2 * Creating audit events from TTY input.
4 * Copyright (C) 2007 Red Hat, Inc. All rights reserved. This copyrighted
5 * material is made available to anyone wishing to use, modify, copy, or
6 * redistribute it subject to the terms and conditions of the GNU General
9 * Authors: Miloslav Trmac <mitr@redhat.com>
12 #include <linux/audit.h>
13 #include <linux/slab.h>
14 #include <linux/tty.h>
16 struct tty_audit_buf
{
18 struct mutex mutex
; /* Protects all data below */
19 int major
, minor
; /* The TTY which the data is from */
22 unsigned char *data
; /* Allocated size N_TTY_BUF_SIZE */
25 static struct tty_audit_buf
*tty_audit_buf_alloc(int major
, int minor
,
28 struct tty_audit_buf
*buf
;
30 buf
= kmalloc(sizeof(*buf
), GFP_KERNEL
);
33 buf
->data
= kmalloc(N_TTY_BUF_SIZE
, GFP_KERNEL
);
36 atomic_set(&buf
->count
, 1);
37 mutex_init(&buf
->mutex
);
50 static void tty_audit_buf_free(struct tty_audit_buf
*buf
)
52 WARN_ON(buf
->valid
!= 0);
57 static void tty_audit_buf_put(struct tty_audit_buf
*buf
)
59 if (atomic_dec_and_test(&buf
->count
))
60 tty_audit_buf_free(buf
);
63 static void tty_audit_log(const char *description
, struct task_struct
*tsk
,
64 uid_t loginuid
, unsigned sessionid
, int major
,
65 int minor
, unsigned char *data
, size_t size
)
67 struct audit_buffer
*ab
;
69 ab
= audit_log_start(NULL
, GFP_KERNEL
, AUDIT_TTY
);
71 char name
[sizeof(tsk
->comm
)];
72 uid_t uid
= task_uid(tsk
);
74 audit_log_format(ab
, "%s pid=%u uid=%u auid=%u ses=%u "
75 "major=%d minor=%d comm=", description
,
76 tsk
->pid
, uid
, loginuid
, sessionid
,
78 get_task_comm(name
, tsk
);
79 audit_log_untrustedstring(ab
, name
);
80 audit_log_format(ab
, " data=");
81 audit_log_n_hex(ab
, data
, size
);
87 * tty_audit_buf_push - Push buffered data out
89 * Generate an audit message from the contents of @buf, which is owned by
90 * @tsk with @loginuid. @buf->mutex must be locked.
92 static void tty_audit_buf_push(struct task_struct
*tsk
, uid_t loginuid
,
93 unsigned int sessionid
,
94 struct tty_audit_buf
*buf
)
98 if (audit_enabled
== 0) {
102 tty_audit_log("tty", tsk
, loginuid
, sessionid
, buf
->major
, buf
->minor
,
103 buf
->data
, buf
->valid
);
108 * tty_audit_buf_push_current - Push buffered data out
110 * Generate an audit message from the contents of @buf, which is owned by
111 * the current task. @buf->mutex must be locked.
113 static void tty_audit_buf_push_current(struct tty_audit_buf
*buf
)
115 uid_t auid
= audit_get_loginuid(current
);
116 unsigned int sessionid
= audit_get_sessionid(current
);
117 tty_audit_buf_push(current
, auid
, sessionid
, buf
);
121 * tty_audit_exit - Handle a task exit
123 * Make sure all buffered data is written out and deallocate the buffer.
124 * Only needs to be called if current->signal->tty_audit_buf != %NULL.
126 void tty_audit_exit(void)
128 struct tty_audit_buf
*buf
;
130 spin_lock_irq(¤t
->sighand
->siglock
);
131 buf
= current
->signal
->tty_audit_buf
;
132 current
->signal
->tty_audit_buf
= NULL
;
133 spin_unlock_irq(¤t
->sighand
->siglock
);
137 mutex_lock(&buf
->mutex
);
138 tty_audit_buf_push_current(buf
);
139 mutex_unlock(&buf
->mutex
);
141 tty_audit_buf_put(buf
);
145 * tty_audit_fork - Copy TTY audit state for a new task
147 * Set up TTY audit state in @sig from current. @sig needs no locking.
149 void tty_audit_fork(struct signal_struct
*sig
)
151 spin_lock_irq(¤t
->sighand
->siglock
);
152 sig
->audit_tty
= current
->signal
->audit_tty
;
153 spin_unlock_irq(¤t
->sighand
->siglock
);
157 * tty_audit_tiocsti - Log TIOCSTI
159 void tty_audit_tiocsti(struct tty_struct
*tty
, char ch
)
161 struct tty_audit_buf
*buf
;
162 int major
, minor
, should_audit
;
164 spin_lock_irq(¤t
->sighand
->siglock
);
165 should_audit
= current
->signal
->audit_tty
;
166 buf
= current
->signal
->tty_audit_buf
;
168 atomic_inc(&buf
->count
);
169 spin_unlock_irq(¤t
->sighand
->siglock
);
171 major
= tty
->driver
->major
;
172 minor
= tty
->driver
->minor_start
+ tty
->index
;
174 mutex_lock(&buf
->mutex
);
175 if (buf
->major
== major
&& buf
->minor
== minor
)
176 tty_audit_buf_push_current(buf
);
177 mutex_unlock(&buf
->mutex
);
178 tty_audit_buf_put(buf
);
181 if (should_audit
&& audit_enabled
) {
183 unsigned int sessionid
;
185 auid
= audit_get_loginuid(current
);
186 sessionid
= audit_get_sessionid(current
);
187 tty_audit_log("ioctl=TIOCSTI", current
, auid
, sessionid
, major
,
193 * tty_audit_push_task - Flush task's pending audit data
195 * @loginuid: sender login uid
196 * @sessionid: sender session id
198 * Called with a ref on @tsk held. Try to lock sighand and get a
199 * reference to the tty audit buffer if available.
