auditsc.c 49 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937
  1. /* auditsc.c -- System-call auditing support
  2. * Handles all system-call specific auditing features.
  3. *
  4. * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
  5. * Copyright 2005 Hewlett-Packard Development Company, L.P.
  6. * Copyright (C) 2005, 2006 IBM Corporation
  7. * All Rights Reserved.
  8. *
  9. * This program is free software; you can redistribute it and/or modify
  10. * it under the terms of the GNU General Public License as published by
  11. * the Free Software Foundation; either version 2 of the License, or
  12. * (at your option) any later version.
  13. *
  14. * This program is distributed in the hope that it will be useful,
  15. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  17. * GNU General Public License for more details.
  18. *
  19. * You should have received a copy of the GNU General Public License
  20. * along with this program; if not, write to the Free Software
  21. * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  22. *
  23. * Written by Rickard E. (Rik) Faith <faith@redhat.com>
  24. *
  25. * Many of the ideas implemented here are from Stephen C. Tweedie,
  26. * especially the idea of avoiding a copy by using getname.
  27. *
  28. * The method for actual interception of syscall entry and exit (not in
  29. * this file -- see entry.S) is based on a GPL'd patch written by
  30. * okir@suse.de and Copyright 2003 SuSE Linux AG.
  31. *
  32. * POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>,
  33. * 2006.
  34. *
  35. * The support of additional filter rules compares (>, <, >=, <=) was
  36. * added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005.
  37. *
  38. * Modified by Amy Griffis <amy.griffis@hp.com> to collect additional
  39. * filesystem information.
  40. *
  41. * Subject and object context labeling support added by <danjones@us.ibm.com>
  42. * and <dustin.kirkland@us.ibm.com> for LSPP certification compliance.
  43. */
  44. #include <linux/init.h>
  45. #include <asm/types.h>
  46. #include <asm/atomic.h>
  47. #include <asm/types.h>
  48. #include <linux/fs.h>
  49. #include <linux/namei.h>
  50. #include <linux/mm.h>
  51. #include <linux/module.h>
  52. #include <linux/mount.h>
  53. #include <linux/socket.h>
  54. #include <linux/mqueue.h>
  55. #include <linux/audit.h>
  56. #include <linux/personality.h>
  57. #include <linux/time.h>
  58. #include <linux/netlink.h>
  59. #include <linux/compiler.h>
  60. #include <asm/unistd.h>
  61. #include <linux/security.h>
  62. #include <linux/list.h>
  63. #include <linux/tty.h>
  64. #include <linux/selinux.h>
  65. #include <linux/binfmts.h>
  66. #include <linux/highmem.h>
  67. #include <linux/syscalls.h>
  68. #include "audit.h"
  69. extern struct list_head audit_filter_list[];
  70. /* No syscall auditing will take place unless audit_enabled != 0. */
  71. extern int audit_enabled;
  72. /* AUDIT_NAMES is the number of slots we reserve in the audit_context
  73. * for saving names from getname(). */
  74. #define AUDIT_NAMES 20
  75. /* AUDIT_NAMES_RESERVED is the number of slots we reserve in the
  76. * audit_context from being used for nameless inodes from
  77. * path_lookup. */
  78. #define AUDIT_NAMES_RESERVED 7
  79. /* Indicates that audit should log the full pathname. */
  80. #define AUDIT_NAME_FULL -1
  81. /* number of audit rules */
  82. int audit_n_rules;
  83. /* When fs/namei.c:getname() is called, we store the pointer in name and
  84. * we don't let putname() free it (instead we free all of the saved
  85. * pointers at syscall exit time).
  86. *
  87. * Further, in fs/namei.c:path_lookup() we store the inode and device. */
  88. struct audit_names {
  89. const char *name;
  90. int name_len; /* number of name's characters to log */
  91. unsigned name_put; /* call __putname() for this name */
  92. unsigned long ino;
  93. dev_t dev;
  94. umode_t mode;
  95. uid_t uid;
  96. gid_t gid;
  97. dev_t rdev;
  98. u32 osid;
  99. };
  100. struct audit_aux_data {
  101. struct audit_aux_data *next;
  102. int type;
  103. };
  104. #define AUDIT_AUX_IPCPERM 0
  105. struct audit_aux_data_mq_open {
  106. struct audit_aux_data d;
  107. int oflag;
  108. mode_t mode;
  109. struct mq_attr attr;
  110. };
  111. struct audit_aux_data_mq_sendrecv {
  112. struct audit_aux_data d;
  113. mqd_t mqdes;
  114. size_t msg_len;
  115. unsigned int msg_prio;
  116. struct timespec abs_timeout;
  117. };
  118. struct audit_aux_data_mq_notify {
  119. struct audit_aux_data d;
  120. mqd_t mqdes;
  121. struct sigevent notification;
  122. };
  123. struct audit_aux_data_mq_getsetattr {
  124. struct audit_aux_data d;
  125. mqd_t mqdes;
  126. struct mq_attr mqstat;
  127. };
  128. struct audit_aux_data_ipcctl {
  129. struct audit_aux_data d;
  130. struct ipc_perm p;
  131. unsigned long qbytes;
  132. uid_t uid;
  133. gid_t gid;
  134. mode_t mode;
  135. u32 osid;
  136. };
  137. struct audit_aux_data_execve {
  138. struct audit_aux_data d;
  139. int argc;
  140. int envc;
  141. char mem[0];
  142. };
  143. struct audit_aux_data_socketcall {
  144. struct audit_aux_data d;
  145. int nargs;
  146. unsigned long args[0];
  147. };
  148. struct audit_aux_data_sockaddr {
  149. struct audit_aux_data d;
  150. int len;
  151. char a[0];
  152. };
  153. struct audit_aux_data_fd_pair {
  154. struct audit_aux_data d;
  155. int fd[2];
  156. };
  157. struct audit_aux_data_path {
  158. struct audit_aux_data d;
  159. struct dentry *dentry;
  160. struct vfsmount *mnt;
  161. };
  162. /* The per-task audit context. */
  163. struct audit_context {
  164. int dummy; /* must be the first element */
  165. int in_syscall; /* 1 if task is in a syscall */
  166. enum audit_state state;
  167. unsigned int serial; /* serial number for record */
  168. struct timespec ctime; /* time of syscall entry */
  169. uid_t loginuid; /* login uid (identity) */
  170. int major; /* syscall number */
  171. unsigned long argv[4]; /* syscall arguments */
  172. int return_valid; /* return code is valid */
  173. long return_code;/* syscall return code */
  174. int auditable; /* 1 if record should be written */
  175. int name_count;
  176. struct audit_names names[AUDIT_NAMES];
  177. char * filterkey; /* key for rule that triggered record */
  178. struct dentry * pwd;
  179. struct vfsmount * pwdmnt;
  180. struct audit_context *previous; /* For nested syscalls */
  181. struct audit_aux_data *aux;
  182. /* Save things to print about task_struct */
  183. pid_t pid, ppid;
  184. uid_t uid, euid, suid, fsuid;
  185. gid_t gid, egid, sgid, fsgid;
  186. unsigned long personality;
  187. int arch;
  188. #if AUDIT_DEBUG
  189. int put_count;
  190. int ino_count;
  191. #endif
  192. };
  193. #define ACC_MODE(x) ("\004\002\006\006"[(x)&O_ACCMODE])
  194. static inline int open_arg(int flags, int mask)
  195. {
  196. int n = ACC_MODE(flags);
  197. if (flags & (O_TRUNC | O_CREAT))
  198. n |= AUDIT_PERM_WRITE;
  199. return n & mask;
  200. }
  201. static int audit_match_perm(struct audit_context *ctx, int mask)
  202. {
  203. unsigned n = ctx->major;
  204. switch (audit_classify_syscall(ctx->arch, n)) {
