xref: /openbmc/linux/kernel/auditfilter.c (revision 4b4f3acc)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* auditfilter.c -- filtering of audit events
3  *
4  * Copyright 2003-2004 Red Hat, Inc.
5  * Copyright 2005 Hewlett-Packard Development Company, L.P.
6  * Copyright 2005 IBM Corporation
7  */
8 
9 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
10 
11 #include <linux/kernel.h>
12 #include <linux/audit.h>
13 #include <linux/kthread.h>
14 #include <linux/mutex.h>
15 #include <linux/fs.h>
16 #include <linux/namei.h>
17 #include <linux/netlink.h>
18 #include <linux/sched.h>
19 #include <linux/slab.h>
20 #include <linux/security.h>
21 #include <net/net_namespace.h>
22 #include <net/sock.h>
23 #include "audit.h"
24 
25 /*
26  * Locking model:
27  *
28  * audit_filter_mutex:
29  *		Synchronizes writes and blocking reads of audit's filterlist
30  *		data.  Rcu is used to traverse the filterlist and access
31  *		contents of structs audit_entry, audit_watch and opaque
32  *		LSM rules during filtering.  If modified, these structures
33  *		must be copied and replace their counterparts in the filterlist.
34  *		An audit_parent struct is not accessed during filtering, so may
35  *		be written directly provided audit_filter_mutex is held.
36  */
37 
38 /* Audit filter lists, defined in <linux/audit.h> */
39 struct list_head audit_filter_list[AUDIT_NR_FILTERS] = {
40 	LIST_HEAD_INIT(audit_filter_list[0]),
41 	LIST_HEAD_INIT(audit_filter_list[1]),
42 	LIST_HEAD_INIT(audit_filter_list[2]),
43 	LIST_HEAD_INIT(audit_filter_list[3]),
44 	LIST_HEAD_INIT(audit_filter_list[4]),
45 	LIST_HEAD_INIT(audit_filter_list[5]),
46 	LIST_HEAD_INIT(audit_filter_list[6]),
47 #if AUDIT_NR_FILTERS != 7
48 #error Fix audit_filter_list initialiser
49 #endif
50 };
51 static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = {
52 	LIST_HEAD_INIT(audit_rules_list[0]),
53 	LIST_HEAD_INIT(audit_rules_list[1]),
54 	LIST_HEAD_INIT(audit_rules_list[2]),
55 	LIST_HEAD_INIT(audit_rules_list[3]),
56 	LIST_HEAD_INIT(audit_rules_list[4]),
57 	LIST_HEAD_INIT(audit_rules_list[5]),
58 	LIST_HEAD_INIT(audit_rules_list[6]),
59 };
60 
61 DEFINE_MUTEX(audit_filter_mutex);
62 
63 static void audit_free_lsm_field(struct audit_field *f)
64 {
65 	switch (f->type) {
66 	case AUDIT_SUBJ_USER:
67 	case AUDIT_SUBJ_ROLE:
68 	case AUDIT_SUBJ_TYPE:
69 	case AUDIT_SUBJ_SEN:
70 	case AUDIT_SUBJ_CLR:
71 	case AUDIT_OBJ_USER:
72 	case AUDIT_OBJ_ROLE:
73 	case AUDIT_OBJ_TYPE:
74 	case AUDIT_OBJ_LEV_LOW:
75 	case AUDIT_OBJ_LEV_HIGH:
76 		kfree(f->lsm_str);
77 		security_audit_rule_free(f->lsm_rule);
78 	}
79 }
80 
81 static inline void audit_free_rule(struct audit_entry *e)
82 {
83 	int i;
84 	struct audit_krule *erule = &e->rule;
85 
86 	/* some rules don't have associated watches */
87 	if (erule->watch)
88 		audit_put_watch(erule->watch);
89 	if (erule->fields)
90 		for (i = 0; i < erule->field_count; i++)
91 			audit_free_lsm_field(&erule->fields[i]);
92 	kfree(erule->fields);
93 	kfree(erule->filterkey);
94 	kfree(e);
95 }
96 
97 void audit_free_rule_rcu(struct rcu_head *head)
98 {
99 	struct audit_entry *e = container_of(head, struct audit_entry, rcu);
100 	audit_free_rule(e);
101 }
102 
103 /* Initialize an audit filterlist entry. */
104 static inline struct audit_entry *audit_init_entry(u32 field_count)
105 {
106 	struct audit_entry *entry;
107 	struct audit_field *fields;
108 
109 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
110 	if (unlikely(!entry))
111 		return NULL;
112 
113 	fields = kcalloc(field_count, sizeof(*fields), GFP_KERNEL);
114 	if (unlikely(!fields)) {
115 		kfree(entry);
116 		return NULL;
117 	}
118 	entry->rule.fields = fields;
119 
120 	return entry;
121 }
122 
123 /* Unpack a filter field's string representation from user-space
124  * buffer. */
125 char *audit_unpack_string(void **bufp, size_t *remain, size_t len)
126 {
127 	char *str;
128 
129 	if (!*bufp || (len == 0) || (len > *remain))
130 		return ERR_PTR(-EINVAL);
131 
132 	/* Of the currently implemented string fields, PATH_MAX
133 	 * defines the longest valid length.
