audit by executable name

PATCH Superseded Richard Guy Briggs 1 participant 13 messages Jul 2, 2014 Audit

lore

Share & tools

lore

Richard Guy Briggs

author

2014-07-02 18:05 UTC #0 lore raw

v3 cover audit by executable name

This is a part of Peter Moody, my and Eric Paris' work to implement audit by executable name.

The fixup! patches are intended to be autosquashed down by git in the final set of patches to be submitted, but they have been included here to show progress. Some are quite obvious.

Please see the accompanying userspace patch:

	https://www.redhat.com/archives/linux-audit/2014-May/msg00019.html

The userspace interface is not expected to change appreciably unless something important has been overlooked. Setting and deleting rules works as expected.

If the path does not exist at rule creation time, it will be re-evaluated every time there is a change to the parent directory at which point the change in device and inode will be noted.

Here's a test run:

# /usr/local/sbin/auditctl -a always,exit -F dir=/tmp -F exe=/bin/touch -F key=touch_tmp
# /usr/local/sbin/ausearch --start recent -k touch_tmp
time->Mon Jun 30 14:15:06 2014
type=CONFIG_CHANGE msg=audit(1404152106.683:149): auid=0 ses=1 subj=unconfined_u :unconfined_r:auditctl_t:s0-s0:c0.c1023 op="add rule" key="touch_tmp" list=4 res =1

# /usr/local/sbin/auditctl -l
-a always,exit -S all -F dir=/tmp -F exe=/bin/touch -F key=touch_tmp

# touch /tmp/test

# /usr/local/sbin/ausearch --start recent -k touch_tmp
time->Wed Jul  2 12:18:47 2014
type=UNKNOWN[1327] msg=audit(1404317927.319:132): proctitle=746F756368002F746D702F74657374
type=PATH msg=audit(1404317927.319:132): item=1 name="/tmp/test" inode=25997 dev=00:20 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE
type=PATH msg=audit(1404317927.319:132): item=0 name="/tmp/" inode=11144 dev=00:20 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype=PARENT
type=CWD msg=audit(1404317927.319:132):  cwd="/root"
type=SYSCALL msg=audit(1404317927.319:132): arch=c000003e syscall=2 success=yes exit=3 a0=7ffffa403dd5 a1=941 a2=1b6 a3=34b65b2c6c items=2 ppid=4321 pid=6436 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=1 comm="touch" exe="/usr/bin/touch" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="touch_tmp"

Revision history:
v3: rationalize and rename some function names and clean up get/put and free code.

v2: misguided attempt to add in audit_exe similar to watches

	https://www.redhat.com/archives/linux-audit/2014-June/msg00066.html

v1.5: eparis' switch to fsnotify

	https://www.redhat.com/archives/linux-audit/2014-May/msg00046.html
	https://www.redhat.com/archives/linux-audit/2014-May/msg00066.html

v1: change to path interface instead of inode

	https://www.redhat.com/archives/linux-audit/2014-May/msg00017.html

v0: Peter Moodie's original patches

Next step:
Get full-path notify working.

Eric Paris (3):
audit: implement audit by executable
audit: clean simple fsnotify implementation
audit: convert audit_exe to audit_fsnotify

Richard Guy Briggs (9):
fixup! audit: clean simple fsnotify implementation fixup! audit: convert audit_exe to audit_fsnotify fixup! audit: clean simple fsnotify implementation
audit: avoid double copying the audit_exe path string fixup! audit: convert audit_exe to audit_fsnotify fixup! audit: clean simple fsnotify implementation fixup! audit: implement audit by executable fixup! audit: clean simple fsnotify implementation fixup! audit: clean simple fsnotify implementation

 include/linux/audit.h      |    1 +
 include/uapi/linux/audit.h |    2 +
 kernel/Makefile            |    2 +-
 kernel/audit.h             |   39 +++++++
 kernel/audit_exe.c         |   46 +++++++++
 kernel/audit_fsnotify.c    |  237 ++++++++++++++++++++++++++++++++++++++++++++
 kernel/auditfilter.c       |   51 +++++++++-
 kernel/auditsc.c           |   16 +++
 8 files changed, 391 insertions(+), 3 deletions(-)
 create mode 100644 kernel/audit_exe.c
 create mode 100644 kernel/audit_fsnotify.c

Richard Guy Briggs

author

2014-07-02 18:05 UTC #1 lore raw

PATCH v3 1/12 audit: implement audit by executable

From: Eric Paris <[email protected]>

This patch implements the ability to filter on the executable. It is clearly incomplete! This patch adds the inode/dev of the executable at the moment the rule is loaded. It does not update if the executable is updated/moved/whatever. That should be added. But at this moment, this patch works.

