audit.c 34 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313
  1. /* audit.c -- Auditing support
  2. * Gateway between the kernel (e.g., selinux) and the user-space audit daemon.
  3. * System-call specific features have moved to auditsc.c
  4. *
  5. * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina.
  6. * All Rights Reserved.
  7. *
  8. * This program is free software; you can redistribute it and/or modify
  9. * it under the terms of the GNU General Public License as published by
  10. * the Free Software Foundation; either version 2 of the License, or
  11. * (at your option) any later version.
  12. *
  13. * This program is distributed in the hope that it will be useful,
  14. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16. * GNU General Public License for more details.
  17. *
  18. * You should have received a copy of the GNU General Public License
  19. * along with this program; if not, write to the Free Software
  20. * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  21. *
  22. * Written by Rickard E. (Rik) Faith <faith@redhat.com>
  23. *
  24. * Goals: 1) Integrate fully with SELinux.
  25. * 2) Minimal run-time overhead:
  26. * a) Minimal when syscall auditing is disabled (audit_enable=0).
  27. * b) Small when syscall auditing is enabled and no audit record
  28. * is generated (defer as much work as possible to record
  29. * generation time):
  30. * i) context is allocated,
  31. * ii) names from getname are stored without a copy, and
  32. * iii) inode information stored from path_lookup.
  33. * 3) Ability to disable syscall auditing at boot time (audit=0).
  34. * 4) Usable by other parts of the kernel (if audit_log* is called,
  35. * then a syscall record will be generated automatically for the
  36. * current syscall).
  37. * 5) Netlink interface to user-space.
  38. * 6) Support low-overhead kernel-based filtering to minimize the
  39. * information that must be passed to user-space.
  40. *
  41. * Example user-space utilities: http://people.redhat.com/sgrubb/audit/
  42. */
  43. #include <linux/init.h>
  44. #include <asm/types.h>
  45. #include <asm/atomic.h>
  46. #include <linux/mm.h>
  47. #include <linux/module.h>
  48. #include <linux/err.h>
  49. #include <linux/kthread.h>
  50. #include <linux/audit.h>
  51. #include <net/sock.h>
  52. #include <net/netlink.h>
  53. #include <linux/skbuff.h>
  54. #include <linux/netlink.h>
  55. #include <linux/selinux.h>
  56. #include <linux/inotify.h>
  57. #include <linux/freezer.h>
  58. #include "audit.h"
  59. /* No auditing will take place until audit_initialized != 0.
  60. * (Initialization happens after skb_init is called.) */
  61. static int audit_initialized;
  62. /* 0 - no auditing
  63. * 1 - auditing enabled
  64. * 2 - auditing enabled and configuration is locked/unchangeable. */
  65. int audit_enabled;
  66. /* Default state when kernel boots without any parameters. */
  67. static int audit_default;
  68. /* If auditing cannot proceed, audit_failure selects what happens. */
  69. static int audit_failure = AUDIT_FAIL_PRINTK;
  70. /* If audit records are to be written to the netlink socket, audit_pid
  71. * contains the (non-zero) pid. */
  72. int audit_pid;
  73. /* If audit_rate_limit is non-zero, limit the rate of sending audit records
  74. * to that number per second. This prevents DoS attacks, but results in
  75. * audit records being dropped. */
  76. static int audit_rate_limit;
  77. /* Number of outstanding audit_buffers allowed. */
  78. static int audit_backlog_limit = 64;
  79. static int audit_backlog_wait_time = 60 * HZ;
  80. static int audit_backlog_wait_overflow = 0;
  81. /* The identity of the user shutting down the audit system. */
  82. uid_t audit_sig_uid = -1;
  83. pid_t audit_sig_pid = -1;
  84. u32 audit_sig_sid = 0;
  85. /* Records can be lost in several ways:
  86. 0) [suppressed in audit_alloc]
  87. 1) out of memory in audit_log_start [kmalloc of struct audit_buffer]
  88. 2) out of memory in audit_log_move [alloc_skb]
  89. 3) suppressed due to audit_rate_limit
  90. 4) suppressed due to audit_backlog_limit
  91. */
  92. static atomic_t audit_lost = ATOMIC_INIT(0);
  93. /* The netlink socket. */
  94. static struct sock *audit_sock;
  95. /* Inotify handle. */
  96. struct inotify_handle *audit_ih;
  97. /* Hash for inode-based rules */
  98. struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
  99. /* The audit_freelist is a list of pre-allocated audit buffers (if more
  100. * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of
  101. * being placed on the freelist). */
  102. static DEFINE_SPINLOCK(audit_freelist_lock);
  103. static int audit_freelist_count;
  104. static LIST_HEAD(audit_freelist);
  105. static struct sk_buff_head audit_skb_queue;
  106. static struct task_struct *kauditd_task;
  107. static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
  108. static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
  109. /* Serialize requests from userspace. */
  110. static DEFINE_MUTEX(audit_cmd_mutex);
  111. /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
  112. * audit records. Since printk uses a 1024 byte buffer, this buffer
