* Check for select valid field values */
420 	switch (f->type) {
421 	case AUDIT_LOGINUID_SET:
422 		if ((f->val != 0) && (f->val != 1))
423 			return -EINVAL;
424 		break;
425 	case AUDIT_PERM:
426 		if (f->val & ~15)
427 			return -EINVAL;
428 		break;
429 	case AUDIT_FILETYPE:
430 		if (f->val & ~S_IFMT)
431 			return -EINVAL;
432 		break;
433 	case AUDIT_FIELD_COMPARE:
434 		if (f->val > AUDIT_MAX_FIELD_COMPARE)
435 			return -EINVAL;
436 		break;
437 	case AUDIT_SADDR_FAM:
438 		if (f->val >= AF_MAX)
439 			return -EINVAL;
440 		break;
441 	default:
442 		break;
443 	}
444 
445 	return 0;
446 }
447 
448 /* Translate struct audit_rule_data to kernel's rule representation. */
audit_data_to_entry(struct audit_rule_data * data,size_t datasz)449 static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
450 					       size_t datasz)
451 {
452 	int err = 0;
453 	struct audit_entry *entry;
454 	void *bufp;
455 	size_t remain = datasz - sizeof(struct audit_rule_data);
456 	int i;
457 	char *str;
458 	struct audit_fsnotify_mark *audit_mark;
459 
460 	entry = audit_to_entry_common(data);
461 	if (IS_ERR(entry))
462 		goto exit_nofree;
463 
464 	bufp = data->buf;
465 	for (i = 0; i < data->field_count; i++) {
466 		struct audit_field *f = &entry->rule.fields[i];
467 		u32 f_val;
468 
469 		err = -EINVAL;
470 
471 		f->op = audit_to_op(data->fieldflags[i]);
472 		if (f->op == Audit_bad)
473 			goto exit_free;
474 
475 		f->type = data->fields[i];
476 		f_val = data->values[i];
477 
478 		/* Support legacy tests for a valid loginuid */
479 		if ((f->type == AUDIT_LOGINUID) && (f_val == AUDIT_UID_UNSET)) {
480 			f->type = AUDIT_LOGINUID_SET;
481 			f_val = 0;
482 			entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;
483 		}
484 
485 		err = audit_field_valid(entry, f);
486 		if (err)
487 			goto exit_free;
488 
489 		err = -EINVAL;
490 		switch (f->type) {
491 		case AUDIT_LOGINUID:
492 		case AUDIT_UID:
493 		case AUDIT_EUID:
494 		case AUDIT_SUID:
495 		case AUDIT_FSUID:
496 		case AUDIT_OBJ_UID:
497 			f->uid = make_kuid(current_user_ns(), f_val);
498 			if (!uid_valid(f->uid))
499 				goto exit_free;
500 			break;
501 		case AUDIT_GID:
502 		case AUDIT_EGID:
503 		case AUDIT_SGID:
504 		case AUDIT_FSGID:
505 		case AUDIT_OBJ_GID:
506 			f->gid = make_kgid(current_user_ns(), f_val);
507 			if (!gid_valid(f->gid))
508 				goto exit_free;
509 			break;
510 		case AUDIT_ARCH:
511 			f->val = f_val;
512 			entry->rule.arch_f = f;
513 			break;
514 		case AUDIT_SUBJ_USER:
515 		case AUDIT_SUBJ_ROLE:
516 		case AUDIT_SUBJ_TYPE:
517 		case AUDIT_SUBJ_SEN:
518 		case AUDIT_SUBJ_CLR:
519 		case AUDIT_OBJ_USER:
520 		case AUDIT_OBJ_ROLE:
521 		case AUDIT_OBJ_TYPE:
522 		case AUDIT_OBJ_LEV_LOW:
523 		case AUDIT_OBJ_LEV_HIGH:
524 			str = audit_unpack_string(&bufp, &remain, f_val);
525 			if (IS_ERR(str)) {
526 				err = PTR_ERR(str);
527 				goto exit_free;
528 			}
529 			entry->rule.buflen += f_val;
530 			f->lsm_str = str;
531 			err = security_audit_rule_init(f->type, f->op, str,
532 						       (void **)&f->lsm_rule);
533 			/* Keep currently invalid fields around in case they
534 			 * become valid after a policy reload. */
535 			if (err == -EINVAL) {
536 				pr_warn("audit rule for LSM \'%s\' is invalid\n",
537 					str);
538 				err = 0;
539 			} else if (err)
540 				goto exit_free;
541 			break;
542 		case AUDIT_WATCH:
543 			str = audit_unpack_string(&bufp, &remain, f_val);
544 			if (IS_ERR(str)) {
545 				err = PTR_ERR(str);
546 				goto exit_free;
547 			}
548 			err = audit_to_watch(&entry->rule, str, f_val, f->op);
549 			if (err) {
550 				kfree(str);
551 				goto exit_free;
552 			}
553 			entry->rule.buflen += f_val;
554 			break;
555 		case AUDIT_DIR:
556 			str = audit_unpack_string(&bufp, &remain, f_val);
557 			if (IS_ERR(str)) {
558 				err = PTR_ERR(str);