Based-on-user-interface-by Richard Guy Briggs <[email protected]>

Cc [email protected]

Based-on-idea-by Peter Moody <[email protected]>

Cc [email protected]

Signed-off-by Eric Paris <[email protected]>

Signed-off-by Richard Guy Briggs <[email protected]>

---
 include/linux/audit.h      |    1 +
 include/uapi/linux/audit.h |    2 +
 kernel/Makefile            |    2 +-
 kernel/audit.h             |   32 +++++++++++++
 kernel/audit_exe.c         |  109 ++++++++++++++++++++++++++++++++++++++++++++
 kernel/auditfilter.c       |   43 +++++++++++++++++
 kernel/auditsc.c           |   16 ++++++
 7 files changed, 204 insertions(+), 1 deletions(-)
 create mode 100644 kernel/audit_exe.c

include/linux/audit.h +1 -0

index 22cfddb..227171c 100644
@@ -59,6 +59,7 @@ struct audit_krule {
 	struct audit_field	*inode_f; /* quick access to an inode field */
 	struct audit_watch	*watch;	/* associated watch */
 	struct audit_tree	*tree;	/* associated watched tree */
+	struct audit_exe	*exe;
 	struct list_head	rlist;	/* entry in audit_{watch,tree}.rules list */
 	struct list_head	list;	/* for AUDIT_LIST* purposes only */
 	u64			prio;

include/uapi/linux/audit.h +2 -0

index 573dc36..f4a72b9 100644
@@ -266,6 +266,8 @@
 #define AUDIT_OBJ_UID	109
 #define AUDIT_OBJ_GID	110
 #define AUDIT_FIELD_COMPARE	111
+#define AUDIT_EXE	112
+#define AUDIT_EXE_CHILDREN	113
 
 #define AUDIT_ARG0      200
 #define AUDIT_ARG1      (AUDIT_ARG0+1)

kernel/Makefile +1 -1

index bc010ee..a1d5715 100644
@@ -61,7 +61,7 @@ obj-$(CONFIG_SMP) += stop_machine.o
 obj-$(CONFIG_KPROBES_SANITY_TEST) += test_kprobes.o
 obj-$(CONFIG_AUDIT) += audit.o auditfilter.o
 obj-$(CONFIG_AUDITSYSCALL) += auditsc.o
-obj-$(CONFIG_AUDIT_WATCH) += audit_watch.o
+obj-$(CONFIG_AUDIT_WATCH) += audit_watch.o audit_exe.o
 obj-$(CONFIG_AUDIT_TREE) += audit_tree.o
 obj-$(CONFIG_GCOV_KERNEL) += gcov/
 obj-$(CONFIG_KPROBES) += kprobes.o

kernel/audit.h +32 -0

index 7bb6573..c975569 100644
@@ -56,6 +56,7 @@ enum audit_state {
 
 /* Rule lists */
 struct audit_watch;
+struct audit_exe;
 struct audit_tree;
 struct audit_chunk;

@@ -280,6 +281,13 @@ extern int audit_add_watch(struct audit_krule *krule, struct list_head **list);
 extern void audit_remove_watch_rule(struct audit_krule *krule);
 extern char *audit_watch_path(struct audit_watch *watch);
 extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev);
+
+int audit_make_exe_rule(struct audit_krule *krule, char *pathname, int len, u32 op);
+void audit_remove_exe_rule(struct audit_krule *krule);
+char *audit_exe_path(struct audit_exe *exe);
+int audit_dup_exe(struct audit_krule *new, struct audit_krule *old);
+int audit_exe_compare(struct task_struct *tsk, struct audit_exe *exe);
+
 #else
 #define audit_put_watch(w) {}
 #define audit_get_watch(w) {}

@@ -289,6 +297,30 @@ extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev
 #define audit_watch_path(w) ""
 #define audit_watch_compare(w, i, d) 0
 
+static inline int audit_make_exe_rule(struct audit_krule *krule, char *pathname, int len, u32 op)
+{
+	return -EINVAL;
+}
+static inline void audit_remove_exe_rule(struct audit_krule *krule)
+{
+	BUG();
+	return 0;
+}
+static inline char *audit_exe_path(struct audit_exe *exe)
+{
+	BUG();
+	return "";
+}
+static inline int audit_dup_exe(struct audit_krule *new, struct audit_krule *old)
+{
+	BUG();
+	return -EINVAL
+}
+static inline int audit_exe_compare(struct task_struct *tsk, struct audit_exe *exe)
+{
+	BUG();
+	return 0;
+}
 #endif /* CONFIG_AUDIT_WATCH */
 
