Back to home page

LXR

 
 

    


0001 #include "audit.h"
0002 #include <linux/fsnotify_backend.h>
0003 #include <linux/namei.h>
0004 #include <linux/mount.h>
0005 #include <linux/kthread.h>
0006 #include <linux/slab.h>
0007 
0008 struct audit_tree;
0009 struct audit_chunk;
0010 
0011 struct audit_tree {
0012     atomic_t count;
0013     int goner;
0014     struct audit_chunk *root;
0015     struct list_head chunks;
0016     struct list_head rules;
0017     struct list_head list;
0018     struct list_head same_root;
0019     struct rcu_head head;
0020     char pathname[];
0021 };
0022 
0023 struct audit_chunk {
0024     struct list_head hash;
0025     struct fsnotify_mark mark;
0026     struct list_head trees;     /* with root here */
0027     int dead;
0028     int count;
0029     atomic_long_t refs;
0030     struct rcu_head head;
0031     struct node {
0032         struct list_head list;
0033         struct audit_tree *owner;
0034         unsigned index;     /* index; upper bit indicates 'will prune' */
0035     } owners[];
0036 };
0037 
0038 static LIST_HEAD(tree_list);
0039 static LIST_HEAD(prune_list);
0040 static struct task_struct *prune_thread;
0041 
0042 /*
0043  * One struct chunk is attached to each inode of interest.
0044  * We replace struct chunk on tagging/untagging.
0045  * Rules have pointer to struct audit_tree.
0046  * Rules have struct list_head rlist forming a list of rules over
0047  * the same tree.
0048  * References to struct chunk are collected at audit_inode{,_child}()
0049  * time and used in AUDIT_TREE rule matching.
0050  * These references are dropped at the same time we are calling
0051  * audit_free_names(), etc.
0052  *
0053  * Cyclic lists galore:
0054  * tree.chunks anchors chunk.owners[].list          hash_lock
0055  * tree.rules anchors rule.rlist                audit_filter_mutex
0056  * chunk.trees anchors tree.same_root               hash_lock
0057  * chunk.hash is a hash with middle bits of watch.inode as
0058  * a hash function.                     RCU, hash_lock
0059  *
0060  * tree is refcounted; one reference for "some rules on rules_list refer to
0061  * it", one for each chunk with pointer to it.
0062  *
0063  * chunk is refcounted by embedded fsnotify_mark + .refs (non-zero refcount
0064  * of watch contributes 1 to .refs).
0065  *
0066  * node.index allows to get from node.list to containing chunk.
0067  * MSB of that sucker is stolen to mark taggings that we might have to
0068  * revert - several operations have very unpleasant cleanup logics and
0069  * that makes a difference.  Some.
0070  */
0071 
0072 static struct fsnotify_group *audit_tree_group;
0073 
0074 static struct audit_tree *alloc_tree(const char *s)
0075 {
0076     struct audit_tree *tree;
0077 
0078     tree = kmalloc(sizeof(struct audit_tree) + strlen(s) + 1, GFP_KERNEL);
0079     if (tree) {
0080         atomic_set(&tree->count, 1);
0081         tree->goner = 0;
0082         INIT_LIST_HEAD(&tree->chunks);
0083         INIT_LIST_HEAD(&tree->rules);
0084         INIT_LIST_HEAD(&tree->list);
0085         INIT_LIST_HEAD(&tree->same_root);
0086         tree->root = NULL;
0087         strcpy(tree->pathname, s);
0088     }
0089     return tree;
0090 }
0091 
0092 static inline void get_tree(struct audit_tree *tree)
0093 {
0094     atomic_inc(&tree->count);
0095 }
0096 
0097 static inline void put_tree(struct audit_tree *tree)
0098 {
0099     if (atomic_dec_and_test(&tree->count))
0100         kfree_rcu(tree, head);
0101 }
0102 
0103 /* to avoid bringing the entire thing in audit.h */
0104 const char *audit_tree_path(struct audit_tree *tree)
0105 {
0106     return tree->pathname;
0107 }
0108 
0109 static void free_chunk(struct audit_chunk *chunk)
0110 {
0111     int i;
0112 
0113     for (i = 0; i < chunk->count; i++) {
0114         if (chunk->owners[i].owner)
0115             put_tree(chunk->owners[i].owner);
0116     }
0117     kfree(chunk);
0118 }
0119 
0120 void audit_put_chunk(struct audit_chunk *chunk)
0121 {
0122     if (atomic_long_dec_and_test(&chunk->refs))
