projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
[PATCH] initialize name osid
[deliverable/linux.git] / kernel / auditsc.c
1 /* auditsc.c -- System-call auditing support
2 * Handles all system-call specific auditing features.
3 *
4 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
5 * Copyright 2005 Hewlett-Packard Development Company, L.P.
6 * Copyright (C) 2005, 2006 IBM Corporation
7 * All Rights Reserved.
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 *
23 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
24 *
25 * Many of the ideas implemented here are from Stephen C. Tweedie,
26 * especially the idea of avoiding a copy by using getname.
27 *
28 * The method for actual interception of syscall entry and exit (not in
29 * this file -- see entry.S) is based on a GPL'd patch written by
30 * okir@suse.de and Copyright 2003 SuSE Linux AG.
31 *
32 * POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>,
33 * 2006.
34 *
35 * The support of additional filter rules compares (>, <, >=, <=) was
36 * added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005.
37 *
38 * Modified by Amy Griffis <amy.griffis@hp.com> to collect additional
39 * filesystem information.
40 *
41 * Subject and object context labeling support added by <danjones@us.ibm.com>
42 * and <dustin.kirkland@us.ibm.com> for LSPP certification compliance.
43 */
44
45 #include <linux/init.h>
46 #include <asm/types.h>
47 #include <asm/atomic.h>
48 #include <asm/types.h>
49 #include <linux/fs.h>
50 #include <linux/namei.h>
51 #include <linux/mm.h>
52 #include <linux/module.h>
53 #include <linux/mount.h>
54 #include <linux/socket.h>
55 #include <linux/mqueue.h>
56 #include <linux/audit.h>
57 #include <linux/personality.h>
58 #include <linux/time.h>
59 #include <linux/netlink.h>
60 #include <linux/compiler.h>
61 #include <asm/unistd.h>
62 #include <linux/security.h>
63 #include <linux/list.h>
64 #include <linux/tty.h>
65 #include <linux/selinux.h>
66 #include <linux/binfmts.h>
67 #include <linux/highmem.h>
68 #include <linux/syscalls.h>
69
70 #include "audit.h"
71
72 extern struct list_head audit_filter_list[];
73
74 /* No syscall auditing will take place unless audit_enabled != 0. */
75 extern int audit_enabled;
76
77 /* AUDIT_NAMES is the number of slots we reserve in the audit_context
78 * for saving names from getname(). */
79 #define AUDIT_NAMES 20
80
81 /* AUDIT_NAMES_RESERVED is the number of slots we reserve in the
82 * audit_context from being used for nameless inodes from
83 * path_lookup. */
84 #define AUDIT_NAMES_RESERVED 7
85
86 /* Indicates that audit should log the full pathname. */
87 #define AUDIT_NAME_FULL -1
88
89 /* number of audit rules */
90 int audit_n_rules;
91
92 /* determines whether we collect data for signals sent */
93 int audit_signals;
94
95 /* When fs/namei.c:getname() is called, we store the pointer in name and
96 * we don't let putname() free it (instead we free all of the saved
97 * pointers at syscall exit time).
98 *
99 * Further, in fs/namei.c:path_lookup() we store the inode and device. */
100 struct audit_names {
101 const char *name;
102 int name_len; /* number of name's characters to log */
103 unsigned name_put; /* call __putname() for this name */
104 unsigned long ino;
105 dev_t dev;
106 umode_t mode;
107 uid_t uid;
108 gid_t gid;
109 dev_t rdev;
110 u32 osid;
111 };
112
113 struct audit_aux_data {
114 struct audit_aux_data *next;
115 int type;
116 };
117
118 #define AUDIT_AUX_IPCPERM 0
119
120 /* Number of target pids per aux struct. */
121 #define AUDIT_AUX_PIDS 16
122
123 struct audit_aux_data_mq_open {
124 struct audit_aux_data d;
125 int oflag;
126 mode_t mode;
127 struct mq_attr attr;
128 };
129
130 struct audit_aux_data_mq_sendrecv {
131 struct audit_aux_data d;
132 mqd_t mqdes;
133 size_t msg_len;
134 unsigned int msg_prio;
135 struct timespec abs_timeout;
136 };
137
138 struct audit_aux_data_mq_notify {
139 struct audit_aux_data d;
140 mqd_t mqdes;
141 struct sigevent notification;
142 };
143
144 struct audit_aux_data_mq_getsetattr {
145 struct audit_aux_data d;
146 mqd_t mqdes;
147 struct mq_attr mqstat;
148 };
149
150 struct audit_aux_data_ipcctl {
151 struct audit_aux_data d;
152 struct ipc_perm p;
153 unsigned long qbytes;
154 uid_t uid;
155 gid_t gid;
156 mode_t mode;
157 u32 osid;
158 };
159
160 struct audit_aux_data_execve {
161 struct audit_aux_data d;
162 int argc;
163 int envc;
164 char mem[0];
165 };
166
167 struct audit_aux_data_socketcall {
168 struct audit_aux_data d;
169 int nargs;
170 unsigned long args[0];
171 };
172
173 struct audit_aux_data_sockaddr {
174 struct audit_aux_data d;
175 int len;
176 char a[0];
177 };
178
179 struct audit_aux_data_fd_pair {
180 struct audit_aux_data d;
181 int fd[2];
182 };
183
184 struct audit_aux_data_path {
185 struct audit_aux_data d;
186 struct dentry *dentry;
187 struct vfsmount *mnt;
188 };
189
190 struct audit_aux_data_pids {
191 struct audit_aux_data d;
192 pid_t target_pid[AUDIT_AUX_PIDS];
193 u32 target_sid[AUDIT_AUX_PIDS];
194 int pid_count;
195 };
196
197 /* The per-task audit context. */
198 struct audit_context {
199 int dummy; /* must be the first element */
200 int in_syscall; /* 1 if task is in a syscall */
201 enum audit_state state;
202 unsigned int serial; /* serial number for record */
203 struct timespec ctime; /* time of syscall entry */
204 uid_t loginuid; /* login uid (identity) */
205 int major; /* syscall number */
206 unsigned long argv[4]; /* syscall arguments */
207 int return_valid; /* return code is valid */
208 long return_code;/* syscall return code */
209 int auditable; /* 1 if record should be written */
210 int name_count;
211 struct audit_names names[AUDIT_NAMES];
212 char * filterkey; /* key for rule that triggered record */
213 struct dentry * pwd;
214 struct vfsmount * pwdmnt;
215 struct audit_context *previous; /* For nested syscalls */
216 struct audit_aux_data *aux;
217 struct audit_aux_data *aux_pids;
218
219 /* Save things to print about task_struct */
220 pid_t pid, ppid;
221 uid_t uid, euid, suid, fsuid;
222 gid_t gid, egid, sgid, fsgid;
223 unsigned long personality;
224 int arch;
225
226 pid_t target_pid;
227 u32 target_sid;
228
229 #if AUDIT_DEBUG
230 int put_count;
231 int ino_count;
232 #endif
233 };
234
235 #define ACC_MODE(x) ("\004\002\006\006"[(x)&O_ACCMODE])
236 static inline int open_arg(int flags, int mask)
237 {
238 int n = ACC_MODE(flags);
239 if (flags & (O_TRUNC | O_CREAT))
240 n |= AUDIT_PERM_WRITE;
241 return n & mask;
242 }
243
244 static int audit_match_perm(struct audit_context *ctx, int mask)
245 {
246 unsigned n = ctx->major;
247 switch (audit_classify_syscall(ctx->arch, n)) {
248 case 0: /* native */
249 if ((mask & AUDIT_PERM_WRITE) &&
250 audit_match_class(AUDIT_CLASS_WRITE, n))
251 return 1;
252 if ((mask & AUDIT_PERM_READ) &&
253 audit_match_class(AUDIT_CLASS_READ, n))
254 return 1;
255 if ((mask & AUDIT_PERM_ATTR) &&
256 audit_match_class(AUDIT_CLASS_CHATTR, n))
257 return 1;
258 return 0;
