kernel/audit_tree.c

   1 #include "audit.h"
   2 #include <linux/fsnotify_backend.h>
   3 #include <linux/namei.h>
   4 #include <linux/mount.h>
   5 #include <linux/kthread.h>
   6 #include <linux/refcount.h>
   7 #include <linux/slab.h>
   8
   9 struct audit_tree;
  10 struct audit_chunk;
  11
  12 struct audit_tree {
  13         refcount_t count;
  14         int goner;
  15         struct audit_chunk *root;
  16         struct list_head chunks;
  17         struct list_head rules;
  18         struct list_head list;
  19         struct list_head same_root;
  20         struct rcu_head head;
  21         char pathname[];
  22 };
  23
  24 struct audit_chunk {
  25         struct list_head hash;
  26         struct fsnotify_mark mark;
  27         struct list_head trees;         /* with root here */
  28         int dead;
  29         int count;
  30         atomic_long_t refs;
  31         struct rcu_head head;
  32         struct node {
  33                 struct list_head list;
  34                 struct audit_tree *owner;
  35                 unsigned index;         /* index; upper bit indicates 'will prune' */
  36         } owners[];
  37 };
  38
  39 static LIST_HEAD(tree_list);
  40 static LIST_HEAD(prune_list);
  41 static struct task_struct *prune_thread;
  42
  43 /*
  44  * One struct chunk is attached to each inode of interest.
  45  * We replace struct chunk on tagging/untagging.
  46  * Rules have pointer to struct audit_tree.
  47  * Rules have struct list_head rlist forming a list of rules over
  48  * the same tree.
  49  * References to struct chunk are collected at audit_inode{,_child}()
  50  * time and used in AUDIT_TREE rule matching.
  51  * These references are dropped at the same time we are calling
  52  * audit_free_names(), etc.
  53  *
  54  * Cyclic lists galore:
  55  * tree.chunks anchors chunk.owners[].list                      hash_lock
  56  * tree.rules anchors rule.rlist                                audit_filter_mutex
  57  * chunk.trees anchors tree.same_root                           hash_lock
  58  * chunk.hash is a hash with middle bits of watch.inode as
  59  * a hash function.                                             RCU, hash_lock
  60  *
  61  * tree is refcounted; one reference for "some rules on rules_list refer to
  62  * it", one for each chunk with pointer to it.
  63  *
  64  * chunk is refcounted by embedded fsnotify_mark + .refs (non-zero refcount
  65  * of watch contributes 1 to .refs).
  66  *
  67  * node.index allows to get from node.list to containing chunk.
  68  * MSB of that sucker is stolen to mark taggings that we might have to
  69  * revert - several operations have very unpleasant cleanup logics and
  70  * that makes a difference.  Some.
  71  */
  72
  73 static struct fsnotify_group *audit_tree_group;
  74
  75 static struct audit_tree *alloc_tree(const char *s)
  76 {
  77         struct audit_tree *tree;
  78
  79         tree = kmalloc(sizeof(struct audit_tree) + strlen(s) + 1, GFP_KERNEL);
  80         if (tree) {
  81                 refcount_set(&tree->count, 1);
  82                 tree->goner = 0;
  83                 INIT_LIST_HEAD(&tree->chunks);
  84                 INIT_LIST_HEAD(&tree->rules);
  85                 INIT_LIST_HEAD(&tree->list);
  86                 INIT_LIST_HEAD(&tree->same_root);
  87                 tree->root = NULL;
  88                 strcpy(tree->pathname, s);
  89         }
  90         return tree;
  91 }
  92
  93 static inline void get_tree(struct audit_tree *tree)
  94 {
  95         refcount_inc(&tree->count);
  96 }
  97
  98 static inline void put_tree(struct audit_tree *tree)
  99 {
 100         if (refcount_dec_and_test(&tree->count))
 101                 kfree_rcu(tree, head);
 102 }
 103
 104 /* to avoid bringing the entire thing in audit.h */
 105 const char *audit_tree_path(struct audit_tree *tree)
 106 {
 107         return tree->pathname;
 108 }
 109
 110 static void free_chunk(struct audit_chunk *chunk)
 111 {
 112         int i;
 113
 114         for (i = 0; i < chunk->count; i++) {
 115                 if (chunk->owners[i].owner)
 116                         put_tree(chunk->owners[i].owner);
 117         }
 118         kfree(chunk);
 119 }
 120
 121 void audit_put_chunk(struct audit_chunk *chunk)
 122 {
 123         if (atomic_long_dec_and_test(&chunk->refs))
 124                 free_chunk(chunk);
 125 }
 126
 127 static void __put_chunk(struct rcu_head *rcu)
 128 {
 129         struct audit_chunk *chunk = container_of(rcu, struct audit_chunk, head);
 130         audit_put_chunk(chunk);