  113. * should be at least that large. */
  114. #define AUDIT_BUFSIZ 1024
  115. /* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the
  116. * audit_freelist. Doing so eliminates many kmalloc/kfree calls. */
  117. #define AUDIT_MAXFREE (2*NR_CPUS)
  118. /* The audit_buffer is used when formatting an audit record. The caller
  119. * locks briefly to get the record off the freelist or to allocate the
  120. * buffer, and locks briefly to send the buffer to the netlink layer or
  121. * to place it on a transmit queue. Multiple audit_buffers can be in
  122. * use simultaneously. */
  123. struct audit_buffer {
  124. struct list_head list;
  125. struct sk_buff *skb; /* formatted skb ready to send */
  126. struct audit_context *ctx; /* NULL or associated context */
  127. gfp_t gfp_mask;
  128. };
  129. static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
  130. {
  131. struct nlmsghdr *nlh = (struct nlmsghdr *)ab->skb->data;
  132. nlh->nlmsg_pid = pid;
  133. }
  134. void audit_panic(const char *message)
  135. {
  136. switch (audit_failure)
  137. {
  138. case AUDIT_FAIL_SILENT:
  139. break;
  140. case AUDIT_FAIL_PRINTK:
  141. printk(KERN_ERR "audit: %s\n", message);
  142. break;
  143. case AUDIT_FAIL_PANIC:
  144. panic("audit: %s\n", message);
  145. break;
  146. }
  147. }
  148. static inline int audit_rate_check(void)
  149. {
  150. static unsigned long last_check = 0;
  151. static int messages = 0;
  152. static DEFINE_SPINLOCK(lock);
  153. unsigned long flags;
  154. unsigned long now;
  155. unsigned long elapsed;
  156. int retval = 0;
  157. if (!audit_rate_limit) return 1;
  158. spin_lock_irqsave(&lock, flags);
  159. if (++messages < audit_rate_limit) {
  160. retval = 1;
  161. } else {
  162. now = jiffies;
  163. elapsed = now - last_check;
  164. if (elapsed > HZ) {
  165. last_check = now;
  166. messages = 0;
  167. retval = 1;
  168. }
  169. }
  170. spin_unlock_irqrestore(&lock, flags);
  171. return retval;
  172. }
  173. /**
  174. * audit_log_lost - conditionally log lost audit message event
  175. * @message: the message stating reason for lost audit message
  176. *
  177. * Emit at least 1 message per second, even if audit_rate_check is
  178. * throttling.
  179. * Always increment the lost messages counter.
  180. */
  181. void audit_log_lost(const char *message)
  182. {
  183. static unsigned long last_msg = 0;
  184. static DEFINE_SPINLOCK(lock);
  185. unsigned long flags;
  186. unsigned long now;
  187. int print;
  188. atomic_inc(&audit_lost);
  189. print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
  190. if (!print) {
  191. spin_lock_irqsave(&lock, flags);
  192. now = jiffies;
  193. if (now - last_msg > HZ) {
  194. print = 1;
  195. last_msg = now;
  196. }
  197. spin_unlock_irqrestore(&lock, flags);
  198. }
  199. if (print) {
  200. printk(KERN_WARNING
  201. "audit: audit_lost=%d audit_rate_limit=%d audit_backlog_limit=%d\n",
  202. atomic_read(&audit_lost),
  203. audit_rate_limit,
  204. audit_backlog_limit);
  205. audit_panic(message);
  206. }
  207. }
  208. static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sid)
  209. {
  210. int res, rc = 0, old = audit_rate_limit;
  211. /* check if we are locked */
  212. if (audit_enabled == 2)
  213. res = 0;
  214. else
  215. res = 1;
  216. if (sid) {
  217. char *ctx = NULL;
  218. u32 len;
  219. if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
  220. audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
  221. "audit_rate_limit=%d old=%d by auid=%u"
  222. " subj=%s res=%d",
  223. limit, old, loginuid, ctx, res);
  224. kfree(ctx);
  225. } else
  226. res = 0; /* Something weird, deny request */
  227. }
  228. audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
  229. "audit_rate_limit=%d old=%d by auid=%u res=%d",
  230. limit, old, loginuid, res);
  231. /* If we are allowed, make the change */
  232. if (res == 1)
  233. audit_rate_limit = limit;
  234. /* Not allowed, update reason */
  235. else if (rc == 0)
  236. rc = -EPERM;
  237. return rc;
  238. }
  239. static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid)
  240. {
  241. int res, rc = 0, old = audit_backlog_limit;
  242. /* check if we are locked */
  243. if (audit_enabled == 2)
  244. res = 0;
  245. else
  246. res = 1;
  247. if (sid) {
  248. char *ctx = NULL;
  249. u32 len;
  250. if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
  251. audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
  252. "audit_backlog_limit=%d old=%d by auid=%u"
  253. " subj=%s res=%d",
  254. limit, old, loginuid, ctx, res);
  255. kfree(ctx);
  256. } else
  257. res = 0; /* Something weird, deny request */
  258. }
  259. audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
  260. "audit_backlog_limit=%d old=%d by auid=%u res=%d",
  261. limit, old, loginuid, res);
  262. /* If we are allowed, make the change */
  263. if (res == 1)
  264. audit_backlog_limit = limit;
  265. /* Not allowed, update reason */
  266. else if (rc == 0)
  267. rc = -EPERM;
  268. return rc;
  269. }
  270. static int audit_set_enabled(int state, uid_t loginuid, u32 sid)
  271. {
