2.6.24-rc8

 kernel

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 04f3ffb..bce9ecd 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -45,7 +45,6 @@
 #include <linux/init.h>
 #include <asm/types.h>
 #include <asm/atomic.h>
-#include <asm/types.h>
 #include <linux/fs.h>
 #include <linux/namei.h>
 #include <linux/mm.h>
@@ -66,6 +65,7 @@
 #include <linux/binfmts.h>
 #include <linux/highmem.h>
 #include <linux/syscalls.h>
+#include <linux/inotify.h>
 
 #include "audit.h"
 
@@ -180,6 +180,11 @@ struct audit_aux_data_pids {
    int         pid_count;
 };
 
+struct audit_tree_refs {
+   struct audit_tree_refs *next;
+   struct audit_chunk *c[31];
+};
+
 /* The per-task audit context. */
 struct audit_context {
    int          dummy;   /* must be the first element */
@@ -212,6 +217,9 @@ struct audit_context {
    pid_t          target_pid;
    u32          target_sid;
 
+   struct audit_tree_refs *trees, *first_trees;
+   int tree_count;
+
 #if AUDIT_DEBUG
    int          put_count;
    int          ino_count;
@@ -266,6 +274,117 @@ static int audit_match_perm(struct audit_context *ctx, int mask)
    }
 }
 
+/*
+ * We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *;
+ * ->first_trees points to its beginning, ->trees - to the current end of data.
+ * ->tree_count is the number of free entries in array pointed to by ->trees.
+ * Original condition is (NULL, NULL, 0); as soon as it grows we never revert to NULL,
+ * "empty" becomes (p, p, 31) afterwards.  We don't shrink the list (and seriously,
+ * it's going to remain 1-element for almost any setup) until we free context itself.
+ * References in it _are_ dropped - at the same time we free/drop aux stuff.
+ */
+
+#ifdef CONFIG_AUDIT_TREE
+static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk)
+{
+   struct audit_tree_refs *p = ctx->trees;
+   int left = ctx->tree_count;
+   if (likely(left)) {
+      p->c[--left] = chunk;
+      ctx->tree_count = left;
+      return 1;
+   }
+   if (!p)
+      return 0;
+   p = p->next;
+   if (p) {
+      p->c[30] = chunk;
+      ctx->trees = p;
+      ctx->tree_count = 30;
+      return 1;
+   }
+   return 0;
+}
+
+static int grow_tree_refs(struct audit_context *ctx)
+{
+   struct audit_tree_refs *p = ctx->trees;
+   ctx->trees = kzalloc(sizeof(struct audit_tree_refs), GFP_KERNEL);
+   if (!ctx->trees) {
+      ctx->trees = p;
+      return 0;
+   }
+   if (p)
+      p->next = ctx->trees;
+   else
+      ctx->first_trees = ctx->trees;
+   ctx->tree_count = 31;
+   return 1;
+}
+#endif
+
+static void unroll_tree_refs(struct audit_context *ctx,
+            struct audit_tree_refs *p, int count)
+{
+#ifdef CONFIG_AUDIT_TREE
+   struct audit_tree_refs *q;
+   int n;
+   if (!p) {
+      /* we started with empty chain */
+      p = ctx->first_trees;
+      count = 31;
+      /* if the very first allocation has failed, nothing to do */
+      if (!p)
+         return;
+   }
+   n = count;
+   for (q = p; q != ctx->trees; q = q->next, n = 31) {
+      while (n--) {
+         audit_put_chunk(q->c[n]);
+         q->c[n] = NULL;
+      }
+   }
+   while (n-- > ctx->tree_count) {
+      audit_put_chunk(q->c[n]);
+      q->c[n] = NULL;
+   }
+   ctx->trees = p;
+   ctx->tree_count = count;
+#endif
+}
+
+static void free_tree_refs(struct audit_context *ctx)
+{
+   struct audit_tree_refs *p, *q;
+   for (p = ctx->first_trees; p; p = q) {
+      q = p->next;
+      kfree(p);
+   }
+}
+
+static int match_tree_refs(struct audit_context *ctx, struct audit_tree *tree)
+{
+#ifdef CONFIG_AUDIT_TREE
+   struct audit_tree_refs *p;
+   int n;
+   if (!tree)
+      return 0;
+   /* full ones */
+   for (p = ctx->first_trees; p != ctx->trees; p = p->next) {
+      for (n = 0; n < 31; n++)
+         if (audit_tree_match(p->c[n], tree))
+            return 1;
+   }
+   /* partial */
+   if (p) {
+      for (n = ctx->tree_count; n < 31; n++)
+         if (audit_tree_match(p->c[n], tree))
+            return 1;
+   }
+#endif
+   return 0;
+}
+
 /* Determine if any context name data matches a rule's watch data */
 /* Compare a task_struct with an audit_rule.  Return 1 on match, 0
  * otherwise. */
@@ -321,7 +440,7 @@ static int audit_filter_rules(struct task_struct *tsk,
          result = audit_comparator(tsk->personality, f->op, f->val);
          break;
       case AUDIT_ARCH:
-          if (ctx)
+         if (ctx)
             result = audit_comparator(ctx->arch, f->op, f->val);
          break;
 
