kernel/audit_tree.c

   1 #include "audit.h"
   2 #include <linux/fsnotify_backend.h>
   3 #include <linux/namei.h>
   4 #include <linux/mount.h>
   5 #include <linux/kthread.h>
   6 #include <linux/slab.h>
   7
   8 struct audit_tree;
   9 struct audit_chunk;
  10
  11 struct audit_tree {
  12         atomic_t count;
  13         int goner;
  14         struct audit_chunk *root;
  15         struct list_head chunks;
  16         struct list_head rules;
  17         struct list_head list;
  18         struct list_head same_root;
  19         struct rcu_head head;
  20         char pathname[];
  21 };
  22
  23 struct audit_chunk {
  24         struct list_head hash;
  25         struct fsnotify_mark_entry mark;
  26         struct list_head trees;         /* with root here */
  27         int dead;
  28         int count;
  29         atomic_long_t refs;
  30         struct rcu_head head;
  31         struct node {
  32                 struct list_head list;
  33                 struct audit_tree *owner;
  34                 unsigned index;         /* index; upper bit indicates 'will prune' */
  35         } owners[];
  36 };
  37
  38 static LIST_HEAD(tree_list);
  39 static LIST_HEAD(prune_list);
  40
  41 /*
  42  * One struct chunk is attached to each inode of interest.
  43  * We replace struct chunk on tagging/untagging.
  44  * Rules have pointer to struct audit_tree.
  45  * Rules have struct list_head rlist forming a list of rules over
  46  * the same tree.
  47  * References to struct chunk are collected at audit_inode{,_child}()
  48  * time and used in AUDIT_TREE rule matching.
  49  * These references are dropped at the same time we are calling
  50  * audit_free_names(), etc.
  51  *
  52  * Cyclic lists galore:
  53  * tree.chunks anchors chunk.owners[].list                      hash_lock
  54  * tree.rules anchors rule.rlist                                audit_filter_mutex
  55  * chunk.trees anchors tree.same_root                           hash_lock
  56  * chunk.hash is a hash with middle bits of watch.inode as
  57  * a hash function.                                             RCU, hash_lock
  58  *
  59  * tree is refcounted; one reference for "some rules on rules_list refer to
  60  * it", one for each chunk with pointer to it.
  61  *
  62  * chunk is refcounted by embedded fsnotify_mark + .refs (non-zero refcount
  63  * of watch contributes 1 to .refs).
  64  *
  65  * node.index allows to get from node.list to containing chunk.
  66  * MSB of that sucker is stolen to mark taggings that we might have to
  67  * revert - several operations have very unpleasant cleanup logics and
  68  * that makes a difference.  Some.
  69  */
  70
  71 static struct fsnotify_group *audit_tree_group;
  72
  73 static struct audit_tree *alloc_tree(const char *s)
  74 {
  75         struct audit_tree *tree;
  76
  77         tree = kmalloc(sizeof(struct audit_tree) + strlen(s) + 1, GFP_KERNEL);
  78         if (tree) {
  79                 atomic_set(&tree->count, 1);
  80                 tree->goner = 0;
  81                 INIT_LIST_HEAD(&tree->chunks);
  82                 INIT_LIST_HEAD(&tree->rules);
  83                 INIT_LIST_HEAD(&tree->list);
  84                 INIT_LIST_HEAD(&tree->same_root);
  85                 tree->root = NULL;
  86                 strcpy(tree->pathname, s);
  87         }
  88         return tree;
  89 }
  90
  91 static inline void get_tree(struct audit_tree *tree)
  92 {
  93         atomic_inc(&tree->count);
  94 }
  95
  96 static void __put_tree(struct rcu_head *rcu)
  97 {
  98         struct audit_tree *tree = container_of(rcu, struct audit_tree, head);
  99         kfree(tree);
 100 }
 101
 102 static inline void put_tree(struct audit_tree *tree)
 103 {
 104         if (atomic_dec_and_test(&tree->count))
 105                 call_rcu(&tree->head, __put_tree);
 106 }
 107
 108 /* to avoid bringing the entire thing in audit.h */
 109 const char *audit_tree_path(struct audit_tree *tree)
 110 {
 111         return tree->pathname;
 112 }
 113
 114 static void free_chunk(struct audit_chunk *chunk)
 115 {
 116         int i;
 117
 118         for (i = 0; i < chunk->count; i++) {
 119                 if (chunk->owners[i].owner)
 120                         put_tree(chunk->owners[i].owner);
 121         }
