audit.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * security/tomoyo/audit.c
  4. *
  5. * Copyright (C) 2005-2011 NTT DATA CORPORATION
  6. */
  7. #include "common.h"
  8. #include <linux/slab.h>
  9. /**
  10. * tomoyo_print_bprm - Print "struct linux_binprm" for auditing.
  11. *
  12. * @bprm: Pointer to "struct linux_binprm".
  13. * @dump: Pointer to "struct tomoyo_page_dump".
  14. *
  15. * Returns the contents of @bprm on success, NULL otherwise.
  16. *
  17. * This function uses kzalloc(), so caller must kfree() if this function
  18. * didn't return NULL.
  19. */
  20. static char *tomoyo_print_bprm(struct linux_binprm *bprm,
  21. struct tomoyo_page_dump *dump)
  22. {
  23. static const int tomoyo_buffer_len = 4096 * 2;
  24. char *buffer = kzalloc(tomoyo_buffer_len, GFP_NOFS);
  25. char *cp;
  26. char *last_start;
  27. int len;
  28. unsigned long pos = bprm->p;
  29. int offset = pos % PAGE_SIZE;
  30. int argv_count = bprm->argc;
  31. int envp_count = bprm->envc;
  32. bool truncated = false;
  33. if (!buffer)
  34. return NULL;
  35. len = snprintf(buffer, tomoyo_buffer_len - 1, "argv[]={ ");
  36. cp = buffer + len;
  37. if (!argv_count) {
  38. memmove(cp, "} envp[]={ ", 11);
  39. cp += 11;
  40. }
  41. last_start = cp;
  42. while (argv_count || envp_count) {
  43. if (!tomoyo_dump_page(bprm, pos, dump))
  44. goto out;
  45. pos += PAGE_SIZE - offset;
  46. /* Read. */
  47. while (offset < PAGE_SIZE) {
  48. const char *kaddr = dump->data;
  49. const unsigned char c = kaddr[offset++];
  50. if (cp == last_start)
  51. *cp++ = '"';
  52. if (cp >= buffer + tomoyo_buffer_len - 32) {
  53. /* Reserve some room for "..." string. */
  54. truncated = true;
  55. } else if (c == '\\') {
  56. *cp++ = '\\';
  57. *cp++ = '\\';
  58. } else if (c > ' ' && c < 127) {
  59. *cp++ = c;
  60. } else if (!c) {
  61. *cp++ = '"';
  62. *cp++ = ' ';
  63. last_start = cp;
  64. } else {
  65. *cp++ = '\\';
  66. *cp++ = (c >> 6) + '0';
  67. *cp++ = ((c >> 3) & 7) + '0';
  68. *cp++ = (c & 7) + '0';
  69. }
  70. if (c)
  71. continue;
  72. if (argv_count) {
  73. if (--argv_count == 0) {
  74. if (truncated) {
  75. cp = last_start;
  76. memmove(cp, "... ", 4);
  77. cp += 4;
  78. }
  79. memmove(cp, "} envp[]={ ", 11);
  80. cp += 11;
  81. last_start = cp;
  82. truncated = false;
  83. }
  84. } else if (envp_count) {
  85. if (--envp_count == 0) {
  86. if (truncated) {
  87. cp = last_start;
  88. memmove(cp, "... ", 4);
  89. cp += 4;
  90. }
  91. }
  92. }
  93. if (!argv_count && !envp_count)
  94. break;
  95. }
  96. offset = 0;
  97. }
  98. *cp++ = '}';
  99. *cp = '\0';
  100. return buffer;
  101. out:
  102. snprintf(buffer, tomoyo_buffer_len - 1,
  103. "argv[]={ ... } envp[]= { ... }");
  104. return buffer;
  105. }
  106. /**
  107. * tomoyo_filetype - Get string representation of file type.
  108. *
  109. * @mode: Mode value for stat().