 #ifdef CONFIG_AUDIT_TREE

kernel/audit_exe.c new file +109 -0

109 lines not on this page · raw message

kernel/auditfilter.c +43 -0

79 lines not on this page · raw message

kernel/auditsc.c +16 -0

index f251a5e..2513726 100644
@@ -48,6 +48,7 @@
 #include <asm/types.h>
 #include <linux/atomic.h>
 #include <linux/fs.h>
+#include <linux/dcache.h>
 #include <linux/namei.h>
 #include <linux/mm.h>
 #include <linux/export.h>

@@ -70,6 +71,7 @@
 #include <linux/capability.h>
 #include <linux/fs_struct.h>
 #include <linux/compat.h>
+#include <linux/sched.h>
 #include <linux/ctype.h>
 
 #include "audit.h"

@@ -471,6 +473,20 @@ static int audit_filter_rules(struct task_struct *tsk,
 				result = audit_comparator(ctx->ppid, f->op, f->val);
 			}
 			break;
+		case AUDIT_EXE:
+			result = audit_exe_compare(tsk, rule->exe);
+			break;
+		case AUDIT_EXE_CHILDREN:
+		{
+			struct task_struct *ptsk;
+			for (ptsk = tsk; ptsk->parent->pid > 0; ptsk = find_task_by_vpid(ptsk->parent->pid)) {
+				if (audit_exe_compare(ptsk, rule->exe)) {
+					++result;
+					break;
+				}
+			}
+		}
+			break;
 		case AUDIT_UID:
 			result = audit_uid_comparator(cred->uid, f->op, f->uid);
 			break;

Signature · 1 line

1.7.1

Richard Guy Briggs

author

2014-07-02 18:05 UTC #2 lore raw

PATCH v3 2/12 audit: clean simple fsnotify implementation

In reply to Richard Guy Briggs

From: Eric Paris <[email protected]>

This is to be used to audit by executable rules, but audit watches should be able to share this code eventually.

At the moment the audit watch code is a lot more complex, that code only creates one fsnotify watch per parent directory. That 'audit_parent' in turn has a list of 'audit_watches' which contain the name, ino, dev of the specific object we care about. This just creates one fsnotify watch per object we care about. So if you watch 100 inodes in /etc this code will create 100 fsnotify watches on /etc. The audit_watch code will instead create 1 fsnotify watch on /etc (the audit_parent) and then 100 individual watches chained from that fsnotify mark.

We should be able to convert the audit_watch code to do one fsnotify mark per watch and simplify things/remove a whole lot of code. After that conversion we should be able to convert the audit_fsnotify code to support that hierarchy if the optomization is necessary.

Signed-off-by Eric Paris <[email protected]>

Signed-off-by Richard Guy Briggs <[email protected]>

---
 kernel/Makefile         |    2 +-
 kernel/audit.h          |   29 ++++++
 kernel/audit_fsnotify.c |  246 +++++++++++++++++++++++++++++++++++++++++++++++
 kernel/auditfilter.c    |    2 +-
 4 files changed, 277 insertions(+), 2 deletions(-)
 create mode 100644 kernel/audit_fsnotify.c

kernel/Makefile +1 -1

index a1d5715..32617ef 100644
@@ -61,7 +61,7 @@ obj-$(CONFIG_SMP) += stop_machine.o
 obj-$(CONFIG_KPROBES_SANITY_TEST) += test_kprobes.o
 obj-$(CONFIG_AUDIT) += audit.o auditfilter.o
 obj-$(CONFIG_AUDITSYSCALL) += auditsc.o
-obj-$(CONFIG_AUDIT_WATCH) += audit_watch.o audit_exe.o
+obj-$(CONFIG_AUDIT_WATCH) += audit_watch.o audit_exe.o audit_fsnotify.o
 obj-$(CONFIG_AUDIT_TREE) += audit_tree.o
 obj-$(CONFIG_GCOV_KERNEL) += gcov/
 obj-$(CONFIG_KPROBES) += kprobes.o

kernel/audit.h +29 -0

index c975569..1eed1ed 100644
@@ -56,6 +56,7 @@ enum audit_state {
 
 /* Rule lists */
 struct audit_watch;
+struct audit_fsnotify_mark;
 struct audit_exe;
 struct audit_tree;
 struct audit_chunk;

