2.4.4 文件系统变化的审计

struct audit_krule {
......
struct audit_watch*watch;
......
};

审计监视结构audit_watch列出如下（在linux26/include/linux/audit.h中）：

struct audit_watch {
atomic_tcount;　 /*引用数 */
char*path;　  /* 加watch的路径*/
dev_tdev;　   /* 与超级块设置被关的指针*/
unsigned longino;　  /*相关的节点号*/
struct audit_parent*parent;  /* associated parent */
struct list_headwlist;      /* 用于挂接到parent->watches 链表上 */
struct list_headrules;         /* 相关的规则*/
};

struct audit_parent {
struct list_headilist;/*用于挂接在inotify注册链表上*/
struct list_headwatches;　 /*用于挂接结构audit_watch实例的链表头*/
struct inotify_watchwdata;/*inotify机制的watch数据*/
unsignedflags;/*状态标识*/
};

-w 为文件系统对象插入一个watch（监视）。不支持匹配符
-W 移去文件系统对象

/*参数ndw是文件的结构nameidata 实例，ndp为文件所在目录的结构实例*/
static int audit_add_watch(struct audit_krule *krule, struct nameidata *ndp,
   struct nameidata *ndw)
{
　//得到审计监视规则实例，前面运行的函数audit_init_watch根据规则已初始化了这个实例
struct audit_watch *watch = krule->watch;
struct inotify_watch *i_watch;
struct audit_parent *parent;
int ret = 0;

if (ndw) {
watch->dev = ndw->dentry->d_inode->i_sb->s_dev;　//得到文件所在的设备
watch->ino = ndw->dentry->d_inode->i_ino;//得到文件的节点号
}

mutex_unlock(&audit_filter_mutex);
     //在目录节点上查找符合audit_ih的watch，找到后，放在i_watch中
if (inotify_find_watch(audit_ih, ndp->dentry->d_inode, &i_watch) < 0) {
               /*如果在目录节点上没有找到watch，初始化watch，创建结构audit_parent实例并放在parent中
parent = audit_init_parent(ndp);
if (IS_ERR(parent)) {　//如果初始化出错，返回错误
/* 调用者期望互斥锁处于锁住状态*/
mutex_lock(&audit_filter_mutex);
return PTR_ERR(parent);
}
} else
　//找到watch，得到它的结构audit_parent实例，并放在parent中
parent = container_of(i_watch, struct audit_parent, wdata);

mutex_lock(&audit_filter_mutex);

/* parent在取得audit_filter_mutex之前被移走，则返回错误*/
if (parent->flags & AUDIT_PARENT_INVALID)
ret = -ENOENT;
else
audit_add_to_parent(krule, parent);　//将parent加入到krule中，krule代表一条审计规则

/*引用计数减1，如果引用计数为0，删除watch */
put_inotify_watch(&parent->wdata);
return ret;
}

static void audit_add_to_parent(struct audit_krule *krule,
struct audit_parent *parent)
{
  //得到审计监视规则实例，前面运行的函数audit_init_watch根据规则已初始化这个实例
struct audit_watch *w, *watch = krule->watch;
int watch_found = 0;
      //遍历链表watches，watches存放着目录下所有文件的结构audit_watch实例
list_for_each_entry(w, &parent->watches, wlist) {
　  // parent->watches为目录的结构audit_watch实例，w为文件的结构audit_watch实例
if (strcmp(watch->path, w->path))
continue;

watch_found = 1;

audit_put_watch(watch); //引用计数减1
audit_put_watch(watch);

audit_get_watch(w);　//引用计数加1
krule->watch = watch = w;  //将文件的结构audit_watch实例放到内核规则实例krule上
break;
}

if (!watch_found) {　//在链表watches没有找到文件的结构audit_watch实例，将
get_inotify_watch(&parent->wdata);　//引用计数加1
watch->parent = parent; 

list_add(&watch->wlist, &parent->watches); //将&watch加入到parent->watches 链表上
}
list_add(&krule->rlist, &watch->rules);
}

struct inotify_handle *audit_ih;
static int __init audit_init(void)
{
......
 #ifdef CONFIG_AUDITSYSCALL
audit_ih = inotify_init(&audit_inotify_ops);
if (IS_ERR(audit_ih))
audit_panic("cannot initialize inotify handle");
#endif
    ......
}

操作函数集audit_inotify_ops列出如下：

#ifdef CONFIG_AUDITSYSCALL
static const struct inotify_operations audit_inotify_ops = {
.handle_event= audit_handle_ievent,
.destroy_watch= audit_free_parent,
};
#endif

void audit_handle_ievent(struct inotify_watch *i_watch, u32 wd, u32 mask,
u32 cookie, const char *dname, struct inode *inode)
{
struct audit_parent *parent;
//通过节点的i_watch找到结构audit_parent实例
parent = container_of(i_watch, struct audit_parent, wdata);

if (mask & (IN_CREATE|IN_MOVED_TO) && inode)
//更新规则结构实例中的审计监视，并调用审计系统接口函数记录文件系统变化的信息
audit_update_watch(parent, dname, inode->i_sb->s_dev,
inode->i_ino, 0);
else if (mask & (IN_DELETE|IN_MOVED_FROM))
audit_update_watch(parent, dname, (dev_t)-1, (unsigned long)-1, 1);
/* inotify自动删除watch 并发送IN_IGNORED */
else if (mask & (IN_DELETE_SELF|IN_UNMOUNT))
audit_remove_parent_watches(parent);
/* inotify不删除watch，因此需要手动删除它 */
else if(mask & IN_MOVE_SELF) {
audit_remove_parent_watches(parent);
inotify_remove_watch_locked(audit_ih, i_watch);
} else if (mask & IN_IGNORED)
put_inotify_watch(i_watch);　//删除watch
}