blob: ce8c957201efbe2e95d731e07a31c1e277ed5618 [file] [log] [blame]
85c87212005-04-29 16:23:29 +01001/* auditsc.c -- System-call auditing support
Linus Torvalds1da177e2005-04-16 15:20:36 -07002 * Handles all system-call specific auditing features.
3 *
4 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
Amy Griffis73241cc2005-11-03 16:00:25 +00005 * Copyright 2005 Hewlett-Packard Development Company, L.P.
George C. Wilson20ca73b2006-05-24 16:09:55 -05006 * Copyright (C) 2005, 2006 IBM Corporation
Linus Torvalds1da177e2005-04-16 15:20:36 -07007 * All Rights Reserved.
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 *
23 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
24 *
25 * Many of the ideas implemented here are from Stephen C. Tweedie,
26 * especially the idea of avoiding a copy by using getname.
27 *
28 * The method for actual interception of syscall entry and exit (not in
29 * this file -- see entry.S) is based on a GPL'd patch written by
30 * okir@suse.de and Copyright 2003 SuSE Linux AG.
31 *
George C. Wilson20ca73b2006-05-24 16:09:55 -050032 * POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>,
33 * 2006.
34 *
Dustin Kirklandb63862f2005-11-03 15:41:46 +000035 * The support of additional filter rules compares (>, <, >=, <=) was
36 * added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005.
37 *
Amy Griffis73241cc2005-11-03 16:00:25 +000038 * Modified by Amy Griffis <amy.griffis@hp.com> to collect additional
39 * filesystem information.
Dustin Kirkland8c8570f2005-11-03 17:15:16 +000040 *
41 * Subject and object context labeling support added by <danjones@us.ibm.com>
42 * and <dustin.kirkland@us.ibm.com> for LSPP certification compliance.
Linus Torvalds1da177e2005-04-16 15:20:36 -070043 */
44
45#include <linux/init.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070046#include <asm/types.h>
Alan Cox715b49e2006-01-18 17:44:07 -080047#include <asm/atomic.h>
Amy Griffis73241cc2005-11-03 16:00:25 +000048#include <linux/fs.h>
49#include <linux/namei.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070050#include <linux/mm.h>
51#include <linux/module.h>
Stephen Smalley01116102005-05-21 00:15:52 +010052#include <linux/mount.h>
David Woodhouse3ec3b2f2005-05-17 12:08:48 +010053#include <linux/socket.h>
George C. Wilson20ca73b2006-05-24 16:09:55 -050054#include <linux/mqueue.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070055#include <linux/audit.h>
56#include <linux/personality.h>
57#include <linux/time.h>
David Woodhouse5bb289b2005-06-24 14:14:05 +010058#include <linux/netlink.h>
David Woodhousef5561962005-07-13 22:47:07 +010059#include <linux/compiler.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070060#include <asm/unistd.h>
Dustin Kirkland8c8570f2005-11-03 17:15:16 +000061#include <linux/security.h>
David Woodhousefe7752b2005-12-15 18:33:52 +000062#include <linux/list.h>
Steve Grubba6c043a2006-01-01 14:07:00 -050063#include <linux/tty.h>
Darrel Goeddel3dc7e312006-03-10 18:14:06 -060064#include <linux/selinux.h>
Al Viro473ae302006-04-26 14:04:08 -040065#include <linux/binfmts.h>
Al Viroa1f8e7f72006-10-19 16:08:53 -040066#include <linux/highmem.h>
Al Virof46038f2006-05-06 08:22:52 -040067#include <linux/syscalls.h>
Al Viro74c3cbe2007-07-22 08:04:18 -040068#include <linux/inotify.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070069
David Woodhousefe7752b2005-12-15 18:33:52 +000070#include "audit.h"
71
72extern struct list_head audit_filter_list[];
Linus Torvalds1da177e2005-04-16 15:20:36 -070073
Linus Torvalds1da177e2005-04-16 15:20:36 -070074/* AUDIT_NAMES is the number of slots we reserve in the audit_context
75 * for saving names from getname(). */
76#define AUDIT_NAMES 20
77
Amy Griffis9c937dc2006-06-08 23:19:31 -040078/* Indicates that audit should log the full pathname. */
79#define AUDIT_NAME_FULL -1
80
Al Viro471a5c72006-07-10 08:29:24 -040081/* number of audit rules */
82int audit_n_rules;
83
Amy Griffise54dc242007-03-29 18:01:04 -040084/* determines whether we collect data for signals sent */
85int audit_signals;
86
Linus Torvalds1da177e2005-04-16 15:20:36 -070087/* When fs/namei.c:getname() is called, we store the pointer in name and
88 * we don't let putname() free it (instead we free all of the saved
89 * pointers at syscall exit time).
90 *
91 * Further, in fs/namei.c:path_lookup() we store the inode and device. */
92struct audit_names {
93 const char *name;
Amy Griffis9c937dc2006-06-08 23:19:31 -040094 int name_len; /* number of name's characters to log */
95 unsigned name_put; /* call __putname() for this name */
Linus Torvalds1da177e2005-04-16 15:20:36 -070096 unsigned long ino;
97 dev_t dev;
98 umode_t mode;
99 uid_t uid;
100 gid_t gid;
101 dev_t rdev;
Steve Grubb1b50eed2006-04-03 14:06:13 -0400102 u32 osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700103};
104
105struct audit_aux_data {
106 struct audit_aux_data *next;
107 int type;
108};
109
110#define AUDIT_AUX_IPCPERM 0
111
Amy Griffise54dc242007-03-29 18:01:04 -0400112/* Number of target pids per aux struct. */
113#define AUDIT_AUX_PIDS 16
114
George C. Wilson20ca73b2006-05-24 16:09:55 -0500115struct audit_aux_data_mq_open {
116 struct audit_aux_data d;
117 int oflag;
118 mode_t mode;
119 struct mq_attr attr;
120};
121
122struct audit_aux_data_mq_sendrecv {
123 struct audit_aux_data d;
124 mqd_t mqdes;
125 size_t msg_len;
126 unsigned int msg_prio;
127 struct timespec abs_timeout;
128};
129
130struct audit_aux_data_mq_notify {
131 struct audit_aux_data d;
132 mqd_t mqdes;
133 struct sigevent notification;
134};
135
136struct audit_aux_data_mq_getsetattr {
137 struct audit_aux_data d;
138 mqd_t mqdes;
139 struct mq_attr mqstat;
140};
141
Linus Torvalds1da177e2005-04-16 15:20:36 -0700142struct audit_aux_data_ipcctl {
143 struct audit_aux_data d;
144 struct ipc_perm p;
145 unsigned long qbytes;
146 uid_t uid;
147 gid_t gid;
148 mode_t mode;
Steve Grubb9c7aa6a2006-03-31 15:22:49 -0500149 u32 osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700150};
151
Al Viro473ae302006-04-26 14:04:08 -0400152struct audit_aux_data_execve {
153 struct audit_aux_data d;
154 int argc;
155 int envc;
Peter Zijlstrabdf4c482007-07-19 01:48:15 -0700156 struct mm_struct *mm;
Al Viro473ae302006-04-26 14:04:08 -0400157};
158
David Woodhouse3ec3b2f2005-05-17 12:08:48 +0100159struct audit_aux_data_socketcall {
160 struct audit_aux_data d;
161 int nargs;
162 unsigned long args[0];
163};
164
165struct audit_aux_data_sockaddr {
166 struct audit_aux_data d;
167 int len;
168 char a[0];
169};
170
Al Virodb349502007-02-07 01:48:00 -0500171struct audit_aux_data_fd_pair {
172 struct audit_aux_data d;
173 int fd[2];
174};
175
Amy Griffise54dc242007-03-29 18:01:04 -0400176struct audit_aux_data_pids {
177 struct audit_aux_data d;
178 pid_t target_pid[AUDIT_AUX_PIDS];
179 u32 target_sid[AUDIT_AUX_PIDS];
180 int pid_count;
181};
182
Al Viro74c3cbe2007-07-22 08:04:18 -0400183struct audit_tree_refs {
184 struct audit_tree_refs *next;
185 struct audit_chunk *c[31];
186};
187
Linus Torvalds1da177e2005-04-16 15:20:36 -0700188/* The per-task audit context. */
189struct audit_context {
Al Virod51374a2006-08-03 10:59:26 -0400190 int dummy; /* must be the first element */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700191 int in_syscall; /* 1 if task is in a syscall */
192 enum audit_state state;
193 unsigned int serial; /* serial number for record */
194 struct timespec ctime; /* time of syscall entry */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700195 int major; /* syscall number */
196 unsigned long argv[4]; /* syscall arguments */
197 int return_valid; /* return code is valid */
2fd6f582005-04-29 16:08:28 +0100198 long return_code;/* syscall return code */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700199 int auditable; /* 1 if record should be written */
200 int name_count;
201 struct audit_names names[AUDIT_NAMES];
Amy Griffis5adc8a62006-06-14 18:45:21 -0400202 char * filterkey; /* key for rule that triggered record */
David Woodhouse8f37d472005-05-27 12:17:28 +0100203 struct dentry * pwd;
204 struct vfsmount * pwdmnt;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700205 struct audit_context *previous; /* For nested syscalls */
206 struct audit_aux_data *aux;
Amy Griffise54dc242007-03-29 18:01:04 -0400207 struct audit_aux_data *aux_pids;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700208
209 /* Save things to print about task_struct */
Al Virof46038f2006-05-06 08:22:52 -0400210 pid_t pid, ppid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700211 uid_t uid, euid, suid, fsuid;
212 gid_t gid, egid, sgid, fsgid;
213 unsigned long personality;
2fd6f582005-04-29 16:08:28 +0100214 int arch;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700215
Al Viroa5cb0132007-03-20 13:58:35 -0400216 pid_t target_pid;
217 u32 target_sid;
218
Al Viro74c3cbe2007-07-22 08:04:18 -0400219 struct audit_tree_refs *trees, *first_trees;
220 int tree_count;
221
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222#if AUDIT_DEBUG
223 int put_count;
224 int ino_count;
225#endif
226};
227
Al Viro55669bf2006-08-31 19:26:40 -0400228#define ACC_MODE(x) ("\004\002\006\006"[(x)&O_ACCMODE])
229static inline int open_arg(int flags, int mask)
230{
231 int n = ACC_MODE(flags);
232 if (flags & (O_TRUNC | O_CREAT))
233 n |= AUDIT_PERM_WRITE;
234 return n & mask;
235}
236
237static int audit_match_perm(struct audit_context *ctx, int mask)
238{
239 unsigned n = ctx->major;
240 switch (audit_classify_syscall(ctx->arch, n)) {
241 case 0: /* native */
242 if ((mask & AUDIT_PERM_WRITE) &&
243 audit_match_class(AUDIT_CLASS_WRITE, n))
244 return 1;
245 if ((mask & AUDIT_PERM_READ) &&
246 audit_match_class(AUDIT_CLASS_READ, n))
247 return 1;
248 if ((mask & AUDIT_PERM_ATTR) &&
249 audit_match_class(AUDIT_CLASS_CHATTR, n))
250 return 1;
251 return 0;
252 case 1: /* 32bit on biarch */
253 if ((mask & AUDIT_PERM_WRITE) &&
254 audit_match_class(AUDIT_CLASS_WRITE_32, n))
255 return 1;
256 if ((mask & AUDIT_PERM_READ) &&
257 audit_match_class(AUDIT_CLASS_READ_32, n))
258 return 1;
259 if ((mask & AUDIT_PERM_ATTR) &&
260 audit_match_class(AUDIT_CLASS_CHATTR_32, n))
261 return 1;
262 return 0;
263 case 2: /* open */
264 return mask & ACC_MODE(ctx->argv[1]);
265 case 3: /* openat */
266 return mask & ACC_MODE(ctx->argv[2]);
267 case 4: /* socketcall */
268 return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);
269 case 5: /* execve */
270 return mask & AUDIT_PERM_EXEC;
271 default:
272 return 0;
273 }
274}
275
Al Viro74c3cbe2007-07-22 08:04:18 -0400276/*
277 * We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *;
278 * ->first_trees points to its beginning, ->trees - to the current end of data.
279 * ->tree_count is the number of free entries in array pointed to by ->trees.
280 * Original condition is (NULL, NULL, 0); as soon as it grows we never revert to NULL,
281 * "empty" becomes (p, p, 31) afterwards. We don't shrink the list (and seriously,
282 * it's going to remain 1-element for almost any setup) until we free context itself.
283 * References in it _are_ dropped - at the same time we free/drop aux stuff.
