hc
2023-12-09 b22da3d8526a935aa31e086e63f60ff3246cb61c
kernel/kernel/audit_fsnotify.c
....@@ -1,18 +1,9 @@
1
+// SPDX-License-Identifier: GPL-2.0-or-later
12 /* audit_fsnotify.c -- tracking inodes
23 *
34 * Copyright 2003-2009,2014-2015 Red Hat, Inc.
45 * Copyright 2005 Hewlett-Packard Development Company, L.P.
56 * Copyright 2005 IBM Corporation
6
- *
7
- * This program is free software; you can redistribute it and/or modify
8
- * it under the terms of the GNU General Public License as published by
9
- * the Free Software Foundation; either version 2 of the License, or
10
- * (at your option) any later version.
11
- *
12
- * This program is distributed in the hope that it will be useful,
13
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- * GNU General Public License for more details.
167 */
178
189 #include <linux/kernel.h>
....@@ -45,7 +36,7 @@
4536
4637 /* fsnotify events we care about. */
4738 #define AUDIT_FS_EVENTS (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
48
- FS_MOVE_SELF | FS_EVENT_ON_CHILD)
39
+ FS_MOVE_SELF)
4940
5041 static void audit_fsnotify_mark_free(struct audit_fsnotify_mark *audit_mark)
5142 {
....@@ -111,6 +102,7 @@
111102
112103 ret = fsnotify_add_inode_mark(&audit_mark->mark, inode, true);
113104 if (ret < 0) {
105
+ audit_mark->path = NULL;
114106 fsnotify_put_mark(&audit_mark->mark);
115107 audit_mark = ERR_PTR(ret);
116108 }
....@@ -127,13 +119,11 @@
127119
128120 if (!audit_enabled)
129121 return;
130
- ab = audit_log_start(NULL, GFP_NOFS, AUDIT_CONFIG_CHANGE);
122
+ ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE);
131123 if (unlikely(!ab))
132124 return;
133
- audit_log_format(ab, "auid=%u ses=%u op=%s",
134
- from_kuid(&init_user_ns, audit_get_loginuid(current)),
135
- audit_get_sessionid(current), op);
136
- audit_log_format(ab, " path=");
125
+ audit_log_session_info(ab);
126
+ audit_log_format(ab, " op=%s path=", op);
137127 audit_log_untrustedstring(ab, audit_mark->path);
138128 audit_log_key(ab, rule->filterkey);
139129 audit_log_format(ab, " list=%d res=1", rule->listnr);
....@@ -163,44 +153,31 @@
163153 }
164154
165155 /* Update mark data in audit rules based on fsnotify events. */
166
-static int audit_mark_handle_event(struct fsnotify_group *group,
167
- struct inode *to_tell,
168
- u32 mask, const void *data, int data_type,
169
- const unsigned char *dname, u32 cookie,
170
- struct fsnotify_iter_info *iter_info)
156
+static int audit_mark_handle_event(struct fsnotify_mark *inode_mark, u32 mask,
157
+ struct inode *inode, struct inode *dir,
158
+ const struct qstr *dname, u32 cookie)
171159 {
172
- struct fsnotify_mark *inode_mark = fsnotify_iter_inode_mark(iter_info);
173160 struct audit_fsnotify_mark *audit_mark;
174
- const struct inode *inode = NULL;
175161
176162 audit_mark = container_of(inode_mark, struct audit_fsnotify_mark, mark);
177163
178
- BUG_ON(group != audit_fsnotify_group);
179
-
180
- switch (data_type) {
181
- case (FSNOTIFY_EVENT_PATH):
182
- inode = ((const struct path *)data)->dentry->d_inode;
183
- break;
184
- case (FSNOTIFY_EVENT_INODE):
185
- inode = (const struct inode *)data;
186
- break;
187
- default:
188
- BUG();
164
+ if (WARN_ON_ONCE(inode_mark->group != audit_fsnotify_group) ||
165
+ WARN_ON_ONCE(!inode))
189166 return 0;
190
- }
191167
192168 if (mask & (FS_CREATE|FS_MOVED_TO|FS_DELETE|FS_MOVED_FROM)) {
193169 if (audit_compare_dname_path(dname, audit_mark->path, AUDIT_NAME_FULL))
194170 return 0;
195171 audit_update_mark(audit_mark, inode);
196
- } else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF))
172
+ } else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF)) {
197173 audit_autoremove_mark_rule(audit_mark);
174
+ }
198175
199176 return 0;
200177 }
201178
202179 static const struct fsnotify_ops audit_mark_fsnotify_ops = {
203
- .handle_event = audit_mark_handle_event,
180
+ .handle_inode_event = audit_mark_handle_event,
204181 .free_mark = audit_fsnotify_free_mark,
205182 };
206183