Linux 2.6.28-rc5
[cris-mirror.git] / kernel / audit_tree.c
blob8b509441f49a2f740a2d709c66cecc73d9896f1c
1 #include "audit.h"
2 #include <linux/inotify.h>
3 #include <linux/namei.h>
4 #include <linux/mount.h>
6 struct audit_tree;
7 struct audit_chunk;
9 struct audit_tree {
10 atomic_t count;
11 int goner;
12 struct audit_chunk *root;
13 struct list_head chunks;
14 struct list_head rules;
15 struct list_head list;
16 struct list_head same_root;
17 struct rcu_head head;
18 char pathname[];
21 struct audit_chunk {
22 struct list_head hash;
23 struct inotify_watch watch;
24 struct list_head trees; /* with root here */
25 int dead;
26 int count;
27 atomic_long_t refs;
28 struct rcu_head head;
29 struct node {
30 struct list_head list;
31 struct audit_tree *owner;
32 unsigned index; /* index; upper bit indicates 'will prune' */
33 } owners[];
36 static LIST_HEAD(tree_list);
37 static LIST_HEAD(prune_list);
40 * One struct chunk is attached to each inode of interest.
41 * We replace struct chunk on tagging/untagging.
42 * Rules have pointer to struct audit_tree.
43 * Rules have struct list_head rlist forming a list of rules over
44 * the same tree.
45 * References to struct chunk are collected at audit_inode{,_child}()
46 * time and used in AUDIT_TREE rule matching.
47 * These references are dropped at the same time we are calling
48 * audit_free_names(), etc.
50 * Cyclic lists galore:
51 * tree.chunks anchors chunk.owners[].list hash_lock
52 * tree.rules anchors rule.rlist audit_filter_mutex
53 * chunk.trees anchors tree.same_root hash_lock
54 * chunk.hash is a hash with middle bits of watch.inode as
55 * a hash function. RCU, hash_lock
57 * tree is refcounted; one reference for "some rules on rules_list refer to
58 * it", one for each chunk with pointer to it.
60 * chunk is refcounted by embedded inotify_watch + .refs (non-zero refcount
61 * of watch contributes 1 to .refs).
63 * node.index allows to get from node.list to containing chunk.
64 * MSB of that sucker is stolen to mark taggings that we might have to
65 * revert - several operations have very unpleasant cleanup logics and
66 * that makes a difference. Some.
69 static struct inotify_handle *rtree_ih;
71 static struct audit_tree *alloc_tree(const char *s)
73 struct audit_tree *tree;
75 tree = kmalloc(sizeof(struct audit_tree) + strlen(s) + 1, GFP_KERNEL);
76 if (tree) {
77 atomic_set(&tree->count, 1);
78 tree->goner = 0;
79 INIT_LIST_HEAD(&tree->chunks);
80 INIT_LIST_HEAD(&tree->rules);
81 INIT_LIST_HEAD(&tree->list);
82 INIT_LIST_HEAD(&tree->same_root);
83 tree->root = NULL;
84 strcpy(tree->pathname, s);
86 return tree;
89 static inline void get_tree(struct audit_tree *tree)
91 atomic_inc(&tree->count);
94 static void __put_tree(struct rcu_head *rcu)
96 struct audit_tree *tree = container_of(rcu, struct audit_tree, head);
97 kfree(tree);
100 static inline void put_tree(struct audit_tree *tree)
102 if (atomic_dec_and_test(&tree->count))
103 call_rcu(&tree->head, __put_tree);
106 /* to avoid bringing the entire thing in audit.h */
107 const char *audit_tree_path(struct audit_tree *tree)