259 case 1: /* 32bit on biarch */
260 if ((mask & AUDIT_PERM_WRITE) &&
261 audit_match_class(AUDIT_CLASS_WRITE_32, n))
262 return 1;
263 if ((mask & AUDIT_PERM_READ) &&
264 audit_match_class(AUDIT_CLASS_READ_32, n))
265 return 1;
266 if ((mask & AUDIT_PERM_ATTR) &&
267 audit_match_class(AUDIT_CLASS_CHATTR_32, n))
268 return 1;
269 return 0;
270 case 2: /* open */
271 return mask & ACC_MODE(ctx->argv[1]);
272 case 3: /* openat */
273 return mask & ACC_MODE(ctx->argv[2]);
274 case 4: /* socketcall */
275 return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);
276 case 5: /* execve */
277 return mask & AUDIT_PERM_EXEC;
278 default:
279 return 0;
280 }
281 }
282
283 /* Determine if any context name data matches a rule's watch data */
284 /* Compare a task_struct with an audit_rule. Return 1 on match, 0
285 * otherwise. */
286 static int audit_filter_rules(struct task_struct *tsk,
287 struct audit_krule *rule,
288 struct audit_context *ctx,
289 struct audit_names *name,
290 enum audit_state *state)
291 {
292 int i, j, need_sid = 1;
293 u32 sid;
294
295 for (i = 0; i < rule->field_count; i++) {
296 struct audit_field *f = &rule->fields[i];
297 int result = 0;
298
299 switch (f->type) {
300 case AUDIT_PID:
301 result = audit_comparator(tsk->pid, f->op, f->val);
302 break;
303 case AUDIT_PPID:
304 if (ctx) {
305 if (!ctx->ppid)
306 ctx->ppid = sys_getppid();
307 result = audit_comparator(ctx->ppid, f->op, f->val);
308 }
309 break;
310 case AUDIT_UID:
311 result = audit_comparator(tsk->uid, f->op, f->val);
312 break;
313 case AUDIT_EUID:
314 result = audit_comparator(tsk->euid, f->op, f->val);
315 break;
316 case AUDIT_SUID:
317 result = audit_comparator(tsk->suid, f->op, f->val);
318 break;
319 case AUDIT_FSUID:
320 result = audit_comparator(tsk->fsuid, f->op, f->val);
321 break;
322 case AUDIT_GID:
323 result = audit_comparator(tsk->gid, f->op, f->val);
324 break;
325 case AUDIT_EGID:
326 result = audit_comparator(tsk->egid, f->op, f->val);
327 break;
328 case AUDIT_SGID:
329 result = audit_comparator(tsk->sgid, f->op, f->val);
330 break;
331 case AUDIT_FSGID:
332 result = audit_comparator(tsk->fsgid, f->op, f->val);
333 break;
334 case AUDIT_PERS:
335 result = audit_comparator(tsk->personality, f->op, f->val);
336 break;
337 case AUDIT_ARCH:
338 if (ctx)
339 result = audit_comparator(ctx->arch, f->op, f->val);
340 break;
341
342 case AUDIT_EXIT:
343 if (ctx && ctx->return_valid)
344 result = audit_comparator(ctx->return_code, f->op, f->val);
345 break;
346 case AUDIT_SUCCESS:
347 if (ctx && ctx->return_valid) {
348 if (f->val)
349 result = audit_comparator(ctx->return_valid, f->op, AUDITSC_SUCCESS);
350 else
351 result = audit_comparator(ctx->return_valid, f->op, AUDITSC_FAILURE);
352 }
353 break;
354 case AUDIT_DEVMAJOR:
355 if (name)
356 result = audit_comparator(MAJOR(name->dev),
357 f->op, f->val);
358 else if (ctx) {
359 for (j = 0; j < ctx->name_count; j++) {
360 if (audit_comparator(MAJOR(ctx->names[j].dev), f->op, f->val)) {
361 ++result;
362 break;
363 }
364 }
365 }
366 break;
367 case AUDIT_DEVMINOR:
368 if (name)
369 result = audit_comparator(MINOR(name->dev),
370 f->op, f->val);
371 else if (ctx) {
372 for (j = 0; j < ctx->name_count; j++) {
373 if (audit_comparator(MINOR(ctx->names[j].dev), f->op, f->val)) {
374 ++result;
375 break;
376 }
377 }
378 }
379 break;
380 case AUDIT_INODE:
381 if (name)
382 result = (name->ino == f->val);
383 else if (ctx) {
384 for (j = 0; j < ctx->name_count; j++) {
385 if (audit_comparator(ctx->names[j].ino, f->op, f->val)) {
386 ++result;
387 break;
388 }
389 }
390 }
391 break;
392 case AUDIT_WATCH:
393 if (name && rule->watch->ino != (unsigned long)-1)
394 result = (name->dev == rule->watch->dev &&
395 name->ino == rule->watch->ino);
396 break;
397 case AUDIT_LOGINUID:
398 result = 0;
399 if (ctx)
400 result = audit_comparator(ctx->loginuid, f->op, f->val);
401 break;
402 case AUDIT_SUBJ_USER:
403 case AUDIT_SUBJ_ROLE:
404 case AUDIT_SUBJ_TYPE:
405 case AUDIT_SUBJ_SEN:
406 case AUDIT_SUBJ_CLR:
407 /* NOTE: this may return negative values indicating
408 a temporary error. We simply treat this as a
409 match for now to avoid losing information that
410 may be wanted. An error message will also be
411 logged upon error */
412 if (f->se_rule) {
413 if (need_sid) {
414 selinux_get_task_sid(tsk, &sid);
415 need_sid = 0;
416 }
417 result = selinux_audit_rule_match(sid, f->type,
418 f->op,
419 f->se_rule,
420 ctx);
421 }
422 break;
423 case AUDIT_OBJ_USER:
424 case AUDIT_OBJ_ROLE:
425 case AUDIT_OBJ_TYPE:
426 case AUDIT_OBJ_LEV_LOW:
427 case AUDIT_OBJ_LEV_HIGH:
428 /* The above note for AUDIT_SUBJ_USER...AUDIT_SUBJ_CLR
429 also applies here */
430 if (f->se_rule) {
431 /* Find files that match */
432 if (name) {
433 result = selinux_audit_rule_match(
434 name->osid, f->type, f->op,
435 f->se_rule, ctx);
436 } else if (ctx) {
437 for (j = 0; j < ctx->name_count; j++) {
438 if (selinux_audit_rule_match(
439 ctx->names[j].osid,
440 f->type, f->op,
441 f->se_rule, ctx)) {
442 ++result;
443 break;
444 }
445 }
446 }
447 /* Find ipc objects that match */
448 if (ctx) {
449 struct audit_aux_data *aux;
450 for (aux = ctx->aux; aux;
451 aux = aux->next) {
452 if (aux->type == AUDIT_IPC) {
453 struct audit_aux_data_ipcctl *axi = (void *)aux;
454 if (selinux_audit_rule_match(axi->osid, f->type, f->op, f->se_rule, ctx)) {
455 ++result;
456 break;
457 }
458 }
459 }
460 }
461 }
462 break;
463 case AUDIT_ARG0:
464 case AUDIT_ARG1:
465 case AUDIT_ARG2:
466 case AUDIT_ARG3:
467 if (ctx)
468 result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
469 break;
470 case AUDIT_FILTERKEY:
471 /* ignore this field for filtering */
472 result = 1;
473 break;
474 case AUDIT_PERM:
475 result = audit_match_perm(ctx, f->val);
476 break;
477 }
478
479 if (!result)
480 return 0;
481 }
482 if (rule->filterkey)
483 ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
484 switch (rule->action) {
485 case AUDIT_NEVER: *state = AUDIT_DISABLED; break;
486 case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break;
487 }
488 return 1;
489 }
490
491 /* At process creation time, we can determine if system-call auditing is
492 * completely disabled for this task. Since we only have the task
493 * structure at this point, we can only check uid and gid.
494 */
495 static enum audit_state audit_filter_task(struct task_struct *tsk)
496 {
497 struct audit_entry *e;
498 enum audit_state state;
499
500 rcu_read_lock();
501 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
502 if (audit_filter_rules(tsk, &e->rule, NULL, NULL, &state)) {
503 rcu_read_unlock();
504 return state;
505 }
506 }
507 rcu_read_unlock();
508 return AUDIT_BUILD_CONTEXT;
509 }
510
511 /* At syscall entry and exit time, this filter is called if the
512 * audit_state is not low enough that auditing cannot take place, but is
513 * also not high enough that we already know we have to write an audit
514 * record (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT).