 122         kfree(chunk);
 123 }
 124
 125 void audit_put_chunk(struct audit_chunk *chunk)
 126 {
 127         if (atomic_long_dec_and_test(&chunk->refs))
 128                 free_chunk(chunk);
 129 }
 130
 131 static void __put_chunk(struct rcu_head *rcu)
 132 {
 133         struct audit_chunk *chunk = container_of(rcu, struct audit_chunk, head);
 134         audit_put_chunk(chunk);
 135 }
 136
 137 static void audit_tree_destroy_watch(struct fsnotify_mark_entry *entry)
 138 {
 139         struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
 140         call_rcu(&chunk->head, __put_chunk);
 141 }
 142
 143 static struct audit_chunk *alloc_chunk(int count)
 144 {
 145         struct audit_chunk *chunk;
 146         size_t size;
 147         int i;
 148
 149         size = offsetof(struct audit_chunk, owners) + count * sizeof(struct node);
 150         chunk = kzalloc(size, GFP_KERNEL);
 151         if (!chunk)
 152                 return NULL;
 153
 154         INIT_LIST_HEAD(&chunk->hash);
 155         INIT_LIST_HEAD(&chunk->trees);
 156         chunk->count = count;
 157         atomic_long_set(&chunk->refs, 1);
 158         for (i = 0; i < count; i++) {
 159                 INIT_LIST_HEAD(&chunk->owners[i].list);
 160                 chunk->owners[i].index = i;
 161         }
 162         fsnotify_init_mark(&chunk->mark, audit_tree_destroy_watch);
 163         return chunk;
 164 }
 165
 166 enum {HASH_SIZE = 128};
 167 static struct list_head chunk_hash_heads[HASH_SIZE];
 168 static __cacheline_aligned_in_smp DEFINE_SPINLOCK(hash_lock);
 169
 170 static inline struct list_head *chunk_hash(const struct inode *inode)
 171 {
 172         unsigned long n = (unsigned long)inode / L1_CACHE_BYTES;
 173         return chunk_hash_heads + n % HASH_SIZE;
 174 }
 175
 176 /* hash_lock & entry->lock is held by caller */
 177 static void insert_hash(struct audit_chunk *chunk)
 178 {
 179         struct fsnotify_mark_entry *entry = &chunk->mark;
 180         struct list_head *list;
 181
 182         if (!entry->inode)
 183                 return;
 184         list = chunk_hash(entry->inode);
 185         list_add_rcu(&chunk->hash, list);
 186 }
 187
 188 /* called under rcu_read_lock */
 189 struct audit_chunk *audit_tree_lookup(const struct inode *inode)
 190 {
 191         struct list_head *list = chunk_hash(inode);
 192         struct audit_chunk *p;
 193
 194         list_for_each_entry_rcu(p, list, hash) {
 195                 /* mark.inode may have gone NULL, but who cares? */
 196                 if (p->mark.inode == inode) {
 197                         atomic_long_inc(&p->refs);
 198                         return p;
 199                 }
 200         }
 201         return NULL;
 202 }
 203
 204 int audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree)
 205 {
 206         int n;
 207         for (n = 0; n < chunk->count; n++)
 208                 if (chunk->owners[n].owner == tree)
 209                         return 1;
 210         return 0;
 211 }
 212
 213 /* tagging and untagging inodes with trees */
 214
 215 static struct audit_chunk *find_chunk(struct node *p)
 216 {
 217         int index = p->index & ~(1U<<31);
 218         p -= index;
 219         return container_of(p, struct audit_chunk, owners[0]);
 220 }
 221
 222 static void untag_chunk(struct node *p)
 223 {
 224         struct audit_chunk *chunk = find_chunk(p);
 225         struct fsnotify_mark_entry *entry = &chunk->mark;
 226         struct audit_chunk *new;
 227         struct audit_tree *owner;
 228         int size = chunk->count - 1;
 229         int i, j;
 230
 231         fsnotify_get_mark(entry);
 232
 233         spin_unlock(&hash_lock);
 234
 235         spin_lock(&entry->lock);
 236         if (chunk->dead || !entry->inode) {
 237                 spin_unlock(&entry->lock);
 238                 goto out;
 239         }
 240
 241         owner = p->owner;
 242
 243         if (!size) {
 244                 chunk->dead = 1;
 245                 spin_lock(&hash_lock);
 246                 list_del_init(&chunk->trees);
 247                 if (owner->root == chunk)
 248                         owner->root = NULL;
 249                 list_del_init(&p->list);
 250                 list_del_rcu(&chunk->hash);
 251                 spin_unlock(&hash_lock);