  272. int res, rc = 0, old = audit_enabled;
  273. if (state < 0 || state > 2)
  274. return -EINVAL;
  275. /* check if we are locked */
  276. if (audit_enabled == 2)
  277. res = 0;
  278. else
  279. res = 1;
  280. if (sid) {
  281. char *ctx = NULL;
  282. u32 len;
  283. if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
  284. audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
  285. "audit_enabled=%d old=%d by auid=%u"
  286. " subj=%s res=%d",
  287. state, old, loginuid, ctx, res);
  288. kfree(ctx);
  289. } else
  290. res = 0; /* Something weird, deny request */
  291. }
  292. audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
  293. "audit_enabled=%d old=%d by auid=%u res=%d",
  294. state, old, loginuid, res);
  295. /* If we are allowed, make the change */
  296. if (res == 1)
  297. audit_enabled = state;
  298. /* Not allowed, update reason */
  299. else if (rc == 0)
  300. rc = -EPERM;
  301. return rc;
  302. }
  303. static int audit_set_failure(int state, uid_t loginuid, u32 sid)
  304. {
  305. int res, rc = 0, old = audit_failure;
  306. if (state != AUDIT_FAIL_SILENT
  307. && state != AUDIT_FAIL_PRINTK
  308. && state != AUDIT_FAIL_PANIC)
  309. return -EINVAL;
  310. /* check if we are locked */
  311. if (audit_enabled == 2)
  312. res = 0;
  313. else
  314. res = 1;
  315. if (sid) {
  316. char *ctx = NULL;
  317. u32 len;
  318. if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
  319. audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
  320. "audit_failure=%d old=%d by auid=%u"
  321. " subj=%s res=%d",
  322. state, old, loginuid, ctx, res);
  323. kfree(ctx);
  324. } else
  325. res = 0; /* Something weird, deny request */
  326. }
  327. audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
  328. "audit_failure=%d old=%d by auid=%u res=%d",
  329. state, old, loginuid, res);
  330. /* If we are allowed, make the change */
  331. if (res == 1)
  332. audit_failure = state;
  333. /* Not allowed, update reason */
  334. else if (rc == 0)
  335. rc = -EPERM;
  336. return rc;
  337. }
  338. static int kauditd_thread(void *dummy)
  339. {
  340. struct sk_buff *skb;
  341. while (!kthread_should_stop()) {
  342. skb = skb_dequeue(&audit_skb_queue);
  343. wake_up(&audit_backlog_wait);
  344. if (skb) {
  345. if (audit_pid) {
  346. int err = netlink_unicast(audit_sock, skb, audit_pid, 0);
  347. if (err < 0) {
  348. BUG_ON(err != -ECONNREFUSED); /* Shoudn't happen */
  349. printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
  350. audit_pid = 0;
  351. }
  352. } else {
  353. printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0));
  354. kfree_skb(skb);
  355. }
  356. } else {
  357. DECLARE_WAITQUEUE(wait, current);
  358. set_current_state(TASK_INTERRUPTIBLE);
  359. add_wait_queue(&kauditd_wait, &wait);
  360. if (!skb_queue_len(&audit_skb_queue)) {
  361. try_to_freeze();
  362. schedule();
  363. }
  364. __set_current_state(TASK_RUNNING);
  365. remove_wait_queue(&kauditd_wait, &wait);
  366. }
  367. }
  368. return 0;
  369. }
  370. int audit_send_list(void *_dest)
  371. {
  372. struct audit_netlink_list *dest = _dest;
  373. int pid = dest->pid;
  374. struct sk_buff *skb;
  375. /* wait for parent to finish and send an ACK */
  376. mutex_lock(&audit_cmd_mutex);
  377. mutex_unlock(&audit_cmd_mutex);
  378. while ((skb = __skb_dequeue(&dest->q)) != NULL)
  379. netlink_unicast(audit_sock, skb, pid, 0);
  380. kfree(dest);
  381. return 0;
  382. }
  383. struct sk_buff *audit_make_reply(int pid, int seq, int type, int done,
  384. int multi, void *payload, int size)
  385. {
  386. struct sk_buff *skb;
  387. struct nlmsghdr *nlh;
  388. int len = NLMSG_SPACE(size);
  389. void *data;
  390. int flags = multi ? NLM_F_MULTI : 0;
  391. int t = done ? NLMSG_DONE : type;
  392. skb = alloc_skb(len, GFP_KERNEL);
  393. if (!skb)
  394. return NULL;
  395. nlh = NLMSG_PUT(skb, pid, seq, t, size);
  396. nlh->nlmsg_flags = flags;
  397. data = NLMSG_DATA(nlh);
  398. memcpy(data, payload, size);
  399. return skb;
  400. nlmsg_failure: /* Used by NLMSG_PUT */
  401. if (skb)
  402. kfree_skb(skb);
  403. return NULL;
  404. }
  405. /**
  406. * audit_send_reply - send an audit reply message via netlink
  407. * @pid: process id to send reply to
  408. * @seq: sequence number
  409. * @type: audit message type
  410. * @done: done (last) flag
  411. * @multi: multi-part message flag
  412. * @payload: payload data
  413. * @size: payload size
  414. *
  415. * Allocates an skb, builds the netlink message, and sends it to the pid.
  416. * No failure notifications.
  417. */
  418. void audit_send_reply(int pid, int seq, int type, int done, int multi,
  419. void *payload, int size)
  420. {
  421. struct sk_buff *skb;
  422. skb = audit_make_reply(pid, seq, type, done, multi, payload, size);
  423. if (!skb)
  424. return;
  425. /* Ignore failure. It'll only happen if the sender goes away,
  426. because our timeout is set to infinite. */
  427. netlink_unicast(audit_sock, skb, pid, 0);
  428. return;
  429. }
  430. /*
  431. * Check for appropriate CAP_AUDIT_ capabilities on incoming audit
  432. * control messages.