515 */
516 static enum audit_state audit_filter_syscall(struct task_struct *tsk,
517 struct audit_context *ctx,
518 struct list_head *list)
519 {
520 struct audit_entry *e;
521 enum audit_state state;
522
523 if (audit_pid && tsk->tgid == audit_pid)
524 return AUDIT_DISABLED;
525
526 rcu_read_lock();
527 if (!list_empty(list)) {
528 int word = AUDIT_WORD(ctx->major);
529 int bit = AUDIT_BIT(ctx->major);
530
531 list_for_each_entry_rcu(e, list, list) {
532 if ((e->rule.mask[word] & bit) == bit &&
533 audit_filter_rules(tsk, &e->rule, ctx, NULL,
534 &state)) {
535 rcu_read_unlock();
536 return state;
537 }
538 }
539 }
540 rcu_read_unlock();
541 return AUDIT_BUILD_CONTEXT;
542 }
543
544 /* At syscall exit time, this filter is called if any audit_names[] have been
545 * collected during syscall processing. We only check rules in sublists at hash
546 * buckets applicable to the inode numbers in audit_names[].
547 * Regarding audit_state, same rules apply as for audit_filter_syscall().
548 */
549 enum audit_state audit_filter_inodes(struct task_struct *tsk,
550 struct audit_context *ctx)
551 {
552 int i;
553 struct audit_entry *e;
554 enum audit_state state;
555
556 if (audit_pid && tsk->tgid == audit_pid)
557 return AUDIT_DISABLED;
558
559 rcu_read_lock();
560 for (i = 0; i < ctx->name_count; i++) {
561 int word = AUDIT_WORD(ctx->major);
562 int bit = AUDIT_BIT(ctx->major);
563 struct audit_names *n = &ctx->names[i];
564 int h = audit_hash_ino((u32)n->ino);
565 struct list_head *list = &audit_inode_hash[h];
566
567 if (list_empty(list))
568 continue;
569
570 list_for_each_entry_rcu(e, list, list) {
571 if ((e->rule.mask[word] & bit) == bit &&
572 audit_filter_rules(tsk, &e->rule, ctx, n, &state)) {
573 rcu_read_unlock();
574 return state;
575 }
576 }
577 }
578 rcu_read_unlock();
579 return AUDIT_BUILD_CONTEXT;
580 }
581
582 void audit_set_auditable(struct audit_context *ctx)
583 {
584 ctx->auditable = 1;
585 }
586
587 static inline struct audit_context *audit_get_context(struct task_struct *tsk,
588 int return_valid,
589 int return_code)
590 {
591 struct audit_context *context = tsk->audit_context;
592
593 if (likely(!context))
594 return NULL;
595 context->return_valid = return_valid;
596 context->return_code = return_code;
597
598 if (context->in_syscall && !context->dummy && !context->auditable) {
599 enum audit_state state;
600
601 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
602 if (state == AUDIT_RECORD_CONTEXT) {
603 context->auditable = 1;
604 goto get_context;
605 }
606
607 state = audit_filter_inodes(tsk, context);
608 if (state == AUDIT_RECORD_CONTEXT)
609 context->auditable = 1;
610
611 }
612
613 get_context:
614
615 tsk->audit_context = NULL;
616 return context;
617 }
618
619 static inline void audit_free_names(struct audit_context *context)
620 {
621 int i;
622
623 #if AUDIT_DEBUG == 2
624 if (context->auditable
625 ||context->put_count + context->ino_count != context->name_count) {
626 printk(KERN_ERR "%s:%d(:%d): major=%d in_syscall=%d"
627 " name_count=%d put_count=%d"
628 " ino_count=%d [NOT freeing]\n",
629 __FILE__, __LINE__,
630 context->serial, context->major, context->in_syscall,
631 context->name_count, context->put_count,
632 context->ino_count);
633 for (i = 0; i < context->name_count; i++) {
634 printk(KERN_ERR "names[%d] = %p = %s\n", i,
635 context->names[i].name,
636 context->names[i].name ?: "(null)");
637 }
638 dump_stack();
639 return;
640 }
641 #endif
642 #if AUDIT_DEBUG
643 context->put_count = 0;
644 context->ino_count = 0;
645 #endif
646
647 for (i = 0; i < context->name_count; i++) {
648 if (context->names[i].name && context->names[i].name_put)
649 __putname(context->names[i].name);
650 }
651 context->name_count = 0;
652 if (context->pwd)
653 dput(context->pwd);
654 if (context->pwdmnt)
655 mntput(context->pwdmnt);
656 context->pwd = NULL;
657 context->pwdmnt = NULL;
658 }
659
660 static inline void audit_free_aux(struct audit_context *context)
661 {
662 struct audit_aux_data *aux;
663
664 while ((aux = context->aux)) {
665 if (aux->type == AUDIT_AVC_PATH) {
666 struct audit_aux_data_path *axi = (void *)aux;
667 dput(axi->dentry);
668 mntput(axi->mnt);
669 }
670
671 context->aux = aux->next;
672 kfree(aux);
673 }
674 while ((aux = context->aux_pids)) {
675 context->aux_pids = aux->next;
676 kfree(aux);
677 }
678 }
679
680 static inline void audit_zero_context(struct audit_context *context,
681 enum audit_state state)
682 {
683 uid_t loginuid = context->loginuid;
684
685 memset(context, 0, sizeof(*context));
686 context->state = state;
687 context->loginuid = loginuid;
688 }
689
690 static inline struct audit_context *audit_alloc_context(enum audit_state state)
691 {
692 struct audit_context *context;
693
694 if (!(context = kmalloc(sizeof(*context), GFP_KERNEL)))
695 return NULL;
696 audit_zero_context(context, state);
697 return context;
698 }
699
700 /**
701 * audit_alloc - allocate an audit context block for a task
702 * @tsk: task
703 *
704 * Filter on the task information and allocate a per-task audit context
705 * if necessary. Doing so turns on system call auditing for the
706 * specified task. This is called from copy_process, so no lock is
707 * needed.
708 */
709 int audit_alloc(struct task_struct *tsk)
710 {
711 struct audit_context *context;
712 enum audit_state state;
713
714 if (likely(!audit_enabled))
715 return 0; /* Return if not auditing. */
716
717 state = audit_filter_task(tsk);
718 if (likely(state == AUDIT_DISABLED))
719 return 0;
720
721 if (!(context = audit_alloc_context(state))) {
722 audit_log_lost("out of memory in audit_alloc");
723 return -ENOMEM;
724 }
725
726 /* Preserve login uid */
727 context->loginuid = -1;
728 if (current->audit_context)
729 context->loginuid = current->audit_context->loginuid;
730
731 tsk->audit_context = context;
732 set_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
733 return 0;
734 }
735
736 static inline void audit_free_context(struct audit_context *context)
737 {
738 struct audit_context *previous;
739 int count = 0;
740
741 do {
742 previous = context->previous;
743 if (previous || (count && count < 10)) {
744 ++count;
745 printk(KERN_ERR "audit(:%d): major=%d name_count=%d:"
746 " freeing multiple contexts (%d)\n",
747 context->serial, context->major,
748 context->name_count, count);
749 }
750 audit_free_names(context);
751 audit_free_aux(context);
752 kfree(context->filterkey);
753 kfree(context);
754 context = previous;
755 } while (context);
756 if (count >= 10)
757 printk(KERN_ERR "audit: freed %d contexts\n", count);
758 }
759
760 void audit_log_task_context(struct audit_buffer *ab)
761 {
762 char *ctx = NULL;
763 unsigned len;
764 int error;
765 u32 sid;
766
767 selinux_get_task_sid(current, &sid);
768 if (!sid)
769 return;
770
771 error = selinux_sid_to_string(sid, &ctx, &len);
772 if (error) {
773 if (error != -EINVAL)
774 goto error_path;
775 return;
776 }
777
778 audit_log_format(ab, " subj=%s", ctx);
779 kfree(ctx);
780 return;
781
782 error_path:
783 audit_panic("error in audit_log_task_context");
784 return;
785 }
786
787 EXPORT_SYMBOL(audit_log_task_context);