@@ -267,6 +268,7 @@ struct audit_net {
 extern int selinux_audit_rule_update(void);
 
 extern struct mutex audit_filter_mutex;
+extern int audit_del_rule(struct audit_entry *);
 extern void audit_free_rule_rcu(struct rcu_head *);
 extern struct list_head audit_filter_list[];

@@ -282,6 +284,11 @@ extern void audit_remove_watch_rule(struct audit_krule *krule);
 extern char *audit_watch_path(struct audit_watch *watch);
 extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev);
 
+struct audit_fsnotify_mark *audit_alloc_mark(char *pathname, int len, struct audit_krule *krule);
+char *audit_mark_path(struct audit_fsnotify_mark *mark);
+void audit_remove_mark(struct audit_fsnotify_mark *audit_mark);
+int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev);
+
 int audit_make_exe_rule(struct audit_krule *krule, char *pathname, int len, u32 op);
 void audit_remove_exe_rule(struct audit_krule *krule);
 char *audit_exe_path(struct audit_exe *exe);

@@ -297,6 +304,28 @@ int audit_exe_compare(struct task_struct *tsk, struct audit_exe *exe);
 #define audit_watch_path(w) ""
 #define audit_watch_compare(w, i, d) 0
 
+static inline struct audit_fsnotify_mark *audit_alloc_mark(char *pathname, int len, struct audit_krule *krule)
+{
+	return ERR_PTR(-EINVAL);
+}
+
+static inline char *audit_mark_path(struct audit_fsnotify_mark *mark)
+{
+	BUG();
+	return "";
+}
+
+static inline void audit_remove_mark(struct audit_fsnotify_mark *audit_mark)
+{
+	BUG();
+}
+
+static inline int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev)
+{
+	BUG();
+	return 0;
+}
+
 static inline int audit_make_exe_rule(struct audit_krule *krule, char *pathname, int len, u32 op)
 {
 	return -EINVAL;

kernel/audit_fsnotify.c new file +246 -0

246 lines not on this page · raw message

kernel/auditfilter.c +1 -1

index 9caeaf5..5c1951a 100644
@@ -977,7 +977,7 @@ error:
 }
 
 /* Remove an existing rule from filterlist. */
-static inline int audit_del_rule(struct audit_entry *entry)
+int audit_del_rule(struct audit_entry *entry)
 {
 	struct audit_entry  *e;
 	struct audit_watch *watch = entry->rule.watch;

Signature · 1 line

1.7.1

Richard Guy Briggs

author

2014-07-02 18:05 UTC #3 lore raw

PATCH v3 3/12 audit: convert audit_exe to audit_fsnotify

In reply to Richard Guy Briggs

From: Eric Paris <[email protected]>

Instead of just hard coding the ino and dev of the executable we care about at the moment the rule is inserted into the kernel, use the new audit_fsnotify infrastructure. This means that if the inode in question is unlinked and creat'd (aka updated) the rule will just continue to work.

Signed-off-by Eric Paris <[email protected]>

Signed-off-by Richard Guy Briggs <[email protected]>

---
 include/linux/audit.h |    2 +-
 kernel/audit.h        |   32 +++---------------
 kernel/audit_exe.c    |   87 +++++++------------------------------------------
 kernel/auditfilter.c  |   18 ++++++----
 4 files changed, 29 insertions(+), 110 deletions(-)

include/linux/audit.h +1 -1

index 227171c..f2a8044 100644
@@ -59,7 +59,7 @@ struct audit_krule {
 	struct audit_field	*inode_f; /* quick access to an inode field */
 	struct audit_watch	*watch;	/* associated watch */
 	struct audit_tree	*tree;	/* associated watched tree */
-	struct audit_exe	*exe;
+	struct audit_fsnotify_mark	*exe;
 	struct list_head	rlist;	/* entry in audit_{watch,tree}.rules list */
 	struct list_head	list;	/* for AUDIT_LIST* purposes only */
 	u64			prio;

kernel/audit.h +5 ~~-27~~

index 1eed1ed..61688ba 100644
@@ -57,7 +57,6 @@ enum audit_state {
 /* Rule lists */
 struct audit_watch;
 struct audit_fsnotify_mark;
-struct audit_exe;
 struct audit_tree;
 struct audit_chunk;

@@ -289,11 +288,8 @@ char *audit_mark_path(struct audit_fsnotify_mark *mark);
 void audit_remove_mark(struct audit_fsnotify_mark *audit_mark);
 int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev);
 
-int audit_make_exe_rule(struct audit_krule *krule, char *pathname, int len, u32 op);
-void audit_remove_exe_rule(struct audit_krule *krule);
-char *audit_exe_path(struct audit_exe *exe);
 int audit_dup_exe(struct audit_krule *new, struct audit_krule *old);
-int audit_exe_compare(struct task_struct *tsk, struct audit_exe *exe);
+int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark);
 
