audit.c 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * AppArmor security module
  4. *
  5. * This file contains AppArmor auditing functions
  6. *
  7. * Copyright (C) 1998-2008 Novell/SUSE
  8. * Copyright 2009-2010 Canonical Ltd.
  9. */
  10. #include <linux/audit.h>
  11. #include <linux/socket.h>
  12. #include "include/apparmor.h"
  13. #include "include/audit.h"
  14. #include "include/policy.h"
  15. #include "include/policy_ns.h"
  16. #include "include/secid.h"
  17. const char *const audit_mode_names[] = {
  18. "normal",
  19. "quiet_denied",
  20. "quiet",
  21. "noquiet",
  22. "all"
  23. };
  24. static const char *const aa_audit_type[] = {
  25. "AUDIT",
  26. "ALLOWED",
  27. "DENIED",
  28. "HINT",
  29. "STATUS",
  30. "ERROR",
  31. "KILLED",
  32. "AUTO"
  33. };
  34. /*
  35. * Currently AppArmor auditing is fed straight into the audit framework.
  36. *
  37. * TODO:
  38. * netlink interface for complain mode
  39. * user auditing, - send user auditing to netlink interface
  40. * system control of whether user audit messages go to system log
  41. */
  42. /**
  43. * audit_base - core AppArmor function.
  44. * @ab: audit buffer to fill (NOT NULL)
  45. * @ca: audit structure containing data to audit (NOT NULL)
  46. *
  47. * Record common AppArmor audit data from @sa
  48. */
  49. static void audit_pre(struct audit_buffer *ab, void *ca)
  50. {
  51. struct common_audit_data *sa = ca;
  52. if (aa_g_audit_header) {
  53. audit_log_format(ab, "apparmor=\"%s\"",
  54. aa_audit_type[aad(sa)->type]);
  55. }
  56. if (aad(sa)->op) {
  57. audit_log_format(ab, " operation=\"%s\"", aad(sa)->op);
  58. }
  59. if (aad(sa)->info) {
  60. audit_log_format(ab, " info=\"%s\"", aad(sa)->info);
  61. if (aad(sa)->error)
  62. audit_log_format(ab, " error=%d", aad(sa)->error);
  63. }
  64. if (aad(sa)->label) {
  65. struct aa_label *label = aad(sa)->label;
  66. if (label_isprofile(label)) {
  67. struct aa_profile *profile = labels_profile(label);
  68. if (profile->ns != root_ns) {
  69. audit_log_format(ab, " namespace=");
  70. audit_log_untrustedstring(ab,
  71. profile->ns->base.hname);
  72. }
  73. audit_log_format(ab, " profile=");
  74. audit_log_untrustedstring(ab, profile->base.hname);
  75. } else {
  76. audit_log_format(ab, " label=");
  77. aa_label_xaudit(ab, root_ns, label, FLAG_VIEW_SUBNS,
  78. GFP_ATOMIC);
  79. }
  80. }
  81. if (aad(sa)->name) {
  82. audit_log_format(ab, " name=");
  83. audit_log_untrustedstring(ab, aad(sa)->name);
  84. }
  85. }
  86. /**
  87. * aa_audit_msg - Log a message to the audit subsystem
  88. * @sa: audit event structure (NOT NULL)
  89. * @cb: optional callback fn for type specific fields (MAYBE NULL)
  90. */
  91. void aa_audit_msg(int type, struct common_audit_data *sa,
  92. void (*cb) (struct audit_buffer *, void *))
  93. {
  94. aad(sa)->type = type;
  95. common_lsm_audit(sa, audit_pre, cb);
  96. }
  97. /**
  98. * aa_audit - Log a profile based audit event to the audit subsystem
  99. * @type: audit type for the message
  100. * @profile: profile to check against (NOT NULL)
  101. * @sa: audit event (NOT NULL)