  110. *
  111. * Returns file type string.
  112. */
  113. static inline const char *tomoyo_filetype(const umode_t mode)
  114. {
  115. switch (mode & S_IFMT) {
  116. case S_IFREG:
  117. case 0:
  118. return tomoyo_condition_keyword[TOMOYO_TYPE_IS_FILE];
  119. case S_IFDIR:
  120. return tomoyo_condition_keyword[TOMOYO_TYPE_IS_DIRECTORY];
  121. case S_IFLNK:
  122. return tomoyo_condition_keyword[TOMOYO_TYPE_IS_SYMLINK];
  123. case S_IFIFO:
  124. return tomoyo_condition_keyword[TOMOYO_TYPE_IS_FIFO];
  125. case S_IFSOCK:
  126. return tomoyo_condition_keyword[TOMOYO_TYPE_IS_SOCKET];
  127. case S_IFBLK:
  128. return tomoyo_condition_keyword[TOMOYO_TYPE_IS_BLOCK_DEV];
  129. case S_IFCHR:
  130. return tomoyo_condition_keyword[TOMOYO_TYPE_IS_CHAR_DEV];
  131. }
  132. return "unknown"; /* This should not happen. */
  133. }
  134. /**
  135. * tomoyo_print_header - Get header line of audit log.
  136. *
  137. * @r: Pointer to "struct tomoyo_request_info".
  138. *
  139. * Returns string representation.
  140. *
  141. * This function uses kmalloc(), so caller must kfree() if this function
  142. * didn't return NULL.
  143. */
  144. static char *tomoyo_print_header(struct tomoyo_request_info *r)
  145. {
  146. struct tomoyo_time stamp;
  147. const pid_t gpid = task_pid_nr(current);
  148. struct tomoyo_obj_info *obj = r->obj;
  149. static const int tomoyo_buffer_len = 4096;
  150. char *buffer = kmalloc(tomoyo_buffer_len, GFP_NOFS);
  151. int pos;
  152. u8 i;
  153. if (!buffer)
  154. return NULL;
  155. tomoyo_convert_time(ktime_get_real_seconds(), &stamp);
  156. pos = snprintf(buffer, tomoyo_buffer_len - 1,
  157. "#%04u/%02u/%02u %02u:%02u:%02u# profile=%u mode=%s granted=%s (global-pid=%u) task={ pid=%u ppid=%u uid=%u gid=%u euid=%u egid=%u suid=%u sgid=%u fsuid=%u fsgid=%u }",
  158. stamp.year, stamp.month, stamp.day, stamp.hour,
  159. stamp.min, stamp.sec, r->profile, tomoyo_mode[r->mode],
  160. tomoyo_yesno(r->granted), gpid, tomoyo_sys_getpid(),
  161. tomoyo_sys_getppid(),
  162. from_kuid(&init_user_ns, current_uid()),
  163. from_kgid(&init_user_ns, current_gid()),
  164. from_kuid(&init_user_ns, current_euid()),
  165. from_kgid(&init_user_ns, current_egid()),
  166. from_kuid(&init_user_ns, current_suid()),
  167. from_kgid(&init_user_ns, current_sgid()),
  168. from_kuid(&init_user_ns, current_fsuid()),
  169. from_kgid(&init_user_ns, current_fsgid()));
  170. if (!obj)
  171. goto no_obj_info;
  172. if (!obj->validate_done) {
  173. tomoyo_get_attributes(obj);
  174. obj->validate_done = true;
  175. }
  176. for (i = 0; i < TOMOYO_MAX_PATH_STAT; i++) {
  177. struct tomoyo_mini_stat *stat;
  178. unsigned int dev;
  179. umode_t mode;
  180. if (!obj->stat_valid[i])
  181. continue;
  182. stat = &obj->stat[i];
  183. dev = stat->dev;
  184. mode = stat->mode;
  185. if (i & 1) {
  186. pos += snprintf(buffer + pos,
  187. tomoyo_buffer_len - 1 - pos,
  188. " path%u.parent={ uid=%u gid=%u ino=%lu perm=0%o }",
  189. (i >> 1) + 1,
  190. from_kuid(&init_user_ns, stat->uid),