 #else
 #define audit_put_watch(w) {}

@@ -320,36 +316,18 @@ static inline void audit_remove_mark(struct audit_fsnotify_mark *audit_mark)
 	BUG();
 }
 
-static inline int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev)
+static inline int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
 {
 	BUG();
-	return 0;
-}
-
-static inline int audit_make_exe_rule(struct audit_krule *krule, char *pathname, int len, u32 op)
-{
 	return -EINVAL;
 }
-static inline void audit_remove_exe_rule(struct audit_krule *krule)
-{
-	BUG();
-	return 0;
-}
-static inline char *audit_exe_path(struct audit_exe *exe)
-{
-	BUG();
-	return "";
-}
+
 static inline int audit_dup_exe(struct audit_krule *new, struct audit_krule *old)
 {
 	BUG();
-	return -EINVAL
-}
-static inline int audit_exe_compare(struct task_struct *tsk, struct audit_exe *exe)
-{
-	BUG();
-	return 0;
+	return -EINVAL;
 }
+
 #endif /* CONFIG_AUDIT_WATCH */
 
 #ifdef CONFIG_AUDIT_TREE

kernel/audit_exe.c +12 ~~-75~~

105 lines not on this page · raw message

kernel/auditfilter.c +11 -7

index 5c1951a..30091ce 100644
@@ -411,6 +411,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
 	size_t remain = datasz - sizeof(struct audit_rule_data);
 	int i;
 	char *str;
+	struct audit_fsnotify_mark *audit_mark;
 
 	entry = audit_to_entry_common(data);
 	if (IS_ERR(entry))

@@ -550,6 +551,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
 			break;
 		case AUDIT_EXE:
 		case AUDIT_EXE_CHILDREN:
+
 			if (entry->rule.exe || f->val > PATH_MAX)
 				goto exit_free;
 			str = audit_unpack_string(&bufp, &remain, f->val);

@@ -559,11 +561,13 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
 			}
 			entry->rule.buflen += f->val;
 
-			err = audit_make_exe_rule(&entry->rule, str, f->val, f->op);
-			if (err) {
-				kfree(str);
+			audit_mark = audit_alloc_mark(str, f->val, &entry->rule);
+			kfree(str);
+			if (IS_ERR(audit_mark)) {
+				err = PTR_ERR(audit_mark);
 				goto exit_free;
 			}
+			entry->rule.exe = audit_mark;
 			break;
 		}
 	}

@@ -646,7 +650,7 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
 		case AUDIT_EXE:
 		case AUDIT_EXE_CHILDREN:
 			data->buflen += data->values[i] =
-				audit_pack_string(&bufp, audit_exe_path(krule->exe));
+				audit_pack_string(&bufp, audit_mark_path(krule->exe));
 			break;
 		default:
 			data->values[i] = f->val;

@@ -706,8 +710,8 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
 		case AUDIT_EXE:
 		case AUDIT_EXE_CHILDREN:
 			/* both paths exist based on above type compare */
-			if (strcmp(audit_exe_path(a->exe),
-				   audit_exe_path(b->exe)))
+			if (strcmp(audit_mark_path(a->exe),
+				   audit_mark_path(b->exe)))
 				return 1;
 			break;
 		case AUDIT_UID:

@@ -1008,7 +1012,7 @@ int audit_del_rule(struct audit_entry *entry)
 		audit_remove_tree_rule(&e->rule);
 
 	if (e->rule.exe)
-		audit_remove_exe_rule(&e->rule);
+		audit_remove_mark(e->rule.exe);
 	list_del_rcu(&e->list);
 	list_del(&e->rule.list);
 	call_rcu(&e->rcu, audit_free_rule_rcu);

Signature · 1 line

1.7.1

Richard Guy Briggs

author

2014-07-02 18:05 UTC #4 lore raw

PATCH v3 4/12 fixup! audit: clean simple fsnotify implementation

In reply to Richard Guy Briggs

Move the access to the entry for audit_match_signal() to the beginning of the function in case the entry found is the same one passed in. This will enable it to be used by audit_remove_mark_rule().

Signed-off-by Richard Guy Briggs <[email protected]>

---
This might benefit from a flag to tell it to delete the entry handed it rather than searching for an identical one.