  205. case 0: /* native */
  206. if ((mask & AUDIT_PERM_WRITE) &&
  207. audit_match_class(AUDIT_CLASS_WRITE, n))
  208. return 1;
  209. if ((mask & AUDIT_PERM_READ) &&
  210. audit_match_class(AUDIT_CLASS_READ, n))
  211. return 1;
  212. if ((mask & AUDIT_PERM_ATTR) &&
  213. audit_match_class(AUDIT_CLASS_CHATTR, n))
  214. return 1;
  215. return 0;
  216. case 1: /* 32bit on biarch */
  217. if ((mask & AUDIT_PERM_WRITE) &&
  218. audit_match_class(AUDIT_CLASS_WRITE_32, n))
  219. return 1;
  220. if ((mask & AUDIT_PERM_READ) &&
  221. audit_match_class(AUDIT_CLASS_READ_32, n))
  222. return 1;
  223. if ((mask & AUDIT_PERM_ATTR) &&
  224. audit_match_class(AUDIT_CLASS_CHATTR_32, n))
  225. return 1;
  226. return 0;
  227. case 2: /* open */
  228. return mask & ACC_MODE(ctx->argv[1]);
  229. case 3: /* openat */
  230. return mask & ACC_MODE(ctx->argv[2]);
  231. case 4: /* socketcall */
  232. return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);
  233. case 5: /* execve */
  234. return mask & AUDIT_PERM_EXEC;
  235. default:
  236. return 0;
  237. }
  238. }
  239. /* Determine if any context name data matches a rule's watch data */
  240. /* Compare a task_struct with an audit_rule. Return 1 on match, 0
  241. * otherwise. */
  242. static int audit_filter_rules(struct task_struct *tsk,
  243. struct audit_krule *rule,
  244. struct audit_context *ctx,
  245. struct audit_names *name,
  246. enum audit_state *state)
  247. {
  248. int i, j, need_sid = 1;
  249. u32 sid;
  250. for (i = 0; i < rule->field_count; i++) {
  251. struct audit_field *f = &rule->fields[i];
  252. int result = 0;
  253. switch (f->type) {
  254. case AUDIT_PID:
  255. result = audit_comparator(tsk->pid, f->op, f->val);
  256. break;
  257. case AUDIT_PPID:
  258. if (ctx) {
  259. if (!ctx->ppid)
  260. ctx->ppid = sys_getppid();
  261. result = audit_comparator(ctx->ppid, f->op, f->val);
  262. }
  263. break;
  264. case AUDIT_UID:
  265. result = audit_comparator(tsk->uid, f->op, f->val);
  266. break;
  267. case AUDIT_EUID:
  268. result = audit_comparator(tsk->euid, f->op, f->val);
  269. break;
  270. case AUDIT_SUID:
  271. result = audit_comparator(tsk->suid, f->op, f->val);
  272. break;
  273. case AUDIT_FSUID:
  274. result = audit_comparator(tsk->fsuid, f->op, f->val);
  275. break;
  276. case AUDIT_GID:
  277. result = audit_comparator(tsk->gid, f->op, f->val);
  278. break;
  279. case AUDIT_EGID:
  280. result = audit_comparator(tsk->egid, f->op, f->val);
  281. break;
  282. case AUDIT_SGID:
  283. result = audit_comparator(tsk->sgid, f->op, f->val);
  284. break;
  285. case AUDIT_FSGID:
  286. result = audit_comparator(tsk->fsgid, f->op, f->val);
  287. break;
  288. case AUDIT_PERS:
  289. result = audit_comparator(tsk->personality, f->op, f->val);
  290. break;
  291. case AUDIT_ARCH:
  292. if (ctx)
  293. result = audit_comparator(ctx->arch, f->op, f->val);
  294. break;
  295. case AUDIT_EXIT:
  296. if (ctx && ctx->return_valid)
  297. result = audit_comparator(ctx->return_code, f->op, f->val);
  298. break;
  299. case AUDIT_SUCCESS:
  300. if (ctx && ctx->return_valid) {
  301. if (f->val)
  302. result = audit_comparator(ctx->return_valid, f->op, AUDITSC_SUCCESS);
  303. else
  304. result = audit_comparator(ctx->return_valid, f->op, AUDITSC_FAILURE);
  305. }
  306. break;
  307. case AUDIT_DEVMAJOR:
  308. if (name)
  309. result = audit_comparator(MAJOR(name->dev),
  310. f->op, f->val);
  311. else if (ctx) {
  312. for (j = 0; j < ctx->name_count; j++) {
  313. if (audit_comparator(MAJOR(ctx->names[j].dev), f->op, f->val)) {
  314. ++result;
  315. break;
  316. }
  317. }
  318. }
  319. break;
  320. case AUDIT_DEVMINOR:
  321. if (name)
  322. result = audit_comparator(MINOR(name->dev),
  323. f->op, f->val);
  324. else if (ctx) {
  325. for (j = 0; j < ctx->name_count; j++) {
  326. if (audit_comparator(MINOR(ctx->names[j].dev), f->op, f->val)) {
  327. ++result;
  328. break;
  329. }
  330. }
  331. }
  332. break;
  333. case AUDIT_INODE:
  334. if (name)
  335. result = (name->ino == f->val);
  336. else if (ctx) {
  337. for (j = 0; j < ctx->name_count; j++) {
  338. if (audit_comparator(ctx->names[j].ino, f->op, f->val)) {
  339. ++result;
  340. break;
  341. }
  342. }
  343. }
  344. break;
  345. case AUDIT_WATCH:
  346. if (name && rule->watch->ino != (unsigned long)-1)
  347. result = (name->dev == rule->watch->dev &&
  348. name->ino == rule->watch->ino);
  349. break;
  350. case AUDIT_LOGINUID:
  351. result = 0;
  352. if (ctx)
  353. result = audit_comparator(ctx->loginuid, f->op, f->val);
  354. break;
  355. case AUDIT_SUBJ_USER:
  356. case AUDIT_SUBJ_ROLE:
  357. case AUDIT_SUBJ_TYPE:
  358. case AUDIT_SUBJ_SEN:
  359. case AUDIT_SUBJ_CLR:
  360. /* NOTE: this may return negative values indicating
  361. a temporary error. We simply treat this as a
  362. match for now to avoid losing information that
  363. may be wanted. An error message will also be
  364. logged upon error */
  365. if (f->se_rule) {
  366. if (need_sid) {
  367. selinux_get_task_sid(tsk, &sid);
  368. need_sid = 0;
  369. }
  370. result = selinux_audit_rule_match(sid, f->type,
  371. f->op,
  372. f->se_rule,
  373. ctx);
  374. }
  375. break;
  376. case AUDIT_OBJ_USER:
  377. case AUDIT_OBJ_ROLE:
  378. case AUDIT_OBJ_TYPE:
  379. case AUDIT_OBJ_LEV_LOW:
  380. case AUDIT_OBJ_LEV_HIGH:
  381. /* The above note for AUDIT_SUBJ_USER...AUDIT_SUBJ_CLR
  382. also applies here */
  383. if (f->se_rule) {
  384. /* Find files that match */
  385. if (name) {
  386. result = selinux_audit_rule_match(
  387. name->osid, f->type, f->op,
  388. f->se_rule, ctx);
  389. } else if (ctx) {
  390. for (j = 0; j < ctx->name_count; j++) {
  391. if (selinux_audit_rule_match(
  392. ctx->names[j].osid,
  393. f->type, f->op,
  394. f->se_rule, ctx)) {
  395. ++result;
  396. break;
  397. }
  398. }
  399. }
  400. /* Find ipc objects that match */
  401. if (ctx) {
  402. struct audit_aux_data *aux;
  403. for (aux = ctx->aux; aux;
  404. aux = aux->next) {
  405. if (aux->type == AUDIT_IPC) {
  406. struct audit_aux_data_ipcctl *axi = (void *)aux;
  407. if (selinux_audit_rule_match(axi->osid, f->type, f->op, f->se_rule, ctx)) {
  408. ++result;
  409. break;
  410. }
  411. }
  412. }
  413. }
  414. }
  415. break;
  416. case AUDIT_ARG0:
  417. case AUDIT_ARG1:
  418. case AUDIT_ARG2:
  419. case AUDIT_ARG3:
  420. if (ctx)
  421. result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
  422. break;
  423. case AUDIT_FILTERKEY:
  424. /* ignore this field for filtering */
  425. result = 1;
  426. break;
  427. case AUDIT_PERM:
  428. result = audit_match_perm(ctx, f->val);
  429. break;
  430. }
  431. if (!result)
  432. return 0;
  433. }
  434. if (rule->filterkey)
  435. ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
  436. switch (rule->action) {
  437. case AUDIT_NEVER: *state = AUDIT_DISABLED; break;
  438. case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break;
  439. }
  440. return 1;
  441. }
  442. /* At process creation time, we can determine if system-call auditing is
  443. * completely disabled for this task. Since we only have the task
  444. * structure at this point, we can only check uid and gid.