109 return tree->pathname;
112 static struct audit_chunk *alloc_chunk(int count)
114 struct audit_chunk *chunk;
115 size_t size;
116 int i;
118 size = offsetof(struct audit_chunk, owners) + count * sizeof(struct node);
119 chunk = kzalloc(size, GFP_KERNEL);
120 if (!chunk)
121 return NULL;
123 INIT_LIST_HEAD(&chunk->hash);
124 INIT_LIST_HEAD(&chunk->trees);
125 chunk->count = count;
126 atomic_long_set(&chunk->refs, 1);
127 for (i = 0; i < count; i++) {
128 INIT_LIST_HEAD(&chunk->owners[i].list);
129 chunk->owners[i].index = i;
131 inotify_init_watch(&chunk->watch);
132 return chunk;
135 static void free_chunk(struct audit_chunk *chunk)
137 int i;
139 for (i = 0; i < chunk->count; i++) {
140 if (chunk->owners[i].owner)
141 put_tree(chunk->owners[i].owner);
143 kfree(chunk);
146 void audit_put_chunk(struct audit_chunk *chunk)
148 if (atomic_long_dec_and_test(&chunk->refs))
149 free_chunk(chunk);
152 static void __put_chunk(struct rcu_head *rcu)
154 struct audit_chunk *chunk = container_of(rcu, struct audit_chunk, head);
155 audit_put_chunk(chunk);
158 enum {HASH_SIZE = 128};
159 static struct list_head chunk_hash_heads[HASH_SIZE];
160 static __cacheline_aligned_in_smp DEFINE_SPINLOCK(hash_lock);
162 static inline struct list_head *chunk_hash(const struct inode *inode)
164 unsigned long n = (unsigned long)inode / L1_CACHE_BYTES;
165 return chunk_hash_heads + n % HASH_SIZE;
168 /* hash_lock is held by caller */
169 static void insert_hash(struct audit_chunk *chunk)
171 struct list_head *list = chunk_hash(chunk->watch.inode);
172 list_add_rcu(&chunk->hash, list);
175 /* called under rcu_read_lock */
176 struct audit_chunk *audit_tree_lookup(const struct inode *inode)
178 struct list_head *list = chunk_hash(inode);
179 struct audit_chunk *p;
181 list_for_each_entry_rcu(p, list, hash) {
182 if (p->watch.inode == inode) {
183 atomic_long_inc(&p->refs);
184 return p;
187 return NULL;
190 int audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree)
192 int n;
193 for (n = 0; n < chunk->count; n++)
194 if (chunk->owners[n].owner == tree)
195 return 1;
196 return 0;
199 /* tagging and untagging inodes with trees */
201 static struct audit_chunk *find_chunk(struct node *p)
203 int index = p->index & ~(1U<<31);
204 p -= index;
205 return container_of(p, struct audit_chunk, owners[0]);
208 static void untag_chunk(struct node *p)
210 struct audit_chunk *chunk = find_chunk(p);
211 struct audit_chunk *new;
212 struct audit_tree *owner;
213 int size = chunk->count - 1;
214 int i, j;
216 if (!pin_inotify_watch(&chunk->watch)) {
218 * Filesystem is shutting down; all watches are getting
219 * evicted, just take it off the node list for this
220 * tree and let the eviction logics take care of the
221 * rest.
223 owner = p->owner;
224 if (owner->root == chunk) {
225 list_del_init(&owner->same_root);
226 owner->root = NULL;
228 list_del_init(&p->list);
229 p->owner = NULL;
230 put_tree(owner);
231 return;
234 spin_unlock(&hash_lock);
237 * pin_inotify_watch() succeeded, so the watch won't go away
238 * from under us.