  191. from_kgid(&init_user_ns, stat->gid),
  192. (unsigned long)stat->ino,
  193. stat->mode & S_IALLUGO);
  194. continue;
  195. }
  196. pos += snprintf(buffer + pos, tomoyo_buffer_len - 1 - pos,
  197. " path%u={ uid=%u gid=%u ino=%lu major=%u minor=%u perm=0%o type=%s",
  198. (i >> 1) + 1,
  199. from_kuid(&init_user_ns, stat->uid),
  200. from_kgid(&init_user_ns, stat->gid),
  201. (unsigned long)stat->ino,
  202. MAJOR(dev), MINOR(dev),
  203. mode & S_IALLUGO, tomoyo_filetype(mode));
  204. if (S_ISCHR(mode) || S_ISBLK(mode)) {
  205. dev = stat->rdev;
  206. pos += snprintf(buffer + pos,
  207. tomoyo_buffer_len - 1 - pos,
  208. " dev_major=%u dev_minor=%u",
  209. MAJOR(dev), MINOR(dev));
  210. }
  211. pos += snprintf(buffer + pos, tomoyo_buffer_len - 1 - pos,
  212. " }");
  213. }
  214. no_obj_info:
  215. if (pos < tomoyo_buffer_len - 1)
  216. return buffer;
  217. kfree(buffer);
  218. return NULL;
  219. }
  220. /**
  221. * tomoyo_init_log - Allocate buffer for audit logs.
  222. *
  223. * @r: Pointer to "struct tomoyo_request_info".
  224. * @len: Buffer size needed for @fmt and @args.
  225. * @fmt: The printf()'s format string.
  226. * @args: va_list structure for @fmt.
  227. *
  228. * Returns pointer to allocated memory.
  229. *
  230. * This function uses kzalloc(), so caller must kfree() if this function
  231. * didn't return NULL.
  232. */
  233. char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt,
  234. va_list args)
  235. {
  236. char *buf = NULL;
  237. char *bprm_info = NULL;
  238. const char *header = NULL;
  239. char *realpath = NULL;
  240. const char *symlink = NULL;
  241. int pos;
  242. const char *domainname = r->domain->domainname->name;
  243. header = tomoyo_print_header(r);
  244. if (!header)
  245. return NULL;
  246. /* +10 is for '\n' etc. and '\0'. */
  247. len += strlen(domainname) + strlen(header) + 10;
  248. if (r->ee) {
  249. struct file *file = r->ee->bprm->file;
  250. realpath = tomoyo_realpath_from_path(&file->f_path);
  251. bprm_info = tomoyo_print_bprm(r->ee->bprm, &r->ee->dump);
  252. if (!realpath || !bprm_info)
  253. goto out;
  254. /* +80 is for " exec={ realpath=\"%s\" argc=%d envc=%d %s }" */
  255. len += strlen(realpath) + 80 + strlen(bprm_info);
  256. } else if (r->obj && r->obj->symlink_target) {
  257. symlink = r->obj->symlink_target->name;
  258. /* +18 is for " symlink.target=\"%s\"" */
  259. len += 18 + strlen(symlink);
  260. }
  261. len = tomoyo_round2(len);
  262. buf = kzalloc(len, GFP_NOFS);
  263. if (!buf)
  264. goto out;
  265. len--;
  266. pos = snprintf(buf, len, "%s", header);
  267. if (realpath) {
  268. struct linux_binprm *bprm = r->ee->bprm;
  269. pos += snprintf(buf + pos, len - pos,
  270. " exec={ realpath=\"%s\" argc=%d envc=%d %s }",
  271. realpath, bprm->argc, bprm->envc, bprm_info);
  272. } else if (symlink)
  273. pos += snprintf(buf + pos, len - pos, " symlink.target=\"%s\"",
  274. symlink);
  275. pos += snprintf(buf + pos, len - pos, "\n%s\n", domainname);