  445. */
  446. static enum audit_state audit_filter_task(struct task_struct *tsk)
  447. {
  448. struct audit_entry *e;
  449. enum audit_state state;
  450. rcu_read_lock();
  451. list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
  452. if (audit_filter_rules(tsk, &e->rule, NULL, NULL, &state)) {
  453. rcu_read_unlock();
  454. return state;
  455. }
  456. }
  457. rcu_read_unlock();
  458. return AUDIT_BUILD_CONTEXT;
  459. }
  460. /* At syscall entry and exit time, this filter is called if the
  461. * audit_state is not low enough that auditing cannot take place, but is
  462. * also not high enough that we already know we have to write an audit
  463. * record (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT).
  464. */
  465. static enum audit_state audit_filter_syscall(struct task_struct *tsk,
  466. struct audit_context *ctx,
  467. struct list_head *list)
  468. {
  469. struct audit_entry *e;
  470. enum audit_state state;
  471. if (audit_pid && tsk->tgid == audit_pid)
  472. return AUDIT_DISABLED;
  473. rcu_read_lock();
  474. if (!list_empty(list)) {
  475. int word = AUDIT_WORD(ctx->major);
  476. int bit = AUDIT_BIT(ctx->major);
  477. list_for_each_entry_rcu(e, list, list) {
  478. if ((e->rule.mask[word] & bit) == bit &&
  479. audit_filter_rules(tsk, &e->rule, ctx, NULL,
  480. &state)) {
  481. rcu_read_unlock();
  482. return state;
  483. }
  484. }
  485. }
  486. rcu_read_unlock();
  487. return AUDIT_BUILD_CONTEXT;
  488. }
  489. /* At syscall exit time, this filter is called if any audit_names[] have been
  490. * collected during syscall processing. We only check rules in sublists at hash
  491. * buckets applicable to the inode numbers in audit_names[].
  492. * Regarding audit_state, same rules apply as for audit_filter_syscall().
  493. */
  494. enum audit_state audit_filter_inodes(struct task_struct *tsk,
  495. struct audit_context *ctx)
  496. {
  497. int i;
  498. struct audit_entry *e;
  499. enum audit_state state;
  500. if (audit_pid && tsk->tgid == audit_pid)
  501. return AUDIT_DISABLED;
  502. rcu_read_lock();
  503. for (i = 0; i < ctx->name_count; i++) {
  504. int word = AUDIT_WORD(ctx->major);
  505. int bit = AUDIT_BIT(ctx->major);
  506. struct audit_names *n = &ctx->names[i];
  507. int h = audit_hash_ino((u32)n->ino);
  508. struct list_head *list = &audit_inode_hash[h];
  509. if (list_empty(list))
  510. continue;
  511. list_for_each_entry_rcu(e, list, list) {
  512. if ((e->rule.mask[word] & bit) == bit &&
  513. audit_filter_rules(tsk, &e->rule, ctx, n, &state)) {
  514. rcu_read_unlock();
  515. return state;
  516. }
  517. }
  518. }
  519. rcu_read_unlock();
  520. return AUDIT_BUILD_CONTEXT;
  521. }
  522. void audit_set_auditable(struct audit_context *ctx)
  523. {
  524. ctx->auditable = 1;
  525. }
  526. static inline struct audit_context *audit_get_context(struct task_struct *tsk,
  527. int return_valid,
  528. int return_code)
  529. {
  530. struct audit_context *context = tsk->audit_context;
  531. if (likely(!context))
  532. return NULL;
  533. context->return_valid = return_valid;
  534. context->return_code = return_code;
  535. if (context->in_syscall && !context->dummy && !context->auditable) {
  536. enum audit_state state;
  537. state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
  538. if (state == AUDIT_RECORD_CONTEXT) {
  539. context->auditable = 1;
  540. goto get_context;
  541. }
  542. state = audit_filter_inodes(tsk, context);
  543. if (state == AUDIT_RECORD_CONTEXT)
  544. context->auditable = 1;
  545. }
  546. get_context:
  547. tsk->audit_context = NULL;
  548. return context;
  549. }
  550. static inline void audit_free_names(struct audit_context *context)
  551. {
  552. int i;
  553. #if AUDIT_DEBUG == 2
  554. if (context->auditable
  555. ||context->put_count + context->ino_count != context->name_count) {
  556. printk(KERN_ERR "%s:%d(:%d): major=%d in_syscall=%d"
  557. " name_count=%d put_count=%d"
  558. " ino_count=%d [NOT freeing]\n",
  559. __FILE__, __LINE__,
  560. context->serial, context->major, context->in_syscall,
  561. context->name_count, context->put_count,
  562. context->ino_count);
  563. for (i = 0; i < context->name_count; i++) {
  564. printk(KERN_ERR "names[%d] = %p = %s\n", i,
  565. context->names[i].name,
  566. context->names[i].name ?: "(null)");
  567. }
  568. dump_stack();
  569. return;
  570. }
  571. #endif
  572. #if AUDIT_DEBUG
  573. context->put_count = 0;
  574. context->ino_count = 0;
  575. #endif
  576. for (i = 0; i < context->name_count; i++) {
  577. if (context->names[i].name && context->names[i].name_put)
  578. __putname(context->names[i].name);
  579. }
  580. context->name_count = 0;
  581. if (context->pwd)
  582. dput(context->pwd);
  583. if (context->pwdmnt)
  584. mntput(context->pwdmnt);
  585. context->pwd = NULL;
  586. context->pwdmnt = NULL;
  587. }
  588. static inline void audit_free_aux(struct audit_context *context)
  589. {
  590. struct audit_aux_data *aux;
  591. while ((aux = context->aux)) {
  592. if (aux->type == AUDIT_AVC_PATH) {
  593. struct audit_aux_data_path *axi = (void *)aux;
  594. dput(axi->dentry);
  595. mntput(axi->mnt);
  596. }
  597. context->aux = aux->next;
  598. kfree(aux);
  599. }
  600. }
  601. static inline void audit_zero_context(struct audit_context *context,
  602. enum audit_state state)
  603. {
  604. uid_t loginuid = context->loginuid;
  605. memset(context, 0, sizeof(*context));
  606. context->state = state;
  607. context->loginuid = loginuid;
  608. }
  609. static inline struct audit_context *audit_alloc_context(enum audit_state state)
  610. {
  611. struct audit_context *context;
  612. if (!(context = kmalloc(sizeof(*context), GFP_KERNEL)))
  613. return NULL;
  614. audit_zero_context(context, state);
  615. return context;
  616. }
  617. /**
  618. * audit_alloc - allocate an audit context block for a task
  619. * @tsk: task
  620. *
  621. * Filter on the task information and allocate a per-task audit context
  622. * if necessary. Doing so turns on system call auditing for the
  623. * specified task. This is called from copy_process, so no lock is
  624. * needed.
