audit: overhaul __audit_inode_child to accomodate retrying

In order to accomodate retrying path-based syscalls, we need to add a new "type" argument to audit_inode_child. This will tell us whether we're looking for a child entry that represents a create or a delete. If we find a parent, don't automatically assume that we need to create a new entry. Instead, use the information we have to try to find an existing entry first. Update it if one is found and create a new one if not.

Jeff Layton committed 14 years ago

Commit 4fa6b5e1 parent e3d6b075 files · +47 −38Browse files

Unified · Split

5 files

fs/btrfs/ioctl.c +1 −1
fs/namei.c +1 −1
include/linux/audit.h +11 −5
include/linux/fsnotify.h +4 −4
kernel/auditsc.c +30 −27

fs/btrfs/ioctl.c+1−1

@@ -638,7 +638,7 @@ static int btrfs_may_delete(struct inode dir,struct dentry victim,int isdir) · 637 unmodified lines
638	return -ENOENT;	638	return -ENOENT;
639		639
640	BUG_ON(victim->d_parent->d_inode != dir);	640	BUG_ON(victim->d_parent->d_inode != dir);
641	audit_inode_child(dir, victim);	641	audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
642		642
643	error = inode_permission(dir, MAY_WRITE \| MAY_EXEC);	643	error = inode_permission(dir, MAY_WRITE \| MAY_EXEC);
644	if (error)	644	if (error)

fs/namei.c+1−1

@@ -2176,7 +2176,7 @@ static int may_delete(struct inode dir,struct dentry victim,int isdir) · 2175 unmodified lines
2176	return -ENOENT;	2176	return -ENOENT;
2177		2177
2178	BUG_ON(victim->d_parent->d_inode != dir);	2178	BUG_ON(victim->d_parent->d_inode != dir);
2179	audit_inode_child(dir, victim);	2179	audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE);
2180		2180
2181	error = inode_permission(dir, MAY_WRITE \| MAY_EXEC);	2181	error = inode_permission(dir, MAY_WRITE \| MAY_EXEC);
2182	if (error)	2182	if (error)

include/linux/audit.h+11−5

 #define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */
 #define	AUDIT_TYPE_NORMAL	1	/* a "normal" audit record */
 #define	AUDIT_TYPE_PARENT	2	/* a parent audit record */
+#define	AUDIT_TYPE_CHILD_DELETE 3	/* a child being deleted */
+#define	AUDIT_TYPE_CHILD_CREATE 4	/* a child being created */
 #ifdef CONFIG_AUDITSYSCALL
 /* These are defined in auditsc.c */
 extern void __audit_inode(const char *name, const struct dentry *dentry,
 				unsigned int parent);
 extern void __audit_inode_child(const struct inode *parent,
-				const struct dentry *dentry);
+				const struct dentry *dentry,
+				const unsigned char type);
 extern void __audit_seccomp(unsigned long syscall, long signr, int code);
 extern void __audit_ptrace(struct task_struct *t);
 		__audit_inode(name, dentry, parent);
 }
 static inline void audit_inode_child(const struct inode *parent,
-				     const struct dentry *dentry) {
+				     const struct dentry *dentry,
+				     const unsigned char type) {
 	if (unlikely(!audit_dummy_context()))
-		__audit_inode_child(parent, dentry);
+		__audit_inode_child(parent, dentry, type);
 }
 void audit_core_dumps(long signr);
 					unsigned int parent)
 { }
 static inline void __audit_inode_child(const struct inode *parent,
-					const struct dentry *dentry)
+					const struct dentry *dentry,
+					const unsigned char type)
 { }
 static inline void audit_inode(const char *name, const struct dentry *dentry,
 				unsigned int parent)
 { }
 static inline void audit_inode_child(const struct inode *parent,
-				     const struct dentry *dentry)
+				     const struct dentry *dentry,
+				     const unsigned char type)
 { }
 static inline void audit_core_dumps(long signr)
 { }