134 	 */
135 	if (len > PATH_MAX)
136 		return ERR_PTR(-ENAMETOOLONG);
137 
138 	str = kmalloc(len + 1, GFP_KERNEL);
139 	if (unlikely(!str))
140 		return ERR_PTR(-ENOMEM);
141 
142 	memcpy(str, *bufp, len);
143 	str[len] = 0;
144 	*bufp += len;
145 	*remain -= len;
146 
147 	return str;
148 }
149 
150 /* Translate an inode field to kernel representation. */
151 static inline int audit_to_inode(struct audit_krule *krule,
152 				 struct audit_field *f)
153 {
154 	if (krule->listnr != AUDIT_FILTER_EXIT ||
155 	    krule->inode_f || krule->watch || krule->tree ||
156 	    (f->op != Audit_equal && f->op != Audit_not_equal))
157 		return -EINVAL;
158 
159 	krule->inode_f = f;
160 	return 0;
161 }
162 
163 static __u32 *classes[AUDIT_SYSCALL_CLASSES];
164 
165 int __init audit_register_class(int class, unsigned *list)
166 {
167 	__u32 *p = kcalloc(AUDIT_BITMASK_SIZE, sizeof(__u32), GFP_KERNEL);
168 	if (!p)
169 		return -ENOMEM;
170 	while (*list != ~0U) {
171 		unsigned n = *list++;
172 		if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) {
173 			kfree(p);
174 			return -EINVAL;
175 		}
176 		p[AUDIT_WORD(n)] |= AUDIT_BIT(n);
177 	}
178 	if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) {
179 		kfree(p);
180 		return -EINVAL;
181 	}
182 	classes[class] = p;
183 	return 0;
184 }
185 
186 int audit_match_class(int class, unsigned syscall)
187 {
188 	if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32))
189 		return 0;
190 	if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class]))
191 		return 0;
192 	return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall);
193 }
194 
195 #ifdef CONFIG_AUDITSYSCALL
196 static inline int audit_match_class_bits(int class, u32 *mask)
197 {
198 	int i;
199 
200 	if (classes[class]) {
201 		for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
202 			if (mask[i] & classes[class][i])
203 				return 0;
204 	}
205 	return 1;
206 }
207 
208 static int audit_match_signal(struct audit_entry *entry)
209 {
210 	struct audit_field *arch = entry->rule.arch_f;
211 
212 	if (!arch) {
213 		/* When arch is unspecified, we must check both masks on biarch
214 		 * as syscall number alone is ambiguous. */
215 		return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
216 					       entry->rule.mask) &&
217 			audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
218 					       entry->rule.mask));
219 	}
220 
221 	switch(audit_classify_arch(arch->val)) {
222 	case 0: /* native */
223 		return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
224 					       entry->rule.mask));
225 	case 1: /* 32bit on biarch */
226 		return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
227 					       entry->rule.mask));
228 	default:
229 		return 1;
230 	}
231 }
232 #endif
233 
234 /* Common user-space to kernel rule translation. */
235 static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule)
236 {
237 	unsigned listnr;
238 	struct audit_entry *entry;
239 	int i, err;
240 
241 	err = -EINVAL;
242 	listnr = rule->flags & ~AUDIT_FILTER_PREPEND;
243 	switch(listnr) {
244 	default:
245 		goto exit_err;
246 #ifdef CONFIG_AUDITSYSCALL
247 	case AUDIT_FILTER_ENTRY:
248 		pr_err("AUDIT_FILTER_ENTRY is deprecated\n");
249 		goto exit_err;
250 	case AUDIT_FILTER_EXIT:
251 	case AUDIT_FILTER_TASK:
252 #endif
253 	case AUDIT_FILTER_USER:
254 	case AUDIT_FILTER_EXCLUDE:
255 	case AUDIT_FILTER_FS:
256 		;
257 	}
258 	if (unlikely(rule->action == AUDIT_POSSIBLE)) {
259 		pr_err("AUDIT_POSSIBLE is deprecated\n");
260 		goto exit_err;
261 	}
262 	if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS)
263 		goto exit_err;
264 	if (rule->field_count > AUDIT_MAX_FIELDS)
265 		goto exit_err;
266 
267 	err = -ENOMEM;
268 	entry = audit_init_entry(rule->field_count);
269 	if (!entry)
270 		goto exit_err;
271 
272 	entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;
273 	entry->rule.listnr = listnr;
274 	entry->rule.action = rule->action;
275 	entry->rule.field_count = rule->field_count;
276 
277 	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
278 		entry->rule.mask[i] = rule->mask[i];
279 
280 	for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) {
281 		int bit = AUDIT_BITMASK_SIZE * 32 - i - 1;
282 		__u32 *p = &entry->rule.mask[AUDIT_WORD(bit)];
283 		__u32 *class;
284 
285 		if (!(*p & AUDIT_BIT(bit)))
286 			continue;
287 		*p &= ~AUDIT_BIT(bit);
288 		class = classes[i];
289 		if (class) {
290 			int j;
291 			for (j = 0; j < AUDIT_BITMASK_SIZE; j++)
292 				entry->rule.mask[j] |= class[j];
293 		}
294 	}
295 
296 	return entry;
297 
298 exit_err:
299 	return ERR_PTR(err);
300 }
301 
302 static u32 audit_ops[] =
303 {
304 	[Audit_equal] = AUDIT_EQUAL,
305 	[Audit_not_equal] = AUDIT_NOT_EQUAL,
306 	[Audit_bitmask] = AUDIT_BIT_MASK,
307 	[Audit_bittest] = AUDIT_BIT_TEST,
308 	[Audit_lt] = AUDIT_LESS_THAN,
309 	[Audit_gt] = AUDIT_GREATER_THAN,
310 	[Audit_le] = AUDIT_LESS_THAN_OR_EQUAL,
311 	[Audit_ge] = AUDIT_GREATER_THAN_OR_EQUAL,
312 };
313 
314 static u32 audit_to_op(u32 op)
315 {
316 	u32 n;
317 	for (n = Audit_equal; n < Audit_bad && audit_ops[n] != op; n++)
318 		;