  625. */
  626. int audit_alloc(struct task_struct *tsk)
  627. {
  628. struct audit_context *context;
  629. enum audit_state state;
  630. if (likely(!audit_enabled))
  631. return 0; /* Return if not auditing. */
  632. state = audit_filter_task(tsk);
  633. if (likely(state == AUDIT_DISABLED))
  634. return 0;
  635. if (!(context = audit_alloc_context(state))) {
  636. audit_log_lost("out of memory in audit_alloc");
  637. return -ENOMEM;
  638. }
  639. /* Preserve login uid */
  640. context->loginuid = -1;
  641. if (current->audit_context)
  642. context->loginuid = current->audit_context->loginuid;
  643. tsk->audit_context = context;
  644. set_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
  645. return 0;
  646. }
  647. static inline void audit_free_context(struct audit_context *context)
  648. {
  649. struct audit_context *previous;
  650. int count = 0;
  651. do {
  652. previous = context->previous;
  653. if (previous || (count && count < 10)) {
  654. ++count;
  655. printk(KERN_ERR "audit(:%d): major=%d name_count=%d:"
  656. " freeing multiple contexts (%d)\n",
  657. context->serial, context->major,
  658. context->name_count, count);
  659. }
  660. audit_free_names(context);
  661. audit_free_aux(context);
  662. kfree(context->filterkey);
  663. kfree(context);
  664. context = previous;
  665. } while (context);
  666. if (count >= 10)
  667. printk(KERN_ERR "audit: freed %d contexts\n", count);
  668. }
  669. void audit_log_task_context(struct audit_buffer *ab)
  670. {
  671. char *ctx = NULL;
  672. unsigned len;
  673. int error;
  674. u32 sid;
  675. selinux_get_task_sid(current, &sid);
  676. if (!sid)
  677. return;
  678. error = selinux_sid_to_string(sid, &ctx, &len);
  679. if (error) {
  680. if (error != -EINVAL)
  681. goto error_path;
  682. return;
  683. }
  684. audit_log_format(ab, " subj=%s", ctx);
  685. kfree(ctx);
  686. return;
  687. error_path:
  688. audit_panic("error in audit_log_task_context");
  689. return;
  690. }
  691. EXPORT_SYMBOL(audit_log_task_context);
  692. static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
  693. {
  694. char name[sizeof(tsk->comm)];
  695. struct mm_struct *mm = tsk->mm;
  696. struct vm_area_struct *vma;
  697. /* tsk == current */
  698. get_task_comm(name, tsk);
  699. audit_log_format(ab, " comm=");
  700. audit_log_untrustedstring(ab, name);
  701. if (mm) {
  702. down_read(&mm->mmap_sem);
  703. vma = mm->mmap;
  704. while (vma) {
  705. if ((vma->vm_flags & VM_EXECUTABLE) &&
  706. vma->vm_file) {
  707. audit_log_d_path(ab, "exe=",
  708. vma->vm_file->f_path.dentry,
  709. vma->vm_file->f_path.mnt);
  710. break;
  711. }
  712. vma = vma->vm_next;
  713. }
  714. up_read(&mm->mmap_sem);
  715. }
  716. audit_log_task_context(ab);
  717. }
  718. static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)
  719. {
  720. int i, call_panic = 0;
  721. struct audit_buffer *ab;
  722. struct audit_aux_data *aux;
  723. const char *tty;
  724. /* tsk == current */
  725. context->pid = tsk->pid;
  726. if (!context->ppid)
  727. context->ppid = sys_getppid();
  728. context->uid = tsk->uid;
  729. context->gid = tsk->gid;
  730. context->euid = tsk->euid;
  731. context->suid = tsk->suid;
  732. context->fsuid = tsk->fsuid;
  733. context->egid = tsk->egid;
  734. context->sgid = tsk->sgid;
  735. context->fsgid = tsk->fsgid;
  736. context->personality = tsk->personality;
  737. ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
  738. if (!ab)
  739. return; /* audit_panic has been called */
  740. audit_log_format(ab, "arch=%x syscall=%d",
  741. context->arch, context->major);
  742. if (context->personality != PER_LINUX)
  743. audit_log_format(ab, " per=%lx", context->personality);
  744. if (context->return_valid)
  745. audit_log_format(ab, " success=%s exit=%ld",
  746. (context->return_valid==AUDITSC_SUCCESS)?"yes":"no",
  747. context->return_code);
  748. mutex_lock(&tty_mutex);
  749. read_lock(&tasklist_lock);
  750. if (tsk->signal && tsk->signal->tty && tsk->signal->tty->name)
  751. tty = tsk->signal->tty->name;
  752. else
  753. tty = "(none)";
  754. read_unlock(&tasklist_lock);
  755. audit_log_format(ab,
  756. " a0=%lx a1=%lx a2=%lx a3=%lx items=%d"
  757. " ppid=%d pid=%d auid=%u uid=%u gid=%u"
  758. " euid=%u suid=%u fsuid=%u"
  759. " egid=%u sgid=%u fsgid=%u tty=%s",
  760. context->argv[0],
  761. context->argv[1],
  762. context->argv[2],
  763. context->argv[3],
  764. context->name_count,
  765. context->ppid,
  766. context->pid,
  767. context->loginuid,
  768. context->uid,
  769. context->gid,
  770. context->euid, context->suid, context->fsuid,
  771. context->egid, context->sgid, context->fsgid, tty);
  772. mutex_unlock(&tty_mutex);
  773. audit_log_task_info(ab, tsk);
  774. if (context->filterkey) {
  775. audit_log_format(ab, " key=");
  776. audit_log_untrustedstring(ab, context->filterkey);
  777. } else
  778. audit_log_format(ab, " key=(null)");
  779. audit_log_end(ab);
  780. for (aux = context->aux; aux; aux = aux->next) {
  781. ab = audit_log_start(context, GFP_KERNEL, aux->type);
  782. if (!ab)
  783. continue; /* audit_panic has been called */
  784. switch (aux->type) {
  785. case AUDIT_MQ_OPEN: {
  786. struct audit_aux_data_mq_open *axi = (void *)aux;
  787. audit_log_format(ab,
  788. "oflag=0x%x mode=%#o mq_flags=0x%lx mq_maxmsg=%ld "
  789. "mq_msgsize=%ld mq_curmsgs=%ld",
  790. axi->oflag, axi->mode, axi->attr.mq_flags,
  791. axi->attr.mq_maxmsg, axi->attr.mq_msgsize,
  792. axi->attr.mq_curmsgs);
  793. break; }
  794. case AUDIT_MQ_SENDRECV: {
  795. struct audit_aux_data_mq_sendrecv *axi = (void *)aux;
  796. audit_log_format(ab,
  797. "mqdes=%d msg_len=%zd msg_prio=%u "
  798. "abs_timeout_sec=%ld abs_timeout_nsec=%ld",
  799. axi->mqdes, axi->msg_len, axi->msg_prio,
  800. axi->abs_timeout.tv_sec, axi->abs_timeout.tv_nsec);
  801. break; }
  802. case AUDIT_MQ_NOTIFY: {
  803. struct audit_aux_data_mq_notify *axi = (void *)aux;
  804. audit_log_format(ab,
  805. "mqdes=%d sigev_signo=%d",
  806. axi->mqdes,
  807. axi->notification.sigev_signo);
  808. break; }
  809. case AUDIT_MQ_GETSETATTR: {
  810. struct audit_aux_data_mq_getsetattr *axi = (void *)aux;
  811. audit_log_format(ab,
  812. "mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
  813. "mq_curmsgs=%ld ",
  814. axi->mqdes,
  815. axi->mqstat.mq_flags, axi->mqstat.mq_maxmsg,
  816. axi->mqstat.mq_msgsize, axi->mqstat.mq_curmsgs);
  817. break; }
  818. case AUDIT_IPC: {
  819. struct audit_aux_data_ipcctl *axi = (void *)aux;
  820. audit_log_format(ab,
  821. "ouid=%u ogid=%u mode=%x",
  822. axi->uid, axi->gid, axi->mode);
  823. if (axi->osid != 0) {
  824. char *ctx = NULL;
  825. u32 len;
  826. if (selinux_sid_to_string(
  827. axi->osid, &ctx, &len)) {
  828. audit_log_format(ab, " osid=%u",
  829. axi->osid);
  830. call_panic = 1;
  831. } else
  832. audit_log_format(ab, " obj=%s", ctx);
  833. kfree(ctx);
  834. }
  835. break; }
  836. case AUDIT_IPC_SET_PERM: {
  837. struct audit_aux_data_ipcctl *axi = (void *)aux;
  838. audit_log_format(ab,
  839. "qbytes=%lx ouid=%u ogid=%u mode=%x",
  840. axi->qbytes, axi->uid, axi->gid, axi->mode);
  841. break; }
  842. case AUDIT_EXECVE: {
  843. struct audit_aux_data_execve *axi = (void *)aux;
  844. int i;
  845. const char *p;
  846. for (i = 0, p = axi->mem; i < axi->argc; i++) {
  847. audit_log_format(ab, "a%d=", i);
  848. p = audit_log_untrustedstring(ab, p);
  849. audit_log_format(ab, "\n");
  850. }
  851. break; }
  852. case AUDIT_SOCKETCALL: {
  853. int i;
  854. struct audit_aux_data_socketcall *axs = (void *)aux;
  855. audit_log_format(ab, "nargs=%d", axs->nargs);
  856. for (i=0; i<axs->nargs; i++)
  857. audit_log_format(ab, " a%d=%lx", i, axs->args[i]);
  858. break; }
  859. case AUDIT_SOCKADDR: {
  860. struct audit_aux_data_sockaddr *axs = (void *)aux;
  861. audit_log_format(ab, "saddr=");
  862. audit_log_hex(ab, axs->a, axs->len);
