kernel/audit_watch.c - linux - Git at Google

 // SPDX-License-Identifier: GPL-2.0-or-later
 /* audit_watch.c -- watching inodes
  *
  * Copyright 2003-2009 Red Hat, Inc.
  * Copyright 2005 Hewlett-Packard Development Company, L.P.
  * Copyright 2005 IBM Corporation
  */

 #include <linux/file.h>
 #include <linux/kernel.h>
 #include <linux/audit.h>
 #include <linux/kthread.h>
 #include <linux/mutex.h>
 #include <linux/fs.h>
 #include <linux/fsnotify_backend.h>
 #include <linux/namei.h>
 #include <linux/netlink.h>
 #include <linux/refcount.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/security.h>
 #include "audit.h"

 /*
  * Reference counting:
  *
  * audit_parent: lifetime is from audit_init_parent() to receipt of an FS_IGNORED
  * 	event.  Each audit_watch holds a reference to its associated parent.
  *
  * audit_watch: if added to lists, lifetime is from audit_init_watch() to
  * 	audit_remove_watch().  Additionally, an audit_watch may exist
  * 	temporarily to assist in searching existing filter data.  Each
  * 	audit_krule holds a reference to its associated watch.
  */

 struct audit_watch {
 	refcount_t		count;	/* reference count */
 	dev_t			dev;	/* associated superblock device */
 	char			*path;	/* insertion path */
 	unsigned long		ino;	/* associated inode number */
 	struct audit_parent	*parent; /* associated parent */
 	struct list_head	wlist;	/* entry in parent->watches list */
 	struct list_head	rules;	/* anchor for krule->rlist */
 };

 struct audit_parent {
 	struct list_head	watches; /* anchor for audit_watch->wlist */
 	struct fsnotify_mark mark; /* fsnotify mark on the inode */
 };

 /* fsnotify handle. */
 static struct fsnotify_group *audit_watch_group;

 /* fsnotify events we care about. */
 #define AUDIT_FS_WATCH (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
 			FS_MOVE_SELF | FS_EVENT_ON_CHILD | FS_UNMOUNT)

 static void audit_free_parent(struct audit_parent *parent)
 {
 	WARN_ON(!list_empty(&parent->watches));
 	kfree(parent);
 }

 static void audit_watch_free_mark(struct fsnotify_mark *entry)
 {
 	struct audit_parent *parent;

 	parent = container_of(entry, struct audit_parent, mark);
 	audit_free_parent(parent);
 }

 static void audit_get_parent(struct audit_parent *parent)
 {
 	if (likely(parent))
 		fsnotify_get_mark(&parent->mark);
 }

 static void audit_put_parent(struct audit_parent *parent)
 {
 	if (likely(parent))
 		fsnotify_put_mark(&parent->mark);
 }

 /*
  * Find and return the audit_parent on the given inode.  If found a reference
  * is taken on this parent.
  */
 static inline struct audit_parent *audit_find_parent(struct inode *inode)
 {
 	struct audit_parent *parent = NULL;
 	struct fsnotify_mark *entry;

 	entry = fsnotify_find_mark(&inode->i_fsnotify_marks, audit_watch_group);
 	if (entry)
 		parent = container_of(entry, struct audit_parent, mark);

 	return parent;
 }

 void audit_get_watch(struct audit_watch *watch)
 {
 	refcount_inc(&watch->count);
 }

 void audit_put_watch(struct audit_watch *watch)
 {
 	if (refcount_dec_and_test(&watch->count)) {
 		WARN_ON(watch->parent);
 		WARN_ON(!list_empty(&watch->rules));
 		kfree(watch->path);
 		kfree(watch);
 	}
 }

 static void audit_remove_watch(struct audit_watch *watch)
 {
 	list_del(&watch->wlist);
 	audit_put_parent(watch->parent);
 	watch->parent = NULL;
 	audit_put_watch(watch); /* match initial get */
 }

 char *audit_watch_path(struct audit_watch *watch)
 {
 	return watch->path;
 }

 int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
 {
 	return (watch->ino != AUDIT_INO_UNSET) &&
 		(watch->ino == ino) &&
 		(watch->dev == dev);
 }

