blob: 42d99896e7a6ec9969f6b44fd6f3dd06be767aed [file] [log] [blame]
Thomas Gleixner1a59d1b82019-05-27 08:55:05 +02001// SPDX-License-Identifier: GPL-2.0-or-later
David Woodhousefe7752b2005-12-15 18:33:52 +00002/* auditfilter.c -- filtering of audit events
3 *
4 * Copyright 2003-2004 Red Hat, Inc.
5 * Copyright 2005 Hewlett-Packard Development Company, L.P.
6 * Copyright 2005 IBM Corporation
David Woodhousefe7752b2005-12-15 18:33:52 +00007 */
8
Richard Guy Briggsf952d102014-01-27 17:38:42 -05009#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
10
David Woodhousefe7752b2005-12-15 18:33:52 +000011#include <linux/kernel.h>
12#include <linux/audit.h>
13#include <linux/kthread.h>
Amy Griffisf368c07d2006-04-07 16:55:56 -040014#include <linux/mutex.h>
15#include <linux/fs.h>
16#include <linux/namei.h>
David Woodhousefe7752b2005-12-15 18:33:52 +000017#include <linux/netlink.h>
Amy Griffisf368c07d2006-04-07 16:55:56 -040018#include <linux/sched.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090019#include <linux/slab.h>
Ahmed S. Darwish2a862b32008-03-01 21:54:38 +020020#include <linux/security.h>
Eric W. Biederman48095d92014-02-03 17:25:33 -080021#include <net/net_namespace.h>
Eric W. Biederman6f285b12014-02-28 19:44:55 -080022#include <net/sock.h>
David Woodhousefe7752b2005-12-15 18:33:52 +000023#include "audit.h"
24
Amy Griffisf368c07d2006-04-07 16:55:56 -040025/*
26 * Locking model:
27 *
28 * audit_filter_mutex:
Scott Matheina725131e2015-11-04 08:23:51 -050029 * Synchronizes writes and blocking reads of audit's filterlist
30 * data. Rcu is used to traverse the filterlist and access
31 * contents of structs audit_entry, audit_watch and opaque
32 * LSM rules during filtering. If modified, these structures
33 * must be copied and replace their counterparts in the filterlist.
34 * An audit_parent struct is not accessed during filtering, so may
35 * be written directly provided audit_filter_mutex is held.
Amy Griffisf368c07d2006-04-07 16:55:56 -040036 */
37
Amy Griffisf368c07d2006-04-07 16:55:56 -040038/* Audit filter lists, defined in <linux/audit.h> */
David Woodhousefe7752b2005-12-15 18:33:52 +000039struct list_head audit_filter_list[AUDIT_NR_FILTERS] = {
40 LIST_HEAD_INIT(audit_filter_list[0]),
41 LIST_HEAD_INIT(audit_filter_list[1]),
42 LIST_HEAD_INIT(audit_filter_list[2]),
43 LIST_HEAD_INIT(audit_filter_list[3]),
44 LIST_HEAD_INIT(audit_filter_list[4]),
45 LIST_HEAD_INIT(audit_filter_list[5]),
Richard Guy Briggs42d5e372017-08-23 07:03:39 -040046 LIST_HEAD_INIT(audit_filter_list[6]),
Paul Moore67daf272021-04-18 21:54:47 -040047 LIST_HEAD_INIT(audit_filter_list[7]),
48#if AUDIT_NR_FILTERS != 8
David Woodhousefe7752b2005-12-15 18:33:52 +000049#error Fix audit_filter_list initialiser
50#endif
51};
Al Viroe45aa212008-12-15 01:17:50 -050052static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = {
53 LIST_HEAD_INIT(audit_rules_list[0]),
54 LIST_HEAD_INIT(audit_rules_list[1]),
55 LIST_HEAD_INIT(audit_rules_list[2]),
56 LIST_HEAD_INIT(audit_rules_list[3]),
57 LIST_HEAD_INIT(audit_rules_list[4]),
58 LIST_HEAD_INIT(audit_rules_list[5]),
Richard Guy Briggs42d5e372017-08-23 07:03:39 -040059 LIST_HEAD_INIT(audit_rules_list[6]),
Paul Moore67daf272021-04-18 21:54:47 -040060 LIST_HEAD_INIT(audit_rules_list[7]),
Al Viroe45aa212008-12-15 01:17:50 -050061};
David Woodhousefe7752b2005-12-15 18:33:52 +000062
Al Viro74c3cbe2007-07-22 08:04:18 -040063DEFINE_MUTEX(audit_filter_mutex);
Amy Griffisf368c07d2006-04-07 16:55:56 -040064
Richard Guy Briggs219ca392014-03-26 07:26:47 -040065static void audit_free_lsm_field(struct audit_field *f)
66{
67 switch (f->type) {
68 case AUDIT_SUBJ_USER:
69 case AUDIT_SUBJ_ROLE:
70 case AUDIT_SUBJ_TYPE:
71 case AUDIT_SUBJ_SEN:
72 case AUDIT_SUBJ_CLR:
73 case AUDIT_OBJ_USER:
74 case AUDIT_OBJ_ROLE:
75 case AUDIT_OBJ_TYPE:
76 case AUDIT_OBJ_LEV_LOW:
77 case AUDIT_OBJ_LEV_HIGH:
78 kfree(f->lsm_str);
79 security_audit_rule_free(f->lsm_rule);
80 }
81}
82
Amy Griffis93315ed2006-02-07 12:05:27 -050083static inline void audit_free_rule(struct audit_entry *e)
David Woodhousefe7752b2005-12-15 18:33:52 +000084{
Darrel Goeddel3dc7e312006-03-10 18:14:06 -060085 int i;
Zhenwen Xuc28bb7d2009-03-12 22:16:12 +080086 struct audit_krule *erule = &e->rule;
Eric Parisae7b8f42009-12-17 20:12:04 -050087
Amy Griffisf368c07d2006-04-07 16:55:56 -040088 /* some rules don't have associated watches */
Zhenwen Xuc28bb7d2009-03-12 22:16:12 +080089 if (erule->watch)
90 audit_put_watch(erule->watch);
91 if (erule->fields)
Richard Guy Briggs219ca392014-03-26 07:26:47 -040092 for (i = 0; i < erule->field_count; i++)
93 audit_free_lsm_field(&erule->fields[i]);
Zhenwen Xuc28bb7d2009-03-12 22:16:12 +080094 kfree(erule->fields);
95 kfree(erule->filterkey);
Amy Griffis93315ed2006-02-07 12:05:27 -050096 kfree(e);
David Woodhousefe7752b2005-12-15 18:33:52 +000097}
98
Al Viro74c3cbe2007-07-22 08:04:18 -040099void audit_free_rule_rcu(struct rcu_head *head)
Amy Griffis93315ed2006-02-07 12:05:27 -0500100{
101 struct audit_entry *e = container_of(head, struct audit_entry, rcu);
102 audit_free_rule(e);
103}
104
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600105/* Initialize an audit filterlist entry. */
106static inline struct audit_entry *audit_init_entry(u32 field_count)
107{
108 struct audit_entry *entry;
109 struct audit_field *fields;
110
111 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
112 if (unlikely(!entry))
113 return NULL;
114
Fabian Frederickbab5e2d2014-08-06 16:03:22 -0700115 fields = kcalloc(field_count, sizeof(*fields), GFP_KERNEL);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600116 if (unlikely(!fields)) {
117 kfree(entry);
118 return NULL;
119 }
120 entry->rule.fields = fields;
121
122 return entry;
123}
124
Amy Griffis93315ed2006-02-07 12:05:27 -0500125/* Unpack a filter field's string representation from user-space
126 * buffer. */
Al Viro74c3cbe2007-07-22 08:04:18 -0400127char *audit_unpack_string(void **bufp, size_t *remain, size_t len)
Amy Griffis93315ed2006-02-07 12:05:27 -0500128{
129 char *str;
130
131 if (!*bufp || (len == 0) || (len > *remain))
132 return ERR_PTR(-EINVAL);
133
134 /* Of the currently implemented string fields, PATH_MAX
135 * defines the longest valid length.
