From mboxrd@z Thu Jan 1 00:00:00 1970 From: Amy Griffis Subject: Re: [PATCH git 2/3] don't allow duplicate inode or watch rules Date: Mon, 5 Jun 2006 13:45:41 -0400 Message-ID: <20060605174541.GC24778@zk3.dec.com> References: <20060605174105.GA24778@zk3.dec.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20060605174105.GA24778@zk3.dec.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com In audit_add_rule(), check the inode hash so duplicate rules can't be added. Signed-off-by: Amy Griffis --- kernel/auditfilter.c | 52 +++++++++++++++++++++++++++++++++++++++----------- 1 files changed, 41 insertions(+), 11 deletions(-) 745105541b430c90127a2b7ad1806d995fd793b0 diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index d53a80d..3cedc73 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -880,6 +880,37 @@ static void audit_inotify_unregister(str } } +/* Find an existing audit rule. + * Caller must hold audit_filter_mutex to prevent stale rule data. */ +static struct audit_entry *audit_find_rule(struct audit_entry *entry, + struct list_head *list) +{ + struct audit_entry *e, *found = NULL; + int h; + + if (entry->rule.watch) { + /* we don't know the inode number, so must walk entire hash */ + for (h = 0; h < AUDIT_INODE_BUCKETS; h++) { + list = &audit_inode_hash[h]; + list_for_each_entry(e, list, list) + if (!audit_compare_rule(&entry->rule, &e->rule)) { + found = e; + goto out; + } + } + goto out; + } + + list_for_each_entry(e, list, list) + if (!audit_compare_rule(&entry->rule, &e->rule)) { + found = e; + goto out; + } + +out: + return found; +} + /* Get path information necessary for adding watches. */ static int audit_get_nd(char *path, struct nameidata **ndp, struct nameidata **ndw) @@ -1017,16 +1048,18 @@ static inline int audit_add_rule(struct struct nameidata *ndp, *ndw; int h, err, putnd_needed = 0; - /* Taking audit_filter_mutex protects from stale rule data. */ - mutex_lock(&audit_filter_mutex); - list_for_each_entry(e, list, list) { - if (!audit_compare_rule(&entry->rule, &e->rule)) { - err = -EEXIST; - mutex_unlock(&audit_filter_mutex); - goto error; - } + if (inode_f) { + h = audit_hash_ino(inode_f->val); + list = &audit_inode_hash[h]; } + + mutex_lock(&audit_filter_mutex); + e = audit_find_rule(entry, list); mutex_unlock(&audit_filter_mutex); + if (e) { + err = -EEXIST; + goto error; + } /* Avoid calling path_lookup under audit_filter_mutex. */ if (watch) { @@ -1046,9 +1079,6 @@ static inline int audit_add_rule(struct } h = audit_hash_ino((u32)watch->ino); list = &audit_inode_hash[h]; - } else if (inode_f) { - h = audit_hash_ino(inode_f->val); - list = &audit_inode_hash[h]; } if (entry->rule.flags & AUDIT_FILTER_PREPEND) { -- 1.3.0