559 				goto exit_free;
560 			}
561 			err = audit_make_tree(&entry->rule, str, f->op);
562 			kfree(str);
563 			if (err)
564 				goto exit_free;
565 			entry->rule.buflen += f_val;
566 			break;
567 		case AUDIT_INODE:
568 			f->val = f_val;
569 			err = audit_to_inode(&entry->rule, f);
570 			if (err)
571 				goto exit_free;
572 			break;
573 		case AUDIT_FILTERKEY:
574 			if (entry->rule.filterkey || f_val > AUDIT_MAX_KEY_LEN)
575 				goto exit_free;
576 			str = audit_unpack_string(&bufp, &remain, f_val);
577 			if (IS_ERR(str)) {
578 				err = PTR_ERR(str);
579 				goto exit_free;
580 			}
581 			entry->rule.buflen += f_val;
582 			entry->rule.filterkey = str;
583 			break;
584 		case AUDIT_EXE:
585 			if (entry->rule.exe || f_val > PATH_MAX)
586 				goto exit_free;
587 			str = audit_unpack_string(&bufp, &remain, f_val);
588 			if (IS_ERR(str)) {
589 				err = PTR_ERR(str);
590 				goto exit_free;
591 			}
592 			audit_mark = audit_alloc_mark(&entry->rule, str, f_val);
593 			if (IS_ERR(audit_mark)) {
594 				kfree(str);
595 				err = PTR_ERR(audit_mark);
596 				goto exit_free;
597 			}
598 			entry->rule.buflen += f_val;
599 			entry->rule.exe = audit_mark;
600 			break;
601 		default:
602 			f->val = f_val;
603 			break;
604 		}
605 	}
606 
607 	if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)
608 		entry->rule.inode_f = NULL;
609 
610 exit_nofree:
611 	return entry;
612 
613 exit_free:
614 	if (entry->rule.tree)
615 		audit_put_tree(entry->rule.tree); /* that's the temporary one */
616 	if (entry->rule.exe)
617 		audit_remove_mark(entry->rule.exe); /* that's the template one */
618 	audit_free_rule(entry);
619 	return ERR_PTR(err);
620 }
621 
622 /* Pack a filter field's string representation into data block. */
audit_pack_string(void ** bufp,const char * str)623 static inline size_t audit_pack_string(void **bufp, const char *str)
624 {
625 	size_t len = strlen(str);
626 
627 	memcpy(*bufp, str, len);
628 	*bufp += len;
629 
630 	return len;
631 }
632 
633 /* Translate kernel rule representation to struct audit_rule_data. */
audit_krule_to_data(struct audit_krule * krule)634 static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
635 {
636 	struct audit_rule_data *data;
637 	void *bufp;
638 	int i;
639 
640 	data = kmalloc(sizeof(*data) + krule->buflen, GFP_KERNEL);
641 	if (unlikely(!data))
642 		return NULL;
643 	memset(data, 0, sizeof(*data));
644 
645 	data->flags = krule->flags | krule->listnr;
646 	data->action = krule->action;
647 	data->field_count = krule->field_count;
648 	bufp = data->buf;
649 	for (i = 0; i < data->field_count; i++) {
650 		struct audit_field *f = &krule->fields[i];
651 
652 		data->fields[i] = f->type;
653 		data->fieldflags[i] = audit_ops[f->op];
654 		switch(f->type) {
655 		case AUDIT_SUBJ_USER:
656 		case AUDIT_SUBJ_ROLE:
657 		case AUDIT_SUBJ_TYPE:
658 		case AUDIT_SUBJ_SEN:
659 		case AUDIT_SUBJ_CLR:
660 		case AUDIT_OBJ_USER:
661 		case AUDIT_OBJ_ROLE:
662 		case AUDIT_OBJ_TYPE:
663 		case AUDIT_OBJ_LEV_LOW:
664 		case AUDIT_OBJ_LEV_HIGH:
665 			data->buflen += data->values[i] =
666 				audit_pack_string(&bufp, f->lsm_str);
667 			break;
668 		case AUDIT_WATCH:
669 			data->buflen += data->values[i] =
670 				audit_pack_string(&bufp,
671 						  audit_watch_path(krule->watch));
672 			break;
673 		case AUDIT_DIR:
674 			data->buflen += data->values[i] =
675 				audit_pack_string(&bufp,
676 						  audit_tree_path(krule->tree));
677 			break;
678 		case AUDIT_FILTERKEY:
679 			data->buflen += data->values[i] =
680 				audit_pack_string(&bufp, krule->filterkey);
681 			break;
682 		case AUDIT_EXE:
683 			data->buflen += data->values[i] =
684 				audit_pack_string(&bufp, audit_mark_path(krule->exe));
685 			break;
686 		case AUDIT_LOGINUID_SET:
687 			if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {
688 				data->fields[i] = AUDIT_LOGINUID;
689 				data->values[i] = AUDIT_UID_UNSET;
690 				break;
691 			}
692 			fallthrough;	/* if set */
693 		default:
694 			data->values[i] = f->val;
695 		}
696 	}
697 	for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i];
698 
699 	return data;
700 }
701 
702 /* Compare two rules in kernel format.  Considered success if rules
703  * don't match. */
audit_compare_rule(struct audit_krule * a,struct audit_krule * b)704 static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
705 {
706 	int i;
707 
708 	if (a->flags != b->flags ||
709 	    a->pflags != b->pflags ||
710 	    a->listnr != b->listnr ||
711 	    a->action != b->action ||
712 	    a->field_count != b->field_count)
713 		return 1;
714 
715 	for (i = 0; i < a->field_count; i++) {
716 		if (a->fields[i].type != b->fields[i].type ||
717 		    a->fields[i].op != b->fields[i].op)
718 			return 1;
719 
720 		switch(a->fields[i].type) {
721 		case AUDIT_SUBJ_USER:
722 		case AUDIT_SUBJ_ROLE:
723 		case AUDIT_SUBJ_TYPE:
724 		case AUDIT_SUBJ_SEN:
725 		case AUDIT_SUBJ_CLR:
726 		case AUDIT_OBJ_USER:
727 		case AUDIT_OBJ_ROLE:
728 		case AUDIT_OBJ_TYPE:
729 		case AUDIT_OBJ_LEV_LOW:
730 		case AUDIT_OBJ_LEV_HIGH:
731 			if (strcmp(a->fields[i].lsm_str, b->fields[i].lsm_str))
732 				return 1;
733 			break;
734 		case AUDIT_WATCH:
735 			if (strcmp(audit_watch_path(a->watch),
736 				   audit_watch_path(b->watch)))
737 				return 1;
738 			break;
739 		case AUDIT_DIR:
740 			if (strcmp(audit_tree_path(a->tree),
741 				   audit_tree_path(b->tree)))
742 				return 1;
743 			break;
744 		case AUDIT_FILTERKEY:
745 			/* both filterkeys exist based on above type compare */
746 			if (strcmp(a->filterkey, b->filterkey))
747 				return 1;
748 			break;
749 		case AUDIT_EXE:
750 			/* both paths exist based on above type compare */
751 			if (strcmp(audit_mark_path(a->exe),
752 				   audit_mark_path(b->exe)))
753 				return 1;
754 			break;
755 		case AUDIT_UID:
756 		case AUDIT_EUID:
757 		case AUDIT_SUID:
758 		case AUDIT_FSUID:
759 		case AUDIT_LOGINUID:
760 		case AUDIT_OBJ_UID:
761 			if (!uid_eq(a->fields[i].uid, b->fields[i].uid))
762 				return 1;
763 			break;
764 		case AUDIT_GID:
765 		case AUDIT_EGID:
766 		case AUDIT_SGID:
767 		case AUDIT_FSGID:
768 		case AUDIT_OBJ_GID:
769 			if (!gid_eq(a->fields[i].gid, b->fields[i].gid))
770 				return 1;
771 			break;
772 		default:
773 			if (a->fields[i].val != b->fields[i].val)
774 				return 1;
775 		}
776 	}
777 
778 	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
779 		if (a->mask[i] != b->mask[i])
780 			return 1;
781 
782 	return 0;
783 }
784 
785 /* Duplicate LSM field information.  The lsm_rule is opaque, so must be
786  * re-initialized. */
audit_dupe_lsm_field(struct audit_field * df,struct audit_field * sf)787 static inline int audit_dupe_lsm_field(struct audit_field *df,
788 					   struct audit_field *sf)
789 {
790 	int ret = 0;
791 	char *lsm_str;
792 
793 	/* our own copy of lsm_str */
794 	lsm_str = kstrdup(sf->lsm_str, GFP_KERNEL);
795 	if (unlikely(!lsm_str))
796 		return -ENOMEM;
797 	df->lsm_str = lsm_str;
798 
799 	/* our own (refreshed) copy of lsm_rule */
800 	ret = security_audit_rule_init(df->type, df->op, df->lsm_str,
801 				       (void **)&df->lsm_rule);
802 	/* Keep currently invalid fields around in case they
803 	 * become valid after a policy reload. */
804 	if (ret == -EINVAL) {
805 		pr_warn("audit rule for LSM \'%s\' is invalid\n",
806 			df->lsm_str);
807 		ret = 0;
808 	}
809 
810 	return ret;
811 }
812 
813 /* Duplicate an audit rule.  This will be a deep copy with the exception
814  * of the watch - that pointer is carried over.  The LSM specific fields
815  * will be updated in the copy.  The point is to be able to replace the old
816  * rule with the new rule in the filterlist, then free the old rule.