  276. vsnprintf(buf + pos, len - pos, fmt, args);
  277. out:
  278. kfree(realpath);
  279. kfree(bprm_info);
  280. kfree(header);
  281. return buf;
  282. }
  283. /* Wait queue for /sys/kernel/security/tomoyo/audit. */
  284. static DECLARE_WAIT_QUEUE_HEAD(tomoyo_log_wait);
  285. /* Structure for audit log. */
  286. struct tomoyo_log {
  287. struct list_head list;
  288. char *log;
  289. int size;
  290. };
  291. /* The list for "struct tomoyo_log". */
  292. static LIST_HEAD(tomoyo_log);
  293. /* Lock for "struct list_head tomoyo_log". */
  294. static DEFINE_SPINLOCK(tomoyo_log_lock);
  295. /* Length of "stuct list_head tomoyo_log". */
  296. static unsigned int tomoyo_log_count;
  297. /**
  298. * tomoyo_get_audit - Get audit mode.
  299. *
  300. * @ns: Pointer to "struct tomoyo_policy_namespace".
  301. * @profile: Profile number.
  302. * @index: Index number of functionality.
  303. * @is_granted: True if granted log, false otherwise.
  304. *
  305. * Returns true if this request should be audited, false otherwise.
  306. */
  307. static bool tomoyo_get_audit(const struct tomoyo_policy_namespace *ns,
  308. const u8 profile, const u8 index,
  309. const struct tomoyo_acl_info *matched_acl,
  310. const bool is_granted)
  311. {
  312. u8 mode;
  313. const u8 category = tomoyo_index2category[index] +
  314. TOMOYO_MAX_MAC_INDEX;
  315. struct tomoyo_profile *p;
  316. if (!tomoyo_policy_loaded)
  317. return false;
  318. p = tomoyo_profile(ns, profile);
  319. if (tomoyo_log_count >= p->pref[TOMOYO_PREF_MAX_AUDIT_LOG])
  320. return false;
  321. if (is_granted && matched_acl && matched_acl->cond &&
  322. matched_acl->cond->grant_log != TOMOYO_GRANTLOG_AUTO)
  323. return matched_acl->cond->grant_log == TOMOYO_GRANTLOG_YES;
  324. mode = p->config[index];
  325. if (mode == TOMOYO_CONFIG_USE_DEFAULT)
  326. mode = p->config[category];
  327. if (mode == TOMOYO_CONFIG_USE_DEFAULT)
  328. mode = p->default_config;
  329. if (is_granted)
  330. return mode & TOMOYO_CONFIG_WANT_GRANT_LOG;
  331. return mode & TOMOYO_CONFIG_WANT_REJECT_LOG;
  332. }
  333. /**
  334. * tomoyo_write_log2 - Write an audit log.
  335. *
  336. * @r: Pointer to "struct tomoyo_request_info".
  337. * @len: Buffer size needed for @fmt and @args.
  338. * @fmt: The printf()'s format string.
  339. * @args: va_list structure for @fmt.
  340. *
  341. * Returns nothing.
  342. */
  343. void tomoyo_write_log2(struct tomoyo_request_info *r, int len, const char *fmt,
  344. va_list args)
  345. {
  346. char *buf;
  347. struct tomoyo_log *entry;
  348. bool quota_exceeded = false;
  349. if (!tomoyo_get_audit(r->domain->ns, r->profile, r->type,
  350. r->matched_acl, r->granted))
  351. goto out;
  352. buf = tomoyo_init_log(r, len, fmt, args);
  353. if (!buf)
  354. goto out;
  355. entry = kzalloc(sizeof(*entry), GFP_NOFS);
  356. if (!entry) {
  357. kfree(buf);
  358. goto out;
  359. }
  360. entry->log = buf;
  361. len = tomoyo_round2(strlen(buf) + 1);
  362. /*
  363. * The entry->size is used for memory quota checks.
