Merge tag 'fsnotify_for_v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

Pull fsnotify updates from Jan Kara: "Support for auditing decisions regarding fanotify permission events" * tag 'fsnotify_for_v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify,audit: Allow audit to use the full permission event response fanotify: define struct members to hold response decision context fanotify: Ensure consistent variable type for response

Linus Torvalds committed 3 years ago

Commit cd776a42 parents 6639c3c 032bffd7 files · +131 −33Browse files

Unified · Split

7 files

fs/notify/fanotify/fanotify.c +6 −2
fs/notify/fanotify/fanotify.h +5 −1
fs/notify/fanotify/fanotify_user.c +66 −22
include/linux/audit.h +5 −4
include/linux/fanotify.h +5 −0
include/uapi/linux/fanotify.h +29 −1
kernel/auditsc.c +15 −3

fs/notify/fanotify/fanotify.c+6−2

 	}
 	/* userspace responded, convert to something usable */
-	switch (event->response & ~FAN_AUDIT) {
+	switch (event->response & FANOTIFY_RESPONSE_ACCESS) {
 	case FAN_ALLOW:
 		ret = 0;
 		break;
 	/* Check if the response should be audited */
 	if (event->response & FAN_AUDIT)
-		audit_fanotify(event->response & ~FAN_AUDIT);
+		audit_fanotify(event->response & ~FAN_AUDIT,
+			       &event->audit_rule);
 	pr_debug("%s: group=%p event=%p about to return ret=%d\n", __func__,
 		 group, event, ret);
 	pevent->fae.type = FANOTIFY_EVENT_TYPE_PATH_PERM;
 	pevent->response = 0;
+	pevent->hdr.type = FAN_RESPONSE_INFO_NONE;
+	pevent->hdr.pad = 0;
+	pevent->hdr.len = 0;
 	pevent->state = FAN_EVENT_INIT;
 	pevent->path = *path;
 	path_get(path);

fs/notify/fanotify/fanotify.h+5−1

 struct fanotify_perm_event {
 	struct fanotify_event fae;
 	struct path path;
-	unsigned short response;	/* userspace answer to the event */
+	u32 response;			/* userspace answer to the event */
 	unsigned short state;		/* state of the event */
 	int fd;		/* fd we passed to userspace for this event */
+	union {
+		struct fanotify_response_info_header hdr;
+		struct fanotify_response_info_audit_rule audit_rule;
+	};
 };
 static inline struct fanotify_perm_event *