 131 }
 132
 133 static void audit_tree_destroy_watch(struct fsnotify_mark *entry)
 134 {
 135         struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
 136         call_rcu(&chunk->head, __put_chunk);
 137 }
 138
 139 static struct audit_chunk *alloc_chunk(int count)
 140 {
 141         struct audit_chunk *chunk;
 142         size_t size;
 143         int i;
 144
 145         size = offsetof(struct audit_chunk, owners) + count * sizeof(struct node);
 146         chunk = kzalloc(size, GFP_KERNEL);
 147         if (!chunk)
 148                 return NULL;
 149
 150         INIT_LIST_HEAD(&chunk->hash);
 151         INIT_LIST_HEAD(&chunk->trees);
 152         chunk->count = count;
 153         atomic_long_set(&chunk->refs, 1);
 154         for (i = 0; i < count; i++) {
 155                 INIT_LIST_HEAD(&chunk->owners[i].list);
 156                 chunk->owners[i].index = i;
 157         }
 158         fsnotify_init_mark(&chunk->mark, audit_tree_destroy_watch);
 159         chunk->mark.mask = FS_IN_IGNORED;
 160         return chunk;
 161 }
 162
 163 enum {HASH_SIZE = 128};
 164 static struct list_head chunk_hash_heads[HASH_SIZE];
 165 static __cacheline_aligned_in_smp DEFINE_SPINLOCK(hash_lock);
 166
 167 static inline struct list_head *chunk_hash(const struct inode *inode)
 168 {
 169         unsigned long n = (unsigned long)inode / L1_CACHE_BYTES;
 170         return chunk_hash_heads + n % HASH_SIZE;
 171 }
 172
 173 /* hash_lock & entry->lock is held by caller */
 174 static void insert_hash(struct audit_chunk *chunk)
 175 {
 176         struct fsnotify_mark *entry = &chunk->mark;
 177         struct list_head *list;
 178
 179         if (!entry->inode)
 180                 return;
 181         list = chunk_hash(entry->inode);
 182         list_add_rcu(&chunk->hash, list);
 183 }
 184
 185 /* called under rcu_read_lock */
 186 struct audit_chunk *audit_tree_lookup(const struct inode *inode)
 187 {
 188         struct list_head *list = chunk_hash(inode);
 189         struct audit_chunk *p;
 190
 191         list_for_each_entry_rcu(p, list, hash) {
 192                 /* mark.inode may have gone NULL, but who cares? */
 193                 if (p->mark.inode == inode) {
 194                         atomic_long_inc(&p->refs);
 195                         return p;
 196                 }
 197         }
 198         return NULL;
 199 }
 200
 201 bool audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree)
 202 {
 203         int n;
 204         for (n = 0; n < chunk->count; n++)
 205                 if (chunk->owners[n].owner == tree)
 206                         return true;
 207         return false;
 208 }
 209
 210 /* tagging and untagging inodes with trees */
 211
 212 static struct audit_chunk *find_chunk(struct node *p)
 213 {
 214         int index = p->index & ~(1U<<31);
 215         p -= index;
 216         return container_of(p, struct audit_chunk, owners[0]);
 217 }
 218
 219 static void untag_chunk(struct node *p)
 220 {
 221         struct audit_chunk *chunk = find_chunk(p);
 222         struct fsnotify_mark *entry = &chunk->mark;
 223         struct audit_chunk *new = NULL;
 224         struct audit_tree *owner;
 225         int size = chunk->count - 1;
 226         int i, j;
 227
 228         fsnotify_get_mark(entry);
 229
 230         spin_unlock(&hash_lock);
 231
 232         if (size)
 233                 new = alloc_chunk(size);
 234
 235         mutex_lock(&entry->group->mark_mutex);
 236         spin_lock(&entry->lock);
 237         if (chunk->dead || !entry->inode) {
 238                 spin_unlock(&entry->lock);
 239                 mutex_unlock(&entry->group->mark_mutex);
 240                 if (new)
 241                         free_chunk(new);
 242                 goto out;
 243         }
 244
 245         owner = p->owner;
 246
 247         if (!size) {
 248                 chunk->dead = 1;
 249                 spin_lock(&hash_lock);
 250                 list_del_init(&chunk->trees);
 251                 if (owner->root == chunk)
 252                         owner->root = NULL;
 253                 list_del_init(&p->list);
 254                 list_del_rcu(&chunk->hash);
 255                 spin_unlock(&hash_lock);
 256                 spin_unlock(&entry->lock);
 257                 mutex_unlock(&entry->group->mark_mutex);
 258                 fsnotify_destroy_mark(entry, audit_tree_group);
 259                 goto out;
 260         }
 261
 262         if (!new)
 263                 goto Fallback;
 264
 265         if (fsnotify_add_mark_locked(&new->mark, entry->group, entry->inode,