136 */
137 if (len > PATH_MAX)
138 return ERR_PTR(-ENAMETOOLONG);
139
140 str = kmalloc(len + 1, GFP_KERNEL);
141 if (unlikely(!str))
142 return ERR_PTR(-ENOMEM);
143
144 memcpy(str, *bufp, len);
145 str[len] = 0;
146 *bufp += len;
147 *remain -= len;
148
149 return str;
150}
151
Wei Yuanfd976462016-02-06 15:39:47 +0800152/* Translate an inode field to kernel representation. */
Amy Griffisf368c07d2006-04-07 16:55:56 -0400153static inline int audit_to_inode(struct audit_krule *krule,
154 struct audit_field *f)
155{
Paul Moore67daf272021-04-18 21:54:47 -0400156 if ((krule->listnr != AUDIT_FILTER_EXIT &&
157 krule->listnr != AUDIT_FILTER_URING_EXIT) ||
Richard Guy Briggs3639f172014-10-02 22:05:18 -0400158 krule->inode_f || krule->watch || krule->tree ||
Al Viro5af75d82008-12-16 05:59:26 -0500159 (f->op != Audit_equal && f->op != Audit_not_equal))
Amy Griffisf368c07d2006-04-07 16:55:56 -0400160 return -EINVAL;
161
162 krule->inode_f = f;
163 return 0;
164}
165
Al Virob9155432006-07-01 03:56:16 -0400166static __u32 *classes[AUDIT_SYSCALL_CLASSES];
167
168int __init audit_register_class(int class, unsigned *list)
169{
Fabian Frederickbab5e2d2014-08-06 16:03:22 -0700170 __u32 *p = kcalloc(AUDIT_BITMASK_SIZE, sizeof(__u32), GFP_KERNEL);
Al Virob9155432006-07-01 03:56:16 -0400171 if (!p)
172 return -ENOMEM;
173 while (*list != ~0U) {
174 unsigned n = *list++;
175 if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) {
176 kfree(p);
177 return -EINVAL;
178 }
179 p[AUDIT_WORD(n)] |= AUDIT_BIT(n);
180 }
181 if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) {
182 kfree(p);
183 return -EINVAL;
184 }
185 classes[class] = p;
186 return 0;
187}
188
Al Viro55669bf2006-08-31 19:26:40 -0400189int audit_match_class(int class, unsigned syscall)
190{
Klaus Weidnerc926e4f2007-05-16 17:45:42 -0500191 if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32))
Al Viro55669bf2006-08-31 19:26:40 -0400192 return 0;
193 if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class]))
194 return 0;
195 return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall);
196}
197
Al Viro327b9ee2007-05-15 20:37:10 +0100198#ifdef CONFIG_AUDITSYSCALL
Amy Griffise54dc242007-03-29 18:01:04 -0400199static inline int audit_match_class_bits(int class, u32 *mask)
200{
201 int i;
202
203 if (classes[class]) {
204 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
205 if (mask[i] & classes[class][i])
206 return 0;
207 }
208 return 1;
209}
210
211static int audit_match_signal(struct audit_entry *entry)
212{
213 struct audit_field *arch = entry->rule.arch_f;
214
215 if (!arch) {
216 /* When arch is unspecified, we must check both masks on biarch
217 * as syscall number alone is ambiguous. */
218 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
219 entry->rule.mask) &&
220 audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
221 entry->rule.mask));
222 }
223
224 switch(audit_classify_arch(arch->val)) {
225 case 0: /* native */
226 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
227 entry->rule.mask));
228 case 1: /* 32bit on biarch */
229 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
230 entry->rule.mask));
231 default:
232 return 1;
233 }
234}
Al Viro327b9ee2007-05-15 20:37:10 +0100235#endif
Amy Griffise54dc242007-03-29 18:01:04 -0400236
Amy Griffis93315ed2006-02-07 12:05:27 -0500237/* Common user-space to kernel rule translation. */
Eric Paris56c49112014-04-02 15:46:42 -0400238static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule)
Amy Griffis93315ed2006-02-07 12:05:27 -0500239{
240 unsigned listnr;
241 struct audit_entry *entry;
Amy Griffis93315ed2006-02-07 12:05:27 -0500242 int i, err;
243
244 err = -EINVAL;
245 listnr = rule->flags & ~AUDIT_FILTER_PREPEND;
246 switch(listnr) {
247 default:
248 goto exit_err;
Amy Griffis93315ed2006-02-07 12:05:27 -0500249#ifdef CONFIG_AUDITSYSCALL
250 case AUDIT_FILTER_ENTRY:
Richard Guy Briggs5260ecc2018-02-14 21:47:43 -0500251 pr_err("AUDIT_FILTER_ENTRY is deprecated\n");
252 goto exit_err;
Amy Griffis93315ed2006-02-07 12:05:27 -0500253 case AUDIT_FILTER_EXIT:
Paul Moore67daf272021-04-18 21:54:47 -0400254 case AUDIT_FILTER_URING_EXIT:
Amy Griffis93315ed2006-02-07 12:05:27 -0500255 case AUDIT_FILTER_TASK:
256#endif
Eric Paris7ff68e52012-01-03 14:23:07 -0500257 case AUDIT_FILTER_USER:
Richard Guy Briggsd904ac02018-06-05 11:45:07 -0400258 case AUDIT_FILTER_EXCLUDE:
Richard Guy Briggs42d5e372017-08-23 07:03:39 -0400259 case AUDIT_FILTER_FS:
Amy Griffis93315ed2006-02-07 12:05:27 -0500260 ;
261 }
Al Viro014149c2006-05-23 01:36:13 -0400262 if (unlikely(rule->action == AUDIT_POSSIBLE)) {
Richard Guy Briggsf952d102014-01-27 17:38:42 -0500263 pr_err("AUDIT_POSSIBLE is deprecated\n");
Al Viro014149c2006-05-23 01:36:13 -0400264 goto exit_err;
265 }
266 if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS)
Amy Griffis93315ed2006-02-07 12:05:27 -0500267 goto exit_err;
268 if (rule->field_count > AUDIT_MAX_FIELDS)
269 goto exit_err;
270
271 err = -ENOMEM;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600272 entry = audit_init_entry(rule->field_count);
273 if (!entry)
Amy Griffis93315ed2006-02-07 12:05:27 -0500274 goto exit_err;
Amy Griffis93315ed2006-02-07 12:05:27 -0500275
276 entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;
277 entry->rule.listnr = listnr;
278 entry->rule.action = rule->action;
279 entry->rule.field_count = rule->field_count;
Amy Griffis93315ed2006-02-07 12:05:27 -0500280
281 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
282 entry->rule.mask[i] = rule->mask[i];
283
Al Virob9155432006-07-01 03:56:16 -0400284 for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) {
285 int bit = AUDIT_BITMASK_SIZE * 32 - i - 1;
286 __u32 *p = &entry->rule.mask[AUDIT_WORD(bit)];
287 __u32 *class;
288
289 if (!(*p & AUDIT_BIT(bit)))
290 continue;
291 *p &= ~AUDIT_BIT(bit);
292 class = classes[i];
293 if (class) {
294 int j;
295 for (j = 0; j < AUDIT_BITMASK_SIZE; j++)
296 entry->rule.mask[j] |= class[j];
297 }
298 }
299
Amy Griffis93315ed2006-02-07 12:05:27 -0500300 return entry;
301
302exit_err:
303 return ERR_PTR(err);
304}
305
Al Viro5af75d82008-12-16 05:59:26 -0500306static u32 audit_ops[] =
307{
308 [Audit_equal] = AUDIT_EQUAL,
309 [Audit_not_equal] = AUDIT_NOT_EQUAL,
310 [Audit_bitmask] = AUDIT_BIT_MASK,
311 [Audit_bittest] = AUDIT_BIT_TEST,
312 [Audit_lt] = AUDIT_LESS_THAN,
313 [Audit_gt] = AUDIT_GREATER_THAN,
314 [Audit_le] = AUDIT_LESS_THAN_OR_EQUAL,
315 [Audit_ge] = AUDIT_GREATER_THAN_OR_EQUAL,
316};
317
318static u32 audit_to_op(u32 op)
319{
320 u32 n;
321 for (n = Audit_equal; n < Audit_bad && audit_ops[n] != op; n++)
322 ;
323 return n;
324}
325
Eric Parisab61d382013-04-16 17:26:51 -0400326/* check if an audit field is valid */
Eric Paris62062cf2013-04-16 13:08:43 -0400327static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
Amy Griffis93315ed2006-02-07 12:05:27 -0500328{
Richard Guy Briggsecc68902019-05-22 17:51:09 -0400329 switch (f->type) {
Eric Paris62062cf2013-04-16 13:08:43 -0400330 case AUDIT_MSGTYPE:
Richard Guy Briggsd904ac02018-06-05 11:45:07 -0400331 if (entry->rule.listnr != AUDIT_FILTER_EXCLUDE &&
Eric Paris62062cf2013-04-16 13:08:43 -0400332 entry->rule.listnr != AUDIT_FILTER_USER)
333 return -EINVAL;
334 break;
Richard Guy Briggs42d5e372017-08-23 07:03:39 -0400335 case AUDIT_FSTYPE:
336 if (entry->rule.listnr != AUDIT_FILTER_FS)
337 return -EINVAL;
338 break;
Paul Moore67daf272021-04-18 21:54:47 -0400339 case AUDIT_PERM:
340 if (entry->rule.listnr == AUDIT_FILTER_URING_EXIT)
341 return -EINVAL;
342 break;
Richard Guy Briggs42d5e372017-08-23 07:03:39 -0400343 }
344
Richard Guy Briggsecc68902019-05-22 17:51:09 -0400345 switch (entry->rule.listnr) {
Richard Guy Briggs42d5e372017-08-23 07:03:39 -0400346 case AUDIT_FILTER_FS:
347 switch(f->type) {
348 case AUDIT_FSTYPE:
349 case AUDIT_FILTERKEY:
350 break;
351 default:
352 return -EINVAL;
353 }
Nicholas Mc Guireb7a84de2017-05-02 10:16:03 -0400354 }
Amy Griffis93315ed2006-02-07 12:05:27 -0500355
Richard Guy Briggsecc68902019-05-22 17:51:09 -0400356 /* Check for valid field type and op */
357 switch (f->type) {
358 case AUDIT_ARG0:
359 case AUDIT_ARG1:
360 case AUDIT_ARG2:
361 case AUDIT_ARG3:
362 case AUDIT_PERS: /* <uapi/linux/personality.h> */
363 case AUDIT_DEVMINOR:
364 /* all ops are valid */
365 break;
Eric Parisab61d382013-04-16 17:26:51 -0400366 case AUDIT_UID:
367 case AUDIT_EUID:
368 case AUDIT_SUID:
369 case AUDIT_FSUID:
370 case AUDIT_LOGINUID:
371 case AUDIT_OBJ_UID:
372 case AUDIT_GID:
373 case AUDIT_EGID:
374 case AUDIT_SGID:
375 case AUDIT_FSGID:
376 case AUDIT_OBJ_GID:
377 case AUDIT_PID:
Eric Parisab61d382013-04-16 17:26:51 -0400378 case AUDIT_MSGTYPE:
379 case AUDIT_PPID:
380 case AUDIT_DEVMAJOR:
Eric Parisab61d382013-04-16 17:26:51 -0400381 case AUDIT_EXIT:
382 case AUDIT_SUCCESS:
Eric Paris78122032013-09-04 15:01:43 -0400383 case AUDIT_INODE:
Richard Guy Briggs8fae4772016-11-20 16:47:55 -0500384 case AUDIT_SESSIONID:
Richard Guy Briggsecc68902019-05-22 17:51:09 -0400385 case AUDIT_SUBJ_SEN:
386 case AUDIT_SUBJ_CLR:
387 case AUDIT_OBJ_LEV_LOW:
388 case AUDIT_OBJ_LEV_HIGH:
Richard Guy Briggsbf361232019-05-09 20:01:36 -0400389 case AUDIT_SADDR_FAM:
Eric Parisab61d382013-04-16 17:26:51 -0400390 /* bit ops are only useful on syscall args */
391 if (f->op == Audit_bitmask || f->op == Audit_bittest)