 /* Initialize a parent watch entry. */
 static struct audit_parent *audit_init_parent(struct path *path)
 {
 	struct inode *inode = d_backing_inode(path->dentry);
 	struct audit_parent *parent;
 	int ret;

 	parent = kzalloc(sizeof(*parent), GFP_KERNEL);
 	if (unlikely(!parent))
 		return ERR_PTR(-ENOMEM);

 	INIT_LIST_HEAD(&parent->watches);

 	fsnotify_init_mark(&parent->mark, audit_watch_group);
 	parent->mark.mask = AUDIT_FS_WATCH;
 	ret = fsnotify_add_inode_mark(&parent->mark, inode, 0);
 	if (ret < 0) {
 		audit_free_parent(parent);
 		return ERR_PTR(ret);
 	}

 	return parent;
 }

 /* Initialize a watch entry. */
 static struct audit_watch *audit_init_watch(char *path)
 {
 	struct audit_watch *watch;

 	watch = kzalloc(sizeof(*watch), GFP_KERNEL);
 	if (unlikely(!watch))
 		return ERR_PTR(-ENOMEM);

 	INIT_LIST_HEAD(&watch->rules);
 	refcount_set(&watch->count, 1);
 	watch->path = path;
 	watch->dev = AUDIT_DEV_UNSET;
 	watch->ino = AUDIT_INO_UNSET;

 	return watch;
 }

 /* Translate a watch string to kernel representation. */
 int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op)
 {
 	struct audit_watch *watch;

 	if (!audit_watch_group)
 		return -EOPNOTSUPP;

 	if (path[0] != '/' || path[len-1] == '/' ||
 	    krule->listnr != AUDIT_FILTER_EXIT ||
 	    op != Audit_equal ||
 	    krule->inode_f || krule->watch || krule->tree)
 		return -EINVAL;

 	watch = audit_init_watch(path);
 	if (IS_ERR(watch))
 		return PTR_ERR(watch);

 	krule->watch = watch;

 	return 0;
 }

 /* Duplicate the given audit watch.  The new watch's rules list is initialized
  * to an empty list and wlist is undefined. */
 static struct audit_watch *audit_dupe_watch(struct audit_watch *old)
 {
 	char *path;
 	struct audit_watch *new;

 	path = kstrdup(old->path, GFP_KERNEL);
 	if (unlikely(!path))
 		return ERR_PTR(-ENOMEM);

 	new = audit_init_watch(path);
 	if (IS_ERR(new)) {
 		kfree(path);
 		goto out;
 	}

 	new->dev = old->dev;
 	new->ino = old->ino;
 	audit_get_parent(old->parent);
 	new->parent = old->parent;

 out:
 	return new;
 }

 static void audit_watch_log_rule_change(struct audit_krule *r, struct audit_watch *w, char *op)
 {
 	struct audit_buffer *ab;

 	if (!audit_enabled)
 		return;
 	ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE);
 	if (!ab)
 		return;
 	audit_log_session_info(ab);
 	audit_log_format(ab, "op=%s path=", op);
 	audit_log_untrustedstring(ab, w->path);
 	audit_log_key(ab, r->filterkey);
 	audit_log_format(ab, " list=%d res=1", r->listnr);
 	audit_log_end(ab);
 }

 /* Update inode info in audit rules based on filesystem event. */
 static void audit_update_watch(struct audit_parent *parent,
 			       const struct qstr *dname, dev_t dev,
 			       unsigned long ino, unsigned invalidating)
 {
 	struct audit_watch *owatch, *nwatch, *nextw;
 	struct audit_krule *r, *nextr;
 	struct audit_entry *oentry, *nentry;

 	mutex_lock(&audit_filter_mutex);
 	/* Run all of the watches on this parent looking for the one that
 	 * matches the given dname */
 	list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
 		if (audit_compare_dname_path(dname, owatch->path,
 					     AUDIT_NAME_FULL))
 			continue;

 		/* If the update involves invalidating rules, do the inode-based
 		 * filtering now, so we don't omit records. */
 		if (invalidating && !audit_dummy_context())
 			audit_filter_inodes(current, audit_context());

