1 /* audit.c -- Auditing support 2 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon. 3 * System-call specific features have moved to auditsc.c 4 * 5 * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina. 6 * All Rights Reserved. 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 * Written by Rickard E. (Rik) Faith <faith@redhat.com> 23 * 24 * Goals: 1) Integrate fully with SELinux. 25 * 2) Minimal run-time overhead: 26 * a) Minimal when syscall auditing is disabled (audit_enable=0). 27 * b) Small when syscall auditing is enabled and no audit record 28 * is generated (defer as much work as possible to record 29 * generation time): 30 * i) context is allocated, 31 * ii) names from getname are stored without a copy, and 32 * iii) inode information stored from path_lookup. 33 * 3) Ability to disable syscall auditing at boot time (audit=0). 34 * 4) Usable by other parts of the kernel (if audit_log* is called, 35 * then a syscall record will be generated automatically for the 36 * current syscall). 37 * 5) Netlink interface to user-space. 38 * 6) Support low-overhead kernel-based filtering to minimize the 39 * information that must be passed to user-space. 40 * 41 * Example user-space utilities: http://people.redhat.com/sgrubb/audit/ 42 */ 43 44 #include <linux/init.h> 45 #include <asm/types.h> 46 #include <asm/atomic.h> 47 #include <linux/mm.h> 48 #include <linux/module.h> 49 #include <linux/err.h> 50 #include <linux/kthread.h> 51 52 #include <linux/audit.h> 53 54 #include <net/sock.h> 55 #include <net/netlink.h> 56 #include <linux/skbuff.h> 57 #include <linux/netlink.h> 58 #include <linux/selinux.h> 59 #include <linux/inotify.h> 60 #include <linux/freezer.h> 61 #include <linux/tty.h> 62 63 #include "audit.h" 64 65 /* No auditing will take place until audit_initialized != 0. 66 * (Initialization happens after skb_init is called.) */ 67 static int audit_initialized; 68 69 /* 0 - no auditing 70 * 1 - auditing enabled 71 * 2 - auditing enabled and configuration is locked/unchangeable. */ 72 int audit_enabled; 73 74 /* Default state when kernel boots without any parameters. */ 75 static int audit_default; 76 77 /* If auditing cannot proceed, audit_failure selects what happens. */ 78 static int audit_failure = AUDIT_FAIL_PRINTK; 79 80 /* If audit records are to be written to the netlink socket, audit_pid 81 * contains the (non-zero) pid. */ 82 int audit_pid; 83 84 /* If audit_rate_limit is non-zero, limit the rate of sending audit records 85 * to that number per second. This prevents DoS attacks, but results in 86 * audit records being dropped. */ 87 static int audit_rate_limit; 88 89 /* Number of outstanding audit_buffers allowed. */ 90 static int audit_backlog_limit = 64; 91 static int audit_backlog_wait_time = 60 * HZ; 92 static int audit_backlog_wait_overflow = 0; 93 94 /* The identity of the user shutting down the audit system. */ 95 uid_t audit_sig_uid = -1; 96 pid_t audit_sig_pid = -1; 97 u32 audit_sig_sid = 0; 98 99 /* Records can be lost in several ways: 100 0) [suppressed in audit_alloc] 101 1) out of memory in audit_log_start [kmalloc of struct audit_buffer] 102 2) out of memory in audit_log_move [alloc_skb] 103 3) suppressed due to audit_rate_limit 104 4) suppressed due to audit_backlog_limit 105 */ 106 static atomic_t audit_lost = ATOMIC_INIT(0); 107 108 /* The netlink socket. */ 109 static struct sock *audit_sock; 110 111 /* Inotify handle. */ 112 struct inotify_handle *audit_ih; 113 114 /* Hash for inode-based rules */ 115 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; 116 117 /* The audit_freelist is a list of pre-allocated audit buffers (if more 118 * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of 119 * being placed on the freelist). */ 120 static DEFINE_SPINLOCK(audit_freelist_lock); 121 static int audit_freelist_count; 122 static LIST_HEAD(audit_freelist); 123 124 static struct sk_buff_head audit_skb_queue; 125 static struct task_struct *kauditd_task; 