 252                 spin_unlock(&entry->lock);
 253                 fsnotify_destroy_mark_by_entry(entry);
 254                 fsnotify_put_mark(entry);
 255                 goto out;
 256         }
 257
 258         new = alloc_chunk(size);
 259         if (!new)
 260                 goto Fallback;
 261         fsnotify_duplicate_mark(&new->mark, entry);
 262         if (fsnotify_add_mark(&new->mark, new->mark.group, new->mark.inode, 1)) {
 263                 free_chunk(new);
 264                 goto Fallback;
 265         }
 266
 267         chunk->dead = 1;
 268         spin_lock(&hash_lock);
 269         list_replace_init(&chunk->trees, &new->trees);
 270         if (owner->root == chunk) {
 271                 list_del_init(&owner->same_root);
 272                 owner->root = NULL;
 273         }
 274
 275         for (i = j = 0; j <= size; i++, j++) {
 276                 struct audit_tree *s;
 277                 if (&chunk->owners[j] == p) {
 278                         list_del_init(&p->list);
 279                         i--;
 280                         continue;
 281                 }
 282                 s = chunk->owners[j].owner;
 283                 new->owners[i].owner = s;
 284                 new->owners[i].index = chunk->owners[j].index - j + i;
 285                 if (!s) /* result of earlier fallback */
 286                         continue;
 287                 get_tree(s);
 288                 list_replace_init(&chunk->owners[j].list, &new->owners[i].list);
 289         }
 290
 291         list_replace_rcu(&chunk->hash, &new->hash);
 292         list_for_each_entry(owner, &new->trees, same_root)
 293                 owner->root = new;
 294         spin_unlock(&hash_lock);
 295         spin_unlock(&entry->lock);
 296         fsnotify_destroy_mark_by_entry(entry);
 297         fsnotify_put_mark(entry);
 298         goto out;
 299
 300 Fallback:
 301         // do the best we can
 302         spin_lock(&hash_lock);
 303         if (owner->root == chunk) {
 304                 list_del_init(&owner->same_root);
 305                 owner->root = NULL;
 306         }
 307         list_del_init(&p->list);
 308         p->owner = NULL;
 309         put_tree(owner);
 310         spin_unlock(&hash_lock);
 311         spin_unlock(&entry->lock);
 312 out:
 313         fsnotify_put_mark(entry);
 314         spin_lock(&hash_lock);
 315 }
 316
 317 static int create_chunk(struct inode *inode, struct audit_tree *tree)
 318 {
 319         struct fsnotify_mark_entry *entry;
 320         struct audit_chunk *chunk = alloc_chunk(1);
 321         if (!chunk)
 322                 return -ENOMEM;
 323
 324         entry = &chunk->mark;
 325         if (fsnotify_add_mark(entry, audit_tree_group, inode, 0)) {
 326                 free_chunk(chunk);
 327                 return -ENOSPC;
 328         }
 329
 330         spin_lock(&entry->lock);
 331         spin_lock(&hash_lock);
 332         if (tree->goner) {
 333                 spin_unlock(&hash_lock);
 334                 chunk->dead = 1;
 335                 spin_unlock(&entry->lock);
 336                 fsnotify_destroy_mark_by_entry(entry);
 337                 fsnotify_put_mark(entry);
 338                 return 0;
 339         }
 340         chunk->owners[0].index = (1U << 31);
 341         chunk->owners[0].owner = tree;
 342         get_tree(tree);
 343         list_add(&chunk->owners[0].list, &tree->chunks);
 344         if (!tree->root) {
 345                 tree->root = chunk;
 346                 list_add(&tree->same_root, &chunk->trees);
 347         }
 348         insert_hash(chunk);
 349         spin_unlock(&hash_lock);
 350         spin_unlock(&entry->lock);
 351         return 0;
 352 }
 353
 354 /* the first tagged inode becomes root of tree */
 355 static int tag_chunk(struct inode *inode, struct audit_tree *tree)
 356 {
 357         struct fsnotify_mark_entry *old_entry, *chunk_entry;
 358         struct audit_tree *owner;
 359         struct audit_chunk *chunk, *old;
 360         struct node *p;
 361         int n;
 362
 363         spin_lock(&inode->i_lock);
 364         old_entry = fsnotify_find_mark_entry(audit_tree_group, inode);
 365         spin_unlock(&inode->i_lock);
 366         if (!old_entry)
 367                 return create_chunk(inode, tree);
 368