  433. */
  434. static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
  435. {
  436. int err = 0;
  437. switch (msg_type) {
  438. case AUDIT_GET:
  439. case AUDIT_LIST:
  440. case AUDIT_LIST_RULES:
  441. case AUDIT_SET:
  442. case AUDIT_ADD:
  443. case AUDIT_ADD_RULE:
  444. case AUDIT_DEL:
  445. case AUDIT_DEL_RULE:
  446. case AUDIT_SIGNAL_INFO:
  447. if (security_netlink_recv(skb, CAP_AUDIT_CONTROL))
  448. err = -EPERM;
  449. break;
  450. case AUDIT_USER:
  451. case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG:
  452. case AUDIT_FIRST_USER_MSG2...AUDIT_LAST_USER_MSG2:
  453. if (security_netlink_recv(skb, CAP_AUDIT_WRITE))
  454. err = -EPERM;
  455. break;
  456. default: /* bad msg */
  457. err = -EINVAL;
  458. }
  459. return err;
  460. }
  461. static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
  462. {
  463. u32 uid, pid, seq, sid;
  464. void *data;
  465. struct audit_status *status_get, status_set;
  466. int err;
  467. struct audit_buffer *ab;
  468. u16 msg_type = nlh->nlmsg_type;
  469. uid_t loginuid; /* loginuid of sender */
  470. struct audit_sig_info *sig_data;
  471. char *ctx;
  472. u32 len;
  473. err = audit_netlink_ok(skb, msg_type);
  474. if (err)
  475. return err;
  476. /* As soon as there's any sign of userspace auditd,
  477. * start kauditd to talk to it */
  478. if (!kauditd_task)
  479. kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
  480. if (IS_ERR(kauditd_task)) {
  481. err = PTR_ERR(kauditd_task);
  482. kauditd_task = NULL;
  483. return err;
  484. }
  485. pid = NETLINK_CREDS(skb)->pid;
  486. uid = NETLINK_CREDS(skb)->uid;
  487. loginuid = NETLINK_CB(skb).loginuid;
  488. sid = NETLINK_CB(skb).sid;
  489. seq = nlh->nlmsg_seq;
  490. data = NLMSG_DATA(nlh);
  491. switch (msg_type) {
  492. case AUDIT_GET:
  493. status_set.enabled = audit_enabled;
  494. status_set.failure = audit_failure;
  495. status_set.pid = audit_pid;
  496. status_set.rate_limit = audit_rate_limit;
  497. status_set.backlog_limit = audit_backlog_limit;
  498. status_set.lost = atomic_read(&audit_lost);
  499. status_set.backlog = skb_queue_len(&audit_skb_queue);
  500. audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
  501. &status_set, sizeof(status_set));
  502. break;
  503. case AUDIT_SET:
  504. if (nlh->nlmsg_len < sizeof(struct audit_status))
  505. return -EINVAL;
  506. status_get = (struct audit_status *)data;
  507. if (status_get->mask & AUDIT_STATUS_ENABLED) {
  508. err = audit_set_enabled(status_get->enabled,
  509. loginuid, sid);
  510. if (err < 0) return err;
  511. }
  512. if (status_get->mask & AUDIT_STATUS_FAILURE) {
  513. err = audit_set_failure(status_get->failure,
  514. loginuid, sid);
  515. if (err < 0) return err;
  516. }
  517. if (status_get->mask & AUDIT_STATUS_PID) {
  518. int old = audit_pid;
  519. if (sid) {
  520. if ((err = selinux_sid_to_string(
  521. sid, &ctx, &len)))
  522. return err;
  523. else
  524. audit_log(NULL, GFP_KERNEL,
  525. AUDIT_CONFIG_CHANGE,
  526. "audit_pid=%d old=%d by auid=%u subj=%s",
  527. status_get->pid, old,
  528. loginuid, ctx);
  529. kfree(ctx);
  530. } else
  531. audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
  532. "audit_pid=%d old=%d by auid=%u",
  533. status_get->pid, old, loginuid);
  534. audit_pid = status_get->pid;
  535. }
  536. if (status_get->mask & AUDIT_STATUS_RATE_LIMIT)
  537. err = audit_set_rate_limit(status_get->rate_limit,
  538. loginuid, sid);
  539. if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT)
  540. err = audit_set_backlog_limit(status_get->backlog_limit,
  541. loginuid, sid);
  542. break;
  543. case AUDIT_USER:
  544. case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG:
  545. case AUDIT_FIRST_USER_MSG2...AUDIT_LAST_USER_MSG2:
  546. if (!audit_enabled && msg_type != AUDIT_USER_AVC)
  547. return 0;
  548. err = audit_filter_user(&NETLINK_CB(skb), msg_type);
  549. if (err == 1) {
  550. err = 0;
  551. ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
  552. if (ab) {
  553. audit_log_format(ab,
  554. "user pid=%d uid=%u auid=%u",
  555. pid, uid, loginuid);
  556. if (sid) {
  557. if (selinux_sid_to_string(
  558. sid, &ctx, &len)) {
  559. audit_log_format(ab,
  560. " ssid=%u", sid);
  561. /* Maybe call audit_panic? */
  562. } else
  563. audit_log_format(ab,
  564. " subj=%s", ctx);
  565. kfree(ctx);
  566. }
  567. audit_log_format(ab, " msg='%.1024s'",
  568. (char *)data);
  569. audit_set_pid(ab, pid);
  570. audit_log_end(ab);
  571. }
  572. }
  573. break;
  574. case AUDIT_ADD:
  575. case AUDIT_DEL:
  576. if (nlmsg_len(nlh) < sizeof(struct audit_rule))
  577. return -EINVAL;
  578. if (audit_enabled == 2) {
  579. ab = audit_log_start(NULL, GFP_KERNEL,
  580. AUDIT_CONFIG_CHANGE);