392 return -EINVAL;
393 break;
Eric Parisab61d382013-04-16 17:26:51 -0400394 case AUDIT_SUBJ_USER:
395 case AUDIT_SUBJ_ROLE:
396 case AUDIT_SUBJ_TYPE:
Eric Parisab61d382013-04-16 17:26:51 -0400397 case AUDIT_OBJ_USER:
398 case AUDIT_OBJ_ROLE:
399 case AUDIT_OBJ_TYPE:
Eric Parisab61d382013-04-16 17:26:51 -0400400 case AUDIT_WATCH:
401 case AUDIT_DIR:
402 case AUDIT_FILTERKEY:
Eric W. Biederman780a7652013-04-09 02:22:10 -0700403 case AUDIT_LOGINUID_SET:
Eric Parisab61d382013-04-16 17:26:51 -0400404 case AUDIT_ARCH:
Richard Guy Briggs42d5e372017-08-23 07:03:39 -0400405 case AUDIT_FSTYPE:
Richard Guy Briggsecc68902019-05-22 17:51:09 -0400406 case AUDIT_PERM:
407 case AUDIT_FILETYPE:
408 case AUDIT_FIELD_COMPARE:
409 case AUDIT_EXE:
410 /* only equal and not equal valid ops */
Eric Parisab61d382013-04-16 17:26:51 -0400411 if (f->op != Audit_not_equal && f->op != Audit_equal)
412 return -EINVAL;
413 break;
Richard Guy Briggsecc68902019-05-22 17:51:09 -0400414 default:
415 /* field not recognized */
416 return -EINVAL;
417 }
418
419 /* Check for select valid field values */
420 switch (f->type) {
421 case AUDIT_LOGINUID_SET:
422 if ((f->val != 0) && (f->val != 1))
423 return -EINVAL;
424 break;
Eric Parisab61d382013-04-16 17:26:51 -0400425 case AUDIT_PERM:
426 if (f->val & ~15)
427 return -EINVAL;
428 break;
429 case AUDIT_FILETYPE:
430 if (f->val & ~S_IFMT)
431 return -EINVAL;
432 break;
433 case AUDIT_FIELD_COMPARE:
434 if (f->val > AUDIT_MAX_FIELD_COMPARE)
435 return -EINVAL;
436 break;
Richard Guy Briggsbf361232019-05-09 20:01:36 -0400437 case AUDIT_SADDR_FAM:
438 if (f->val >= AF_MAX)
Richard Guy Briggs34d99af52015-08-05 16:29:37 -0400439 return -EINVAL;
Richard Guy Briggs34d99af52015-08-05 16:29:37 -0400440 break;
Richard Guy Briggsecc68902019-05-22 17:51:09 -0400441 default:
Eric Parisab61d382013-04-16 17:26:51 -0400442 break;
Nicholas Mc Guireb7a84de2017-05-02 10:16:03 -0400443 }
Richard Guy Briggsecc68902019-05-22 17:51:09 -0400444
Eric Paris62062cf2013-04-16 13:08:43 -0400445 return 0;
Amy Griffis93315ed2006-02-07 12:05:27 -0500446}
447
Wei Yuanfd976462016-02-06 15:39:47 +0800448/* Translate struct audit_rule_data to kernel's rule representation. */
Amy Griffis93315ed2006-02-07 12:05:27 -0500449static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
450 size_t datasz)
451{
452 int err = 0;
453 struct audit_entry *entry;
454 void *bufp;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600455 size_t remain = datasz - sizeof(struct audit_rule_data);
Amy Griffis93315ed2006-02-07 12:05:27 -0500456 int i;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600457 char *str;
Richard Guy Briggs34d99af52015-08-05 16:29:37 -0400458 struct audit_fsnotify_mark *audit_mark;
Amy Griffis93315ed2006-02-07 12:05:27 -0500459
Eric Paris56c49112014-04-02 15:46:42 -0400460 entry = audit_to_entry_common(data);
Amy Griffis93315ed2006-02-07 12:05:27 -0500461 if (IS_ERR(entry))
462 goto exit_nofree;
463
464 bufp = data->buf;
Amy Griffis93315ed2006-02-07 12:05:27 -0500465 for (i = 0; i < data->field_count; i++) {
466 struct audit_field *f = &entry->rule.fields[i];
Paul Moore2ad3e172020-02-22 20:36:47 -0500467 u32 f_val;
Amy Griffis93315ed2006-02-07 12:05:27 -0500468
469 err = -EINVAL;
Al Viro5af75d82008-12-16 05:59:26 -0500470
471 f->op = audit_to_op(data->fieldflags[i]);
472 if (f->op == Audit_bad)
Amy Griffis93315ed2006-02-07 12:05:27 -0500473 goto exit_free;
474
Amy Griffis93315ed2006-02-07 12:05:27 -0500475 f->type = data->fields[i];
Paul Moore2ad3e172020-02-22 20:36:47 -0500476 f_val = data->values[i];
Eric Paris62062cf2013-04-16 13:08:43 -0400477
Eric W. Biederman780a7652013-04-09 02:22:10 -0700478 /* Support legacy tests for a valid loginuid */
Paul Moore2ad3e172020-02-22 20:36:47 -0500479 if ((f->type == AUDIT_LOGINUID) && (f_val == AUDIT_UID_UNSET)) {
Eric W. Biederman780a7652013-04-09 02:22:10 -0700480 f->type = AUDIT_LOGINUID_SET;
Paul Moore2ad3e172020-02-22 20:36:47 -0500481 f_val = 0;
Richard Guy Briggs041d7b92014-12-23 13:02:04 -0500482 entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;
Richard Guy Briggsf1dc4862013-12-11 13:52:26 -0500483 }
484
Eric Paris62062cf2013-04-16 13:08:43 -0400485 err = audit_field_valid(entry, f);
486 if (err)
487 goto exit_free;
488
489 err = -EINVAL;
Eric Parisab61d382013-04-16 17:26:51 -0400490 switch (f->type) {
Eric W. Biederman780a7652013-04-09 02:22:10 -0700491 case AUDIT_LOGINUID:
Al Viro0a73dcc2006-06-05 08:15:59 -0400492 case AUDIT_UID:
493 case AUDIT_EUID:
494 case AUDIT_SUID:
495 case AUDIT_FSUID:
Eric W. Biedermanca57ec02012-09-11 02:18:08 -0700496 case AUDIT_OBJ_UID:
Paul Moore2ad3e172020-02-22 20:36:47 -0500497 f->uid = make_kuid(current_user_ns(), f_val);
Eric W. Biedermanca57ec02012-09-11 02:18:08 -0700498 if (!uid_valid(f->uid))
499 goto exit_free;
500 break;
Al Viro0a73dcc2006-06-05 08:15:59 -0400501 case AUDIT_GID:
502 case AUDIT_EGID:
503 case AUDIT_SGID:
504 case AUDIT_FSGID:
Eric W. Biedermanca57ec02012-09-11 02:18:08 -0700505 case AUDIT_OBJ_GID:
Paul Moore2ad3e172020-02-22 20:36:47 -0500506 f->gid = make_kgid(current_user_ns(), f_val);
Eric W. Biedermanca57ec02012-09-11 02:18:08 -0700507 if (!gid_valid(f->gid))
508 goto exit_free;
509 break;
Amy Griffise54dc242007-03-29 18:01:04 -0400510 case AUDIT_ARCH:
Paul Moore2ad3e172020-02-22 20:36:47 -0500511 f->val = f_val;
Amy Griffise54dc242007-03-29 18:01:04 -0400512 entry->rule.arch_f = f;
513 break;
Darrel Goeddel3a6b9f82006-06-29 16:56:39 -0500514 case AUDIT_SUBJ_USER:
515 case AUDIT_SUBJ_ROLE:
516 case AUDIT_SUBJ_TYPE:
517 case AUDIT_SUBJ_SEN:
518 case AUDIT_SUBJ_CLR:
Darrel Goeddel6e5a2d12006-06-29 16:57:08 -0500519 case AUDIT_OBJ_USER:
520 case AUDIT_OBJ_ROLE:
521 case AUDIT_OBJ_TYPE:
522 case AUDIT_OBJ_LEV_LOW:
523 case AUDIT_OBJ_LEV_HIGH:
Paul Moore2ad3e172020-02-22 20:36:47 -0500524 str = audit_unpack_string(&bufp, &remain, f_val);
525 if (IS_ERR(str)) {
526 err = PTR_ERR(str);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600527 goto exit_free;
Paul Moore2ad3e172020-02-22 20:36:47 -0500528 }
529 entry->rule.buflen += f_val;
530 f->lsm_str = str;
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +0200531 err = security_audit_rule_init(f->type, f->op, str,
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000532 (void **)&f->lsm_rule);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600533 /* Keep currently invalid fields around in case they
534 * become valid after a policy reload. */
535 if (err == -EINVAL) {
Richard Guy Briggsf952d102014-01-27 17:38:42 -0500536 pr_warn("audit rule for LSM \'%s\' is invalid\n",
537 str);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600538 err = 0;
Paul Moore2ad3e172020-02-22 20:36:47 -0500539 } else if (err)
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600540 goto exit_free;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600541 break;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400542 case AUDIT_WATCH:
Paul Moore2ad3e172020-02-22 20:36:47 -0500543 str = audit_unpack_string(&bufp, &remain, f_val);
544 if (IS_ERR(str)) {
545 err = PTR_ERR(str);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400546 goto exit_free;
Paul Moore2ad3e172020-02-22 20:36:47 -0500547 }
548 err = audit_to_watch(&entry->rule, str, f_val, f->op);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400549 if (err) {
550 kfree(str);
551 goto exit_free;
552 }
Paul Moore2ad3e172020-02-22 20:36:47 -0500553 entry->rule.buflen += f_val;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400554 break;
Al Viro74c3cbe2007-07-22 08:04:18 -0400555 case AUDIT_DIR:
Paul Moore2ad3e172020-02-22 20:36:47 -0500556 str = audit_unpack_string(&bufp, &remain, f_val);
557 if (IS_ERR(str)) {
558 err = PTR_ERR(str);
Al Viro74c3cbe2007-07-22 08:04:18 -0400559 goto exit_free;
Paul Moore2ad3e172020-02-22 20:36:47 -0500560 }
Al Viro74c3cbe2007-07-22 08:04:18 -0400561 err = audit_make_tree(&entry->rule, str, f->op);
562 kfree(str);
563 if (err)
564 goto exit_free;
Paul Moore2ad3e172020-02-22 20:36:47 -0500565 entry->rule.buflen += f_val;
Al Viro74c3cbe2007-07-22 08:04:18 -0400566 break;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400567 case AUDIT_INODE:
Paul Moore2ad3e172020-02-22 20:36:47 -0500568 f->val = f_val;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400569 err = audit_to_inode(&entry->rule, f);
570 if (err)
571 goto exit_free;
572 break;
Amy Griffis5adc8a62006-06-14 18:45:21 -0400573 case AUDIT_FILTERKEY:
Paul Moore2ad3e172020-02-22 20:36:47 -0500574 if (entry->rule.filterkey || f_val > AUDIT_MAX_KEY_LEN)
Amy Griffis5adc8a62006-06-14 18:45:21 -0400575 goto exit_free;
Paul Moore2ad3e172020-02-22 20:36:47 -0500576 str = audit_unpack_string(&bufp, &remain, f_val);
Richard Guy Briggs34d99af52015-08-05 16:29:37 -0400577 if (IS_ERR(str)) {
578 err = PTR_ERR(str);
579 goto exit_free;
580 }
Paul Moore2ad3e172020-02-22 20:36:47 -0500581 entry->rule.buflen += f_val;
582 entry->rule.filterkey = str;
583 break;
584 case AUDIT_EXE:
585 if (entry->rule.exe || f_val > PATH_MAX)
586 goto exit_free;
587 str = audit_unpack_string(&bufp, &remain, f_val);
588 if (IS_ERR(str)) {
589 err = PTR_ERR(str);
590 goto exit_free;
591 }
592 audit_mark = audit_alloc_mark(&entry->rule, str, f_val);
Richard Guy Briggs34d99af52015-08-05 16:29:37 -0400593 if (IS_ERR(audit_mark)) {
594 kfree(str);
595 err = PTR_ERR(audit_mark);