 266                                      NULL, 1)) {
 267                 fsnotify_put_mark(&new->mark);
 268                 goto Fallback;
 269         }
 270
 271         chunk->dead = 1;
 272         spin_lock(&hash_lock);
 273         list_replace_init(&chunk->trees, &new->trees);
 274         if (owner->root == chunk) {
 275                 list_del_init(&owner->same_root);
 276                 owner->root = NULL;
 277         }
 278
 279         for (i = j = 0; j <= size; i++, j++) {
 280                 struct audit_tree *s;
 281                 if (&chunk->owners[j] == p) {
 282                         list_del_init(&p->list);
 283                         i--;
 284                         continue;
 285                 }
 286                 s = chunk->owners[j].owner;
 287                 new->owners[i].owner = s;
 288                 new->owners[i].index = chunk->owners[j].index - j + i;
 289                 if (!s) /* result of earlier fallback */
 290                         continue;
 291                 get_tree(s);
 292                 list_replace_init(&chunk->owners[j].list, &new->owners[i].list);
 293         }
 294
 295         list_replace_rcu(&chunk->hash, &new->hash);
 296         list_for_each_entry(owner, &new->trees, same_root)
 297                 owner->root = new;
 298         spin_unlock(&hash_lock);
 299         spin_unlock(&entry->lock);
 300         mutex_unlock(&entry->group->mark_mutex);
 301         fsnotify_destroy_mark(entry, audit_tree_group);
 302         fsnotify_put_mark(&new->mark);  /* drop initial reference */
 303         goto out;
 304
 305 Fallback:
 306         // do the best we can
 307         spin_lock(&hash_lock);
 308         if (owner->root == chunk) {
 309                 list_del_init(&owner->same_root);
 310                 owner->root = NULL;
 311         }
 312         list_del_init(&p->list);
 313         p->owner = NULL;
 314         put_tree(owner);
 315         spin_unlock(&hash_lock);
 316         spin_unlock(&entry->lock);
 317         mutex_unlock(&entry->group->mark_mutex);
 318 out:
 319         fsnotify_put_mark(entry);
 320         spin_lock(&hash_lock);
 321 }
 322
 323 static int create_chunk(struct inode *inode, struct audit_tree *tree)
 324 {
 325         struct fsnotify_mark *entry;
 326         struct audit_chunk *chunk = alloc_chunk(1);
 327         if (!chunk)
 328                 return -ENOMEM;
 329
 330         entry = &chunk->mark;
 331         if (fsnotify_add_mark(entry, audit_tree_group, inode, NULL, 0)) {
 332                 fsnotify_put_mark(entry);
 333                 return -ENOSPC;
 334         }
 335
 336         spin_lock(&entry->lock);
 337         spin_lock(&hash_lock);
 338         if (tree->goner) {
 339                 spin_unlock(&hash_lock);
 340                 chunk->dead = 1;
 341                 spin_unlock(&entry->lock);
 342                 fsnotify_destroy_mark(entry, audit_tree_group);
 343                 fsnotify_put_mark(entry);
 344                 return 0;
 345         }
 346         chunk->owners[0].index = (1U << 31);
 347         chunk->owners[0].owner = tree;
 348         get_tree(tree);
 349         list_add(&chunk->owners[0].list, &tree->chunks);
 350         if (!tree->root) {
 351                 tree->root = chunk;
 352                 list_add(&tree->same_root, &chunk->trees);
 353         }
 354         insert_hash(chunk);
 355         spin_unlock(&hash_lock);
 356         spin_unlock(&entry->lock);
 357         fsnotify_put_mark(entry);       /* drop initial reference */
 358         return 0;
 359 }
 360
 361 /* the first tagged inode becomes root of tree */
 362 static int tag_chunk(struct inode *inode, struct audit_tree *tree)
 363 {
 364         struct fsnotify_mark *old_entry, *chunk_entry;
 365         struct audit_tree *owner;
 366         struct audit_chunk *chunk, *old;
 367         struct node *p;
 368         int n;
 369
 370         old_entry = fsnotify_find_inode_mark(audit_tree_group, inode);
 371         if (!old_entry)
 372                 return create_chunk(inode, tree);
 373
 374         old = container_of(old_entry, struct audit_chunk, mark);
 375
 376         /* are we already there? */
 377         spin_lock(&hash_lock);
 378         for (n = 0; n < old->count; n++) {
 379                 if (old->owners[n].owner == tree) {
 380                         spin_unlock(&hash_lock);
 381                         fsnotify_put_mark(old_entry);
 382                         return 0;
 383                 }
 384         }
 385         spin_unlock(&hash_lock);
 386