 369         old = container_of(old_entry, struct audit_chunk, mark);
 370
 371         /* are we already there? */
 372         spin_lock(&hash_lock);
 373         for (n = 0; n < old->count; n++) {
 374                 if (old->owners[n].owner == tree) {
 375                         spin_unlock(&hash_lock);
 376                         fsnotify_put_mark(old_entry);
 377                         return 0;
 378                 }
 379         }
 380         spin_unlock(&hash_lock);
 381
 382         chunk = alloc_chunk(old->count + 1);
 383         if (!chunk) {
 384                 fsnotify_put_mark(old_entry);
 385                 return -ENOMEM;
 386         }
 387
 388         chunk_entry = &chunk->mark;
 389
 390         spin_lock(&old_entry->lock);
 391         if (!old_entry->inode) {
 392                 /* old_entry is being shot, lets just lie */
 393                 spin_unlock(&old_entry->lock);
 394                 fsnotify_put_mark(old_entry);
 395                 free_chunk(chunk);
 396                 return -ENOENT;
 397         }
 398
 399         fsnotify_duplicate_mark(chunk_entry, old_entry);
 400         if (fsnotify_add_mark(chunk_entry, chunk_entry->group, chunk_entry->inode, 1)) {
 401                 spin_unlock(&old_entry->lock);
 402                 free_chunk(chunk);
 403                 fsnotify_put_mark(old_entry);
 404                 return -ENOSPC;
 405         }
 406
 407         /* even though we hold old_entry->lock, this is safe since chunk_entry->lock could NEVER have been grabbed before */
 408         spin_lock(&chunk_entry->lock);
 409         spin_lock(&hash_lock);
 410
 411         /* we now hold old_entry->lock, chunk_entry->lock, and hash_lock */
 412         if (tree->goner) {
 413                 spin_unlock(&hash_lock);
 414                 chunk->dead = 1;
 415                 spin_unlock(&chunk_entry->lock);
 416                 spin_unlock(&old_entry->lock);
 417
 418                 fsnotify_destroy_mark_by_entry(chunk_entry);
 419
 420                 fsnotify_put_mark(chunk_entry);
 421                 fsnotify_put_mark(old_entry);
 422                 return 0;
 423         }
 424         list_replace_init(&old->trees, &chunk->trees);
 425         for (n = 0, p = chunk->owners; n < old->count; n++, p++) {
 426                 struct audit_tree *s = old->owners[n].owner;
 427                 p->owner = s;
 428                 p->index = old->owners[n].index;
 429                 if (!s) /* result of fallback in untag */
 430                         continue;
 431                 get_tree(s);
 432                 list_replace_init(&old->owners[n].list, &p->list);
 433         }
 434         p->index = (chunk->count - 1) | (1U<<31);
 435         p->owner = tree;
 436         get_tree(tree);
 437         list_add(&p->list, &tree->chunks);
 438         list_replace_rcu(&old->hash, &chunk->hash);
 439         list_for_each_entry(owner, &chunk->trees, same_root)
 440                 owner->root = chunk;
 441         old->dead = 1;
 442         if (!tree->root) {
 443                 tree->root = chunk;
 444                 list_add(&tree->same_root, &chunk->trees);
 445         }
 446         spin_unlock(&hash_lock);
 447         spin_unlock(&chunk_entry->lock);
 448         spin_unlock(&old_entry->lock);
 449         fsnotify_destroy_mark_by_entry(old_entry);
 450         fsnotify_put_mark(old_entry); /* pair to fsnotify_find mark_entry */
 451         fsnotify_put_mark(old_entry); /* and kill it */
 452         return 0;
 453 }
 454
 455 static void kill_rules(struct audit_tree *tree)
 456 {
 457         struct audit_krule *rule, *next;
 458         struct audit_entry *entry;
 459         struct audit_buffer *ab;
 460
 461         list_for_each_entry_safe(rule, next, &tree->rules, rlist) {
 462                 entry = container_of(rule, struct audit_entry, rule);
 463
 464                 list_del_init(&rule->rlist);
 465                 if (rule->tree) {
 466                         /* not a half-baked one */
 467                         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
 468                         audit_log_format(ab, "op=");
 469                         audit_log_string(ab, "remove rule");
 470                         audit_log_format(ab, " dir=");
 471                         audit_log_untrustedstring(ab, rule->tree->pathname);