788
789 static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
790 {
791 char name[sizeof(tsk->comm)];
792 struct mm_struct *mm = tsk->mm;
793 struct vm_area_struct *vma;
794
795 /* tsk == current */
796
797 get_task_comm(name, tsk);
798 audit_log_format(ab, " comm=");
799 audit_log_untrustedstring(ab, name);
800
801 if (mm) {
802 down_read(&mm->mmap_sem);
803 vma = mm->mmap;
804 while (vma) {
805 if ((vma->vm_flags & VM_EXECUTABLE) &&
806 vma->vm_file) {
807 audit_log_d_path(ab, "exe=",
808 vma->vm_file->f_path.dentry,
809 vma->vm_file->f_path.mnt);
810 break;
811 }
812 vma = vma->vm_next;
813 }
814 up_read(&mm->mmap_sem);
815 }
816 audit_log_task_context(ab);
817 }
818
819 static int audit_log_pid_context(struct audit_context *context, pid_t pid,
820 u32 sid)
821 {
822 struct audit_buffer *ab;
823 char *s = NULL;
824 u32 len;
825 int rc = 0;
826
827 ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
828 if (!ab)
829 return 1;
830
831 if (selinux_sid_to_string(sid, &s, &len)) {
832 audit_log_format(ab, "opid=%d obj=(none)", pid);
833 rc = 1;
834 } else
835 audit_log_format(ab, "opid=%d obj=%s", pid, s);
836 audit_log_end(ab);
837 kfree(s);
838
839 return rc;
840 }
841
842 static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)
843 {
844 int i, call_panic = 0;
845 struct audit_buffer *ab;
846 struct audit_aux_data *aux;
847 const char *tty;
848
849 /* tsk == current */
850 context->pid = tsk->pid;
851 if (!context->ppid)
852 context->ppid = sys_getppid();
853 context->uid = tsk->uid;
854 context->gid = tsk->gid;
855 context->euid = tsk->euid;
856 context->suid = tsk->suid;
857 context->fsuid = tsk->fsuid;
858 context->egid = tsk->egid;
859 context->sgid = tsk->sgid;
860 context->fsgid = tsk->fsgid;
861 context->personality = tsk->personality;
862
863 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
864 if (!ab)
865 return; /* audit_panic has been called */
866 audit_log_format(ab, "arch=%x syscall=%d",
867 context->arch, context->major);
868 if (context->personality != PER_LINUX)
869 audit_log_format(ab, " per=%lx", context->personality);
870 if (context->return_valid)
871 audit_log_format(ab, " success=%s exit=%ld",
872 (context->return_valid==AUDITSC_SUCCESS)?"yes":"no",
873 context->return_code);
874
875 mutex_lock(&tty_mutex);
876 read_lock(&tasklist_lock);
877 if (tsk->signal && tsk->signal->tty && tsk->signal->tty->name)
878 tty = tsk->signal->tty->name;
879 else
880 tty = "(none)";
881 read_unlock(&tasklist_lock);
882 audit_log_format(ab,
883 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d"
884 " ppid=%d pid=%d auid=%u uid=%u gid=%u"
885 " euid=%u suid=%u fsuid=%u"
886 " egid=%u sgid=%u fsgid=%u tty=%s",
887 context->argv[0],
888 context->argv[1],
889 context->argv[2],
890 context->argv[3],
891 context->name_count,
892 context->ppid,
893 context->pid,
894 context->loginuid,
895 context->uid,
896 context->gid,
897 context->euid, context->suid, context->fsuid,
898 context->egid, context->sgid, context->fsgid, tty);
899
900 mutex_unlock(&tty_mutex);
901
902 audit_log_task_info(ab, tsk);
903 if (context->filterkey) {
904 audit_log_format(ab, " key=");
905 audit_log_untrustedstring(ab, context->filterkey);
906 } else
907 audit_log_format(ab, " key=(null)");
908 audit_log_end(ab);
909
910 for (aux = context->aux; aux; aux = aux->next) {
911
912 ab = audit_log_start(context, GFP_KERNEL, aux->type);
913 if (!ab)
914 continue; /* audit_panic has been called */
915
916 switch (aux->type) {
917 case AUDIT_MQ_OPEN: {
918 struct audit_aux_data_mq_open *axi = (void *)aux;
919 audit_log_format(ab,
920 "oflag=0x%x mode=%#o mq_flags=0x%lx mq_maxmsg=%ld "
921 "mq_msgsize=%ld mq_curmsgs=%ld",
922 axi->oflag, axi->mode, axi->attr.mq_flags,
923 axi->attr.mq_maxmsg, axi->attr.mq_msgsize,
924 axi->attr.mq_curmsgs);
925 break; }
926
927 case AUDIT_MQ_SENDRECV: {
928 struct audit_aux_data_mq_sendrecv *axi = (void *)aux;
929 audit_log_format(ab,
930 "mqdes=%d msg_len=%zd msg_prio=%u "
931 "abs_timeout_sec=%ld abs_timeout_nsec=%ld",
932 axi->mqdes, axi->msg_len, axi->msg_prio,
933 axi->abs_timeout.tv_sec, axi->abs_timeout.tv_nsec);
934 break; }
935
936 case AUDIT_MQ_NOTIFY: {
937 struct audit_aux_data_mq_notify *axi = (void *)aux;
938 audit_log_format(ab,
939 "mqdes=%d sigev_signo=%d",
940 axi->mqdes,
941 axi->notification.sigev_signo);
942 break; }
943
944 case AUDIT_MQ_GETSETATTR: {
945 struct audit_aux_data_mq_getsetattr *axi = (void *)aux;
946 audit_log_format(ab,
947 "mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
948 "mq_curmsgs=%ld ",
949 axi->mqdes,
950 axi->mqstat.mq_flags, axi->mqstat.mq_maxmsg,
951 axi->mqstat.mq_msgsize, axi->mqstat.mq_curmsgs);
952 break; }
953
954 case AUDIT_IPC: {
955 struct audit_aux_data_ipcctl *axi = (void *)aux;
956 audit_log_format(ab,
957 "ouid=%u ogid=%u mode=%x",
958 axi->uid, axi->gid, axi->mode);
959 if (axi->osid != 0) {
960 char *ctx = NULL;
961 u32 len;
962 if (selinux_sid_to_string(
963 axi->osid, &ctx, &len)) {
964 audit_log_format(ab, " osid=%u",
965 axi->osid);
966 call_panic = 1;
967 } else
968 audit_log_format(ab, " obj=%s", ctx);
969 kfree(ctx);
970 }
971 break; }
972
973 case AUDIT_IPC_SET_PERM: {
974 struct audit_aux_data_ipcctl *axi = (void *)aux;
975 audit_log_format(ab,
976 "qbytes=%lx ouid=%u ogid=%u mode=%x",
977 axi->qbytes, axi->uid, axi->gid, axi->mode);
978 break; }
979
980 case AUDIT_EXECVE: {
981 struct audit_aux_data_execve *axi = (void *)aux;
982 int i;
983 const char *p;
984 for (i = 0, p = axi->mem; i < axi->argc; i++) {
985 audit_log_format(ab, "a%d=", i);
986 p = audit_log_untrustedstring(ab, p);
987 audit_log_format(ab, "\n");
988 }
989 break; }
990
991 case AUDIT_SOCKETCALL: {
992 int i;
993 struct audit_aux_data_socketcall *axs = (void *)aux;
994 audit_log_format(ab, "nargs=%d", axs->nargs);
995 for (i=0; i<axs->nargs; i++)
996 audit_log_format(ab, " a%d=%lx", i, axs->args[i]);
997 break; }
998
999 case AUDIT_SOCKADDR: {
1000 struct audit_aux_data_sockaddr *axs = (void *)aux;
1001
1002 audit_log_format(ab, "saddr=");
1003 audit_log_hex(ab, axs->a, axs->len);
1004 break; }
1005
1006 case AUDIT_AVC_PATH: {
1007 struct audit_aux_data_path *axi = (void *)aux;
1008 audit_log_d_path(ab, "path=", axi->dentry, axi->mnt);
1009 break; }
1010
1011 case AUDIT_FD_PAIR: {
1012 struct audit_aux_data_fd_pair *axs = (void *)aux;
1013 audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]);
1014 break; }
1015
1016 }
1017 audit_log_end(ab);
1018 }
1019
1020 for (aux = context->aux_pids; aux; aux = aux->next) {
1021 struct audit_aux_data_pids *axs = (void *)aux;
1022 int i;
1023
1024 for (i = 0; i < axs->pid_count; i++)
1025 if (audit_log_pid_context(context, axs->target_pid[i],
1026 axs->target_sid[i]))
1027 call_panic = 1;
1028 }
1029
1030 if (context->target_pid &&
1031 audit_log_pid_context(context, context->target_pid,
1032 context->target_sid))
1033 call_panic = 1;
1034
1035 if (context->pwd && context->pwdmnt) {
1036 ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
1037 if (ab) {
1038 audit_log_d_path(ab, "cwd=", context->pwd, context->pwdmnt);
1039 audit_log_end(ab);
1040 }
1041 }