596 goto exit_free;
597 }
Paul Moore2ad3e172020-02-22 20:36:47 -0500598 entry->rule.buflen += f_val;
Richard Guy Briggs34d99af52015-08-05 16:29:37 -0400599 entry->rule.exe = audit_mark;
600 break;
Paul Moore2ad3e172020-02-22 20:36:47 -0500601 default:
602 f->val = f_val;
603 break;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400604 }
605 }
606
Al Viro5af75d82008-12-16 05:59:26 -0500607 if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)
608 entry->rule.inode_f = NULL;
Amy Griffis93315ed2006-02-07 12:05:27 -0500609
610exit_nofree:
611 return entry;
612
613exit_free:
Chen Gang373e0f32013-04-29 15:05:18 -0700614 if (entry->rule.tree)
615 audit_put_tree(entry->rule.tree); /* that's the temporary one */
Richard Guy Briggs34d99af52015-08-05 16:29:37 -0400616 if (entry->rule.exe)
617 audit_remove_mark(entry->rule.exe); /* that's the template one */
Amy Griffis93315ed2006-02-07 12:05:27 -0500618 audit_free_rule(entry);
619 return ERR_PTR(err);
620}
621
622/* Pack a filter field's string representation into data block. */
Al Viro74c3cbe2007-07-22 08:04:18 -0400623static inline size_t audit_pack_string(void **bufp, const char *str)
Amy Griffis93315ed2006-02-07 12:05:27 -0500624{
625 size_t len = strlen(str);
626
627 memcpy(*bufp, str, len);
628 *bufp += len;
629
630 return len;
631}
632
Wei Yuanfd976462016-02-06 15:39:47 +0800633/* Translate kernel rule representation to struct audit_rule_data. */
Amy Griffis93315ed2006-02-07 12:05:27 -0500634static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
635{
636 struct audit_rule_data *data;
637 void *bufp;
638 int i;
639
Xiu Jianfengbc6e60a2021-12-14 19:48:54 +0800640 data = kmalloc(struct_size(data, buf, krule->buflen), GFP_KERNEL);
Amy Griffis93315ed2006-02-07 12:05:27 -0500641 if (unlikely(!data))
Amy Griffis0a3b4832006-05-02 15:06:01 -0400642 return NULL;
Amy Griffis93315ed2006-02-07 12:05:27 -0500643 memset(data, 0, sizeof(*data));
644
645 data->flags = krule->flags | krule->listnr;
646 data->action = krule->action;
647 data->field_count = krule->field_count;
648 bufp = data->buf;
649 for (i = 0; i < data->field_count; i++) {
650 struct audit_field *f = &krule->fields[i];
651
652 data->fields[i] = f->type;
Al Viro5af75d82008-12-16 05:59:26 -0500653 data->fieldflags[i] = audit_ops[f->op];
Amy Griffis93315ed2006-02-07 12:05:27 -0500654 switch(f->type) {
Darrel Goeddel3a6b9f82006-06-29 16:56:39 -0500655 case AUDIT_SUBJ_USER:
656 case AUDIT_SUBJ_ROLE:
657 case AUDIT_SUBJ_TYPE:
658 case AUDIT_SUBJ_SEN:
659 case AUDIT_SUBJ_CLR:
Darrel Goeddel6e5a2d12006-06-29 16:57:08 -0500660 case AUDIT_OBJ_USER:
661 case AUDIT_OBJ_ROLE:
662 case AUDIT_OBJ_TYPE:
663 case AUDIT_OBJ_LEV_LOW:
664 case AUDIT_OBJ_LEV_HIGH:
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600665 data->buflen += data->values[i] =
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000666 audit_pack_string(&bufp, f->lsm_str);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600667 break;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400668 case AUDIT_WATCH:
669 data->buflen += data->values[i] =
Eric Pariscfcad622009-06-11 14:31:36 -0400670 audit_pack_string(&bufp,
671 audit_watch_path(krule->watch));
Amy Griffisf368c07d2006-04-07 16:55:56 -0400672 break;
Al Viro74c3cbe2007-07-22 08:04:18 -0400673 case AUDIT_DIR:
674 data->buflen += data->values[i] =
675 audit_pack_string(&bufp,
676 audit_tree_path(krule->tree));
677 break;
Amy Griffis5adc8a62006-06-14 18:45:21 -0400678 case AUDIT_FILTERKEY:
679 data->buflen += data->values[i] =
680 audit_pack_string(&bufp, krule->filterkey);
681 break;
Richard Guy Briggs34d99af52015-08-05 16:29:37 -0400682 case AUDIT_EXE:
683 data->buflen += data->values[i] =
684 audit_pack_string(&bufp, audit_mark_path(krule->exe));
685 break;
Richard Guy Briggs041d7b92014-12-23 13:02:04 -0500686 case AUDIT_LOGINUID_SET:
687 if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {
688 data->fields[i] = AUDIT_LOGINUID;
689 data->values[i] = AUDIT_UID_UNSET;
690 break;
691 }
Gustavo A. R. Silvadf561f662020-08-23 17:36:59 -0500692 fallthrough; /* if set */
Amy Griffis93315ed2006-02-07 12:05:27 -0500693 default:
694 data->values[i] = f->val;
695 }
696 }
697 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i];
698
699 return data;
700}
701
702/* Compare two rules in kernel format. Considered success if rules
703 * don't match. */
704static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
David Woodhousefe7752b2005-12-15 18:33:52 +0000705{
706 int i;
707
Amy Griffis93315ed2006-02-07 12:05:27 -0500708 if (a->flags != b->flags ||
Richard Guy Briggs041d7b92014-12-23 13:02:04 -0500709 a->pflags != b->pflags ||
Amy Griffis93315ed2006-02-07 12:05:27 -0500710 a->listnr != b->listnr ||
711 a->action != b->action ||
712 a->field_count != b->field_count)
David Woodhousefe7752b2005-12-15 18:33:52 +0000713 return 1;
714
715 for (i = 0; i < a->field_count; i++) {
Amy Griffis93315ed2006-02-07 12:05:27 -0500716 if (a->fields[i].type != b->fields[i].type ||
717 a->fields[i].op != b->fields[i].op)
David Woodhousefe7752b2005-12-15 18:33:52 +0000718 return 1;
Amy Griffis93315ed2006-02-07 12:05:27 -0500719
720 switch(a->fields[i].type) {
Darrel Goeddel3a6b9f82006-06-29 16:56:39 -0500721 case AUDIT_SUBJ_USER:
722 case AUDIT_SUBJ_ROLE:
723 case AUDIT_SUBJ_TYPE:
724 case AUDIT_SUBJ_SEN:
725 case AUDIT_SUBJ_CLR:
Darrel Goeddel6e5a2d12006-06-29 16:57:08 -0500726 case AUDIT_OBJ_USER:
727 case AUDIT_OBJ_ROLE:
728 case AUDIT_OBJ_TYPE:
729 case AUDIT_OBJ_LEV_LOW:
730 case AUDIT_OBJ_LEV_HIGH:
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000731 if (strcmp(a->fields[i].lsm_str, b->fields[i].lsm_str))
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600732 return 1;
733 break;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400734 case AUDIT_WATCH:
Eric Pariscfcad622009-06-11 14:31:36 -0400735 if (strcmp(audit_watch_path(a->watch),
736 audit_watch_path(b->watch)))
Amy Griffisf368c07d2006-04-07 16:55:56 -0400737 return 1;
738 break;
Al Viro74c3cbe2007-07-22 08:04:18 -0400739 case AUDIT_DIR:
740 if (strcmp(audit_tree_path(a->tree),
741 audit_tree_path(b->tree)))
742 return 1;
743 break;
Amy Griffis5adc8a62006-06-14 18:45:21 -0400744 case AUDIT_FILTERKEY:
745 /* both filterkeys exist based on above type compare */
746 if (strcmp(a->filterkey, b->filterkey))
747 return 1;
748 break;
Richard Guy Briggs34d99af52015-08-05 16:29:37 -0400749 case AUDIT_EXE:
750 /* both paths exist based on above type compare */
751 if (strcmp(audit_mark_path(a->exe),
752 audit_mark_path(b->exe)))
753 return 1;
754 break;
Eric W. Biedermanca57ec02012-09-11 02:18:08 -0700755 case AUDIT_UID:
756 case AUDIT_EUID:
757 case AUDIT_SUID:
758 case AUDIT_FSUID:
759 case AUDIT_LOGINUID:
760 case AUDIT_OBJ_UID:
761 if (!uid_eq(a->fields[i].uid, b->fields[i].uid))
762 return 1;
763 break;
764 case AUDIT_GID:
765 case AUDIT_EGID:
766 case AUDIT_SGID:
767 case AUDIT_FSGID:
768 case AUDIT_OBJ_GID:
769 if (!gid_eq(a->fields[i].gid, b->fields[i].gid))
770 return 1;
771 break;
Amy Griffis93315ed2006-02-07 12:05:27 -0500772 default:
773 if (a->fields[i].val != b->fields[i].val)
774 return 1;
775 }
David Woodhousefe7752b2005-12-15 18:33:52 +0000776 }
777
778 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
779 if (a->mask[i] != b->mask[i])
780 return 1;
781
782 return 0;
783}
784
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000785/* Duplicate LSM field information. The lsm_rule is opaque, so must be
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600786 * re-initialized. */
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +0200787static inline int audit_dupe_lsm_field(struct audit_field *df,
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600788 struct audit_field *sf)
789{
790 int ret = 0;
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000791 char *lsm_str;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600792
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000793 /* our own copy of lsm_str */
794 lsm_str = kstrdup(sf->lsm_str, GFP_KERNEL);
795 if (unlikely(!lsm_str))
Akinobu Mita3e1fbd12006-12-22 01:10:02 -0800796 return -ENOMEM;
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000797 df->lsm_str = lsm_str;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600798
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000799 /* our own (refreshed) copy of lsm_rule */
800 ret = security_audit_rule_init(df->type, df->op, df->lsm_str,
801 (void **)&df->lsm_rule);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600802 /* Keep currently invalid fields around in case they
803 * become valid after a policy reload. */
804 if (ret == -EINVAL) {
Richard Guy Briggsf952d102014-01-27 17:38:42 -0500805 pr_warn("audit rule for LSM \'%s\' is invalid\n",
806 df->lsm_str);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600807 ret = 0;
808 }
809
810 return ret;
811}
812
813/* Duplicate an audit rule. This will be a deep copy with the exception
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +0200814 * of the watch - that pointer is carried over. The LSM specific fields
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600815 * will be updated in the copy. The point is to be able to replace the old
Amy Griffisf368c07d2006-04-07 16:55:56 -0400816 * rule with the new rule in the filterlist, then free the old rule.