240 mutex_lock(&chunk->watch.inode->inotify_mutex);
241 if (chunk->dead) {
242 mutex_unlock(&chunk->watch.inode->inotify_mutex);
243 goto out;
246 owner = p->owner;
248 if (!size) {
249 chunk->dead = 1;
250 spin_lock(&hash_lock);
251 list_del_init(&chunk->trees);
252 if (owner->root == chunk)
253 owner->root = NULL;
254 list_del_init(&p->list);
255 list_del_rcu(&chunk->hash);
256 spin_unlock(&hash_lock);
257 inotify_evict_watch(&chunk->watch);
258 mutex_unlock(&chunk->watch.inode->inotify_mutex);
259 put_inotify_watch(&chunk->watch);
260 goto out;
263 new = alloc_chunk(size);
264 if (!new)
265 goto Fallback;
266 if (inotify_clone_watch(&chunk->watch, &new->watch) < 0) {
267 free_chunk(new);
268 goto Fallback;
271 chunk->dead = 1;
272 spin_lock(&hash_lock);
273 list_replace_init(&chunk->trees, &new->trees);
274 if (owner->root == chunk) {
275 list_del_init(&owner->same_root);
276 owner->root = NULL;
279 for (i = j = 0; i < size; i++, j++) {
280 struct audit_tree *s;
281 if (&chunk->owners[j] == p) {
282 list_del_init(&p->list);
283 i--;
284 continue;
286 s = chunk->owners[j].owner;
287 new->owners[i].owner = s;
288 new->owners[i].index = chunk->owners[j].index - j + i;
289 if (!s) /* result of earlier fallback */
290 continue;
291 get_tree(s);
292 list_replace_init(&chunk->owners[i].list, &new->owners[j].list);
295 list_replace_rcu(&chunk->hash, &new->hash);
296 list_for_each_entry(owner, &new->trees, same_root)
297 owner->root = new;
298 spin_unlock(&hash_lock);
299 inotify_evict_watch(&chunk->watch);
300 mutex_unlock(&chunk->watch.inode->inotify_mutex);
301 put_inotify_watch(&chunk->watch);
302 goto out;
304 Fallback:
305 // do the best we can
306 spin_lock(&hash_lock);
307 if (owner->root == chunk) {
308 list_del_init(&owner->same_root);
309 owner->root = NULL;
311 list_del_init(&p->list);
312 p->owner = NULL;
313 put_tree(owner);
314 spin_unlock(&hash_lock);
315 mutex_unlock(&chunk->watch.inode->inotify_mutex);
316 out:
317 unpin_inotify_watch(&chunk->watch);
318 spin_lock(&hash_lock);
321 static int create_chunk(struct inode *inode, struct audit_tree *tree)
323 struct audit_chunk *chunk = alloc_chunk(1);
324 if (!chunk)
325 return -ENOMEM;
327 if (inotify_add_watch(rtree_ih, &chunk->watch, inode, IN_IGNORED | IN_DELETE_SELF) < 0) {
328 free_chunk(chunk);
329 return -ENOSPC;
332 mutex_lock(&inode->inotify_mutex);
333 spin_lock(&hash_lock);
334 if (tree->goner) {
335 spin_unlock(&hash_lock);
336 chunk->dead = 1;
337 inotify_evict_watch(&chunk->watch);
338 mutex_unlock(&inode->inotify_mutex);
339 put_inotify_watch(&chunk->watch);
340 return 0;
342 chunk->owners[0].index = (1U << 31);
343 chunk->owners[0].owner = tree;
344 get_tree(tree);
345 list_add(&chunk->owners[0].list, &tree->chunks);
346 if (!tree->root) {
347 tree->root = chunk;
348 list_add(&tree->same_root, &chunk->trees);
350 insert_hash(chunk);
351 spin_unlock(&hash_lock);
352 mutex_unlock(&inode->inotify_mutex);
353 return 0;
356 /* the first tagged inode becomes root of tree */
357 static int tag_chunk(struct inode *inode, struct audit_tree *tree)
359 struct inotify_watch *watch;
360 struct audit_tree *owner;
361 struct audit_chunk *chunk, *old;
362 struct node *p;
363 int n;
365 if (inotify_find_watch(rtree_ih, inode, &watch) < 0)
