Smack: include magic.h in smackfs.c
[linux-3.10.git] / security / lsm_audit.c
index fc41b7c..8d8d97d 100644 (file)
@@ -49,8 +49,8 @@ int ipv4_skb_to_auditdata(struct sk_buff *skb,
        if (ih == NULL)
                return -EINVAL;
 
-       ad->u.net.v4info.saddr = ih->saddr;
-       ad->u.net.v4info.daddr = ih->daddr;
+       ad->u.net->v4info.saddr = ih->saddr;
+       ad->u.net->v4info.daddr = ih->daddr;
 
        if (proto)
                *proto = ih->protocol;
@@ -64,8 +64,8 @@ int ipv4_skb_to_auditdata(struct sk_buff *skb,
                if (th == NULL)
                        break;
 
-               ad->u.net.sport = th->source;
-               ad->u.net.dport = th->dest;
+               ad->u.net->sport = th->source;
+               ad->u.net->dport = th->dest;
                break;
        }
        case IPPROTO_UDP: {
@@ -73,8 +73,8 @@ int ipv4_skb_to_auditdata(struct sk_buff *skb,
                if (uh == NULL)
                        break;
 
-               ad->u.net.sport = uh->source;
-               ad->u.net.dport = uh->dest;
+               ad->u.net->sport = uh->source;
+               ad->u.net->dport = uh->dest;
                break;
        }
        case IPPROTO_DCCP: {
@@ -82,16 +82,16 @@ int ipv4_skb_to_auditdata(struct sk_buff *skb,
                if (dh == NULL)
                        break;
 
-               ad->u.net.sport = dh->dccph_sport;
-               ad->u.net.dport = dh->dccph_dport;
+               ad->u.net->sport = dh->dccph_sport;
+               ad->u.net->dport = dh->dccph_dport;
                break;
        }
        case IPPROTO_SCTP: {
                struct sctphdr *sh = sctp_hdr(skb);
                if (sh == NULL)
                        break;
-               ad->u.net.sport = sh->source;
-               ad->u.net.dport = sh->dest;
+               ad->u.net->sport = sh->source;
+               ad->u.net->dport = sh->dest;
                break;
        }
        default:
@@ -119,8 +119,8 @@ int ipv6_skb_to_auditdata(struct sk_buff *skb,
        ip6 = ipv6_hdr(skb);
        if (ip6 == NULL)
                return -EINVAL;
-       ad->u.net.v6info.saddr = ip6->saddr;
-       ad->u.net.v6info.daddr = ip6->daddr;
+       ad->u.net->v6info.saddr = ip6->saddr;
+       ad->u.net->v6info.daddr = ip6->daddr;
        ret = 0;
        /* IPv6 can have several extension header before the Transport header
         * skip them */
@@ -140,8 +140,8 @@ int ipv6_skb_to_auditdata(struct sk_buff *skb,
                if (th == NULL)
                        break;
 
-               ad->u.net.sport = th->source;
-               ad->u.net.dport = th->dest;
+               ad->u.net->sport = th->source;
+               ad->u.net->dport = th->dest;
                break;
        }
        case IPPROTO_UDP: {
@@ -151,8 +151,8 @@ int ipv6_skb_to_auditdata(struct sk_buff *skb,
                if (uh == NULL)
                        break;
 
-               ad->u.net.sport = uh->source;
-               ad->u.net.dport = uh->dest;
+               ad->u.net->sport = uh->source;
+               ad->u.net->dport = uh->dest;
                break;
        }
        case IPPROTO_DCCP: {
@@ -162,8 +162,8 @@ int ipv6_skb_to_auditdata(struct sk_buff *skb,
                if (dh == NULL)
                        break;
 
-               ad->u.net.sport = dh->dccph_sport;
-               ad->u.net.dport = dh->dccph_dport;
+               ad->u.net->sport = dh->dccph_sport;
+               ad->u.net->dport = dh->dccph_dport;
                break;
        }
        case IPPROTO_SCTP: {
@@ -172,8 +172,8 @@ int ipv6_skb_to_auditdata(struct sk_buff *skb,
                sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
                if (sh == NULL)
                        break;
-               ad->u.net.sport = sh->source;
-               ad->u.net.dport = sh->dest;
+               ad->u.net->sport = sh->source;
+               ad->u.net->dport = sh->dest;
                break;
        }
        default:
@@ -213,12 +213,15 @@ static void dump_common_audit_data(struct audit_buffer *ab,
 {
        struct task_struct *tsk = current;
 