  581. if (ab) {
  582. audit_log_format(ab,
  583. "pid=%d uid=%u auid=%u",
  584. pid, uid, loginuid);
  585. if (sid) {
  586. if (selinux_sid_to_string(
  587. sid, &ctx, &len)) {
  588. audit_log_format(ab,
  589. " ssid=%u", sid);
  590. /* Maybe call audit_panic? */
  591. } else
  592. audit_log_format(ab,
  593. " subj=%s", ctx);
  594. kfree(ctx);
  595. }
  596. audit_log_format(ab, " audit_enabled=%d res=0",
  597. audit_enabled);
  598. audit_log_end(ab);
  599. }
  600. return -EPERM;
  601. }
  602. /* fallthrough */
  603. case AUDIT_LIST:
  604. err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
  605. uid, seq, data, nlmsg_len(nlh),
  606. loginuid, sid);
  607. break;
  608. case AUDIT_ADD_RULE:
  609. case AUDIT_DEL_RULE:
  610. if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
  611. return -EINVAL;
  612. if (audit_enabled == 2) {
  613. ab = audit_log_start(NULL, GFP_KERNEL,
  614. AUDIT_CONFIG_CHANGE);
  615. if (ab) {
  616. audit_log_format(ab,
  617. "pid=%d uid=%u auid=%u",
  618. pid, uid, loginuid);
  619. if (sid) {
  620. if (selinux_sid_to_string(
  621. sid, &ctx, &len)) {
  622. audit_log_format(ab,
  623. " ssid=%u", sid);
  624. /* Maybe call audit_panic? */
  625. } else
  626. audit_log_format(ab,
  627. " subj=%s", ctx);
  628. kfree(ctx);
  629. }
  630. audit_log_format(ab, " audit_enabled=%d res=0",
  631. audit_enabled);
  632. audit_log_end(ab);
  633. }
  634. return -EPERM;
  635. }
  636. /* fallthrough */
  637. case AUDIT_LIST_RULES:
  638. err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
  639. uid, seq, data, nlmsg_len(nlh),
  640. loginuid, sid);
  641. break;
  642. case AUDIT_SIGNAL_INFO:
  643. err = selinux_sid_to_string(audit_sig_sid, &ctx, &len);
  644. if (err)
  645. return err;
  646. sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
  647. if (!sig_data) {
  648. kfree(ctx);
  649. return -ENOMEM;
  650. }
  651. sig_data->uid = audit_sig_uid;
  652. sig_data->pid = audit_sig_pid;
  653. memcpy(sig_data->ctx, ctx, len);
  654. kfree(ctx);
  655. audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO,
  656. 0, 0, sig_data, sizeof(*sig_data) + len);
  657. kfree(sig_data);
  658. break;
  659. default:
  660. err = -EINVAL;
  661. break;
  662. }
  663. return err < 0 ? err : 0;
  664. }
  665. /*
  666. * Get message from skb (based on rtnetlink_rcv_skb). Each message is
  667. * processed by audit_receive_msg. Malformed skbs with wrong length are
  668. * discarded silently.
  669. */
  670. static void audit_receive_skb(struct sk_buff *skb)
  671. {
  672. int err;
  673. struct nlmsghdr *nlh;
  674. u32 rlen;
  675. while (skb->len >= NLMSG_SPACE(0)) {
  676. nlh = (struct nlmsghdr *)skb->data;
  677. if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
  678. return;
  679. rlen = NLMSG_ALIGN(nlh->nlmsg_len);
  680. if (rlen > skb->len)
  681. rlen = skb->len;
  682. if ((err = audit_receive_msg(skb, nlh))) {
  683. netlink_ack(skb, nlh, err);
  684. } else if (nlh->nlmsg_flags & NLM_F_ACK)
  685. netlink_ack(skb, nlh, 0);
  686. skb_pull(skb, rlen);
  687. }
  688. }
  689. /* Receive messages from netlink socket. */
  690. static void audit_receive(struct sock *sk, int length)
  691. {
  692. struct sk_buff *skb;
  693. unsigned int qlen;
  694. mutex_lock(&audit_cmd_mutex);
  695. for (qlen = skb_queue_len(&sk->sk_receive_queue); qlen; qlen--) {
  696. skb = skb_dequeue(&sk->sk_receive_queue);
  697. audit_receive_skb(skb);
  698. kfree_skb(skb);
  699. }
  700. mutex_unlock(&audit_cmd_mutex);
  701. }
  702. #ifdef CONFIG_AUDITSYSCALL
  703. static const struct inotify_operations audit_inotify_ops = {
  704. .handle_event = audit_handle_ievent,
  705. .destroy_watch = audit_free_parent,
  706. };
  707. #endif
  708. /* Initialize audit support at boot time. */
  709. static int __init audit_init(void)
  710. {
  711. int i;
  712. printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
  713. audit_default ? "enabled" : "disabled");
  714. audit_sock = netlink_kernel_create(NETLINK_AUDIT, 0, audit_receive,
  715. THIS_MODULE);
  716. if (!audit_sock)
  717. audit_panic("cannot initialize netlink socket");
  718. else
  719. audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
  720. skb_queue_head_init(&audit_skb_queue);
  721. audit_initialized = 1;
  722. audit_enabled = audit_default;
  723. /* Register the callback with selinux. This callback will be invoked
  724. * when a new policy is loaded. */
  725. selinux_audit_set_callback(&selinux_audit_rule_update);
  726. audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
  727. #ifdef CONFIG_AUDITSYSCALL
  728. audit_ih = inotify_init(&audit_inotify_ops);
  729. if (IS_ERR(audit_ih))
  730. audit_panic("cannot initialize inotify handle");