---
 kernel/auditfilter.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

kernel/auditfilter.c +2 -1

index 30091ce..9b2db56 100644
@@ -990,6 +990,7 @@ int audit_del_rule(struct audit_entry *entry)
 	int ret = 0;
 #ifdef CONFIG_AUDITSYSCALL
 	int dont_count = 0;
+	int match = audit_match_signal(entry);
 
 	/* If either of these, don't count towards total */
 	if (entry->rule.listnr == AUDIT_FILTER_USER ||

@@ -1021,7 +1022,7 @@ int audit_del_rule(struct audit_entry *entry)
 	if (!dont_count)
 		audit_n_rules--;
 
-	if (!audit_match_signal(entry))
+	if (!match)
 		audit_signals--;
 #endif
 	mutex_unlock(&audit_filter_mutex);

Signature · 1 line

1.7.1

Richard Guy Briggs

author

2014-07-02 18:05 UTC #5 lore raw

PATCH v3 5/12 fixup! audit: convert audit_exe to audit_fsnotify

In reply to Richard Guy Briggs

Remove unnecessary space.

Signed-off-by Richard Guy Briggs <[email protected]>

---
 kernel/auditfilter.c |    1 -
 1 files changed, 0 insertions(+), 1 deletions(-)

kernel/auditfilter.c +0 -1

index 9b2db56..d57c57d 100644
@@ -551,7 +551,6 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
 			break;
 		case AUDIT_EXE:
 		case AUDIT_EXE_CHILDREN:
-
 			if (entry->rule.exe || f->val > PATH_MAX)
 				goto exit_free;
 			str = audit_unpack_string(&bufp, &remain, f->val);

Signature · 1 line

1.7.1

Richard Guy Briggs

author

2014-07-02 18:05 UTC #6 lore raw

PATCH v3 6/12 fixup! audit: clean simple fsnotify implementation

In reply to Richard Guy Briggs

Rename several "watch" references to "mark".

Signed-off-by Richard Guy Briggs <[email protected]>

---
 kernel/audit_fsnotify.c |   16 ++++++++--------
 1 files changed, 8 insertions(+), 8 deletions(-)

kernel/audit_fsnotify.c +8 -8

index b936213..c66e91b 100644
@@ -1,4 +1,4 @@
-/* audit_watch.c -- watching inodes
+/* audit_fsnotify.c -- tracking inodes
  *
  * Copyright 2003-2009 Red Hat, Inc.
  * Copyright 2005 Hewlett-Packard Development Company, L.P.

@@ -145,7 +145,7 @@ out:
 	return audit_mark;
 }
 
-static void audit_watch_log_rule_change(struct audit_fsnotify_mark *audit_mark, char *op)
+static void audit_mark_log_rule_change(struct audit_fsnotify_mark *audit_mark, char *op)
 {
 	struct audit_buffer *ab;
 	struct audit_krule *rule = audit_mark->rule;

@@ -189,12 +189,12 @@ static void audit_remove_rule(struct audit_fsnotify_mark *audit_mark)
 	struct audit_krule *rule = audit_mark->rule;
 	struct audit_entry *entry = container_of(rule, struct audit_entry, rule);
 
-	audit_watch_log_rule_change(audit_mark, "remove rule");
+	audit_mark_log_rule_change(audit_mark, "remove rule");
 	audit_del_rule(entry);
 }
 
-/* Update watch data in audit rules based on fsnotify events. */
-static int audit_watch_handle_event(struct fsnotify_group *group,
+/* Update mark data in audit rules based on fsnotify events. */
+static int audit_mark_handle_event(struct fsnotify_group *group,
 				    struct inode *to_tell,
 				    struct fsnotify_mark *inode_mark,
 				    struct fsnotify_mark *vfsmount_mark,

@@ -230,13 +230,13 @@ static int audit_watch_handle_event(struct fsnotify_group *group,
 	return 0;
 }
 
-static const struct fsnotify_ops audit_watch_fsnotify_ops = {
-	.handle_event =	audit_watch_handle_event,
+static const struct fsnotify_ops audit_mark_fsnotify_ops = {
+	.handle_event =	audit_mark_handle_event,
 };
 
 static int __init audit_fsnotify_init(void)
 {
-	audit_fsnotify_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops);
+	audit_fsnotify_group = fsnotify_alloc_group(&audit_mark_fsnotify_ops);
 	if (IS_ERR(audit_fsnotify_group)) {
 		audit_fsnotify_group = NULL;
 		audit_panic("cannot create audit fsnotify group");

Signature · 1 line

1.7.1

Richard Guy Briggs

author

2014-07-02 18:05 UTC #7 lore raw

PATCH v3 7/12 audit: avoid double copying the audit_exe path string

In reply to Richard Guy Briggs

Make this interface consistent with watch and filter key, avoiding the extra string copy and simply consume the new string pointer.