319 	return n;
320 }
321 
322 /* check if an audit field is valid */
323 static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
324 {
325 	switch(f->type) {
326 	case AUDIT_MSGTYPE:
327 		if (entry->rule.listnr != AUDIT_FILTER_EXCLUDE &&
328 		    entry->rule.listnr != AUDIT_FILTER_USER)
329 			return -EINVAL;
330 		break;
331 	case AUDIT_FSTYPE:
332 		if (entry->rule.listnr != AUDIT_FILTER_FS)
333 			return -EINVAL;
334 		break;
335 	}
336 
337 	switch(entry->rule.listnr) {
338 	case AUDIT_FILTER_FS:
339 		switch(f->type) {
340 		case AUDIT_FSTYPE:
341 		case AUDIT_FILTERKEY:
342 			break;
343 		default:
344 			return -EINVAL;
345 		}
346 	}
347 
348 	switch(f->type) {
349 	default:
350 		return -EINVAL;
351 	case AUDIT_UID:
352 	case AUDIT_EUID:
353 	case AUDIT_SUID:
354 	case AUDIT_FSUID:
355 	case AUDIT_LOGINUID:
356 	case AUDIT_OBJ_UID:
357 	case AUDIT_GID:
358 	case AUDIT_EGID:
359 	case AUDIT_SGID:
360 	case AUDIT_FSGID:
361 	case AUDIT_OBJ_GID:
362 	case AUDIT_PID:
363 	case AUDIT_PERS:
364 	case AUDIT_MSGTYPE:
365 	case AUDIT_PPID:
366 	case AUDIT_DEVMAJOR:
367 	case AUDIT_DEVMINOR:
368 	case AUDIT_EXIT:
369 	case AUDIT_SUCCESS:
370 	case AUDIT_INODE:
371 	case AUDIT_SESSIONID:
372 		/* bit ops are only useful on syscall args */
373 		if (f->op == Audit_bitmask || f->op == Audit_bittest)
374 			return -EINVAL;
375 		break;
376 	case AUDIT_ARG0:
377 	case AUDIT_ARG1:
378 	case AUDIT_ARG2:
379 	case AUDIT_ARG3:
380 	case AUDIT_SUBJ_USER:
381 	case AUDIT_SUBJ_ROLE:
382 	case AUDIT_SUBJ_TYPE:
383 	case AUDIT_SUBJ_SEN:
384 	case AUDIT_SUBJ_CLR:
385 	case AUDIT_OBJ_USER:
386 	case AUDIT_OBJ_ROLE:
387 	case AUDIT_OBJ_TYPE:
388 	case AUDIT_OBJ_LEV_LOW:
389 	case AUDIT_OBJ_LEV_HIGH:
390 	case AUDIT_WATCH:
391 	case AUDIT_DIR:
392 	case AUDIT_FILTERKEY:
393 		break;
394 	case AUDIT_LOGINUID_SET:
395 		if ((f->val != 0) && (f->val != 1))
396 			return -EINVAL;
397 	/* FALL THROUGH */
398 	case AUDIT_ARCH:
399 	case AUDIT_FSTYPE:
400 		if (f->op != Audit_not_equal && f->op != Audit_equal)
401 			return -EINVAL;
402 		break;
403 	case AUDIT_PERM:
404 		if (f->val & ~15)
405 			return -EINVAL;
406 		break;
407 	case AUDIT_FILETYPE:
408 		if (f->val & ~S_IFMT)
409 			return -EINVAL;
410 		break;
411 	case AUDIT_FIELD_COMPARE:
412 		if (f->val > AUDIT_MAX_FIELD_COMPARE)
413 			return -EINVAL;
414 		break;
415 	case AUDIT_EXE:
416 		if (f->op != Audit_not_equal && f->op != Audit_equal)
417 			return -EINVAL;
418 		break;
419 	}
420 	return 0;
421 }
422 
423 /* Translate struct audit_rule_data to kernel's rule representation. */
424 static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
425 					       size_t datasz)
426 {
427 	int err = 0;
428 	struct audit_entry *entry;
429 	void *bufp;
430 	size_t remain = datasz - sizeof(struct audit_rule_data);
431 	int i;
432 	char *str;
433 	struct audit_fsnotify_mark *audit_mark;
434 
435 	entry = audit_to_entry_common(data);
436 	if (IS_ERR(entry))
437 		goto exit_nofree;
438 
439 	bufp = data->buf;
440 	for (i = 0; i < data->field_count; i++) {
441 		struct audit_field *f = &entry->rule.fields[i];
442 
443 		err = -EINVAL;
444 
445 		f->op = audit_to_op(data->fieldflags[i]);
446 		if (f->op == Audit_bad)
447 			goto exit_free;
448 
449 		f->type = data->fields[i];
450 		f->val = data->values[i];
451 
452 		/* Support legacy tests for a valid loginuid */
453 		if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {
454 			f->type = AUDIT_LOGINUID_SET;
455 			f->val = 0;
456 			entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;
457 		}
458 
459 		err = audit_field_valid(entry, f);
460 		if (err)
461 			goto exit_free;
462 
463 		err = -EINVAL;
464 		switch (f->type) {
465 		case AUDIT_LOGINUID:
466 		case AUDIT_UID:
467 		case AUDIT_EUID:
468 		case AUDIT_SUID:
469 		case AUDIT_FSUID:
470 		case AUDIT_OBJ_UID:
471 			f->uid = make_kuid(current_user_ns(), f->val);
472 			if (!uid_valid(f->uid))
473 				goto exit_free;
474 			break;
475 		case AUDIT_GID:
476 		case AUDIT_EGID:
477 		case AUDIT_SGID:
478 		case AUDIT_FSGID:
479 		case AUDIT_OBJ_GID:
480 			f->gid = make_kgid(current_user_ns(), f->val);
481 			if (!gid_valid(f->gid))
482 				goto exit_free;
483 			break;
484 		case AUDIT_ARCH:
485 			entry->rule.arch_f = f;
486 			break;
487 		case AUDIT_SUBJ_USER:
488 		case AUDIT_SUBJ_ROLE:
489 		case AUDIT_SUBJ_TYPE:
490 		case AUDIT_SUBJ_SEN:
491 		case AUDIT_SUBJ_CLR:
492 		case AUDIT_OBJ_USER:
493 		case AUDIT_OBJ_ROLE:
494 		case AUDIT_OBJ_TYPE:
495 		case AUDIT_OBJ_LEV_LOW:
496 		case AUDIT_OBJ_LEV_HIGH:
497 			str = audit_unpack_string(&bufp, &remain, f->val);
498 			if (IS_ERR(str))
499 				goto exit_free;
500 			entry->rule.buflen += f->val;
501 
502 			err = security_audit_rule_init(f->type, f->op, str,
503 						       (void **)&f->lsm_rule);
504 			/* Keep currently invalid fields around in case they
505 			 * become valid after a policy reload. */
506 			if (err == -EINVAL) {
507 				pr_warn("audit rule for LSM \'%s\' is invalid\n",
508 					str);
509 				err = 0;
510 			}
511 			if (err) {
512 				kfree(str);
513 				goto exit_free;
514 			} else
515 				f->lsm_str = str;