366 return create_chunk(inode, tree);
368 old = container_of(watch, struct audit_chunk, watch);
370 /* are we already there? */
371 spin_lock(&hash_lock);
372 for (n = 0; n < old->count; n++) {
373 if (old->owners[n].owner == tree) {
374 spin_unlock(&hash_lock);
375 put_inotify_watch(watch);
376 return 0;
379 spin_unlock(&hash_lock);
381 chunk = alloc_chunk(old->count + 1);
382 if (!chunk)
383 return -ENOMEM;
385 mutex_lock(&inode->inotify_mutex);
386 if (inotify_clone_watch(&old->watch, &chunk->watch) < 0) {
387 mutex_unlock(&inode->inotify_mutex);
388 free_chunk(chunk);
389 return -ENOSPC;
391 spin_lock(&hash_lock);
392 if (tree->goner) {
393 spin_unlock(&hash_lock);
394 chunk->dead = 1;
395 inotify_evict_watch(&chunk->watch);
396 mutex_unlock(&inode->inotify_mutex);
397 put_inotify_watch(&chunk->watch);
398 return 0;
400 list_replace_init(&old->trees, &chunk->trees);
401 for (n = 0, p = chunk->owners; n < old->count; n++, p++) {
402 struct audit_tree *s = old->owners[n].owner;
403 p->owner = s;
404 p->index = old->owners[n].index;
405 if (!s) /* result of fallback in untag */
406 continue;
407 get_tree(s);
408 list_replace_init(&old->owners[n].list, &p->list);
410 p->index = (chunk->count - 1) | (1U<<31);
411 p->owner = tree;
412 get_tree(tree);
413 list_add(&p->list, &tree->chunks);
414 list_replace_rcu(&old->hash, &chunk->hash);
415 list_for_each_entry(owner, &chunk->trees, same_root)
416 owner->root = chunk;
417 old->dead = 1;
418 if (!tree->root) {
419 tree->root = chunk;
420 list_add(&tree->same_root, &chunk->trees);
422 spin_unlock(&hash_lock);
423 inotify_evict_watch(&old->watch);
424 mutex_unlock(&inode->inotify_mutex);
425 put_inotify_watch(&old->watch);
426 return 0;
429 static void kill_rules(struct audit_tree *tree)
431 struct audit_krule *rule, *next;
432 struct audit_entry *entry;
433 struct audit_buffer *ab;
435 list_for_each_entry_safe(rule, next, &tree->rules, rlist) {
436 entry = container_of(rule, struct audit_entry, rule);
438 list_del_init(&rule->rlist);
439 if (rule->tree) {
440 /* not a half-baked one */
441 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
442 audit_log_format(ab, "op=remove rule dir=");
443 audit_log_untrustedstring(ab, rule->tree->pathname);
444 if (rule->filterkey) {
445 audit_log_format(ab, " key=");
446 audit_log_untrustedstring(ab, rule->filterkey);
447 } else
448 audit_log_format(ab, " key=(null)");
449 audit_log_format(ab, " list=%d res=1", rule->listnr);
450 audit_log_end(ab);
451 rule->tree = NULL;
452 list_del_rcu(&entry->list);
453 call_rcu(&entry->rcu, audit_free_rule_rcu);
459 * finish killing struct audit_tree
461 static void prune_one(struct audit_tree *victim)
463 spin_lock(&hash_lock);
464 while (!list_empty(&victim->chunks)) {
465 struct node *p;
467 p = list_entry(victim->chunks.next, struct node, list);
469 untag_chunk(p);
471 spin_unlock(&hash_lock);
472 put_tree(victim);
475 /* trim the uncommitted chunks from tree */
477 static void trim_marked(struct audit_tree *tree)
479 struct list_head *p, *q;
480 spin_lock(&hash_lock);
481 if (tree->goner) {
482 spin_unlock(&hash_lock);
483 return;
485 /* reorder */
486 for (p = tree->chunks.next; p != &tree->chunks; p = q) {
487 struct node *node = list_entry(p, struct node, list);
488 q = p->next;