 472                         audit_log_key(ab, rule->filterkey);
 473                         audit_log_format(ab, " list=%d res=1", rule->listnr);
 474                         audit_log_end(ab);
 475                         rule->tree = NULL;
 476                         list_del_rcu(&entry->list);
 477                         list_del(&entry->rule.list);
 478                         call_rcu(&entry->rcu, audit_free_rule_rcu);
 479                 }
 480         }
 481 }
 482
 483 /*
 484  * finish killing struct audit_tree
 485  */
 486 static void prune_one(struct audit_tree *victim)
 487 {
 488         spin_lock(&hash_lock);
 489         while (!list_empty(&victim->chunks)) {
 490                 struct node *p;
 491
 492                 p = list_entry(victim->chunks.next, struct node, list);
 493
 494                 untag_chunk(p);
 495         }
 496         spin_unlock(&hash_lock);
 497         put_tree(victim);
 498 }
 499
 500 /* trim the uncommitted chunks from tree */
 501
 502 static void trim_marked(struct audit_tree *tree)
 503 {
 504         struct list_head *p, *q;
 505         spin_lock(&hash_lock);
 506         if (tree->goner) {
 507                 spin_unlock(&hash_lock);
 508                 return;
 509         }
 510         /* reorder */
 511         for (p = tree->chunks.next; p != &tree->chunks; p = q) {
 512                 struct node *node = list_entry(p, struct node, list);
 513                 q = p->next;
 514                 if (node->index & (1U<<31)) {
 515                         list_del_init(p);
 516                         list_add(p, &tree->chunks);
 517                 }
 518         }
 519
 520         while (!list_empty(&tree->chunks)) {
 521                 struct node *node;
 522
 523                 node = list_entry(tree->chunks.next, struct node, list);
 524
 525                 /* have we run out of marked? */
 526                 if (!(node->index & (1U<<31)))
 527                         break;
 528
 529                 untag_chunk(node);
 530         }
 531         if (!tree->root && !tree->goner) {
 532                 tree->goner = 1;
 533                 spin_unlock(&hash_lock);
 534                 mutex_lock(&audit_filter_mutex);
 535                 kill_rules(tree);
 536                 list_del_init(&tree->list);
 537                 mutex_unlock(&audit_filter_mutex);
 538                 prune_one(tree);
 539         } else {
 540                 spin_unlock(&hash_lock);
 541         }
 542 }
 543
 544 static void audit_schedule_prune(void);
 545
 546 /* called with audit_filter_mutex */
 547 int audit_remove_tree_rule(struct audit_krule *rule)
 548 {
 549         struct audit_tree *tree;
 550         tree = rule->tree;
 551         if (tree) {
 552                 spin_lock(&hash_lock);
 553                 list_del_init(&rule->rlist);
 554                 if (list_empty(&tree->rules) && !tree->goner) {
 555                         tree->root = NULL;
 556                         list_del_init(&tree->same_root);
 557                         tree->goner = 1;
 558                         list_move(&tree->list, &prune_list);
 559                         rule->tree = NULL;
 560                         spin_unlock(&hash_lock);
 561                         audit_schedule_prune();
 562                         return 1;
 563                 }
 564                 rule->tree = NULL;
 565                 spin_unlock(&hash_lock);
 566                 return 1;
 567         }
 568         return 0;
 569 }
 570
 571 static int compare_root(struct vfsmount *mnt, void *arg)
 572 {
 573         return mnt->mnt_root->d_inode == arg;
 574 }
 575
 576 void audit_trim_trees(void)
 577 {
 578         struct list_head cursor;
 579
 580         mutex_lock(&audit_filter_mutex);
 581         list_add(&cursor, &tree_list);
 582         while (cursor.next != &tree_list) {
 583                 struct audit_tree *tree;
 584                 struct path path;
 585                 struct vfsmount *root_mnt;
 586                 struct node *node;
 587                 int err;
 588
 589                 tree = container_of(cursor.next, struct audit_tree, list);
 590                 get_tree(tree);
 591                 list_del(&cursor);
 592                 list_add(&cursor, &tree->list);
