.. | .. |
---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-or-later |
---|
1 | 2 | /* audit_fsnotify.c -- tracking inodes |
---|
2 | 3 | * |
---|
3 | 4 | * Copyright 2003-2009,2014-2015 Red Hat, Inc. |
---|
4 | 5 | * Copyright 2005 Hewlett-Packard Development Company, L.P. |
---|
5 | 6 | * Copyright 2005 IBM Corporation |
---|
6 | | - * |
---|
7 | | - * This program is free software; you can redistribute it and/or modify |
---|
8 | | - * it under the terms of the GNU General Public License as published by |
---|
9 | | - * the Free Software Foundation; either version 2 of the License, or |
---|
10 | | - * (at your option) any later version. |
---|
11 | | - * |
---|
12 | | - * This program is distributed in the hope that it will be useful, |
---|
13 | | - * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
14 | | - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
15 | | - * GNU General Public License for more details. |
---|
16 | 7 | */ |
---|
17 | 8 | |
---|
18 | 9 | #include <linux/kernel.h> |
---|
.. | .. |
---|
45 | 36 | |
---|
46 | 37 | /* fsnotify events we care about. */ |
---|
47 | 38 | #define AUDIT_FS_EVENTS (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\ |
---|
48 | | - FS_MOVE_SELF | FS_EVENT_ON_CHILD) |
---|
| 39 | + FS_MOVE_SELF) |
---|
49 | 40 | |
---|
50 | 41 | static void audit_fsnotify_mark_free(struct audit_fsnotify_mark *audit_mark) |
---|
51 | 42 | { |
---|
.. | .. |
---|
111 | 102 | |
---|
112 | 103 | ret = fsnotify_add_inode_mark(&audit_mark->mark, inode, true); |
---|
113 | 104 | if (ret < 0) { |
---|
| 105 | + audit_mark->path = NULL; |
---|
114 | 106 | fsnotify_put_mark(&audit_mark->mark); |
---|
115 | 107 | audit_mark = ERR_PTR(ret); |
---|
116 | 108 | } |
---|
.. | .. |
---|
127 | 119 | |
---|
128 | 120 | if (!audit_enabled) |
---|
129 | 121 | return; |
---|
130 | | - ab = audit_log_start(NULL, GFP_NOFS, AUDIT_CONFIG_CHANGE); |
---|
| 122 | + ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE); |
---|
131 | 123 | if (unlikely(!ab)) |
---|
132 | 124 | return; |
---|
133 | | - audit_log_format(ab, "auid=%u ses=%u op=%s", |
---|
134 | | - from_kuid(&init_user_ns, audit_get_loginuid(current)), |
---|
135 | | - audit_get_sessionid(current), op); |
---|
136 | | - audit_log_format(ab, " path="); |
---|
| 125 | + audit_log_session_info(ab); |
---|
| 126 | + audit_log_format(ab, " op=%s path=", op); |
---|
137 | 127 | audit_log_untrustedstring(ab, audit_mark->path); |
---|
138 | 128 | audit_log_key(ab, rule->filterkey); |
---|
139 | 129 | audit_log_format(ab, " list=%d res=1", rule->listnr); |
---|
.. | .. |
---|
163 | 153 | } |
---|
164 | 154 | |
---|
165 | 155 | /* Update mark data in audit rules based on fsnotify events. */ |
---|
166 | | -static int audit_mark_handle_event(struct fsnotify_group *group, |
---|
167 | | - struct inode *to_tell, |
---|
168 | | - u32 mask, const void *data, int data_type, |
---|
169 | | - const unsigned char *dname, u32 cookie, |
---|
170 | | - struct fsnotify_iter_info *iter_info) |
---|
| 156 | +static int audit_mark_handle_event(struct fsnotify_mark *inode_mark, u32 mask, |
---|
| 157 | + struct inode *inode, struct inode *dir, |
---|
| 158 | + const struct qstr *dname, u32 cookie) |
---|
171 | 159 | { |
---|
172 | | - struct fsnotify_mark *inode_mark = fsnotify_iter_inode_mark(iter_info); |
---|
173 | 160 | struct audit_fsnotify_mark *audit_mark; |
---|
174 | | - const struct inode *inode = NULL; |
---|
175 | 161 | |
---|
176 | 162 | audit_mark = container_of(inode_mark, struct audit_fsnotify_mark, mark); |
---|
177 | 163 | |
---|
178 | | - BUG_ON(group != audit_fsnotify_group); |
---|
179 | | - |
---|
180 | | - switch (data_type) { |
---|
181 | | - case (FSNOTIFY_EVENT_PATH): |
---|
182 | | - inode = ((const struct path *)data)->dentry->d_inode; |
---|
183 | | - break; |
---|
184 | | - case (FSNOTIFY_EVENT_INODE): |
---|
185 | | - inode = (const struct inode *)data; |
---|
186 | | - break; |
---|
187 | | - default: |
---|
188 | | - BUG(); |
---|
| 164 | + if (WARN_ON_ONCE(inode_mark->group != audit_fsnotify_group) || |
---|
| 165 | + WARN_ON_ONCE(!inode)) |
---|
189 | 166 | return 0; |
---|
190 | | - } |
---|
191 | 167 | |
---|
192 | 168 | if (mask & (FS_CREATE|FS_MOVED_TO|FS_DELETE|FS_MOVED_FROM)) { |
---|
193 | 169 | if (audit_compare_dname_path(dname, audit_mark->path, AUDIT_NAME_FULL)) |
---|
194 | 170 | return 0; |
---|
195 | 171 | audit_update_mark(audit_mark, inode); |
---|
196 | | - } else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF)) |
---|
| 172 | + } else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF)) { |
---|
197 | 173 | audit_autoremove_mark_rule(audit_mark); |
---|
| 174 | + } |
---|
198 | 175 | |
---|
199 | 176 | return 0; |
---|
200 | 177 | } |
---|
201 | 178 | |
---|
202 | 179 | static const struct fsnotify_ops audit_mark_fsnotify_ops = { |
---|
203 | | - .handle_event = audit_mark_handle_event, |
---|
| 180 | + .handle_inode_event = audit_mark_handle_event, |
---|
204 | 181 | .free_mark = audit_fsnotify_free_mark, |
---|
205 | 182 | }; |
---|
206 | 183 | |
---|