817 * The rlist element is undefined; list manipulations are handled apart from
818 * the initial copy. */
Eric Parisae7b8f42009-12-17 20:12:04 -0500819struct audit_entry *audit_dupe_rule(struct audit_krule *old)
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600820{
821 u32 fcount = old->field_count;
822 struct audit_entry *entry;
823 struct audit_krule *new;
Amy Griffis5adc8a62006-06-14 18:45:21 -0400824 char *fk;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600825 int i, err = 0;
826
827 entry = audit_init_entry(fcount);
828 if (unlikely(!entry))
829 return ERR_PTR(-ENOMEM);
830
831 new = &entry->rule;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600832 new->flags = old->flags;
Richard Guy Briggs041d7b92014-12-23 13:02:04 -0500833 new->pflags = old->pflags;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600834 new->listnr = old->listnr;
835 new->action = old->action;
836 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
837 new->mask[i] = old->mask[i];
Al Viro0590b932008-12-14 23:45:27 -0500838 new->prio = old->prio;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600839 new->buflen = old->buflen;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400840 new->inode_f = old->inode_f;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600841 new->field_count = old->field_count;
Eric Parisae7b8f42009-12-17 20:12:04 -0500842
Al Viro74c3cbe2007-07-22 08:04:18 -0400843 /*
844 * note that we are OK with not refcounting here; audit_match_tree()
845 * never dereferences tree and we can't get false positives there
846 * since we'd have to have rule gone from the list *and* removed
847 * before the chunks found by lookup had been allocated, i.e. before
848 * the beginning of list scan.
849 */
850 new->tree = old->tree;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600851 memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount);
852
Ahmed S. Darwish04305e42008-04-19 09:59:43 +1000853 /* deep copy this information, updating the lsm_rule fields, because
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600854 * the originals will all be freed when the old rule is freed. */
855 for (i = 0; i < fcount; i++) {
856 switch (new->fields[i].type) {
Darrel Goeddel3a6b9f82006-06-29 16:56:39 -0500857 case AUDIT_SUBJ_USER:
858 case AUDIT_SUBJ_ROLE:
859 case AUDIT_SUBJ_TYPE:
860 case AUDIT_SUBJ_SEN:
861 case AUDIT_SUBJ_CLR:
Darrel Goeddel6e5a2d12006-06-29 16:57:08 -0500862 case AUDIT_OBJ_USER:
863 case AUDIT_OBJ_ROLE:
864 case AUDIT_OBJ_TYPE:
865 case AUDIT_OBJ_LEV_LOW:
866 case AUDIT_OBJ_LEV_HIGH:
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +0200867 err = audit_dupe_lsm_field(&new->fields[i],
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600868 &old->fields[i]);
Amy Griffis5adc8a62006-06-14 18:45:21 -0400869 break;
870 case AUDIT_FILTERKEY:
871 fk = kstrdup(old->filterkey, GFP_KERNEL);
872 if (unlikely(!fk))
873 err = -ENOMEM;
874 else
875 new->filterkey = fk;
Richard Guy Briggs34d99af52015-08-05 16:29:37 -0400876 break;
877 case AUDIT_EXE:
878 err = audit_dupe_exe(new, old);
879 break;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600880 }
881 if (err) {
Richard Guy Briggs34d99af52015-08-05 16:29:37 -0400882 if (new->exe)
883 audit_remove_mark(new->exe);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600884 audit_free_rule(entry);
885 return ERR_PTR(err);
886 }
887 }
888
Eric Parisae7b8f42009-12-17 20:12:04 -0500889 if (old->watch) {
890 audit_get_watch(old->watch);
891 new->watch = old->watch;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400892 }
893
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600894 return entry;
895}
896
Amy Griffisf368c07d2006-04-07 16:55:56 -0400897/* Find an existing audit rule.
898 * Caller must hold audit_filter_mutex to prevent stale rule data. */
899static struct audit_entry *audit_find_rule(struct audit_entry *entry,
Al Viro36c4f1b12008-12-15 01:50:28 -0500900 struct list_head **p)
Amy Griffisf368c07d2006-04-07 16:55:56 -0400901{
902 struct audit_entry *e, *found = NULL;
Al Viro36c4f1b12008-12-15 01:50:28 -0500903 struct list_head *list;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400904 int h;
905
Al Viro36c4f1b12008-12-15 01:50:28 -0500906 if (entry->rule.inode_f) {
907 h = audit_hash_ino(entry->rule.inode_f->val);
908 *p = list = &audit_inode_hash[h];
909 } else if (entry->rule.watch) {
Amy Griffisf368c07d2006-04-07 16:55:56 -0400910 /* we don't know the inode number, so must walk entire hash */
911 for (h = 0; h < AUDIT_INODE_BUCKETS; h++) {
912 list = &audit_inode_hash[h];
913 list_for_each_entry(e, list, list)
914 if (!audit_compare_rule(&entry->rule, &e->rule)) {
915 found = e;
916 goto out;
917 }
918 }
919 goto out;
Al Viro36c4f1b12008-12-15 01:50:28 -0500920 } else {
921 *p = list = &audit_filter_list[entry->rule.listnr];
Amy Griffisf368c07d2006-04-07 16:55:56 -0400922 }
923
924 list_for_each_entry(e, list, list)
925 if (!audit_compare_rule(&entry->rule, &e->rule)) {
926 found = e;
927 goto out;
928 }
929
930out:
931 return found;
932}
933
Al Viro0590b932008-12-14 23:45:27 -0500934static u64 prio_low = ~0ULL/2;
935static u64 prio_high = ~0ULL/2 - 1;
936
Amy Griffisf368c07d2006-04-07 16:55:56 -0400937/* Add rule to given filterlist if not a duplicate. */
Al Viro36c4f1b12008-12-15 01:50:28 -0500938static inline int audit_add_rule(struct audit_entry *entry)
Amy Griffisf368c07d2006-04-07 16:55:56 -0400939{
940 struct audit_entry *e;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400941 struct audit_watch *watch = entry->rule.watch;
Al Viro74c3cbe2007-07-22 08:04:18 -0400942 struct audit_tree *tree = entry->rule.tree;
Al Viro36c4f1b12008-12-15 01:50:28 -0500943 struct list_head *list;
Paul Mooreae9d2fb2015-08-05 11:19:45 -0400944 int err = 0;
Al Viro471a5c72006-07-10 08:29:24 -0400945#ifdef CONFIG_AUDITSYSCALL
946 int dont_count = 0;
947
Richard Guy Briggs42d5e372017-08-23 07:03:39 -0400948 /* If any of these, don't count towards total */
949 switch(entry->rule.listnr) {
950 case AUDIT_FILTER_USER:
Richard Guy Briggsd904ac02018-06-05 11:45:07 -0400951 case AUDIT_FILTER_EXCLUDE:
Richard Guy Briggs42d5e372017-08-23 07:03:39 -0400952 case AUDIT_FILTER_FS:
Al Viro471a5c72006-07-10 08:29:24 -0400953 dont_count = 1;
Richard Guy Briggs42d5e372017-08-23 07:03:39 -0400954 }
Al Viro471a5c72006-07-10 08:29:24 -0400955#endif
Amy Griffisf368c07d2006-04-07 16:55:56 -0400956
Amy Griffisf368c07d2006-04-07 16:55:56 -0400957 mutex_lock(&audit_filter_mutex);
Al Viro36c4f1b12008-12-15 01:50:28 -0500958 e = audit_find_rule(entry, &list);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400959 if (e) {
Eric Paris35fe4d02009-06-11 14:31:36 -0400960 mutex_unlock(&audit_filter_mutex);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400961 err = -EEXIST;
Al Viro74c3cbe2007-07-22 08:04:18 -0400962 /* normally audit_add_tree_rule() will free it on failure */
963 if (tree)
964 audit_put_tree(tree);
Richard Guy Briggsf8259b22015-08-01 15:41:12 -0400965 return err;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400966 }
967
Amy Griffisf368c07d2006-04-07 16:55:56 -0400968 if (watch) {
969 /* audit_filter_mutex is dropped and re-taken during this call */
Eric Parisae7b8f42009-12-17 20:12:04 -0500970 err = audit_add_watch(&entry->rule, &list);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400971 if (err) {
972 mutex_unlock(&audit_filter_mutex);
Chen Gang2f992ee2013-07-08 15:59:38 -0700973 /*
974 * normally audit_add_tree_rule() will free it
975 * on failure
976 */
977 if (tree)
978 audit_put_tree(tree);
Richard Guy Briggsf8259b22015-08-01 15:41:12 -0400979 return err;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400980 }
David Woodhousefe7752b2005-12-15 18:33:52 +0000981 }
