[PATCH] match audit name data
Make more effort to detect previously collected names, so we don't log multiple PATH records for a single filesystem object. Add audit_inc_name_count() to reduce duplicate code. Signed-off-by: Amy Griffis <amy.griffis@hp.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
parent
4fc03b9beb
commit
5712e88f2b
140
kernel/auditsc.c
140
kernel/auditsc.c
|
@ -78,11 +78,6 @@ extern int audit_enabled;
|
||||||
* for saving names from getname(). */
|
* for saving names from getname(). */
|
||||||
#define AUDIT_NAMES 20
|
#define AUDIT_NAMES 20
|
||||||
|
|
||||||
/* AUDIT_NAMES_RESERVED is the number of slots we reserve in the
|
|
||||||
* audit_context from being used for nameless inodes from
|
|
||||||
* path_lookup. */
|
|
||||||
#define AUDIT_NAMES_RESERVED 7
|
|
||||||
|
|
||||||
/* Indicates that audit should log the full pathname. */
|
/* Indicates that audit should log the full pathname. */
|
||||||
#define AUDIT_NAME_FULL -1
|
#define AUDIT_NAME_FULL -1
|
||||||
|
|
||||||
|
@ -1343,6 +1338,28 @@ void audit_putname(const char *name)
|
||||||
#endif
|
#endif
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static int audit_inc_name_count(struct audit_context *context,
|
||||||
|
const struct inode *inode)
|
||||||
|
{
|
||||||
|
if (context->name_count >= AUDIT_NAMES) {
|
||||||
|
if (inode)
|
||||||
|
printk(KERN_DEBUG "name_count maxed, losing inode data: "
|
||||||
|
"dev=%02x:%02x, inode=%lu",
|
||||||
|
MAJOR(inode->i_sb->s_dev),
|
||||||
|
MINOR(inode->i_sb->s_dev),
|
||||||
|
inode->i_ino);
|
||||||
|
|
||||||
|
else
|
||||||
|
printk(KERN_DEBUG "name_count maxed, losing inode data");
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
context->name_count++;
|
||||||
|
#if AUDIT_DEBUG
|
||||||
|
context->ino_count++;
|
||||||
|
#endif
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
/* Copy inode data into an audit_names. */
|
/* Copy inode data into an audit_names. */
|
||||||
static void audit_copy_inode(struct audit_names *name, const struct inode *inode)
|
static void audit_copy_inode(struct audit_names *name, const struct inode *inode)
|
||||||
{
|
{
|
||||||
|
@ -1380,13 +1397,10 @@ void __audit_inode(const char *name, const struct inode *inode)
|
||||||
else {
|
else {
|
||||||
/* FIXME: how much do we care about inodes that have no
|
/* FIXME: how much do we care about inodes that have no
|
||||||
* associated name? */
|
* associated name? */
|
||||||
if (context->name_count >= AUDIT_NAMES - AUDIT_NAMES_RESERVED)
|
if (audit_inc_name_count(context, inode))
|
||||||
return;
|
return;
|
||||||
idx = context->name_count++;
|
idx = context->name_count - 1;
|
||||||
context->names[idx].name = NULL;
|
context->names[idx].name = NULL;
|
||||||
#if AUDIT_DEBUG
|
|
||||||
++context->ino_count;
|
|
||||||
#endif
|
|
||||||
}
|
}
|
||||||
audit_copy_inode(&context->names[idx], inode);
|
audit_copy_inode(&context->names[idx], inode);
|
||||||
}
|
}
|
||||||
|
@ -1410,7 +1424,7 @@ void __audit_inode_child(const char *dname, const struct inode *inode,
|
||||||
{
|
{
|
||||||
int idx;
|
int idx;
|
||||||
struct audit_context *context = current->audit_context;
|
struct audit_context *context = current->audit_context;
|
||||||
const char *found_name = NULL;
|
const char *found_parent = NULL, *found_child = NULL;
|
||||||
int dirlen = 0;
|
int dirlen = 0;
|
||||||
|
|
||||||
if (!context->in_syscall)
|
if (!context->in_syscall)
|
||||||
|
@ -1418,61 +1432,73 @@ void __audit_inode_child(const char *dname, const struct inode *inode,
|
||||||
|
|
||||||
/* determine matching parent */
|
/* determine matching parent */
|
||||||
if (!dname)
|
if (!dname)
|
||||||
goto update_context;
|
goto add_names;
|
||||||
for (idx = 0; idx < context->name_count; idx++)
|
|
||||||
if (context->names[idx].ino == parent->i_ino) {
|
|
||||||