 		/* updating ino will likely change which audit_hash_list we
 		 * are on so we need a new watch for the new list */
 		nwatch = audit_dupe_watch(owatch);
 		if (IS_ERR(nwatch)) {
 			mutex_unlock(&audit_filter_mutex);
 			audit_panic("error updating watch, skipping");
 			return;
 		}
 		nwatch->dev = dev;
 		nwatch->ino = ino;

 		list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) {

 			oentry = container_of(r, struct audit_entry, rule);
 			list_del(&oentry->rule.rlist);
 			list_del_rcu(&oentry->list);

 			nentry = audit_dupe_rule(&oentry->rule);
 			if (IS_ERR(nentry)) {
 				list_del(&oentry->rule.list);
 				audit_panic("error updating watch, removing");
 			} else {
 				int h = audit_hash_ino((u32)ino);

 				/*
 				 * nentry->rule.watch == oentry->rule.watch so
 				 * we must drop that reference and set it to our
 				 * new watch.
 				 */
 				audit_put_watch(nentry->rule.watch);
 				audit_get_watch(nwatch);
 				nentry->rule.watch = nwatch;
 				list_add(&nentry->rule.rlist, &nwatch->rules);
 				list_add_rcu(&nentry->list, &audit_inode_hash[h]);
 				list_replace(&oentry->rule.list,
 					     &nentry->rule.list);
 			}
 			if (oentry->rule.exe)
 				audit_remove_mark(oentry->rule.exe);

 			call_rcu(&oentry->rcu, audit_free_rule_rcu);
 		}

 		audit_remove_watch(owatch);
 		goto add_watch_to_parent; /* event applies to a single watch */
 	}
 	mutex_unlock(&audit_filter_mutex);
 	return;

 add_watch_to_parent:
 	list_add(&nwatch->wlist, &parent->watches);
 	mutex_unlock(&audit_filter_mutex);
 	return;
 }

 /* Remove all watches & rules associated with a parent that is going away. */
 static void audit_remove_parent_watches(struct audit_parent *parent)
 {
 	struct audit_watch *w, *nextw;
 	struct audit_krule *r, *nextr;
 	struct audit_entry *e;

 	mutex_lock(&audit_filter_mutex);
 	list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
 		list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
 			e = container_of(r, struct audit_entry, rule);
 			audit_watch_log_rule_change(r, w, "remove_rule");
 			if (e->rule.exe)
 				audit_remove_mark(e->rule.exe);
 			list_del(&r->rlist);
 			list_del(&r->list);
 			list_del_rcu(&e->list);
 			call_rcu(&e->rcu, audit_free_rule_rcu);
 		}
 		audit_remove_watch(w);
 	}
 	mutex_unlock(&audit_filter_mutex);

 	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
 }

 /* Get path information necessary for adding watches. */
 static int audit_get_nd(struct audit_watch *watch, struct path *parent)
 {
 	struct dentry *d = kern_path_locked(watch->path, parent);
 	if (IS_ERR(d))
 		return PTR_ERR(d);
 	if (d_is_positive(d)) {
 		/* update watch filter fields */
 		watch->dev = d->d_sb->s_dev;
 		watch->ino = d_backing_inode(d)->i_ino;
 	}
 	inode_unlock(d_backing_inode(parent->dentry));
 	dput(d);
 	return 0;
 }

 /* Associate the given rule with an existing parent.
  * Caller must hold audit_filter_mutex. */
 static void audit_add_to_parent(struct audit_krule *krule,
 				struct audit_parent *parent)
 {
 	struct audit_watch *w, *watch = krule->watch;
 	int watch_found = 0;

 	BUG_ON(!mutex_is_locked(&audit_filter_mutex));

 	list_for_each_entry(w, &parent->watches, wlist) {
 		if (strcmp(watch->path, w->path))
 			continue;

 		watch_found = 1;

 		/* put krule's ref to temporary watch */
 		audit_put_watch(watch);

 		audit_get_watch(w);
 		krule->watch = watch = w;

 		audit_put_parent(parent);
 		break;
 	}

 	if (!watch_found) {
 		watch->parent = parent;

 		audit_get_watch(watch);
 		list_add(&watch->wlist, &parent->watches);
 	}
 	list_add(&krule->rlist, &watch->rules);
 }

 /* Find a matching watch entry, or add this one.
  * Caller must hold audit_filter_mutex. */
 int audit_add_watch(struct audit_krule *krule, struct list_head **list)
 {
 	struct audit_watch *watch = krule->watch;
 	struct audit_parent *parent;
 	struct path parent_path;
 	int h, ret = 0;