Signed-off-by Richard Guy Briggs <[email protected]>

---
 kernel/audit_fsnotify.c |   12 ++----------
 kernel/auditfilter.c    |    2 +-
 2 files changed, 3 insertions(+), 11 deletions(-)

kernel/audit_fsnotify.c +2 ~~-10~~

index c66e91b..c396471 100644
@@ -94,7 +94,6 @@ struct audit_fsnotify_mark *audit_alloc_mark(char *pathname, int len, struct aud
 	struct dentry *dentry;
 	struct inode *inode;
 	unsigned long ino;
-	char *local_pathname;
 	dev_t dev;
 	int ret;

@@ -115,20 +114,13 @@ struct audit_fsnotify_mark *audit_alloc_mark(char *pathname, int len, struct aud
 		ino = dentry->d_inode->i_ino;
 	}
 
-	audit_mark = ERR_PTR(-ENOMEM);
-	local_pathname = kstrdup(pathname, GFP_KERNEL);
-	if (!local_pathname)
-		goto out;
-
 	audit_mark = kzalloc(sizeof(*audit_mark), GFP_KERNEL);
-	if (unlikely(!audit_mark)) {
-		kfree(local_pathname);
+	if (unlikely(!audit_mark))
 		goto out;
-	}
 
 	fsnotify_init_mark(&audit_mark->mark, audit_free_fsnotify_mark);
 	audit_mark->mark.mask = AUDIT_FS_EVENTS;
-	audit_mark->path = local_pathname;
+	audit_mark->path = pathname;
 	audit_mark->ino = ino;
 	audit_mark->dev = dev;
 	audit_mark->rule = krule;

kernel/auditfilter.c +1 -1

index d57c57d..7ffbd7d 100644
@@ -561,8 +561,8 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
 			entry->rule.buflen += f->val;
 
 			audit_mark = audit_alloc_mark(str, f->val, &entry->rule);
-			kfree(str);
 			if (IS_ERR(audit_mark)) {
+				kfree(str);
 				err = PTR_ERR(audit_mark);
 				goto exit_free;
 			}

Signature · 1 line

1.7.1

Richard Guy Briggs

author

2014-07-02 18:05 UTC #8 lore raw

PATCH v3 8/12 fixup! audit: convert audit_exe to audit_fsnotify

In reply to Richard Guy Briggs

Put audit_alloc_mark() arguments in same order as watch, tree and inode.

Signed-off-by Richard Guy Briggs <[email protected]>

---
 kernel/audit.h          |    2 +-
 kernel/audit_exe.c      |    2 +-
 kernel/audit_fsnotify.c |    2 +-
 kernel/auditfilter.c    |    2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

kernel/audit.h +1 -1

index 61688ba..7bf3138 100644
@@ -283,7 +283,7 @@ extern void audit_remove_watch_rule(struct audit_krule *krule);
 extern char *audit_watch_path(struct audit_watch *watch);
 extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev);
 
-struct audit_fsnotify_mark *audit_alloc_mark(char *pathname, int len, struct audit_krule *krule);
+struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len);
 char *audit_mark_path(struct audit_fsnotify_mark *mark);
 void audit_remove_mark(struct audit_fsnotify_mark *audit_mark);
 int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev);

kernel/audit_exe.c +1 -1

index b33a09a..0c7ee8d 100644
@@ -29,7 +29,7 @@ int audit_dup_exe(struct audit_krule *new, struct audit_krule *old)
 
 	pathname = audit_mark_path(old->exe);
 
-	audit_mark = audit_alloc_mark(pathname, strlen(pathname), new);
+	audit_mark = audit_alloc_mark(new, pathname, strlen(pathname));
 	if (IS_ERR(audit_mark))
 		return PTR_ERR(audit_mark);
 	new->exe = audit_mark;

kernel/audit_fsnotify.c +1 -1

index c396471..5469dc1 100644
@@ -87,7 +87,7 @@ int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_
 	return (mark->ino == ino) && (mark->dev == dev);
 }
 
-struct audit_fsnotify_mark *audit_alloc_mark(char *pathname, int len, struct audit_krule *krule)
+struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len)
 {
 	struct audit_fsnotify_mark *audit_mark;
 	struct path path;

kernel/auditfilter.c +1 -1

index 7ffbd7d..c3bf4bb 100644
@@ -560,7 +560,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
 			}
 			entry->rule.buflen += f->val;
 
-			audit_mark = audit_alloc_mark(str, f->val, &entry->rule);
+			audit_mark = audit_alloc_mark(&entry->rule, str, f->val);
 			if (IS_ERR(audit_mark)) {
 				kfree(str);
 				err = PTR_ERR(audit_mark);

Signature · 1 line

1.7.1

Richard Guy Briggs

author

2014-07-02 18:05 UTC #9 lore raw

PATCH v3 9/12 fixup! audit: clean simple fsnotify implementation

In reply to Richard Guy Briggs

Remove redundant goto.