const char *name = context->names[idx].name;
|
|
||||||
|
|
||||||
if (!name)
|
/* parent is more likely, look for it first */
|
||||||
continue;
|
for (idx = 0; idx < context->name_count; idx++) {
|
||||||
|
struct audit_names *n = &context->names[idx];
|
||||||
|
|
||||||
if (audit_compare_dname_path(dname, name, &dirlen) == 0) {
|
if (!n->name)
|
||||||
context->names[idx].name_len = dirlen;
|
continue;
|
||||||
found_name = name;
|
|
||||||
break;
|
if (n->ino == parent->i_ino &&
|
||||||
}
|
!audit_compare_dname_path(dname, n->name, &dirlen)) {
|
||||||
|
n->name_len = dirlen; /* update parent data in place */
|
||||||
|
found_parent = n->name;
|
||||||
|
goto add_names;
|
||||||
}
|
}
|
||||||
|
|
||||||
update_context:
|
|
||||||
idx = context->name_count;
|
|
||||||
if (context->name_count == AUDIT_NAMES) {
|
|
||||||
printk(KERN_DEBUG "name_count maxed and losing %s\n",
|
|
||||||
found_name ?: "(null)");
|
|
||||||
return;
|
|
||||||
}
|
}
|
||||||
context->name_count++;
|
|
||||||
#if AUDIT_DEBUG
|
|
||||||
context->ino_count++;
|
|
||||||
#endif
|
|
||||||
/* Re-use the name belonging to the slot for a matching parent directory.
|
|
||||||
* All names for this context are relinquished in audit_free_names() */
|
|
||||||
context->names[idx].name = found_name;
|
|
||||||
context->names[idx].name_len = AUDIT_NAME_FULL;
|
|
||||||
context->names[idx].name_put = 0; /* don't call __putname() */
|
|
||||||
|
|
||||||
if (!inode)
|
/* no matching parent, look for matching child */
|
||||||
context->names[idx].ino = (unsigned long)-1;
|
for (idx = 0; idx < context->name_count; idx++) {
|
||||||
else
|
struct audit_names *n = &context->names[idx];
|
||||||
audit_copy_inode(&context->names[idx], inode);
|
|
||||||
|
|
||||||
/* A parent was not found in audit_names, so copy the inode data for the
|
if (!n->name)
|
||||||
* provided parent. */
|
continue;
|
||||||
if (!found_name) {
|
|
||||||
idx = context->name_count;
|
/* strcmp() is the more likely scenario */
|
||||||
if (context->name_count == AUDIT_NAMES) {
|
if (!strcmp(dname, n->name) ||
|
||||||
printk(KERN_DEBUG
|
!audit_compare_dname_path(dname, n->name, &dirlen)) {
|
||||||
"name_count maxed and losing parent inode data: dev=%02x:%02x, inode=%lu",
|
if (inode)
|
||||||
MAJOR(parent->i_sb->s_dev),
|
audit_copy_inode(n, inode);
|
||||||
MINOR(parent->i_sb->s_dev),
|
else
|
||||||
parent->i_ino);
|
n->ino = (unsigned long)-1;
|
||||||
return;
|
found_child = n->name;
|
||||||
|
goto add_names;
|
||||||
}
|
}
|
||||||
context->name_count++;
|
}
|
||||||
#if AUDIT_DEBUG
|
|
||||||
context->ino_count++;
|
add_names:
|
||||||
#endif
|
if (!found_parent) {
|
||||||
|
if (audit_inc_name_count(context, parent))
|
||||||
|
return;
|
||||||
|
idx = context->name_count - 1;
|
||||||
|
context->names[idx].name = NULL;
|
||||||
audit_copy_inode(&context->names[idx], parent);
|
audit_copy_inode(&context->names[idx], parent);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (!found_child) {
|
||||||
|
if (audit_inc_name_count(context, inode))
|
||||||
|
return;
|
||||||
|
idx = context->name_count - 1;
|
||||||
|
|
||||||
|
/* Re-use the name belonging to the slot for a matching parent
|
||||||
|
* directory. All names for this context are relinquished in
|
||||||
|
* audit_free_names() */
|
||||||
|
if (found_parent) {
|
||||||
|
context->names[idx].name = found_parent;
|
||||||
|
context->names[idx].name_len = AUDIT_NAME_FULL;
|
||||||
|
/* don't call __putname() */
|
||||||
|
context->names[idx].name_put = 0;
|
||||||
|
} else {
|
||||||
|
context->names[idx].name = NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (inode)
|
||||||
|
audit_copy_inode(&context->names[idx], inode);
|
||||||
|
else
|
||||||
|
context->names[idx].ino = (unsigned long)-1;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
Loading…
Reference in a new issue