@@ -380,6 +499,10 @@ static int audit_filter_rules(struct task_struct *tsk,
             result = (name->dev == rule->watch->dev &&
                  name->ino == rule->watch->ino);
          break;
+      case AUDIT_DIR:
+         if (ctx)
+            result = match_tree_refs(ctx, rule->tree);
+         break;
       case AUDIT_LOGINUID:
          result = 0;
          if (ctx)
@@ -728,6 +851,8 @@ static inline void audit_free_context(struct audit_context *context)
                 context->name_count, count);
       }
       audit_free_names(context);
+      unroll_tree_refs(context, NULL, 0);
+      free_tree_refs(context);
       audit_free_aux(context);
       kfree(context->filterkey);
       kfree(context);
@@ -899,7 +1024,7 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
    if (context->personality != PER_LINUX)
       audit_log_format(ab, " per=%lx", context->personality);
    if (context->return_valid)
-      audit_log_format(ab, " success=%s exit=%ld", 
+      audit_log_format(ab, " success=%s exit=%ld",
              (context->return_valid==AUDITSC_SUCCESS)?"yes":"no",
              context->return_code);
 
@@ -1136,8 +1261,8 @@ void audit_free(struct task_struct *tsk)
       return;
 
    /* Check for system calls that do not go through the exit
-    * function (e.g., exit_group), then free context block. 
-    * We use GFP_ATOMIC here because we might be doing this 
+    * function (e.g., exit_group), then free context block.
+    * We use GFP_ATOMIC here because we might be doing this
     * in the context of the idle thread */
    /* that can happen only if we are called from do_exit() */
    if (context->in_syscall && context->auditable)
@@ -1271,6 +1396,7 @@ void audit_syscall_exit(int valid, long return_code)
       tsk->audit_context = new_context;
    } else {
       audit_free_names(context);
+      unroll_tree_refs(context, NULL, 0);
       audit_free_aux(context);
       context->aux = NULL;
       context->aux_pids = NULL;
@@ -1282,6 +1408,95 @@ void audit_syscall_exit(int valid, long return_code)
    }
 }
 