  731. #endif
  732. for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
  733. INIT_LIST_HEAD(&audit_inode_hash[i]);
  734. return 0;
  735. }
  736. __initcall(audit_init);
  737. /* Process kernel command-line parameter at boot time. audit=0 or audit=1. */
  738. static int __init audit_enable(char *str)
  739. {
  740. audit_default = !!simple_strtol(str, NULL, 0);
  741. printk(KERN_INFO "audit: %s%s\n",
  742. audit_default ? "enabled" : "disabled",
  743. audit_initialized ? "" : " (after initialization)");
  744. if (audit_initialized)
  745. audit_enabled = audit_default;
  746. return 1;
  747. }
  748. __setup("audit=", audit_enable);
  749. static void audit_buffer_free(struct audit_buffer *ab)
  750. {
  751. unsigned long flags;
  752. if (!ab)
  753. return;
  754. if (ab->skb)
  755. kfree_skb(ab->skb);
  756. spin_lock_irqsave(&audit_freelist_lock, flags);
  757. if (audit_freelist_count > AUDIT_MAXFREE)
  758. kfree(ab);
  759. else {
  760. audit_freelist_count++;
  761. list_add(&ab->list, &audit_freelist);
  762. }
  763. spin_unlock_irqrestore(&audit_freelist_lock, flags);
  764. }
  765. static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
  766. gfp_t gfp_mask, int type)
  767. {
  768. unsigned long flags;
  769. struct audit_buffer *ab = NULL;
  770. struct nlmsghdr *nlh;
  771. spin_lock_irqsave(&audit_freelist_lock, flags);
  772. if (!list_empty(&audit_freelist)) {
  773. ab = list_entry(audit_freelist.next,
  774. struct audit_buffer, list);
  775. list_del(&ab->list);
  776. --audit_freelist_count;
  777. }
  778. spin_unlock_irqrestore(&audit_freelist_lock, flags);
  779. if (!ab) {
  780. ab = kmalloc(sizeof(*ab), gfp_mask);
  781. if (!ab)
  782. goto err;
  783. }
  784. ab->skb = alloc_skb(AUDIT_BUFSIZ, gfp_mask);
  785. if (!ab->skb)
  786. goto err;
  787. ab->ctx = ctx;
  788. ab->gfp_mask = gfp_mask;
  789. nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0));
  790. nlh->nlmsg_type = type;
  791. nlh->nlmsg_flags = 0;
  792. nlh->nlmsg_pid = 0;
  793. nlh->nlmsg_seq = 0;
  794. return ab;
  795. err:
  796. audit_buffer_free(ab);
  797. return NULL;
  798. }
  799. /**
  800. * audit_serial - compute a serial number for the audit record
  801. *
  802. * Compute a serial number for the audit record. Audit records are
  803. * written to user-space as soon as they are generated, so a complete
  804. * audit record may be written in several pieces. The timestamp of the
  805. * record and this serial number are used by the user-space tools to
  806. * determine which pieces belong to the same audit record. The
  807. * (timestamp,serial) tuple is unique for each syscall and is live from
  808. * syscall entry to syscall exit.
  809. *
  810. * NOTE: Another possibility is to store the formatted records off the
  811. * audit context (for those records that have a context), and emit them
  812. * all at syscall exit. However, this could delay the reporting of
  813. * significant errors until syscall exit (or never, if the system
  814. * halts).
  815. */
  816. unsigned int audit_serial(void)
  817. {
  818. static DEFINE_SPINLOCK(serial_lock);
  819. static unsigned int serial = 0;
  820. unsigned long flags;
  821. unsigned int ret;
  822. spin_lock_irqsave(&serial_lock, flags);
  823. do {
  824. ret = ++serial;
  825. } while (unlikely(!ret));
  826. spin_unlock_irqrestore(&serial_lock, flags);
  827. return ret;
  828. }
  829. static inline void audit_get_stamp(struct audit_context *ctx,
  830. struct timespec *t, unsigned int *serial)
  831. {
  832. if (ctx)
  833. auditsc_get_stamp(ctx, t, serial);
  834. else {
  835. *t = CURRENT_TIME;
  836. *serial = audit_serial();
  837. }
  838. }
  839. /* Obtain an audit buffer. This routine does locking to obtain the
  840. * audit buffer, but then no locking is required for calls to
  841. * audit_log_*format. If the tsk is a task that is currently in a
  842. * syscall, then the syscall is marked as auditable and an audit record
  843. * will be written at syscall exit. If there is no associated task, tsk
  844. * should be NULL. */
  845. /**
  846. * audit_log_start - obtain an audit buffer
  847. * @ctx: audit_context (may be NULL)
  848. * @gfp_mask: type of allocation
  849. * @type: audit message type
  850. *
  851. * Returns audit_buffer pointer on success or NULL on error.
  852. *
  853. * Obtain an audit buffer. This routine does locking to obtain the
  854. * audit buffer, but then no locking is required for calls to
  855. * audit_log_*format. If the task (ctx) is a task that is currently in a
  856. * syscall, then the syscall is marked as auditable and an audit record
  857. * will be written at syscall exit. If there is no associated task, then
  858. * task context (ctx) should be NULL.