fs/notify/fanotify/fanotify_user.c+66−22

 	return client_fd;
 }
+static int process_access_response_info(const char __user *info,
+					size_t info_len,
+				struct fanotify_response_info_audit_rule *friar)
+{
+	if (info_len != sizeof(*friar))
+		return -EINVAL;
+	if (copy_from_user(friar, info, sizeof(*friar)))
+		return -EFAULT;
+	if (friar->hdr.type != FAN_RESPONSE_INFO_AUDIT_RULE)
+		return -EINVAL;
+	if (friar->hdr.pad != 0)
+		return -EINVAL;
+	if (friar->hdr.len != sizeof(*friar))
+		return -EINVAL;
+	return info_len;
+}
 /*
  * Finish processing of permission event by setting it to ANSWERED state and
  * drop group->notification_lock.
  */
 static void finish_permission_event(struct fsnotify_group *group,
-				    struct fanotify_perm_event *event,
+				    struct fanotify_perm_event *event, u32 response,
-				    unsigned int response)
+				    struct fanotify_response_info_audit_rule *friar)
 				    __releases(&group->notification_lock)
 {
 	bool destroy = false;
 	assert_spin_locked(&group->notification_lock);
-	event->response = response;
+	event->response = response & ~FAN_INFO;
+	if (response & FAN_INFO)
+		memcpy(&event->audit_rule, friar, sizeof(*friar));
 	if (event->state == FAN_EVENT_CANCELED)
 		destroy = true;
 	else
 }
 static int process_access_response(struct fsnotify_group *group,
-				   struct fanotify_response *response_struct)
+				   struct fanotify_response *response_struct,
+				   const char __user *info,
+				   size_t info_len)
 {
 	struct fanotify_perm_event *event;
 	int fd = response_struct->fd;
-	int response = response_struct->response;
+	u32 response = response_struct->response;
+	int ret = info_len;
+	struct fanotify_response_info_audit_rule friar;
-	pr_debug("%s: group=%p fd=%d response=%d\n", __func__, group,
+	pr_debug("%s: group=%p fd=%d response=%u buf=%p size=%zu\n", __func__,
-		 fd, response);
+		 group, fd, response, info, info_len);
 	/*
 	 * make sure the response is valid, if invalid we do nothing and either
 	 * userspace can send a valid response or we will clean it up after the
 	 * timeout
 	 */
-	switch (response & ~FAN_AUDIT) {
+	if (response & ~FANOTIFY_RESPONSE_VALID_MASK)
+		return -EINVAL;
+	switch (response & FANOTIFY_RESPONSE_ACCESS) {
 	case FAN_ALLOW:
 	case FAN_DENY:
 		break;
 		return -EINVAL;
 	}
-	if (fd < 0)
+	if ((response & FAN_AUDIT) && !FAN_GROUP_FLAG(group, FAN_ENABLE_AUDIT))
 		return -EINVAL;
-	if ((response & FAN_AUDIT) && !FAN_GROUP_FLAG(group, FAN_ENABLE_AUDIT))
+	if (response & FAN_INFO) {
+		ret = process_access_response_info(info, info_len, &friar);
+		if (ret < 0)
+			return ret;
+		if (fd == FAN_NOFD)
+			return ret;
+	} else {
+		ret = 0;
+	}
+	if (fd < 0)
 		return -EINVAL;
 	spin_lock(&group->notification_lock);
 			continue;
 		list_del_init(&event->fae.fse.list);
-		finish_permission_event(group, event, response);
+		finish_permission_event(group, event, response, &friar);
 		wake_up(&group->fanotify_data.access_waitq);
-		return 0;
+		return ret;
 	}
 	spin_unlock(&group->notification_lock);
 			if (ret <= 0) {
 				spin_lock(&group->notification_lock);
 				finish_permission_event(group,
-					FANOTIFY_PERM(event), FAN_DENY);
+					FANOTIFY_PERM(event), FAN_DENY, NULL);
 				wake_up(&group->fanotify_data.access_waitq);
 			} else {
 				spin_lock(&group->notification_lock);
 static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t count, loff_t *pos)
 {
-	struct fanotify_response response = { .fd = -1, .response = -1 };
+	struct fanotify_response response;
 	struct fsnotify_group *group;
 	int ret;
+	const char __user *info_buf = buf + sizeof(struct fanotify_response);
+	size_t info_len;
 	if (!IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS))
 		return -EINVAL;
 	group = file->private_data;
+	pr_debug("%s: group=%p count=%zu\n", __func__, group, count);
 	if (count < sizeof(response))
 		return -EINVAL;
-	count = sizeof(response);
+	if (copy_from_user(&response, buf, sizeof(response)))
-	pr_debug("%s: group=%p count=%zu\n", __func__, group, count);
-	if (copy_from_user(&response, buf, count))
 		return -EFAULT;
-	ret = process_access_response(group, &response);
+	info_len = count - sizeof(response);
+	ret = process_access_response(group, &response, info_buf, info_len);
 	if (ret < 0)
 		count = ret;
+	else
+		count = sizeof(response) + ret;
 	return count;
 }
 		event = list_first_entry(&group->fanotify_data.access_list,
 				struct fanotify_perm_event, fae.fse.list);
 		list_del_init(&event->fae.fse.list);
-		finish_permission_event(group, event, FAN_ALLOW);
+		finish_permission_event(group, event, FAN_ALLOW, NULL);
 		spin_lock(&group->notification_lock);
 	}
 			fsnotify_destroy_event(group, fsn_event);
 		} else {
 			finish_permission_event(group, FANOTIFY_PERM(event),
-						FAN_ALLOW);
+						FAN_ALLOW, NULL);
 		}
 		spin_lock(&group->notification_lock);
 	}

include/linux/audit.h+5−4

 #include <linux/audit_arch.h>
 #include <uapi/linux/audit.h>
 #include <uapi/linux/netfilter/nf_tables.h>
+#include <uapi/linux/fanotify.h>
 #define AUDIT_INO_UNSET ((unsigned long)-1)
 #define AUDIT_DEV_UNSET ((dev_t)-1)
 extern void __audit_mmap_fd(int fd, int flags);
 extern void __audit_openat2_how(struct open_how *how);
 extern void __audit_log_kern_module(char *name);
-extern void __audit_fanotify(unsigned int response);
+extern void __audit_fanotify(u32 response, struct fanotify_response_info_audit_rule *friar);
 extern void __audit_tk_injoffset(struct timespec64 offset);
 extern void __audit_ntp_log(const struct audit_ntp_data *ad);
 extern void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
 		__audit_log_kern_module(name);
 }
-static inline void audit_fanotify(unsigned int response)
+static inline void audit_fanotify(u32 response, struct fanotify_response_info_audit_rule *friar)
 {
 	if (!audit_dummy_context())
-		__audit_fanotify(response);
+		__audit_fanotify(response, friar);
 }
 static inline void audit_tk_injoffset(struct timespec64 offset)
 {
 }
-static inline void audit_fanotify(unsigned int response)
+static inline void audit_fanotify(u32 response, struct fanotify_response_info_audit_rule *friar)
 { }
 static inline void audit_tk_injoffset(struct timespec64 offset)