489 if (node->index & (1U<<31)) {
490 list_del_init(p);
491 list_add(p, &tree->chunks);
495 while (!list_empty(&tree->chunks)) {
496 struct node *node;
498 node = list_entry(tree->chunks.next, struct node, list);
500 /* have we run out of marked? */
501 if (!(node->index & (1U<<31)))
502 break;
504 untag_chunk(node);
506 if (!tree->root && !tree->goner) {
507 tree->goner = 1;
508 spin_unlock(&hash_lock);
509 mutex_lock(&audit_filter_mutex);
510 kill_rules(tree);
511 list_del_init(&tree->list);
512 mutex_unlock(&audit_filter_mutex);
513 prune_one(tree);
514 } else {
515 spin_unlock(&hash_lock);
519 /* called with audit_filter_mutex */
520 int audit_remove_tree_rule(struct audit_krule *rule)
522 struct audit_tree *tree;
523 tree = rule->tree;
524 if (tree) {
525 spin_lock(&hash_lock);
526 list_del_init(&rule->rlist);
527 if (list_empty(&tree->rules) && !tree->goner) {
528 tree->root = NULL;
529 list_del_init(&tree->same_root);
530 tree->goner = 1;
531 list_move(&tree->list, &prune_list);
532 rule->tree = NULL;
533 spin_unlock(&hash_lock);
534 audit_schedule_prune();
535 return 1;
537 rule->tree = NULL;
538 spin_unlock(&hash_lock);
539 return 1;
541 return 0;
544 void audit_trim_trees(void)
546 struct list_head cursor;
548 mutex_lock(&audit_filter_mutex);
549 list_add(&cursor, &tree_list);
550 while (cursor.next != &tree_list) {
551 struct audit_tree *tree;
552 struct path path;
553 struct vfsmount *root_mnt;
554 struct node *node;
555 struct list_head list;
556 int err;
558 tree = container_of(cursor.next, struct audit_tree, list);
559 get_tree(tree);
560 list_del(&cursor);
561 list_add(&cursor, &tree->list);
562 mutex_unlock(&audit_filter_mutex);
564 err = kern_path(tree->pathname, 0, &path);
565 if (err)
566 goto skip_it;
568 root_mnt = collect_mounts(path.mnt, path.dentry);
569 path_put(&path);
570 if (!root_mnt)
571 goto skip_it;
573 list_add_tail(&list, &root_mnt->mnt_list);
574 spin_lock(&hash_lock);
575 list_for_each_entry(node, &tree->chunks, list) {
576 struct audit_chunk *chunk = find_chunk(node);
577 struct inode *inode = chunk->watch.inode;
578 struct vfsmount *mnt;
579 node->index |= 1U<<31;
580 list_for_each_entry(mnt, &list, mnt_list) {
581 if (mnt->mnt_root->d_inode == inode) {
582 node->index &= ~(1U<<31);
583 break;
587 spin_unlock(&hash_lock);
588 trim_marked(tree);
589 put_tree(tree);
590 list_del_init(&list);
591 drop_collected_mounts(root_mnt);
592 skip_it:
593 mutex_lock(&audit_filter_mutex);
595 list_del(&cursor);
596 mutex_unlock(&audit_filter_mutex);
599 static int is_under(struct vfsmount *mnt, struct dentry *dentry,
600 struct path *path)
602 if (mnt != path->mnt) {
603 for (;;) {
604 if (mnt->mnt_parent == mnt)
605 return 0;
606 if (mnt->mnt_parent == path->mnt)
607 break;
608 mnt = mnt->mnt_parent;
610 dentry = mnt->mnt_mountpoint;
612 return is_subdir(dentry, path->dentry);
615 int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op)
618 if (pathname[0] != '/' ||
619 rule->listnr != AUDIT_FILTER_EXIT ||
620 op & ~AUDIT_EQUAL ||
621 rule->inode_f || rule->watch || rule->tree)
622 return -EINVAL;
623 rule->tree = alloc_tree(pathname);
624 if (!rule->tree)
625 return -ENOMEM;
626 return 0;
629 void audit_put_tree(struct audit_tree *tree)
631 put_tree(tree);