817  * The rlist element is undefined; list manipulations are handled apart from
818  * the initial copy. */
audit_dupe_rule(struct audit_krule * old)819 struct audit_entry *audit_dupe_rule(struct audit_krule *old)
820 {
821 	u32 fcount = old->field_count;
822 	struct audit_entry *entry;
823 	struct audit_krule *new;
824 	char *fk;
825 	int i, err = 0;
826 
827 	entry = audit_init_entry(fcount);
828 	if (unlikely(!entry))
829 		return ERR_PTR(-ENOMEM);
830 
831 	new = &entry->rule;
832 	new->flags = old->flags;
833 	new->pflags = old->pflags;
834 	new->listnr = old->listnr;
835 	new->action = old->action;
836 	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
837 		new->mask[i] = old->mask[i];
838 	new->prio = old->prio;
839 	new->buflen = old->buflen;
840 	new->inode_f = old->inode_f;
841 	new->field_count = old->field_count;
842 
843 	/*
844 	 * note that we are OK with not refcounting here; audit_match_tree()
845 	 * never dereferences tree and we can't get false positives there
846 	 * since we'd have to have rule gone from the list *and* removed
847 	 * before the chunks found by lookup had been allocated, i.e. before
848 	 * the beginning of list scan.
849 	 */
850 	new->tree = old->tree;
851 	memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount);
852 
853 	/* deep copy this information, updating the lsm_rule fields, because
854 	 * the originals will all be freed when the old rule is freed. */
855 	for (i = 0; i < fcount; i++) {
856 		switch (new->fields[i].type) {
857 		case AUDIT_SUBJ_USER:
858 		case AUDIT_SUBJ_ROLE:
859 		case AUDIT_SUBJ_TYPE:
860 		case AUDIT_SUBJ_SEN:
861 		case AUDIT_SUBJ_CLR:
862 		case AUDIT_OBJ_USER:
863 		case AUDIT_OBJ_ROLE:
864 		case AUDIT_OBJ_TYPE:
865 		case AUDIT_OBJ_LEV_LOW:
866 		case AUDIT_OBJ_LEV_HIGH:
867 			err = audit_dupe_lsm_field(&new->fields[i],
868 						       &old->fields[i]);
869 			break;
870 		case AUDIT_FILTERKEY:
871 			fk = kstrdup(old->filterkey, GFP_KERNEL);
872 			if (unlikely(!fk))
873 				err = -ENOMEM;
874 			else
875 				new->filterkey = fk;
876 			break;
877 		case AUDIT_EXE:
878 			err = audit_dupe_exe(new, old);
879 			break;
880 		}
881 		if (err) {
882 			if (new->exe)
883 				audit_remove_mark(new->exe);
884 			audit_free_rule(entry);
885 			return ERR_PTR(err);
886 		}
887 	}
888 
889 	if (old->watch) {
890 		audit_get_watch(old->watch);
891 		new->watch = old->watch;
892 	}
893 
894 	return entry;
895 }
896 
897 /* Find an existing audit rule.
898  * Caller must hold audit_filter_mutex to prevent stale rule data. */
audit_find_rule(struct audit_entry * entry,struct list_head ** p)899 static struct audit_entry *audit_find_rule(struct audit_entry *entry,
900 					   struct list_head **p)
901 {
902 	struct audit_entry *e, *found = NULL;
903 	struct list_head *list;
904 	int h;
905 
906 	if (entry->rule.inode_f) {
907 		h = audit_hash_ino(entry->rule.inode_f->val);
908 		*p = list = &audit_inode_hash[h];
909 	} else if (entry->rule.watch) {
910 		/* we don't know the inode number, so must walk entire hash */
911 		for (h = 0; h < AUDIT_INODE_BUCKETS; h++) {
912 			list = &audit_inode_hash[h];
913 			list_for_each_entry(e, list, list)
914 				if (!audit_compare_rule(&entry->rule, &e->rule)) {
915 					found = e;
916 					goto out;
917 				}
918 		}
919 		goto out;
920 	} else {
921 		*p = list = &audit_filter_list[entry->rule.listnr];
922 	}
923 
924 	list_for_each_entry(e, list, list)
925 		if (!audit_compare_rule(&entry->rule, &e->rule)) {
926 			found = e;
927 			goto out;
928 		}
929 
930 out:
931 	return found;
932 }
933 
934 static u64 prio_low = ~0ULL/2;
935 static u64 prio_high = ~0ULL/2 - 1;