 	/*
 	 * When we will be calling audit_add_to_parent, krule->watch might have
 	 * been updated and watch might have been freed.
 	 * So we need to keep a reference of watch.
 	 */
 	audit_get_watch(watch);

 	mutex_unlock(&audit_filter_mutex);

 	/* Avoid calling path_lookup under audit_filter_mutex. */
 	ret = audit_get_nd(watch, &parent_path);

 	/* caller expects mutex locked */
 	mutex_lock(&audit_filter_mutex);

 	if (ret) {
 		audit_put_watch(watch);
 		return ret;
 	}

 	/* either find an old parent or attach a new one */
 	parent = audit_find_parent(d_backing_inode(parent_path.dentry));
 	if (!parent) {
 		parent = audit_init_parent(&parent_path);
 		if (IS_ERR(parent)) {
 			ret = PTR_ERR(parent);
 			goto error;
 		}
 	}

 	audit_add_to_parent(krule, parent);

 	h = audit_hash_ino((u32)watch->ino);
 	*list = &audit_inode_hash[h];
 error:
 	path_put(&parent_path);
 	audit_put_watch(watch);
 	return ret;
 }

 void audit_remove_watch_rule(struct audit_krule *krule)
 {
 	struct audit_watch *watch = krule->watch;
 	struct audit_parent *parent = watch->parent;

 	list_del(&krule->rlist);

 	if (list_empty(&watch->rules)) {
 		/*
 		 * audit_remove_watch() drops our reference to 'parent' which
 		 * can get freed. Grab our own reference to be safe.
 		 */
 		audit_get_parent(parent);
 		audit_remove_watch(watch);
 		if (list_empty(&parent->watches))
 			fsnotify_destroy_mark(&parent->mark, audit_watch_group);
 		audit_put_parent(parent);
 	}
 }

 /* Update watch data in audit rules based on fsnotify events. */
 static int audit_watch_handle_event(struct fsnotify_group *group,
 				    struct inode *to_tell,
 				    u32 mask, const void *data, int data_type,
 				    const struct qstr *dname, u32 cookie,
 				    struct fsnotify_iter_info *iter_info)
 {
 	struct fsnotify_mark *inode_mark = fsnotify_iter_inode_mark(iter_info);
 	const struct inode *inode = fsnotify_data_inode(data, data_type);
 	struct audit_parent *parent;

 	parent = container_of(inode_mark, struct audit_parent, mark);

 	BUG_ON(group != audit_watch_group);
 	WARN_ON(!inode);

 	if (mask & (FS_CREATE|FS_MOVED_TO) && inode)
 		audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
 	else if (mask & (FS_DELETE|FS_MOVED_FROM))
 		audit_update_watch(parent, dname, AUDIT_DEV_UNSET, AUDIT_INO_UNSET, 1);
 	else if (mask & (FS_DELETE_SELF|FS_UNMOUNT|FS_MOVE_SELF))
 		audit_remove_parent_watches(parent);

 	return 0;
 }

 static const struct fsnotify_ops audit_watch_fsnotify_ops = {
 	.handle_event = 	audit_watch_handle_event,
 	.free_mark =		audit_watch_free_mark,
 };

 static int __init audit_watch_init(void)
 {
 	audit_watch_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops);
 	if (IS_ERR(audit_watch_group)) {
 		audit_watch_group = NULL;
 		audit_panic("cannot create audit fsnotify group");
 	}
 	return 0;
 }
 device_initcall(audit_watch_init);

 int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old)
 {
 	struct audit_fsnotify_mark *audit_mark;
 	char *pathname;

 	pathname = kstrdup(audit_mark_path(old->exe), GFP_KERNEL);
 	if (!pathname)
 		return -ENOMEM;

 	audit_mark = audit_alloc_mark(new, pathname, strlen(pathname));
 	if (IS_ERR(audit_mark)) {
 		kfree(pathname);
 		return PTR_ERR(audit_mark);
 	}
 	new->exe = audit_mark;

 	return 0;
 }

 int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
 {
 	struct file *exe_file;
 	unsigned long ino;
 	dev_t dev;

 	exe_file = get_task_exe_file(tsk);
 	if (!exe_file)
 		return 0;
 	ino = file_inode(exe_file)->i_ino;
 	dev = file_inode(exe_file)->i_sb->s_dev;
 	fput(exe_file);
 	return audit_mark_compare(mark, ino, dev);
 }
	// SPDX-License-Identifier: GPL-2.0-or-later
	/* audit_watch.c -- watching inodes
	*
	* Copyright 2003-2009 Red Hat, Inc.
	* Copyright 2005 Hewlett-Packard Development Company, L.P.
	* Copyright 2005 IBM Corporation
	*/