 593                 mutex_unlock(&audit_filter_mutex);
 594
 595                 err = kern_path(tree->pathname, 0, &path);
 596                 if (err)
 597                         goto skip_it;
 598
 599                 root_mnt = collect_mounts(&path);
 600                 path_put(&path);
 601                 if (!root_mnt)
 602                         goto skip_it;
 603
 604                 spin_lock(&hash_lock);
 605                 list_for_each_entry(node, &tree->chunks, list) {
 606                         struct audit_chunk *chunk = find_chunk(node);
 607                         /* this could be NULL if the watch is dieing else where... */
 608                         struct inode *inode = chunk->mark.inode;
 609                         node->index |= 1U<<31;
 610                         if (iterate_mounts(compare_root, inode, root_mnt))
 611                                 node->index &= ~(1U<<31);
 612                 }
 613                 spin_unlock(&hash_lock);
 614                 trim_marked(tree);
 615                 put_tree(tree);
 616                 drop_collected_mounts(root_mnt);
 617 skip_it:
 618                 mutex_lock(&audit_filter_mutex);
 619         }
 620         list_del(&cursor);
 621         mutex_unlock(&audit_filter_mutex);
 622 }
 623
 624 int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op)
 625 {
 626
 627         if (pathname[0] != '/' ||
 628             rule->listnr != AUDIT_FILTER_EXIT ||
 629             op != Audit_equal ||
 630             rule->inode_f || rule->watch || rule->tree)
 631                 return -EINVAL;
 632         rule->tree = alloc_tree(pathname);
 633         if (!rule->tree)
 634                 return -ENOMEM;
 635         return 0;
 636 }
 637
 638 void audit_put_tree(struct audit_tree *tree)
 639 {
 640         put_tree(tree);
 641 }
 642
 643 static int tag_mount(struct vfsmount *mnt, void *arg)
 644 {
 645         return tag_chunk(mnt->mnt_root->d_inode, arg);
 646 }
 647
 648 /* called with audit_filter_mutex */
 649 int audit_add_tree_rule(struct audit_krule *rule)
 650 {
 651         struct audit_tree *seed = rule->tree, *tree;
 652         struct path path;
 653         struct vfsmount *mnt;
 654         int err;
 655
 656         list_for_each_entry(tree, &tree_list, list) {
 657                 if (!strcmp(seed->pathname, tree->pathname)) {
 658                         put_tree(seed);
 659                         rule->tree = tree;
 660                         list_add(&rule->rlist, &tree->rules);
 661                         return 0;
 662                 }
 663         }
 664         tree = seed;
 665         list_add(&tree->list, &tree_list);
 666         list_add(&rule->rlist, &tree->rules);
 667         /* do not set rule->tree yet */
 668         mutex_unlock(&audit_filter_mutex);
 669
 670         err = kern_path(tree->pathname, 0, &path);
 671         if (err)
 672                 goto Err;
 673         mnt = collect_mounts(&path);
 674         path_put(&path);
 675         if (!mnt) {
 676                 err = -ENOMEM;
 677                 goto Err;
 678         }
 679
 680         get_tree(tree);
 681         err = iterate_mounts(tag_mount, tree, mnt);
 682         drop_collected_mounts(mnt);
 683
 684         if (!err) {
 685                 struct node *node;
 686                 spin_lock(&hash_lock);
 687                 list_for_each_entry(node, &tree->chunks, list)
 688                         node->index &= ~(1U<<31);
 689                 spin_unlock(&hash_lock);
 690         } else {
 691                 trim_marked(tree);
 692                 goto Err;
 693         }
 694
 695         mutex_lock(&audit_filter_mutex);
 696         if (list_empty(&rule->rlist)) {
 697                 put_tree(tree);
 698                 return -ENOENT;
 699         }
 700         rule->tree = tree;
 701         put_tree(tree);
 702
 703         return 0;
 704 Err:
 705         mutex_lock(&audit_filter_mutex);
 706         list_del_init(&tree->list);
 707         list_del_init(&tree->rules);
 708         put_tree(tree);
 709         return err;
 710 }
 711
 712 int audit_tag_tree(char *old, char *new)
 713 {
 714         struct list_head cursor, barrier;
 715         int failed = 0;
 716         struct path path1, path2;
 717         struct vfsmount *tagged;
 718         int err;