0123         free_chunk(chunk);
0124 }
0125 
0126 static void __put_chunk(struct rcu_head *rcu)
0127 {
0128     struct audit_chunk *chunk = container_of(rcu, struct audit_chunk, head);
0129     audit_put_chunk(chunk);
0130 }
0131 
0132 static void audit_tree_destroy_watch(struct fsnotify_mark *entry)
0133 {
0134     struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
0135     call_rcu(&chunk->head, __put_chunk);
0136 }
0137 
0138 static struct audit_chunk *alloc_chunk(int count)
0139 {
0140     struct audit_chunk *chunk;
0141     size_t size;
0142     int i;
0143 
0144     size = offsetof(struct audit_chunk, owners) + count * sizeof(struct node);
0145     chunk = kzalloc(size, GFP_KERNEL);
0146     if (!chunk)
0147         return NULL;
0148 
0149     INIT_LIST_HEAD(&chunk->hash);
0150     INIT_LIST_HEAD(&chunk->trees);
0151     chunk->count = count;
0152     atomic_long_set(&chunk->refs, 1);
0153     for (i = 0; i < count; i++) {
0154         INIT_LIST_HEAD(&chunk->owners[i].list);
0155         chunk->owners[i].index = i;
0156     }
0157     fsnotify_init_mark(&chunk->mark, audit_tree_destroy_watch);
0158     chunk->mark.mask = FS_IN_IGNORED;
0159     return chunk;
0160 }
0161 
0162 enum {HASH_SIZE = 128};
0163 static struct list_head chunk_hash_heads[HASH_SIZE];
0164 static __cacheline_aligned_in_smp DEFINE_SPINLOCK(hash_lock);
0165 
0166 static inline struct list_head *chunk_hash(const struct inode *inode)
0167 {
0168     unsigned long n = (unsigned long)inode / L1_CACHE_BYTES;
0169     return chunk_hash_heads + n % HASH_SIZE;
0170 }
0171 
0172 /* hash_lock & entry->lock is held by caller */
0173 static void insert_hash(struct audit_chunk *chunk)
0174 {
0175     struct fsnotify_mark *entry = &chunk->mark;
0176     struct list_head *list;
0177 
0178     if (!entry->inode)
0179         return;
0180     list = chunk_hash(entry->inode);
0181     list_add_rcu(&chunk->hash, list);
0182 }
0183 
0184 /* called under rcu_read_lock */
0185 struct audit_chunk *audit_tree_lookup(const struct inode *inode)
0186 {
0187     struct list_head *list = chunk_hash(inode);
0188     struct audit_chunk *p;
0189 
0190     list_for_each_entry_rcu(p, list, hash) {
0191         /* mark.inode may have gone NULL, but who cares? */
0192         if (p->mark.inode == inode) {
0193             atomic_long_inc(&p->refs);
0194             return p;
0195         }
0196     }
0197     return NULL;
0198 }
0199 
0200 bool audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree)
0201 {
0202     int n;
0203     for (n = 0; n < chunk->count; n++)
0204         if (chunk->owners[n].owner == tree)
0205             return true;
0206     return false;
0207 }
0208 
0209 /* tagging and untagging inodes with trees */
0210 
0211 static struct audit_chunk *find_chunk(struct node *p)
0212 {
0213     int index = p->index & ~(1U<<31);
0214     p -= index;
0215     return container_of(p, struct audit_chunk, owners[0]);
0216 }
0217 
0218 static void untag_chunk(struct node *p)
0219 {
0220     struct audit_chunk *chunk = find_chunk(p);
0221     struct fsnotify_mark *entry = &chunk->mark;
0222     struct audit_chunk *new = NULL;
0223     struct audit_tree *owner;
0224     int size = chunk->count - 1;
0225     int i, j;
0226 
0227     fsnotify_get_mark(entry);
0228 
0229     spin_unlock(&hash_lock);
0230 
0231     if (size)
0232         new = alloc_chunk(size);
0233 
0234     mutex_lock(&entry->group->mark_mutex);
0235     spin_lock(&entry->lock);
0236     if (chunk->dead || !entry->inode) {
0237         spin_unlock(&entry->lock);
0238         mutex_unlock(&entry->group->mark_mutex);
0239         if (new)
0240             free_chunk(new);
0241         goto out;
0242     }
0243 
0244     owner = p->owner;
0245 
0246     if (!size) {
0247         chunk->dead = 1;
0248         spin_lock(&hash_lock);
0249         list_del_init(&chunk->trees);
0250         if (owner->root == chunk)
0251             owner->root = NULL;
0252         list_del_init(&p->list);
0253         list_del_rcu(&chunk->hash);
0254         spin_unlock(&hash_lock);