	#include <linux/file.h>
	#include <linux/kernel.h>
	#include <linux/audit.h>
	#include <linux/kthread.h>
	#include <linux/mutex.h>
	#include <linux/fs.h>
	#include <linux/fsnotify_backend.h>
	#include <linux/namei.h>
	#include <linux/netlink.h>
	#include <linux/refcount.h>
	#include <linux/sched.h>
	#include <linux/slab.h>
	#include <linux/security.h>
	#include "audit.h"

	/*
	* Reference counting:
	*
	* audit_parent: lifetime is from audit_init_parent() to receipt of an FS_IGNORED
	* event. Each audit_watch holds a reference to its associated parent.
	*
	* audit_watch: if added to lists, lifetime is from audit_init_watch() to
	* audit_remove_watch(). Additionally, an audit_watch may exist
	* temporarily to assist in searching existing filter data. Each
	* audit_krule holds a reference to its associated watch.
	*/

	struct audit_watch {
	refcount_t count; /* reference count */
	dev_t dev; /* associated superblock device */
	char path; / insertion path */
	unsigned long ino; /* associated inode number */
	struct audit_parent parent; / associated parent */
	struct list_head wlist; /* entry in parent->watches list */
	struct list_head rules; /* anchor for krule->rlist */
	};

	struct audit_parent {
	struct list_head watches; /* anchor for audit_watch->wlist */
	struct fsnotify_mark mark; /* fsnotify mark on the inode */
	};

	/* fsnotify handle. */
	static struct fsnotify_group *audit_watch_group;

	/* fsnotify events we care about. */
	#define AUDIT_FS_WATCH (FS_MOVE \| FS_CREATE \| FS_DELETE \| FS_DELETE_SELF \|\
	FS_MOVE_SELF \| FS_EVENT_ON_CHILD \| FS_UNMOUNT)

	static void audit_free_parent(struct audit_parent *parent)
	{
	WARN_ON(!list_empty(&parent->watches));
	kfree(parent);
	}

	static void audit_watch_free_mark(struct fsnotify_mark *entry)
	{
	struct audit_parent *parent;

	parent = container_of(entry, struct audit_parent, mark);
	audit_free_parent(parent);
	}

	static void audit_get_parent(struct audit_parent *parent)
	{
	if (likely(parent))
	fsnotify_get_mark(&parent->mark);
	}

	static void audit_put_parent(struct audit_parent *parent)
	{
	if (likely(parent))
	fsnotify_put_mark(&parent->mark);
	}

	/*
	* Find and return the audit_parent on the given inode. If found a reference
	* is taken on this parent.
	*/
	static inline struct audit_parent audit_find_parent(struct inode inode)
	{
	struct audit_parent *parent = NULL;
	struct fsnotify_mark *entry;

	entry = fsnotify_find_mark(&inode->i_fsnotify_marks, audit_watch_group);
	if (entry)
	parent = container_of(entry, struct audit_parent, mark);

	return parent;
	}

	void audit_get_watch(struct audit_watch *watch)
	{
	refcount_inc(&watch->count);
	}

	void audit_put_watch(struct audit_watch *watch)
	{
	if (refcount_dec_and_test(&watch->count)) {
	WARN_ON(watch->parent);
	WARN_ON(!list_empty(&watch->rules));
	kfree(watch->path);
	kfree(watch);
	}
	}

	static void audit_remove_watch(struct audit_watch *watch)
	{
	list_del(&watch->wlist);
	audit_put_parent(watch->parent);
	watch->parent = NULL;
	audit_put_watch(watch); /* match initial get */
	}

	char audit_watch_path(struct audit_watch watch)
	{
	return watch->path;
	}

	int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev)
	{
	return (watch->ino != AUDIT_INO_UNSET) &&
	(watch->ino == ino) &&
	(watch->dev == dev);
	}

