audit.h 4.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147
  1. /* audit -- definition of audit_context structure and supporting types
  2. *
  3. * Copyright 2003-2004 Red Hat, Inc.
  4. * Copyright 2005 Hewlett-Packard Development Company, L.P.
  5. * Copyright 2005 IBM Corporation
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License as published by
  9. * the Free Software Foundation; either version 2 of the License, or
  10. * (at your option) any later version.
  11. *
  12. * This program is distributed in the hope that it will be useful,
  13. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. * GNU General Public License for more details.
  16. *
  17. * You should have received a copy of the GNU General Public License
  18. * along with this program; if not, write to the Free Software
  19. * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20. */
  21. #include <linux/fs.h>
  22. #include <linux/audit.h>
  23. #include <linux/skbuff.h>
  24. /* 0 = no checking
  25. 1 = put_count checking
  26. 2 = verbose put_count checking
  27. */
  28. #define AUDIT_DEBUG 0
  29. /* At task start time, the audit_state is set in the audit_context using
  30. a per-task filter. At syscall entry, the audit_state is augmented by
  31. the syscall filter. */
  32. enum audit_state {
  33. AUDIT_DISABLED, /* Do not create per-task audit_context.
  34. * No syscall-specific audit records can
  35. * be generated. */
  36. AUDIT_SETUP_CONTEXT, /* Create the per-task audit_context,
  37. * but don't necessarily fill it in at
  38. * syscall entry time (i.e., filter
  39. * instead). */
  40. AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context,
  41. * and always fill it in at syscall
  42. * entry time. This makes a full
  43. * syscall record available if some
  44. * other part of the kernel decides it
  45. * should be recorded. */
  46. AUDIT_RECORD_CONTEXT /* Create the per-task audit_context,
  47. * always fill it in at syscall entry
  48. * time, and always write out the audit
  49. * record at syscall exit time. */
  50. };
  51. /* Rule lists */
  52. struct audit_parent;
  53. struct audit_watch {
  54. atomic_t count; /* reference count */
  55. char *path; /* insertion path */
  56. dev_t dev; /* associated superblock device */
  57. unsigned long ino; /* associated inode number */
  58. struct audit_parent *parent; /* associated parent */
  59. struct list_head wlist; /* entry in parent->watches list */
  60. struct list_head rules; /* associated rules */
  61. };
  62. struct audit_field {
  63. u32 type;
  64. u32 val;
  65. u32 op;
  66. char *se_str;
  67. struct selinux_audit_rule *se_rule;
  68. };
  69. struct audit_krule {
  70. int vers_ops;
  71. u32 flags;
  72. u32 listnr;
  73. u32 action;
  74. u32 mask[AUDIT_BITMASK_SIZE];
  75. u32 buflen; /* for data alloc on list rules */
  76. u32 field_count;
  77. char *filterkey; /* ties events to rules */
  78. struct audit_field *fields;
  79. struct audit_field *inode_f; /* quick access to an inode field */
  80. struct audit_watch *watch; /* associated watch */
  81. struct list_head rlist; /* entry in audit_watch.rules list */
  82. };
  83. struct audit_entry {
  84. struct list_head list;
  85. struct rcu_head rcu;
  86. struct audit_krule rule;
  87. };
  88. extern int audit_pid;
  89. #define AUDIT_INODE_BUCKETS 32
  90. extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
  91. static inline int audit_hash_ino(u32 ino)
  92. {
  93. return (ino & (AUDIT_INODE_BUCKETS-1));
  94. }
  95. extern int audit_match_class(int class, unsigned syscall);
  96. extern int audit_comparator(const u32 left, const u32 op, const u32 right);
  97. extern int audit_compare_dname_path(const char *dname, const char *path,
  98. int *dirlen);
  99. extern struct sk_buff * audit_make_reply(int pid, int seq, int type,
  100. int done, int multi,
  101. void *payload, int size);
  102. extern void audit_send_reply(int pid, int seq, int type,
  103. int done, int multi,
  104. void *payload, int size);
  105. extern void audit_log_lost(const char *message);
  106. extern void audit_panic(const char *message);
  107. struct audit_netlink_list {
  108. int pid;
  109. struct sk_buff_head q;
  110. };
  111. int audit_send_list(void *);
  112. struct inotify_watch;
  113. extern void audit_free_parent(struct inotify_watch *);
  114. extern void audit_handle_ievent(struct inotify_watch *, u32, u32, u32,
  115. const char *, struct inode *);
  116. extern int selinux_audit_rule_update(void);
  117. #ifdef CONFIG_AUDITSYSCALL
  118. extern void __audit_signal_info(int sig, struct task_struct *t);
  119. static inline void audit_signal_info(int sig, struct task_struct *t)
  120. {
  121. if (unlikely(audit_pid && t->tgid == audit_pid))
  122. __audit_signal_info(sig, t);
  123. }
  124. extern enum audit_state audit_filter_inodes(struct task_struct *,
  125. struct audit_context *);
  126. extern void audit_set_auditable(struct audit_context *);
  127. #else
  128. #define audit_signal_info(s,t)
  129. #define audit_filter_inodes(t,c) AUDIT_DISABLED
  130. #define audit_set_auditable(c)
  131. #endif