126 static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait); 127 static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait); 128 129 /* Serialize requests from userspace. */ 130 static DEFINE_MUTEX(audit_cmd_mutex); 131 132 /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting 133 * audit records. Since printk uses a 1024 byte buffer, this buffer 134 * should be at least that large. */ 135 #define AUDIT_BUFSIZ 1024 136 137 /* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the 138 * audit_freelist. Doing so eliminates many kmalloc/kfree calls. */ 139 #define AUDIT_MAXFREE (2*NR_CPUS) 140 141 /* The audit_buffer is used when formatting an audit record. The caller 142 * locks briefly to get the record off the freelist or to allocate the 143 * buffer, and locks briefly to send the buffer to the netlink layer or 144 * to place it on a transmit queue. Multiple audit_buffers can be in 145 * use simultaneously. */ 146 struct audit_buffer { 147 struct list_head list; 148 struct sk_buff *skb; /* formatted skb ready to send */ 149 struct audit_context *ctx; /* NULL or associated context */ 150 gfp_t gfp_mask; 151 }; 152 153 static void audit_set_pid(struct audit_buffer *ab, pid_t pid) 154 { 155 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb); 156 nlh->nlmsg_pid = pid; 157 } 158 159 void audit_panic(const char *message) 160 { 161 switch (audit_failure) 162 { 163 case AUDIT_FAIL_SILENT: 164 break; 165 case AUDIT_FAIL_PRINTK: 166 printk(KERN_ERR "audit: %s\n", message); 167 break; 168 case AUDIT_FAIL_PANIC: 169 panic("audit: %s\n", message); 170 break; 171 } 172 } 173 174 static inline int audit_rate_check(void) 175 { 176 static unsigned long last_check = 0; 177 static int messages = 0; 178 static DEFINE_SPINLOCK(lock); 179 unsigned long flags; 180 unsigned long now; 181 unsigned long elapsed; 182 int retval = 0; 183 184 if (!audit_rate_limit) return 1; 185 186 spin_lock_irqsave(&lock, flags); 187 if (++messages < audit_rate_limit) { 188 retval = 1; 189 } else { 190 now = jiffies; 191 elapsed = now - last_check; 192 if (elapsed > HZ) { 193 last_check = now; 194 messages = 0; 195 retval = 1; 196 } 197 } 198 spin_unlock_irqrestore(&lock, flags); 199 200 return retval; 201 } 202 203 /** 204 * audit_log_lost - conditionally log lost audit message event 205 * @message: the message stating reason for lost audit message 206 * 207 * Emit at least 1 message per second, even if audit_rate_check is 208 * throttling. 209 * Always increment the lost messages counter. 210 */ 211 void audit_log_lost(const char *message) 212 { 213 static unsigned long last_msg = 0; 214 static DEFINE_SPINLOCK(lock); 215 unsigned long flags; 216 unsigned long now; 217 int print; 218 219 atomic_inc(&audit_lost); 220 221 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit); 222 223 if (!print) { 224 spin_lock_irqsave(&lock, flags); 225 now = jiffies; 226 if (now - last_msg > HZ) { 227 print = 1; 228 last_msg = now; 229 } 230 spin_unlock_irqrestore(&lock, flags); 231 } 232 233 if (print) { 234 printk(KERN_WARNING 235 "audit: audit_lost=%d audit_rate_limit=%d audit_backlog_limit=%d\n", 236 atomic_read(&audit_lost), 237 audit_rate_limit, 238 audit_backlog_limit); 239 audit_panic(message); 240 } 241 } 242 243 static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sid) 244 { 245 int res, rc = 0, old = audit_rate_limit; 246 247 /* check if we are locked */ 248 if (audit_enabled == 2) 249 res = 0; 250 else 251 res = 1; 252 253 if (sid) { 254 char *ctx = NULL; 255 u32 len; 256 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { 257 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 258 "audit_rate_limit=%d old=%d by auid=%u" 259 " subj=%s res=%d", 260 limit, old, loginuid, ctx, res); 261 kfree(ctx); 262 } else 263 res = 0; /* Something weird, deny request */ 264 } 265 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 266 "audit_rate_limit=%d old=%d by auid=%u res=%d", 267 limit, old, loginuid, res); 