 387         chunk = alloc_chunk(old->count + 1);
 388         if (!chunk) {
 389                 fsnotify_put_mark(old_entry);
 390                 return -ENOMEM;
 391         }
 392
 393         chunk_entry = &chunk->mark;
 394
 395         mutex_lock(&old_entry->group->mark_mutex);
 396         spin_lock(&old_entry->lock);
 397         if (!old_entry->inode) {
 398                 /* old_entry is being shot, lets just lie */
 399                 spin_unlock(&old_entry->lock);
 400                 mutex_unlock(&old_entry->group->mark_mutex);
 401                 fsnotify_put_mark(old_entry);
 402                 free_chunk(chunk);
 403                 return -ENOENT;
 404         }
 405
 406         if (fsnotify_add_mark_locked(chunk_entry, old_entry->group,
 407                                      old_entry->inode, NULL, 1)) {
 408                 spin_unlock(&old_entry->lock);
 409                 mutex_unlock(&old_entry->group->mark_mutex);
 410                 fsnotify_put_mark(chunk_entry);
 411                 fsnotify_put_mark(old_entry);
 412                 return -ENOSPC;
 413         }
 414
 415         /* even though we hold old_entry->lock, this is safe since chunk_entry->lock could NEVER have been grabbed before */
 416         spin_lock(&chunk_entry->lock);
 417         spin_lock(&hash_lock);
 418
 419         /* we now hold old_entry->lock, chunk_entry->lock, and hash_lock */
 420         if (tree->goner) {
 421                 spin_unlock(&hash_lock);
 422                 chunk->dead = 1;
 423                 spin_unlock(&chunk_entry->lock);
 424                 spin_unlock(&old_entry->lock);
 425                 mutex_unlock(&old_entry->group->mark_mutex);
 426
 427                 fsnotify_destroy_mark(chunk_entry, audit_tree_group);
 428
 429                 fsnotify_put_mark(chunk_entry);
 430                 fsnotify_put_mark(old_entry);
 431                 return 0;
 432         }
 433         list_replace_init(&old->trees, &chunk->trees);
 434         for (n = 0, p = chunk->owners; n < old->count; n++, p++) {
 435                 struct audit_tree *s = old->owners[n].owner;
 436                 p->owner = s;
 437                 p->index = old->owners[n].index;
 438                 if (!s) /* result of fallback in untag */
 439                         continue;
 440                 get_tree(s);
 441                 list_replace_init(&old->owners[n].list, &p->list);
 442         }
 443         p->index = (chunk->count - 1) | (1U<<31);
 444         p->owner = tree;
 445         get_tree(tree);
 446         list_add(&p->list, &tree->chunks);
 447         list_replace_rcu(&old->hash, &chunk->hash);
 448         list_for_each_entry(owner, &chunk->trees, same_root)
 449                 owner->root = chunk;
 450         old->dead = 1;
 451         if (!tree->root) {
 452                 tree->root = chunk;
 453                 list_add(&tree->same_root, &chunk->trees);
 454         }
 455         spin_unlock(&hash_lock);
 456         spin_unlock(&chunk_entry->lock);
 457         spin_unlock(&old_entry->lock);
 458         mutex_unlock(&old_entry->group->mark_mutex);
 459         fsnotify_destroy_mark(old_entry, audit_tree_group);
 460         fsnotify_put_mark(chunk_entry); /* drop initial reference */
 461         fsnotify_put_mark(old_entry); /* pair to fsnotify_find mark_entry */
 462         return 0;
 463 }
 464
 465 static void audit_tree_log_remove_rule(struct audit_krule *rule)
 466 {
 467         struct audit_buffer *ab;
 468
 469         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
 470         if (unlikely(!ab))
 471                 return;
 472         audit_log_format(ab, "op=remove_rule");
 473         audit_log_format(ab, " dir=");
 474         audit_log_untrustedstring(ab, rule->tree->pathname);
 475         audit_log_key(ab, rule->filterkey);
 476         audit_log_format(ab, " list=%d res=1", rule->listnr);
 477         audit_log_end(ab);
 478 }
 479
 480 static void kill_rules(struct audit_tree *tree)
 481 {
 482         struct audit_krule *rule, *next;
 483         struct audit_entry *entry;
 484
 485         list_for_each_entry_safe(rule, next, &tree->rules, rlist) {
 486                 entry = container_of(rule, struct audit_entry, rule);
 487
 488                 list_del_init(&rule->rlist);
 489                 if (rule->tree) {
 490                         /* not a half-baked one */
 491                         audit_tree_log_remove_rule(rule);
 492                         if (entry->rule.exe)
 493                                 audit_remove_mark(entry->rule.exe);
 494                         rule->tree = NULL;