  102. * @cb: optional callback fn for type specific fields (MAYBE NULL)
  103. *
  104. * Handle default message switching based off of audit mode flags
  105. *
  106. * Returns: error on failure
  107. */
  108. int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa,
  109. void (*cb) (struct audit_buffer *, void *))
  110. {
  111. AA_BUG(!profile);
  112. if (type == AUDIT_APPARMOR_AUTO) {
  113. if (likely(!aad(sa)->error)) {
  114. if (AUDIT_MODE(profile) != AUDIT_ALL)
  115. return 0;
  116. type = AUDIT_APPARMOR_AUDIT;
  117. } else if (COMPLAIN_MODE(profile))
  118. type = AUDIT_APPARMOR_ALLOWED;
  119. else
  120. type = AUDIT_APPARMOR_DENIED;
  121. }
  122. if (AUDIT_MODE(profile) == AUDIT_QUIET ||
  123. (type == AUDIT_APPARMOR_DENIED &&
  124. AUDIT_MODE(profile) == AUDIT_QUIET))
  125. return aad(sa)->error;
  126. if (KILL_MODE(profile) && type == AUDIT_APPARMOR_DENIED)
  127. type = AUDIT_APPARMOR_KILL;
  128. aad(sa)->label = &profile->label;
  129. aa_audit_msg(type, sa, cb);
  130. if (aad(sa)->type == AUDIT_APPARMOR_KILL)
  131. (void)send_sig_info(SIGKILL, NULL,
  132. sa->type == LSM_AUDIT_DATA_TASK && sa->u.tsk ?
  133. sa->u.tsk : current);
  134. if (aad(sa)->type == AUDIT_APPARMOR_ALLOWED)
  135. return complain_error(aad(sa)->error);
  136. return aad(sa)->error;
  137. }
  138. struct aa_audit_rule {
  139. struct aa_label *label;
  140. };
  141. void aa_audit_rule_free(void *vrule)
  142. {
  143. struct aa_audit_rule *rule = vrule;
  144. if (rule) {
  145. if (!IS_ERR(rule->label))
  146. aa_put_label(rule->label);
  147. kfree(rule);
  148. }
  149. }
  150. int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
  151. {
  152. struct aa_audit_rule *rule;
  153. switch (field) {
  154. case AUDIT_SUBJ_ROLE:
  155. if (op != Audit_equal && op != Audit_not_equal)
  156. return -EINVAL;
  157. break;
  158. default:
  159. return -EINVAL;
  160. }
  161. rule = kzalloc(sizeof(struct aa_audit_rule), GFP_KERNEL);
  162. if (!rule)
  163. return -ENOMEM;
  164. /* Currently rules are treated as coming from the root ns */
  165. rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
  166. GFP_KERNEL, true, false);
  167. if (IS_ERR(rule->label)) {
  168. int err = PTR_ERR(rule->label);
  169. aa_audit_rule_free(rule);
  170. return err;
  171. }
  172. *vrule = rule;
  173. return 0;
  174. }
  175. int aa_audit_rule_known(struct audit_krule *rule)
  176. {
  177. int i;
  178. for (i = 0; i < rule->field_count; i++) {
  179. struct audit_field *f = &rule->fields[i];
  180. switch (f->type) {
  181. case AUDIT_SUBJ_ROLE:
  182. return 1;
  183. }
  184. }
  185. return 0;
  186. }
  187. int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule)
  188. {
  189. struct aa_audit_rule *rule = vrule;
  190. struct aa_label *label;
  191. int found = 0;
  192. label = aa_secid_to_label(sid);
  193. if (!label)
  194. return -ENOENT;
  195. if (aa_label_is_subset(label, rule->label))
  196. found = 1;
  197. switch (field) {
  198. case AUDIT_SUBJ_ROLE:
  199. switch (op) {
  200. case Audit_equal:
  201. return found;
  202. case Audit_not_equal:
  203. return !found;
  204. }
  205. }
  206. return 0;
  207. }