2 * Creating audit events from TTY input.
4 * Copyright (C) 2007 Red Hat, Inc. All rights reserved. This copyrighted
5 * material is made available to anyone wishing to use, modify, copy, or
6 * redistribute it subject to the terms and conditions of the GNU General
9 * Authors: Miloslav Trmac <mitr@redhat.com>
12 #include <linux/audit.h>
13 #include <linux/file.h>
14 #include <linux/tty.h>
16 struct tty_audit_buf
{
18 struct mutex mutex
; /* Protects all data below */
19 int major
, minor
; /* The TTY which the data is from */
22 unsigned char *data
; /* Allocated size N_TTY_BUF_SIZE */
25 static struct tty_audit_buf
*tty_audit_buf_alloc(int major
, int minor
,
28 struct tty_audit_buf
*buf
;
30 buf
= kmalloc(sizeof (*buf
), GFP_KERNEL
);
33 if (PAGE_SIZE
!= N_TTY_BUF_SIZE
)
34 buf
->data
= kmalloc(N_TTY_BUF_SIZE
, GFP_KERNEL
);
36 buf
->data
= (unsigned char *)__get_free_page(GFP_KERNEL
);
39 atomic_set(&buf
->count
, 1);
40 mutex_init(&buf
->mutex
);
53 static void tty_audit_buf_free(struct tty_audit_buf
*buf
)
55 WARN_ON(buf
->valid
!= 0);
56 if (PAGE_SIZE
!= N_TTY_BUF_SIZE
)
59 free_page((unsigned long)buf
->data
);
63 static void tty_audit_buf_put(struct tty_audit_buf
*buf
)
65 if (atomic_dec_and_test(&buf
->count
))
66 tty_audit_buf_free(buf
);
70 * tty_audit_buf_push - Push buffered data out
72 * Generate an audit message from the contents of @buf, which is owned by
73 * @tsk with @loginuid. @buf->mutex must be locked.
75 static void tty_audit_buf_push(struct task_struct
*tsk
, uid_t loginuid
,
76 struct tty_audit_buf
*buf
)
78 struct audit_buffer
*ab
;
82 if (audit_enabled
== 0)
84 ab
= audit_log_start(NULL
, GFP_KERNEL
, AUDIT_TTY
);
86 char name
[sizeof(tsk
->comm
)];
88 audit_log_format(ab
, "tty pid=%u uid=%u auid=%u major=%d "
89 "minor=%d comm=", tsk
->pid
, tsk
->uid
,
90 loginuid
, buf
->major
, buf
->minor
);
91 get_task_comm(name
, tsk
);
92 audit_log_untrustedstring(ab
, name
);
93 audit_log_format(ab
, " data=");
94 audit_log_n_untrustedstring(ab
, buf
->valid
, buf
->data
);
101 * tty_audit_buf_push_current - Push buffered data out
103 * Generate an audit message from the contents of @buf, which is owned by
104 * the current task. @buf->mutex must be locked.
106 static void tty_audit_buf_push_current(struct tty_audit_buf
*buf
)
108 tty_audit_buf_push(current
, audit_get_loginuid(current
), buf
);
112 * tty_audit_exit - Handle a task exit
114 * Make sure all buffered data is written out and deallocate the buffer.
115 * Only needs to be called if current->signal->tty_audit_buf != %NULL.
117 void tty_audit_exit(void)
119 struct tty_audit_buf
*buf
;
121 spin_lock_irq(¤t
->sighand
->siglock
);
122 buf
= current
->signal
->tty_audit_buf
;
123 current
->signal
->tty_audit_buf
= NULL
;
124 spin_unlock_irq(¤t
->sighand
->siglock
);
128 mutex_lock(&buf
->mutex
);
129 tty_audit_buf_push_current(buf
);
130 mutex_unlock(&buf
->mutex
);
132 tty_audit_buf_put(buf
);
136 * tty_audit_fork - Copy TTY audit state for a new task
138 * Set up TTY audit state in @sig from current. @sig needs no locking.
140 void tty_audit_fork(struct signal_struct
*sig
)
142 spin_lock_irq(¤t
->sighand
->siglock
);
143 sig
->audit_tty
= current
->signal
->audit_tty
;
144 spin_unlock_irq(¤t
->sighand
->siglock
);
145 sig
->tty_audit_buf
= NULL
;
149 * tty_audit_push_task - Flush task's pending audit data
151 void tty_audit_push_task(struct task_struct
*tsk
, uid_t loginuid
)
153 struct tty_audit_buf
*buf
;
155 spin_lock_irq(&tsk
->sighand
->siglock
);
156 buf
= tsk
->signal
->tty_audit_buf
;
158 atomic_inc(&buf
->count
);
159 spin_unlock_irq(&tsk
->sighand
->siglock
);
163 mutex_lock(&buf
->mutex
);
164 tty_audit_buf_push(tsk
, loginuid
, buf
);
165 mutex_unlock(&buf
->mutex
);
167 tty_audit_buf_put(buf
);
171 * tty_audit_buf_get - Get an audit buffer.