include/linux/fsnotify.h+4−4

@@ -109,7 +109,7 @@ static inline void fsnotify_move(struct inode old_dir, struct inode new_dir, · 108 unmodified lines
109		109
110	if (source)	110	if (source)
111	fsnotify(source, FS_MOVE_SELF, moved->d_inode, FSNOTIFY_EVENT_INODE, NULL, 0);	111	fsnotify(source, FS_MOVE_SELF, moved->d_inode, FSNOTIFY_EVENT_INODE, NULL, 0);
112	audit_inode_child(new_dir, moved);	112	audit_inode_child(new_dir, moved, AUDIT_TYPE_CHILD_CREATE);
113	}	113	}
114		114
115	/*	115	/*
@@ -155,7 +155,7 @@ static inline void fsnotify_inoderemove(struct inode *inode) · 39 unmodified lines
155	*/	155	*/
156	static inline void fsnotify_create(struct inode inode, struct dentry dentry)	156	static inline void fsnotify_create(struct inode inode, struct dentry dentry)
157	{	157	{
158	audit_inode_child(inode, dentry);	158	audit_inode_child(inode, dentry, AUDIT_TYPE_CHILD_CREATE);
159		159
160	fsnotify(inode, FS_CREATE, dentry->d_inode, FSNOTIFY_EVENT_INODE, dentry->d_name.name, 0);	160	fsnotify(inode, FS_CREATE, dentry->d_inode, FSNOTIFY_EVENT_INODE, dentry->d_name.name, 0);
161	}	161	}
@@ -168,7 +168,7 @@ static inline void fsnotify_create(struct inode inode, struct dentry dentry) · 6 unmodified lines
168	static inline void fsnotify_link(struct inode dir, struct inode inode, struct dentry *new_dentry)	168	static inline void fsnotify_link(struct inode dir, struct inode inode, struct dentry *new_dentry)
169	{	169	{
170	fsnotify_link_count(inode);	170	fsnotify_link_count(inode);
171	audit_inode_child(dir, new_dentry);	171	audit_inode_child(dir, new_dentry, AUDIT_TYPE_CHILD_CREATE);
172		172
173	fsnotify(dir, FS_CREATE, inode, FSNOTIFY_EVENT_INODE, new_dentry->d_name.name, 0);	173	fsnotify(dir, FS_CREATE, inode, FSNOTIFY_EVENT_INODE, new_dentry->d_name.name, 0);
174	}	174	}
@@ -181,7 +181,7 @@ static inline void fsnotify_mkdir(struct inode inode, struct dentry dentry) · 6 unmodified lines
181	__u32 mask = (FS_CREATE \| FS_ISDIR);	181	__u32 mask = (FS_CREATE \| FS_ISDIR);
182	struct inode *d_inode = dentry->d_inode;	182	struct inode *d_inode = dentry->d_inode;
183		183
184	audit_inode_child(inode, dentry);	184	audit_inode_child(inode, dentry, AUDIT_TYPE_CHILD_CREATE);
185		185
186	fsnotify(inode, mask, d_inode, FSNOTIFY_EVENT_INODE, dentry->d_name.name, 0);	186	fsnotify(inode, mask, d_inode, FSNOTIFY_EVENT_INODE, dentry->d_name.name, 0);
187	}	187	}

kernel/auditsc.c+30−27

  * __audit_inode_child - collect inode info for created/removed objects
  * @parent: inode of dentry parent
  * @dentry: dentry being audited
+ * @type:   AUDIT_TYPE_* value that we're looking for
  *
  * For syscalls that create or remove filesystem objects, audit_inode
  * can only collect information for the filesystem object's parent.
  * unsuccessful attempts.
  */
 void __audit_inode_child(const struct inode *parent,
-			 const struct dentry *dentry)
+			 const struct dentry *dentry,
+			 const unsigned char type)
 {
 	struct audit_context *context = current->audit_context;
-	const char *found_parent = NULL, *found_child = NULL;
 	const struct inode *inode = dentry->d_inode;
 	const char *dname = dentry->d_name.name;
-	struct audit_names *n;
+	struct audit_names *n, *found_parent = NULL, *found_child = NULL;
 	if (!context->in_syscall)
 		return;
 	if (inode)
 		handle_one(inode);
-	/* parent is more likely, look for it first */
+	/* look for a parent entry first */
 	list_for_each_entry(n, &context->names_list, list) {
-		if (!n->name)
+		if (!n->name || n->type != AUDIT_TYPE_PARENT)
 			continue;
 		if (n->ino == parent->i_ino &&
 		    !audit_compare_dname_path(dname, n->name, n->name_len)) {
-			found_parent = n->name;
+			found_parent = n;
-			goto add_names;
+			break;
 		}
 	}
-	/* no matching parent, look for matching child */
+	/* is there a matching child entry? */
 	list_for_each_entry(n, &context->names_list, list) {
-		if (!n->name)
+		/* can only match entries that have a name */
+		if (!n->name || n->type != type)
+			continue;
+		/* if we found a parent, make sure this one is a child of it */
+		if (found_parent && (n->name != found_parent->name))
 			continue;
-		/* strcmp() is the more likely scenario */
 		if (!strcmp(dname, n->name) ||
 		    !audit_compare_dname_path(dname, n->name,
+						found_parent ?
+						found_parent->name_len :
 						AUDIT_NAME_FULL)) {
-			if (inode)
+			found_child = n;
-				audit_copy_inode(n, dentry, inode);
+			break;
-			else
-				n->ino = (unsigned long)-1;
-			n->type = AUDIT_TYPE_NORMAL;
-			found_child = n->name;
-			goto add_names;
 		}
 	}
-add_names:
 	if (!found_parent) {
-		n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);
+		/* create a new, "anonymous" parent record */
+		n = audit_alloc_name(context, AUDIT_TYPE_PARENT);
 		if (!n)
 			return;
 		audit_copy_inode(n, NULL, parent);
 	}
 	if (!found_child) {
-		n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);
+		found_child = audit_alloc_name(context, type);
-		if (!n)
+		if (!found_child)
 			return;
 		/* Re-use the name belonging to the slot for a matching parent
 		 * directory. All names for this context are relinquished in
 		 * audit_free_names() */
 		if (found_parent) {
-			n->name = found_parent;
+			found_child->name = found_parent->name;
-			n->name_len = AUDIT_NAME_FULL;
+			found_child->name_len = AUDIT_NAME_FULL;
 			/* don't call __putname() */
-			n->name_put = false;
+			found_child->name_put = false;
 		}
-		if (inode)
-			audit_copy_inode(n, dentry, inode);
 	}
+	if (inode)
+		audit_copy_inode(found_child, dentry, inode);
+	else
+		found_child->ino = (unsigned long)-1;
 }
 EXPORT_SYMBOL_GPL(__audit_inode_child);