936 
937 /* Add rule to given filterlist if not a duplicate. */
audit_add_rule(struct audit_entry * entry)938 static inline int audit_add_rule(struct audit_entry *entry)
939 {
940 	struct audit_entry *e;
941 	struct audit_watch *watch = entry->rule.watch;
942 	struct audit_tree *tree = entry->rule.tree;
943 	struct list_head *list;
944 	int err = 0;
945 #ifdef CONFIG_AUDITSYSCALL
946 	int dont_count = 0;
947 
948 	/* If any of these, don't count towards total */
949 	switch(entry->rule.listnr) {
950 	case AUDIT_FILTER_USER:
951 	case AUDIT_FILTER_EXCLUDE:
952 	case AUDIT_FILTER_FS:
953 		dont_count = 1;
954 	}
955 #endif
956 
957 	mutex_lock(&audit_filter_mutex);
958 	e = audit_find_rule(entry, &list);
959 	if (e) {
960 		mutex_unlock(&audit_filter_mutex);
961 		err = -EEXIST;
962 		/* normally audit_add_tree_rule() will free it on failure */
963 		if (tree)
964 			audit_put_tree(tree);
965 		return err;
966 	}
967 
968 	if (watch) {
969 		/* audit_filter_mutex is dropped and re-taken during this call */
970 		err = audit_add_watch(&entry->rule, &list);
971 		if (err) {
972 			mutex_unlock(&audit_filter_mutex);
973 			/*
974 			 * normally audit_add_tree_rule() will free it
975 			 * on failure
976 			 */
977 			if (tree)
978 				audit_put_tree(tree);
979 			return err;
980 		}
981 	}
982 	if (tree) {
983 		err = audit_add_tree_rule(&entry->rule);
984 		if (err) {
985 			mutex_unlock(&audit_filter_mutex);
986 			return err;
987 		}
988 	}
989 
990 	entry->rule.prio = ~0ULL;
991 	if (entry->rule.listnr == AUDIT_FILTER_EXIT ||
992 	    entry->rule.listnr == AUDIT_FILTER_URING_EXIT) {
993 		if (entry->rule.flags & AUDIT_FILTER_PREPEND)
994 			entry->rule.prio = ++prio_high;
995 		else
996 			entry->rule.prio = --prio_low;
997 	}
998 
999 	if (entry->rule.flags & AUDIT_FILTER_PREPEND) {
1000 		list_add(&entry->rule.list,
1001 			 &audit_rules_list[entry->rule.listnr]);
1002 		list_add_rcu(&entry->list, list);
1003 		entry->rule.flags &= ~AUDIT_FILTER_PREPEND;
1004 	} else {
1005 		list_add_tail(&entry->rule.list,
1006 			      &audit_rules_list[entry->rule.listnr]);
1007 		list_add_tail_rcu(&entry->list, list);
1008 	}
1009 #ifdef CONFIG_AUDITSYSCALL
1010 	if (!dont_count)
1011 		audit_n_rules++;
1012 
1013 	if (!audit_match_signal(entry))
1014 		audit_signals++;
1015 #endif
1016 	mutex_unlock(&audit_filter_mutex);
1017 
1018 	return err;
1019 }
1020 
1021 /* Remove an existing rule from filterlist. */
audit_del_rule(struct audit_entry * entry)1022 int audit_del_rule(struct audit_entry *entry)
1023 {
1024 	struct audit_entry  *e;
1025 	struct audit_tree *tree = entry->rule.tree;
1026 	struct list_head *list;
1027 	int ret = 0;
1028 #ifdef CONFIG_AUDITSYSCALL
1029 	int dont_count = 0;
1030 
1031 	/* If any of these, don't count towards total */
1032 	switch(entry->rule.listnr) {
1033 	case AUDIT_FILTER_USER:
1034 	case AUDIT_FILTER_EXCLUDE:
1035 	case AUDIT_FILTER_FS:
1036 		dont_count = 1;
1037 	}
1038 #endif
1039 
1040 	mutex_lock(&audit_filter_mutex);
1041 	e = audit_find_rule(entry, &list);
1042 	if (!e) {
1043 		ret = -ENOENT;
1044 		goto out;
1045 	}
1046 
1047 	if (e->rule.watch)
1048 		audit_remove_watch_rule(&e->rule);
1049 
1050 	if (e->rule.tree)
1051 		audit_remove_tree_rule(&e->rule);
1052 
1053 	if (e->rule.exe)
1054 		audit_remove_mark_rule(&e->rule);
1055 
1056 #ifdef CONFIG_AUDITSYSCALL
1057 	if (!dont_count)
1058 		audit_n_rules--;
1059 
1060 	if (!audit_match_signal(entry))
1061 		audit_signals--;
1062 #endif
1063 
1064 	list_del_rcu(&e->list);
1065 	list_del(&e->rule.list);
1066 	call_rcu(&e->rcu, audit_free_rule_rcu);
1067 
1068 out:
1069 	mutex_unlock(&audit_filter_mutex);