 495                         list_del_rcu(&entry->list);
 496                         list_del(&entry->rule.list);
 497                         call_rcu(&entry->rcu, audit_free_rule_rcu);
 498                 }
 499         }
 500 }
 501
 502 /*
 503  * finish killing struct audit_tree
 504  */
 505 static void prune_one(struct audit_tree *victim)
 506 {
 507         spin_lock(&hash_lock);
 508         while (!list_empty(&victim->chunks)) {
 509                 struct node *p;
 510
 511                 p = list_entry(victim->chunks.next, struct node, list);
 512
 513                 untag_chunk(p);
 514         }
 515         spin_unlock(&hash_lock);
 516         put_tree(victim);
 517 }
 518
 519 /* trim the uncommitted chunks from tree */
 520
 521 static void trim_marked(struct audit_tree *tree)
 522 {
 523         struct list_head *p, *q;
 524         spin_lock(&hash_lock);
 525         if (tree->goner) {
 526                 spin_unlock(&hash_lock);
 527                 return;
 528         }
 529         /* reorder */
 530         for (p = tree->chunks.next; p != &tree->chunks; p = q) {
 531                 struct node *node = list_entry(p, struct node, list);
 532                 q = p->next;
 533                 if (node->index & (1U<<31)) {
 534                         list_del_init(p);
 535                         list_add(p, &tree->chunks);
 536                 }
 537         }
 538
 539         while (!list_empty(&tree->chunks)) {
 540                 struct node *node;
 541
 542                 node = list_entry(tree->chunks.next, struct node, list);
 543
 544                 /* have we run out of marked? */
 545                 if (!(node->index & (1U<<31)))
 546                         break;
 547
 548                 untag_chunk(node);
 549         }
 550         if (!tree->root && !tree->goner) {
 551                 tree->goner = 1;
 552                 spin_unlock(&hash_lock);
 553                 mutex_lock(&audit_filter_mutex);
 554                 kill_rules(tree);
 555                 list_del_init(&tree->list);
 556                 mutex_unlock(&audit_filter_mutex);
 557                 prune_one(tree);
 558         } else {
 559                 spin_unlock(&hash_lock);
 560         }
 561 }
 562
 563 static void audit_schedule_prune(void);
 564
 565 /* called with audit_filter_mutex */
 566 int audit_remove_tree_rule(struct audit_krule *rule)
 567 {
 568         struct audit_tree *tree;
 569         tree = rule->tree;
 570         if (tree) {
 571                 spin_lock(&hash_lock);
 572                 list_del_init(&rule->rlist);
 573                 if (list_empty(&tree->rules) && !tree->goner) {
 574                         tree->root = NULL;
 575                         list_del_init(&tree->same_root);
 576                         tree->goner = 1;
 577                         list_move(&tree->list, &prune_list);
 578                         rule->tree = NULL;
 579                         spin_unlock(&hash_lock);
 580                         audit_schedule_prune();
 581                         return 1;
 582                 }
 583                 rule->tree = NULL;
 584                 spin_unlock(&hash_lock);
 585                 return 1;
 586         }
 587         return 0;
 588 }
 589
 590 static int compare_root(struct vfsmount *mnt, void *arg)
 591 {
 592         return d_backing_inode(mnt->mnt_root) == arg;
 593 }
 594
 595 void audit_trim_trees(void)
 596 {
 597         struct list_head cursor;
 598
 599         mutex_lock(&audit_filter_mutex);
 600         list_add(&cursor, &tree_list);
 601         while (cursor.next != &tree_list) {
 602                 struct audit_tree *tree;
 603                 struct path path;
 604                 struct vfsmount *root_mnt;
 605                 struct node *node;
 606                 int err;
 607
 608                 tree = container_of(cursor.next, struct audit_tree, list);
 609                 get_tree(tree);
 610                 list_del(&cursor);
 611                 list_add(&cursor, &tree->list);
 612                 mutex_unlock(&audit_filter_mutex);
 613
 614                 err = kern_path(tree->pathname, 0, &path);
 615                 if (err)
 616                         goto skip_it;
 617
 618                 root_mnt = collect_mounts(&path);
 619                 path_put(&path);
 620                 if (IS_ERR(root_mnt))
 621                         goto skip_it;
 622
 623                 spin_lock(&hash_lock);
 624                 list_for_each_entry(node, &tree->chunks, list) {
