2 * common LSM auditing functions
4 * Based on code written for SELinux by :
5 * Stephen Smalley, <sds@epoch.ncsc.mil>
6 * James Morris <jmorris@redhat.com>
7 * Author : Etienne Basset, <etienne.basset@ensta.org>
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2,
11 * as published by the Free Software Foundation.
14 #include <linux/types.h>
15 #include <linux/stddef.h>
16 #include <linux/kernel.h>
17 #include <linux/gfp.h>
19 #include <linux/init.h>
22 #include <net/af_unix.h>
23 #include <linux/audit.h>
24 #include <linux/ipv6.h>
28 #include <linux/tcp.h>
29 #include <linux/udp.h>
30 #include <linux/dccp.h>
31 #include <linux/sctp.h>
32 #include <linux/lsm_audit.h>
35 * ipv4_skb_to_auditdata : fill auditdata from skb
37 * @ad : the audit data to fill
38 * @proto : the layer 4 protocol
42 int ipv4_skb_to_auditdata(struct sk_buff
*skb
,
43 struct common_audit_data
*ad
, u8
*proto
)
52 ad
->u
.net
.v4info
.saddr
= ih
->saddr
;
53 ad
->u
.net
.v4info
.daddr
= ih
->daddr
;
56 *proto
= ih
->protocol
;
57 /* non initial fragment */
58 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
61 switch (ih
->protocol
) {
63 struct tcphdr
*th
= tcp_hdr(skb
);
67 ad
->u
.net
.sport
= th
->source
;
68 ad
->u
.net
.dport
= th
->dest
;
72 struct udphdr
*uh
= udp_hdr(skb
);
76 ad
->u
.net
.sport
= uh
->source
;
77 ad
->u
.net
.dport
= uh
->dest
;
81 struct dccp_hdr
*dh
= dccp_hdr(skb
);
85 ad
->u
.net
.sport
= dh
->dccph_sport
;
86 ad
->u
.net
.dport
= dh
->dccph_dport
;
90 struct sctphdr
*sh
= sctp_hdr(skb
);
93 ad
->u
.net
.sport
= sh
->source
;
94 ad
->u
.net
.dport
= sh
->dest
;
102 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
104 * ipv6_skb_to_auditdata : fill auditdata from skb
106 * @ad : the audit data to fill
107 * @proto : the layer 4 protocol
109 * return 0 on success
111 int ipv6_skb_to_auditdata(struct sk_buff
*skb
,
112 struct common_audit_data
*ad
, u8
*proto
)
121 ipv6_addr_copy(&ad
->u
.net
.v6info
.saddr
, &ip6
->saddr
);
122 ipv6_addr_copy(&ad
->u
.net
.v6info
.daddr
, &ip6
->daddr
);
124 /* IPv6 can have several extension header before the Transport header
126 offset
= skb_network_offset(skb
);
127 offset
+= sizeof(*ip6
);
128 nexthdr
= ip6
->nexthdr
;
129 offset
= ipv6_skip_exthdr(skb
, offset
, &nexthdr
);
136 struct tcphdr _tcph
, *th
;
138 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
142 ad
->u
.net
.sport
= th
->source
;
143 ad
->u
.net
.dport
= th
->dest
;
147 struct udphdr _udph
, *uh
;
149 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
153 ad
->u
.net
.sport
= uh
->source
;
154 ad
->u
.net
.dport
= uh
->dest
;
158 struct dccp_hdr _dccph
, *dh
;
160 dh
= skb_header_pointer(skb
, offset
, sizeof(_dccph
), &_dccph
);
164 ad
->u
.net
.sport
= dh
->dccph_sport
;
165 ad
->u
.net
.dport
= dh
->dccph_dport
;
169 struct sctphdr _sctph
, *sh
;
171 sh
= skb_header_pointer(skb
, offset
, sizeof(_sctph
), &_sctph
);
174 ad
->u
.net
.sport
= sh
->source
;
175 ad
->u
.net
.dport
= sh
->dest
;
186 static inline void print_ipv6_addr(struct audit_buffer
*ab
,
187 struct in6_addr
*addr
, __be16 port
,
188 char *name1
, char *name2
)
190 if (!ipv6_addr_any(addr
))
191 audit_log_format(ab
, " %s=%pI6c", name1
, addr
);
193 audit_log_format(ab
, " %s=%d", name2
, ntohs(port
));
196 static inline void print_ipv4_addr(struct audit_buffer
*ab
, __be32 addr
,
197 __be16 port
, char *name1
, char *name2
)
200 audit_log_format(ab
, " %s=%pI4", name1
, &addr
);
202 audit_log_format(ab
, " %s=%d", name2
, ntohs(port
));