  863. break; }
  864. case AUDIT_AVC_PATH: {
  865. struct audit_aux_data_path *axi = (void *)aux;
  866. audit_log_d_path(ab, "path=", axi->dentry, axi->mnt);
  867. break; }
  868. case AUDIT_FD_PAIR: {
  869. struct audit_aux_data_fd_pair *axs = (void *)aux;
  870. audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]);
  871. break; }
  872. }
  873. audit_log_end(ab);
  874. }
  875. if (context->pwd && context->pwdmnt) {
  876. ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
  877. if (ab) {
  878. audit_log_d_path(ab, "cwd=", context->pwd, context->pwdmnt);
  879. audit_log_end(ab);
  880. }
  881. }
  882. for (i = 0; i < context->name_count; i++) {
  883. struct audit_names *n = &context->names[i];
  884. ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
  885. if (!ab)
  886. continue; /* audit_panic has been called */
  887. audit_log_format(ab, "item=%d", i);
  888. if (n->name) {
  889. switch(n->name_len) {
  890. case AUDIT_NAME_FULL:
  891. /* log the full path */
  892. audit_log_format(ab, " name=");
  893. audit_log_untrustedstring(ab, n->name);
  894. break;
  895. case 0:
  896. /* name was specified as a relative path and the
  897. * directory component is the cwd */
  898. audit_log_d_path(ab, " name=", context->pwd,
  899. context->pwdmnt);
  900. break;
  901. default:
  902. /* log the name's directory component */
  903. audit_log_format(ab, " name=");
  904. audit_log_n_untrustedstring(ab, n->name_len,
  905. n->name);
  906. }
  907. } else
  908. audit_log_format(ab, " name=(null)");
  909. if (n->ino != (unsigned long)-1) {
  910. audit_log_format(ab, " inode=%lu"
  911. " dev=%02x:%02x mode=%#o"
  912. " ouid=%u ogid=%u rdev=%02x:%02x",
  913. n->ino,
  914. MAJOR(n->dev),
  915. MINOR(n->dev),
  916. n->mode,
  917. n->uid,
  918. n->gid,
  919. MAJOR(n->rdev),
  920. MINOR(n->rdev));
  921. }
  922. if (n->osid != 0) {
  923. char *ctx = NULL;
  924. u32 len;
  925. if (selinux_sid_to_string(
  926. n->osid, &ctx, &len)) {
  927. audit_log_format(ab, " osid=%u", n->osid);
  928. call_panic = 2;
  929. } else
  930. audit_log_format(ab, " obj=%s", ctx);
  931. kfree(ctx);
  932. }
  933. audit_log_end(ab);
  934. }
  935. if (call_panic)
  936. audit_panic("error converting sid to string");
  937. }
  938. /**
  939. * audit_free - free a per-task audit context
  940. * @tsk: task whose audit context block to free
  941. *
  942. * Called from copy_process and do_exit
  943. */
  944. void audit_free(struct task_struct *tsk)
  945. {
  946. struct audit_context *context;
  947. context = audit_get_context(tsk, 0, 0);
  948. if (likely(!context))
  949. return;
  950. /* Check for system calls that do not go through the exit
  951. * function (e.g., exit_group), then free context block.
  952. * We use GFP_ATOMIC here because we might be doing this
  953. * in the context of the idle thread */
  954. /* that can happen only if we are called from do_exit() */
  955. if (context->in_syscall && context->auditable)
  956. audit_log_exit(context, tsk);
  957. audit_free_context(context);
  958. }
  959. /**
  960. * audit_syscall_entry - fill in an audit record at syscall entry
  961. * @tsk: task being audited
  962. * @arch: architecture type
  963. * @major: major syscall type (function)
  964. * @a1: additional syscall register 1
  965. * @a2: additional syscall register 2
  966. * @a3: additional syscall register 3
  967. * @a4: additional syscall register 4
  968. *
  969. * Fill in audit context at syscall entry. This only happens if the
  970. * audit context was created when the task was created and the state or
  971. * filters demand the audit context be built. If the state from the
  972. * per-task filter or from the per-syscall filter is AUDIT_RECORD_CONTEXT,
  973. * then the record will be written at syscall exit time (otherwise, it
  974. * will only be written if another part of the kernel requests that it
  975. * be written).
  976. */
  977. void audit_syscall_entry(int arch, int major,
  978. unsigned long a1, unsigned long a2,
  979. unsigned long a3, unsigned long a4)
  980. {
  981. struct task_struct *tsk = current;
  982. struct audit_context *context = tsk->audit_context;
  983. enum audit_state state;
  984. BUG_ON(!context);
  985. /*
  986. * This happens only on certain architectures that make system
  987. * calls in kernel_thread via the entry.S interface, instead of
  988. * with direct calls. (If you are porting to a new
  989. * architecture, hitting this condition can indicate that you
  990. * got the _exit/_leave calls backward in entry.S.)
  991. *
  992. * i386 no
  993. * x86_64 no
  994. * ppc64 yes (see arch/powerpc/platforms/iseries/misc.S)
  995. *
  996. * This also happens with vm86 emulation in a non-nested manner
  997. * (entries without exits), so this case must be caught.
  998. */
  999. if (context->in_syscall) {
  1000. struct audit_context *newctx;
  1001. #if AUDIT_DEBUG
  1002. printk(KERN_ERR
  1003. "audit(:%d) pid=%d in syscall=%d;"
  1004. " entering syscall=%d\n",
  1005. context->serial, tsk->pid, context->major, major);
  1006. #endif
  1007. newctx = audit_alloc_context(context->state);
  1008. if (newctx) {
  1009. newctx->previous = context;
  1010. context = newctx;
  1011. tsk->audit_context = newctx;
  1012. } else {
  1013. /* If we can't alloc a new context, the best we
  1014. * can do is to leak memory (any pending putname
  1015. * will be lost). The only other alternative is
  1016. * to abandon auditing. */
  1017. audit_zero_context(context, context->state);
  1018. }
  1019. }
  1020. BUG_ON(context->in_syscall || context->name_count);
  1021. if (!audit_enabled)
  1022. return;
  1023. context->arch = arch;
  1024. context->major = major;
  1025. context->argv[0] = a1;
  1026. context->argv[1] = a2;
  1027. context->argv[2] = a3;
  1028. context->argv[3] = a4;
  1029. state = context->state;
  1030. context->dummy = !audit_n_rules;
  1031. if (!context->dummy && (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT))
  1032. state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
  1033. if (likely(state == AUDIT_DISABLED))
  1034. return;
  1035. context->serial = 0;
  1036. context->ctime = CURRENT_TIME;
  1037. context->in_syscall = 1;
  1038. context->auditable = !!(state == AUDIT_RECORD_CONTEXT);
  1039. context->ppid = 0;
  1040. }
  1041. /**
  1042. * audit_syscall_exit - deallocate audit context after a system call
  1043. * @tsk: task being audited
  1044. * @valid: success/failure flag
  1045. * @return_code: syscall return value
  1046. *
  1047. * Tear down after system call. If the audit context has been marked as
  1048. * auditable (either because of the AUDIT_RECORD_CONTEXT state from
  1049. * filtering, or because some other part of the kernel write an audit
  1050. * message), then write out the syscall information. In call cases,
  1051. * free the names stored from getname().
  1052. */
  1053. void audit_syscall_exit(int valid, long return_code)
  1054. {
  1055. struct task_struct *tsk = current;
  1056. struct audit_context *context;
  1057. context = audit_get_context(tsk, valid, return_code);
  1058. if (likely(!context))
  1059. return;
  1060. if (context->in_syscall && context->auditable)
  1061. audit_log_exit(context, tsk);
  1062. context->in_syscall = 0;
  1063. context->auditable = 0;
  1064. if (context->previous) {
  1065. struct audit_context *new_context = context->previous;
  1066. context->previous = NULL;
  1067. audit_free_context(context);
  1068. tsk->audit_context = new_context;
  1069. } else {
  1070. audit_free_names(context);
  1071. audit_free_aux(context);
  1072. kfree(context->filterkey);
  1073. context->filterkey = NULL;
  1074. tsk->audit_context = context;
  1075. }
  1076. }
  1077. /**
  1078. * audit_getname - add a name to the list
  1079. * @name: name to add
  1080. *
  1081. * Add a name to the list of audit names for this context.
  1082. * Called from fs/namei.c:getname().