 719
 720         err = kern_path(new, 0, &path2);
 721         if (err)
 722                 return err;
 723         tagged = collect_mounts(&path2);
 724         path_put(&path2);
 725         if (!tagged)
 726                 return -ENOMEM;
 727
 728         err = kern_path(old, 0, &path1);
 729         if (err) {
 730                 drop_collected_mounts(tagged);
 731                 return err;
 732         }
 733
 734         mutex_lock(&audit_filter_mutex);
 735         list_add(&barrier, &tree_list);
 736         list_add(&cursor, &barrier);
 737
 738         while (cursor.next != &tree_list) {
 739                 struct audit_tree *tree;
 740                 int good_one = 0;
 741
 742                 tree = container_of(cursor.next, struct audit_tree, list);
 743                 get_tree(tree);
 744                 list_del(&cursor);
 745                 list_add(&cursor, &tree->list);
 746                 mutex_unlock(&audit_filter_mutex);
 747
 748                 err = kern_path(tree->pathname, 0, &path2);
 749                 if (!err) {
 750                         good_one = path_is_under(&path1, &path2);
 751                         path_put(&path2);
 752                 }
 753
 754                 if (!good_one) {
 755                         put_tree(tree);
 756                         mutex_lock(&audit_filter_mutex);
 757                         continue;
 758                 }
 759
 760                 failed = iterate_mounts(tag_mount, tree, tagged);
 761                 if (failed) {
 762                         put_tree(tree);
 763                         mutex_lock(&audit_filter_mutex);
 764                         break;
 765                 }
 766
 767                 mutex_lock(&audit_filter_mutex);
 768                 spin_lock(&hash_lock);
 769                 if (!tree->goner) {
 770                         list_del(&tree->list);
 771                         list_add(&tree->list, &tree_list);
 772                 }
 773                 spin_unlock(&hash_lock);
 774                 put_tree(tree);
 775         }
 776
 777         while (barrier.prev != &tree_list) {
 778                 struct audit_tree *tree;
 779
 780                 tree = container_of(barrier.prev, struct audit_tree, list);
 781                 get_tree(tree);
 782                 list_del(&tree->list);
 783                 list_add(&tree->list, &barrier);
 784                 mutex_unlock(&audit_filter_mutex);
 785
 786                 if (!failed) {
 787                         struct node *node;
 788                         spin_lock(&hash_lock);
 789                         list_for_each_entry(node, &tree->chunks, list)
 790                                 node->index &= ~(1U<<31);
 791                         spin_unlock(&hash_lock);
 792                 } else {
 793                         trim_marked(tree);
 794                 }
 795
 796                 put_tree(tree);
 797                 mutex_lock(&audit_filter_mutex);
 798         }
 799         list_del(&barrier);
 800         list_del(&cursor);
 801         mutex_unlock(&audit_filter_mutex);
 802         path_put(&path1);
 803         drop_collected_mounts(tagged);
 804         return failed;
 805 }
 806
 807 /*
 808  * That gets run when evict_chunk() ends up needing to kill audit_tree.
 809  * Runs from a separate thread.
 810  */
 811 static int prune_tree_thread(void *unused)
 812 {
 813         mutex_lock(&audit_cmd_mutex);
 814         mutex_lock(&audit_filter_mutex);
 815
 816         while (!list_empty(&prune_list)) {
 817                 struct audit_tree *victim;
 818
 819                 victim = list_entry(prune_list.next, struct audit_tree, list);
 820                 list_del_init(&victim->list);
 821
 822                 mutex_unlock(&audit_filter_mutex);
 823
 824                 prune_one(victim);
 825
 826                 mutex_lock(&audit_filter_mutex);
 827         }
 828
 829         mutex_unlock(&audit_filter_mutex);
 830         mutex_unlock(&audit_cmd_mutex);
 831         return 0;
 832 }
 833
 834 static void audit_schedule_prune(void)
 835 {
 836         kthread_run(prune_tree_thread, NULL, "audit_prune_tree");
 837 }
 838
 839 /*
 840  * ... and that one is done if evict_chunk() decides to delay until the end
 841  * of syscall.  Runs synchronously.