 625                         struct audit_chunk *chunk = find_chunk(node);
 626                         /* this could be NULL if the watch is dying else where... */
 627                         struct inode *inode = chunk->mark.inode;
 628                         node->index |= 1U<<31;
 629                         if (iterate_mounts(compare_root, inode, root_mnt))
 630                                 node->index &= ~(1U<<31);
 631                 }
 632                 spin_unlock(&hash_lock);
 633                 trim_marked(tree);
 634                 drop_collected_mounts(root_mnt);
 635 skip_it:
 636                 put_tree(tree);
 637                 mutex_lock(&audit_filter_mutex);
 638         }
 639         list_del(&cursor);
 640         mutex_unlock(&audit_filter_mutex);
 641 }
 642
 643 int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op)
 644 {
 645
 646         if (pathname[0] != '/' ||
 647             rule->listnr != AUDIT_FILTER_EXIT ||
 648             op != Audit_equal ||
 649             rule->inode_f || rule->watch || rule->tree)
 650                 return -EINVAL;
 651         rule->tree = alloc_tree(pathname);
 652         if (!rule->tree)
 653                 return -ENOMEM;
 654         return 0;
 655 }
 656
 657 void audit_put_tree(struct audit_tree *tree)
 658 {
 659         put_tree(tree);
 660 }
 661
 662 static int tag_mount(struct vfsmount *mnt, void *arg)
 663 {
 664         return tag_chunk(d_backing_inode(mnt->mnt_root), arg);
 665 }
 666
 667 /*
 668  * That gets run when evict_chunk() ends up needing to kill audit_tree.
 669  * Runs from a separate thread.
 670  */
 671 static int prune_tree_thread(void *unused)
 672 {
 673         for (;;) {
 674                 if (list_empty(&prune_list)) {
 675                         set_current_state(TASK_INTERRUPTIBLE);
 676                         schedule();
 677                 }
 678
 679                 mutex_lock(&audit_cmd_mutex);
 680                 mutex_lock(&audit_filter_mutex);
 681
 682                 while (!list_empty(&prune_list)) {
 683                         struct audit_tree *victim;
 684
 685                         victim = list_entry(prune_list.next,
 686                                         struct audit_tree, list);
 687                         list_del_init(&victim->list);
 688
 689                         mutex_unlock(&audit_filter_mutex);
 690
 691                         prune_one(victim);
 692
 693                         mutex_lock(&audit_filter_mutex);
 694                 }
 695
 696                 mutex_unlock(&audit_filter_mutex);
 697                 mutex_unlock(&audit_cmd_mutex);
 698         }
 699         return 0;
 700 }
 701
 702 static int audit_launch_prune(void)
 703 {
 704         if (prune_thread)
 705                 return 0;
 706         prune_thread = kthread_run(prune_tree_thread, NULL,
 707                                 "audit_prune_tree");
 708         if (IS_ERR(prune_thread)) {
 709                 pr_err("cannot start thread audit_prune_tree");
 710                 prune_thread = NULL;
 711                 return -ENOMEM;
 712         }
 713         return 0;
 714 }
 715
 716 /* called with audit_filter_mutex */
 717 int audit_add_tree_rule(struct audit_krule *rule)
 718 {
 719         struct audit_tree *seed = rule->tree, *tree;
 720         struct path path;
 721         struct vfsmount *mnt;
 722         int err;
 723
 724         rule->tree = NULL;
 725         list_for_each_entry(tree, &tree_list, list) {
 726                 if (!strcmp(seed->pathname, tree->pathname)) {
 727                         put_tree(seed);
 728                         rule->tree = tree;
 729                         list_add(&rule->rlist, &tree->rules);
 730                         return 0;
 731                 }
 732         }
 733         tree = seed;
 734         list_add(&tree->list, &tree_list);
 735         list_add(&rule->rlist, &tree->rules);
 736         /* do not set rule->tree yet */
 737         mutex_unlock(&audit_filter_mutex);
 738
 739         if (unlikely(!prune_thread)) {
 740                 err = audit_launch_prune();
 741                 if (err)
 742                         goto Err;
 743         }
 744
 745         err = kern_path(tree->pathname, 0, &path);
 746         if (err)
 747                 goto Err;
 748         mnt = collect_mounts(&path);
 749         path_put(&path);
 750         if (IS_ERR(mnt)) {
 751                 err = PTR_ERR(mnt);
 752                 goto Err;
 753         }
 754
 755         get_tree(tree);
 756         err = iterate_mounts(tag_mount, tree, mnt);