634 /* called with audit_filter_mutex */
635 int audit_add_tree_rule(struct audit_krule *rule)
637 struct audit_tree *seed = rule->tree, *tree;
638 struct path path;
639 struct vfsmount *mnt, *p;
640 struct list_head list;
641 int err;
643 list_for_each_entry(tree, &tree_list, list) {
644 if (!strcmp(seed->pathname, tree->pathname)) {
645 put_tree(seed);
646 rule->tree = tree;
647 list_add(&rule->rlist, &tree->rules);
648 return 0;
651 tree = seed;
652 list_add(&tree->list, &tree_list);
653 list_add(&rule->rlist, &tree->rules);
654 /* do not set rule->tree yet */
655 mutex_unlock(&audit_filter_mutex);
657 err = kern_path(tree->pathname, 0, &path);
658 if (err)
659 goto Err;
660 mnt = collect_mounts(path.mnt, path.dentry);
661 path_put(&path);
662 if (!mnt) {
663 err = -ENOMEM;
664 goto Err;
666 list_add_tail(&list, &mnt->mnt_list);
668 get_tree(tree);
669 list_for_each_entry(p, &list, mnt_list) {
670 err = tag_chunk(p->mnt_root->d_inode, tree);
671 if (err)
672 break;
675 list_del(&list);
676 drop_collected_mounts(mnt);
678 if (!err) {
679 struct node *node;
680 spin_lock(&hash_lock);
681 list_for_each_entry(node, &tree->chunks, list)
682 node->index &= ~(1U<<31);
683 spin_unlock(&hash_lock);
684 } else {
685 trim_marked(tree);
686 goto Err;
689 mutex_lock(&audit_filter_mutex);
690 if (list_empty(&rule->rlist)) {
691 put_tree(tree);
692 return -ENOENT;
694 rule->tree = tree;
695 put_tree(tree);
697 return 0;
698 Err:
699 mutex_lock(&audit_filter_mutex);
700 list_del_init(&tree->list);
701 list_del_init(&tree->rules);
702 put_tree(tree);
703 return err;
706 int audit_tag_tree(char *old, char *new)
708 struct list_head cursor, barrier;
709 int failed = 0;
710 struct path path;
711 struct vfsmount *tagged;
712 struct list_head list;
713 struct vfsmount *mnt;
714 struct dentry *dentry;
715 int err;
717 err = kern_path(new, 0, &path);
718 if (err)
719 return err;
720 tagged = collect_mounts(path.mnt, path.dentry);
721 path_put(&path);
722 if (!tagged)
723 return -ENOMEM;
725 err = kern_path(old, 0, &path);
726 if (err) {
727 drop_collected_mounts(tagged);
728 return err;
730 mnt = mntget(path.mnt);
731 dentry = dget(path.dentry);
732 path_put(&path);
734 if (dentry == tagged->mnt_root && dentry == mnt->mnt_root)
735 follow_up(&mnt, &dentry);
737 list_add_tail(&list, &tagged->mnt_list);
739 mutex_lock(&audit_filter_mutex);
740 list_add(&barrier, &tree_list);
741 list_add(&cursor, &barrier);
743 while (cursor.next != &tree_list) {
744 struct audit_tree *tree;
745 struct vfsmount *p;
747 tree = container_of(cursor.next, struct audit_tree, list);
748 get_tree(tree);
749 list_del(&cursor);
750 list_add(&cursor, &tree->list);
751 mutex_unlock(&audit_filter_mutex);
753 err = kern_path(tree->pathname, 0, &path);
754 if (err) {
755 put_tree(tree);
756 mutex_lock(&audit_filter_mutex);
757 continue;
760 spin_lock(&vfsmount_lock);
761 if (!is_under(mnt, dentry, &path)) {
762 spin_unlock(&vfsmount_lock);
763 path_put(&path);
764 put_tree(tree);
765 mutex_lock(&audit_filter_mutex);
766 continue;
768 spin_unlock(&vfsmount_lock);
769 path_put(&path);
771 list_for_each_entry(p, &list, mnt_list) {
772 failed = tag_chunk(p->mnt_root->d_inode, tree);
773 if (failed)
774 break;
777 if (failed) {
778 put_tree(tree);
779 mutex_lock(&audit_filter_mutex);