268 269 /* If we are allowed, make the change */ 270 if (res == 1) 271 audit_rate_limit = limit; 272 /* Not allowed, update reason */ 273 else if (rc == 0) 274 rc = -EPERM; 275 return rc; 276 } 277 278 static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid) 279 { 280 int res, rc = 0, old = audit_backlog_limit; 281 282 /* check if we are locked */ 283 if (audit_enabled == 2) 284 res = 0; 285 else 286 res = 1; 287 288 if (sid) { 289 char *ctx = NULL; 290 u32 len; 291 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { 292 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 293 "audit_backlog_limit=%d old=%d by auid=%u" 294 " subj=%s res=%d", 295 limit, old, loginuid, ctx, res); 296 kfree(ctx); 297 } else 298 res = 0; /* Something weird, deny request */ 299 } 300 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 301 "audit_backlog_limit=%d old=%d by auid=%u res=%d", 302 limit, old, loginuid, res); 303 304 /* If we are allowed, make the change */ 305 if (res == 1) 306 audit_backlog_limit = limit; 307 /* Not allowed, update reason */ 308 else if (rc == 0) 309 rc = -EPERM; 310 return rc; 311 } 312 313 static int audit_set_enabled(int state, uid_t loginuid, u32 sid) 314 { 315 int res, rc = 0, old = audit_enabled; 316 317 if (state < 0 || state > 2) 318 return -EINVAL; 319 320 /* check if we are locked */ 321 if (audit_enabled == 2) 322 res = 0; 323 else 324 res = 1; 325 326 if (sid) { 327 char *ctx = NULL; 328 u32 len; 329 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { 330 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 331 "audit_enabled=%d old=%d by auid=%u" 332 " subj=%s res=%d", 333 state, old, loginuid, ctx, res); 334 kfree(ctx); 335 } else 336 res = 0; /* Something weird, deny request */ 337 } 338 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 339 "audit_enabled=%d old=%d by auid=%u res=%d", 340 state, old, loginuid, res); 341 342 /* If we are allowed, make the change */ 343 if (res == 1) 344 audit_enabled = state; 345 /* Not allowed, update reason */ 346 else if (rc == 0) 347 rc = -EPERM; 348 return rc; 349 } 350 351 static int audit_set_failure(int state, uid_t loginuid, u32 sid) 352 { 353 int res, rc = 0, old = audit_failure; 354 355 if (state != AUDIT_FAIL_SILENT 356 && state != AUDIT_FAIL_PRINTK 357 && state != AUDIT_FAIL_PANIC) 358 return -EINVAL; 359 360 /* check if we are locked */ 361 if (audit_enabled == 2) 362 res = 0; 363 else 364 res = 1; 365 366 if (sid) { 367 char *ctx = NULL; 368 u32 len; 369 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { 370 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 371 "audit_failure=%d old=%d by auid=%u" 372 " subj=%s res=%d", 373 state, old, loginuid, ctx, res); 374 kfree(ctx); 375 } else 376 res = 0; /* Something weird, deny request */ 377 } 378 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 379 "audit_failure=%d old=%d by auid=%u res=%d", 380 state, old, loginuid, res); 381 382 /* If we are allowed, make the change */ 383 if (res == 1) 384 audit_failure = state; 385 /* Not allowed, update reason */ 386 else if (rc == 0) 387 rc = -EPERM; 388 return rc; 389 } 390 391 static int kauditd_thread(void *dummy) 392 { 393 struct sk_buff *skb; 394 395 set_freezable(); 396 while (!kthread_should_stop()) { 397 skb = skb_dequeue(&audit_skb_queue); 398 wake_up(&audit_backlog_wait); 399 if (skb) { 400 if (audit_pid) { 401 int err = netlink_unicast(audit_sock, skb, audit_pid, 0); 402 if (err < 0) { 403 BUG_ON(err != -ECONNREFUSED); /* Shoudn't happen */ 404 printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid); 405 audit_pid = 0; 406 } 407 } else { 408 printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0)); 409 kfree_skb(skb); 410 } 411 } else { 412 DECLARE_WAITQUEUE(wait, current); 413 set_current_state(TASK_INTERRUPTIBLE); 414 add_wait_queue(&kauditd_wait, &wait); 415 416 if (!skb_queue_len(&audit_skb_queue)) { 417 try_to_freeze(); 418 schedule(); 419 } 420 421 __set_current_state(TASK_RUNNING); 