284 */
285
286#ifdef CONFIG_AUDIT_TREE
287static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk)
288{
289 struct audit_tree_refs *p = ctx->trees;
290 int left = ctx->tree_count;
291 if (likely(left)) {
292 p->c[--left] = chunk;
293 ctx->tree_count = left;
294 return 1;
295 }
296 if (!p)
297 return 0;
298 p = p->next;
299 if (p) {
300 p->c[30] = chunk;
301 ctx->trees = p;
302 ctx->tree_count = 30;
303 return 1;
304 }
305 return 0;
306}
307
308static int grow_tree_refs(struct audit_context *ctx)
309{
310 struct audit_tree_refs *p = ctx->trees;
311 ctx->trees = kzalloc(sizeof(struct audit_tree_refs), GFP_KERNEL);
312 if (!ctx->trees) {
313 ctx->trees = p;
314 return 0;
315 }
316 if (p)
317 p->next = ctx->trees;
318 else
319 ctx->first_trees = ctx->trees;
320 ctx->tree_count = 31;
321 return 1;
322}
323#endif
324
325static void unroll_tree_refs(struct audit_context *ctx,
326 struct audit_tree_refs *p, int count)
327{
328#ifdef CONFIG_AUDIT_TREE
329 struct audit_tree_refs *q;
330 int n;
331 if (!p) {
332 /* we started with empty chain */
333 p = ctx->first_trees;
334 count = 31;
335 /* if the very first allocation has failed, nothing to do */
336 if (!p)
337 return;
338 }
339 n = count;
340 for (q = p; q != ctx->trees; q = q->next, n = 31) {
341 while (n--) {
342 audit_put_chunk(q->c[n]);
343 q->c[n] = NULL;
344 }
345 }
346 while (n-- > ctx->tree_count) {
347 audit_put_chunk(q->c[n]);
348 q->c[n] = NULL;
349 }
350 ctx->trees = p;
351 ctx->tree_count = count;
352#endif
353}
354
355static void free_tree_refs(struct audit_context *ctx)
356{
357 struct audit_tree_refs *p, *q;
358 for (p = ctx->first_trees; p; p = q) {
359 q = p->next;
360 kfree(p);
361 }
362}
363
364static int match_tree_refs(struct audit_context *ctx, struct audit_tree *tree)
365{
366#ifdef CONFIG_AUDIT_TREE
367 struct audit_tree_refs *p;
368 int n;
369 if (!tree)
370 return 0;
371 /* full ones */
372 for (p = ctx->first_trees; p != ctx->trees; p = p->next) {
373 for (n = 0; n < 31; n++)
374 if (audit_tree_match(p->c[n], tree))
375 return 1;
376 }
377 /* partial */
378 if (p) {
379 for (n = ctx->tree_count; n < 31; n++)
380 if (audit_tree_match(p->c[n], tree))
381 return 1;
382 }
383#endif
384 return 0;
385}
386
Amy Griffisf368c07d2006-04-07 16:55:56 -0400387/* Determine if any context name data matches a rule's watch data */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700388/* Compare a task_struct with an audit_rule. Return 1 on match, 0
389 * otherwise. */
390static int audit_filter_rules(struct task_struct *tsk,
Amy Griffis93315ed2006-02-07 12:05:27 -0500391 struct audit_krule *rule,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700392 struct audit_context *ctx,
Amy Griffisf368c07d2006-04-07 16:55:56 -0400393 struct audit_names *name,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700394 enum audit_state *state)
395{
Steve Grubb2ad312d2006-04-11 08:50:56 -0400396 int i, j, need_sid = 1;
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600397 u32 sid;
398
Linus Torvalds1da177e2005-04-16 15:20:36 -0700399 for (i = 0; i < rule->field_count; i++) {
Amy Griffis93315ed2006-02-07 12:05:27 -0500400 struct audit_field *f = &rule->fields[i];
Linus Torvalds1da177e2005-04-16 15:20:36 -0700401 int result = 0;
402
Amy Griffis93315ed2006-02-07 12:05:27 -0500403 switch (f->type) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700404 case AUDIT_PID:
Amy Griffis93315ed2006-02-07 12:05:27 -0500405 result = audit_comparator(tsk->pid, f->op, f->val);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700406 break;
Al Viro3c662512006-05-06 08:26:27 -0400407 case AUDIT_PPID:
Alexander Viro419c58f2006-09-29 00:08:50 -0400408 if (ctx) {
409 if (!ctx->ppid)
410 ctx->ppid = sys_getppid();
Al Viro3c662512006-05-06 08:26:27 -0400411 result = audit_comparator(ctx->ppid, f->op, f->val);
Alexander Viro419c58f2006-09-29 00:08:50 -0400412 }
Al Viro3c662512006-05-06 08:26:27 -0400413 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700414 case AUDIT_UID:
Amy Griffis93315ed2006-02-07 12:05:27 -0500415 result = audit_comparator(tsk->uid, f->op, f->val);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700416 break;
417 case AUDIT_EUID:
Amy Griffis93315ed2006-02-07 12:05:27 -0500418 result = audit_comparator(tsk->euid, f->op, f->val);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700419 break;
420 case AUDIT_SUID:
Amy Griffis93315ed2006-02-07 12:05:27 -0500421 result = audit_comparator(tsk->suid, f->op, f->val);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700422 break;
423 case AUDIT_FSUID:
Amy Griffis93315ed2006-02-07 12:05:27 -0500424 result = audit_comparator(tsk->fsuid, f->op, f->val);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700425 break;
426 case AUDIT_GID:
Amy Griffis93315ed2006-02-07 12:05:27 -0500427 result = audit_comparator(tsk->gid, f->op, f->val);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700428 break;
429 case AUDIT_EGID:
Amy Griffis93315ed2006-02-07 12:05:27 -0500430 result = audit_comparator(tsk->egid, f->op, f->val);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700431 break;
432 case AUDIT_SGID:
Amy Griffis93315ed2006-02-07 12:05:27 -0500433 result = audit_comparator(tsk->sgid, f->op, f->val);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700434 break;
435 case AUDIT_FSGID:
Amy Griffis93315ed2006-02-07 12:05:27 -0500436 result = audit_comparator(tsk->fsgid, f->op, f->val);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700437 break;
438 case AUDIT_PERS:
Amy Griffis93315ed2006-02-07 12:05:27 -0500439 result = audit_comparator(tsk->personality, f->op, f->val);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700440 break;
2fd6f582005-04-29 16:08:28 +0100441 case AUDIT_ARCH:
Daniel Walker9f8dbe92007-10-18 03:06:09 -0700442 if (ctx)
Amy Griffis93315ed2006-02-07 12:05:27 -0500443 result = audit_comparator(ctx->arch, f->op, f->val);
2fd6f582005-04-29 16:08:28 +0100444 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700445
446 case AUDIT_EXIT:
447 if (ctx && ctx->return_valid)
Amy Griffis93315ed2006-02-07 12:05:27 -0500448 result = audit_comparator(ctx->return_code, f->op, f->val);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700449 break;
450 case AUDIT_SUCCESS:
David Woodhouseb01f2cc2005-08-27 10:25:43 +0100451 if (ctx && ctx->return_valid) {
Amy Griffis93315ed2006-02-07 12:05:27 -0500452 if (f->val)
453 result = audit_comparator(ctx->return_valid, f->op, AUDITSC_SUCCESS);
David Woodhouseb01f2cc2005-08-27 10:25:43 +0100454 else
Amy Griffis93315ed2006-02-07 12:05:27 -0500455 result = audit_comparator(ctx->return_valid, f->op, AUDITSC_FAILURE);
David Woodhouseb01f2cc2005-08-27 10:25:43 +0100456 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700457 break;
458 case AUDIT_DEVMAJOR:
Amy Griffisf368c07d2006-04-07 16:55:56 -0400459 if (name)
460 result = audit_comparator(MAJOR(name->dev),
461 f->op, f->val);
462 else if (ctx) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700463 for (j = 0; j < ctx->name_count; j++) {
Amy Griffis93315ed2006-02-07 12:05:27 -0500464 if (audit_comparator(MAJOR(ctx->names[j].dev), f->op, f->val)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700465 ++result;
466 break;
467 }
468 }
469 }
470 break;
471 case AUDIT_DEVMINOR:
Amy Griffisf368c07d2006-04-07 16:55:56 -0400472 if (name)
473 result = audit_comparator(MINOR(name->dev),
474 f->op, f->val);
475 else if (ctx) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700476 for (j = 0; j < ctx->name_count; j++) {
Amy Griffis93315ed2006-02-07 12:05:27 -0500477 if (audit_comparator(MINOR(ctx->names[j].dev), f->op, f->val)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700478 ++result;
479 break;
480 }
481 }
482 }
483 break;
484 case AUDIT_INODE:
Amy Griffisf368c07d2006-04-07 16:55:56 -0400485 if (name)
Amy Griffis9c937dc2006-06-08 23:19:31 -0400486 result = (name->ino == f->val);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400487 else if (ctx) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700488 for (j = 0; j < ctx->name_count; j++) {
Amy Griffis9c937dc2006-06-08 23:19:31 -0400489 if (audit_comparator(ctx->names[j].ino, f->op, f->val)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700490 ++result;
491 break;
492 }
493 }
494 }
495 break;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400496 case AUDIT_WATCH:
497 if (name && rule->watch->ino != (unsigned long)-1)
498 result = (name->dev == rule->watch->dev &&
Amy Griffis9c937dc2006-06-08 23:19:31 -0400499 name->ino == rule->watch->ino);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400500 break;
Al Viro74c3cbe2007-07-22 08:04:18 -0400501 case AUDIT_DIR:
502 if (ctx)
503 result = match_tree_refs(ctx, rule->tree);
504 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700505 case AUDIT_LOGINUID:
506 result = 0;
507 if (ctx)
Al Virobfef93a2008-01-10 04:53:18 -0500508 result = audit_comparator(tsk->loginuid, f->op, f->val);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700509 break;
Darrel Goeddel3a6b9f82006-06-29 16:56:39 -0500510 case AUDIT_SUBJ_USER:
511 case AUDIT_SUBJ_ROLE:
512 case AUDIT_SUBJ_TYPE:
513 case AUDIT_SUBJ_SEN:
514 case AUDIT_SUBJ_CLR:
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600515 /* NOTE: this may return negative values indicating
516 a temporary error. We simply treat this as a
517 match for now to avoid losing information that
518 may be wanted. An error message will also be
519 logged upon error */
Steve Grubb2ad312d2006-04-11 08:50:56 -0400520 if (f->se_rule) {
521 if (need_sid) {
Stephen Smalley62bac012006-09-25 23:31:56 -0700522 selinux_get_task_sid(tsk, &sid);
Steve Grubb2ad312d2006-04-11 08:50:56 -0400523 need_sid = 0;
524 }
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600525 result = selinux_audit_rule_match(sid, f->type,
526 f->op,
527 f->se_rule,
528 ctx);
Steve Grubb2ad312d2006-04-11 08:50:56 -0400529 }
Darrel Goeddel3dc7e312006-03-10 18:14:06 -0600530 break;
Darrel Goeddel6e5a2d12006-06-29 16:57:08 -0500531 case AUDIT_OBJ_USER:
532 case AUDIT_OBJ_ROLE:
533 case AUDIT_OBJ_TYPE:
534 case AUDIT_OBJ_LEV_LOW:
535 case AUDIT_OBJ_LEV_HIGH:
536 /* The above note for AUDIT_SUBJ_USER...AUDIT_SUBJ_CLR
537 also applies here */
538 if (f->se_rule) {
539 /* Find files that match */
540 if (name) {
541 result = selinux_audit_rule_match(
542 name->osid, f->type, f->op,
543 f->se_rule, ctx);
544 } else if (ctx) {
545 for (j = 0; j < ctx->name_count; j++) {
546 if (selinux_audit_rule_match(
547 ctx->names[j].osid,
548 f->type, f->op,
549 f->se_rule, ctx)) {
550 ++result;
551 break;
552 }
553 }
554 }
555 /* Find ipc objects that match */
556 if (ctx) {
557 struct audit_aux_data *aux;
558 for (aux = ctx->aux; aux;
559 aux = aux->next) {
560 if (aux->type == AUDIT_IPC) {
561 struct audit_aux_data_ipcctl *axi = (void *)aux;
562 if (selinux_audit_rule_match(axi->osid, f->type, f->op, f->se_rule, ctx)) {
563 ++result;
564 break;
565 }
566 }
567 }
568 }
569 }
570 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700571 case AUDIT_ARG0:
572 case AUDIT_ARG1:
573 case AUDIT_ARG2:
574 case AUDIT_ARG3:
575 if (ctx)
Amy Griffis93315ed2006-02-07 12:05:27 -0500576 result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700577 break;
Amy Griffis5adc8a62006-06-14 18:45:21 -0400578 case AUDIT_FILTERKEY:
579 /* ignore this field for filtering */
580 result = 1;
581 break;
Al Viro55669bf2006-08-31 19:26:40 -0400582 case AUDIT_PERM:
583 result = audit_match_perm(ctx, f->val);
584 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700585 }
586
Linus Torvalds1da177e2005-04-16 15:20:36 -0700587 if (!result)
588 return 0;
589 }
Amy Griffis5adc8a62006-06-14 18:45:21 -0400590 if (rule->filterkey)
591 ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700592 switch (rule->action) {
593 case AUDIT_NEVER: *state = AUDIT_DISABLED; break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700594 case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break;
595 }
596 return 1;
597}
598
599/* At process creation time, we can determine if system-call auditing is
600 * completely disabled for this task. Since we only have the task
601 * structure at this point, we can only check uid and gid.