0255         spin_unlock(&entry->lock);
0256         mutex_unlock(&entry->group->mark_mutex);
0257         fsnotify_destroy_mark(entry, audit_tree_group);
0258         goto out;
0259     }
0260 
0261     if (!new)
0262         goto Fallback;
0263 
0264     if (fsnotify_add_mark_locked(&new->mark, entry->group, entry->inode,
0265                      NULL, 1)) {
0266         fsnotify_put_mark(&new->mark);
0267         goto Fallback;
0268     }
0269 
0270     chunk->dead = 1;
0271     spin_lock(&hash_lock);
0272     list_replace_init(&chunk->trees, &new->trees);
0273     if (owner->root == chunk) {
0274         list_del_init(&owner->same_root);
0275         owner->root = NULL;
0276     }
0277 
0278     for (i = j = 0; j <= size; i++, j++) {
0279         struct audit_tree *s;
0280         if (&chunk->owners[j] == p) {
0281             list_del_init(&p->list);
0282             i--;
0283             continue;
0284         }
0285         s = chunk->owners[j].owner;
0286         new->owners[i].owner = s;
0287         new->owners[i].index = chunk->owners[j].index - j + i;
0288         if (!s) /* result of earlier fallback */
0289             continue;
0290         get_tree(s);
0291         list_replace_init(&chunk->owners[j].list, &new->owners[i].list);
0292     }
0293 
0294     list_replace_rcu(&chunk->hash, &new->hash);
0295     list_for_each_entry(owner, &new->trees, same_root)
0296         owner->root = new;
0297     spin_unlock(&hash_lock);
0298     spin_unlock(&entry->lock);
0299     mutex_unlock(&entry->group->mark_mutex);
0300     fsnotify_destroy_mark(entry, audit_tree_group);
0301     fsnotify_put_mark(&new->mark);  /* drop initial reference */
0302     goto out;
0303 
0304 Fallback:
0305     // do the best we can
0306     spin_lock(&hash_lock);
0307     if (owner->root == chunk) {
0308         list_del_init(&owner->same_root);
0309         owner->root = NULL;
0310     }
0311     list_del_init(&p->list);
0312     p->owner = NULL;
0313     put_tree(owner);
0314     spin_unlock(&hash_lock);
0315     spin_unlock(&entry->lock);
0316     mutex_unlock(&entry->group->mark_mutex);
0317 out:
0318     fsnotify_put_mark(entry);
0319     spin_lock(&hash_lock);
0320 }
0321 
0322 static int create_chunk(struct inode *inode, struct audit_tree *tree)
0323 {
0324     struct fsnotify_mark *entry;
0325     struct audit_chunk *chunk = alloc_chunk(1);
0326     if (!chunk)
0327         return -ENOMEM;
0328 
0329     entry = &chunk->mark;
0330     if (fsnotify_add_mark(entry, audit_tree_group, inode, NULL, 0)) {
0331         fsnotify_put_mark(entry);
0332         return -ENOSPC;
0333     }
0334 
0335     spin_lock(&entry->lock);
0336     spin_lock(&hash_lock);
0337     if (tree->goner) {
0338         spin_unlock(&hash_lock);
0339         chunk->dead = 1;
0340         spin_unlock(&entry->lock);
0341         fsnotify_destroy_mark(entry, audit_tree_group);
0342         fsnotify_put_mark(entry);
0343         return 0;
0344     }
0345     chunk->owners[0].index = (1U << 31);
0346     chunk->owners[0].owner = tree;
0347     get_tree(tree);
0348     list_add(&chunk->owners[0].list, &tree->chunks);
0349     if (!tree->root) {
0350         tree->root = chunk;
0351         list_add(&tree->same_root, &chunk->trees);
0352     }
0353     insert_hash(chunk);
0354     spin_unlock(&hash_lock);
0355     spin_unlock(&entry->lock);
0356     fsnotify_put_mark(entry);   /* drop initial reference */
0357     return 0;
0358 }
0359 
0360 /* the first tagged inode becomes root of tree */
0361 static int tag_chunk(struct inode *inode, struct audit_tree *tree)
0362 {
0363     struct fsnotify_mark *old_entry, *chunk_entry;
0364     struct audit_tree *owner;
0365     struct audit_chunk *chunk, *old;
0366     struct node *p;
0367     int n;
0368 
0369     old_entry = fsnotify_find_inode_mark(audit_tree_group, inode);
0370     if (!old_entry)
0371         return create_chunk(inode, tree);
0372 
0373     old = container_of(old_entry, struct audit_chunk, mark);
0374 
0375     /* are we already there? */
0376     spin_lock(&hash_lock);