1070 
1071 	if (tree)
1072 		audit_put_tree(tree);	/* that's the temporary one */
1073 
1074 	return ret;
1075 }
1076 
1077 /* List rules using struct audit_rule_data. */
audit_list_rules(int seq,struct sk_buff_head * q)1078 static void audit_list_rules(int seq, struct sk_buff_head *q)
1079 {
1080 	struct sk_buff *skb;
1081 	struct audit_krule *r;
1082 	int i;
1083 
1084 	/* This is a blocking read, so use audit_filter_mutex instead of rcu
1085 	 * iterator to sync with list writers. */
1086 	for (i=0; i<AUDIT_NR_FILTERS; i++) {
1087 		list_for_each_entry(r, &audit_rules_list[i], list) {
1088 			struct audit_rule_data *data;
1089 
1090 			data = audit_krule_to_data(r);
1091 			if (unlikely(!data))
1092 				break;
1093 			skb = audit_make_reply(seq, AUDIT_LIST_RULES, 0, 1,
1094 					       data,
1095 					       sizeof(*data) + data->buflen);
1096 			if (skb)
1097 				skb_queue_tail(q, skb);
1098 			kfree(data);
1099 		}
1100 	}
1101 	skb = audit_make_reply(seq, AUDIT_LIST_RULES, 1, 1, NULL, 0);
1102 	if (skb)
1103 		skb_queue_tail(q, skb);
1104 }
1105 
1106 /* Log rule additions and removals */
audit_log_rule_change(char * action,struct audit_krule * rule,int res)1107 static void audit_log_rule_change(char *action, struct audit_krule *rule, int res)
1108 {
1109 	struct audit_buffer *ab;
1110 
1111 	if (!audit_enabled)
1112 		return;
1113 
1114 	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONFIG_CHANGE);
1115 	if (!ab)
1116 		return;
1117 	audit_log_session_info(ab);
1118 	audit_log_task_context(ab);
1119 	audit_log_format(ab, " op=%s", action);
1120 	audit_log_key(ab, rule->filterkey);
1121 	audit_log_format(ab, " list=%d res=%d", rule->listnr, res);
1122 	audit_log_end(ab);
1123 }
1124 
1125 /**
1126  * audit_rule_change - apply all rules to the specified message type
1127  * @type: audit message type
1128  * @seq: netlink audit message sequence (serial) number
1129  * @data: payload data
1130  * @datasz: size of payload data
1131  */
audit_rule_change(int type,int seq,void * data,size_t datasz)1132 int audit_rule_change(int type, int seq, void *data, size_t datasz)
1133 {
1134 	int err = 0;
1135 	struct audit_entry *entry;
1136 
1137 	switch (type) {
1138 	case AUDIT_ADD_RULE:
1139 		entry = audit_data_to_entry(data, datasz);
1140 		if (IS_ERR(entry))
1141 			return PTR_ERR(entry);
1142 		err = audit_add_rule(entry);
1143 		audit_log_rule_change("add_rule", &entry->rule, !err);
1144 		break;
1145 	case AUDIT_DEL_RULE:
1146 		entry = audit_data_to_entry(data, datasz);
1147 		if (IS_ERR(entry))
1148 			return PTR_ERR(entry);
1149 		err = audit_del_rule(entry);
1150 		audit_log_rule_change("remove_rule", &entry->rule, !err);
1151 		break;
1152 	default:
1153 		WARN_ON(1);
1154 		return -EINVAL;
1155 	}
1156 
1157 	if (err || type == AUDIT_DEL_RULE) {
1158 		if (entry->rule.exe)
1159 			audit_remove_mark(entry->rule.exe);
1160 		audit_free_rule(entry);
1161 	}
1162 
1163 	return err;
1164 }
1165 
1166 /**
1167  * audit_list_rules_send - list the audit rules
1168  * @request_skb: skb of request we are replying to (used to target the reply)
1169  * @seq: netlink audit message sequence (serial) number
1170  */
audit_list_rules_send(struct sk_buff * request_skb,int seq)1171 int audit_list_rules_send(struct sk_buff *request_skb, int seq)
1172 {
1173 	struct task_struct *tsk;
1174 	struct audit_netlink_list *dest;
1175 
1176 	/* We can't just spew out the rules here because we might fill
1177 	 * the available socket buffer space and deadlock waiting for
1178 	 * auditctl to read from it... which isn't ever going to
1179 	 * happen if we're actually running in the context of auditctl
