audit: filter PATH records keyed on filesystem magic

Tracefs or debugfs were causing hundreds to thousands of PATH records to
be associated with the init_module and finit_module SYSCALL records on a
few modules when the following rule was in place for startup:
	-a always,exit -F arch=x86_64 -S init_module -F key=mod-load

Provide a method to ignore these large number of PATH records from
overwhelming the logs if they are not of interest.  Introduce a new
filter list "AUDIT_FILTER_FS", with a new field type AUDIT_FSTYPE,
which keys off the filesystem 4-octet hexadecimal magic identifier to
filter specific filesystem PATH records.

An example rule would look like:
	-a never,filesystem -F fstype=0x74726163 -F key=ignore_tracefs
	-a never,filesystem -F fstype=0x64626720 -F key=ignore_debugfs

Arguably the better way to address this issue is to disable tracefs and
debugfs on boot from production systems.

See: https://github.com/linux-audit/audit-kernel/issues/16
See: https://github.com/linux-audit/audit-userspace/issues/8
Test case: https://github.com/linux-audit/audit-testsuite/issues/42

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
[PM: fixed the whitespace damage in kernel/auditsc.c]
Signed-off-by: Paul Moore <paul@paul-moore.com>

1 files changed, 23 insertions, 0 deletions

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index aac1a41f82bd..c9bb29e17335 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1869,10 +1869,33 @@ void __audit_inode_child(struct inode *parent,
         struct inode *inode = d_backing_inode(dentry);
         const char *dname = dentry->d_name.name;
         struct audit_names *n, *found_parent = NULL, *found_child = NULL;
+        struct audit_entry *e;
+        struct list_head *list = &audit_filter_list[AUDIT_FILTER_FS];
+        int i;
 
         if (!context->in_syscall)
                 return;
 
+        rcu_read_lock();
+        if (!list_empty(list)) {
+                list_for_each_entry_rcu(e, list, list) {
+                        for (i = 0; i < e->rule.field_count; i++) {
+                                struct audit_field *f = &e->rule.fields[i];
+
+                                if (f->type == AUDIT_FSTYPE) {
+                                        if (audit_comparator(parent->i_sb->s_magic,
+                                            f->op, f->val)) {
+                                                if (e->rule.action == AUDIT_NEVER) {
+                                                        rcu_read_unlock();
+                                                        return;
+                                                }
+                                        }
+                                }
+                        }
+                }
+        }
+        rcu_read_unlock();
+
         if (inode)
                 handle_one(inode);