0377     for (n = 0; n < old->count; n++) {
0378         if (old->owners[n].owner == tree) {
0379             spin_unlock(&hash_lock);
0380             fsnotify_put_mark(old_entry);
0381             return 0;
0382         }
0383     }
0384     spin_unlock(&hash_lock);
0385 
0386     chunk = alloc_chunk(old->count + 1);
0387     if (!chunk) {
0388         fsnotify_put_mark(old_entry);
0389         return -ENOMEM;
0390     }
0391 
0392     chunk_entry = &chunk->mark;
0393 
0394     mutex_lock(&old_entry->group->mark_mutex);
0395     spin_lock(&old_entry->lock);
0396     if (!old_entry->inode) {
0397         /* old_entry is being shot, lets just lie */
0398         spin_unlock(&old_entry->lock);
0399         mutex_unlock(&old_entry->group->mark_mutex);
0400         fsnotify_put_mark(old_entry);
0401         free_chunk(chunk);
0402         return -ENOENT;
0403     }
0404 
0405     if (fsnotify_add_mark_locked(chunk_entry, old_entry->group,
0406                      old_entry->inode, NULL, 1)) {
0407         spin_unlock(&old_entry->lock);
0408         mutex_unlock(&old_entry->group->mark_mutex);
0409         fsnotify_put_mark(chunk_entry);
0410         fsnotify_put_mark(old_entry);
0411         return -ENOSPC;
0412     }
0413 
0414     /* even though we hold old_entry->lock, this is safe since chunk_entry->lock could NEVER have been grabbed before */
0415     spin_lock(&chunk_entry->lock);
0416     spin_lock(&hash_lock);
0417 
0418     /* we now hold old_entry->lock, chunk_entry->lock, and hash_lock */
0419     if (tree->goner) {
0420         spin_unlock(&hash_lock);
0421         chunk->dead = 1;
0422         spin_unlock(&chunk_entry->lock);
0423         spin_unlock(&old_entry->lock);
0424         mutex_unlock(&old_entry->group->mark_mutex);
0425 
0426         fsnotify_destroy_mark(chunk_entry, audit_tree_group);
0427 
0428         fsnotify_put_mark(chunk_entry);
0429         fsnotify_put_mark(old_entry);
0430         return 0;
0431     }
0432     list_replace_init(&old->trees, &chunk->trees);
0433     for (n = 0, p = chunk->owners; n < old->count; n++, p++) {
0434         struct audit_tree *s = old->owners[n].owner;
0435         p->owner = s;
0436         p->index = old->owners[n].index;
0437         if (!s) /* result of fallback in untag */
0438             continue;
0439         get_tree(s);
0440         list_replace_init(&old->owners[n].list, &p->list);
0441     }
0442     p->index = (chunk->count - 1) | (1U<<31);
0443     p->owner = tree;
0444     get_tree(tree);
0445     list_add(&p->list, &tree->chunks);
0446     list_replace_rcu(&old->hash, &chunk->hash);
0447     list_for_each_entry(owner, &chunk->trees, same_root)
0448         owner->root = chunk;
0449     old->dead = 1;
0450     if (!tree->root) {
0451         tree->root = chunk;
0452         list_add(&tree->same_root, &chunk->trees);
0453     }
0454     spin_unlock(&hash_lock);
0455     spin_unlock(&chunk_entry->lock);
0456     spin_unlock(&old_entry->lock);
0457     mutex_unlock(&old_entry->group->mark_mutex);
0458     fsnotify_destroy_mark(old_entry, audit_tree_group);
0459     fsnotify_put_mark(chunk_entry); /* drop initial reference */
0460     fsnotify_put_mark(old_entry); /* pair to fsnotify_find mark_entry */
0461     return 0;
0462 }
0463 
0464 static void audit_tree_log_remove_rule(struct audit_krule *rule)
0465 {
0466     struct audit_buffer *ab;
0467 
0468     ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
0469     if (unlikely(!ab))
0470         return;
0471     audit_log_format(ab, "op=remove_rule");
0472     audit_log_format(ab, " dir=");
0473     audit_log_untrustedstring(ab, rule->tree->pathname);
0474     audit_log_key(ab, rule->filterkey);
0475     audit_log_format(ab, " list=%d res=1", rule->listnr);
0476     audit_log_end(ab);
0477 }
0478 
0479 static void kill_rules(struct audit_tree *tree)
0480 {
0481     struct audit_krule *rule, *next;
0482     struct audit_entry *entry;
0483 
0484     list_for_each_entry_safe(rule, next, &tree->rules, rlist) {