  364. * Don't go beyond strlen(entry->log).
  365. */
  366. entry->size = len + tomoyo_round2(sizeof(*entry));
  367. spin_lock(&tomoyo_log_lock);
  368. if (tomoyo_memory_quota[TOMOYO_MEMORY_AUDIT] &&
  369. tomoyo_memory_used[TOMOYO_MEMORY_AUDIT] + entry->size >=
  370. tomoyo_memory_quota[TOMOYO_MEMORY_AUDIT]) {
  371. quota_exceeded = true;
  372. } else {
  373. tomoyo_memory_used[TOMOYO_MEMORY_AUDIT] += entry->size;
  374. list_add_tail(&entry->list, &tomoyo_log);
  375. tomoyo_log_count++;
  376. }
  377. spin_unlock(&tomoyo_log_lock);
  378. if (quota_exceeded) {
  379. kfree(buf);
  380. kfree(entry);
  381. goto out;
  382. }
  383. wake_up(&tomoyo_log_wait);
  384. out:
  385. return;
  386. }
  387. /**
  388. * tomoyo_write_log - Write an audit log.
  389. *
  390. * @r: Pointer to "struct tomoyo_request_info".
  391. * @fmt: The printf()'s format string, followed by parameters.
  392. *
  393. * Returns nothing.
  394. */
  395. void tomoyo_write_log(struct tomoyo_request_info *r, const char *fmt, ...)
  396. {
  397. va_list args;
  398. int len;
  399. va_start(args, fmt);
  400. len = vsnprintf((char *) &len, 1, fmt, args) + 1;
  401. va_end(args);
  402. va_start(args, fmt);
  403. tomoyo_write_log2(r, len, fmt, args);
  404. va_end(args);
  405. }
  406. /**
  407. * tomoyo_read_log - Read an audit log.
  408. *
  409. * @head: Pointer to "struct tomoyo_io_buffer".
  410. *
  411. * Returns nothing.
  412. */
  413. void tomoyo_read_log(struct tomoyo_io_buffer *head)
  414. {
  415. struct tomoyo_log *ptr = NULL;
  416. if (head->r.w_pos)
  417. return;
  418. kfree(head->read_buf);
  419. head->read_buf = NULL;
  420. spin_lock(&tomoyo_log_lock);
  421. if (!list_empty(&tomoyo_log)) {
  422. ptr = list_entry(tomoyo_log.next, typeof(*ptr), list);
  423. list_del(&ptr->list);
  424. tomoyo_log_count--;
  425. tomoyo_memory_used[TOMOYO_MEMORY_AUDIT] -= ptr->size;
  426. }
  427. spin_unlock(&tomoyo_log_lock);
  428. if (ptr) {
  429. head->read_buf = ptr->log;
  430. head->r.w[head->r.w_pos++] = head->read_buf;
  431. kfree(ptr);
  432. }
  433. }
  434. /**
  435. * tomoyo_poll_log - Wait for an audit log.
  436. *
  437. * @file: Pointer to "struct file".
  438. * @wait: Pointer to "poll_table". Maybe NULL.
  439. *
  440. * Returns EPOLLIN | EPOLLRDNORM when ready to read an audit log.
  441. */
  442. __poll_t tomoyo_poll_log(struct file *file, poll_table *wait)
  443. {
  444. if (tomoyo_log_count)
  445. return EPOLLIN | EPOLLRDNORM;
  446. poll_wait(file, &tomoyo_log_wait, wait);
  447. if (tomoyo_log_count)
  448. return EPOLLIN | EPOLLRDNORM;
  449. return 0;
  450. }