602 */
603static enum audit_state audit_filter_task(struct task_struct *tsk)
604{
605 struct audit_entry *e;
606 enum audit_state state;
607
608 rcu_read_lock();
David Woodhouse0f45aa12005-06-19 19:35:50 +0100609 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
Amy Griffisf368c07d2006-04-07 16:55:56 -0400610 if (audit_filter_rules(tsk, &e->rule, NULL, NULL, &state)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700611 rcu_read_unlock();
612 return state;
613 }
614 }
615 rcu_read_unlock();
616 return AUDIT_BUILD_CONTEXT;
617}
618
619/* At syscall entry and exit time, this filter is called if the
620 * audit_state is not low enough that auditing cannot take place, but is
Steve Grubb23f32d12005-05-13 18:35:15 +0100621 * also not high enough that we already know we have to write an audit
Randy Dunlapb0dd25a2005-09-13 12:47:11 -0700622 * record (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT).
Linus Torvalds1da177e2005-04-16 15:20:36 -0700623 */
624static enum audit_state audit_filter_syscall(struct task_struct *tsk,
625 struct audit_context *ctx,
626 struct list_head *list)
627{
628 struct audit_entry *e;
David Woodhousec3896492005-08-17 14:49:57 +0100629 enum audit_state state;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700630
David Woodhouse351bb722005-07-14 14:40:06 +0100631 if (audit_pid && tsk->tgid == audit_pid)
David Woodhousef7056d62005-06-20 16:07:33 +0100632 return AUDIT_DISABLED;
633
Linus Torvalds1da177e2005-04-16 15:20:36 -0700634 rcu_read_lock();
David Woodhousec3896492005-08-17 14:49:57 +0100635 if (!list_empty(list)) {
Dustin Kirklandb63862f2005-11-03 15:41:46 +0000636 int word = AUDIT_WORD(ctx->major);
637 int bit = AUDIT_BIT(ctx->major);
David Woodhousec3896492005-08-17 14:49:57 +0100638
Dustin Kirklandb63862f2005-11-03 15:41:46 +0000639 list_for_each_entry_rcu(e, list, list) {
Amy Griffisf368c07d2006-04-07 16:55:56 -0400640 if ((e->rule.mask[word] & bit) == bit &&
641 audit_filter_rules(tsk, &e->rule, ctx, NULL,
642 &state)) {
Dustin Kirklandb63862f2005-11-03 15:41:46 +0000643 rcu_read_unlock();
644 return state;
645 }
646 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700647 }
648 rcu_read_unlock();
649 return AUDIT_BUILD_CONTEXT;
650}
651
Amy Griffisf368c07d2006-04-07 16:55:56 -0400652/* At syscall exit time, this filter is called if any audit_names[] have been
653 * collected during syscall processing. We only check rules in sublists at hash
654 * buckets applicable to the inode numbers in audit_names[].
655 * Regarding audit_state, same rules apply as for audit_filter_syscall().
656 */
657enum audit_state audit_filter_inodes(struct task_struct *tsk,
658 struct audit_context *ctx)
659{
660 int i;
661 struct audit_entry *e;
662 enum audit_state state;
663
664 if (audit_pid && tsk->tgid == audit_pid)
665 return AUDIT_DISABLED;
666
667 rcu_read_lock();
668 for (i = 0; i < ctx->name_count; i++) {
669 int word = AUDIT_WORD(ctx->major);
670 int bit = AUDIT_BIT(ctx->major);
671 struct audit_names *n = &ctx->names[i];
672 int h = audit_hash_ino((u32)n->ino);
673 struct list_head *list = &audit_inode_hash[h];
674
675 if (list_empty(list))
676 continue;
677
678 list_for_each_entry_rcu(e, list, list) {
679 if ((e->rule.mask[word] & bit) == bit &&
680 audit_filter_rules(tsk, &e->rule, ctx, n, &state)) {
681 rcu_read_unlock();
682 return state;
683 }
684 }
685 }
686 rcu_read_unlock();
687 return AUDIT_BUILD_CONTEXT;
688}
689
690void audit_set_auditable(struct audit_context *ctx)
691{
692 ctx->auditable = 1;
693}
694
Linus Torvalds1da177e2005-04-16 15:20:36 -0700695static inline struct audit_context *audit_get_context(struct task_struct *tsk,
696 int return_valid,
697 int return_code)
698{
699 struct audit_context *context = tsk->audit_context;
700
701 if (likely(!context))
702 return NULL;
703 context->return_valid = return_valid;
Eric Parisf701b752008-01-07 13:34:51 -0500704
705 /*
706 * we need to fix up the return code in the audit logs if the actual
707 * return codes are later going to be fixed up by the arch specific
708 * signal handlers
709 *
710 * This is actually a test for:
711 * (rc == ERESTARTSYS ) || (rc == ERESTARTNOINTR) ||
712 * (rc == ERESTARTNOHAND) || (rc == ERESTART_RESTARTBLOCK)
713 *
714 * but is faster than a bunch of ||
715 */
716 if (unlikely(return_code <= -ERESTARTSYS) &&
717 (return_code >= -ERESTART_RESTARTBLOCK) &&
718 (return_code != -ENOIOCTLCMD))
719 context->return_code = -EINTR;
720 else
721 context->return_code = return_code;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700722
Al Virod51374a2006-08-03 10:59:26 -0400723 if (context->in_syscall && !context->dummy && !context->auditable) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700724 enum audit_state state;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400725
David Woodhouse0f45aa12005-06-19 19:35:50 +0100726 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
Amy Griffisf368c07d2006-04-07 16:55:56 -0400727 if (state == AUDIT_RECORD_CONTEXT) {
728 context->auditable = 1;
729 goto get_context;
730 }
731
732 state = audit_filter_inodes(tsk, context);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700733 if (state == AUDIT_RECORD_CONTEXT)
734 context->auditable = 1;
Amy Griffisf368c07d2006-04-07 16:55:56 -0400735
Linus Torvalds1da177e2005-04-16 15:20:36 -0700736 }
737
Amy Griffisf368c07d2006-04-07 16:55:56 -0400738get_context:
Al Viro3f2792f2006-07-16 06:43:48 -0400739
Linus Torvalds1da177e2005-04-16 15:20:36 -0700740 tsk->audit_context = NULL;
741 return context;
742}
743
744static inline void audit_free_names(struct audit_context *context)
745{
746 int i;
747
748#if AUDIT_DEBUG == 2
749 if (context->auditable
750 ||context->put_count + context->ino_count != context->name_count) {
Amy Griffis73241cc2005-11-03 16:00:25 +0000751 printk(KERN_ERR "%s:%d(:%d): major=%d in_syscall=%d"
Linus Torvalds1da177e2005-04-16 15:20:36 -0700752 " name_count=%d put_count=%d"
753 " ino_count=%d [NOT freeing]\n",
Amy Griffis73241cc2005-11-03 16:00:25 +0000754 __FILE__, __LINE__,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700755 context->serial, context->major, context->in_syscall,
756 context->name_count, context->put_count,
757 context->ino_count);
Dustin Kirkland8c8570f2005-11-03 17:15:16 +0000758 for (i = 0; i < context->name_count; i++) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700759 printk(KERN_ERR "names[%d] = %p = %s\n", i,
760 context->names[i].name,
Amy Griffis73241cc2005-11-03 16:00:25 +0000761 context->names[i].name ?: "(null)");
Dustin Kirkland8c8570f2005-11-03 17:15:16 +0000762 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700763 dump_stack();
764 return;
765 }
766#endif
767#if AUDIT_DEBUG
768 context->put_count = 0;
769 context->ino_count = 0;
770#endif
771
Dustin Kirkland8c8570f2005-11-03 17:15:16 +0000772 for (i = 0; i < context->name_count; i++) {
Amy Griffis9c937dc2006-06-08 23:19:31 -0400773 if (context->names[i].name && context->names[i].name_put)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700774 __putname(context->names[i].name);
Dustin Kirkland8c8570f2005-11-03 17:15:16 +0000775 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700776 context->name_count = 0;
David Woodhouse8f37d472005-05-27 12:17:28 +0100777 if (context->pwd)
778 dput(context->pwd);
779 if (context->pwdmnt)
780 mntput(context->pwdmnt);
781 context->pwd = NULL;
782 context->pwdmnt = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700783}
784
785static inline void audit_free_aux(struct audit_context *context)
786{
787 struct audit_aux_data *aux;
788
789 while ((aux = context->aux)) {
790 context->aux = aux->next;
791 kfree(aux);
792 }
Amy Griffise54dc242007-03-29 18:01:04 -0400793 while ((aux = context->aux_pids)) {
794 context->aux_pids = aux->next;
795 kfree(aux);
796 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700797}
798
799static inline void audit_zero_context(struct audit_context *context,
800 enum audit_state state)
801{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700802 memset(context, 0, sizeof(*context));
803 context->state = state;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700804}
805
806static inline struct audit_context *audit_alloc_context(enum audit_state state)
807{
808 struct audit_context *context;
809
810 if (!(context = kmalloc(sizeof(*context), GFP_KERNEL)))
811 return NULL;
812 audit_zero_context(context, state);
813 return context;
814}
815
Randy Dunlapb0dd25a2005-09-13 12:47:11 -0700816/**
817 * audit_alloc - allocate an audit context block for a task
818 * @tsk: task
819 *
820 * Filter on the task information and allocate a per-task audit context
Linus Torvalds1da177e2005-04-16 15:20:36 -0700821 * if necessary. Doing so turns on system call auditing for the
822 * specified task. This is called from copy_process, so no lock is
Randy Dunlapb0dd25a2005-09-13 12:47:11 -0700823 * needed.