-       if (a->tsk)
-               tsk = a->tsk;
-       if (tsk && tsk->pid) {
-               audit_log_format(ab, " pid=%d comm=", tsk->pid);
-               audit_log_untrustedstring(ab, tsk->comm);
-       }
+       /*
+        * To keep stack sizes in check force programers to notice if they
+        * start making this union too large!  See struct lsm_network_audit
+        * as an example of how to deal with large data.
+        */
+       BUILD_BUG_ON(sizeof(a->u) > sizeof(void *)*2);
+
+       audit_log_format(ab, " pid=%d comm=", tsk->pid);
+       audit_log_untrustedstring(ab, tsk->comm);
 
        switch (a->type) {
        case LSM_AUDIT_DATA_NONE:
@@ -232,7 +235,7 @@ static void dump_common_audit_data(struct audit_buffer *ab,
        case LSM_AUDIT_DATA_PATH: {
                struct inode *inode;
 
-               audit_log_d_path(ab, "path=", &a->u.path);
+               audit_log_d_path(ab, " path=", &a->u.path);
 
                inode = a->u.path.dentry->d_inode;
                if (inode) {
@@ -281,8 +284,8 @@ static void dump_common_audit_data(struct audit_buffer *ab,
                }
                break;
        case LSM_AUDIT_DATA_NET:
-               if (a->u.net.sk) {
-                       struct sock *sk = a->u.net.sk;
+               if (a->u.net->sk) {
+                       struct sock *sk = a->u.net->sk;
                        struct unix_sock *u;
                        int len = 0;
                        char *p = NULL;
@@ -313,12 +316,8 @@ static void dump_common_audit_data(struct audit_buffer *ab,
                        }
                        case AF_UNIX:
                                u = unix_sk(sk);
-                               if (u->dentry) {
-                                       struct path path = {
-                                               .dentry = u->dentry,
-                                               .mnt = u->mnt
-                                       };
-                                       audit_log_d_path(ab, "path=", &path);
+                               if (u->path.dentry) {
+                                       audit_log_d_path(ab, " path=", &u->path);
                                        break;
                                }
                                if (!u->addr)
@@ -334,29 +333,29 @@ static void dump_common_audit_data(struct audit_buffer *ab,
                        }
                }
 
-               switch (a->u.net.family) {
+               switch (a->u.net->family) {
                case AF_INET:
-                       print_ipv4_addr(ab, a->u.net.v4info.saddr,
-                                       a->u.net.sport,
+                       print_ipv4_addr(ab, a->u.net->v4info.saddr,
+                                       a->u.net->sport,
                                        "saddr", "src");
-                       print_ipv4_addr(ab, a->u.net.v4info.daddr,
-                                       a->u.net.dport,
+                       print_ipv4_addr(ab, a->u.net->v4info.daddr,
+                                       a->u.net->dport,
                                        "daddr", "dest");
                        break;
                case AF_INET6:
-                       print_ipv6_addr(ab, &a->u.net.v6info.saddr,
-                                       a->u.net.sport,
+                       print_ipv6_addr(ab, &a->u.net->v6info.saddr,
+                                       a->u.net->sport,
                                        "saddr", "src");
-                       print_ipv6_addr(ab, &a->u.net.v6info.daddr,
-                                       a->u.net.dport,
+                       print_ipv6_addr(ab, &a->u.net->v6info.daddr,
+                                       a->u.net->dport,
                                        "daddr", "dest");
                        break;
                }
-               if (a->u.net.netif > 0) {
+               if (a->u.net->netif > 0) {
                        struct net_device *dev;
 
                        /* NOTE: we always use init's namespace */
-                       dev = dev_get_by_index(&init_net, a->u.net.netif);
+                       dev = dev_get_by_index(&init_net, a->u.net->netif);
                        if (dev) {
                                audit_log_format(ab, " netif=%s", dev->name);
                                dev_put(dev);
@@ -382,11 +381,15 @@ static void dump_common_audit_data(struct audit_buffer *ab,
 /**
  * common_lsm_audit - generic LSM auditing function
  * @a:  auxiliary audit data
+ * @pre_audit: lsm-specific pre-audit callback
+ * @post_audit: lsm-specific post-audit callback
  *
  * setup the audit buffer for common security information
  * uses callback to print LSM specific information
  */
-void common_lsm_audit(struct common_audit_data *a)
+void common_lsm_audit(struct common_audit_data *a,
+       void (*pre_audit)(struct audit_buffer *, void *),
+       void (*post_audit)(struct audit_buffer *, void *))
 {
        struct audit_buffer *ab;
 
@@ -398,13 +401,13 @@ void common_lsm_audit(struct common_audit_data *a)
        if (ab == NULL)
                return;
 
-       if (a->lsm_pre_audit)
-               a->lsm_pre_audit(ab, a);
+       if (pre_audit)
+               pre_audit(ab, a);
 
        dump_common_audit_data(ab, a);
 
-       if (a->lsm_post_audit)
-               a->lsm_post_audit(ab, a);
+       if (post_audit)
+               post_audit(ab, a);
 
        audit_log_end(ab);
 }