0485         entry = container_of(rule, struct audit_entry, rule);
0486 
0487         list_del_init(&rule->rlist);
0488         if (rule->tree) {
0489             /* not a half-baked one */
0490             audit_tree_log_remove_rule(rule);
0491             if (entry->rule.exe)
0492                 audit_remove_mark(entry->rule.exe);
0493             rule->tree = NULL;
0494             list_del_rcu(&entry->list);
0495             list_del(&entry->rule.list);
0496             call_rcu(&entry->rcu, audit_free_rule_rcu);
0497         }
0498     }
0499 }
0500 
0501 /*
0502  * finish killing struct audit_tree
0503  */
0504 static void prune_one(struct audit_tree *victim)
0505 {
0506     spin_lock(&hash_lock);
0507     while (!list_empty(&victim->chunks)) {
0508         struct node *p;
0509 
0510         p = list_entry(victim->chunks.next, struct node, list);
0511 
0512         untag_chunk(p);
0513     }
0514     spin_unlock(&hash_lock);
0515     put_tree(victim);
0516 }
0517 
0518 /* trim the uncommitted chunks from tree */
0519 
0520 static void trim_marked(struct audit_tree *tree)
0521 {
0522     struct list_head *p, *q;
0523     spin_lock(&hash_lock);
0524     if (tree->goner) {
0525         spin_unlock(&hash_lock);
0526         return;
0527     }
0528     /* reorder */
0529     for (p = tree->chunks.next; p != &tree->chunks; p = q) {
0530         struct node *node = list_entry(p, struct node, list);
0531         q = p->next;
0532         if (node->index & (1U<<31)) {
0533             list_del_init(p);
0534             list_add(p, &tree->chunks);
0535         }
0536     }
0537 
0538     while (!list_empty(&tree->chunks)) {
0539         struct node *node;
0540 
0541         node = list_entry(tree->chunks.next, struct node, list);
0542 
0543         /* have we run out of marked? */
0544         if (!(node->index & (1U<<31)))
0545             break;
0546 
0547         untag_chunk(node);
0548     }
0549     if (!tree->root && !tree->goner) {
0550         tree->goner = 1;
0551         spin_unlock(&hash_lock);
0552         mutex_lock(&audit_filter_mutex);
0553         kill_rules(tree);
0554         list_del_init(&tree->list);
0555         mutex_unlock(&audit_filter_mutex);
0556         prune_one(tree);
0557     } else {
0558         spin_unlock(&hash_lock);
0559     }
0560 }
0561 
0562 static void audit_schedule_prune(void);
0563 
0564 /* called with audit_filter_mutex */
0565 int audit_remove_tree_rule(struct audit_krule *rule)
0566 {
0567     struct audit_tree *tree;
0568     tree = rule->tree;
0569     if (tree) {
0570         spin_lock(&hash_lock);
0571         list_del_init(&rule->rlist);
0572         if (list_empty(&tree->rules) && !tree->goner) {
0573             tree->root = NULL;
0574             list_del_init(&tree->same_root);
0575             tree->goner = 1;
0576             list_move(&tree->list, &prune_list);
0577             rule->tree = NULL;
0578             spin_unlock(&hash_lock);
0579             audit_schedule_prune();
0580             return 1;
0581         }
0582         rule->tree = NULL;
0583         spin_unlock(&hash_lock);
0584         return 1;
0585     }
0586     return 0;
0587 }
0588 
0589 static int compare_root(struct vfsmount *mnt, void *arg)
0590 {
0591     return d_backing_inode(mnt->mnt_root) == arg;
0592 }
0593 
0594 void audit_trim_trees(void)
0595 {
0596     struct list_head cursor;
0597 
0598     mutex_lock(&audit_filter_mutex);
0599     list_add(&cursor, &tree_list);
0600     while (cursor.next != &tree_list) {
0601         struct audit_tree *tree;
0602         struct path path;
0603         struct vfsmount *root_mnt;
0604         struct node *node;
0605         int err;
0606 
0607         tree = container_of(cursor.next, struct audit_tree, list);
0608         get_tree(tree);
0609         list_del(&cursor);
0610         list_add(&cursor, &tree->list);
0611         mutex_unlock(&audit_filter_mutex);
0612 
0613         err = kern_path(tree->pathname, 0, &path);
0614         if (err)
0615             goto skip_it;
0616 
0617         root_mnt = collect_mounts(&path);