780 break;
783 mutex_lock(&audit_filter_mutex);
784 spin_lock(&hash_lock);
785 if (!tree->goner) {
786 list_del(&tree->list);
787 list_add(&tree->list, &tree_list);
789 spin_unlock(&hash_lock);
790 put_tree(tree);
793 while (barrier.prev != &tree_list) {
794 struct audit_tree *tree;
796 tree = container_of(barrier.prev, struct audit_tree, list);
797 get_tree(tree);
798 list_del(&tree->list);
799 list_add(&tree->list, &barrier);
800 mutex_unlock(&audit_filter_mutex);
802 if (!failed) {
803 struct node *node;
804 spin_lock(&hash_lock);
805 list_for_each_entry(node, &tree->chunks, list)
806 node->index &= ~(1U<<31);
807 spin_unlock(&hash_lock);
808 } else {
809 trim_marked(tree);
812 put_tree(tree);
813 mutex_lock(&audit_filter_mutex);
815 list_del(&barrier);
816 list_del(&cursor);
817 list_del(&list);
818 mutex_unlock(&audit_filter_mutex);
819 dput(dentry);
820 mntput(mnt);
821 drop_collected_mounts(tagged);
822 return failed;
826 * That gets run when evict_chunk() ends up needing to kill audit_tree.
827 * Runs from a separate thread, with audit_cmd_mutex held.
829 void audit_prune_trees(void)
831 mutex_lock(&audit_filter_mutex);
833 while (!list_empty(&prune_list)) {
834 struct audit_tree *victim;
836 victim = list_entry(prune_list.next, struct audit_tree, list);
837 list_del_init(&victim->list);
839 mutex_unlock(&audit_filter_mutex);
841 prune_one(victim);
843 mutex_lock(&audit_filter_mutex);
846 mutex_unlock(&audit_filter_mutex);
850 * Here comes the stuff asynchronous to auditctl operations
853 /* inode->inotify_mutex is locked */
854 static void evict_chunk(struct audit_chunk *chunk)
856 struct audit_tree *owner;
857 int n;
859 if (chunk->dead)
860 return;
862 chunk->dead = 1;
863 mutex_lock(&audit_filter_mutex);
864 spin_lock(&hash_lock);
865 while (!list_empty(&chunk->trees)) {
866 owner = list_entry(chunk->trees.next,
867 struct audit_tree, same_root);
868 owner->goner = 1;
869 owner->root = NULL;
870 list_del_init(&owner->same_root);
871 spin_unlock(&hash_lock);
872 kill_rules(owner);
873 list_move(&owner->list, &prune_list);
874 audit_schedule_prune();
875 spin_lock(&hash_lock);
877 list_del_rcu(&chunk->hash);
878 for (n = 0; n < chunk->count; n++)
879 list_del_init(&chunk->owners[n].list);
880 spin_unlock(&hash_lock);
881 mutex_unlock(&audit_filter_mutex);
884 static void handle_event(struct inotify_watch *watch, u32 wd, u32 mask,
885 u32 cookie, const char *dname, struct inode *inode)
887 struct audit_chunk *chunk = container_of(watch, struct audit_chunk, watch);
889 if (mask & IN_IGNORED) {
890 evict_chunk(chunk);
891 put_inotify_watch(watch);
895 static void destroy_watch(struct inotify_watch *watch)
897 struct audit_chunk *chunk = container_of(watch, struct audit_chunk, watch);
898 call_rcu(&chunk->head, __put_chunk);
901 static const struct inotify_operations rtree_inotify_ops = {
902 .handle_event = handle_event,
903 .destroy_watch = destroy_watch,
906 static int __init audit_tree_init(void)
908 int i;
910 rtree_ih = inotify_init(&rtree_inotify_ops);
911 if (IS_ERR(rtree_ih))
912 audit_panic("cannot initialize inotify handle for rectree watches");
914 for (i = 0; i < HASH_SIZE; i++)
915 INIT_LIST_HEAD(&chunk_hash_heads[i]);
917 return 0;
919 __initcall(audit_tree_init);