  1083. */
  1084. void __audit_getname(const char *name)
  1085. {
  1086. struct audit_context *context = current->audit_context;
  1087. if (IS_ERR(name) || !name)
  1088. return;
  1089. if (!context->in_syscall) {
  1090. #if AUDIT_DEBUG == 2
  1091. printk(KERN_ERR "%s:%d(:%d): ignoring getname(%p)\n",
  1092. __FILE__, __LINE__, context->serial, name);
  1093. dump_stack();
  1094. #endif
  1095. return;
  1096. }
  1097. BUG_ON(context->name_count >= AUDIT_NAMES);
  1098. context->names[context->name_count].name = name;
  1099. context->names[context->name_count].name_len = AUDIT_NAME_FULL;
  1100. context->names[context->name_count].name_put = 1;
  1101. context->names[context->name_count].ino = (unsigned long)-1;
  1102. ++context->name_count;
  1103. if (!context->pwd) {
  1104. read_lock(&current->fs->lock);
  1105. context->pwd = dget(current->fs->pwd);
  1106. context->pwdmnt = mntget(current->fs->pwdmnt);
  1107. read_unlock(&current->fs->lock);
  1108. }
  1109. }
  1110. /* audit_putname - intercept a putname request
  1111. * @name: name to intercept and delay for putname
  1112. *
  1113. * If we have stored the name from getname in the audit context,
  1114. * then we delay the putname until syscall exit.
  1115. * Called from include/linux/fs.h:putname().
  1116. */
  1117. void audit_putname(const char *name)
  1118. {
  1119. struct audit_context *context = current->audit_context;
  1120. BUG_ON(!context);
  1121. if (!context->in_syscall) {
  1122. #if AUDIT_DEBUG == 2
  1123. printk(KERN_ERR "%s:%d(:%d): __putname(%p)\n",
  1124. __FILE__, __LINE__, context->serial, name);
  1125. if (context->name_count) {
  1126. int i;
  1127. for (i = 0; i < context->name_count; i++)
  1128. printk(KERN_ERR "name[%d] = %p = %s\n", i,
  1129. context->names[i].name,
  1130. context->names[i].name ?: "(null)");
  1131. }
  1132. #endif
  1133. __putname(name);
  1134. }
  1135. #if AUDIT_DEBUG
  1136. else {
  1137. ++context->put_count;
  1138. if (context->put_count > context->name_count) {
  1139. printk(KERN_ERR "%s:%d(:%d): major=%d"
  1140. " in_syscall=%d putname(%p) name_count=%d"
  1141. " put_count=%d\n",
  1142. __FILE__, __LINE__,
  1143. context->serial, context->major,
  1144. context->in_syscall, name, context->name_count,
  1145. context->put_count);
  1146. dump_stack();
  1147. }
  1148. }
  1149. #endif
  1150. }
  1151. /* Copy inode data into an audit_names. */
  1152. static void audit_copy_inode(struct audit_names *name, const struct inode *inode)
  1153. {
  1154. name->ino = inode->i_ino;
  1155. name->dev = inode->i_sb->s_dev;
  1156. name->mode = inode->i_mode;
  1157. name->uid = inode->i_uid;
  1158. name->gid = inode->i_gid;
  1159. name->rdev = inode->i_rdev;
  1160. selinux_get_inode_sid(inode, &name->osid);
  1161. }
  1162. /**
  1163. * audit_inode - store the inode and device from a lookup
  1164. * @name: name being audited
  1165. * @inode: inode being audited
  1166. *
  1167. * Called from fs/namei.c:path_lookup().
  1168. */
  1169. void __audit_inode(const char *name, const struct inode *inode)
  1170. {
  1171. int idx;
  1172. struct audit_context *context = current->audit_context;
  1173. if (!context->in_syscall)
  1174. return;
  1175. if (context->name_count
  1176. && context->names[context->name_count-1].name
  1177. && context->names[context->name_count-1].name == name)
  1178. idx = context->name_count - 1;
  1179. else if (context->name_count > 1
  1180. && context->names[context->name_count-2].name
  1181. && context->names[context->name_count-2].name == name)
  1182. idx = context->name_count - 2;
  1183. else {
  1184. /* FIXME: how much do we care about inodes that have no
  1185. * associated name? */
  1186. if (context->name_count >= AUDIT_NAMES - AUDIT_NAMES_RESERVED)
  1187. return;
  1188. idx = context->name_count++;
  1189. context->names[idx].name = NULL;
  1190. #if AUDIT_DEBUG
  1191. ++context->ino_count;
  1192. #endif
  1193. }
  1194. audit_copy_inode(&context->names[idx], inode);
  1195. }
  1196. /**
  1197. * audit_inode_child - collect inode info for created/removed objects
  1198. * @dname: inode's dentry name
  1199. * @inode: inode being audited
  1200. * @parent: inode of dentry parent
  1201. *
  1202. * For syscalls that create or remove filesystem objects, audit_inode
  1203. * can only collect information for the filesystem object's parent.
  1204. * This call updates the audit context with the child's information.
  1205. * Syscalls that create a new filesystem object must be hooked after
  1206. * the object is created. Syscalls that remove a filesystem object
  1207. * must be hooked prior, in order to capture the target inode during
  1208. * unsuccessful attempts.
  1209. */
  1210. void __audit_inode_child(const char *dname, const struct inode *inode,
  1211. const struct inode *parent)
  1212. {
  1213. int idx;
  1214. struct audit_context *context = current->audit_context;
  1215. const char *found_name = NULL;
  1216. int dirlen = 0;
  1217. if (!context->in_syscall)
  1218. return;
  1219. /* determine matching parent */
  1220. if (!dname)
  1221. goto update_context;
  1222. for (idx = 0; idx < context->name_count; idx++)
  1223. if (context->names[idx].ino == parent->i_ino) {
  1224. const char *name = context->names[idx].name;
  1225. if (!name)
  1226. continue;
  1227. if (audit_compare_dname_path(dname, name, &dirlen) == 0) {
  1228. context->names[idx].name_len = dirlen;
  1229. found_name = name;
  1230. break;
  1231. }
  1232. }
  1233. update_context:
  1234. idx = context->name_count;
  1235. if (context->name_count == AUDIT_NAMES) {
  1236. printk(KERN_DEBUG "name_count maxed and losing %s\n",
  1237. found_name ?: "(null)");
  1238. return;
  1239. }
  1240. context->name_count++;
  1241. #if AUDIT_DEBUG
  1242. context->ino_count++;
  1243. #endif
  1244. /* Re-use the name belonging to the slot for a matching parent directory.
  1245. * All names for this context are relinquished in audit_free_names() */
  1246. context->names[idx].name = found_name;
  1247. context->names[idx].name_len = AUDIT_NAME_FULL;
  1248. context->names[idx].name_put = 0; /* don't call __putname() */
  1249. if (!inode)
  1250. context->names[idx].ino = (unsigned long)-1;
  1251. else
  1252. audit_copy_inode(&context->names[idx], inode);
  1253. /* A parent was not found in audit_names, so copy the inode data for the
  1254. * provided parent. */
  1255. if (!found_name) {
  1256. idx = context->name_count;
  1257. if (context->name_count == AUDIT_NAMES) {
  1258. printk(KERN_DEBUG
  1259. "name_count maxed and losing parent inode data: dev=%02x:%02x, inode=%lu",
  1260. MAJOR(parent->i_sb->s_dev),
  1261. MINOR(parent->i_sb->s_dev),
  1262. parent->i_ino);
  1263. return;
  1264. }
  1265. context->name_count++;
  1266. #if AUDIT_DEBUG
  1267. context->ino_count++;
  1268. #endif
  1269. audit_copy_inode(&context->names[idx], parent);
  1270. }
  1271. }
  1272. /**
  1273. * audit_inode_update - update inode info for last collected name
  1274. * @inode: inode being audited
  1275. *
  1276. * When open() is called on an existing object with the O_CREAT flag, the inode
  1277. * data audit initially collects is incorrect. This additional hook ensures
  1278. * audit has the inode data for the actual object to be opened.