+static inline void handle_one(const struct inode *inode)
+{
+#ifdef CONFIG_AUDIT_TREE
+   struct audit_context *context;
+   struct audit_tree_refs *p;
+   struct audit_chunk *chunk;
+   int count;
+   if (likely(list_empty(&inode->inotify_watches)))
+      return;
+   context = current->audit_context;
+   p = context->trees;
+   count = context->tree_count;
+   rcu_read_lock();
+   chunk = audit_tree_lookup(inode);
+   rcu_read_unlock();
+   if (!chunk)
+      return;
+   if (likely(put_tree_ref(context, chunk)))
+      return;
+   if (unlikely(!grow_tree_refs(context))) {
+      printk(KERN_WARNING "out of memory, audit has lost a tree reference");
+      audit_set_auditable(context);
+      audit_put_chunk(chunk);
+      unroll_tree_refs(context, p, count);
+      return;
+   }
+   put_tree_ref(context, chunk);
+#endif
+}
+
+static void handle_path(const struct dentry *dentry)
+{
+#ifdef CONFIG_AUDIT_TREE
+   struct audit_context *context;
+   struct audit_tree_refs *p;
+   const struct dentry *d, *parent;
+   struct audit_chunk *drop;
+   unsigned long seq;
+   int count;
+
+   context = current->audit_context;
+   p = context->trees;
+   count = context->tree_count;
+retry:
+   drop = NULL;
+   d = dentry;
+   rcu_read_lock();
+   seq = read_seqbegin(&rename_lock);
+   for(;;) {
+      struct inode *inode = d->d_inode;
+      if (inode && unlikely(!list_empty(&inode->inotify_watches))) {
+         struct audit_chunk *chunk;
+         chunk = audit_tree_lookup(inode);
+         if (chunk) {
+            if (unlikely(!put_tree_ref(context, chunk))) {
+               drop = chunk;
+               break;
+            }
+         }
+      }
+      parent = d->d_parent;
+      if (parent == d)
+         break;
+      d = parent;
+   }
+   if (unlikely(read_seqretry(&rename_lock, seq) || drop)) {  /* in this order */
+      rcu_read_unlock();
+      if (!drop) {
+         /* just a race with rename */
+         unroll_tree_refs(context, p, count);
+         goto retry;
+      }
+      audit_put_chunk(drop);
+      if (grow_tree_refs(context)) {
+         /* OK, got more space */
+         unroll_tree_refs(context, p, count);
+         goto retry;
+      }
+      /* too bad */
+      printk(KERN_WARNING
+         "out of memory, audit has lost a tree reference");
+      unroll_tree_refs(context, p, count);
+      audit_set_auditable(context);
+      return;
+   }
+   rcu_read_unlock();
+#endif
+}
+
 /**
  * audit_getname - add a name to the list
  * @name: name to add
@@ -1317,7 +1532,7 @@ void __audit_getname(const char *name)
       context->pwdmnt = mntget(current->fs->pwdmnt);
       read_unlock(¤t->fs->lock);
    }
-      
+
 }
 
 /* audit_putname - intercept a putname request
@@ -1400,14 +1615,15 @@ static void audit_copy_inode(struct audit_names *name, const struct inode *inode
 /**
  * audit_inode - store the inode and device from a lookup
  * @name: name being audited
- * @inode: inode being audited
+ * @dentry: dentry being audited
  *
  * Called from fs/namei.c:path_lookup().
  */
-void __audit_inode(const char *name, const struct inode *inode)
+void __audit_inode(const char *name, const struct dentry *dentry)
 {
    int idx;
    struct audit_context *context = current->audit_context;
+   const struct inode *inode = dentry->d_inode;
 
    if (!context->in_syscall)
       return;
@@ -1427,13 +1643,14 @@ void __audit_inode(const char *name, const struct inode *inode)
       idx = context->name_count - 1;
       context->names[idx].name = NULL;
    }
+   handle_path(dentry);
    audit_copy_inode(&context->names[idx], inode);
 }
 
 /**
  * audit_inode_child - collect inode info for created/removed objects
  * @dname: inode's dentry name
- * @inode: inode being audited
+ * @dentry: dentry being audited
  * @parent: inode of dentry parent
  *
  * For syscalls that create or remove filesystem objects, audit_inode
@@ -1444,17 +1661,20 @@ void __audit_inode(const char *name, const struct inode *inode)
  * must be hooked prior, in order to capture the target inode during
  * unsuccessful attempts.
  */
-void __audit_inode_child(const char *dname, const struct inode *inode,
+void __audit_inode_child(const char *dname, const struct dentry *dentry,
           const struct inode *parent)
 {
    int idx;
    struct audit_context *context = current->audit_context;
    const char *found_parent = NULL, *found_child = NULL;
+   const struct inode *inode = dentry->d_inode;
    int dirlen = 0;
 
    if (!context->in_syscall)
       return;
 
+   if (inode)
+      handle_one(inode);
    /* determine matching parent */
    if (!dname)
       goto add_names;
@@ -1525,6 +1745,7 @@ add_names:
          context->names[idx].ino = (unsigned long)-1;
    }
 }
+EXPORT_SYMBOL_GPL(__audit_inode_child);
 
 /**
  * auditsc_get_stamp - get local copies of audit_context values