0618         path_put(&path);
0619         if (IS_ERR(root_mnt))
0620             goto skip_it;
0621 
0622         spin_lock(&hash_lock);
0623         list_for_each_entry(node, &tree->chunks, list) {
0624             struct audit_chunk *chunk = find_chunk(node);
0625             /* this could be NULL if the watch is dying else where... */
0626             struct inode *inode = chunk->mark.inode;
0627             node->index |= 1U<<31;
0628             if (iterate_mounts(compare_root, inode, root_mnt))
0629                 node->index &= ~(1U<<31);
0630         }
0631         spin_unlock(&hash_lock);
0632         trim_marked(tree);
0633         drop_collected_mounts(root_mnt);
0634 skip_it:
0635         put_tree(tree);
0636         mutex_lock(&audit_filter_mutex);
0637     }
0638     list_del(&cursor);
0639     mutex_unlock(&audit_filter_mutex);
0640 }
0641 
0642 int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op)
0643 {
0644 
0645     if (pathname[0] != '/' ||
0646         rule->listnr != AUDIT_FILTER_EXIT ||
0647         op != Audit_equal ||
0648         rule->inode_f || rule->watch || rule->tree)
0649         return -EINVAL;
0650     rule->tree = alloc_tree(pathname);
0651     if (!rule->tree)
0652         return -ENOMEM;
0653     return 0;
0654 }
0655 
0656 void audit_put_tree(struct audit_tree *tree)
0657 {
0658     put_tree(tree);
0659 }
0660 
0661 static int tag_mount(struct vfsmount *mnt, void *arg)
0662 {
0663     return tag_chunk(d_backing_inode(mnt->mnt_root), arg);
0664 }
0665 
0666 /*
0667  * That gets run when evict_chunk() ends up needing to kill audit_tree.
0668  * Runs from a separate thread.
0669  */
0670 static int prune_tree_thread(void *unused)
0671 {
0672     for (;;) {
0673         if (list_empty(&prune_list)) {
0674             set_current_state(TASK_INTERRUPTIBLE);
0675             schedule();
0676         }
0677 
0678         mutex_lock(&audit_cmd_mutex);
0679         mutex_lock(&audit_filter_mutex);
0680 
0681         while (!list_empty(&prune_list)) {
0682             struct audit_tree *victim;
0683 
0684             victim = list_entry(prune_list.next,
0685                     struct audit_tree, list);
0686             list_del_init(&victim->list);
0687 
0688             mutex_unlock(&audit_filter_mutex);
0689 
0690             prune_one(victim);
0691 
0692             mutex_lock(&audit_filter_mutex);
0693         }
0694 
0695         mutex_unlock(&audit_filter_mutex);
0696         mutex_unlock(&audit_cmd_mutex);
0697     }
0698     return 0;
0699 }
0700 
0701 static int audit_launch_prune(void)
0702 {
0703     if (prune_thread)
0704         return 0;
0705     prune_thread = kthread_run(prune_tree_thread, NULL,
0706                 "audit_prune_tree");
0707     if (IS_ERR(prune_thread)) {
0708         pr_err("cannot start thread audit_prune_tree");
0709         prune_thread = NULL;
0710         return -ENOMEM;
0711     }
0712     return 0;
0713 }
0714 
0715 /* called with audit_filter_mutex */
0716 int audit_add_tree_rule(struct audit_krule *rule)
0717 {
0718     struct audit_tree *seed = rule->tree, *tree;
0719     struct path path;
0720     struct vfsmount *mnt;
0721     int err;
0722 
0723     rule->tree = NULL;
0724     list_for_each_entry(tree, &tree_list, list) {
0725         if (!strcmp(seed->pathname, tree->pathname)) {
0726             put_tree(seed);
0727             rule->tree = tree;
0728             list_add(&rule->rlist, &tree->rules);
0729             return 0;
0730         }
0731     }
0732     tree = seed;
0733     list_add(&tree->list, &tree_list);
0734     list_add(&rule->rlist, &tree->rules);
0735     /* do not set rule->tree yet */
0736     mutex_unlock(&audit_filter_mutex);
0737 
0738     if (unlikely(!prune_thread)) {
0739         err = audit_launch_prune();
0740         if (err)
0741             goto Err;
0742     }
0743 
0744     err = kern_path(tree->pathname, 0, &path);
0745     if (err)
0746         goto Err;
0747     mnt = collect_mounts(&path);
0748     path_put(&path);
0749     if (IS_ERR(mnt)) {
0750         err = PTR_ERR(mnt);