516 			break;
517 		case AUDIT_WATCH:
518 			str = audit_unpack_string(&bufp, &remain, f->val);
519 			if (IS_ERR(str))
520 				goto exit_free;
521 			entry->rule.buflen += f->val;
522 
523 			err = audit_to_watch(&entry->rule, str, f->val, f->op);
524 			if (err) {
525 				kfree(str);
526 				goto exit_free;
527 			}
528 			break;
529 		case AUDIT_DIR:
530 			str = audit_unpack_string(&bufp, &remain, f->val);
531 			if (IS_ERR(str))
532 				goto exit_free;
533 			entry->rule.buflen += f->val;
534 
535 			err = audit_make_tree(&entry->rule, str, f->op);
536 			kfree(str);
537 			if (err)
538 				goto exit_free;
539 			break;
540 		case AUDIT_INODE:
541 			err = audit_to_inode(&entry->rule, f);
542 			if (err)
543 				goto exit_free;
544 			break;
545 		case AUDIT_FILTERKEY:
546 			if (entry->rule.filterkey || f->val > AUDIT_MAX_KEY_LEN)
547 				goto exit_free;
548 			str = audit_unpack_string(&bufp, &remain, f->val);
549 			if (IS_ERR(str))
550 				goto exit_free;
551 			entry->rule.buflen += f->val;
552 			entry->rule.filterkey = str;
553 			break;
554 		case AUDIT_EXE:
555 			if (entry->rule.exe || f->val > PATH_MAX)
556 				goto exit_free;
557 			str = audit_unpack_string(&bufp, &remain, f->val);
558 			if (IS_ERR(str)) {
559 				err = PTR_ERR(str);
560 				goto exit_free;
561 			}
562 			entry->rule.buflen += f->val;
563 
564 			audit_mark = audit_alloc_mark(&entry->rule, str, f->val);
565 			if (IS_ERR(audit_mark)) {
566 				kfree(str);
567 				err = PTR_ERR(audit_mark);
568 				goto exit_free;
569 			}
570 			entry->rule.exe = audit_mark;
571 			break;
572 		}
573 	}
574 
575 	if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)
576 		entry->rule.inode_f = NULL;
577 
578 exit_nofree:
579 	return entry;
580 
581 exit_free:
582 	if (entry->rule.tree)
583 		audit_put_tree(entry->rule.tree); /* that's the temporary one */
584 	if (entry->rule.exe)
585 		audit_remove_mark(entry->rule.exe); /* that's the template one */
586 	audit_free_rule(entry);
587 	return ERR_PTR(err);
588 }
589 
590 /* Pack a filter field's string representation into data block. */
591 static inline size_t audit_pack_string(void **bufp, const char *str)
592 {
593 	size_t len = strlen(str);
594 
595 	memcpy(*bufp, str, len);
596 	*bufp += len;
597 
598 	return len;
599 }
600 
601 /* Translate kernel rule representation to struct audit_rule_data. */
602 static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
603 {
604 	struct audit_rule_data *data;
605 	void *bufp;
606 	int i;
607 
608 	data = kmalloc(sizeof(*data) + krule->buflen, GFP_KERNEL);
609 	if (unlikely(!data))
610 		return NULL;
611 	memset(data, 0, sizeof(*data));
612 
613 	data->flags = krule->flags | krule->listnr;
614 	data->action = krule->action;
615 	data->field_count = krule->field_count;
616 	bufp = data->buf;
617 	for (i = 0; i < data->field_count; i++) {
618 		struct audit_field *f = &krule->fields[i];
619 
620 		data->fields[i] = f->type;
621 		data->fieldflags[i] = audit_ops[f->op];
622 		switch(f->type) {
623 		case AUDIT_SUBJ_USER:
624 		case AUDIT_SUBJ_ROLE:
625 		case AUDIT_SUBJ_TYPE:
626 		case AUDIT_SUBJ_SEN:
627 		case AUDIT_SUBJ_CLR:
628 		case AUDIT_OBJ_USER:
629 		case AUDIT_OBJ_ROLE:
630 		case AUDIT_OBJ_TYPE:
631 		case AUDIT_OBJ_LEV_LOW:
632 		case AUDIT_OBJ_LEV_HIGH:
633 			data->buflen += data->values[i] =
634 				audit_pack_string(&bufp, f->lsm_str);
635 			break;
636 		case AUDIT_WATCH:
637 			data->buflen += data->values[i] =
638 				audit_pack_string(&bufp,
639 						  audit_watch_path(krule->watch));
640 			break;
641 		case AUDIT_DIR:
642 			data->buflen += data->values[i] =
643 				audit_pack_string(&bufp,
644 						  audit_tree_path(krule->tree));
645 			break;
646 		case AUDIT_FILTERKEY:
647 			data->buflen += data->values[i] =
648 				audit_pack_string(&bufp, krule->filterkey);
649 			break;
650 		case AUDIT_EXE:
651 			data->buflen += data->values[i] =
652 				audit_pack_string(&bufp, audit_mark_path(krule->exe));
653 			break;
654 		case AUDIT_LOGINUID_SET:
655 			if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {
656 				data->fields[i] = AUDIT_LOGINUID;
657 				data->values[i] = AUDIT_UID_UNSET;
658 				break;
659 			}
660 			/* fall through - if set */
661 		default:
662 			data->values[i] = f->val;
663 		}
664 	}
665 	for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i];
666 
667 	return data;
668 }
669 
670 /* Compare two rules in kernel format.  Considered success if rules
671  * don't match. */
672 static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
673 {
674 	int i;
675 
676 	if (a->flags != b->flags ||
677 	    a->pflags != b->pflags ||
678 	    a->listnr != b->listnr ||
679 	    a->action != b->action ||
680 	    a->field_count != b->field_count)
681 		return 1;
682 
683 	for (i = 0; i < a->field_count; i++) {
684 		if (a->fields[i].type != b->fields[i].type ||
685 		    a->fields[i].op != b->fields[i].op)
686 			return 1;
687 
688 		switch(a->fields[i].type) {
689 		case AUDIT_SUBJ_USER:
690 		case AUDIT_SUBJ_ROLE:
691 		case AUDIT_SUBJ_TYPE:
692 		case AUDIT_SUBJ_SEN:
693 		case AUDIT_SUBJ_CLR:
694 		case AUDIT_OBJ_USER:
695 		case AUDIT_OBJ_ROLE:
696 		case AUDIT_OBJ_TYPE:
697 		case AUDIT_OBJ_LEV_LOW:
698 		case AUDIT_OBJ_LEV_HIGH:
699 			if (strcmp(a->fields[i].lsm_str, b->fields[i].lsm_str))
700 				return 1;
701 			break;
702 		case AUDIT_WATCH:
703 			if (strcmp(audit_watch_path(a->watch),
704 				   audit_watch_path(b->watch)))
705 				return 1;
706 			break;
707 		case AUDIT_DIR:
708 			if (strcmp(audit_tree_path(a->tree),
709 				   audit_tree_path(b->tree)))
710 				return 1;
711 			break;
712 		case AUDIT_FILTERKEY:
713 			/* both filterkeys exist based on above type compare */
714 			if (strcmp(a->filterkey, b->filterkey))
715 				return 1;
716 			break;
717 		case AUDIT_EXE:
718 			/* both paths exist based on above type compare */
719 			if (strcmp(audit_mark_path(a->exe),
720 				   audit_mark_path(b->exe)))
721 				return 1;
722 			break;
723 		case AUDIT_UID:
724 		case AUDIT_EUID:
725 		case AUDIT_SUID:
726 		case AUDIT_FSUID:
727 		case AUDIT_LOGINUID:
728 		case AUDIT_OBJ_UID:
729 			if (!uid_eq(a->fields[i].uid, b->fields[i].uid))
730 				return 1;
731 			break;
732 		case AUDIT_GID:
733 		case AUDIT_EGID:
734 		case AUDIT_SGID:
735 		case AUDIT_FSGID:
736 		case AUDIT_OBJ_GID:
737 			if (!gid_eq(a->fields[i].gid, b->fields[i].gid))
738 				return 1;
739 			break;
740 		default:
741 			if (a->fields[i].val != b->fields[i].val)
742 				return 1;
743 		}
744 	}
745 
746 	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
747 		if (a->mask[i] != b->mask[i])
748 			return 1;
749 
750 	return 0;
751 }
752 
753 /* Duplicate LSM field information.  The lsm_rule is opaque, so must be
754  * re-initialized. */
755 static inline int audit_dupe_lsm_field(struct audit_field *df,
756 					   struct audit_field *sf)
757 {
758 	int ret = 0;
759 	char *lsm_str;
760 
761 	/* our own copy of lsm_str */
762 	lsm_str = kstrdup(sf->lsm_str, GFP_KERNEL);
763 	if (unlikely(!lsm_str))
764 		return -ENOMEM;
765 	df->lsm_str = lsm_str;
766 
767 	/* our own (refreshed) copy of lsm_rule */
768 	ret = security_audit_rule_init(df->type, df->op, df->lsm_str,
769 				       (void **)&df->lsm_rule);
770 	/* Keep currently invalid fields around in case they
771 	 * become valid after a policy reload. */
772 	if (ret == -EINVAL) {
773 		pr_warn("audit rule for LSM \'%s\' is invalid\n",
774 			df->lsm_str);
775 		ret = 0;
776 	}
777 
778 	return ret;
779 }
780 
781 /* Duplicate an audit rule.  This will be a deep copy with the exception
782  * of the watch - that pointer is carried over.  The LSM specific fields
783  * will be updated in the copy.  The point is to be able to replace the old
784  * rule with the new rule in the filterlist, then free the old rule.
785  * The rlist element is undefined; list manipulations are handled apart from
786  * the initial copy. */
787 struct audit_entry *audit_dupe_rule(struct audit_krule *old)
788 {
789 	u32 fcount = old->field_count;
790 	struct audit_entry *entry;
791 	struct audit_krule *new;
792 	char *fk;
793 	int i, err = 0;
794 
795 	entry = audit_init_entry(fcount);
796 	if (unlikely(!entry))
797 		return ERR_PTR(-ENOMEM);
798 
799 	new = &entry->rule;
800 	new->flags = old->flags;
801 	new->pflags = old->pflags;
802 	new->listnr = old->listnr;
803 	new->action = old->action;
804 	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
805 		new->mask[i] = old->mask[i];
806 	new->prio = old->prio;
807 	new->buflen = old->buflen;
808 	new->inode_f = old->inode_f;
809 	new->field_count = old->field_count;
810 
811 	/*
812 	 * note that we are OK with not refcounting here; audit_match_tree()
813 	 * never dereferences tree and we can't get false positives there
814 	 * since we'd have to have rule gone from the list *and* removed
815 	 * before the chunks found by lookup had been allocated, i.e. before
816 	 * the beginning of list scan.
817 	 */
818 	new->tree = old->tree;
819 	memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount);
820 
821 	/* deep copy this information, updating the lsm_rule fields, because
822 	 * the originals will all be freed when the old rule is freed. */
823 	for (i = 0; i < fcount; i++) {
824 		switch (new->fields[i].type) {
825 		case AUDIT_SUBJ_USER:
826 		case AUDIT_SUBJ_ROLE:
827 		case AUDIT_SUBJ_TYPE:
828 		case AUDIT_SUBJ_SEN:
829 		case AUDIT_SUBJ_CLR:
830 		case AUDIT_OBJ_USER:
831 		case AUDIT_OBJ_ROLE:
832 		case AUDIT_OBJ_TYPE:
833 		case AUDIT_OBJ_LEV_LOW:
834 		case AUDIT_OBJ_LEV_HIGH:
835 			err = audit_dupe_lsm_field(&new->fields[i],
836 						       &old->fields[i]);
837 			break;
838 		case AUDIT_FILTERKEY:
839 			fk = kstrdup(old->filterkey, GFP_KERNEL);
840 			if (unlikely(!fk))
841 				err = -ENOMEM;
842 			else
843 				new->filterkey = fk;
844 			break;
845 		case AUDIT_EXE:
846 			err = audit_dupe_exe(new, old);
847 			break;
848 		}
849 		if (err) {
850 			if (new->exe)
851 				audit_remove_mark(new->exe);
852 			audit_free_rule(entry);
853 			return ERR_PTR(err);
854 		}
855 	}
856 
857 	if (old->watch) {
858 		audit_get_watch(old->watch);
859 		new->watch = old->watch;
860 	}
861 
862 	return entry;
863 }
864 
865 /* Find an existing audit rule.