 757         drop_collected_mounts(mnt);
 758
 759         if (!err) {
 760                 struct node *node;
 761                 spin_lock(&hash_lock);
 762                 list_for_each_entry(node, &tree->chunks, list)
 763                         node->index &= ~(1U<<31);
 764                 spin_unlock(&hash_lock);
 765         } else {
 766                 trim_marked(tree);
 767                 goto Err;
 768         }
 769
 770         mutex_lock(&audit_filter_mutex);
 771         if (list_empty(&rule->rlist)) {
 772                 put_tree(tree);
 773                 return -ENOENT;
 774         }
 775         rule->tree = tree;
 776         put_tree(tree);
 777
 778         return 0;
 779 Err:
 780         mutex_lock(&audit_filter_mutex);
 781         list_del_init(&tree->list);
 782         list_del_init(&tree->rules);
 783         put_tree(tree);
 784         return err;
 785 }
 786
 787 int audit_tag_tree(char *old, char *new)
 788 {
 789         struct list_head cursor, barrier;
 790         int failed = 0;
 791         struct path path1, path2;
 792         struct vfsmount *tagged;
 793         int err;
 794
 795         err = kern_path(new, 0, &path2);
 796         if (err)
 797                 return err;
 798         tagged = collect_mounts(&path2);
 799         path_put(&path2);
 800         if (IS_ERR(tagged))
 801                 return PTR_ERR(tagged);
 802
 803         err = kern_path(old, 0, &path1);
 804         if (err) {
 805                 drop_collected_mounts(tagged);
 806                 return err;
 807         }
 808
 809         mutex_lock(&audit_filter_mutex);
 810         list_add(&barrier, &tree_list);
 811         list_add(&cursor, &barrier);
 812
 813         while (cursor.next != &tree_list) {
 814                 struct audit_tree *tree;
 815                 int good_one = 0;
 816
 817                 tree = container_of(cursor.next, struct audit_tree, list);
 818                 get_tree(tree);
 819                 list_del(&cursor);
 820                 list_add(&cursor, &tree->list);
 821                 mutex_unlock(&audit_filter_mutex);
 822
 823                 err = kern_path(tree->pathname, 0, &path2);
 824                 if (!err) {
 825                         good_one = path_is_under(&path1, &path2);
 826                         path_put(&path2);
 827                 }
 828
 829                 if (!good_one) {
 830                         put_tree(tree);
 831                         mutex_lock(&audit_filter_mutex);
 832                         continue;
 833                 }
 834
 835                 failed = iterate_mounts(tag_mount, tree, tagged);
 836                 if (failed) {
 837                         put_tree(tree);
 838                         mutex_lock(&audit_filter_mutex);
 839                         break;
 840                 }
 841
 842                 mutex_lock(&audit_filter_mutex);
 843                 spin_lock(&hash_lock);
 844                 if (!tree->goner) {
 845                         list_del(&tree->list);
 846                         list_add(&tree->list, &tree_list);
 847                 }
 848                 spin_unlock(&hash_lock);
 849                 put_tree(tree);
 850         }
 851
 852         while (barrier.prev != &tree_list) {
 853                 struct audit_tree *tree;
 854
 855                 tree = container_of(barrier.prev, struct audit_tree, list);
 856                 get_tree(tree);
 857                 list_del(&tree->list);
 858                 list_add(&tree->list, &barrier);
 859                 mutex_unlock(&audit_filter_mutex);
 860
 861                 if (!failed) {
 862                         struct node *node;
 863                         spin_lock(&hash_lock);
 864                         list_for_each_entry(node, &tree->chunks, list)
 865                                 node->index &= ~(1U<<31);
 866                         spin_unlock(&hash_lock);
 867                 } else {
 868                         trim_marked(tree);
 869                 }
 870
 871                 put_tree(tree);
 872                 mutex_lock(&audit_filter_mutex);
 873         }
 874         list_del(&barrier);
 875         list_del(&cursor);
 876         mutex_unlock(&audit_filter_mutex);
 877         path_put(&path1);
 878         drop_collected_mounts(tagged);
 879         return failed;
 880 }
 881
 882
 883 static void audit_schedule_prune(void)
 884 {
 885         wake_up_process(prune_thread);
 886 }
 887
 888 /*
 889  * ... and that one is done if evict_chunk() decides to delay until the end
 890  * of syscall.  Runs synchronously.