include/linux/fanotify.h+5−0

 #define ALL_FANOTIFY_EVENT_BITS		(FANOTIFY_OUTGOING_EVENTS | \
 					 FANOTIFY_EVENT_FLAGS)
+/* These masks check for invalid bits in permission responses. */
+#define FANOTIFY_RESPONSE_ACCESS (FAN_ALLOW | FAN_DENY)
+#define FANOTIFY_RESPONSE_FLAGS (FAN_AUDIT | FAN_INFO)
+#define FANOTIFY_RESPONSE_VALID_MASK (FANOTIFY_RESPONSE_ACCESS | FANOTIFY_RESPONSE_FLAGS)
 /* Do not use these old uapi constants internally */
 #undef FAN_ALL_CLASS_BITS
 #undef FAN_ALL_INIT_FLAGS

include/uapi/linux/fanotify.h+29−1

@@ -188,15 +188,43 @@ struct fanotify_event_info_error { · 187 unmodified lines
188	__u32 error_count;	188	__u32 error_count;
189	};	189	};
190		190
		191	/*
		192	* User space may need to record additional information about its decision.
		193	* The extra information type records what kind of information is included.
		194	* The default is none. We also define an extra information buffer whose
		195	* size is determined by the extra information type.
		196	*
		197	* If the information type is Audit Rule, then the information following
		198	* is the rule number that triggered the user space decision that
		199	* requires auditing.
		200	*/
		201
		202	#define FAN_RESPONSE_INFO_NONE 0
		203	#define FAN_RESPONSE_INFO_AUDIT_RULE 1
		204
191	struct fanotify_response {	205	struct fanotify_response {
192	__s32 fd;	206	__s32 fd;
193	__u32 response;	207	__u32 response;
194	};	208	};
195		209
		210	struct fanotify_response_info_header {
		211	__u8 type;
		212	__u8 pad;
		213	__u16 len;
		214	};
		215
		216	struct fanotify_response_info_audit_rule {
		217	struct fanotify_response_info_header hdr;
		218	__u32 rule_number;
		219	__u32 subj_trust;
		220	__u32 obj_trust;
		221	};
		222
196	/* Legit userspace responses to a _PERM event */	223	/* Legit userspace responses to a _PERM event */
197	#define FAN_ALLOW 0x01	224	#define FAN_ALLOW 0x01
198	#define FAN_DENY 0x02	225	#define FAN_DENY 0x02
199	#define FAN_AUDIT 0x10 /* Bit mask to create audit record for result */	226	#define FAN_AUDIT 0x10 /* Bitmask to create audit record for result */
		227	#define FAN_INFO 0x20 /* Bitmask to indicate additional information */
200		228
201	/* No fd set in event */	229	/* No fd set in event */
202	#define FAN_NOFD -1	230	#define FAN_NOFD -1

kernel/auditsc.c+15−3

 #include <uapi/linux/limits.h>
 #include <uapi/linux/netfilter/nf_tables.h>
 #include <uapi/linux/openat2.h> // struct open_how
+#include <uapi/linux/fanotify.h>
 #include "audit.h"
 	context->type = AUDIT_KERN_MODULE;
 }
-void __audit_fanotify(unsigned int response)
+void __audit_fanotify(u32 response, struct fanotify_response_info_audit_rule *friar)
 {
-	audit_log(audit_context(), GFP_KERNEL,
+	/* {subj,obj}_trust values are {0,1,2}: no,yes,unknown */
-		AUDIT_FANOTIFY,	"resp=%u", response);
+	switch (friar->hdr.type) {
+	case FAN_RESPONSE_INFO_NONE:
+		audit_log(audit_context(), GFP_KERNEL, AUDIT_FANOTIFY,
+			  "resp=%u fan_type=%u fan_info=0 subj_trust=2 obj_trust=2",
+			  response, FAN_RESPONSE_INFO_NONE);
+		break;
+	case FAN_RESPONSE_INFO_AUDIT_RULE:
+		audit_log(audit_context(), GFP_KERNEL, AUDIT_FANOTIFY,
+			  "resp=%u fan_type=%u fan_info=%X subj_trust=%u obj_trust=%u",
+			  response, friar->hdr.type, friar->rule_number,
+			  friar->subj_trust, friar->obj_trust);
+	}
 }
 void __audit_tk_injoffset(struct timespec64 offset)

Merge tag 'fsnotify_for_v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code