824 */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700825int audit_alloc(struct task_struct *tsk)
826{
827 struct audit_context *context;
828 enum audit_state state;
829
830 if (likely(!audit_enabled))
831 return 0; /* Return if not auditing. */
832
833 state = audit_filter_task(tsk);
834 if (likely(state == AUDIT_DISABLED))
835 return 0;
836
837 if (!(context = audit_alloc_context(state))) {
838 audit_log_lost("out of memory in audit_alloc");
839 return -ENOMEM;
840 }
841
Linus Torvalds1da177e2005-04-16 15:20:36 -0700842 tsk->audit_context = context;
843 set_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
844 return 0;
845}
846
847static inline void audit_free_context(struct audit_context *context)
848{
849 struct audit_context *previous;
850 int count = 0;
851
852 do {
853 previous = context->previous;
854 if (previous || (count && count < 10)) {
855 ++count;
856 printk(KERN_ERR "audit(:%d): major=%d name_count=%d:"
857 " freeing multiple contexts (%d)\n",
858 context->serial, context->major,
859 context->name_count, count);
860 }
861 audit_free_names(context);
Al Viro74c3cbe2007-07-22 08:04:18 -0400862 unroll_tree_refs(context, NULL, 0);
863 free_tree_refs(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700864 audit_free_aux(context);
Amy Griffis5adc8a62006-06-14 18:45:21 -0400865 kfree(context->filterkey);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700866 kfree(context);
867 context = previous;
868 } while (context);
869 if (count >= 10)
870 printk(KERN_ERR "audit: freed %d contexts\n", count);
871}
872
Joy Latten161a09e2006-11-27 13:11:54 -0600873void audit_log_task_context(struct audit_buffer *ab)
Dustin Kirkland8c8570f2005-11-03 17:15:16 +0000874{
875 char *ctx = NULL;
Al Viroc4823bc2007-03-12 16:17:42 +0000876 unsigned len;
877 int error;
878 u32 sid;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +0000879
Al Viroc4823bc2007-03-12 16:17:42 +0000880 selinux_get_task_sid(current, &sid);
881 if (!sid)
882 return;
883
884 error = selinux_sid_to_string(sid, &ctx, &len);
885 if (error) {
886 if (error != -EINVAL)
Dustin Kirkland8c8570f2005-11-03 17:15:16 +0000887 goto error_path;
888 return;
889 }
890
Dustin Kirkland8c8570f2005-11-03 17:15:16 +0000891 audit_log_format(ab, " subj=%s", ctx);
Al Viroc4823bc2007-03-12 16:17:42 +0000892 kfree(ctx);
Dustin Kirkland7306a0b2005-11-16 15:53:13 +0000893 return;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +0000894
895error_path:
Dustin Kirkland7306a0b2005-11-16 15:53:13 +0000896 audit_panic("error in audit_log_task_context");
Dustin Kirkland8c8570f2005-11-03 17:15:16 +0000897 return;
898}
899
Joy Latten161a09e2006-11-27 13:11:54 -0600900EXPORT_SYMBOL(audit_log_task_context);
901
Al Viroe4951492006-03-29 20:17:10 -0500902static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
Stephen Smalley219f0812005-04-18 10:47:35 -0700903{
Al Viro45d9bb02006-03-29 20:02:55 -0500904 char name[sizeof(tsk->comm)];
905 struct mm_struct *mm = tsk->mm;
Stephen Smalley219f0812005-04-18 10:47:35 -0700906 struct vm_area_struct *vma;
907
Al Viroe4951492006-03-29 20:17:10 -0500908 /* tsk == current */
909
Al Viro45d9bb02006-03-29 20:02:55 -0500910 get_task_comm(name, tsk);
David Woodhouse99e45ee2005-05-23 21:57:41 +0100911 audit_log_format(ab, " comm=");
912 audit_log_untrustedstring(ab, name);
Stephen Smalley219f0812005-04-18 10:47:35 -0700913
Al Viroe4951492006-03-29 20:17:10 -0500914 if (mm) {
915 down_read(&mm->mmap_sem);
916 vma = mm->mmap;
917 while (vma) {
918 if ((vma->vm_flags & VM_EXECUTABLE) &&
919 vma->vm_file) {
920 audit_log_d_path(ab, "exe=",
Josef Sipeka7a005f2006-12-08 02:37:17 -0800921 vma->vm_file->f_path.dentry,
922 vma->vm_file->f_path.mnt);
Al Viroe4951492006-03-29 20:17:10 -0500923 break;
924 }
925 vma = vma->vm_next;
Stephen Smalley219f0812005-04-18 10:47:35 -0700926 }
Al Viroe4951492006-03-29 20:17:10 -0500927 up_read(&mm->mmap_sem);
Stephen Smalley219f0812005-04-18 10:47:35 -0700928 }
Al Viroe4951492006-03-29 20:17:10 -0500929 audit_log_task_context(ab);
Stephen Smalley219f0812005-04-18 10:47:35 -0700930}
931
Amy Griffise54dc242007-03-29 18:01:04 -0400932static int audit_log_pid_context(struct audit_context *context, pid_t pid,
933 u32 sid)
934{
935 struct audit_buffer *ab;
936 char *s = NULL;
937 u32 len;
938 int rc = 0;
939
940 ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
941 if (!ab)
942 return 1;
943
944 if (selinux_sid_to_string(sid, &s, &len)) {
945 audit_log_format(ab, "opid=%d obj=(none)", pid);
946 rc = 1;
947 } else
948 audit_log_format(ab, "opid=%d obj=%s", pid, s);
949 audit_log_end(ab);
950 kfree(s);
951
952 return rc;
953}
954
Peter Zijlstrabdf4c482007-07-19 01:48:15 -0700955static void audit_log_execve_info(struct audit_buffer *ab,
956 struct audit_aux_data_execve *axi)
957{
958 int i;
959 long len, ret;
Peter Zijlstra040b3a22007-07-28 00:55:18 +0200960 const char __user *p;
Peter Zijlstrabdf4c482007-07-19 01:48:15 -0700961 char *buf;
962
963 if (axi->mm != current->mm)
964 return; /* execve failed, no additional info */
965
Peter Zijlstra040b3a22007-07-28 00:55:18 +0200966 p = (const char __user *)axi->mm->arg_start;
967
Peter Zijlstrabdf4c482007-07-19 01:48:15 -0700968 for (i = 0; i < axi->argc; i++, p += len) {
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700969 len = strnlen_user(p, MAX_ARG_STRLEN);
Peter Zijlstrabdf4c482007-07-19 01:48:15 -0700970 /*
971 * We just created this mm, if we can't find the strings
972 * we just copied into it something is _very_ wrong. Similar
973 * for strings that are too long, we should not have created
974 * any.
975 */
976 if (!len || len > MAX_ARG_STRLEN) {
977 WARN_ON(1);
978 send_sig(SIGKILL, current, 0);
979 }
980
981 buf = kmalloc(len, GFP_KERNEL);
982 if (!buf) {
983 audit_panic("out of memory for argv string\n");
984 break;
985 }
986
987 ret = copy_from_user(buf, p, len);
988 /*
989 * There is no reason for this copy to be short. We just
990 * copied them here, and the mm hasn't been exposed to user-
991 * space yet.
992 */
Peter Zijlstra040b3a22007-07-28 00:55:18 +0200993 if (ret) {
Peter Zijlstrabdf4c482007-07-19 01:48:15 -0700994 WARN_ON(1);
995 send_sig(SIGKILL, current, 0);
996 }
997
998 audit_log_format(ab, "a%d=", i);
999 audit_log_untrustedstring(ab, buf);
1000 audit_log_format(ab, "\n");
1001
1002 kfree(buf);
1003 }
1004}
1005
Al Viroe4951492006-03-29 20:17:10 -05001006static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001007{
Steve Grubb9c7aa6a2006-03-31 15:22:49 -05001008 int i, call_panic = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001009 struct audit_buffer *ab;
David Woodhouse7551ced2005-05-26 12:04:57 +01001010 struct audit_aux_data *aux;
Steve Grubba6c043a2006-01-01 14:07:00 -05001011 const char *tty;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001012
Al Viroe4951492006-03-29 20:17:10 -05001013 /* tsk == current */
Al Viro3f2792f2006-07-16 06:43:48 -04001014 context->pid = tsk->pid;
Alexander Viro419c58f2006-09-29 00:08:50 -04001015 if (!context->ppid)
1016 context->ppid = sys_getppid();
Al Viro3f2792f2006-07-16 06:43:48 -04001017 context->uid = tsk->uid;
1018 context->gid = tsk->gid;
1019 context->euid = tsk->euid;
1020 context->suid = tsk->suid;
1021 context->fsuid = tsk->fsuid;
1022 context->egid = tsk->egid;
1023 context->sgid = tsk->sgid;
1024 context->fsgid = tsk->fsgid;
1025 context->personality = tsk->personality;
Al Viroe4951492006-03-29 20:17:10 -05001026
1027 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001028 if (!ab)
1029 return; /* audit_panic has been called */
David Woodhousebccf6ae2005-05-23 21:35:28 +01001030 audit_log_format(ab, "arch=%x syscall=%d",
1031 context->arch, context->major);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001032 if (context->personality != PER_LINUX)
1033 audit_log_format(ab, " per=%lx", context->personality);
1034 if (context->return_valid)
Daniel Walker9f8dbe92007-10-18 03:06:09 -07001035 audit_log_format(ab, " success=%s exit=%ld",
2fd6f582005-04-29 16:08:28 +01001036 (context->return_valid==AUDITSC_SUCCESS)?"yes":"no",
1037 context->return_code);
Alan Coxeb84a202006-09-29 02:01:41 -07001038
1039 mutex_lock(&tty_mutex);
Peter Zijlstra24ec8392006-12-08 02:36:04 -08001040 read_lock(&tasklist_lock);
Al Viro45d9bb02006-03-29 20:02:55 -05001041 if (tsk->signal && tsk->signal->tty && tsk->signal->tty->name)
1042 tty = tsk->signal->tty->name;
Steve Grubba6c043a2006-01-01 14:07:00 -05001043 else
1044 tty = "(none)";
Peter Zijlstra24ec8392006-12-08 02:36:04 -08001045 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001046 audit_log_format(ab,
1047 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d"
Al Virof46038f2006-05-06 08:22:52 -04001048 " ppid=%d pid=%d auid=%u uid=%u gid=%u"
Steve Grubb326e9c82005-05-21 00:22:31 +01001049 " euid=%u suid=%u fsuid=%u"
Steve Grubba6c043a2006-01-01 14:07:00 -05001050 " egid=%u sgid=%u fsgid=%u tty=%s",
Linus Torvalds1da177e2005-04-16 15:20:36 -07001051 context->argv[0],
1052 context->argv[1],
1053 context->argv[2],
1054 context->argv[3],
1055 context->name_count,
Al Virof46038f2006-05-06 08:22:52 -04001056 context->ppid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001057 context->pid,
Al Virobfef93a2008-01-10 04:53:18 -05001058 tsk->loginuid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001059 context->uid,
1060 context->gid,
1061 context->euid, context->suid, context->fsuid,
Steve Grubba6c043a2006-01-01 14:07:00 -05001062 context->egid, context->sgid, context->fsgid, tty);
Alan Coxeb84a202006-09-29 02:01:41 -07001063
1064 mutex_unlock(&tty_mutex);
1065
Al Viroe4951492006-03-29 20:17:10 -05001066 audit_log_task_info(ab, tsk);
Amy Griffis5adc8a62006-06-14 18:45:21 -04001067 if (context->filterkey) {
1068 audit_log_format(ab, " key=");
1069 audit_log_untrustedstring(ab, context->filterkey);
1070 } else
1071 audit_log_format(ab, " key=(null)");
Linus Torvalds1da177e2005-04-16 15:20:36 -07001072 audit_log_end(ab);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001073
David Woodhouse7551ced2005-05-26 12:04:57 +01001074 for (aux = context->aux; aux; aux = aux->next) {
Steve Grubbc0404992005-05-13 18:17:42 +01001075
Al Viroe4951492006-03-29 20:17:10 -05001076 ab = audit_log_start(context, GFP_KERNEL, aux->type);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001077 if (!ab)
1078 continue; /* audit_panic has been called */
1079
Linus Torvalds1da177e2005-04-16 15:20:36 -07001080 switch (aux->type) {
George C. Wilson20ca73b2006-05-24 16:09:55 -05001081 case AUDIT_MQ_OPEN: {
1082 struct audit_aux_data_mq_open *axi = (void *)aux;
1083 audit_log_format(ab,
1084 "oflag=0x%x mode=%#o mq_flags=0x%lx mq_maxmsg=%ld "
1085 "mq_msgsize=%ld mq_curmsgs=%ld",
1086 axi->oflag, axi->mode, axi->attr.mq_flags,
1087 axi->attr.mq_maxmsg, axi->attr.mq_msgsize,
1088 axi->attr.mq_curmsgs);
1089 break; }
1090
1091 case AUDIT_MQ_SENDRECV: {
1092 struct audit_aux_data_mq_sendrecv *axi = (void *)aux;
1093 audit_log_format(ab,
1094 "mqdes=%d msg_len=%zd msg_prio=%u "
1095 "abs_timeout_sec=%ld abs_timeout_nsec=%ld",
1096 axi->mqdes, axi->msg_len, axi->msg_prio,
1097 axi->abs_timeout.tv_sec, axi->abs_timeout.tv_nsec);
1098 break; }
1099
1100 case AUDIT_MQ_NOTIFY: {
1101 struct audit_aux_data_mq_notify *axi = (void *)aux;
1102 audit_log_format(ab,
1103 "mqdes=%d sigev_signo=%d",
1104 axi->mqdes,
1105 axi->notification.sigev_signo);
1106 break; }
1107
1108 case AUDIT_MQ_GETSETATTR: {
1109 struct audit_aux_data_mq_getsetattr *axi = (void *)aux;
1110 audit_log_format(ab,
1111 "mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
1112 "mq_curmsgs=%ld ",
1113 axi->mqdes,
1114 axi->mqstat.mq_flags, axi->mqstat.mq_maxmsg,
1115 axi->mqstat.mq_msgsize, axi->mqstat.mq_curmsgs);
1116 break; }
1117
Steve Grubbc0404992005-05-13 18:17:42 +01001118 case AUDIT_IPC: {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001119 struct audit_aux_data_ipcctl *axi = (void *)aux;