866  * Caller must hold audit_filter_mutex to prevent stale rule data. */
867 static struct audit_entry *audit_find_rule(struct audit_entry *entry,
868 					   struct list_head **p)
869 {
870 	struct audit_entry *e, *found = NULL;
871 	struct list_head *list;
872 	int h;
873 
874 	if (entry->rule.inode_f) {
875 		h = audit_hash_ino(entry->rule.inode_f->val);
876 		*p = list = &audit_inode_hash[h];
877 	} else if (entry->rule.watch) {
878 		/* we don't know the inode number, so must walk entire hash */
879 		for (h = 0; h < AUDIT_INODE_BUCKETS; h++) {
880 			list = &audit_inode_hash[h];
881 			list_for_each_entry(e, list, list)
882 				if (!audit_compare_rule(&entry->rule, &e->rule)) {
883 					found = e;
884 					goto out;
885 				}
886 		}
887 		goto out;
888 	} else {
889 		*p = list = &audit_filter_list[entry->rule.listnr];
890 	}
891 
892 	list_for_each_entry(e, list, list)
893 		if (!audit_compare_rule(&entry->rule, &e->rule)) {
894 			found = e;
895 			goto out;
896 		}
897 
898 out:
899 	return found;
900 }
901 
902 static u64 prio_low = ~0ULL/2;
903 static u64 prio_high = ~0ULL/2 - 1;
904 
905 /* Add rule to given filterlist if not a duplicate. */
906 static inline int audit_add_rule(struct audit_entry *entry)
907 {
908 	struct audit_entry *e;
909 	struct audit_watch *watch = entry->rule.watch;
910 	struct audit_tree *tree = entry->rule.tree;
911 	struct list_head *list;
912 	int err = 0;
913 #ifdef CONFIG_AUDITSYSCALL
914 	int dont_count = 0;
915 
916 	/* If any of these, don't count towards total */
917 	switch(entry->rule.listnr) {
918 	case AUDIT_FILTER_USER:
919 	case AUDIT_FILTER_EXCLUDE:
920 	case AUDIT_FILTER_FS:
921 		dont_count = 1;
922 	}
923 #endif
924 
925 	mutex_lock(&audit_filter_mutex);
926 	e = audit_find_rule(entry, &list);
927 	if (e) {
928 		mutex_unlock(&audit_filter_mutex);
929 		err = -EEXIST;
930 		/* normally audit_add_tree_rule() will free it on failure */
931 		if (tree)
932 			audit_put_tree(tree);
933 		return err;
934 	}
935 
936 	if (watch) {
937 		/* audit_filter_mutex is dropped and re-taken during this call */
938 		err = audit_add_watch(&entry->rule, &list);
939 		if (err) {
940 			mutex_unlock(&audit_filter_mutex);
941 			/*
942 			 * normally audit_add_tree_rule() will free it
943 			 * on failure
944 			 */
945 			if (tree)
946 				audit_put_tree(tree);
947 			return err;
948 		}
949 	}
950 	if (tree) {
951 		err = audit_add_tree_rule(&entry->rule);
952 		if (err) {
953 			mutex_unlock(&audit_filter_mutex);
954 			return err;
955 		}
956 	}
957 
958 	entry->rule.prio = ~0ULL;
959 	if (entry->rule.listnr == AUDIT_FILTER_EXIT) {
960 		if (entry->rule.flags & AUDIT_FILTER_PREPEND)
961 			entry->rule.prio = ++prio_high;
962 		else
963 			entry->rule.prio = --prio_low;
964 	}
965 
966 	if (entry->rule.flags & AUDIT_FILTER_PREPEND) {
967 		list_add(&entry->rule.list,
968 			 &audit_rules_list[entry->rule.listnr]);
969 		list_add_rcu(&entry->list, list);
970 		entry->rule.flags &= ~AUDIT_FILTER_PREPEND;
971 	} else {
972 		list_add_tail(&entry->rule.list,
973 			      &audit_rules_list[entry->rule.listnr]);
974 		list_add_tail_rcu(&entry->list, list);
975 	}
976 #ifdef CONFIG_AUDITSYSCALL
977 	if (!dont_count)
978 		audit_n_rules++;
979 
980 	if (!audit_match_signal(entry))
981 		audit_signals++;
982 #endif
983 	mutex_unlock(&audit_filter_mutex);
984 
985 	return err;
986 }
987 
988 /* Remove an existing rule from filterlist. */
989 int audit_del_rule(struct audit_entry *entry)
990 {
991 	struct audit_entry  *e;
992 	struct audit_tree *tree = entry->rule.tree;
993 	struct list_head *list;
994 	int ret = 0;
995 #ifdef CONFIG_AUDITSYSCALL
996 	int dont_count = 0;
997 
998 	/* If any of these, don't count towards total */
999 	switch(entry->rule.listnr) {
1000 	case AUDIT_FILTER_USER:
1001 	case AUDIT_FILTER_EXCLUDE:
1002 	case AUDIT_FILTER_FS:
1003 		dont_count = 1;
1004 	}
1005 #endif
1006 
1007 	mutex_lock(&audit_filter_mutex);
1008 	e = audit_find_rule(entry, &list);
1009 	if (!e) {
1010 		ret = -ENOENT;
1011 		goto out;
1012 	}
1013 
1014 	if (e->rule.watch)
1015 		audit_remove_watch_rule(&e->rule);
1016 
1017 	if (e->rule.tree)
1018 		audit_remove_tree_rule(&e->rule);
1019 
1020 	if (e->rule.exe)
1021 		audit_remove_mark_rule(&e->rule);
1022 
1023 #ifdef CONFIG_AUDITSYSCALL
1024 	if (!dont_count)
1025 		audit_n_rules--;
1026 
1027 	if (!audit_match_signal(entry))
1028 		audit_signals--;
1029 #endif
1030 
1031 	list_del_rcu(&e->list);
1032 	list_del(&e->rule.list);
1033 	call_rcu(&e->rcu, audit_free_rule_rcu);
1034 
1035 out:
1036 	mutex_unlock(&audit_filter_mutex);
1037 
1038 	if (tree)
1039 		audit_put_tree(tree);	/* that's the temporary one */
1040 
1041 	return ret;
1042 }
1043 
1044 /* List rules using struct audit_rule_data. */
1045 static void audit_list_rules(int seq, struct sk_buff_head *q)
1046 {
1047 	struct sk_buff *skb;
1048 	struct audit_krule *r;
1049 	int i;
1050 
1051 	/* This is a blocking read, so use audit_filter_mutex instead of rcu
1052 	 * iterator to sync with list writers. */
1053 	for (i=0; i<AUDIT_NR_FILTERS; i++) {
1054 		list_for_each_entry(r, &audit_rules_list[i], list) {
1055 			struct audit_rule_data *data;
1056 
1057 			data = audit_krule_to_data(r);
1058 			if (unlikely(!data))
1059 				break;
1060 			skb = audit_make_reply(seq, AUDIT_LIST_RULES, 0, 1,
1061 					       data,
1062 					       sizeof(*data) + data->buflen);
1063 			if (skb)
1064 				skb_queue_tail(q, skb);
1065 			kfree(data);
1066 		}
1067 	}
1068 	skb = audit_make_reply(seq, AUDIT_LIST_RULES, 1, 1, NULL, 0);
1069 	if (skb)
1070 		skb_queue_tail(q, skb);
1071 }
1072 
1073 /* Log rule additions and removals */
