Jan Kara 65c62025ac fsnotify: fix handling of renames in audit ... commit 6ee8e25fc3 upstream. Commit e9fd702a58 ("audit: convert audit watches to use fsnotify instead of inotify") broke handling of renames in audit. Audit code wants to update inode number of an inode corresponding to watched name in a directory. When something gets renamed into a directory to a watched name, inotify previously passed moved inode to audit code however new fsnotify code passes directory inode where the change happened. That confuses audit and it starts watching parent directory instead of a file in a directory. This can be observed for example by doing: cd /tmp touch foo bar auditctl -w /tmp/foo touch foo mv bar foo touch foo In audit log we see events like: type=CONFIG_CHANGE msg=audit(1423563584.155:90): auid=1000 ses=2 op="updated rules" path="/tmp/foo" key=(null) list=4 res=1 ... type=PATH msg=audit(1423563584.155:91): item=2 name="bar" inode=1046884 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE type=PATH msg=audit(1423563584.155:91): item=3 name="foo" inode=1046842 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE type=PATH msg=audit(1423563584.155:91): item=4 name="foo" inode=1046884 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE ... and that's it - we see event for the first touch after creating the audit rule, we see events for rename but we don't see any event for the last touch. However we start seeing events for unrelated stuff happening in /tmp. Fix the problem by passing moved inode as data in the FS_MOVED_FROM and FS_MOVED_TO events instead of the directory where the change happens. This doesn't introduce any new problems because noone besides audit_watch.c cares about the passed value: fs/notify/fanotify/fanotify.c cares only about FSNOTIFY_EVENT_PATH events. fs/notify/dnotify/dnotify.c doesn't care about passed 'data' value at all. fs/notify/inotify/inotify_fsnotify.c uses 'data' only for FSNOTIFY_EVENT_PATH. kernel/audit_tree.c doesn't care about passed 'data' at all. kernel/audit_watch.c expects moved inode as 'data'. Fixes: e9fd702a58 ("audit: convert audit watches to use fsnotify instead of inotify") Signed-off-by: Jan Kara <jack@suse.cz> Cc: Paul Moore <paul@paul-moore.com> Cc: Eric Paris <eparis@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2015-03-06 14:40:48 -08:00
..
acpi	ACPI / hotplug: Fix conflicted PCI bridge notify handlers	2013-12-04 10:57:04 -08:00
asm-generic	mm: use paravirt friendly ops for NUMA hinting ptes	2014-05-30 21:52:12 -07:00
clocksource	clocksource: arch_timer: use virtual counters	2014-01-09 12:24:26 -08:00
crypto	crypto: scatterwalk - Use sg_chain_ptr on chain entries	2013-12-11 22:36:29 -08:00
drm	drm/radeon: remove invalid pci id	2014-11-14 08:48:00 -08:00
dt-bindings
keys
linux	fsnotify: fix handling of renames in audit	2015-03-06 14:40:48 -08:00
math-emu
media	media: vb2: fix VBI/poll regression	2014-10-09 12:18:42 -07:00
memory
misc
net	ipv4: tcp: get rid of ugly unicast_sock	2015-02-26 17:48:48 -08:00
pcmcia
ras
rdma
rxrpc
scsi	scsi: fix our current target reap infrastructure	2014-05-30 21:52:11 -07:00
sound	ALSA: ak411x: Fix stall in work callback	2015-02-11 14:48:17 +08:00
target	target: Report correct response length for some commands	2014-06-30 20:09:45 -07:00
trace	tracing: Fix syscall_*regfunc() vs copy_process() race	2014-07-06 18:54:16 -07:00
uapi	netfilter: xt_bpf: add mising opaque struct sk_filter definition	2014-11-21 09:22:54 -08:00
video	Merge branch 'fbdev-3.10-fixes' of git://gitorious.org/linux-omap-dss2/linux into linux-fbdev/for-3.10-fixes	2013-05-29 17:00:34 +08:00
xen	xenbus: delay xenbus frontend resume if xenstored is not running	2013-05-29 09:04:19 -04:00
Kbuild	UAPI: remove empty Kbuild files	2013-04-30 17:04:09 -07:00