1120 audit_log_format(ab,
Steve Grubb5b9a4262007-05-29 10:38:18 -04001121 "ouid=%u ogid=%u mode=%#o",
Linda Knippersac032212006-05-16 22:03:48 -04001122 axi->uid, axi->gid, axi->mode);
Steve Grubb9c7aa6a2006-03-31 15:22:49 -05001123 if (axi->osid != 0) {
1124 char *ctx = NULL;
1125 u32 len;
Stephen Smalley1a70cd42006-09-25 23:31:57 -07001126 if (selinux_sid_to_string(
Steve Grubb9c7aa6a2006-03-31 15:22:49 -05001127 axi->osid, &ctx, &len)) {
Steve Grubbce29b682006-04-01 18:29:34 -05001128 audit_log_format(ab, " osid=%u",
Steve Grubb9c7aa6a2006-03-31 15:22:49 -05001129 axi->osid);
1130 call_panic = 1;
1131 } else
1132 audit_log_format(ab, " obj=%s", ctx);
1133 kfree(ctx);
1134 }
David Woodhouse3ec3b2f2005-05-17 12:08:48 +01001135 break; }
1136
Steve Grubb073115d2006-04-02 17:07:33 -04001137 case AUDIT_IPC_SET_PERM: {
1138 struct audit_aux_data_ipcctl *axi = (void *)aux;
1139 audit_log_format(ab,
Steve Grubb5b9a4262007-05-29 10:38:18 -04001140 "qbytes=%lx ouid=%u ogid=%u mode=%#o",
Steve Grubb073115d2006-04-02 17:07:33 -04001141 axi->qbytes, axi->uid, axi->gid, axi->mode);
Steve Grubb073115d2006-04-02 17:07:33 -04001142 break; }
Linda Knippersac032212006-05-16 22:03:48 -04001143
Al Viro473ae302006-04-26 14:04:08 -04001144 case AUDIT_EXECVE: {
1145 struct audit_aux_data_execve *axi = (void *)aux;
Peter Zijlstrabdf4c482007-07-19 01:48:15 -07001146 audit_log_execve_info(ab, axi);
Al Viro473ae302006-04-26 14:04:08 -04001147 break; }
Steve Grubb073115d2006-04-02 17:07:33 -04001148
David Woodhouse3ec3b2f2005-05-17 12:08:48 +01001149 case AUDIT_SOCKETCALL: {
1150 int i;
1151 struct audit_aux_data_socketcall *axs = (void *)aux;
1152 audit_log_format(ab, "nargs=%d", axs->nargs);
1153 for (i=0; i<axs->nargs; i++)
1154 audit_log_format(ab, " a%d=%lx", i, axs->args[i]);
1155 break; }
1156
1157 case AUDIT_SOCKADDR: {
1158 struct audit_aux_data_sockaddr *axs = (void *)aux;
1159
1160 audit_log_format(ab, "saddr=");
1161 audit_log_hex(ab, axs->a, axs->len);
1162 break; }
Stephen Smalley01116102005-05-21 00:15:52 +01001163
Al Virodb349502007-02-07 01:48:00 -05001164 case AUDIT_FD_PAIR: {
1165 struct audit_aux_data_fd_pair *axs = (void *)aux;
1166 audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]);
1167 break; }
1168
Linus Torvalds1da177e2005-04-16 15:20:36 -07001169 }
1170 audit_log_end(ab);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001171 }
1172
Amy Griffise54dc242007-03-29 18:01:04 -04001173 for (aux = context->aux_pids; aux; aux = aux->next) {
1174 struct audit_aux_data_pids *axs = (void *)aux;
1175 int i;
1176
1177 for (i = 0; i < axs->pid_count; i++)
1178 if (audit_log_pid_context(context, axs->target_pid[i],
1179 axs->target_sid[i]))
1180 call_panic = 1;
Al Viroa5cb0132007-03-20 13:58:35 -04001181 }
1182
Amy Griffise54dc242007-03-29 18:01:04 -04001183 if (context->target_pid &&
1184 audit_log_pid_context(context, context->target_pid,
1185 context->target_sid))
1186 call_panic = 1;
1187
David Woodhouse8f37d472005-05-27 12:17:28 +01001188 if (context->pwd && context->pwdmnt) {
Al Viroe4951492006-03-29 20:17:10 -05001189 ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
David Woodhouse8f37d472005-05-27 12:17:28 +01001190 if (ab) {
1191 audit_log_d_path(ab, "cwd=", context->pwd, context->pwdmnt);
1192 audit_log_end(ab);
1193 }
1194 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001195 for (i = 0; i < context->name_count; i++) {
Amy Griffis9c937dc2006-06-08 23:19:31 -04001196 struct audit_names *n = &context->names[i];
Amy Griffis73241cc2005-11-03 16:00:25 +00001197
Al Viroe4951492006-03-29 20:17:10 -05001198 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001199 if (!ab)
1200 continue; /* audit_panic has been called */
David Woodhouse8f37d472005-05-27 12:17:28 +01001201
Linus Torvalds1da177e2005-04-16 15:20:36 -07001202 audit_log_format(ab, "item=%d", i);
Amy Griffis73241cc2005-11-03 16:00:25 +00001203
Amy Griffis9c937dc2006-06-08 23:19:31 -04001204 if (n->name) {
1205 switch(n->name_len) {
1206 case AUDIT_NAME_FULL:
1207 /* log the full path */
1208 audit_log_format(ab, " name=");
1209 audit_log_untrustedstring(ab, n->name);
1210 break;
1211 case 0:
1212 /* name was specified as a relative path and the
1213 * directory component is the cwd */
1214 audit_log_d_path(ab, " name=", context->pwd,
1215 context->pwdmnt);
1216 break;
1217 default:
1218 /* log the name's directory component */
1219 audit_log_format(ab, " name=");
1220 audit_log_n_untrustedstring(ab, n->name_len,
1221 n->name);
1222 }
1223 } else
1224 audit_log_format(ab, " name=(null)");
Amy Griffis73241cc2005-11-03 16:00:25 +00001225
Amy Griffis9c937dc2006-06-08 23:19:31 -04001226 if (n->ino != (unsigned long)-1) {
1227 audit_log_format(ab, " inode=%lu"
1228 " dev=%02x:%02x mode=%#o"
1229 " ouid=%u ogid=%u rdev=%02x:%02x",
1230 n->ino,
1231 MAJOR(n->dev),
1232 MINOR(n->dev),
1233 n->mode,
1234 n->uid,
1235 n->gid,
1236 MAJOR(n->rdev),
1237 MINOR(n->rdev));
1238 }
1239 if (n->osid != 0) {
Steve Grubb1b50eed2006-04-03 14:06:13 -04001240 char *ctx = NULL;
1241 u32 len;
Stephen Smalley1a70cd42006-09-25 23:31:57 -07001242 if (selinux_sid_to_string(
Amy Griffis9c937dc2006-06-08 23:19:31 -04001243 n->osid, &ctx, &len)) {
1244 audit_log_format(ab, " osid=%u", n->osid);
Steve Grubb9c7aa6a2006-03-31 15:22:49 -05001245 call_panic = 2;
Steve Grubb1b50eed2006-04-03 14:06:13 -04001246 } else
1247 audit_log_format(ab, " obj=%s", ctx);
1248 kfree(ctx);
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00001249 }
1250
Linus Torvalds1da177e2005-04-16 15:20:36 -07001251 audit_log_end(ab);
1252 }
Steve Grubb9c7aa6a2006-03-31 15:22:49 -05001253 if (call_panic)
1254 audit_panic("error converting sid to string");
Linus Torvalds1da177e2005-04-16 15:20:36 -07001255}
1256
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001257/**
1258 * audit_free - free a per-task audit context
1259 * @tsk: task whose audit context block to free
1260 *
Al Virofa84cb92006-03-29 20:30:19 -05001261 * Called from copy_process and do_exit
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001262 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001263void audit_free(struct task_struct *tsk)
1264{
1265 struct audit_context *context;
1266
Linus Torvalds1da177e2005-04-16 15:20:36 -07001267 context = audit_get_context(tsk, 0, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001268 if (likely(!context))
1269 return;
1270
1271 /* Check for system calls that do not go through the exit
Daniel Walker9f8dbe92007-10-18 03:06:09 -07001272 * function (e.g., exit_group), then free context block.
1273 * We use GFP_ATOMIC here because we might be doing this
David Woodhousef5561962005-07-13 22:47:07 +01001274 * in the context of the idle thread */
Al Viroe4951492006-03-29 20:17:10 -05001275 /* that can happen only if we are called from do_exit() */
David Woodhousef7056d62005-06-20 16:07:33 +01001276 if (context->in_syscall && context->auditable)
Al Viroe4951492006-03-29 20:17:10 -05001277 audit_log_exit(context, tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001278
1279 audit_free_context(context);
1280}
1281
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001282/**
1283 * audit_syscall_entry - fill in an audit record at syscall entry
1284 * @tsk: task being audited
1285 * @arch: architecture type
1286 * @major: major syscall type (function)
1287 * @a1: additional syscall register 1
1288 * @a2: additional syscall register 2
1289 * @a3: additional syscall register 3
1290 * @a4: additional syscall register 4
1291 *
1292 * Fill in audit context at syscall entry. This only happens if the
Linus Torvalds1da177e2005-04-16 15:20:36 -07001293 * audit context was created when the task was created and the state or
1294 * filters demand the audit context be built. If the state from the
1295 * per-task filter or from the per-syscall filter is AUDIT_RECORD_CONTEXT,
1296 * then the record will be written at syscall exit time (otherwise, it
1297 * will only be written if another part of the kernel requests that it
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001298 * be written).
1299 */
Al Viro5411be52006-03-29 20:23:36 -05001300void audit_syscall_entry(int arch, int major,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001301 unsigned long a1, unsigned long a2,
1302 unsigned long a3, unsigned long a4)
1303{
Al Viro5411be52006-03-29 20:23:36 -05001304 struct task_struct *tsk = current;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001305 struct audit_context *context = tsk->audit_context;
1306 enum audit_state state;
1307
1308 BUG_ON(!context);
1309
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001310 /*
1311 * This happens only on certain architectures that make system
Linus Torvalds1da177e2005-04-16 15:20:36 -07001312 * calls in kernel_thread via the entry.S interface, instead of
1313 * with direct calls. (If you are porting to a new
1314 * architecture, hitting this condition can indicate that you
1315 * got the _exit/_leave calls backward in entry.S.)
1316 *
1317 * i386 no
1318 * x86_64 no
Jon Mason2ef94812006-01-23 10:58:20 -06001319 * ppc64 yes (see arch/powerpc/platforms/iseries/misc.S)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001320 *
1321 * This also happens with vm86 emulation in a non-nested manner
1322 * (entries without exits), so this case must be caught.
1323 */
1324 if (context->in_syscall) {
1325 struct audit_context *newctx;
1326
Linus Torvalds1da177e2005-04-16 15:20:36 -07001327#if AUDIT_DEBUG
1328 printk(KERN_ERR
1329 "audit(:%d) pid=%d in syscall=%d;"
1330 " entering syscall=%d\n",
1331 context->serial, tsk->pid, context->major, major);
1332#endif
1333 newctx = audit_alloc_context(context->state);
1334 if (newctx) {
1335 newctx->previous = context;
1336 context = newctx;
1337 tsk->audit_context = newctx;
1338 } else {
1339 /* If we can't alloc a new context, the best we
1340 * can do is to leak memory (any pending putname
1341 * will be lost). The only other alternative is
1342 * to abandon auditing. */
1343 audit_zero_context(context, context->state);
1344 }
1345 }
1346 BUG_ON(context->in_syscall || context->name_count);
1347
1348 if (!audit_enabled)
1349 return;
1350
2fd6f582005-04-29 16:08:28 +01001351 context->arch = arch;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001352 context->major = major;
1353 context->argv[0] = a1;
1354 context->argv[1] = a2;
1355 context->argv[2] = a3;
1356 context->argv[3] = a4;
1357
1358 state = context->state;
Al Virod51374a2006-08-03 10:59:26 -04001359 context->dummy = !audit_n_rules;
1360 if (!context->dummy && (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT))
David Woodhouse0f45aa12005-06-19 19:35:50 +01001361 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001362 if (likely(state == AUDIT_DISABLED))
1363 return;
1364
David Woodhousece625a82005-07-18 14:24:46 -04001365 context->serial = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001366 context->ctime = CURRENT_TIME;
1367 context->in_syscall = 1;
1368 context->auditable = !!(state == AUDIT_RECORD_CONTEXT);
Alexander Viro419c58f2006-09-29 00:08:50 -04001369 context->ppid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001370}
1371
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001372/**
1373 * audit_syscall_exit - deallocate audit context after a system call
1374 * @tsk: task being audited
1375 * @valid: success/failure flag
1376 * @return_code: syscall return value
1377 *
1378 * Tear down after system call. If the audit context has been marked as
Linus Torvalds1da177e2005-04-16 15:20:36 -07001379 * auditable (either because of the AUDIT_RECORD_CONTEXT state from
1380 * filtering, or because some other part of the kernel write an audit
1381 * message), then write out the syscall information. In call cases,
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001382 * free the names stored from getname().