1042 for (i = 0; i < context->name_count; i++) {
1043 struct audit_names *n = &context->names[i];
1044
1045 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
1046 if (!ab)
1047 continue; /* audit_panic has been called */
1048
1049 audit_log_format(ab, "item=%d", i);
1050
1051 if (n->name) {
1052 switch(n->name_len) {
1053 case AUDIT_NAME_FULL:
1054 /* log the full path */
1055 audit_log_format(ab, " name=");
1056 audit_log_untrustedstring(ab, n->name);
1057 break;
1058 case 0:
1059 /* name was specified as a relative path and the
1060 * directory component is the cwd */
1061 audit_log_d_path(ab, " name=", context->pwd,
1062 context->pwdmnt);
1063 break;
1064 default:
1065 /* log the name's directory component */
1066 audit_log_format(ab, " name=");
1067 audit_log_n_untrustedstring(ab, n->name_len,
1068 n->name);
1069 }
1070 } else
1071 audit_log_format(ab, " name=(null)");
1072
1073 if (n->ino != (unsigned long)-1) {
1074 audit_log_format(ab, " inode=%lu"
1075 " dev=%02x:%02x mode=%#o"
1076 " ouid=%u ogid=%u rdev=%02x:%02x",
1077 n->ino,
1078 MAJOR(n->dev),
1079 MINOR(n->dev),
1080 n->mode,
1081 n->uid,
1082 n->gid,
1083 MAJOR(n->rdev),
1084 MINOR(n->rdev));
1085 }
1086 if (n->osid != 0) {
1087 char *ctx = NULL;
1088 u32 len;
1089 if (selinux_sid_to_string(
1090 n->osid, &ctx, &len)) {
1091 audit_log_format(ab, " osid=%u", n->osid);
1092 call_panic = 2;
1093 } else
1094 audit_log_format(ab, " obj=%s", ctx);
1095 kfree(ctx);
1096 }
1097
1098 audit_log_end(ab);
1099 }
1100 if (call_panic)
1101 audit_panic("error converting sid to string");
1102 }
1103
1104 /**
1105 * audit_free - free a per-task audit context
1106 * @tsk: task whose audit context block to free
1107 *
1108 * Called from copy_process and do_exit
1109 */
1110 void audit_free(struct task_struct *tsk)
1111 {
1112 struct audit_context *context;
1113
1114 context = audit_get_context(tsk, 0, 0);
1115 if (likely(!context))
1116 return;
1117
1118 /* Check for system calls that do not go through the exit
1119 * function (e.g., exit_group), then free context block.
1120 * We use GFP_ATOMIC here because we might be doing this
1121 * in the context of the idle thread */
1122 /* that can happen only if we are called from do_exit() */
1123 if (context->in_syscall && context->auditable)
1124 audit_log_exit(context, tsk);
1125
1126 audit_free_context(context);
1127 }
1128
1129 /**
1130 * audit_syscall_entry - fill in an audit record at syscall entry
1131 * @tsk: task being audited
1132 * @arch: architecture type
1133 * @major: major syscall type (function)
1134 * @a1: additional syscall register 1
1135 * @a2: additional syscall register 2
1136 * @a3: additional syscall register 3
1137 * @a4: additional syscall register 4
1138 *
1139 * Fill in audit context at syscall entry. This only happens if the
1140 * audit context was created when the task was created and the state or
1141 * filters demand the audit context be built. If the state from the
1142 * per-task filter or from the per-syscall filter is AUDIT_RECORD_CONTEXT,
1143 * then the record will be written at syscall exit time (otherwise, it
1144 * will only be written if another part of the kernel requests that it
1145 * be written).
1146 */
1147 void audit_syscall_entry(int arch, int major,
1148 unsigned long a1, unsigned long a2,
1149 unsigned long a3, unsigned long a4)
1150 {
1151 struct task_struct *tsk = current;
1152 struct audit_context *context = tsk->audit_context;
1153 enum audit_state state;
1154
1155 BUG_ON(!context);
1156
1157 /*
1158 * This happens only on certain architectures that make system
1159 * calls in kernel_thread via the entry.S interface, instead of
1160 * with direct calls. (If you are porting to a new
1161 * architecture, hitting this condition can indicate that you
1162 * got the _exit/_leave calls backward in entry.S.)
1163 *
1164 * i386 no
1165 * x86_64 no
1166 * ppc64 yes (see arch/powerpc/platforms/iseries/misc.S)
1167 *
1168 * This also happens with vm86 emulation in a non-nested manner
1169 * (entries without exits), so this case must be caught.
1170 */
1171 if (context->in_syscall) {
1172 struct audit_context *newctx;
1173
1174 #if AUDIT_DEBUG
1175 printk(KERN_ERR
1176 "audit(:%d) pid=%d in syscall=%d;"
1177 " entering syscall=%d\n",
1178 context->serial, tsk->pid, context->major, major);
1179 #endif
1180 newctx = audit_alloc_context(context->state);
1181 if (newctx) {
1182 newctx->previous = context;
1183 context = newctx;
1184 tsk->audit_context = newctx;
1185 } else {
1186 /* If we can't alloc a new context, the best we
1187 * can do is to leak memory (any pending putname
1188 * will be lost). The only other alternative is
1189 * to abandon auditing. */
1190 audit_zero_context(context, context->state);
1191 }
1192 }
1193 BUG_ON(context->in_syscall || context->name_count);
1194
1195 if (!audit_enabled)
1196 return;
1197
1198 context->arch = arch;
1199 context->major = major;
1200 context->argv[0] = a1;
1201 context->argv[1] = a2;
1202 context->argv[2] = a3;
1203 context->argv[3] = a4;
1204
1205 state = context->state;
1206 context->dummy = !audit_n_rules;
1207 if (!context->dummy && (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT))
1208 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
1209 if (likely(state == AUDIT_DISABLED))
1210 return;
1211
1212 context->serial = 0;
1213 context->ctime = CURRENT_TIME;
1214 context->in_syscall = 1;
1215 context->auditable = !!(state == AUDIT_RECORD_CONTEXT);
1216 context->ppid = 0;
1217 }
1218
1219 /**
1220 * audit_syscall_exit - deallocate audit context after a system call
1221 * @tsk: task being audited
1222 * @valid: success/failure flag
1223 * @return_code: syscall return value
1224 *
1225 * Tear down after system call. If the audit context has been marked as
1226 * auditable (either because of the AUDIT_RECORD_CONTEXT state from
1227 * filtering, or because some other part of the kernel write an audit
1228 * message), then write out the syscall information. In call cases,
1229 * free the names stored from getname().
1230 */
1231 void audit_syscall_exit(int valid, long return_code)
1232 {
1233 struct task_struct *tsk = current;
1234 struct audit_context *context;
1235
1236 context = audit_get_context(tsk, valid, return_code);
1237
1238 if (likely(!context))
1239 return;
1240
1241 if (context->in_syscall && context->auditable)
1242 audit_log_exit(context, tsk);
1243
1244 context->in_syscall = 0;
1245 context->auditable = 0;
1246
1247 if (context->previous) {
1248 struct audit_context *new_context = context->previous;
1249 context->previous = NULL;
1250 audit_free_context(context);
1251 tsk->audit_context = new_context;
1252 } else {
1253 audit_free_names(context);
1254 audit_free_aux(context);
1255 context->aux = NULL;
1256 context->aux_pids = NULL;
1257 context->target_pid = 0;
1258 context->target_sid = 0;
1259 kfree(context->filterkey);
1260 context->filterkey = NULL;
1261 tsk->audit_context = context;
1262 }
1263 }
1264
1265 /**
1266 * audit_getname - add a name to the list
1267 * @name: name to add
1268 *
1269 * Add a name to the list of audit names for this context.
1270 * Called from fs/namei.c:getname().