1180 	 * trying to _send_ the stuff */
1181 
1182 	dest = kmalloc(sizeof(*dest), GFP_KERNEL);
1183 	if (!dest)
1184 		return -ENOMEM;
1185 	dest->net = get_net(sock_net(NETLINK_CB(request_skb).sk));
1186 	dest->portid = NETLINK_CB(request_skb).portid;
1187 	skb_queue_head_init(&dest->q);
1188 
1189 	mutex_lock(&audit_filter_mutex);
1190 	audit_list_rules(seq, &dest->q);
1191 	mutex_unlock(&audit_filter_mutex);
1192 
1193 	tsk = kthread_run(audit_send_list_thread, dest, "audit_send_list");
1194 	if (IS_ERR(tsk)) {
1195 		skb_queue_purge(&dest->q);
1196 		put_net(dest->net);
1197 		kfree(dest);
1198 		return PTR_ERR(tsk);
1199 	}
1200 
1201 	return 0;
1202 }
1203 
audit_comparator(u32 left,u32 op,u32 right)1204 int audit_comparator(u32 left, u32 op, u32 right)
1205 {
1206 	switch (op) {
1207 	case Audit_equal:
1208 		return (left == right);
1209 	case Audit_not_equal:
1210 		return (left != right);
1211 	case Audit_lt:
1212 		return (left < right);
1213 	case Audit_le:
1214 		return (left <= right);
1215 	case Audit_gt:
1216 		return (left > right);
1217 	case Audit_ge:
1218 		return (left >= right);
1219 	case Audit_bitmask:
1220 		return (left & right);
1221 	case Audit_bittest:
1222 		return ((left & right) == right);
1223 	default:
1224 		return 0;
1225 	}
1226 }
1227 
audit_uid_comparator(kuid_t left,u32 op,kuid_t right)1228 int audit_uid_comparator(kuid_t left, u32 op, kuid_t right)
1229 {
1230 	switch (op) {
1231 	case Audit_equal:
1232 		return uid_eq(left, right);
1233 	case Audit_not_equal:
1234 		return !uid_eq(left, right);
1235 	case Audit_lt:
1236 		return uid_lt(left, right);
1237 	case Audit_le:
1238 		return uid_lte(left, right);
1239 	case Audit_gt:
1240 		return uid_gt(left, right);
1241 	case Audit_ge:
1242 		return uid_gte(left, right);
1243 	case Audit_bitmask:
1244 	case Audit_bittest:
1245 	default:
1246 		return 0;
1247 	}
1248 }
1249 
audit_gid_comparator(kgid_t left,u32 op,kgid_t right)1250 int audit_gid_comparator(kgid_t left, u32 op, kgid_t right)
1251 {
1252 	switch (op) {
1253 	case Audit_equal:
1254 		return gid_eq(left, right);
1255 	case Audit_not_equal:
1256 		return !gid_eq(left, right);
1257 	case Audit_lt:
1258 		return gid_lt(left, right);
1259 	case Audit_le:
1260 		return gid_lte(left, right);
1261 	case Audit_gt:
1262 		return gid_gt(left, right);
1263 	case Audit_ge:
1264 		return gid_gte(left, right);
1265 	case Audit_bitmask:
1266 	case Audit_bittest:
1267 	default:
1268 		return 0;
1269 	}
1270 }
1271 
1272 /**
1273  * parent_len - find the length of the parent portion of a pathname
1274  * @path: pathname of which to determine length
1275  */
parent_len(const char * path)1276 int parent_len(const char *path)
1277 {
1278 	int plen;
1279 	const char *p;
1280 
1281 	plen = strlen(path);
1282 
1283 	if (plen == 0)
1284 		return plen;
1285 
1286 	/* disregard trailing slashes */
1287 	p = path + plen - 1;
1288 	while ((*p == '/') && (p > path))
1289 		p--;
1290 
1291 	/* walk backward until we find the next slash or hit beginning */
1292 	while ((*p != '/') && (p > path))
1293 		p--;
1294 
1295 	/* did we find a slash? Then increment to include it in path */
1296 	if (*p == '/')
1297 		p++;
1298 
1299 	return p - path;
1300 }
1301 
1302 /**
1303  * audit_compare_dname_path - compare given dentry name with last component in
1304  * 			      given path. Return of 0 indicates a match.
1305  * @dname:	dentry name that we're comparing
1306  * @path:	full pathname that we're comparing
1307  * @parentlen:	length of the parent if known. Passing in AUDIT_NAME_FULL
1308  * 		here indicates that we must compute this value.