200 * Flush the buffer or return an appropriate error code.
202 int tty_audit_push_task(struct task_struct
*tsk
, uid_t loginuid
, u32 sessionid
)
204 struct tty_audit_buf
*buf
= ERR_PTR(-EPERM
);
207 if (!lock_task_sighand(tsk
, &flags
))
210 if (tsk
->signal
->audit_tty
) {
211 buf
= tsk
->signal
->tty_audit_buf
;
213 atomic_inc(&buf
->count
);
215 unlock_task_sighand(tsk
, &flags
);
218 * Return 0 when signal->audit_tty set
219 * but tsk->signal->tty_audit_buf == NULL.
221 if (!buf
|| IS_ERR(buf
))
224 mutex_lock(&buf
->mutex
);
225 tty_audit_buf_push(tsk
, loginuid
, sessionid
, buf
);
226 mutex_unlock(&buf
->mutex
);
228 tty_audit_buf_put(buf
);
233 * tty_audit_buf_get - Get an audit buffer.
235 * Get an audit buffer for @tty, allocate it if necessary. Return %NULL
236 * if TTY auditing is disabled or out of memory. Otherwise, return a new
237 * reference to the buffer.
239 static struct tty_audit_buf
*tty_audit_buf_get(struct tty_struct
*tty
)
241 struct tty_audit_buf
*buf
, *buf2
;
245 spin_lock_irq(¤t
->sighand
->siglock
);
246 if (likely(!current
->signal
->audit_tty
))
248 buf
= current
->signal
->tty_audit_buf
;
250 atomic_inc(&buf
->count
);
253 spin_unlock_irq(¤t
->sighand
->siglock
);
255 buf2
= tty_audit_buf_alloc(tty
->driver
->major
,
256 tty
->driver
->minor_start
+ tty
->index
,
259 audit_log_lost("out of memory in TTY auditing");
263 spin_lock_irq(¤t
->sighand
->siglock
);
264 if (!current
->signal
->audit_tty
)
266 buf
= current
->signal
->tty_audit_buf
;
268 current
->signal
->tty_audit_buf
= buf2
;
272 atomic_inc(&buf
->count
);
275 spin_unlock_irq(¤t
->sighand
->siglock
);
277 tty_audit_buf_free(buf2
);
282 * tty_audit_add_data - Add data for TTY auditing.
284 * Audit @data of @size from @tty, if necessary.
286 void tty_audit_add_data(struct tty_struct
*tty
, unsigned char *data
,
289 struct tty_audit_buf
*buf
;
292 if (unlikely(size
== 0))
295 if (tty
->driver
->type
== TTY_DRIVER_TYPE_PTY
296 && tty
->driver
->subtype
== PTY_TYPE_MASTER
)
299 buf
= tty_audit_buf_get(tty
);
303 mutex_lock(&buf
->mutex
);
304 major
= tty
->driver
->major
;
305 minor
= tty
->driver
->minor_start
+ tty
->index
;
306 if (buf
->major
!= major
|| buf
->minor
!= minor
307 || buf
->icanon
!= tty
->icanon
) {
308 tty_audit_buf_push_current(buf
);
311 buf
->icanon
= tty
->icanon
;
316 run
= N_TTY_BUF_SIZE
- buf
->valid
;
319 memcpy(buf
->data
+ buf
->valid
, data
, run
);
323 if (buf
->valid
== N_TTY_BUF_SIZE
)
324 tty_audit_buf_push_current(buf
);
326 mutex_unlock(&buf
->mutex
);
327 tty_audit_buf_put(buf
);
331 * tty_audit_push - Push buffered data out
333 * Make sure no audit data is pending for @tty on the current process.
335 void tty_audit_push(struct tty_struct
*tty
)
337 struct tty_audit_buf
*buf
;
339 spin_lock_irq(¤t
->sighand
->siglock
);
340 if (likely(!current
->signal
->audit_tty
)) {
341 spin_unlock_irq(¤t
->sighand
->siglock
);
344 buf
= current
->signal
->tty_audit_buf
;
346 atomic_inc(&buf
->count
);
347 spin_unlock_irq(¤t
->sighand
->siglock
);
352 major
= tty
->driver
->major
;
353 minor
= tty
->driver
->minor_start
+ tty
->index
;
354 mutex_lock(&buf
->mutex
);
355 if (buf
->major
== major
&& buf
->minor
== minor
)
356 tty_audit_buf_push_current(buf
);
357 mutex_unlock(&buf
->mutex
);
358 tty_audit_buf_put(buf
);
This page took 0.036845 seconds and 5 git commands to generate.