 842  */
 843 void audit_kill_trees(struct list_head *list)
 844 {
 845         mutex_lock(&audit_cmd_mutex);
 846         mutex_lock(&audit_filter_mutex);
 847
 848         while (!list_empty(list)) {
 849                 struct audit_tree *victim;
 850
 851                 victim = list_entry(list->next, struct audit_tree, list);
 852                 kill_rules(victim);
 853                 list_del_init(&victim->list);
 854
 855                 mutex_unlock(&audit_filter_mutex);
 856
 857                 prune_one(victim);
 858
 859                 mutex_lock(&audit_filter_mutex);
 860         }
 861
 862         mutex_unlock(&audit_filter_mutex);
 863         mutex_unlock(&audit_cmd_mutex);
 864 }
 865
 866 /*
 867  *  Here comes the stuff asynchronous to auditctl operations
 868  */
 869
 870 static void evict_chunk(struct audit_chunk *chunk)
 871 {
 872         struct audit_tree *owner;
 873         struct list_head *postponed = audit_killed_trees();
 874         int need_prune = 0;
 875         int n;
 876
 877         if (chunk->dead)
 878                 return;
 879
 880         chunk->dead = 1;
 881         mutex_lock(&audit_filter_mutex);
 882         spin_lock(&hash_lock);
 883         while (!list_empty(&chunk->trees)) {
 884                 owner = list_entry(chunk->trees.next,
 885                                    struct audit_tree, same_root);
 886                 owner->goner = 1;
 887                 owner->root = NULL;
 888                 list_del_init(&owner->same_root);
 889                 spin_unlock(&hash_lock);
 890                 if (!postponed) {
 891                         kill_rules(owner);
 892                         list_move(&owner->list, &prune_list);
 893                         need_prune = 1;
 894                 } else {
 895                         list_move(&owner->list, postponed);
 896                 }
 897                 spin_lock(&hash_lock);
 898         }
 899         list_del_rcu(&chunk->hash);
 900         for (n = 0; n < chunk->count; n++)
 901                 list_del_init(&chunk->owners[n].list);
 902         spin_unlock(&hash_lock);
 903         if (need_prune)
 904                 audit_schedule_prune();
 905         mutex_unlock(&audit_filter_mutex);
 906 }
 907
 908 static int audit_tree_handle_event(struct fsnotify_group *group, struct fsnotify_event *event)
 909 {
 910         BUG();
 911         return -EOPNOTSUPP;
 912 }
 913
 914 static void audit_tree_freeing_mark(struct fsnotify_mark_entry *entry, struct fsnotify_group *group)
 915 {
 916         struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
 917
 918         evict_chunk(chunk);
 919         fsnotify_put_mark(entry);
 920 }
 921
 922 static bool audit_tree_send_event(struct fsnotify_group *group, struct inode *inode,
 923                                   __u32 mask, void *data, int data_type)
 924 {
 925         return 0;
 926 }
 927
 928 static const struct fsnotify_ops audit_tree_ops = {
 929         .handle_event = audit_tree_handle_event,
 930         .should_send_event = audit_tree_send_event,
 931         .free_group_priv = NULL,
 932         .free_event_priv = NULL,
 933         .freeing_mark = audit_tree_freeing_mark,
 934 };
 935
 936 static int __init audit_tree_init(void)
 937 {
 938         int i;
 939
 940         audit_tree_group = fsnotify_obtain_group(0, &audit_tree_ops);
 941         if (IS_ERR(audit_tree_group))
 942                 audit_panic("cannot initialize fsnotify group for rectree watches");
 943
 944         for (i = 0; i < HASH_SIZE; i++)
 945                 INIT_LIST_HEAD(&chunk_hash_heads[i]);
 946
 947         return 0;
 948 }
 949 __initcall(audit_tree_init);