  1279. */
  1280. void __audit_inode_update(const struct inode *inode)
  1281. {
  1282. struct audit_context *context = current->audit_context;
  1283. int idx;
  1284. if (!context->in_syscall || !inode)
  1285. return;
  1286. if (context->name_count == 0) {
  1287. context->name_count++;
  1288. #if AUDIT_DEBUG
  1289. context->ino_count++;
  1290. #endif
  1291. }
  1292. idx = context->name_count - 1;
  1293. audit_copy_inode(&context->names[idx], inode);
  1294. }
  1295. /**
  1296. * auditsc_get_stamp - get local copies of audit_context values
  1297. * @ctx: audit_context for the task
  1298. * @t: timespec to store time recorded in the audit_context
  1299. * @serial: serial value that is recorded in the audit_context
  1300. *
  1301. * Also sets the context as auditable.
  1302. */
  1303. void auditsc_get_stamp(struct audit_context *ctx,
  1304. struct timespec *t, unsigned int *serial)
  1305. {
  1306. if (!ctx->serial)
  1307. ctx->serial = audit_serial();
  1308. t->tv_sec = ctx->ctime.tv_sec;
  1309. t->tv_nsec = ctx->ctime.tv_nsec;
  1310. *serial = ctx->serial;
  1311. ctx->auditable = 1;
  1312. }
  1313. /**
  1314. * audit_set_loginuid - set a task's audit_context loginuid
  1315. * @task: task whose audit context is being modified
  1316. * @loginuid: loginuid value
  1317. *
  1318. * Returns 0.
  1319. *
  1320. * Called (set) from fs/proc/base.c::proc_loginuid_write().
  1321. */
  1322. int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
  1323. {
  1324. struct audit_context *context = task->audit_context;
  1325. if (context) {
  1326. /* Only log if audit is enabled */
  1327. if (context->in_syscall) {
  1328. struct audit_buffer *ab;
  1329. ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
  1330. if (ab) {
  1331. audit_log_format(ab, "login pid=%d uid=%u "
  1332. "old auid=%u new auid=%u",
  1333. task->pid, task->uid,
  1334. context->loginuid, loginuid);
  1335. audit_log_end(ab);
  1336. }
  1337. }
  1338. context->loginuid = loginuid;
  1339. }
  1340. return 0;
  1341. }
  1342. /**
  1343. * audit_get_loginuid - get the loginuid for an audit_context
  1344. * @ctx: the audit_context
  1345. *
  1346. * Returns the context's loginuid or -1 if @ctx is NULL.
  1347. */
  1348. uid_t audit_get_loginuid(struct audit_context *ctx)
  1349. {
  1350. return ctx ? ctx->loginuid : -1;
  1351. }
  1352. EXPORT_SYMBOL(audit_get_loginuid);
  1353. /**
  1354. * __audit_mq_open - record audit data for a POSIX MQ open
  1355. * @oflag: open flag
  1356. * @mode: mode bits
  1357. * @u_attr: queue attributes
  1358. *
  1359. * Returns 0 for success or NULL context or < 0 on error.
  1360. */
  1361. int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr)
  1362. {
  1363. struct audit_aux_data_mq_open *ax;
  1364. struct audit_context *context = current->audit_context;
  1365. if (!audit_enabled)
  1366. return 0;
  1367. if (likely(!context))
  1368. return 0;
  1369. ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
  1370. if (!ax)
  1371. return -ENOMEM;
  1372. if (u_attr != NULL) {
  1373. if (copy_from_user(&ax->attr, u_attr, sizeof(ax->attr))) {
  1374. kfree(ax);
  1375. return -EFAULT;
  1376. }
  1377. } else
  1378. memset(&ax->attr, 0, sizeof(ax->attr));
  1379. ax->oflag = oflag;
  1380. ax->mode = mode;
  1381. ax->d.type = AUDIT_MQ_OPEN;
  1382. ax->d.next = context->aux;
  1383. context->aux = (void *)ax;
  1384. return 0;
  1385. }
  1386. /**
  1387. * __audit_mq_timedsend - record audit data for a POSIX MQ timed send
  1388. * @mqdes: MQ descriptor
  1389. * @msg_len: Message length
  1390. * @msg_prio: Message priority
  1391. * @u_abs_timeout: Message timeout in absolute time
  1392. *
  1393. * Returns 0 for success or NULL context or < 0 on error.
  1394. */
  1395. int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio,
  1396. const struct timespec __user *u_abs_timeout)
  1397. {
  1398. struct audit_aux_data_mq_sendrecv *ax;
  1399. struct audit_context *context = current->audit_context;
  1400. if (!audit_enabled)
  1401. return 0;
  1402. if (likely(!context))
  1403. return 0;
  1404. ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
  1405. if (!ax)
  1406. return -ENOMEM;
  1407. if (u_abs_timeout != NULL) {
  1408. if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) {
  1409. kfree(ax);
  1410. return -EFAULT;
  1411. }
  1412. } else
  1413. memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout));
  1414. ax->mqdes = mqdes;
  1415. ax->msg_len = msg_len;
  1416. ax->msg_prio = msg_prio;
  1417. ax->d.type = AUDIT_MQ_SENDRECV;
  1418. ax->d.next = context->aux;
  1419. context->aux = (void *)ax;
  1420. return 0;
  1421. }
  1422. /**
  1423. * __audit_mq_timedreceive - record audit data for a POSIX MQ timed receive
  1424. * @mqdes: MQ descriptor
  1425. * @msg_len: Message length
  1426. * @u_msg_prio: Message priority
  1427. * @u_abs_timeout: Message timeout in absolute time
  1428. *
  1429. * Returns 0 for success or NULL context or < 0 on error.
  1430. */
  1431. int __audit_mq_timedreceive(mqd_t mqdes, size_t msg_len,
  1432. unsigned int __user *u_msg_prio,
  1433. const struct timespec __user *u_abs_timeout)
  1434. {
  1435. struct audit_aux_data_mq_sendrecv *ax;
  1436. struct audit_context *context = current->audit_context;
  1437. if (!audit_enabled)
  1438. return 0;
  1439. if (likely(!context))
  1440. return 0;
  1441. ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
  1442. if (!ax)
  1443. return -ENOMEM;
  1444. if (u_msg_prio != NULL) {
  1445. if (get_user(ax->msg_prio, u_msg_prio)) {
  1446. kfree(ax);
  1447. return -EFAULT;
  1448. }
  1449. } else
  1450. ax->msg_prio = 0;
  1451. if (u_abs_timeout != NULL) {
  1452. if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) {
  1453. kfree(ax);
  1454. return -EFAULT;
  1455. }
  1456. } else
  1457. memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout));
  1458. ax->mqdes = mqdes;
  1459. ax->msg_len = msg_len;
  1460. ax->d.type = AUDIT_MQ_SENDRECV;
  1461. ax->d.next = context->aux;
  1462. context->aux = (void *)ax;
  1463. return 0;
  1464. }
  1465. /**
  1466. * __audit_mq_notify - record audit data for a POSIX MQ notify
  1467. * @mqdes: MQ descriptor
  1468. * @u_notification: Notification event
  1469. *
  1470. * Returns 0 for success or NULL context or < 0 on error.
  1471. */
  1472. int __audit_mq_notify(mqd_t mqdes, const struct sigevent __user *u_notification)
  1473. {
  1474. struct audit_aux_data_mq_notify *ax;
  1475. struct audit_context *context = current->audit_context;
  1476. if (!audit_enabled)
  1477. return 0;
  1478. if (likely(!context))
  1479. return 0;
  1480. ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
  1481. if (!ax)
  1482. return -ENOMEM;
  1483. if (u_notification != NULL) {
  1484. if (copy_from_user(&ax->notification, u_notification, sizeof(ax->notification))) {
  1485. kfree(ax);
  1486. return -EFAULT;
  1487. }
  1488. } else
  1489. memset(&ax->notification, 0, sizeof(ax->notification));
  1490. ax->mqdes = mqdes;
  1491. ax->d.type = AUDIT_MQ_NOTIFY;
  1492. ax->d.next = context->aux;
  1493. context->aux = (void *)ax;
  1494. return 0;
  1495. }
  1496. /**
  1497. * __audit_mq_getsetattr - record audit data for a POSIX MQ get/set attribute
  1498. * @mqdes: MQ descriptor
  1499. * @mqstat: MQ flags
  1500. *
  1501. * Returns 0 for success or NULL context or < 0 on error.