1271 */
1272 void __audit_getname(const char *name)
1273 {
1274 struct audit_context *context = current->audit_context;
1275
1276 if (IS_ERR(name) || !name)
1277 return;
1278
1279 if (!context->in_syscall) {
1280 #if AUDIT_DEBUG == 2
1281 printk(KERN_ERR "%s:%d(:%d): ignoring getname(%p)\n",
1282 __FILE__, __LINE__, context->serial, name);
1283 dump_stack();
1284 #endif
1285 return;
1286 }
1287 BUG_ON(context->name_count >= AUDIT_NAMES);
1288 context->names[context->name_count].name = name;
1289 context->names[context->name_count].name_len = AUDIT_NAME_FULL;
1290 context->names[context->name_count].name_put = 1;
1291 context->names[context->name_count].ino = (unsigned long)-1;
1292 context->names[context->name_count].osid = 0;
1293 ++context->name_count;
1294 if (!context->pwd) {
1295 read_lock(&current->fs->lock);
1296 context->pwd = dget(current->fs->pwd);
1297 context->pwdmnt = mntget(current->fs->pwdmnt);
1298 read_unlock(&current->fs->lock);
1299 }
1300
1301 }
1302
1303 /* audit_putname - intercept a putname request
1304 * @name: name to intercept and delay for putname
1305 *
1306 * If we have stored the name from getname in the audit context,
1307 * then we delay the putname until syscall exit.
1308 * Called from include/linux/fs.h:putname().
1309 */
1310 void audit_putname(const char *name)
1311 {
1312 struct audit_context *context = current->audit_context;
1313
1314 BUG_ON(!context);
1315 if (!context->in_syscall) {
1316 #if AUDIT_DEBUG == 2
1317 printk(KERN_ERR "%s:%d(:%d): __putname(%p)\n",
1318 __FILE__, __LINE__, context->serial, name);
1319 if (context->name_count) {
1320 int i;
1321 for (i = 0; i < context->name_count; i++)
1322 printk(KERN_ERR "name[%d] = %p = %s\n", i,
1323 context->names[i].name,
1324 context->names[i].name ?: "(null)");
1325 }
1326 #endif
1327 __putname(name);
1328 }
1329 #if AUDIT_DEBUG
1330 else {
1331 ++context->put_count;
1332 if (context->put_count > context->name_count) {
1333 printk(KERN_ERR "%s:%d(:%d): major=%d"
1334 " in_syscall=%d putname(%p) name_count=%d"
1335 " put_count=%d\n",
1336 __FILE__, __LINE__,
1337 context->serial, context->major,
1338 context->in_syscall, name, context->name_count,
1339 context->put_count);
1340 dump_stack();
1341 }
1342 }
1343 #endif
1344 }
1345
1346 /* Copy inode data into an audit_names. */
1347 static void audit_copy_inode(struct audit_names *name, const struct inode *inode)
1348 {
1349 name->ino = inode->i_ino;
1350 name->dev = inode->i_sb->s_dev;
1351 name->mode = inode->i_mode;
1352 name->uid = inode->i_uid;
1353 name->gid = inode->i_gid;
1354 name->rdev = inode->i_rdev;
1355 selinux_get_inode_sid(inode, &name->osid);
1356 }
1357
1358 /**
1359 * audit_inode - store the inode and device from a lookup
1360 * @name: name being audited
1361 * @inode: inode being audited
1362 *
1363 * Called from fs/namei.c:path_lookup().
1364 */
1365 void __audit_inode(const char *name, const struct inode *inode)
1366 {
1367 int idx;
1368 struct audit_context *context = current->audit_context;
1369
1370 if (!context->in_syscall)
1371 return;
1372 if (context->name_count
1373 && context->names[context->name_count-1].name
1374 && context->names[context->name_count-1].name == name)
1375 idx = context->name_count - 1;
1376 else if (context->name_count > 1
1377 && context->names[context->name_count-2].name
1378 && context->names[context->name_count-2].name == name)
1379 idx = context->name_count - 2;
1380 else {
1381 /* FIXME: how much do we care about inodes that have no
1382 * associated name? */
1383 if (context->name_count >= AUDIT_NAMES - AUDIT_NAMES_RESERVED)
1384 return;
1385 idx = context->name_count++;
1386 context->names[idx].name = NULL;
1387 #if AUDIT_DEBUG
1388 ++context->ino_count;
1389 #endif
1390 }
1391 audit_copy_inode(&context->names[idx], inode);
1392 }
1393
1394 /**
1395 * audit_inode_child - collect inode info for created/removed objects
1396 * @dname: inode's dentry name
1397 * @inode: inode being audited
1398 * @parent: inode of dentry parent
1399 *
1400 * For syscalls that create or remove filesystem objects, audit_inode
1401 * can only collect information for the filesystem object's parent.
1402 * This call updates the audit context with the child's information.
1403 * Syscalls that create a new filesystem object must be hooked after
1404 * the object is created. Syscalls that remove a filesystem object
1405 * must be hooked prior, in order to capture the target inode during
1406 * unsuccessful attempts.
1407 */
1408 void __audit_inode_child(const char *dname, const struct inode *inode,
1409 const struct inode *parent)
1410 {
1411 int idx;
1412 struct audit_context *context = current->audit_context;
1413 const char *found_name = NULL;
1414 int dirlen = 0;
1415
1416 if (!context->in_syscall)
1417 return;
1418
1419 /* determine matching parent */
1420 if (!dname)
1421 goto update_context;
1422 for (idx = 0; idx < context->name_count; idx++)
1423 if (context->names[idx].ino == parent->i_ino) {
1424 const char *name = context->names[idx].name;
1425
1426 if (!name)
1427 continue;
1428
1429 if (audit_compare_dname_path(dname, name, &dirlen) == 0) {
1430 context->names[idx].name_len = dirlen;
1431 found_name = name;
1432 break;
1433 }
1434 }
1435
1436 update_context:
1437 idx = context->name_count;
1438 if (context->name_count == AUDIT_NAMES) {
1439 printk(KERN_DEBUG "name_count maxed and losing %s\n",
1440 found_name ?: "(null)");
1441 return;
1442 }
1443 context->name_count++;
1444 #if AUDIT_DEBUG
1445 context->ino_count++;
1446 #endif
1447 /* Re-use the name belonging to the slot for a matching parent directory.
1448 * All names for this context are relinquished in audit_free_names() */
1449 context->names[idx].name = found_name;
1450 context->names[idx].name_len = AUDIT_NAME_FULL;
1451 context->names[idx].name_put = 0; /* don't call __putname() */
1452
1453 if (!inode)
1454 context->names[idx].ino = (unsigned long)-1;
1455 else
1456 audit_copy_inode(&context->names[idx], inode);
1457
1458 /* A parent was not found in audit_names, so copy the inode data for the
1459 * provided parent. */
1460 if (!found_name) {
1461 idx = context->name_count;
1462 if (context->name_count == AUDIT_NAMES) {
1463 printk(KERN_DEBUG
1464 "name_count maxed and losing parent inode data: dev=%02x:%02x, inode=%lu",
1465 MAJOR(parent->i_sb->s_dev),
1466 MINOR(parent->i_sb->s_dev),
1467 parent->i_ino);
1468 return;
1469 }
1470 context->name_count++;
1471 #if AUDIT_DEBUG
1472 context->ino_count++;
1473 #endif
1474 audit_copy_inode(&context->names[idx], parent);
1475 }
1476 }
1477
1478 /**
1479 * audit_inode_update - update inode info for last collected name
1480 * @inode: inode being audited
1481 *
1482 * When open() is called on an existing object with the O_CREAT flag, the inode
1483 * data audit initially collects is incorrect. This additional hook ensures
1484 * audit has the inode data for the actual object to be opened.
1485 */
1486 void __audit_inode_update(const struct inode *inode)
1487 {
1488 struct audit_context *context = current->audit_context;
1489 int idx;
1490
1491 if (!context->in_syscall || !inode)
1492 return;
1493
1494 if (context->name_count == 0) {
1495 context->name_count++;
1496 #if AUDIT_DEBUG
1497 context->ino_count++;
1498 #endif
1499 }
1500 idx = context->name_count - 1;
1501
1502 audit_copy_inode(&context->names[idx], inode);
1503 }
1504
1505 /**
1506 * auditsc_get_stamp - get local copies of audit_context values
1507 * @ctx: audit_context for the task
1508 * @t: timespec to store time recorded in the audit_context
1509 * @serial: serial value that is recorded in the audit_context
1510 *
1511 * Also sets the context as auditable.
1512 */
1513 void auditsc_get_stamp(struct audit_context *ctx,
1514 struct timespec *t, unsigned int *serial)
1515 {
1516 if (!ctx->serial)
1517 ctx->serial = audit_serial();
1518 t->tv_sec = ctx->ctime.tv_sec;
1519 t->tv_nsec = ctx->ctime.tv_nsec;
1520 *serial = ctx->serial;
1521 ctx->auditable = 1;
1522 }
1523
1524 /**
1525 * audit_set_loginuid - set a task's audit_context loginuid
1526 * @task: task whose audit context is being modified
1527 * @loginuid: loginuid value
1528 *
1529 * Returns 0.