1074 static void audit_log_rule_change(char *action, struct audit_krule *rule, int res)
1075 {
1076 	struct audit_buffer *ab;
1077 
1078 	if (!audit_enabled)
1079 		return;
1080 
1081 	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONFIG_CHANGE);
1082 	if (!ab)
1083 		return;
1084 	audit_log_session_info(ab);
1085 	audit_log_task_context(ab);
1086 	audit_log_format(ab, " op=%s", action);
1087 	audit_log_key(ab, rule->filterkey);
1088 	audit_log_format(ab, " list=%d res=%d", rule->listnr, res);
1089 	audit_log_end(ab);
1090 }
1091 
1092 /**
1093  * audit_rule_change - apply all rules to the specified message type
1094  * @type: audit message type
1095  * @seq: netlink audit message sequence (serial) number
1096  * @data: payload data
1097  * @datasz: size of payload data
1098  */
1099 int audit_rule_change(int type, int seq, void *data, size_t datasz)
1100 {
1101 	int err = 0;
1102 	struct audit_entry *entry;
1103 
1104 	switch (type) {
1105 	case AUDIT_ADD_RULE:
1106 		entry = audit_data_to_entry(data, datasz);
1107 		if (IS_ERR(entry))
1108 			return PTR_ERR(entry);
1109 		err = audit_add_rule(entry);
1110 		audit_log_rule_change("add_rule", &entry->rule, !err);
1111 		break;
1112 	case AUDIT_DEL_RULE:
1113 		entry = audit_data_to_entry(data, datasz);
1114 		if (IS_ERR(entry))
1115 			return PTR_ERR(entry);
1116 		err = audit_del_rule(entry);
1117 		audit_log_rule_change("remove_rule", &entry->rule, !err);
1118 		break;
1119 	default:
1120 		WARN_ON(1);
1121 		return -EINVAL;
1122 	}
1123 
1124 	if (err || type == AUDIT_DEL_RULE) {
1125 		if (entry->rule.exe)
1126 			audit_remove_mark(entry->rule.exe);
1127 		audit_free_rule(entry);
1128 	}
1129 
1130 	return err;
1131 }
1132 
1133 /**
1134  * audit_list_rules_send - list the audit rules
1135  * @request_skb: skb of request we are replying to (used to target the reply)
1136  * @seq: netlink audit message sequence (serial) number
1137  */
1138 int audit_list_rules_send(struct sk_buff *request_skb, int seq)
1139 {
1140 	u32 portid = NETLINK_CB(request_skb).portid;
1141 	struct net *net = sock_net(NETLINK_CB(request_skb).sk);
1142 	struct task_struct *tsk;
1143 	struct audit_netlink_list *dest;
1144 	int err = 0;
1145 
1146 	/* We can't just spew out the rules here because we might fill
1147 	 * the available socket buffer space and deadlock waiting for
1148 	 * auditctl to read from it... which isn't ever going to
1149 	 * happen if we're actually running in the context of auditctl
1150 	 * trying to _send_ the stuff */
1151 
1152 	dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL);
1153 	if (!dest)
1154 		return -ENOMEM;
1155 	dest->net = get_net(net);
1156 	dest->portid = portid;
1157 	skb_queue_head_init(&dest->q);
1158 
1159 	mutex_lock(&audit_filter_mutex);
1160 	audit_list_rules(seq, &dest->q);
1161 	mutex_unlock(&audit_filter_mutex);
1162 
1163 	tsk = kthread_run(audit_send_list, dest, "audit_send_list");
1164 	if (IS_ERR(tsk)) {
1165 		skb_queue_purge(&dest->q);
1166 		kfree(dest);
1167 		err = PTR_ERR(tsk);
1168 	}
1169 
1170 	return err;
1171 }
1172 
1173 int audit_comparator(u32 left, u32 op, u32 right)
1174 {
1175 	switch (op) {
1176 	case Audit_equal:
1177 		return (left == right);
1178 	case Audit_not_equal:
1179 		return (left != right);
1180 	case Audit_lt:
1181 		return (left < right);
1182 	case Audit_le:
1183 		return (left <= right);
1184 	case Audit_gt:
1185 		return (left > right);
1186 	case Audit_ge:
1187 		return (left >= right);
1188 	case Audit_bitmask:
1189 		return (left & right);
1190 	case Audit_bittest:
1191 		return ((left & right) == right);
1192 	default:
1193 		BUG();
1194 		return 0;
1195 	}
1196 }
1197 
1198 int audit_uid_comparator(kuid_t left, u32 op, kuid_t right)
1199 {
1200 	switch (op) {
1201 	case Audit_equal:
1202 		return uid_eq(left, right);
1203 	case Audit_not_equal:
1204 		return !uid_eq(left, right);
1205 	case Audit_lt:
1206 		return uid_lt(left, right);
1207 	case Audit_le:
1208 		return uid_lte(left, right);
1209 	case Audit_gt:
1210 		return uid_gt(left, right);
1211 	case Audit_ge:
1212 		return uid_gte(left, right);
1213 	case Audit_bitmask:
1214 	case Audit_bittest:
1215 	default:
1216 		BUG();
1217 		return 0;
1218 	}
1219 }
1220 
1221 int audit_gid_comparator(kgid_t left, u32 op, kgid_t right)
1222 {
1223 	switch (op) {
1224 	case Audit_equal:
1225 		return gid_eq(left, right);
1226 	case Audit_not_equal:
1227 		return !gid_eq(left, right);
1228 	case Audit_lt:
1229 		return gid_lt(left, right);
1230 	case Audit_le:
1231 		return gid_lte(left, right);
1232 	case Audit_gt:
1233 		return gid_gt(left, right);
1234 	case Audit_ge:
1235 		return gid_gte(left, right);
1236 	case Audit_bitmask:
1237 	case Audit_bittest:
1238 	default:
1239 		BUG();
1240 		return 0;
1241 	}
1242 }
1243 
1244 /**
1245  * parent_len - find the length of the parent portion of a pathname
1246  * @path: pathname of which to determine length
1247  */
1248 int parent_len(const char *path)
1249 {
1250 	int plen;
1251 	const char *p;
1252 
1253 	plen = strlen(path);
1254 
1255 	if (plen == 0)
1256 		return plen;
1257 
1258 	/* disregard trailing slashes */
1259 	p = path + plen - 1;
1260 	while ((*p == '/') && (p > path))
1261 		p--;
1262 
1263 	/* walk backward until we find the next slash or hit beginning */
1264 	while ((*p != '/') && (p > path))
1265 		p--;
1266 
1267 	/* did we find a slash? Then increment to include it in path */
1268 	if (*p == '/')
1269 		p++;
1270 
1271 	return p - path;
1272 }
1273 
1274 /**
1275  * audit_compare_dname_path - compare given dentry name with last component in
1276  * 			      given path. Return of 0 indicates a match.