	/* Initialize a parent watch entry. */
	static struct audit_parent audit_init_parent(struct path path)
	{
	struct inode *inode = d_backing_inode(path->dentry);
	struct audit_parent *parent;
	int ret;

	parent = kzalloc(sizeof(*parent), GFP_KERNEL);
	if (unlikely(!parent))
	return ERR_PTR(-ENOMEM);

	INIT_LIST_HEAD(&parent->watches);

	fsnotify_init_mark(&parent->mark, audit_watch_group);
	parent->mark.mask = AUDIT_FS_WATCH;
	ret = fsnotify_add_inode_mark(&parent->mark, inode, 0);
	if (ret < 0) {
	audit_free_parent(parent);
	return ERR_PTR(ret);
	}

	return parent;
	}

	/* Initialize a watch entry. */
	static struct audit_watch audit_init_watch(char path)
	{
	struct audit_watch *watch;

	watch = kzalloc(sizeof(*watch), GFP_KERNEL);
	if (unlikely(!watch))
	return ERR_PTR(-ENOMEM);

	INIT_LIST_HEAD(&watch->rules);
	refcount_set(&watch->count, 1);
	watch->path = path;
	watch->dev = AUDIT_DEV_UNSET;
	watch->ino = AUDIT_INO_UNSET;

	return watch;
	}

	/* Translate a watch string to kernel representation. */
	int audit_to_watch(struct audit_krule krule, char path, int len, u32 op)
	{
	struct audit_watch *watch;

	if (!audit_watch_group)
	return -EOPNOTSUPP;

	if (path[0] != '/' \|\| path[len-1] == '/' \|\|
	krule->listnr != AUDIT_FILTER_EXIT \|\|
	op != Audit_equal \|\|
	krule->inode_f \|\| krule->watch \|\| krule->tree)
	return -EINVAL;

	watch = audit_init_watch(path);
	if (IS_ERR(watch))
	return PTR_ERR(watch);

	krule->watch = watch;

	return 0;
	}

	/* Duplicate the given audit watch. The new watch's rules list is initialized
	* to an empty list and wlist is undefined. */
	static struct audit_watch audit_dupe_watch(struct audit_watch old)
	{
	char *path;
	struct audit_watch *new;

	path = kstrdup(old->path, GFP_KERNEL);
	if (unlikely(!path))
	return ERR_PTR(-ENOMEM);

	new = audit_init_watch(path);
	if (IS_ERR(new)) {
	kfree(path);
	goto out;
	}

	new->dev = old->dev;
	new->ino = old->ino;
	audit_get_parent(old->parent);
	new->parent = old->parent;

	out:
	return new;
	}

	static void audit_watch_log_rule_change(struct audit_krule r, struct audit_watch w, char *op)
	{
	struct audit_buffer *ab;

	if (!audit_enabled)
	return;
	ab = audit_log_start(audit_context(), GFP_NOFS, AUDIT_CONFIG_CHANGE);
	if (!ab)
	return;
	audit_log_session_info(ab);
	audit_log_format(ab, "op=%s path=", op);
	audit_log_untrustedstring(ab, w->path);
	audit_log_key(ab, r->filterkey);
	audit_log_format(ab, " list=%d res=1", r->listnr);
	audit_log_end(ab);
	}

	/* Update inode info in audit rules based on filesystem event. */
	static void audit_update_watch(struct audit_parent *parent,
	const struct qstr *dname, dev_t dev,
	unsigned long ino, unsigned invalidating)
	{
	struct audit_watch owatch, nwatch, *nextw;
	struct audit_krule r, nextr;
	struct audit_entry oentry, nentry;

	mutex_lock(&audit_filter_mutex);
	/* Run all of the watches on this parent looking for the one that
	* matches the given dname */
	list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
	if (audit_compare_dname_path(dname, owatch->path,
	AUDIT_NAME_FULL))
	continue;

	/* If the update involves invalidating rules, do the inode-based
	* filtering now, so we don't omit records. */
	if (invalidating && !audit_dummy_context())
	audit_filter_inodes(current, audit_context());