1530 *
1531 * Called (set) from fs/proc/base.c::proc_loginuid_write().
1532 */
1533 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
1534 {
1535 struct audit_context *context = task->audit_context;
1536
1537 if (context) {
1538 /* Only log if audit is enabled */
1539 if (context->in_syscall) {
1540 struct audit_buffer *ab;
1541
1542 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
1543 if (ab) {
1544 audit_log_format(ab, "login pid=%d uid=%u "
1545 "old auid=%u new auid=%u",
1546 task->pid, task->uid,
1547 context->loginuid, loginuid);
1548 audit_log_end(ab);
1549 }
1550 }
1551 context->loginuid = loginuid;
1552 }
1553 return 0;
1554 }
1555
1556 /**
1557 * audit_get_loginuid - get the loginuid for an audit_context
1558 * @ctx: the audit_context
1559 *
1560 * Returns the context's loginuid or -1 if @ctx is NULL.
1561 */
1562 uid_t audit_get_loginuid(struct audit_context *ctx)
1563 {
1564 return ctx ? ctx->loginuid : -1;
1565 }
1566
1567 EXPORT_SYMBOL(audit_get_loginuid);
1568
1569 /**
1570 * __audit_mq_open - record audit data for a POSIX MQ open
1571 * @oflag: open flag
1572 * @mode: mode bits
1573 * @u_attr: queue attributes
1574 *
1575 * Returns 0 for success or NULL context or < 0 on error.
1576 */
1577 int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr)
1578 {
1579 struct audit_aux_data_mq_open *ax;
1580 struct audit_context *context = current->audit_context;
1581
1582 if (!audit_enabled)
1583 return 0;
1584
1585 if (likely(!context))
1586 return 0;
1587
1588 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
1589 if (!ax)
1590 return -ENOMEM;
1591
1592 if (u_attr != NULL) {
1593 if (copy_from_user(&ax->attr, u_attr, sizeof(ax->attr))) {
1594 kfree(ax);
1595 return -EFAULT;
1596 }
1597 } else
1598 memset(&ax->attr, 0, sizeof(ax->attr));
1599
1600 ax->oflag = oflag;
1601 ax->mode = mode;
1602
1603 ax->d.type = AUDIT_MQ_OPEN;
1604 ax->d.next = context->aux;
1605 context->aux = (void *)ax;
1606 return 0;
1607 }
1608
1609 /**
1610 * __audit_mq_timedsend - record audit data for a POSIX MQ timed send
1611 * @mqdes: MQ descriptor
1612 * @msg_len: Message length
1613 * @msg_prio: Message priority
1614 * @u_abs_timeout: Message timeout in absolute time
1615 *
1616 * Returns 0 for success or NULL context or < 0 on error.
1617 */
1618 int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio,
1619 const struct timespec __user *u_abs_timeout)
1620 {
1621 struct audit_aux_data_mq_sendrecv *ax;
1622 struct audit_context *context = current->audit_context;
1623
1624 if (!audit_enabled)
1625 return 0;
1626
1627 if (likely(!context))
1628 return 0;
1629
1630 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
1631 if (!ax)
1632 return -ENOMEM;
1633
1634 if (u_abs_timeout != NULL) {
1635 if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) {
1636 kfree(ax);
1637 return -EFAULT;
1638 }
1639 } else
1640 memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout));
1641
1642 ax->mqdes = mqdes;
1643 ax->msg_len = msg_len;
1644 ax->msg_prio = msg_prio;
1645
1646 ax->d.type = AUDIT_MQ_SENDRECV;
1647 ax->d.next = context->aux;
1648 context->aux = (void *)ax;
1649 return 0;
1650 }
1651
1652 /**
1653 * __audit_mq_timedreceive - record audit data for a POSIX MQ timed receive
1654 * @mqdes: MQ descriptor
1655 * @msg_len: Message length
1656 * @u_msg_prio: Message priority
1657 * @u_abs_timeout: Message timeout in absolute time
1658 *
1659 * Returns 0 for success or NULL context or < 0 on error.
1660 */
1661 int __audit_mq_timedreceive(mqd_t mqdes, size_t msg_len,
1662 unsigned int __user *u_msg_prio,
1663 const struct timespec __user *u_abs_timeout)
1664 {
1665 struct audit_aux_data_mq_sendrecv *ax;
1666 struct audit_context *context = current->audit_context;
1667
1668 if (!audit_enabled)
1669 return 0;
1670
1671 if (likely(!context))
1672 return 0;
1673
1674 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
1675 if (!ax)
1676 return -ENOMEM;
1677
1678 if (u_msg_prio != NULL) {
1679 if (get_user(ax->msg_prio, u_msg_prio)) {
1680 kfree(ax);
1681 return -EFAULT;
1682 }
1683 } else
1684 ax->msg_prio = 0;
1685
1686 if (u_abs_timeout != NULL) {
1687 if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) {
1688 kfree(ax);
1689 return -EFAULT;
1690 }
1691 } else
1692 memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout));
1693
1694 ax->mqdes = mqdes;
1695 ax->msg_len = msg_len;
1696
1697 ax->d.type = AUDIT_MQ_SENDRECV;
1698 ax->d.next = context->aux;
1699 context->aux = (void *)ax;
1700 return 0;
1701 }
1702
1703 /**
1704 * __audit_mq_notify - record audit data for a POSIX MQ notify
1705 * @mqdes: MQ descriptor
1706 * @u_notification: Notification event
1707 *
1708 * Returns 0 for success or NULL context or < 0 on error.
1709 */
1710
1711 int __audit_mq_notify(mqd_t mqdes, const struct sigevent __user *u_notification)
1712 {
1713 struct audit_aux_data_mq_notify *ax;
1714 struct audit_context *context = current->audit_context;
1715
1716 if (!audit_enabled)
1717 return 0;
1718
1719 if (likely(!context))
1720 return 0;
1721
1722 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
1723 if (!ax)
1724 return -ENOMEM;
1725
1726 if (u_notification != NULL) {
1727 if (copy_from_user(&ax->notification, u_notification, sizeof(ax->notification))) {
1728 kfree(ax);
1729 return -EFAULT;
1730 }
1731 } else
1732 memset(&ax->notification, 0, sizeof(ax->notification));
1733
1734 ax->mqdes = mqdes;
1735
1736 ax->d.type = AUDIT_MQ_NOTIFY;
1737 ax->d.next = context->aux;
1738 context->aux = (void *)ax;
1739 return 0;
1740 }
1741
1742 /**
1743 * __audit_mq_getsetattr - record audit data for a POSIX MQ get/set attribute
1744 * @mqdes: MQ descriptor
1745 * @mqstat: MQ flags
1746 *
1747 * Returns 0 for success or NULL context or < 0 on error.
1748 */
1749 int __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
1750 {
1751 struct audit_aux_data_mq_getsetattr *ax;
1752 struct audit_context *context = current->audit_context;
1753
1754 if (!audit_enabled)
1755 return 0;
1756
1757 if (likely(!context))
1758 return 0;
1759
1760 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
1761 if (!ax)
1762 return -ENOMEM;
1763
1764 ax->mqdes = mqdes;
1765 ax->mqstat = *mqstat;
1766
1767 ax->d.type = AUDIT_MQ_GETSETATTR;
1768 ax->d.next = context->aux;
1769 context->aux = (void *)ax;
1770 return 0;
1771 }
1772
1773 /**
1774 * audit_ipc_obj - record audit data for ipc object
1775 * @ipcp: ipc permissions
1776 *
1777 * Returns 0 for success or NULL context or < 0 on error.
1778 */
1779 int __audit_ipc_obj(struct kern_ipc_perm *ipcp)
1780 {
1781 struct audit_aux_data_ipcctl *ax;
1782 struct audit_context *context = current->audit_context;
1783
1784 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
1785 if (!ax)
1786 return -ENOMEM;
1787
1788 ax->uid = ipcp->uid;
1789 ax->gid = ipcp->gid;
1790 ax->mode = ipcp->mode;
1791 selinux_get_ipc_sid(ipcp, &ax->osid);
1792
1793 ax->d.type = AUDIT_IPC;
1794 ax->d.next = context->aux;
1795 context->aux = (void *)ax;
1796 return 0;
1797 }
1798
1799 /**
1800 * audit_ipc_set_perm - record audit data for new ipc permissions
1801 * @qbytes: msgq bytes
1802 * @uid: msgq user id
1803 * @gid: msgq group id
1804 * @mode: msgq mode (permissions)
1805 *
1806 * Returns 0 for success or NULL context or < 0 on error.