0751         goto Err;
0752     }
0753 
0754     get_tree(tree);
0755     err = iterate_mounts(tag_mount, tree, mnt);
0756     drop_collected_mounts(mnt);
0757 
0758     if (!err) {
0759         struct node *node;
0760         spin_lock(&hash_lock);
0761         list_for_each_entry(node, &tree->chunks, list)
0762             node->index &= ~(1U<<31);
0763         spin_unlock(&hash_lock);
0764     } else {
0765         trim_marked(tree);
0766         goto Err;
0767     }
0768 
0769     mutex_lock(&audit_filter_mutex);
0770     if (list_empty(&rule->rlist)) {
0771         put_tree(tree);
0772         return -ENOENT;
0773     }
0774     rule->tree = tree;
0775     put_tree(tree);
0776 
0777     return 0;
0778 Err:
0779     mutex_lock(&audit_filter_mutex);
0780     list_del_init(&tree->list);
0781     list_del_init(&tree->rules);
0782     put_tree(tree);
0783     return err;
0784 }
0785 
0786 int audit_tag_tree(char *old, char *new)
0787 {
0788     struct list_head cursor, barrier;
0789     int failed = 0;
0790     struct path path1, path2;
0791     struct vfsmount *tagged;
0792     int err;
0793 
0794     err = kern_path(new, 0, &path2);
0795     if (err)
0796         return err;
0797     tagged = collect_mounts(&path2);
0798     path_put(&path2);
0799     if (IS_ERR(tagged))
0800         return PTR_ERR(tagged);
0801 
0802     err = kern_path(old, 0, &path1);
0803     if (err) {
0804         drop_collected_mounts(tagged);
0805         return err;
0806     }
0807 
0808     mutex_lock(&audit_filter_mutex);
0809     list_add(&barrier, &tree_list);
0810     list_add(&cursor, &barrier);
0811 
0812     while (cursor.next != &tree_list) {
0813         struct audit_tree *tree;
0814         int good_one = 0;
0815 
0816         tree = container_of(cursor.next, struct audit_tree, list);
0817         get_tree(tree);
0818         list_del(&cursor);
0819         list_add(&cursor, &tree->list);
0820         mutex_unlock(&audit_filter_mutex);
0821 
0822         err = kern_path(tree->pathname, 0, &path2);
0823         if (!err) {
0824             good_one = path_is_under(&path1, &path2);
0825             path_put(&path2);
0826         }
0827 
0828         if (!good_one) {
0829             put_tree(tree);
0830             mutex_lock(&audit_filter_mutex);
0831             continue;
0832         }
0833 
0834         failed = iterate_mounts(tag_mount, tree, tagged);
0835         if (failed) {
0836             put_tree(tree);
0837             mutex_lock(&audit_filter_mutex);
0838             break;
0839         }
0840 
0841         mutex_lock(&audit_filter_mutex);
0842         spin_lock(&hash_lock);
0843         if (!tree->goner) {
0844             list_del(&tree->list);
0845             list_add(&tree->list, &tree_list);
0846         }
0847         spin_unlock(&hash_lock);
0848         put_tree(tree);
0849     }
0850 
0851     while (barrier.prev != &tree_list) {
0852         struct audit_tree *tree;
0853 
0854         tree = container_of(barrier.prev, struct audit_tree, list);
0855         get_tree(tree);
0856         list_del(&tree->list);
0857         list_add(&tree->list, &barrier);
0858         mutex_unlock(&audit_filter_mutex);
0859 
0860         if (!failed) {
0861             struct node *node;
0862             spin_lock(&hash_lock);
0863             list_for_each_entry(node, &tree->chunks, list)
0864                 node->index &= ~(1U<<31);
0865             spin_unlock(&hash_lock);
0866         } else {
0867             trim_marked(tree);
0868         }
0869 
0870         put_tree(tree);
0871         mutex_lock(&audit_filter_mutex);
0872     }
0873     list_del(&barrier);
0874     list_del(&cursor);
0875     mutex_unlock(&audit_filter_mutex);
0876     path_put(&path1);
0877     drop_collected_mounts(tagged);
0878     return failed;
0879 }
0880 
0881 
0882 static void audit_schedule_prune(void)
0883 {
0884     wake_up_process(prune_thread);
0885 }
0886 
0887 /*
0888  * ... and that one is done if evict_chunk() decides to delay until the end
0889  * of syscall.  Runs synchronously.