	/* updating ino will likely change which audit_hash_list we
	* are on so we need a new watch for the new list */
	nwatch = audit_dupe_watch(owatch);
	if (IS_ERR(nwatch)) {
	mutex_unlock(&audit_filter_mutex);
	audit_panic("error updating watch, skipping");
	return;
	}
	nwatch->dev = dev;
	nwatch->ino = ino;

	list_for_each_entry_safe(r, nextr, &owatch->rules, rlist) {

	oentry = container_of(r, struct audit_entry, rule);
	list_del(&oentry->rule.rlist);
	list_del_rcu(&oentry->list);

	nentry = audit_dupe_rule(&oentry->rule);
	if (IS_ERR(nentry)) {
	list_del(&oentry->rule.list);
	audit_panic("error updating watch, removing");
	} else {
	int h = audit_hash_ino((u32)ino);

	/*
	* nentry->rule.watch == oentry->rule.watch so
	* we must drop that reference and set it to our
	* new watch.
	*/
	audit_put_watch(nentry->rule.watch);
	audit_get_watch(nwatch);
	nentry->rule.watch = nwatch;
	list_add(&nentry->rule.rlist, &nwatch->rules);
	list_add_rcu(&nentry->list, &audit_inode_hash[h]);
	list_replace(&oentry->rule.list,
	&nentry->rule.list);
	}
	if (oentry->rule.exe)
	audit_remove_mark(oentry->rule.exe);

	call_rcu(&oentry->rcu, audit_free_rule_rcu);
	}

	audit_remove_watch(owatch);
	goto add_watch_to_parent; /* event applies to a single watch */
	}
	mutex_unlock(&audit_filter_mutex);
	return;

	add_watch_to_parent:
	list_add(&nwatch->wlist, &parent->watches);
	mutex_unlock(&audit_filter_mutex);
	return;
	}

	/* Remove all watches & rules associated with a parent that is going away. */
	static void audit_remove_parent_watches(struct audit_parent *parent)
	{
	struct audit_watch w, nextw;
	struct audit_krule r, nextr;
	struct audit_entry *e;

	mutex_lock(&audit_filter_mutex);
	list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
	list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
	e = container_of(r, struct audit_entry, rule);
	audit_watch_log_rule_change(r, w, "remove_rule");
	if (e->rule.exe)
	audit_remove_mark(e->rule.exe);
	list_del(&r->rlist);
	list_del(&r->list);
	list_del_rcu(&e->list);
	call_rcu(&e->rcu, audit_free_rule_rcu);
	}
	audit_remove_watch(w);
	}
	mutex_unlock(&audit_filter_mutex);

	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
	}

	/* Get path information necessary for adding watches. */
	static int audit_get_nd(struct audit_watch watch, struct path parent)
	{
	struct dentry *d = kern_path_locked(watch->path, parent);
	if (IS_ERR(d))
	return PTR_ERR(d);
	if (d_is_positive(d)) {
	/* update watch filter fields */
	watch->dev = d->d_sb->s_dev;
	watch->ino = d_backing_inode(d)->i_ino;
	}
	inode_unlock(d_backing_inode(parent->dentry));
	dput(d);
	return 0;
	}

	/* Associate the given rule with an existing parent.
	* Caller must hold audit_filter_mutex. */
	static void audit_add_to_parent(struct audit_krule *krule,
	struct audit_parent *parent)
	{
	struct audit_watch w, watch = krule->watch;
	int watch_found = 0;

	BUG_ON(!mutex_is_locked(&audit_filter_mutex));

	list_for_each_entry(w, &parent->watches, wlist) {
	if (strcmp(watch->path, w->path))
	continue;

	watch_found = 1;

	/* put krule's ref to temporary watch */
	audit_put_watch(watch);

	audit_get_watch(w);
	krule->watch = watch = w;

	audit_put_parent(parent);
	break;
	}

	if (!watch_found) {
	watch->parent = parent;

	audit_get_watch(watch);
	list_add(&watch->wlist, &parent->watches);
	}
	list_add(&krule->rlist, &watch->rules);
	}

	/* Find a matching watch entry, or add this one.
	* Caller must hold audit_filter_mutex. */
	int audit_add_watch(struct audit_krule krule, struct list_head *list)
	{
	struct audit_watch *watch = krule->watch;
	struct audit_parent *parent;
	struct path parent_path;
	int h, ret = 0;