173 * Get an audit buffer for @tty, allocate it if necessary. Return %NULL
174 * if TTY auditing is disabled or out of memory. Otherwise, return a new
175 * reference to the buffer.
177 static struct tty_audit_buf
*tty_audit_buf_get(struct tty_struct
*tty
)
179 struct tty_audit_buf
*buf
, *buf2
;
183 spin_lock_irq(¤t
->sighand
->siglock
);
184 if (likely(!current
->signal
->audit_tty
))
186 buf
= current
->signal
->tty_audit_buf
;
188 atomic_inc(&buf
->count
);
191 spin_unlock_irq(¤t
->sighand
->siglock
);
193 buf2
= tty_audit_buf_alloc(tty
->driver
->major
,
194 tty
->driver
->minor_start
+ tty
->index
,
197 audit_log_lost("out of memory in TTY auditing");
201 spin_lock_irq(¤t
->sighand
->siglock
);
202 if (!current
->signal
->audit_tty
)
204 buf
= current
->signal
->tty_audit_buf
;
206 current
->signal
->tty_audit_buf
= buf2
;
210 atomic_inc(&buf
->count
);
213 spin_unlock_irq(¤t
->sighand
->siglock
);
215 tty_audit_buf_free(buf2
);
220 * tty_audit_add_data - Add data for TTY auditing.
222 * Audit @data of @size from @tty, if necessary.
224 void tty_audit_add_data(struct tty_struct
*tty
, unsigned char *data
,
227 struct tty_audit_buf
*buf
;
230 if (unlikely(size
== 0))
233 buf
= tty_audit_buf_get(tty
);
237 mutex_lock(&buf
->mutex
);
238 major
= tty
->driver
->major
;
239 minor
= tty
->driver
->minor_start
+ tty
->index
;
240 if (buf
->major
!= major
|| buf
->minor
!= minor
241 || buf
->icanon
!= tty
->icanon
) {
242 tty_audit_buf_push_current(buf
);
245 buf
->icanon
= tty
->icanon
;
250 run
= N_TTY_BUF_SIZE
- buf
->valid
;
253 memcpy(buf
->data
+ buf
->valid
, data
, run
);
257 if (buf
->valid
== N_TTY_BUF_SIZE
)
258 tty_audit_buf_push_current(buf
);
260 mutex_unlock(&buf
->mutex
);
261 tty_audit_buf_put(buf
);
265 * tty_audit_push - Push buffered data out
267 * Make sure no audit data is pending for @tty on the current process.
269 void tty_audit_push(struct tty_struct
*tty
)
271 struct tty_audit_buf
*buf
;
273 spin_lock_irq(¤t
->sighand
->siglock
);
274 if (likely(!current
->signal
->audit_tty
)) {
275 spin_unlock_irq(¤t
->sighand
->siglock
);
278 buf
= current
->signal
->tty_audit_buf
;
280 atomic_inc(&buf
->count
);
281 spin_unlock_irq(¤t
->sighand
->siglock
);
286 major
= tty
->driver
->major
;
287 minor
= tty
->driver
->minor_start
+ tty
->index
;
288 mutex_lock(&buf
->mutex
);
289 if (buf
->major
== major
&& buf
->minor
== minor
)
290 tty_audit_buf_push_current(buf
);
291 mutex_unlock(&buf
->mutex
);
292 tty_audit_buf_put(buf
);
297 * tty_audit_opening - A TTY is being opened.
299 * As a special hack, tasks that close all their TTYs and open new ones
300 * are assumed to be system daemons (e.g. getty) and auditing is
301 * automatically disabled for them.
303 void tty_audit_opening(void)
308 spin_lock_irq(¤t
->sighand
->siglock
);
309 if (current
->signal
->audit_tty
== 0)
311 spin_unlock_irq(¤t
->sighand
->siglock
);
316 if (current
->files
) {
321 * We don't take a ref to the file, so we must hold ->file_lock
324 spin_lock(¤t
->files
->file_lock
);
325 fdt
= files_fdtable(current
->files
);
326 for (i
= 0; i
< fdt
->max_fds
; i
++) {
329 filp
= fcheck_files(current
->files
, i
);
330 if (filp
&& is_tty(filp
)) {
335 spin_unlock(¤t
->files
->file_lock
);
337 task_unlock(current
);
341 spin_lock_irq(¤t
->sighand
->siglock
);
342 current
->signal
->audit_tty
= 0;
343 spin_unlock_irq(¤t
->sighand
->siglock
);
This page took 0.057557 seconds and 6 git commands to generate.