0890  */
0891 void audit_kill_trees(struct list_head *list)
0892 {
0893     mutex_lock(&audit_cmd_mutex);
0894     mutex_lock(&audit_filter_mutex);
0895 
0896     while (!list_empty(list)) {
0897         struct audit_tree *victim;
0898 
0899         victim = list_entry(list->next, struct audit_tree, list);
0900         kill_rules(victim);
0901         list_del_init(&victim->list);
0902 
0903         mutex_unlock(&audit_filter_mutex);
0904 
0905         prune_one(victim);
0906 
0907         mutex_lock(&audit_filter_mutex);
0908     }
0909 
0910     mutex_unlock(&audit_filter_mutex);
0911     mutex_unlock(&audit_cmd_mutex);
0912 }
0913 
0914 /*
0915  *  Here comes the stuff asynchronous to auditctl operations
0916  */
0917 
0918 static void evict_chunk(struct audit_chunk *chunk)
0919 {
0920     struct audit_tree *owner;
0921     struct list_head *postponed = audit_killed_trees();
0922     int need_prune = 0;
0923     int n;
0924 
0925     if (chunk->dead)
0926         return;
0927 
0928     chunk->dead = 1;
0929     mutex_lock(&audit_filter_mutex);
0930     spin_lock(&hash_lock);
0931     while (!list_empty(&chunk->trees)) {
0932         owner = list_entry(chunk->trees.next,
0933                    struct audit_tree, same_root);
0934         owner->goner = 1;
0935         owner->root = NULL;
0936         list_del_init(&owner->same_root);
0937         spin_unlock(&hash_lock);
0938         if (!postponed) {
0939             kill_rules(owner);
0940             list_move(&owner->list, &prune_list);
0941             need_prune = 1;
0942         } else {
0943             list_move(&owner->list, postponed);
0944         }
0945         spin_lock(&hash_lock);
0946     }
0947     list_del_rcu(&chunk->hash);
0948     for (n = 0; n < chunk->count; n++)
0949         list_del_init(&chunk->owners[n].list);
0950     spin_unlock(&hash_lock);
0951     mutex_unlock(&audit_filter_mutex);
0952     if (need_prune)
0953         audit_schedule_prune();
0954 }
0955 
0956 static int audit_tree_handle_event(struct fsnotify_group *group,
0957                    struct inode *to_tell,
0958                    struct fsnotify_mark *inode_mark,
0959                    struct fsnotify_mark *vfsmount_mark,
0960                    u32 mask, const void *data, int data_type,
0961                    const unsigned char *file_name, u32 cookie)
0962 {
0963     return 0;
0964 }
0965 
0966 static void audit_tree_freeing_mark(struct fsnotify_mark *entry, struct fsnotify_group *group)
0967 {
0968     struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
0969 
0970     evict_chunk(chunk);
0971 
0972     /*
0973      * We are guaranteed to have at least one reference to the mark from
0974      * either the inode or the caller of fsnotify_destroy_mark().
0975      */
0976     BUG_ON(atomic_read(&entry->refcnt) < 1);
0977 }
0978 
0979 static const struct fsnotify_ops audit_tree_ops = {
0980     .handle_event = audit_tree_handle_event,
0981     .freeing_mark = audit_tree_freeing_mark,
0982 };
0983 
0984 static int __init audit_tree_init(void)
0985 {
0986     int i;
0987 
0988     audit_tree_group = fsnotify_alloc_group(&audit_tree_ops);
0989     if (IS_ERR(audit_tree_group))
0990         audit_panic("cannot initialize fsnotify group for rectree watches");
0991 
0992     for (i = 0; i < HASH_SIZE; i++)
0993         INIT_LIST_HEAD(&chunk_hash_heads[i]);
0994 
0995     return 0;
0996 }
0997 __initcall(audit_tree_init);