	/*
	* When we will be calling audit_add_to_parent, krule->watch might have
	* been updated and watch might have been freed.
	* So we need to keep a reference of watch.
	*/
	audit_get_watch(watch);

	mutex_unlock(&audit_filter_mutex);

	/* Avoid calling path_lookup under audit_filter_mutex. */
	ret = audit_get_nd(watch, &parent_path);

	/* caller expects mutex locked */
	mutex_lock(&audit_filter_mutex);

	if (ret) {
	audit_put_watch(watch);
	return ret;
	}

	/* either find an old parent or attach a new one */
	parent = audit_find_parent(d_backing_inode(parent_path.dentry));
	if (!parent) {
	parent = audit_init_parent(&parent_path);
	if (IS_ERR(parent)) {
	ret = PTR_ERR(parent);
	goto error;
	}
	}

	audit_add_to_parent(krule, parent);

	h = audit_hash_ino((u32)watch->ino);
	*list = &audit_inode_hash[h];
	error:
	path_put(&parent_path);
	audit_put_watch(watch);
	return ret;
	}

	void audit_remove_watch_rule(struct audit_krule *krule)
	{
	struct audit_watch *watch = krule->watch;
	struct audit_parent *parent = watch->parent;

	list_del(&krule->rlist);

	if (list_empty(&watch->rules)) {
	/*
	* audit_remove_watch() drops our reference to 'parent' which
	* can get freed. Grab our own reference to be safe.
	*/
	audit_get_parent(parent);
	audit_remove_watch(watch);
	if (list_empty(&parent->watches))
	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
	audit_put_parent(parent);
	}
	}

	/* Update watch data in audit rules based on fsnotify events. */
	static int audit_watch_handle_event(struct fsnotify_group *group,
	struct inode *to_tell,
	u32 mask, const void *data, int data_type,
	const struct qstr *dname, u32 cookie,
	struct fsnotify_iter_info *iter_info)
	{
	struct fsnotify_mark *inode_mark = fsnotify_iter_inode_mark(iter_info);
	const struct inode *inode = fsnotify_data_inode(data, data_type);
	struct audit_parent *parent;

	parent = container_of(inode_mark, struct audit_parent, mark);

	BUG_ON(group != audit_watch_group);
	WARN_ON(!inode);

	if (mask & (FS_CREATE\|FS_MOVED_TO) && inode)
	audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
	else if (mask & (FS_DELETE\|FS_MOVED_FROM))
	audit_update_watch(parent, dname, AUDIT_DEV_UNSET, AUDIT_INO_UNSET, 1);
	else if (mask & (FS_DELETE_SELF\|FS_UNMOUNT\|FS_MOVE_SELF))
	audit_remove_parent_watches(parent);

	return 0;
	}

	static const struct fsnotify_ops audit_watch_fsnotify_ops = {
	.handle_event = audit_watch_handle_event,
	.free_mark = audit_watch_free_mark,
	};

	static int __init audit_watch_init(void)
	{
	audit_watch_group = fsnotify_alloc_group(&audit_watch_fsnotify_ops);
	if (IS_ERR(audit_watch_group)) {
	audit_watch_group = NULL;
	audit_panic("cannot create audit fsnotify group");
	}
	return 0;
	}
	device_initcall(audit_watch_init);

	int audit_dupe_exe(struct audit_krule new, struct audit_krule old)
	{
	struct audit_fsnotify_mark *audit_mark;
	char *pathname;

	pathname = kstrdup(audit_mark_path(old->exe), GFP_KERNEL);
	if (!pathname)
	return -ENOMEM;

	audit_mark = audit_alloc_mark(new, pathname, strlen(pathname));
	if (IS_ERR(audit_mark)) {
	kfree(pathname);
	return PTR_ERR(audit_mark);
	}
	new->exe = audit_mark;

	return 0;
	}

	int audit_exe_compare(struct task_struct tsk, struct audit_fsnotify_mark mark)
	{
	struct file *exe_file;
	unsigned long ino;
	dev_t dev;

	exe_file = get_task_exe_file(tsk);
	if (!exe_file)
	return 0;
	ino = file_inode(exe_file)->i_ino;
	dev = file_inode(exe_file)->i_sb->s_dev;
	fput(exe_file);
	return audit_mark_compare(mark, ino, dev);
	}