1383 */
Al Viro5411be52006-03-29 20:23:36 -05001384void audit_syscall_exit(int valid, long return_code)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001385{
Al Viro5411be52006-03-29 20:23:36 -05001386 struct task_struct *tsk = current;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001387 struct audit_context *context;
1388
2fd6f582005-04-29 16:08:28 +01001389 context = audit_get_context(tsk, valid, return_code);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001390
Linus Torvalds1da177e2005-04-16 15:20:36 -07001391 if (likely(!context))
Al Viro97e94c42006-03-29 20:26:24 -05001392 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001393
David Woodhousef7056d62005-06-20 16:07:33 +01001394 if (context->in_syscall && context->auditable)
Al Viroe4951492006-03-29 20:17:10 -05001395 audit_log_exit(context, tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001396
1397 context->in_syscall = 0;
1398 context->auditable = 0;
2fd6f582005-04-29 16:08:28 +01001399
Linus Torvalds1da177e2005-04-16 15:20:36 -07001400 if (context->previous) {
1401 struct audit_context *new_context = context->previous;
1402 context->previous = NULL;
1403 audit_free_context(context);
1404 tsk->audit_context = new_context;
1405 } else {
1406 audit_free_names(context);
Al Viro74c3cbe2007-07-22 08:04:18 -04001407 unroll_tree_refs(context, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001408 audit_free_aux(context);
Amy Griffise54dc242007-03-29 18:01:04 -04001409 context->aux = NULL;
1410 context->aux_pids = NULL;
Al Viroa5cb0132007-03-20 13:58:35 -04001411 context->target_pid = 0;
Amy Griffise54dc242007-03-29 18:01:04 -04001412 context->target_sid = 0;
Amy Griffis5adc8a62006-06-14 18:45:21 -04001413 kfree(context->filterkey);
1414 context->filterkey = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001415 tsk->audit_context = context;
1416 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001417}
1418
Al Viro74c3cbe2007-07-22 08:04:18 -04001419static inline void handle_one(const struct inode *inode)
1420{
1421#ifdef CONFIG_AUDIT_TREE
1422 struct audit_context *context;
1423 struct audit_tree_refs *p;
1424 struct audit_chunk *chunk;
1425 int count;
1426 if (likely(list_empty(&inode->inotify_watches)))
1427 return;
1428 context = current->audit_context;
1429 p = context->trees;
1430 count = context->tree_count;
1431 rcu_read_lock();
1432 chunk = audit_tree_lookup(inode);
1433 rcu_read_unlock();
1434 if (!chunk)
1435 return;
1436 if (likely(put_tree_ref(context, chunk)))
1437 return;
1438 if (unlikely(!grow_tree_refs(context))) {
1439 printk(KERN_WARNING "out of memory, audit has lost a tree reference");
1440 audit_set_auditable(context);
1441 audit_put_chunk(chunk);
1442 unroll_tree_refs(context, p, count);
1443 return;
1444 }
1445 put_tree_ref(context, chunk);
1446#endif
1447}
1448
1449static void handle_path(const struct dentry *dentry)
1450{
1451#ifdef CONFIG_AUDIT_TREE
1452 struct audit_context *context;
1453 struct audit_tree_refs *p;
1454 const struct dentry *d, *parent;
1455 struct audit_chunk *drop;
1456 unsigned long seq;
1457 int count;
1458
1459 context = current->audit_context;
1460 p = context->trees;
1461 count = context->tree_count;
1462retry:
1463 drop = NULL;
1464 d = dentry;
1465 rcu_read_lock();
1466 seq = read_seqbegin(&rename_lock);
1467 for(;;) {
1468 struct inode *inode = d->d_inode;
1469 if (inode && unlikely(!list_empty(&inode->inotify_watches))) {
1470 struct audit_chunk *chunk;
1471 chunk = audit_tree_lookup(inode);
1472 if (chunk) {
1473 if (unlikely(!put_tree_ref(context, chunk))) {
1474 drop = chunk;
1475 break;
1476 }
1477 }
1478 }
1479 parent = d->d_parent;
1480 if (parent == d)
1481 break;
1482 d = parent;
1483 }
1484 if (unlikely(read_seqretry(&rename_lock, seq) || drop)) { /* in this order */
1485 rcu_read_unlock();
1486 if (!drop) {
1487 /* just a race with rename */
1488 unroll_tree_refs(context, p, count);
1489 goto retry;
1490 }
1491 audit_put_chunk(drop);
1492 if (grow_tree_refs(context)) {
1493 /* OK, got more space */
1494 unroll_tree_refs(context, p, count);
1495 goto retry;
1496 }
1497 /* too bad */
1498 printk(KERN_WARNING
1499 "out of memory, audit has lost a tree reference");
1500 unroll_tree_refs(context, p, count);
1501 audit_set_auditable(context);
1502 return;
1503 }
1504 rcu_read_unlock();
1505#endif
1506}
1507
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001508/**
1509 * audit_getname - add a name to the list
1510 * @name: name to add
1511 *
1512 * Add a name to the list of audit names for this context.
1513 * Called from fs/namei.c:getname().
1514 */
Al Virod8945bb52006-05-18 16:01:30 -04001515void __audit_getname(const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001516{
1517 struct audit_context *context = current->audit_context;
1518
Al Virod8945bb52006-05-18 16:01:30 -04001519 if (IS_ERR(name) || !name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001520 return;
1521
1522 if (!context->in_syscall) {
1523#if AUDIT_DEBUG == 2
1524 printk(KERN_ERR "%s:%d(:%d): ignoring getname(%p)\n",
1525 __FILE__, __LINE__, context->serial, name);
1526 dump_stack();
1527#endif
1528 return;
1529 }
1530 BUG_ON(context->name_count >= AUDIT_NAMES);
1531 context->names[context->name_count].name = name;
Amy Griffis9c937dc2006-06-08 23:19:31 -04001532 context->names[context->name_count].name_len = AUDIT_NAME_FULL;
1533 context->names[context->name_count].name_put = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001534 context->names[context->name_count].ino = (unsigned long)-1;
Amy Griffise41e8bd2007-02-13 14:14:09 -05001535 context->names[context->name_count].osid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001536 ++context->name_count;
David Woodhouse8f37d472005-05-27 12:17:28 +01001537 if (!context->pwd) {
1538 read_lock(&current->fs->lock);
1539 context->pwd = dget(current->fs->pwd);
1540 context->pwdmnt = mntget(current->fs->pwdmnt);
1541 read_unlock(&current->fs->lock);
1542 }
Daniel Walker9f8dbe92007-10-18 03:06:09 -07001543
Linus Torvalds1da177e2005-04-16 15:20:36 -07001544}
1545
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001546/* audit_putname - intercept a putname request
1547 * @name: name to intercept and delay for putname
1548 *
1549 * If we have stored the name from getname in the audit context,
1550 * then we delay the putname until syscall exit.
1551 * Called from include/linux/fs.h:putname().
1552 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001553void audit_putname(const char *name)
1554{
1555 struct audit_context *context = current->audit_context;
1556
1557 BUG_ON(!context);
1558 if (!context->in_syscall) {
1559#if AUDIT_DEBUG == 2
1560 printk(KERN_ERR "%s:%d(:%d): __putname(%p)\n",
1561 __FILE__, __LINE__, context->serial, name);
1562 if (context->name_count) {
1563 int i;
1564 for (i = 0; i < context->name_count; i++)
1565 printk(KERN_ERR "name[%d] = %p = %s\n", i,
1566 context->names[i].name,
Amy Griffis73241cc2005-11-03 16:00:25 +00001567 context->names[i].name ?: "(null)");
Linus Torvalds1da177e2005-04-16 15:20:36 -07001568 }
1569#endif
1570 __putname(name);
1571 }
1572#if AUDIT_DEBUG
1573 else {
1574 ++context->put_count;
1575 if (context->put_count > context->name_count) {
1576 printk(KERN_ERR "%s:%d(:%d): major=%d"
1577 " in_syscall=%d putname(%p) name_count=%d"
1578 " put_count=%d\n",
1579 __FILE__, __LINE__,
1580 context->serial, context->major,
1581 context->in_syscall, name, context->name_count,
1582 context->put_count);
1583 dump_stack();
1584 }
1585 }
1586#endif
1587}
1588
Amy Griffis5712e882007-02-13 14:15:22 -05001589static int audit_inc_name_count(struct audit_context *context,
1590 const struct inode *inode)
1591{
1592 if (context->name_count >= AUDIT_NAMES) {
1593 if (inode)
1594 printk(KERN_DEBUG "name_count maxed, losing inode data: "
1595 "dev=%02x:%02x, inode=%lu",
1596 MAJOR(inode->i_sb->s_dev),
1597 MINOR(inode->i_sb->s_dev),
1598 inode->i_ino);
1599
1600 else
1601 printk(KERN_DEBUG "name_count maxed, losing inode data");
1602 return 1;
1603 }
1604 context->name_count++;
1605#if AUDIT_DEBUG
1606 context->ino_count++;
1607#endif
1608 return 0;
1609}
1610
Amy Griffis3e2efce2006-07-13 13:16:02 -04001611/* Copy inode data into an audit_names. */
1612static void audit_copy_inode(struct audit_names *name, const struct inode *inode)
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00001613{
Amy Griffis3e2efce2006-07-13 13:16:02 -04001614 name->ino = inode->i_ino;
1615 name->dev = inode->i_sb->s_dev;
1616 name->mode = inode->i_mode;
1617 name->uid = inode->i_uid;
1618 name->gid = inode->i_gid;
1619 name->rdev = inode->i_rdev;
1620 selinux_get_inode_sid(inode, &name->osid);
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00001621}
1622
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001623/**
1624 * audit_inode - store the inode and device from a lookup
1625 * @name: name being audited
Randy Dunlap481968f2007-10-21 20:59:53 -07001626 * @dentry: dentry being audited
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001627 *
1628 * Called from fs/namei.c:path_lookup().
1629 */
Al Viro5a190ae2007-06-07 12:19:32 -04001630void __audit_inode(const char *name, const struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001631{
1632 int idx;
1633 struct audit_context *context = current->audit_context;
Al Viro74c3cbe2007-07-22 08:04:18 -04001634 const struct inode *inode = dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001635
1636 if (!context->in_syscall)
1637 return;
1638 if (context->name_count
1639 && context->names[context->name_count-1].name
1640 && context->names[context->name_count-1].name == name)
1641 idx = context->name_count - 1;
1642 else if (context->name_count > 1
1643 && context->names[context->name_count-2].name
1644 && context->names[context->name_count-2].name == name)
1645 idx = context->name_count - 2;
1646 else {
1647 /* FIXME: how much do we care about inodes that have no
1648 * associated name? */
Amy Griffis5712e882007-02-13 14:15:22 -05001649 if (audit_inc_name_count(context, inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07001650 return;
Amy Griffis5712e882007-02-13 14:15:22 -05001651 idx = context->name_count - 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001652 context->names[idx].name = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001653 }
Al Viro74c3cbe2007-07-22 08:04:18 -04001654 handle_path(dentry);
Amy Griffis3e2efce2006-07-13 13:16:02 -04001655 audit_copy_inode(&context->names[idx], inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001656}
1657
Amy Griffis73241cc2005-11-03 16:00:25 +00001658/**
1659 * audit_inode_child - collect inode info for created/removed objects
1660 * @dname: inode's dentry name
Randy Dunlap481968f2007-10-21 20:59:53 -07001661 * @dentry: dentry being audited
Amy Griffis73d3ec52006-07-13 13:16:39 -04001662 * @parent: inode of dentry parent
Amy Griffis73241cc2005-11-03 16:00:25 +00001663 *
1664 * For syscalls that create or remove filesystem objects, audit_inode
1665 * can only collect information for the filesystem object's parent.
1666 * This call updates the audit context with the child's information.
1667 * Syscalls that create a new filesystem object must be hooked after
1668 * the object is created. Syscalls that remove a filesystem object
1669 * must be hooked prior, in order to capture the target inode during
1670 * unsuccessful attempts.