  1502. */
  1503. int __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
  1504. {
  1505. struct audit_aux_data_mq_getsetattr *ax;
  1506. struct audit_context *context = current->audit_context;
  1507. if (!audit_enabled)
  1508. return 0;
  1509. if (likely(!context))
  1510. return 0;
  1511. ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
  1512. if (!ax)
  1513. return -ENOMEM;
  1514. ax->mqdes = mqdes;
  1515. ax->mqstat = *mqstat;
  1516. ax->d.type = AUDIT_MQ_GETSETATTR;
  1517. ax->d.next = context->aux;
  1518. context->aux = (void *)ax;
  1519. return 0;
  1520. }
  1521. /**
  1522. * audit_ipc_obj - record audit data for ipc object
  1523. * @ipcp: ipc permissions
  1524. *
  1525. * Returns 0 for success or NULL context or < 0 on error.
  1526. */
  1527. int __audit_ipc_obj(struct kern_ipc_perm *ipcp)
  1528. {
  1529. struct audit_aux_data_ipcctl *ax;
  1530. struct audit_context *context = current->audit_context;
  1531. ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
  1532. if (!ax)
  1533. return -ENOMEM;
  1534. ax->uid = ipcp->uid;
  1535. ax->gid = ipcp->gid;
  1536. ax->mode = ipcp->mode;
  1537. selinux_get_ipc_sid(ipcp, &ax->osid);
  1538. ax->d.type = AUDIT_IPC;
  1539. ax->d.next = context->aux;
  1540. context->aux = (void *)ax;
  1541. return 0;
  1542. }
  1543. /**
  1544. * audit_ipc_set_perm - record audit data for new ipc permissions
  1545. * @qbytes: msgq bytes
  1546. * @uid: msgq user id
  1547. * @gid: msgq group id
  1548. * @mode: msgq mode (permissions)
  1549. *
  1550. * Returns 0 for success or NULL context or < 0 on error.
  1551. */
  1552. int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode)
  1553. {
  1554. struct audit_aux_data_ipcctl *ax;
  1555. struct audit_context *context = current->audit_context;
  1556. ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
  1557. if (!ax)
  1558. return -ENOMEM;
  1559. ax->qbytes = qbytes;
  1560. ax->uid = uid;
  1561. ax->gid = gid;
  1562. ax->mode = mode;
  1563. ax->d.type = AUDIT_IPC_SET_PERM;
  1564. ax->d.next = context->aux;
  1565. context->aux = (void *)ax;
  1566. return 0;
  1567. }
  1568. int audit_bprm(struct linux_binprm *bprm)
  1569. {
  1570. struct audit_aux_data_execve *ax;
  1571. struct audit_context *context = current->audit_context;
  1572. unsigned long p, next;
  1573. void *to;
  1574. if (likely(!audit_enabled || !context || context->dummy))
  1575. return 0;
  1576. ax = kmalloc(sizeof(*ax) + PAGE_SIZE * MAX_ARG_PAGES - bprm->p,
  1577. GFP_KERNEL);
  1578. if (!ax)
  1579. return -ENOMEM;
  1580. ax->argc = bprm->argc;
  1581. ax->envc = bprm->envc;
  1582. for (p = bprm->p, to = ax->mem; p < MAX_ARG_PAGES*PAGE_SIZE; p = next) {
  1583. struct page *page = bprm->page[p / PAGE_SIZE];
  1584. void *kaddr = kmap(page);
  1585. next = (p + PAGE_SIZE) & ~(PAGE_SIZE - 1);
  1586. memcpy(to, kaddr + (p & (PAGE_SIZE - 1)), next - p);
  1587. to += next - p;
  1588. kunmap(page);
  1589. }
  1590. ax->d.type = AUDIT_EXECVE;
  1591. ax->d.next = context->aux;
  1592. context->aux = (void *)ax;
  1593. return 0;
  1594. }
  1595. /**
  1596. * audit_socketcall - record audit data for sys_socketcall
  1597. * @nargs: number of args
  1598. * @args: args array
  1599. *
  1600. * Returns 0 for success or NULL context or < 0 on error.
  1601. */
  1602. int audit_socketcall(int nargs, unsigned long *args)
  1603. {
  1604. struct audit_aux_data_socketcall *ax;
  1605. struct audit_context *context = current->audit_context;
  1606. if (likely(!context || context->dummy))
  1607. return 0;
  1608. ax = kmalloc(sizeof(*ax) + nargs * sizeof(unsigned long), GFP_KERNEL);
  1609. if (!ax)
  1610. return -ENOMEM;
  1611. ax->nargs = nargs;
  1612. memcpy(ax->args, args, nargs * sizeof(unsigned long));
  1613. ax->d.type = AUDIT_SOCKETCALL;
  1614. ax->d.next = context->aux;
  1615. context->aux = (void *)ax;
  1616. return 0;
  1617. }
  1618. /**
  1619. * __audit_fd_pair - record audit data for pipe and socketpair
  1620. * @fd1: the first file descriptor
  1621. * @fd2: the second file descriptor
  1622. *
  1623. * Returns 0 for success or NULL context or < 0 on error.
  1624. */
  1625. int __audit_fd_pair(int fd1, int fd2)
  1626. {
  1627. struct audit_context *context = current->audit_context;
  1628. struct audit_aux_data_fd_pair *ax;
  1629. if (likely(!context)) {
  1630. return 0;
  1631. }
  1632. ax = kmalloc(sizeof(*ax), GFP_KERNEL);
  1633. if (!ax) {
  1634. return -ENOMEM;
  1635. }
  1636. ax->fd[0] = fd1;
  1637. ax->fd[1] = fd2;
  1638. ax->d.type = AUDIT_FD_PAIR;
  1639. ax->d.next = context->aux;
  1640. context->aux = (void *)ax;
  1641. return 0;
  1642. }
  1643. /**
  1644. * audit_sockaddr - record audit data for sys_bind, sys_connect, sys_sendto
  1645. * @len: data length in user space
  1646. * @a: data address in kernel space
  1647. *
  1648. * Returns 0 for success or NULL context or < 0 on error.
  1649. */
  1650. int audit_sockaddr(int len, void *a)
  1651. {
  1652. struct audit_aux_data_sockaddr *ax;
  1653. struct audit_context *context = current->audit_context;
  1654. if (likely(!context || context->dummy))
  1655. return 0;
  1656. ax = kmalloc(sizeof(*ax) + len, GFP_KERNEL);
  1657. if (!ax)
  1658. return -ENOMEM;
  1659. ax->len = len;
  1660. memcpy(ax->a, a, len);
  1661. ax->d.type = AUDIT_SOCKADDR;
  1662. ax->d.next = context->aux;
  1663. context->aux = (void *)ax;
  1664. return 0;
  1665. }
  1666. /**
  1667. * audit_avc_path - record the granting or denial of permissions
  1668. * @dentry: dentry to record
  1669. * @mnt: mnt to record
  1670. *
  1671. * Returns 0 for success or NULL context or < 0 on error.
  1672. *
  1673. * Called from security/selinux/avc.c::avc_audit()
  1674. */
  1675. int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt)
  1676. {
  1677. struct audit_aux_data_path *ax;
  1678. struct audit_context *context = current->audit_context;
  1679. if (likely(!context))
  1680. return 0;
  1681. ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
  1682. if (!ax)
  1683. return -ENOMEM;
  1684. ax->dentry = dget(dentry);
  1685. ax->mnt = mntget(mnt);
  1686. ax->d.type = AUDIT_AVC_PATH;
  1687. ax->d.next = context->aux;
  1688. context->aux = (void *)ax;
  1689. return 0;
  1690. }
  1691. /**
  1692. * audit_signal_info - record signal info for shutting down audit subsystem
  1693. * @sig: signal value
  1694. * @t: task being signaled
  1695. *
  1696. * If the audit subsystem is being terminated, record the task (pid)
  1697. * and uid that is doing that.
  1698. */
  1699. void __audit_signal_info(int sig, struct task_struct *t)
  1700. {
  1701. extern pid_t audit_sig_pid;
  1702. extern uid_t audit_sig_uid;
  1703. extern u32 audit_sig_sid;
  1704. if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1) {
  1705. struct task_struct *tsk = current;
  1706. struct audit_context *ctx = tsk->audit_context;
  1707. audit_sig_pid = tsk->pid;
  1708. if (ctx)
  1709. audit_sig_uid = ctx->loginuid;
  1710. else
  1711. audit_sig_uid = tsk->uid;
  1712. selinux_get_task_sid(tsk, &audit_sig_sid);
  1713. }
  1714. }