1309  */
audit_compare_dname_path(const struct qstr * dname,const char * path,int parentlen)1310 int audit_compare_dname_path(const struct qstr *dname, const char *path, int parentlen)
1311 {
1312 	int dlen, pathlen;
1313 	const char *p;
1314 
1315 	dlen = dname->len;
1316 	pathlen = strlen(path);
1317 	if (pathlen < dlen)
1318 		return 1;
1319 
1320 	parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen;
1321 	if (pathlen - parentlen != dlen)
1322 		return 1;
1323 
1324 	p = path + parentlen;
1325 
1326 	return strncmp(p, dname->name, dlen);
1327 }
1328 
audit_filter(int msgtype,unsigned int listtype)1329 int audit_filter(int msgtype, unsigned int listtype)
1330 {
1331 	struct audit_entry *e;
1332 	int ret = 1; /* Audit by default */
1333 
1334 	rcu_read_lock();
1335 	list_for_each_entry_rcu(e, &audit_filter_list[listtype], list) {
1336 		int i, result = 0;
1337 
1338 		for (i = 0; i < e->rule.field_count; i++) {
1339 			struct audit_field *f = &e->rule.fields[i];
1340 			pid_t pid;
1341 			u32 sid;
1342 
1343 			switch (f->type) {
1344 			case AUDIT_PID:
1345 				pid = task_pid_nr(current);
1346 				result = audit_comparator(pid, f->op, f->val);
1347 				break;
1348 			case AUDIT_UID:
1349 				result = audit_uid_comparator(current_uid(), f->op, f->uid);
1350 				break;
1351 			case AUDIT_GID:
1352 				result = audit_gid_comparator(current_gid(), f->op, f->gid);
1353 				break;
1354 			case AUDIT_LOGINUID:
1355 				result = audit_uid_comparator(audit_get_loginuid(current),
1356 							      f->op, f->uid);
1357 				break;
1358 			case AUDIT_LOGINUID_SET:
1359 				result = audit_comparator(audit_loginuid_set(current),
1360 							  f->op, f->val);
1361 				break;
1362 			case AUDIT_MSGTYPE:
1363 				result = audit_comparator(msgtype, f->op, f->val);
1364 				break;
1365 			case AUDIT_SUBJ_USER:
1366 			case AUDIT_SUBJ_ROLE:
1367 			case AUDIT_SUBJ_TYPE:
1368 			case AUDIT_SUBJ_SEN:
1369 			case AUDIT_SUBJ_CLR:
1370 				if (f->lsm_rule) {
1371 					security_task_getsecid_subj(current,
1372 								    &sid);
1373 					result = security_audit_rule_match(sid,
1374 						   f->type, f->op, f->lsm_rule);
1375 				}
1376 				break;
1377 			case AUDIT_EXE:
1378 				result = audit_exe_compare(current, e->rule.exe);
1379 				if (f->op == Audit_not_equal)
1380 					result = !result;
1381 				break;
1382 			default:
1383 				goto unlock_and_return;
1384 			}
1385 			if (result < 0) /* error */
1386 				goto unlock_and_return;
1387 			if (!result)
1388 				break;
1389 		}
1390 		if (result > 0) {
1391 			if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_EXCLUDE)
1392 				ret = 0;
1393 			break;
1394 		}
1395 	}
1396 unlock_and_return:
1397 	rcu_read_unlock();
1398 	return ret;
1399 }
1400 
update_lsm_rule(struct audit_krule * r)1401 static int update_lsm_rule(struct audit_krule *r)
1402 {
1403 	struct audit_entry *entry = container_of(r, struct audit_entry, rule);
1404 	struct audit_entry *nentry;
1405 	int err = 0;
1406 
1407 	if (!security_audit_rule_known(r))
1408 		return 0;
1409 
1410 	nentry = audit_dupe_rule(r);
1411 	if (entry->rule.exe)
1412 		audit_remove_mark(entry->rule.exe);
1413 	if (IS_ERR(nentry)) {
1414 		/* save the first error encountered for the
1415 		 * return value */
1416 		err = PTR_ERR(nentry);
1417 		audit_panic("error updating LSM filters");
1418 		if (r->watch)
1419 			list_del(&r->rlist);
1420 		list_del_rcu(&entry->list);
1421 		list_del(&r->list);
1422 	} else {
1423 		if (r->watch || r->tree)
1424 			list_replace_init(&r->rlist, &nentry->rule.rlist);
1425 		list_replace_rcu(&entry->list, &nentry->list);
1426 		list_replace(&r->list, &nentry->rule.list);
1427 	}
1428 	call_rcu(&entry->rcu, audit_free_rule_rcu);
1429 
1430 	return err;
1431 }
1432 
1433 /* This function will re-initialize the lsm_rule field of all applicable rules.
1434  * It will traverse the filter lists serarching for rules that contain LSM
1435  * specific filter fields.  When such a rule is found, it is copied, the
1436  * LSM field is re-initialized, and the old rule is replaced with the
1437  * updated rule. */
audit_update_lsm_rules(void)1438 int audit_update_lsm_rules(void)
1439 {
1440 	struct audit_krule *r, *n;
1441 	int i, err = 0;
1442 
1443 	/* audit_filter_mutex synchronizes the writers */
1444 	mutex_lock(&audit_filter_mutex);
1445 
1446 	for (i = 0; i < AUDIT_NR_FILTERS; i++) {
1447 		list_for_each_entry_safe(r, n, &audit_rules_list[i], list) {
1448 			int res = update_lsm_rule(r);
1449 			if (!err)
1450 				err = res;
1451 		}
1452 	}
1453 	mutex_unlock(&audit_filter_mutex);
1454 
1455 	return err;
1456 }
1457