  859. */
  860. struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
  861. int type)
  862. {
  863. struct audit_buffer *ab = NULL;
  864. struct timespec t;
  865. unsigned int serial;
  866. int reserve;
  867. unsigned long timeout_start = jiffies;
  868. if (!audit_initialized)
  869. return NULL;
  870. if (unlikely(audit_filter_type(type)))
  871. return NULL;
  872. if (gfp_mask & __GFP_WAIT)
  873. reserve = 0;
  874. else
  875. reserve = 5; /* Allow atomic callers to go up to five
  876. entries over the normal backlog limit */
  877. while (audit_backlog_limit
  878. && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
  879. if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time
  880. && time_before(jiffies, timeout_start + audit_backlog_wait_time)) {
  881. /* Wait for auditd to drain the queue a little */
  882. DECLARE_WAITQUEUE(wait, current);
  883. set_current_state(TASK_INTERRUPTIBLE);
  884. add_wait_queue(&audit_backlog_wait, &wait);
  885. if (audit_backlog_limit &&
  886. skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
  887. schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies);
  888. __set_current_state(TASK_RUNNING);
  889. remove_wait_queue(&audit_backlog_wait, &wait);
  890. continue;
  891. }
  892. if (audit_rate_check())
  893. printk(KERN_WARNING
  894. "audit: audit_backlog=%d > "
  895. "audit_backlog_limit=%d\n",
  896. skb_queue_len(&audit_skb_queue),
  897. audit_backlog_limit);
  898. audit_log_lost("backlog limit exceeded");
  899. audit_backlog_wait_time = audit_backlog_wait_overflow;
  900. wake_up(&audit_backlog_wait);
  901. return NULL;
  902. }
  903. ab = audit_buffer_alloc(ctx, gfp_mask, type);
  904. if (!ab) {
  905. audit_log_lost("out of memory in audit_log_start");
  906. return NULL;
  907. }
  908. audit_get_stamp(ab->ctx, &t, &serial);
  909. audit_log_format(ab, "audit(%lu.%03lu:%u): ",
  910. t.tv_sec, t.tv_nsec/1000000, serial);
  911. return ab;
  912. }
  913. /**
  914. * audit_expand - expand skb in the audit buffer
  915. * @ab: audit_buffer
  916. * @extra: space to add at tail of the skb
  917. *
  918. * Returns 0 (no space) on failed expansion, or available space if
  919. * successful.
  920. */
  921. static inline int audit_expand(struct audit_buffer *ab, int extra)
  922. {
  923. struct sk_buff *skb = ab->skb;
  924. int ret = pskb_expand_head(skb, skb_headroom(skb), extra,
  925. ab->gfp_mask);
  926. if (ret < 0) {
  927. audit_log_lost("out of memory in audit_expand");
  928. return 0;
  929. }
  930. return skb_tailroom(skb);
  931. }
  932. /*
  933. * Format an audit message into the audit buffer. If there isn't enough
  934. * room in the audit buffer, more room will be allocated and vsnprint
  935. * will be called a second time. Currently, we assume that a printk
  936. * can't format message larger than 1024 bytes, so we don't either.
  937. */
  938. static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
  939. va_list args)
  940. {
  941. int len, avail;
  942. struct sk_buff *skb;
  943. va_list args2;
  944. if (!ab)
  945. return;
  946. BUG_ON(!ab->skb);
  947. skb = ab->skb;
  948. avail = skb_tailroom(skb);
  949. if (avail == 0) {
  950. avail = audit_expand(ab, AUDIT_BUFSIZ);
  951. if (!avail)
  952. goto out;
  953. }
  954. va_copy(args2, args);
  955. len = vsnprintf(skb->tail, avail, fmt, args);
  956. if (len >= avail) {
  957. /* The printk buffer is 1024 bytes long, so if we get
  958. * here and AUDIT_BUFSIZ is at least 1024, then we can
  959. * log everything that printk could have logged. */
  960. avail = audit_expand(ab,
  961. max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
  962. if (!avail)
  963. goto out;
  964. len = vsnprintf(skb->tail, avail, fmt, args2);
  965. }
  966. if (len > 0)
  967. skb_put(skb, len);
  968. out:
  969. return;
  970. }
  971. /**
  972. * audit_log_format - format a message into the audit buffer.
  973. * @ab: audit_buffer
  974. * @fmt: format string
  975. * @...: optional parameters matching @fmt string
  976. *
  977. * All the work is done in audit_log_vformat.
  978. */
  979. void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
  980. {
  981. va_list args;
  982. if (!ab)
  983. return;
  984. va_start(args, fmt);
  985. audit_log_vformat(ab, fmt, args);
  986. va_end(args);
  987. }
  988. /**
  989. * audit_log_hex - convert a buffer to hex and append it to the audit skb
  990. * @ab: the audit_buffer
  991. * @buf: buffer to convert to hex
  992. * @len: length of @buf to be converted
  993. *
  994. * No return value; failure to expand is silently ignored.
  995. *
  996. * This function will take the passed buf and convert it into a string of
  997. * ascii hex digits. The new string is placed onto the skb.
  998. */
  999. void audit_log_hex(struct audit_buffer *ab, const unsigned char *buf,
  1000. size_t len)
  1001. {
  1002. int i, avail, new_len;
  1003. unsigned char *ptr;
  1004. struct sk_buff *skb;
  1005. static const unsigned char *hex = "0123456789ABCDEF";
  1006. if (!ab)
  1007. return;
  1008. BUG_ON(!ab->skb);
  1009. skb = ab->skb;
  1010. avail = skb_tailroom(skb);
  1011. new_len = len<<1;
  1012. if (new_len >= avail) {
  1013. /* Round the buffer request up to the next multiple */
  1014. new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
  1015. avail = audit_expand(ab, new_len);
  1016. if (!avail)
  1017. return;
  1018. }
  1019. ptr = skb->tail;
  1020. for (i=0; i<len; i++) {
  1021. *ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */
  1022. *ptr++ = hex[buf[i] & 0x0F]; /* Lower nibble */
  1023. }
  1024. *ptr = 0;
  1025. skb_put(skb, len << 1); /* new string is twice the old string */
  1026. }
  1027. /*
  1028. * Format a string of no more than slen characters into the audit buffer,
  1029. * enclosed in quote marks.