Al Viro74c3cbe2007-07-22 08:04:18 -0400982 if (tree) {
983 err = audit_add_tree_rule(&entry->rule);
984 if (err) {
985 mutex_unlock(&audit_filter_mutex);
Richard Guy Briggsf8259b22015-08-01 15:41:12 -0400986 return err;
Al Viro74c3cbe2007-07-22 08:04:18 -0400987 }
988 }
David Woodhousefe7752b2005-12-15 18:33:52 +0000989
Al Viro0590b932008-12-14 23:45:27 -0500990 entry->rule.prio = ~0ULL;
Paul Moore67daf272021-04-18 21:54:47 -0400991 if (entry->rule.listnr == AUDIT_FILTER_EXIT ||
992 entry->rule.listnr == AUDIT_FILTER_URING_EXIT) {
Al Viro0590b932008-12-14 23:45:27 -0500993 if (entry->rule.flags & AUDIT_FILTER_PREPEND)
994 entry->rule.prio = ++prio_high;
995 else
996 entry->rule.prio = --prio_low;
997 }
998
David Woodhousefe7752b2005-12-15 18:33:52 +0000999 if (entry->rule.flags & AUDIT_FILTER_PREPEND) {
Al Viroe45aa212008-12-15 01:17:50 -05001000 list_add(&entry->rule.list,
1001 &audit_rules_list[entry->rule.listnr]);
David Woodhousefe7752b2005-12-15 18:33:52 +00001002 list_add_rcu(&entry->list, list);
Amy Griffis6a2bcee2006-06-02 13:16:01 -04001003 entry->rule.flags &= ~AUDIT_FILTER_PREPEND;
David Woodhousefe7752b2005-12-15 18:33:52 +00001004 } else {
Al Viroe45aa212008-12-15 01:17:50 -05001005 list_add_tail(&entry->rule.list,
1006 &audit_rules_list[entry->rule.listnr]);
David Woodhousefe7752b2005-12-15 18:33:52 +00001007 list_add_tail_rcu(&entry->list, list);
1008 }
Al Viro471a5c72006-07-10 08:29:24 -04001009#ifdef CONFIG_AUDITSYSCALL
1010 if (!dont_count)
1011 audit_n_rules++;
Amy Griffise54dc242007-03-29 18:01:04 -04001012
1013 if (!audit_match_signal(entry))
1014 audit_signals++;
Al Viro471a5c72006-07-10 08:29:24 -04001015#endif
Amy Griffisf368c07d2006-04-07 16:55:56 -04001016 mutex_unlock(&audit_filter_mutex);
David Woodhousefe7752b2005-12-15 18:33:52 +00001017
Amy Griffisf368c07d2006-04-07 16:55:56 -04001018 return err;
David Woodhousefe7752b2005-12-15 18:33:52 +00001019}
1020
Amy Griffisf368c07d2006-04-07 16:55:56 -04001021/* Remove an existing rule from filterlist. */
Richard Guy Briggs7f492942015-08-05 16:29:36 -04001022int audit_del_rule(struct audit_entry *entry)
David Woodhousefe7752b2005-12-15 18:33:52 +00001023{
1024 struct audit_entry *e;
Al Viro74c3cbe2007-07-22 08:04:18 -04001025 struct audit_tree *tree = entry->rule.tree;
Al Viro36c4f1b12008-12-15 01:50:28 -05001026 struct list_head *list;
Al Viro36c4f1b12008-12-15 01:50:28 -05001027 int ret = 0;
Al Viro471a5c72006-07-10 08:29:24 -04001028#ifdef CONFIG_AUDITSYSCALL
1029 int dont_count = 0;
1030
Richard Guy Briggs42d5e372017-08-23 07:03:39 -04001031 /* If any of these, don't count towards total */
1032 switch(entry->rule.listnr) {
1033 case AUDIT_FILTER_USER:
Richard Guy Briggsd904ac02018-06-05 11:45:07 -04001034 case AUDIT_FILTER_EXCLUDE:
Richard Guy Briggs42d5e372017-08-23 07:03:39 -04001035 case AUDIT_FILTER_FS:
Al Viro471a5c72006-07-10 08:29:24 -04001036 dont_count = 1;
Richard Guy Briggs42d5e372017-08-23 07:03:39 -04001037 }
Al Viro471a5c72006-07-10 08:29:24 -04001038#endif
David Woodhousefe7752b2005-12-15 18:33:52 +00001039
Amy Griffisf368c07d2006-04-07 16:55:56 -04001040 mutex_lock(&audit_filter_mutex);
Al Viro36c4f1b12008-12-15 01:50:28 -05001041 e = audit_find_rule(entry, &list);
Amy Griffisf368c07d2006-04-07 16:55:56 -04001042 if (!e) {
Amy Griffisf368c07d2006-04-07 16:55:56 -04001043 ret = -ENOENT;
1044 goto out;
1045 }
1046
Eric Pariscfcad622009-06-11 14:31:36 -04001047 if (e->rule.watch)
Eric Parisa05fb6c2009-12-17 20:12:05 -05001048 audit_remove_watch_rule(&e->rule);
Amy Griffisf368c07d2006-04-07 16:55:56 -04001049
Al Viro74c3cbe2007-07-22 08:04:18 -04001050 if (e->rule.tree)
1051 audit_remove_tree_rule(&e->rule);
1052
Richard Guy Briggs34d99af52015-08-05 16:29:37 -04001053 if (e->rule.exe)
1054 audit_remove_mark_rule(&e->rule);
1055
Al Viro471a5c72006-07-10 08:29:24 -04001056#ifdef CONFIG_AUDITSYSCALL
1057 if (!dont_count)
1058 audit_n_rules--;
Amy Griffise54dc242007-03-29 18:01:04 -04001059
1060 if (!audit_match_signal(entry))
1061 audit_signals--;
Al Viro471a5c72006-07-10 08:29:24 -04001062#endif
Richard Guy Briggs8c85fc92015-08-05 15:23:09 -04001063
1064 list_del_rcu(&e->list);
1065 list_del(&e->rule.list);
1066 call_rcu(&e->rcu, audit_free_rule_rcu);
Amy Griffisf368c07d2006-04-07 16:55:56 -04001067
Amy Griffisf368c07d2006-04-07 16:55:56 -04001068out:
Richard Guy Briggs8c85fc92015-08-05 15:23:09 -04001069 mutex_unlock(&audit_filter_mutex);
1070
Al Viro74c3cbe2007-07-22 08:04:18 -04001071 if (tree)
1072 audit_put_tree(tree); /* that's the temporary one */
Amy Griffisf368c07d2006-04-07 16:55:56 -04001073
1074 return ret;
David Woodhousefe7752b2005-12-15 18:33:52 +00001075}
1076
Amy Griffis93315ed2006-02-07 12:05:27 -05001077/* List rules using struct audit_rule_data. */
Paul Moore45a06422017-05-02 10:16:05 -04001078static void audit_list_rules(int seq, struct sk_buff_head *q)
Amy Griffis93315ed2006-02-07 12:05:27 -05001079{
Al Viro9044e6b2006-05-22 01:09:24 -04001080 struct sk_buff *skb;
Al Viroe45aa212008-12-15 01:17:50 -05001081 struct audit_krule *r;
Amy Griffis93315ed2006-02-07 12:05:27 -05001082 int i;
1083
Amy Griffisf368c07d2006-04-07 16:55:56 -04001084 /* This is a blocking read, so use audit_filter_mutex instead of rcu
1085 * iterator to sync with list writers. */
Amy Griffis93315ed2006-02-07 12:05:27 -05001086 for (i=0; i<AUDIT_NR_FILTERS; i++) {
Al Viroe45aa212008-12-15 01:17:50 -05001087 list_for_each_entry(r, &audit_rules_list[i], list) {
Amy Griffis93315ed2006-02-07 12:05:27 -05001088 struct audit_rule_data *data;
1089
Al Viroe45aa212008-12-15 01:17:50 -05001090 data = audit_krule_to_data(r);
Amy Griffisf368c07d2006-04-07 16:55:56 -04001091 if (unlikely(!data))
1092 break;
Paul Moore45a06422017-05-02 10:16:05 -04001093 skb = audit_make_reply(seq, AUDIT_LIST_RULES, 0, 1,
1094 data,
Xiu Jianfeng30561b52021-12-17 09:01:51 +08001095 struct_size(data, buf, data->buflen));
Al Viro9044e6b2006-05-22 01:09:24 -04001096 if (skb)
1097 skb_queue_tail(q, skb);
Amy Griffis93315ed2006-02-07 12:05:27 -05001098 kfree(data);
1099 }
1100 }
Paul Moore45a06422017-05-02 10:16:05 -04001101 skb = audit_make_reply(seq, AUDIT_LIST_RULES, 1, 1, NULL, 0);
Al Viro9044e6b2006-05-22 01:09:24 -04001102 if (skb)
1103 skb_queue_tail(q, skb);
Amy Griffis93315ed2006-02-07 12:05:27 -05001104}
1105
Amy Griffis5adc8a62006-06-14 18:45:21 -04001106/* Log rule additions and removals */
Eric Parisdc9eb692013-04-19 13:23:09 -04001107static void audit_log_rule_change(char *action, struct audit_krule *rule, int res)
Amy Griffis5adc8a62006-06-14 18:45:21 -04001108{
1109 struct audit_buffer *ab;
1110
Eric Paris1a6b9f22008-01-07 17:09:31 -05001111 if (!audit_enabled)
1112 return;
1113
Richard Guy Briggs626abcd2019-01-18 17:42:48 -05001114 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONFIG_CHANGE);
Amy Griffis5adc8a62006-06-14 18:45:21 -04001115 if (!ab)
1116 return;
Richard Guy Briggs5c5b8d82018-05-17 22:01:48 -04001117 audit_log_session_info(ab);
Eric Parisb122c372013-04-19 15:00:33 -04001118 audit_log_task_context(ab);
Steve Grubbc1e8f062016-11-16 16:14:33 -05001119 audit_log_format(ab, " op=%s", action);
Eric Paris9d960982009-06-11 14:31:37 -04001120 audit_log_key(ab, rule->filterkey);
Amy Griffis5adc8a62006-06-14 18:45:21 -04001121 audit_log_format(ab, " list=%d res=%d", rule->listnr, res);
1122 audit_log_end(ab);
1123}
1124
David Woodhousefe7752b2005-12-15 18:33:52 +00001125/**
Richard Guy Briggsce0d9f02013-11-20 14:01:53 -05001126 * audit_rule_change - apply all rules to the specified message type
David Woodhousefe7752b2005-12-15 18:33:52 +00001127 * @type: audit message type
David Woodhousefe7752b2005-12-15 18:33:52 +00001128 * @seq: netlink audit message sequence (serial) number
1129 * @data: payload data
