export RK_PA3

hc

2024-02-19 151fecfb72a0d602dfe79790602ef64b4e241574

 kernel/kernel/audit_fsnotify.c
..
..
@@ -1,18 +1,9 @@
1
+// SPDX-License-Identifier: GPL-2.0-or-later
1
2
 /* audit_fsnotify.c -- tracking inodes
2
3
  *
3
4
  * Copyright 2003-2009,2014-2015 Red Hat, Inc.
4
5
  * Copyright 2005 Hewlett-Packard Development Company, L.P.
5
6
  * Copyright 2005 IBM Corporation
6
- *
7
- * This program is free software; you can redistribute it and/or modify
8
- * it under the terms of the GNU General Public License as published by
9
- * the Free Software Foundation; either version 2 of the License, or
10
- * (at your option) any later version.
11
- *
12
- * This program is distributed in the hope that it will be useful,
13
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15
- * GNU General Public License for more details.
16
7
  */
17
8
 
18
9
 #include <linux/kernel.h>
..
..
@@ -45,7 +36,7 @@
45
36
 
46
37
 /* fsnotify events we care about. */
47
38
 #define AUDIT_FS_EVENTS (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
48
-			 FS_MOVE_SELF | FS_EVENT_ON_CHILD)
39
+			 FS_MOVE_SELF)
49
40
 
50
41
 static void audit_fsnotify_mark_free(struct audit_fsnotify_mark *audit_mark)
51
42
 {
..
..
@@ -111,6 +102,7 @@
111
102
 
112
103
 	ret = fsnotify_add_inode_mark(&audit_mark->mark, inode, true);
113
104
 	if (ret < 0) {
105
+		audit_mark->path = NULL;
114
106
 		fsnotify_put_mark(&audit_mark->mark);
115
107
 		audit_mark = ERR_PTR(ret);
116
108
 	}
..
..
@@ -127,13 +119,11 @@
127
119
 
128
120
 	if (!audit_enabled)
129
121
 		return;
130
-	ab = audit_log_start(NULL, GFP_NOFS, AUDIT_CONFIG_CHANGE);
122
+	ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE);
131
123
 	if (unlikely(!ab))
132
124
 		return;
133
-	audit_log_format(ab, "auid=%u ses=%u op=%s",
134
-			 from_kuid(&init_user_ns, audit_get_loginuid(current)),
135
-			 audit_get_sessionid(current), op);
136
-	audit_log_format(ab, " path=");
125
+	audit_log_session_info(ab);
126
+	audit_log_format(ab, " op=%s path=", op);
137
127
 	audit_log_untrustedstring(ab, audit_mark->path);
138
128
 	audit_log_key(ab, rule->filterkey);
139
129
 	audit_log_format(ab, " list=%d res=1", rule->listnr);
..
..
@@ -163,44 +153,31 @@
163
153
 }
164
154
 
165
155
 /* Update mark data in audit rules based on fsnotify events. */
166
-static int audit_mark_handle_event(struct fsnotify_group *group,
167
-				    struct inode *to_tell,
168
-				    u32 mask, const void *data, int data_type,
169
-				    const unsigned char *dname, u32 cookie,
170
-				    struct fsnotify_iter_info *iter_info)
156
+static int audit_mark_handle_event(struct fsnotify_mark *inode_mark, u32 mask,
157
+				   struct inode *inode, struct inode *dir,
158
+				   const struct qstr *dname, u32 cookie)
171
159
 {
172
-	struct fsnotify_mark *inode_mark = fsnotify_iter_inode_mark(iter_info);
173
160
 	struct audit_fsnotify_mark *audit_mark;
174
-	const struct inode *inode = NULL;
175
161
 
176
162
 	audit_mark = container_of(inode_mark, struct audit_fsnotify_mark, mark);
177
163
 
178
-	BUG_ON(group != audit_fsnotify_group);
179
-
180
-	switch (data_type) {
181
-	case (FSNOTIFY_EVENT_PATH):
182
-		inode = ((const struct path *)data)->dentry->d_inode;
183
-		break;
184
-	case (FSNOTIFY_EVENT_INODE):
185
-		inode = (const struct inode *)data;
186
-		break;
187
-	default:
188
-		BUG();
164
+	if (WARN_ON_ONCE(inode_mark->group != audit_fsnotify_group) ||
165
+	    WARN_ON_ONCE(!inode))
189
166
 		return 0;
190
-	}
191
167
 
192
168
 	if (mask & (FS_CREATE|FS_MOVED_TO|FS_DELETE|FS_MOVED_FROM)) {
193
169
 		if (audit_compare_dname_path(dname, audit_mark->path, AUDIT_NAME_FULL))
194
170
 			return 0;
195
171
 		audit_update_mark(audit_mark, inode);
196
-	} else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF))
172
+	} else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF)) {
197
173
 		audit_autoremove_mark_rule(audit_mark);
174
+	}
198
175
 
199
176
 	return 0;
200
177
 }
201
178
 
202
179
 static const struct fsnotify_ops audit_mark_fsnotify_ops = {
203
-	.handle_event =	audit_mark_handle_event,
180
+	.handle_inode_event = audit_mark_handle_event,
204
181
 	.free_mark = audit_fsnotify_free_mark,
205
182
 };
206
183