  1030. */
  1031. static void audit_log_n_string(struct audit_buffer *ab, size_t slen,
  1032. const char *string)
  1033. {
  1034. int avail, new_len;
  1035. unsigned char *ptr;
  1036. struct sk_buff *skb;
  1037. if (!ab)
  1038. return;
  1039. BUG_ON(!ab->skb);
  1040. skb = ab->skb;
  1041. avail = skb_tailroom(skb);
  1042. new_len = slen + 3; /* enclosing quotes + null terminator */
  1043. if (new_len > avail) {
  1044. avail = audit_expand(ab, new_len);
  1045. if (!avail)
  1046. return;
  1047. }
  1048. ptr = skb->tail;
  1049. *ptr++ = '"';
  1050. memcpy(ptr, string, slen);
  1051. ptr += slen;
  1052. *ptr++ = '"';
  1053. *ptr = 0;
  1054. skb_put(skb, slen + 2); /* don't include null terminator */
  1055. }
  1056. /**
  1057. * audit_log_n_unstrustedstring - log a string that may contain random characters
  1058. * @ab: audit_buffer
  1059. * @len: lenth of string (not including trailing null)
  1060. * @string: string to be logged
  1061. *
  1062. * This code will escape a string that is passed to it if the string
  1063. * contains a control character, unprintable character, double quote mark,
  1064. * or a space. Unescaped strings will start and end with a double quote mark.
  1065. * Strings that are escaped are printed in hex (2 digits per char).
  1066. *
  1067. * The caller specifies the number of characters in the string to log, which may
  1068. * or may not be the entire string.
  1069. */
  1070. const char *audit_log_n_untrustedstring(struct audit_buffer *ab, size_t len,
  1071. const char *string)
  1072. {
  1073. const unsigned char *p = string;
  1074. while (*p) {
  1075. if (*p == '"' || *p < 0x21 || *p > 0x7f) {
  1076. audit_log_hex(ab, string, len);
  1077. return string + len + 1;
  1078. }
  1079. p++;
  1080. }
  1081. audit_log_n_string(ab, len, string);
  1082. return p + 1;
  1083. }
  1084. /**
  1085. * audit_log_unstrustedstring - log a string that may contain random characters
  1086. * @ab: audit_buffer
  1087. * @string: string to be logged
  1088. *
  1089. * Same as audit_log_n_unstrustedstring(), except that strlen is used to
  1090. * determine string length.
  1091. */
  1092. const char *audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
  1093. {
  1094. return audit_log_n_untrustedstring(ab, strlen(string), string);
  1095. }
  1096. /* This is a helper-function to print the escaped d_path */
  1097. void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
  1098. struct dentry *dentry, struct vfsmount *vfsmnt)
  1099. {
  1100. char *p, *path;
  1101. if (prefix)
  1102. audit_log_format(ab, " %s", prefix);
  1103. /* We will allow 11 spaces for ' (deleted)' to be appended */
  1104. path = kmalloc(PATH_MAX+11, ab->gfp_mask);
  1105. if (!path) {
  1106. audit_log_format(ab, "<no memory>");
  1107. return;
  1108. }
  1109. p = d_path(dentry, vfsmnt, path, PATH_MAX+11);
  1110. if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */
  1111. /* FIXME: can we save some information here? */
  1112. audit_log_format(ab, "<too long>");
  1113. } else
  1114. audit_log_untrustedstring(ab, p);
  1115. kfree(path);
  1116. }
  1117. /**
  1118. * audit_log_end - end one audit record
  1119. * @ab: the audit_buffer
  1120. *
  1121. * The netlink_* functions cannot be called inside an irq context, so
  1122. * the audit buffer is placed on a queue and a tasklet is scheduled to
  1123. * remove them from the queue outside the irq context. May be called in
  1124. * any context.
  1125. */
  1126. void audit_log_end(struct audit_buffer *ab)
  1127. {
  1128. if (!ab)
  1129. return;
  1130. if (!audit_rate_check()) {
  1131. audit_log_lost("rate limit exceeded");
  1132. } else {
  1133. if (audit_pid) {
  1134. struct nlmsghdr *nlh = (struct nlmsghdr *)ab->skb->data;
  1135. nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0);
  1136. skb_queue_tail(&audit_skb_queue, ab->skb);
  1137. ab->skb = NULL;
  1138. wake_up_interruptible(&kauditd_wait);
  1139. } else {
  1140. printk(KERN_NOTICE "%s\n", ab->skb->data + NLMSG_SPACE(0));
  1141. }
  1142. }
  1143. audit_buffer_free(ab);
  1144. }
  1145. /**
  1146. * audit_log - Log an audit record
  1147. * @ctx: audit context
  1148. * @gfp_mask: type of allocation
  1149. * @type: audit message type
  1150. * @fmt: format string to use
  1151. * @...: variable parameters matching the format string
  1152. *
  1153. * This is a convenience function that calls audit_log_start,
  1154. * audit_log_vformat, and audit_log_end. It may be called
  1155. * in any context.
  1156. */
  1157. void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
  1158. const char *fmt, ...)
  1159. {
  1160. struct audit_buffer *ab;
  1161. va_list args;
  1162. ab = audit_log_start(ctx, gfp_mask, type);
  1163. if (ab) {
  1164. va_start(args, fmt);
  1165. audit_log_vformat(ab, fmt, args);
  1166. va_end(args);
  1167. audit_log_end(ab);
  1168. }
  1169. }
  1170. EXPORT_SYMBOL(audit_log_start);
  1171. EXPORT_SYMBOL(audit_log_end);
  1172. EXPORT_SYMBOL(audit_log_format);
  1173. EXPORT_SYMBOL(audit_log);