Amy Griffis93315ed2006-02-07 12:05:27 -05001130 * @datasz: size of payload data
David Woodhousefe7752b2005-12-15 18:33:52 +00001131 */
Paul Moore45a06422017-05-02 10:16:05 -04001132int audit_rule_change(int type, int seq, void *data, size_t datasz)
David Woodhousefe7752b2005-12-15 18:33:52 +00001133{
Amy Griffis93315ed2006-02-07 12:05:27 -05001134 int err = 0;
1135 struct audit_entry *entry;
David Woodhousefe7752b2005-12-15 18:33:52 +00001136
1137 switch (type) {
Amy Griffis93315ed2006-02-07 12:05:27 -05001138 case AUDIT_ADD_RULE:
Wenwen Wang70c4cf12019-04-19 20:49:29 -05001139 entry = audit_data_to_entry(data, datasz);
1140 if (IS_ERR(entry))
1141 return PTR_ERR(entry);
Al Viro36c4f1b12008-12-15 01:50:28 -05001142 err = audit_add_rule(entry);
Burn Altinge7df61f2014-04-04 16:00:38 +11001143 audit_log_rule_change("add_rule", &entry->rule, !err);
David Woodhousefe7752b2005-12-15 18:33:52 +00001144 break;
Amy Griffis93315ed2006-02-07 12:05:27 -05001145 case AUDIT_DEL_RULE:
Wenwen Wang70c4cf12019-04-19 20:49:29 -05001146 entry = audit_data_to_entry(data, datasz);
1147 if (IS_ERR(entry))
1148 return PTR_ERR(entry);
Al Viro36c4f1b12008-12-15 01:50:28 -05001149 err = audit_del_rule(entry);
Burn Altinge7df61f2014-04-04 16:00:38 +11001150 audit_log_rule_change("remove_rule", &entry->rule, !err);
David Woodhousefe7752b2005-12-15 18:33:52 +00001151 break;
1152 default:
Eric Paris739c9502014-10-10 15:05:21 -04001153 WARN_ON(1);
Wenwen Wang70c4cf12019-04-19 20:49:29 -05001154 return -EINVAL;
David Woodhousefe7752b2005-12-15 18:33:52 +00001155 }
1156
Richard Guy Briggs34d99af52015-08-05 16:29:37 -04001157 if (err || type == AUDIT_DEL_RULE) {
1158 if (entry->rule.exe)
1159 audit_remove_mark(entry->rule.exe);
Richard Guy Briggse85322d2014-10-02 22:05:19 -04001160 audit_free_rule(entry);
Richard Guy Briggs34d99af52015-08-05 16:29:37 -04001161 }
Richard Guy Briggse85322d2014-10-02 22:05:19 -04001162
David Woodhousefe7752b2005-12-15 18:33:52 +00001163 return err;
1164}
1165
Richard Guy Briggsce0d9f02013-11-20 14:01:53 -05001166/**
1167 * audit_list_rules_send - list the audit rules
Eric W. Biedermand211f1772014-03-08 15:31:54 -08001168 * @request_skb: skb of request we are replying to (used to target the reply)
Richard Guy Briggsce0d9f02013-11-20 14:01:53 -05001169 * @seq: netlink audit message sequence (serial) number
1170 */
Eric W. Biederman6f285b12014-02-28 19:44:55 -08001171int audit_list_rules_send(struct sk_buff *request_skb, int seq)
Richard Guy Briggsce0d9f02013-11-20 14:01:53 -05001172{
1173 struct task_struct *tsk;
1174 struct audit_netlink_list *dest;
Richard Guy Briggsce0d9f02013-11-20 14:01:53 -05001175
1176 /* We can't just spew out the rules here because we might fill
1177 * the available socket buffer space and deadlock waiting for
1178 * auditctl to read from it... which isn't ever going to
1179 * happen if we're actually running in the context of auditctl
1180 * trying to _send_ the stuff */
1181
Paul Moore3054d062020-04-21 09:10:56 -04001182 dest = kmalloc(sizeof(*dest), GFP_KERNEL);
Richard Guy Briggsce0d9f02013-11-20 14:01:53 -05001183 if (!dest)
1184 return -ENOMEM;
Paul Moore3054d062020-04-21 09:10:56 -04001185 dest->net = get_net(sock_net(NETLINK_CB(request_skb).sk));
1186 dest->portid = NETLINK_CB(request_skb).portid;
Richard Guy Briggsce0d9f02013-11-20 14:01:53 -05001187 skb_queue_head_init(&dest->q);
1188
1189 mutex_lock(&audit_filter_mutex);
Paul Moore45a06422017-05-02 10:16:05 -04001190 audit_list_rules(seq, &dest->q);
Richard Guy Briggsce0d9f02013-11-20 14:01:53 -05001191 mutex_unlock(&audit_filter_mutex);
1192
Paul Moore3054d062020-04-21 09:10:56 -04001193 tsk = kthread_run(audit_send_list_thread, dest, "audit_send_list");
Richard Guy Briggsce0d9f02013-11-20 14:01:53 -05001194 if (IS_ERR(tsk)) {
1195 skb_queue_purge(&dest->q);
Paul Moore3054d062020-04-21 09:10:56 -04001196 put_net(dest->net);
Richard Guy Briggsce0d9f02013-11-20 14:01:53 -05001197 kfree(dest);
Paul Moore3054d062020-04-21 09:10:56 -04001198 return PTR_ERR(tsk);
Richard Guy Briggsce0d9f02013-11-20 14:01:53 -05001199 }
1200
Paul Moore3054d062020-04-21 09:10:56 -04001201 return 0;
Richard Guy Briggsce0d9f02013-11-20 14:01:53 -05001202}
1203
Al Viro5af75d82008-12-16 05:59:26 -05001204int audit_comparator(u32 left, u32 op, u32 right)
David Woodhousefe7752b2005-12-15 18:33:52 +00001205{
1206 switch (op) {
Al Viro5af75d82008-12-16 05:59:26 -05001207 case Audit_equal:
David Woodhousefe7752b2005-12-15 18:33:52 +00001208 return (left == right);
Al Viro5af75d82008-12-16 05:59:26 -05001209 case Audit_not_equal:
David Woodhousefe7752b2005-12-15 18:33:52 +00001210 return (left != right);
Al Viro5af75d82008-12-16 05:59:26 -05001211 case Audit_lt:
David Woodhousefe7752b2005-12-15 18:33:52 +00001212 return (left < right);
Al Viro5af75d82008-12-16 05:59:26 -05001213 case Audit_le:
David Woodhousefe7752b2005-12-15 18:33:52 +00001214 return (left <= right);
Al Viro5af75d82008-12-16 05:59:26 -05001215 case Audit_gt:
David Woodhousefe7752b2005-12-15 18:33:52 +00001216 return (left > right);
Al Viro5af75d82008-12-16 05:59:26 -05001217 case Audit_ge:
David Woodhousefe7752b2005-12-15 18:33:52 +00001218 return (left >= right);
Al Viro5af75d82008-12-16 05:59:26 -05001219 case Audit_bitmask:
Eric Paris74f23452007-06-04 17:00:14 -04001220 return (left & right);
Al Viro5af75d82008-12-16 05:59:26 -05001221 case Audit_bittest:
Eric Paris74f23452007-06-04 17:00:14 -04001222 return ((left & right) == right);
Al Viro5af75d82008-12-16 05:59:26 -05001223 default:
Al Viro5af75d82008-12-16 05:59:26 -05001224 return 0;
David Woodhousefe7752b2005-12-15 18:33:52 +00001225 }
1226}
1227
Eric W. Biedermanca57ec02012-09-11 02:18:08 -07001228int audit_uid_comparator(kuid_t left, u32 op, kuid_t right)
1229{
1230 switch (op) {
1231 case Audit_equal:
1232 return uid_eq(left, right);
1233 case Audit_not_equal:
1234 return !uid_eq(left, right);
1235 case Audit_lt:
1236 return uid_lt(left, right);
1237 case Audit_le:
1238 return uid_lte(left, right);
1239 case Audit_gt:
1240 return uid_gt(left, right);
1241 case Audit_ge:
1242 return uid_gte(left, right);
1243 case Audit_bitmask:
1244 case Audit_bittest:
1245 default:
Eric W. Biedermanca57ec02012-09-11 02:18:08 -07001246 return 0;
1247 }
1248}
1249
1250int audit_gid_comparator(kgid_t left, u32 op, kgid_t right)
1251{
1252 switch (op) {
1253 case Audit_equal:
1254 return gid_eq(left, right);
1255 case Audit_not_equal:
1256 return !gid_eq(left, right);
1257 case Audit_lt:
1258 return gid_lt(left, right);
1259 case Audit_le:
1260 return gid_lte(left, right);
1261 case Audit_gt:
1262 return gid_gt(left, right);
1263 case Audit_ge:
1264 return gid_gte(left, right);
1265 case Audit_bitmask:
1266 case Audit_bittest:
1267 default:
Eric W. Biedermanca57ec02012-09-11 02:18:08 -07001268 return 0;
1269 }
1270}
1271
Jeff Laytonbfcec702012-10-10 15:25:23 -04001272/**
1273 * parent_len - find the length of the parent portion of a pathname
1274 * @path: pathname of which to determine length
1275 */
1276int parent_len(const char *path)
1277{
1278 int plen;
1279 const char *p;
1280
1281 plen = strlen(path);
1282
1283 if (plen == 0)
1284 return plen;
1285
1286 /* disregard trailing slashes */
1287 p = path + plen - 1;
1288 while ((*p == '/') && (p > path))
1289 p--;
1290
1291 /* walk backward until we find the next slash or hit beginning */
1292 while ((*p != '/') && (p > path))
1293 p--;
1294
1295 /* did we find a slash? Then increment to include it in path */
1296 if (*p == '/')
1297 p++;
1298
1299 return p - path;
1300}
1301
Jeff Laytone3d6b072012-10-10 15:25:25 -04001302/**
1303 * audit_compare_dname_path - compare given dentry name with last component in
1304 * given path. Return of 0 indicates a match.