1277  * @dname:	dentry name that we're comparing
1278  * @path:	full pathname that we're comparing
1279  * @parentlen:	length of the parent if known. Passing in AUDIT_NAME_FULL
1280  * 		here indicates that we must compute this value.
1281  */
1282 int audit_compare_dname_path(const struct qstr *dname, const char *path, int parentlen)
1283 {
1284 	int dlen, pathlen;
1285 	const char *p;
1286 
1287 	dlen = dname->len;
1288 	pathlen = strlen(path);
1289 	if (pathlen < dlen)
1290 		return 1;
1291 
1292 	parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen;
1293 	if (pathlen - parentlen != dlen)
1294 		return 1;
1295 
1296 	p = path + parentlen;
1297 
1298 	return strncmp(p, dname->name, dlen);
1299 }
1300 
1301 int audit_filter(int msgtype, unsigned int listtype)
1302 {
1303 	struct audit_entry *e;
1304 	int ret = 1; /* Audit by default */
1305 
1306 	rcu_read_lock();
1307 	list_for_each_entry_rcu(e, &audit_filter_list[listtype], list) {
1308 		int i, result = 0;
1309 
1310 		for (i = 0; i < e->rule.field_count; i++) {
1311 			struct audit_field *f = &e->rule.fields[i];
1312 			pid_t pid;
1313 			u32 sid;
1314 
1315 			switch (f->type) {
1316 			case AUDIT_PID:
1317 				pid = task_pid_nr(current);
1318 				result = audit_comparator(pid, f->op, f->val);
1319 				break;
1320 			case AUDIT_UID:
1321 				result = audit_uid_comparator(current_uid(), f->op, f->uid);
1322 				break;
1323 			case AUDIT_GID:
1324 				result = audit_gid_comparator(current_gid(), f->op, f->gid);
1325 				break;
1326 			case AUDIT_LOGINUID:
1327 				result = audit_uid_comparator(audit_get_loginuid(current),
1328 							      f->op, f->uid);
1329 				break;
1330 			case AUDIT_LOGINUID_SET:
1331 				result = audit_comparator(audit_loginuid_set(current),
1332 							  f->op, f->val);
1333 				break;
1334 			case AUDIT_MSGTYPE:
1335 				result = audit_comparator(msgtype, f->op, f->val);
1336 				break;
1337 			case AUDIT_SUBJ_USER:
1338 			case AUDIT_SUBJ_ROLE:
1339 			case AUDIT_SUBJ_TYPE:
1340 			case AUDIT_SUBJ_SEN:
1341 			case AUDIT_SUBJ_CLR:
1342 				if (f->lsm_rule) {
1343 					security_task_getsecid(current, &sid);
1344 					result = security_audit_rule_match(sid,
1345 						   f->type, f->op, f->lsm_rule);
1346 				}
1347 				break;
1348 			case AUDIT_EXE:
1349 				result = audit_exe_compare(current, e->rule.exe);
1350 				if (f->op == Audit_not_equal)
1351 					result = !result;
1352 				break;
1353 			default:
1354 				goto unlock_and_return;
1355 			}
1356 			if (result < 0) /* error */
1357 				goto unlock_and_return;
1358 			if (!result)
1359 				break;
1360 		}
1361 		if (result > 0) {
1362 			if (e->rule.action == AUDIT_NEVER || listtype == AUDIT_FILTER_EXCLUDE)
1363 				ret = 0;
1364 			break;
1365 		}
1366 	}
1367 unlock_and_return:
1368 	rcu_read_unlock();
1369 	return ret;
1370 }
1371 
1372 static int update_lsm_rule(struct audit_krule *r)
1373 {
1374 	struct audit_entry *entry = container_of(r, struct audit_entry, rule);
1375 	struct audit_entry *nentry;
1376 	int err = 0;
1377 
1378 	if (!security_audit_rule_known(r))
1379 		return 0;
1380 
1381 	nentry = audit_dupe_rule(r);
1382 	if (entry->rule.exe)
1383 		audit_remove_mark(entry->rule.exe);
1384 	if (IS_ERR(nentry)) {
1385 		/* save the first error encountered for the
1386 		 * return value */
1387 		err = PTR_ERR(nentry);
1388 		audit_panic("error updating LSM filters");
1389 		if (r->watch)
1390 			list_del(&r->rlist);
1391 		list_del_rcu(&entry->list);
1392 		list_del(&r->list);
1393 	} else {
1394 		if (r->watch || r->tree)
1395 			list_replace_init(&r->rlist, &nentry->rule.rlist);
1396 		list_replace_rcu(&entry->list, &nentry->list);
1397 		list_replace(&r->list, &nentry->rule.list);
1398 	}
1399 	call_rcu(&entry->rcu, audit_free_rule_rcu);
1400 
1401 	return err;
1402 }
1403 
1404 /* This function will re-initialize the lsm_rule field of all applicable rules.
1405  * It will traverse the filter lists serarching for rules that contain LSM
1406  * specific filter fields.  When such a rule is found, it is copied, the
1407  * LSM field is re-initialized, and the old rule is replaced with the
1408  * updated rule. */
1409 int audit_update_lsm_rules(void)
1410 {
1411 	struct audit_krule *r, *n;
1412 	int i, err = 0;
1413 
1414 	/* audit_filter_mutex synchronizes the writers */
1415 	mutex_lock(&audit_filter_mutex);
1416 
1417 	for (i = 0; i < AUDIT_NR_FILTERS; i++) {
1418 		list_for_each_entry_safe(r, n, &audit_rules_list[i], list) {
1419 			int res = update_lsm_rule(r);
1420 			if (!err)
1421 				err = res;
1422 		}
1423 	}
1424 	mutex_unlock(&audit_filter_mutex);
1425 
1426 	return err;
1427 }
1428