linux/kernel/audit_watch.c

28  * 	event.  Each audit_watch holds a reference to its associated parent.
41 	struct audit_parent	*parent; /* associated parent */
42 	struct list_head	wlist;	/* entry in parent->watches list */
58 static void audit_free_parent(struct audit_parent *parent)
60 	WARN_ON(!list_empty(&parent->watches));
61 	kfree(parent);
66 	struct audit_parent *parent;
68 	parent = container_of(entry, struct audit_parent, mark);
69 	audit_free_parent(parent);
72 static void audit_get_parent(struct audit_parent *parent)
74 	if (likely(parent))
75 		fsnotify_get_mark(&parent->mark);
78 static void audit_put_parent(struct audit_parent *parent)
80 	if (likely(parent))
81 		fsnotify_put_mark(&parent->mark);
86  * is taken on this parent.
90 	struct audit_parent *parent = NULL;
95 		parent = container_of(entry, struct audit_parent, mark);
97 	return parent;
108 		WARN_ON(watch->parent);
118 	audit_put_parent(watch->parent);
119 	watch->parent = NULL;
135 /* Initialize a parent watch entry. */
139 	struct audit_parent *parent;
142 	parent = kzalloc(sizeof(*parent), GFP_KERNEL);
143 	if (unlikely(!parent))
146 	INIT_LIST_HEAD(&parent->watches);
148 	fsnotify_init_mark(&parent->mark, audit_watch_group);
149 	parent->mark.mask = AUDIT_FS_WATCH;
150 	ret = fsnotify_add_inode_mark(&parent->mark, inode, 0);
152 		audit_free_parent(parent);
156 	return parent;
220 	audit_get_parent(old->parent);
221 	new->parent = old->parent;
245 static void audit_update_watch(struct audit_parent *parent,
254 	/* Run all of the watches on this parent looking for the one that
256 	list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
316 	list_add(&nwatch->wlist, &parent->watches);
321 /* Remove all watches & rules associated with a parent that is going away. */
322 static void audit_remove_parent_watches(struct audit_parent *parent)
329 	list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
344 	fsnotify_destroy_mark(&parent->mark, audit_watch_group);
348 static int audit_get_nd(struct audit_watch *watch, struct path *parent)
352 	d = kern_path_locked_negative(watch->path, parent);
362 	inode_unlock(d_backing_inode(parent->dentry));
367 /* Associate the given rule with an existing parent.
370 				struct audit_parent *parent)
377 	list_for_each_entry(w, &parent->watches, wlist) {
389 		audit_put_parent(parent);
394 		watch->parent = parent;
397 		list_add(&watch->wlist, &parent->watches);
407 	struct audit_parent *parent;
431 	/* either find an old parent or attach a new one */
432 	parent = audit_find_parent(d_backing_inode(parent_path.dentry));
433 	if (!parent) {
434 		parent = audit_init_parent(&parent_path);
435 		if (IS_ERR(parent)) {
436 			ret = PTR_ERR(parent);
441 	audit_add_to_parent(krule, parent);
454 	struct audit_parent *parent = watch->parent;
460 		 * audit_remove_watch() drops our reference to 'parent' which
463 		audit_get_parent(parent);
465 		if (list_empty(&parent->watches))
466 			fsnotify_destroy_mark(&parent->mark, audit_watch_group);
467 		audit_put_parent(parent);
476 	struct audit_parent *parent;
478 	parent = container_of(inode_mark, struct audit_parent, mark);
484 		audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);
486 		audit_update_watch(parent, dname, AUDIT_DEV_UNSET, AUDIT_INO_UNSET, 1);
488 		audit_remove_parent_watches(parent);