1671 */
Al Viro5a190ae2007-06-07 12:19:32 -04001672void __audit_inode_child(const char *dname, const struct dentry *dentry,
Amy Griffis73d3ec52006-07-13 13:16:39 -04001673 const struct inode *parent)
Amy Griffis73241cc2005-11-03 16:00:25 +00001674{
1675 int idx;
1676 struct audit_context *context = current->audit_context;
Amy Griffis5712e882007-02-13 14:15:22 -05001677 const char *found_parent = NULL, *found_child = NULL;
Al Viro5a190ae2007-06-07 12:19:32 -04001678 const struct inode *inode = dentry->d_inode;
Amy Griffis9c937dc2006-06-08 23:19:31 -04001679 int dirlen = 0;
Amy Griffis73241cc2005-11-03 16:00:25 +00001680
1681 if (!context->in_syscall)
1682 return;
1683
Al Viro74c3cbe2007-07-22 08:04:18 -04001684 if (inode)
1685 handle_one(inode);
Amy Griffis73241cc2005-11-03 16:00:25 +00001686 /* determine matching parent */
Amy Griffisf368c07d2006-04-07 16:55:56 -04001687 if (!dname)
Amy Griffis5712e882007-02-13 14:15:22 -05001688 goto add_names;
Amy Griffis73241cc2005-11-03 16:00:25 +00001689
Amy Griffis5712e882007-02-13 14:15:22 -05001690 /* parent is more likely, look for it first */
1691 for (idx = 0; idx < context->name_count; idx++) {
1692 struct audit_names *n = &context->names[idx];
Amy Griffis73241cc2005-11-03 16:00:25 +00001693
Amy Griffis5712e882007-02-13 14:15:22 -05001694 if (!n->name)
1695 continue;
1696
1697 if (n->ino == parent->i_ino &&
1698 !audit_compare_dname_path(dname, n->name, &dirlen)) {
1699 n->name_len = dirlen; /* update parent data in place */
1700 found_parent = n->name;
1701 goto add_names;
Amy Griffisf368c07d2006-04-07 16:55:56 -04001702 }
Steve Grubbac9910c2006-09-28 14:31:32 -04001703 }
Amy Griffis73241cc2005-11-03 16:00:25 +00001704
Amy Griffis5712e882007-02-13 14:15:22 -05001705 /* no matching parent, look for matching child */
1706 for (idx = 0; idx < context->name_count; idx++) {
1707 struct audit_names *n = &context->names[idx];
Amy Griffis73d3ec52006-07-13 13:16:39 -04001708
Amy Griffis5712e882007-02-13 14:15:22 -05001709 if (!n->name)
1710 continue;
1711
1712 /* strcmp() is the more likely scenario */
1713 if (!strcmp(dname, n->name) ||
1714 !audit_compare_dname_path(dname, n->name, &dirlen)) {
1715 if (inode)
1716 audit_copy_inode(n, inode);
1717 else
1718 n->ino = (unsigned long)-1;
1719 found_child = n->name;
1720 goto add_names;
Steve Grubbac9910c2006-09-28 14:31:32 -04001721 }
Amy Griffis5712e882007-02-13 14:15:22 -05001722 }
1723
1724add_names:
1725 if (!found_parent) {
1726 if (audit_inc_name_count(context, parent))
1727 return;
1728 idx = context->name_count - 1;
1729 context->names[idx].name = NULL;
Amy Griffis73d3ec52006-07-13 13:16:39 -04001730 audit_copy_inode(&context->names[idx], parent);
1731 }
Amy Griffis5712e882007-02-13 14:15:22 -05001732
1733 if (!found_child) {
1734 if (audit_inc_name_count(context, inode))
1735 return;
1736 idx = context->name_count - 1;
1737
1738 /* Re-use the name belonging to the slot for a matching parent
1739 * directory. All names for this context are relinquished in
1740 * audit_free_names() */
1741 if (found_parent) {
1742 context->names[idx].name = found_parent;
1743 context->names[idx].name_len = AUDIT_NAME_FULL;
1744 /* don't call __putname() */
1745 context->names[idx].name_put = 0;
1746 } else {
1747 context->names[idx].name = NULL;
1748 }
1749
1750 if (inode)
1751 audit_copy_inode(&context->names[idx], inode);
1752 else
1753 context->names[idx].ino = (unsigned long)-1;
1754 }
Amy Griffis3e2efce2006-07-13 13:16:02 -04001755}
Trond Myklebust50e437d2007-06-07 22:44:34 -04001756EXPORT_SYMBOL_GPL(__audit_inode_child);
Amy Griffis3e2efce2006-07-13 13:16:02 -04001757
1758/**
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001759 * auditsc_get_stamp - get local copies of audit_context values
1760 * @ctx: audit_context for the task
1761 * @t: timespec to store time recorded in the audit_context
1762 * @serial: serial value that is recorded in the audit_context
1763 *
1764 * Also sets the context as auditable.
1765 */
David Woodhousebfb44962005-05-21 21:08:09 +01001766void auditsc_get_stamp(struct audit_context *ctx,
1767 struct timespec *t, unsigned int *serial)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001768{
David Woodhousece625a82005-07-18 14:24:46 -04001769 if (!ctx->serial)
1770 ctx->serial = audit_serial();
David Woodhousebfb44962005-05-21 21:08:09 +01001771 t->tv_sec = ctx->ctime.tv_sec;
1772 t->tv_nsec = ctx->ctime.tv_nsec;
1773 *serial = ctx->serial;
1774 ctx->auditable = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001775}
1776
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001777/**
1778 * audit_set_loginuid - set a task's audit_context loginuid
1779 * @task: task whose audit context is being modified
1780 * @loginuid: loginuid value
1781 *
1782 * Returns 0.
1783 *
1784 * Called (set) from fs/proc/base.c::proc_loginuid_write().
1785 */
Steve Grubb456be6c2005-04-29 17:30:07 +01001786int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001787{
Steve Grubb41757102006-06-12 07:48:28 -04001788 struct audit_context *context = task->audit_context;
Steve Grubbc0404992005-05-13 18:17:42 +01001789
Al Virobfef93a2008-01-10 04:53:18 -05001790 if (context && context->in_syscall) {
1791 struct audit_buffer *ab;
Steve Grubb41757102006-06-12 07:48:28 -04001792
Al Virobfef93a2008-01-10 04:53:18 -05001793 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
1794 if (ab) {
1795 audit_log_format(ab, "login pid=%d uid=%u "
1796 "old auid=%u new auid=%u",
1797 task->pid, task->uid,
1798 task->loginuid, loginuid);
1799 audit_log_end(ab);
Steve Grubbc0404992005-05-13 18:17:42 +01001800 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001801 }
Al Virobfef93a2008-01-10 04:53:18 -05001802 task->loginuid = loginuid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001803 return 0;
1804}
1805
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07001806/**
George C. Wilson20ca73b2006-05-24 16:09:55 -05001807 * __audit_mq_open - record audit data for a POSIX MQ open
1808 * @oflag: open flag
1809 * @mode: mode bits
1810 * @u_attr: queue attributes
1811 *
1812 * Returns 0 for success or NULL context or < 0 on error.
1813 */
1814int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr)
1815{
1816 struct audit_aux_data_mq_open *ax;
1817 struct audit_context *context = current->audit_context;
1818
1819 if (!audit_enabled)
1820 return 0;
1821
1822 if (likely(!context))
1823 return 0;
1824
1825 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
1826 if (!ax)
1827 return -ENOMEM;
1828
1829 if (u_attr != NULL) {
1830 if (copy_from_user(&ax->attr, u_attr, sizeof(ax->attr))) {
1831 kfree(ax);
1832 return -EFAULT;
1833 }
1834 } else
1835 memset(&ax->attr, 0, sizeof(ax->attr));
1836
1837 ax->oflag = oflag;
1838 ax->mode = mode;
1839
1840 ax->d.type = AUDIT_MQ_OPEN;
1841 ax->d.next = context->aux;
1842 context->aux = (void *)ax;
1843 return 0;
1844}
1845
1846/**
1847 * __audit_mq_timedsend - record audit data for a POSIX MQ timed send
1848 * @mqdes: MQ descriptor
1849 * @msg_len: Message length
1850 * @msg_prio: Message priority
Randy Dunlap1dbe83c2006-06-27 02:54:01 -07001851 * @u_abs_timeout: Message timeout in absolute time
George C. Wilson20ca73b2006-05-24 16:09:55 -05001852 *
1853 * Returns 0 for success or NULL context or < 0 on error.
1854 */
1855int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio,
1856 const struct timespec __user *u_abs_timeout)
1857{
1858 struct audit_aux_data_mq_sendrecv *ax;
1859 struct audit_context *context = current->audit_context;
1860
1861 if (!audit_enabled)
1862 return 0;
1863
1864 if (likely(!context))
1865 return 0;
1866
1867 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
1868 if (!ax)
1869 return -ENOMEM;
1870
1871 if (u_abs_timeout != NULL) {
1872 if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) {
1873 kfree(ax);
1874 return -EFAULT;
1875 }
1876 } else
1877 memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout));
1878
1879 ax->mqdes = mqdes;
1880 ax->msg_len = msg_len;
1881 ax->msg_prio = msg_prio;
1882
1883 ax->d.type = AUDIT_MQ_SENDRECV;
1884 ax->d.next = context->aux;
1885 context->aux = (void *)ax;
1886 return 0;
1887}
1888
1889/**
1890 * __audit_mq_timedreceive - record audit data for a POSIX MQ timed receive
1891 * @mqdes: MQ descriptor
1892 * @msg_len: Message length
Randy Dunlap1dbe83c2006-06-27 02:54:01 -07001893 * @u_msg_prio: Message priority
1894 * @u_abs_timeout: Message timeout in absolute time
George C. Wilson20ca73b2006-05-24 16:09:55 -05001895 *
1896 * Returns 0 for success or NULL context or < 0 on error.
1897 */
1898int __audit_mq_timedreceive(mqd_t mqdes, size_t msg_len,
1899 unsigned int __user *u_msg_prio,
1900 const struct timespec __user *u_abs_timeout)
1901{
1902 struct audit_aux_data_mq_sendrecv *ax;
1903 struct audit_context *context = current->audit_context;
1904
1905 if (!audit_enabled)
1906 return 0;
1907
1908 if (likely(!context))
1909 return 0;
1910
1911 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
1912 if (!ax)
1913 return -ENOMEM;
1914
1915 if (u_msg_prio != NULL) {
1916 if (get_user(ax->msg_prio, u_msg_prio)) {
1917 kfree(ax);
1918 return -EFAULT;
1919 }
1920 } else
1921 ax->msg_prio = 0;
1922
1923 if (u_abs_timeout != NULL) {
1924 if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) {
1925 kfree(ax);
1926 return -EFAULT;
1927 }
1928 } else
1929 memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout));
1930
1931 ax->mqdes = mqdes;
1932 ax->msg_len = msg_len;
1933
1934 ax->d.type = AUDIT_MQ_SENDRECV;
1935 ax->d.next = context->aux;
1936 context->aux = (void *)ax;
1937 return 0;
1938}
1939
1940/**
1941 * __audit_mq_notify - record audit data for a POSIX MQ notify
1942 * @mqdes: MQ descriptor
1943 * @u_notification: Notification event
1944 *
1945 * Returns 0 for success or NULL context or < 0 on error.
1946 */
1947
1948int __audit_mq_notify(mqd_t mqdes, const struct sigevent __user *u_notification)
1949{
1950 struct audit_aux_data_mq_notify *ax;
1951 struct audit_context *context = current->audit_context;
1952
1953 if (!audit_enabled)
1954 return 0;
1955
1956 if (likely(!context))
1957 return 0;
1958
1959 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
1960 if (!ax)
1961 return -ENOMEM;
1962
1963 if (u_notification != NULL) {
1964 if (copy_from_user(&ax->notification, u_notification, sizeof(ax->notification))) {
1965 kfree(ax);
1966 return -EFAULT;
1967 }
1968 } else
1969 memset(&ax->notification, 0, sizeof(ax->notification));
1970
1971 ax->mqdes = mqdes;
1972
1973 ax->d.type = AUDIT_MQ_NOTIFY;
1974 ax->d.next = context->aux;
1975 context->aux = (void *)ax;
1976 return 0;
1977}
1978
1979/**
1980 * __audit_mq_getsetattr - record audit data for a POSIX MQ get/set attribute
1981 * @mqdes: MQ descriptor
1982 * @mqstat: MQ flags
1983 *
1984 * Returns 0 for success or NULL context or < 0 on error.