1807 */
1808 int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode)
1809 {
1810 struct audit_aux_data_ipcctl *ax;
1811 struct audit_context *context = current->audit_context;
1812
1813 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
1814 if (!ax)
1815 return -ENOMEM;
1816
1817 ax->qbytes = qbytes;
1818 ax->uid = uid;
1819 ax->gid = gid;
1820 ax->mode = mode;
1821
1822 ax->d.type = AUDIT_IPC_SET_PERM;
1823 ax->d.next = context->aux;
1824 context->aux = (void *)ax;
1825 return 0;
1826 }
1827
1828 int audit_bprm(struct linux_binprm *bprm)
1829 {
1830 struct audit_aux_data_execve *ax;
1831 struct audit_context *context = current->audit_context;
1832 unsigned long p, next;
1833 void *to;
1834
1835 if (likely(!audit_enabled || !context || context->dummy))
1836 return 0;
1837
1838 ax = kmalloc(sizeof(*ax) + PAGE_SIZE * MAX_ARG_PAGES - bprm->p,
1839 GFP_KERNEL);
1840 if (!ax)
1841 return -ENOMEM;
1842
1843 ax->argc = bprm->argc;
1844 ax->envc = bprm->envc;
1845 for (p = bprm->p, to = ax->mem; p < MAX_ARG_PAGES*PAGE_SIZE; p = next) {
1846 struct page *page = bprm->page[p / PAGE_SIZE];
1847 void *kaddr = kmap(page);
1848 next = (p + PAGE_SIZE) & ~(PAGE_SIZE - 1);
1849 memcpy(to, kaddr + (p & (PAGE_SIZE - 1)), next - p);
1850 to += next - p;
1851 kunmap(page);
1852 }
1853
1854 ax->d.type = AUDIT_EXECVE;
1855 ax->d.next = context->aux;
1856 context->aux = (void *)ax;
1857 return 0;
1858 }
1859
1860
1861 /**
1862 * audit_socketcall - record audit data for sys_socketcall
1863 * @nargs: number of args
1864 * @args: args array
1865 *
1866 * Returns 0 for success or NULL context or < 0 on error.
1867 */
1868 int audit_socketcall(int nargs, unsigned long *args)
1869 {
1870 struct audit_aux_data_socketcall *ax;
1871 struct audit_context *context = current->audit_context;
1872
1873 if (likely(!context || context->dummy))
1874 return 0;
1875
1876 ax = kmalloc(sizeof(*ax) + nargs * sizeof(unsigned long), GFP_KERNEL);
1877 if (!ax)
1878 return -ENOMEM;
1879
1880 ax->nargs = nargs;
1881 memcpy(ax->args, args, nargs * sizeof(unsigned long));
1882
1883 ax->d.type = AUDIT_SOCKETCALL;
1884 ax->d.next = context->aux;
1885 context->aux = (void *)ax;
1886 return 0;
1887 }
1888
1889 /**
1890 * __audit_fd_pair - record audit data for pipe and socketpair
1891 * @fd1: the first file descriptor
1892 * @fd2: the second file descriptor
1893 *
1894 * Returns 0 for success or NULL context or < 0 on error.
1895 */
1896 int __audit_fd_pair(int fd1, int fd2)
1897 {
1898 struct audit_context *context = current->audit_context;
1899 struct audit_aux_data_fd_pair *ax;
1900
1901 if (likely(!context)) {
1902 return 0;
1903 }
1904
1905 ax = kmalloc(sizeof(*ax), GFP_KERNEL);
1906 if (!ax) {
1907 return -ENOMEM;
1908 }
1909
1910 ax->fd[0] = fd1;
1911 ax->fd[1] = fd2;
1912
1913 ax->d.type = AUDIT_FD_PAIR;
1914 ax->d.next = context->aux;
1915 context->aux = (void *)ax;
1916 return 0;
1917 }
1918
1919 /**
1920 * audit_sockaddr - record audit data for sys_bind, sys_connect, sys_sendto
1921 * @len: data length in user space
1922 * @a: data address in kernel space
1923 *
1924 * Returns 0 for success or NULL context or < 0 on error.
1925 */
1926 int audit_sockaddr(int len, void *a)
1927 {
1928 struct audit_aux_data_sockaddr *ax;
1929 struct audit_context *context = current->audit_context;
1930
1931 if (likely(!context || context->dummy))
1932 return 0;
1933
1934 ax = kmalloc(sizeof(*ax) + len, GFP_KERNEL);
1935 if (!ax)
1936 return -ENOMEM;
1937
1938 ax->len = len;
1939 memcpy(ax->a, a, len);
1940
1941 ax->d.type = AUDIT_SOCKADDR;
1942 ax->d.next = context->aux;
1943 context->aux = (void *)ax;
1944 return 0;
1945 }
1946
1947 void __audit_ptrace(struct task_struct *t)
1948 {
1949 struct audit_context *context = current->audit_context;
1950
1951 context->target_pid = t->pid;
1952 selinux_get_task_sid(t, &context->target_sid);
1953 }
1954
1955 /**
1956 * audit_avc_path - record the granting or denial of permissions
1957 * @dentry: dentry to record
1958 * @mnt: mnt to record
1959 *
1960 * Returns 0 for success or NULL context or < 0 on error.
1961 *
1962 * Called from security/selinux/avc.c::avc_audit()
1963 */
1964 int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt)
1965 {
1966 struct audit_aux_data_path *ax;
1967 struct audit_context *context = current->audit_context;
1968
1969 if (likely(!context))
1970 return 0;
1971
1972 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
1973 if (!ax)
1974 return -ENOMEM;
1975
1976 ax->dentry = dget(dentry);
1977 ax->mnt = mntget(mnt);
1978
1979 ax->d.type = AUDIT_AVC_PATH;
1980 ax->d.next = context->aux;
1981 context->aux = (void *)ax;
1982 return 0;
1983 }
1984
1985 /**
1986 * audit_signal_info - record signal info for shutting down audit subsystem
1987 * @sig: signal value
1988 * @t: task being signaled
1989 *
1990 * If the audit subsystem is being terminated, record the task (pid)
1991 * and uid that is doing that.
1992 */
1993 int __audit_signal_info(int sig, struct task_struct *t)
1994 {
1995 struct audit_aux_data_pids *axp;
1996 struct task_struct *tsk = current;
1997 struct audit_context *ctx = tsk->audit_context;
1998 extern pid_t audit_sig_pid;
1999 extern uid_t audit_sig_uid;
2000 extern u32 audit_sig_sid;
2001
2002 if (audit_pid && t->tgid == audit_pid &&
2003 (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1)) {
2004 audit_sig_pid = tsk->pid;
2005 if (ctx)
2006 audit_sig_uid = ctx->loginuid;
2007 else
2008 audit_sig_uid = tsk->uid;
2009 selinux_get_task_sid(tsk, &audit_sig_sid);
2010 }
2011
2012 if (!audit_signals) /* audit_context checked in wrapper */
2013 return 0;
2014
2015 /* optimize the common case by putting first signal recipient directly
2016 * in audit_context */
2017 if (!ctx->target_pid) {
2018 ctx->target_pid = t->tgid;
2019 selinux_get_task_sid(t, &ctx->target_sid);
2020 return 0;
2021 }
2022
2023 axp = (void *)ctx->aux_pids;
2024 if (!axp || axp->pid_count == AUDIT_AUX_PIDS) {
2025 axp = kzalloc(sizeof(*axp), GFP_ATOMIC);
2026 if (!axp)
2027 return -ENOMEM;
2028
2029 axp->d.type = AUDIT_OBJ_PID;
2030 axp->d.next = ctx->aux_pids;
2031 ctx->aux_pids = (void *)axp;
2032 }
2033 BUG_ON(axp->pid_count > AUDIT_AUX_PIDS);
2034
2035 axp->target_pid[axp->pid_count] = t->tgid;
2036 selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]);
2037 axp->pid_count++;
2038
2039 return 0;
2040 }
Linux kernel - Deliverables
This page took 0.26021 seconds and 6 git commands to generate.