Signed-off-by Richard Guy Briggs <[email protected]>

---
 kernel/audit_fsnotify.c |    1 -
 1 files changed, 0 insertions(+), 1 deletions(-)

kernel/audit_fsnotify.c +0 -1

index 5469dc1..a11cede 100644
@@ -129,7 +129,6 @@ struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pa
 	if (ret < 0) {
 		audit_free_mark(audit_mark);
 		audit_mark = ERR_PTR(ret);
-		goto out;
 	}
 out:
 	dput(dentry);

Signature · 1 line

1.7.1

Richard Guy Briggs

author

2014-07-02 18:05 UTC #10 lore raw

PATCH v3 10/12 fixup! audit: implement audit by executable

In reply to Richard Guy Briggs

Add space for consistency.

Signed-off-by Richard Guy Briggs <[email protected]>

---
 kernel/auditfilter.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

kernel/auditfilter.c +1 -0

index c3bf4bb..e9d0b2f 100644
@@ -1013,6 +1013,7 @@ int audit_del_rule(struct audit_entry *entry)
 
 	if (e->rule.exe)
 		audit_remove_mark(e->rule.exe);
+
 	list_del_rcu(&e->list);
 	list_del(&e->rule.list);
 	call_rcu(&e->rcu, audit_free_rule_rcu);

Signature · 1 line

1.7.1

Richard Guy Briggs

author

2014-07-02 18:05 UTC #11 lore raw

PATCH v3 11/12 fixup! audit: clean simple fsnotify implementation

In reply to Richard Guy Briggs

Rename audit_remove_rule() to audit_remove_mark_rule().

Signed-off-by Richard Guy Briggs <[email protected]>

---
 kernel/audit_fsnotify.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

kernel/audit_fsnotify.c +2 -2

index a11cede..07b33f7 100644
@@ -175,7 +175,7 @@ void audit_remove_mark(struct audit_fsnotify_mark *audit_mark)
 	fsnotify_put_mark(&audit_mark->mark);
 }
 
-static void audit_remove_rule(struct audit_fsnotify_mark *audit_mark)
+static void audit_remove_mark_rule(struct audit_fsnotify_mark *audit_mark)
 {
 	struct audit_krule *rule = audit_mark->rule;
 	struct audit_entry *entry = container_of(rule, struct audit_entry, rule);

@@ -216,7 +216,7 @@ static int audit_mark_handle_event(struct fsnotify_group *group,
 			return 0;
 		audit_update_mark(audit_mark, inode);
 	} else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF))
-		audit_remove_rule(audit_mark);
+		audit_remove_mark_rule(audit_mark);
 
 	return 0;
 }

Signature · 1 line

1.7.1

Richard Guy Briggs

author

2014-07-02 18:05 UTC #12 lore raw

PATCH v3 12/12 fixup! audit: clean simple fsnotify implementation

In reply to Richard Guy Briggs

Let audit_free_rule() take care of calling audit_remove_mark().

Signed-off-by Richard Guy Briggs <[email protected]>

---
 kernel/auditfilter.c |    5 ++---
 1 files changed, 2 insertions(+), 3 deletions(-)

kernel/auditfilter.c +2 -3

index e9d0b2f..ff99749 100644
@@ -79,6 +79,8 @@ static inline void audit_free_rule(struct audit_entry *e)
 	/* some rules don't have associated watches */
 	if (erule->watch)
 		audit_put_watch(erule->watch);
+	if (erule->exe)
+		audit_remove_mark(erule->exe);
 	if (erule->fields)
 		for (i = 0; i < erule->field_count; i++) {
 			struct audit_field *f = &erule->fields[i];

@@ -1011,9 +1013,6 @@ int audit_del_rule(struct audit_entry *entry)
 	if (e->rule.tree)
 		audit_remove_tree_rule(&e->rule);
 
-	if (e->rule.exe)
-		audit_remove_mark(e->rule.exe);
-
 	list_del_rcu(&e->list);
 	list_del(&e->rule.list);
 	call_rcu(&e->rcu, audit_free_rule_rcu);

Signature · 1 line

1.7.1