1985 */
1986int __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
1987{
1988 struct audit_aux_data_mq_getsetattr *ax;
1989 struct audit_context *context = current->audit_context;
1990
1991 if (!audit_enabled)
1992 return 0;
1993
1994 if (likely(!context))
1995 return 0;
1996
1997 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
1998 if (!ax)
1999 return -ENOMEM;
2000
2001 ax->mqdes = mqdes;
2002 ax->mqstat = *mqstat;
2003
2004 ax->d.type = AUDIT_MQ_GETSETATTR;
2005 ax->d.next = context->aux;
2006 context->aux = (void *)ax;
2007 return 0;
2008}
2009
2010/**
Steve Grubb073115d2006-04-02 17:07:33 -04002011 * audit_ipc_obj - record audit data for ipc object
2012 * @ipcp: ipc permissions
2013 *
2014 * Returns 0 for success or NULL context or < 0 on error.
2015 */
Al Virod8945bb52006-05-18 16:01:30 -04002016int __audit_ipc_obj(struct kern_ipc_perm *ipcp)
Steve Grubb073115d2006-04-02 17:07:33 -04002017{
2018 struct audit_aux_data_ipcctl *ax;
2019 struct audit_context *context = current->audit_context;
2020
Steve Grubb073115d2006-04-02 17:07:33 -04002021 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
2022 if (!ax)
2023 return -ENOMEM;
2024
2025 ax->uid = ipcp->uid;
2026 ax->gid = ipcp->gid;
2027 ax->mode = ipcp->mode;
2028 selinux_get_ipc_sid(ipcp, &ax->osid);
2029
2030 ax->d.type = AUDIT_IPC;
2031 ax->d.next = context->aux;
2032 context->aux = (void *)ax;
2033 return 0;
2034}
2035
2036/**
2037 * audit_ipc_set_perm - record audit data for new ipc permissions
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07002038 * @qbytes: msgq bytes
2039 * @uid: msgq user id
2040 * @gid: msgq group id
2041 * @mode: msgq mode (permissions)
2042 *
2043 * Returns 0 for success or NULL context or < 0 on error.
2044 */
Al Virod8945bb52006-05-18 16:01:30 -04002045int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002046{
2047 struct audit_aux_data_ipcctl *ax;
2048 struct audit_context *context = current->audit_context;
2049
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00002050 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002051 if (!ax)
2052 return -ENOMEM;
2053
2054 ax->qbytes = qbytes;
2055 ax->uid = uid;
2056 ax->gid = gid;
2057 ax->mode = mode;
2058
Steve Grubb073115d2006-04-02 17:07:33 -04002059 ax->d.type = AUDIT_IPC_SET_PERM;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002060 ax->d.next = context->aux;
2061 context->aux = (void *)ax;
2062 return 0;
2063}
Steve Grubbc2f0c7c2005-05-06 12:38:39 +01002064
Peter Zijlstrabdf4c482007-07-19 01:48:15 -07002065int audit_argv_kb = 32;
2066
Al Viro473ae302006-04-26 14:04:08 -04002067int audit_bprm(struct linux_binprm *bprm)
2068{
2069 struct audit_aux_data_execve *ax;
2070 struct audit_context *context = current->audit_context;
Al Viro473ae302006-04-26 14:04:08 -04002071
Al Viro5ac3a9c2006-07-16 06:38:45 -04002072 if (likely(!audit_enabled || !context || context->dummy))
Al Viro473ae302006-04-26 14:04:08 -04002073 return 0;
2074
Peter Zijlstrabdf4c482007-07-19 01:48:15 -07002075 /*
2076 * Even though the stack code doesn't limit the arg+env size any more,
2077 * the audit code requires that _all_ arguments be logged in a single
2078 * netlink skb. Hence cap it :-(
2079 */
2080 if (bprm->argv_len > (audit_argv_kb << 10))
2081 return -E2BIG;
2082
2083 ax = kmalloc(sizeof(*ax), GFP_KERNEL);
Al Viro473ae302006-04-26 14:04:08 -04002084 if (!ax)
2085 return -ENOMEM;
2086
2087 ax->argc = bprm->argc;
2088 ax->envc = bprm->envc;
Peter Zijlstrabdf4c482007-07-19 01:48:15 -07002089 ax->mm = bprm->mm;
Al Viro473ae302006-04-26 14:04:08 -04002090 ax->d.type = AUDIT_EXECVE;
2091 ax->d.next = context->aux;
2092 context->aux = (void *)ax;
2093 return 0;
2094}
2095
2096
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07002097/**
2098 * audit_socketcall - record audit data for sys_socketcall
2099 * @nargs: number of args
2100 * @args: args array
2101 *
2102 * Returns 0 for success or NULL context or < 0 on error.
2103 */
David Woodhouse3ec3b2f2005-05-17 12:08:48 +01002104int audit_socketcall(int nargs, unsigned long *args)
2105{
2106 struct audit_aux_data_socketcall *ax;
2107 struct audit_context *context = current->audit_context;
2108
Al Viro5ac3a9c2006-07-16 06:38:45 -04002109 if (likely(!context || context->dummy))
David Woodhouse3ec3b2f2005-05-17 12:08:48 +01002110 return 0;
2111
2112 ax = kmalloc(sizeof(*ax) + nargs * sizeof(unsigned long), GFP_KERNEL);
2113 if (!ax)
2114 return -ENOMEM;
2115
2116 ax->nargs = nargs;
2117 memcpy(ax->args, args, nargs * sizeof(unsigned long));
2118
2119 ax->d.type = AUDIT_SOCKETCALL;
2120 ax->d.next = context->aux;
2121 context->aux = (void *)ax;
2122 return 0;
2123}
2124
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07002125/**
Al Virodb349502007-02-07 01:48:00 -05002126 * __audit_fd_pair - record audit data for pipe and socketpair
2127 * @fd1: the first file descriptor
2128 * @fd2: the second file descriptor
2129 *
2130 * Returns 0 for success or NULL context or < 0 on error.
2131 */
2132int __audit_fd_pair(int fd1, int fd2)
2133{
2134 struct audit_context *context = current->audit_context;
2135 struct audit_aux_data_fd_pair *ax;
2136
2137 if (likely(!context)) {
2138 return 0;
2139 }
2140
2141 ax = kmalloc(sizeof(*ax), GFP_KERNEL);
2142 if (!ax) {
2143 return -ENOMEM;
2144 }
2145
2146 ax->fd[0] = fd1;
2147 ax->fd[1] = fd2;
2148
2149 ax->d.type = AUDIT_FD_PAIR;
2150 ax->d.next = context->aux;
2151 context->aux = (void *)ax;
2152 return 0;
2153}
2154
2155/**
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07002156 * audit_sockaddr - record audit data for sys_bind, sys_connect, sys_sendto
2157 * @len: data length in user space
2158 * @a: data address in kernel space
2159 *
2160 * Returns 0 for success or NULL context or < 0 on error.
2161 */
David Woodhouse3ec3b2f2005-05-17 12:08:48 +01002162int audit_sockaddr(int len, void *a)
2163{
2164 struct audit_aux_data_sockaddr *ax;
2165 struct audit_context *context = current->audit_context;
2166
Al Viro5ac3a9c2006-07-16 06:38:45 -04002167 if (likely(!context || context->dummy))
David Woodhouse3ec3b2f2005-05-17 12:08:48 +01002168 return 0;
2169
2170 ax = kmalloc(sizeof(*ax) + len, GFP_KERNEL);
2171 if (!ax)
2172 return -ENOMEM;
2173
2174 ax->len = len;
2175 memcpy(ax->a, a, len);
2176
2177 ax->d.type = AUDIT_SOCKADDR;
2178 ax->d.next = context->aux;
2179 context->aux = (void *)ax;
2180 return 0;
2181}
2182
Al Viroa5cb0132007-03-20 13:58:35 -04002183void __audit_ptrace(struct task_struct *t)
2184{
2185 struct audit_context *context = current->audit_context;
2186
2187 context->target_pid = t->pid;
2188 selinux_get_task_sid(t, &context->target_sid);
2189}
2190
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07002191/**
Randy Dunlapb0dd25a2005-09-13 12:47:11 -07002192 * audit_signal_info - record signal info for shutting down audit subsystem
2193 * @sig: signal value
2194 * @t: task being signaled
2195 *
2196 * If the audit subsystem is being terminated, record the task (pid)
2197 * and uid that is doing that.
2198 */
Amy Griffise54dc242007-03-29 18:01:04 -04002199int __audit_signal_info(int sig, struct task_struct *t)
Steve Grubbc2f0c7c2005-05-06 12:38:39 +01002200{
Amy Griffise54dc242007-03-29 18:01:04 -04002201 struct audit_aux_data_pids *axp;
2202 struct task_struct *tsk = current;
2203 struct audit_context *ctx = tsk->audit_context;
Steve Grubbc2f0c7c2005-05-06 12:38:39 +01002204 extern pid_t audit_sig_pid;
2205 extern uid_t audit_sig_uid;
Al Viroe1396062006-05-25 10:19:47 -04002206 extern u32 audit_sig_sid;
Steve Grubbc2f0c7c2005-05-06 12:38:39 +01002207
Al Viro175fc482007-08-08 00:01:46 +01002208 if (audit_pid && t->tgid == audit_pid) {
2209 if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1) {
2210 audit_sig_pid = tsk->pid;
Al Virobfef93a2008-01-10 04:53:18 -05002211 if (tsk->loginuid != -1)
2212 audit_sig_uid = tsk->loginuid;
Al Viro175fc482007-08-08 00:01:46 +01002213 else
2214 audit_sig_uid = tsk->uid;
2215 selinux_get_task_sid(tsk, &audit_sig_sid);
2216 }
2217 if (!audit_signals || audit_dummy_context())
2218 return 0;
Steve Grubbc2f0c7c2005-05-06 12:38:39 +01002219 }
Amy Griffise54dc242007-03-29 18:01:04 -04002220
Amy Griffise54dc242007-03-29 18:01:04 -04002221 /* optimize the common case by putting first signal recipient directly
2222 * in audit_context */
2223 if (!ctx->target_pid) {
2224 ctx->target_pid = t->tgid;
2225 selinux_get_task_sid(t, &ctx->target_sid);
2226 return 0;
2227 }
2228
2229 axp = (void *)ctx->aux_pids;
2230 if (!axp || axp->pid_count == AUDIT_AUX_PIDS) {
2231 axp = kzalloc(sizeof(*axp), GFP_ATOMIC);
2232 if (!axp)
2233 return -ENOMEM;
2234
2235 axp->d.type = AUDIT_OBJ_PID;
2236 axp->d.next = ctx->aux_pids;
2237 ctx->aux_pids = (void *)axp;
2238 }
Adrian Bunk88ae7042007-08-22 14:01:05 -07002239 BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
Amy Griffise54dc242007-03-29 18:01:04 -04002240
2241 axp->target_pid[axp->pid_count] = t->tgid;
2242 selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]);
2243 axp->pid_count++;
2244
2245 return 0;
Steve Grubbc2f0c7c2005-05-06 12:38:39 +01002246}
Steve Grubb0a4ff8c2007-04-19 10:28:21 -04002247
2248/**
2249 * audit_core_dumps - record information about processes that end abnormally
Henrik Kretzschmar6d9525b2007-07-15 23:41:10 -07002250 * @signr: signal value
Steve Grubb0a4ff8c2007-04-19 10:28:21 -04002251 *
2252 * If a process ends with a core dump, something fishy is going on and we
2253 * should record the event for investigation.
2254 */
2255void audit_core_dumps(long signr)
2256{
2257 struct audit_buffer *ab;
2258 u32 sid;
2259
2260 if (!audit_enabled)
2261 return;
2262
2263 if (signr == SIGQUIT) /* don't care for those */
2264 return;
2265
2266 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
2267 audit_log_format(ab, "auid=%u uid=%u gid=%u",
Al Viro0c11b942008-01-10 04:20:52 -05002268 audit_get_loginuid(current),
Steve Grubb0a4ff8c2007-04-19 10:28:21 -04002269 current->uid, current->gid);
2270 selinux_get_task_sid(current, &sid);
2271 if (sid) {
2272 char *ctx = NULL;
2273 u32 len;
2274
2275 if (selinux_sid_to_string(sid, &ctx, &len))
2276 audit_log_format(ab, " ssid=%u", sid);
2277 else
2278 audit_log_format(ab, " subj=%s", ctx);
2279 kfree(ctx);
2280 }
2281 audit_log_format(ab, " pid=%d comm=", current->pid);
2282 audit_log_untrustedstring(ab, current->comm);
2283 audit_log_format(ab, " sig=%ld", signr);
2284 audit_log_end(ab);
2285}