1305 * @dname: dentry name that we're comparing
1306 * @path: full pathname that we're comparing
1307 * @parentlen: length of the parent if known. Passing in AUDIT_NAME_FULL
1308 * here indicates that we must compute this value.
1309 */
Al Viro795d6732019-04-26 14:11:05 -04001310int audit_compare_dname_path(const struct qstr *dname, const char *path, int parentlen)
Amy Griffisf368c07d2006-04-07 16:55:56 -04001311{
Jeff Laytone3d6b072012-10-10 15:25:25 -04001312 int dlen, pathlen;
Amy Griffisf368c07d2006-04-07 16:55:56 -04001313 const char *p;
David Woodhousefe7752b2005-12-15 18:33:52 +00001314
Al Viro795d6732019-04-26 14:11:05 -04001315 dlen = dname->len;
Eric Paris29e9a342012-10-10 15:25:24 -04001316 pathlen = strlen(path);
1317 if (pathlen < dlen)
Amy Griffisf368c07d2006-04-07 16:55:56 -04001318 return 1;
1319
Jeff Laytone3d6b072012-10-10 15:25:25 -04001320 parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen;
Eric Paris29e9a342012-10-10 15:25:24 -04001321 if (pathlen - parentlen != dlen)
Amy Griffisf368c07d2006-04-07 16:55:56 -04001322 return 1;
Eric Paris29e9a342012-10-10 15:25:24 -04001323
1324 p = path + parentlen;
Amy Griffisf368c07d2006-04-07 16:55:56 -04001325
Al Viro795d6732019-04-26 14:11:05 -04001326 return strncmp(p, dname->name, dlen);
Amy Griffisf368c07d2006-04-07 16:55:56 -04001327}
David Woodhousefe7752b2005-12-15 18:33:52 +00001328
Richard Guy Briggs86b2efb2016-06-24 16:35:46 -04001329int audit_filter(int msgtype, unsigned int listtype)
David Woodhousefe7752b2005-12-15 18:33:52 +00001330{
David Woodhousefe7752b2005-12-15 18:33:52 +00001331 struct audit_entry *e;
Richard Guy Briggs86b2efb2016-06-24 16:35:46 -04001332 int ret = 1; /* Audit by default */
David Woodhousefe7752b2005-12-15 18:33:52 +00001333
1334 rcu_read_lock();
Richard Guy Briggs86b2efb2016-06-24 16:35:46 -04001335 list_for_each_entry_rcu(e, &audit_filter_list[listtype], list) {
1336 int i, result = 0;
1337
1338 for (i = 0; i < e->rule.field_count; i++) {
1339 struct audit_field *f = &e->rule.fields[i];
1340 pid_t pid;
1341 u32 sid;
1342
1343 switch (f->type) {
1344 case AUDIT_PID:
1345 pid = task_pid_nr(current);
1346 result = audit_comparator(pid, f->op, f->val);
1347 break;
1348 case AUDIT_UID:
1349 result = audit_uid_comparator(current_uid(), f->op, f->uid);
1350 break;
1351 case AUDIT_GID:
1352 result = audit_gid_comparator(current_gid(), f->op, f->gid);
1353 break;
1354 case AUDIT_LOGINUID:
1355 result = audit_uid_comparator(audit_get_loginuid(current),
1356 f->op, f->uid);
1357 break;
1358 case AUDIT_LOGINUID_SET:
1359 result = audit_comparator(audit_loginuid_set(current),
1360 f->op, f->val);
1361 break;
1362 case AUDIT_MSGTYPE:
1363 result = audit_comparator(msgtype, f->op, f->val);
1364 break;
1365 case AUDIT_SUBJ_USER:
1366 case AUDIT_SUBJ_ROLE:
1367 case AUDIT_SUBJ_TYPE:
1368 case AUDIT_SUBJ_SEN:
1369 case AUDIT_SUBJ_CLR:
1370 if (f->lsm_rule) {
Paul Moore63269482021-09-29 11:01:21 -04001371 security_current_getsecid_subj(&sid);
Richard Guy Briggs86b2efb2016-06-24 16:35:46 -04001372 result = security_audit_rule_match(sid,
Richard Guy Briggs90462a52019-01-31 11:52:11 -05001373 f->type, f->op, f->lsm_rule);
Richard Guy Briggs86b2efb2016-06-24 16:35:46 -04001374 }
1375 break;
Ondrej Mosnáček29c13722018-05-30 10:45:24 +02001376 case AUDIT_EXE:
1377 result = audit_exe_compare(current, e->rule.exe);
1378 if (f->op == Audit_not_equal)
1379 result = !result;
1380 break;
Richard Guy Briggs86b2efb2016-06-24 16:35:46 -04001381 default:
1382 goto unlock_and_return;
1383 }
1384 if (result < 0) /* error */
1385 goto unlock_and_return;
1386 if (!result)
1387 break;
1388 }
1389 if (result > 0) {
Richard Guy Briggsd904ac02018-06-05 11:45:07 -04001390 if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_EXCLUDE)
David Woodhousefe7752b2005-12-15 18:33:52 +00001391 ret = 0;
1392 break;
1393 }
1394 }
David Woodhousefe7752b2005-12-15 18:33:52 +00001395unlock_and_return:
1396 rcu_read_unlock();
Richard Guy Briggs86b2efb2016-06-24 16:35:46 -04001397 return ret;
David Woodhousefe7752b2005-12-15 18:33:52 +00001398}
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001399
Al Viroe45aa212008-12-15 01:17:50 -05001400static int update_lsm_rule(struct audit_krule *r)
Al Viro1a9d07972008-12-14 12:04:02 -05001401{
Al Viroe45aa212008-12-15 01:17:50 -05001402 struct audit_entry *entry = container_of(r, struct audit_entry, rule);
Al Viro1a9d07972008-12-14 12:04:02 -05001403 struct audit_entry *nentry;
Al Viro1a9d07972008-12-14 12:04:02 -05001404 int err = 0;
1405
Al Viroe45aa212008-12-15 01:17:50 -05001406 if (!security_audit_rule_known(r))
Al Viro1a9d07972008-12-14 12:04:02 -05001407 return 0;
1408
Eric Parisae7b8f42009-12-17 20:12:04 -05001409 nentry = audit_dupe_rule(r);
Richard Guy Briggs34d99af52015-08-05 16:29:37 -04001410 if (entry->rule.exe)
1411 audit_remove_mark(entry->rule.exe);
Al Viro1a9d07972008-12-14 12:04:02 -05001412 if (IS_ERR(nentry)) {
1413 /* save the first error encountered for the
1414 * return value */
1415 err = PTR_ERR(nentry);
1416 audit_panic("error updating LSM filters");
Eric Parisae7b8f42009-12-17 20:12:04 -05001417 if (r->watch)
Al Viroe45aa212008-12-15 01:17:50 -05001418 list_del(&r->rlist);
Al Viro1a9d07972008-12-14 12:04:02 -05001419 list_del_rcu(&entry->list);
Al Viroe45aa212008-12-15 01:17:50 -05001420 list_del(&r->list);
Al Viro1a9d07972008-12-14 12:04:02 -05001421 } else {
Eric Parisae7b8f42009-12-17 20:12:04 -05001422 if (r->watch || r->tree)
Al Viroe45aa212008-12-15 01:17:50 -05001423 list_replace_init(&r->rlist, &nentry->rule.rlist);
Al Viro1a9d07972008-12-14 12:04:02 -05001424 list_replace_rcu(&entry->list, &nentry->list);
Al Viroe45aa212008-12-15 01:17:50 -05001425 list_replace(&r->list, &nentry->rule.list);
Al Viro1a9d07972008-12-14 12:04:02 -05001426 }
1427 call_rcu(&entry->rcu, audit_free_rule_rcu);
1428
1429 return err;
1430}
1431
Ahmed S. Darwish04305e42008-04-19 09:59:43 +10001432/* This function will re-initialize the lsm_rule field of all applicable rules.
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +02001433 * It will traverse the filter lists serarching for rules that contain LSM
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001434 * specific filter fields. When such a rule is found, it is copied, the
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +02001435 * LSM field is re-initialized, and the old rule is replaced with the
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001436 * updated rule. */
Ahmed S. Darwishd7a96f32008-03-01 22:01:11 +02001437int audit_update_lsm_rules(void)
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001438{
Al Viroe45aa212008-12-15 01:17:50 -05001439 struct audit_krule *r, *n;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001440 int i, err = 0;
1441
Amy Griffisf368c07d2006-04-07 16:55:56 -04001442 /* audit_filter_mutex synchronizes the writers */
1443 mutex_lock(&audit_filter_mutex);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001444
1445 for (i = 0; i < AUDIT_NR_FILTERS; i++) {
Al Viroe45aa212008-12-15 01:17:50 -05001446 list_for_each_entry_safe(r, n, &audit_rules_list[i], list) {
1447 int res = update_lsm_rule(r);
Al Viro1a9d07972008-12-14 12:04:02 -05001448 if (!err)
1449 err = res;
1450 }
1451 }
Amy Griffisf368c07d2006-04-07 16:55:56 -04001452 mutex_unlock(&audit_filter_mutex);
Darrel Goeddel3dc7e312006-03-10 18:14:06 -06001453
1454 return err;
1455}