206 * dump_common_audit_data - helper to dump common audit data
207 * @a : common audit data
210 static void dump_common_audit_data(struct audit_buffer
*ab
,
211 struct common_audit_data
*a
)
213 struct inode
*inode
= NULL
;
214 struct task_struct
*tsk
= current
;
218 if (tsk
&& tsk
->pid
) {
219 audit_log_format(ab
, " pid=%d comm=", tsk
->pid
);
220 audit_log_untrustedstring(ab
, tsk
->comm
);
224 case LSM_AUDIT_DATA_NONE
:
226 case LSM_AUDIT_DATA_IPC
:
227 audit_log_format(ab
, " key=%d ", a
->u
.ipc_id
);
229 case LSM_AUDIT_DATA_CAP
:
230 audit_log_format(ab
, " capability=%d ", a
->u
.cap
);
232 case LSM_AUDIT_DATA_FS
:
233 if (a
->u
.fs
.path
.dentry
) {
234 struct dentry
*dentry
= a
->u
.fs
.path
.dentry
;
235 if (a
->u
.fs
.path
.mnt
) {
236 audit_log_d_path(ab
, "path=", &a
->u
.fs
.path
);
238 audit_log_format(ab
, " name=");
239 audit_log_untrustedstring(ab
,
240 dentry
->d_name
.name
);
242 inode
= dentry
->d_inode
;
243 } else if (a
->u
.fs
.inode
) {
244 struct dentry
*dentry
;
245 inode
= a
->u
.fs
.inode
;
246 dentry
= d_find_alias(inode
);
248 audit_log_format(ab
, " name=");
249 audit_log_untrustedstring(ab
,
250 dentry
->d_name
.name
);
255 audit_log_format(ab
, " dev=%s ino=%lu",
259 case LSM_AUDIT_DATA_TASK
:
261 if (tsk
&& tsk
->pid
) {
262 audit_log_format(ab
, " pid=%d comm=", tsk
->pid
);
263 audit_log_untrustedstring(ab
, tsk
->comm
);
266 case LSM_AUDIT_DATA_NET
:
268 struct sock
*sk
= a
->u
.net
.sk
;
273 switch (sk
->sk_family
) {
275 struct inet_sock
*inet
= inet_sk(sk
);
277 print_ipv4_addr(ab
, inet
->inet_rcv_saddr
,
280 print_ipv4_addr(ab
, inet
->inet_daddr
,
286 struct inet_sock
*inet
= inet_sk(sk
);
287 struct ipv6_pinfo
*inet6
= inet6_sk(sk
);
289 print_ipv6_addr(ab
, &inet6
->rcv_saddr
,
292 print_ipv6_addr(ab
, &inet6
->daddr
,
304 audit_log_d_path(ab
, "path=", &path
);
309 len
= u
->addr
->len
-sizeof(short);
310 p
= &u
->addr
->name
->sun_path
[0];
311 audit_log_format(ab
, " path=");
313 audit_log_untrustedstring(ab
, p
);
315 audit_log_n_hex(ab
, p
, len
);
320 switch (a
->u
.net
.family
) {
322 print_ipv4_addr(ab
, a
->u
.net
.v4info
.saddr
,
325 print_ipv4_addr(ab
, a
->u
.net
.v4info
.daddr
,
330 print_ipv6_addr(ab
, &a
->u
.net
.v6info
.saddr
,
333 print_ipv6_addr(ab
, &a
->u
.net
.v6info
.daddr
,
338 if (a
->u
.net
.netif
> 0) {
339 struct net_device
*dev
;
341 /* NOTE: we always use init's namespace */
342 dev
= dev_get_by_index(&init_net
, a
->u
.net
.netif
);
344 audit_log_format(ab
, " netif=%s", dev
->name
);
350 case LSM_AUDIT_DATA_KEY
:
351 audit_log_format(ab
, " key_serial=%u", a
->u
.key_struct
.key
);
352 if (a
->u
.key_struct
.key_desc
) {
353 audit_log_format(ab
, " key_desc=");
354 audit_log_untrustedstring(ab
, a
->u
.key_struct
.key_desc
);
358 case LSM_AUDIT_DATA_KMOD
:
359 audit_log_format(ab
, " kmod=");
360 audit_log_untrustedstring(ab
, a
->u
.kmod_name
);
362 } /* switch (a->type) */
366 * common_lsm_audit - generic LSM auditing function
367 * @a: auxiliary audit data
369 * setup the audit buffer for common security information
370 * uses callback to print LSM specific information
372 void common_lsm_audit(struct common_audit_data
*a
)
374 struct audit_buffer
*ab
;
378 /* we use GFP_ATOMIC so we won't sleep */
379 ab
= audit_log_start(current
->audit_context
, GFP_ATOMIC
, AUDIT_AVC
);
384 if (a
->lsm_pre_audit
)
385 a
->lsm_pre_audit(ab
, a
);
387 dump_common_audit_data(ab
, a
);
389 if (a
->lsm_post_audit
)
390 a
->lsm_post_audit(ab
, a
);
This page took 0.037866 seconds and 5 git commands to generate.