 891  */
 892 void audit_kill_trees(struct list_head *list)
 893 {
 894         mutex_lock(&audit_cmd_mutex);
 895         mutex_lock(&audit_filter_mutex);
 896
 897         while (!list_empty(list)) {
 898                 struct audit_tree *victim;
 899
 900                 victim = list_entry(list->next, struct audit_tree, list);
 901                 kill_rules(victim);
 902                 list_del_init(&victim->list);
 903
 904                 mutex_unlock(&audit_filter_mutex);
 905
 906                 prune_one(victim);
 907
 908                 mutex_lock(&audit_filter_mutex);
 909         }
 910
 911         mutex_unlock(&audit_filter_mutex);
 912         mutex_unlock(&audit_cmd_mutex);
 913 }
 914
 915 /*
 916  *  Here comes the stuff asynchronous to auditctl operations
 917  */
 918
 919 static void evict_chunk(struct audit_chunk *chunk)
 920 {
 921         struct audit_tree *owner;
 922         struct list_head *postponed = audit_killed_trees();
 923         int need_prune = 0;
 924         int n;
 925
 926         if (chunk->dead)
 927                 return;
 928
 929         chunk->dead = 1;
 930         mutex_lock(&audit_filter_mutex);
 931         spin_lock(&hash_lock);
 932         while (!list_empty(&chunk->trees)) {
 933                 owner = list_entry(chunk->trees.next,
 934                                    struct audit_tree, same_root);
 935                 owner->goner = 1;
 936                 owner->root = NULL;
 937                 list_del_init(&owner->same_root);
 938                 spin_unlock(&hash_lock);
 939                 if (!postponed) {
 940                         kill_rules(owner);
 941                         list_move(&owner->list, &prune_list);
 942                         need_prune = 1;
 943                 } else {
 944                         list_move(&owner->list, postponed);
 945                 }
 946                 spin_lock(&hash_lock);
 947         }
 948         list_del_rcu(&chunk->hash);
 949         for (n = 0; n < chunk->count; n++)
 950                 list_del_init(&chunk->owners[n].list);
 951         spin_unlock(&hash_lock);
 952         mutex_unlock(&audit_filter_mutex);
 953         if (need_prune)
 954                 audit_schedule_prune();
 955 }
 956
 957 static int audit_tree_handle_event(struct fsnotify_group *group,
 958                                    struct inode *to_tell,
 959                                    struct fsnotify_mark *inode_mark,
 960                                    struct fsnotify_mark *vfsmount_mark,
 961                                    u32 mask, const void *data, int data_type,
 962                                    const unsigned char *file_name, u32 cookie)
 963 {
 964         return 0;
 965 }
 966
 967 static void audit_tree_freeing_mark(struct fsnotify_mark *entry, struct fsnotify_group *group)
 968 {
 969         struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
 970
 971         evict_chunk(chunk);
 972
 973         /*
 974          * We are guaranteed to have at least one reference to the mark from
 975          * either the inode or the caller of fsnotify_destroy_mark().
 976          */
 977         BUG_ON(atomic_read(&entry->refcnt) < 1);
 978 }
 979
 980 static const struct fsnotify_ops audit_tree_ops = {
 981         .handle_event = audit_tree_handle_event,
 982         .freeing_mark = audit_tree_freeing_mark,
 983 };
 984
 985 static int __init audit_tree_init(void)
 986 {
 987         int i;
 988
 989         audit_tree_group = fsnotify_alloc_group(&audit_tree_ops);
 990         if (IS_ERR(audit_tree_group))
 991                 audit_panic("cannot initialize fsnotify group for rectree watches");
 992
 993         for (i = 0; i < HASH_SIZE; i++)
 994                 INIT_LIST_HEAD(&chunk_hash_heads[i]);
 995
 996         return 0;
 997 }
 998 __initcall(audit_tree_init);