422 remove_wait_queue(&kauditd_wait, &wait); 423 } 424 } 425 return 0; 426 } 427 428 static int audit_prepare_user_tty(pid_t pid, uid_t loginuid) 429 { 430 struct task_struct *tsk; 431 int err; 432 433 read_lock(&tasklist_lock); 434 tsk = find_task_by_pid(pid); 435 err = -ESRCH; 436 if (!tsk) 437 goto out; 438 err = 0; 439 440 spin_lock_irq(&tsk->sighand->siglock); 441 if (!tsk->signal->audit_tty) 442 err = -EPERM; 443 spin_unlock_irq(&tsk->sighand->siglock); 444 if (err) 445 goto out; 446 447 tty_audit_push_task(tsk, loginuid); 448 out: 449 read_unlock(&tasklist_lock); 450 return err; 451 } 452 453 int audit_send_list(void *_dest) 454 { 455 struct audit_netlink_list *dest = _dest; 456 int pid = dest->pid; 457 struct sk_buff *skb; 458 459 /* wait for parent to finish and send an ACK */ 460 mutex_lock(&audit_cmd_mutex); 461 mutex_unlock(&audit_cmd_mutex); 462 463 while ((skb = __skb_dequeue(&dest->q)) != NULL) 464 netlink_unicast(audit_sock, skb, pid, 0); 465 466 kfree(dest); 467 468 return 0; 469 } 470 471 #ifdef CONFIG_AUDIT_TREE 472 static int prune_tree_thread(void *unused) 473 { 474 mutex_lock(&audit_cmd_mutex); 475 audit_prune_trees(); 476 mutex_unlock(&audit_cmd_mutex); 477 return 0; 478 } 479 480 void audit_schedule_prune(void) 481 { 482 kthread_run(prune_tree_thread, NULL, "audit_prune_tree"); 483 } 484 #endif 485 486 struct sk_buff *audit_make_reply(int pid, int seq, int type, int done, 487 int multi, void *payload, int size) 488 { 489 struct sk_buff *skb; 490 struct nlmsghdr *nlh; 491 int len = NLMSG_SPACE(size); 492 void *data; 493 int flags = multi ? NLM_F_MULTI : 0; 494 int t = done ? NLMSG_DONE : type; 495 496 skb = alloc_skb(len, GFP_KERNEL); 497 if (!skb) 498 return NULL; 499 500 nlh = NLMSG_PUT(skb, pid, seq, t, size); 501 nlh->nlmsg_flags = flags; 502 data = NLMSG_DATA(nlh); 503 memcpy(data, payload, size); 504 return skb; 505 506 nlmsg_failure: /* Used by NLMSG_PUT */ 507 if (skb) 508 kfree_skb(skb); 509 return NULL; 510 } 511 512 /** 513 * audit_send_reply - send an audit reply message via netlink 514 * @pid: process id to send reply to 515 * @seq: sequence number 516 * @type: audit message type 517 * @done: done (last) flag 518 * @multi: multi-part message flag 519 * @payload: payload data 520 * @size: payload size 521 * 522 * Allocates an skb, builds the netlink message, and sends it to the pid. 523 * No failure notifications. 524 */ 525 void audit_send_reply(int pid, int seq, int type, int done, int multi, 526 void *payload, int size) 527 { 528 struct sk_buff *skb; 529 skb = audit_make_reply(pid, seq, type, done, multi, payload, size); 530 if (!skb) 531 return; 532 /* Ignore failure. It'll only happen if the sender goes away, 533 because our timeout is set to infinite. */ 534 netlink_unicast(audit_sock, skb, pid, 0); 535 return; 536 } 537 538 /* 539 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit 540 * control messages. 541 */ 542 static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type) 543 { 544 int err = 0; 545 546 switch (msg_type) { 547 case AUDIT_GET: 548 case AUDIT_LIST: 549 case AUDIT_LIST_RULES: 550 case AUDIT_SET: 551 case AUDIT_ADD: 552 case AUDIT_ADD_RULE: 553 case AUDIT_DEL: 554 case AUDIT_DEL_RULE: 555 case AUDIT_SIGNAL_INFO: 556 case AUDIT_TTY_GET: 557 case AUDIT_TTY_SET: 558 case AUDIT_TRIM: 559 case AUDIT_MAKE_EQUIV: 560 if (security_netlink_recv(skb, CAP_AUDIT_CONTROL)) 561 err = -EPERM; 562 break; 563 case AUDIT_USER: 564 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: 565 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: 566 if (security_netlink_recv(skb, CAP_AUDIT_WRITE)) 567 err = -EPERM; 568 break; 569 default: /* bad msg */ 570 err = -EINVAL; 571 } 572 573 return err; 574 } 575 576 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 577 { 578 u32 uid, pid, seq, sid; 579 void *data; 580 struct audit_status *status_get, status_set; 581 int err; 582 struct audit_buffer *ab; 583 u16 msg_type = nlh->nlmsg_type; 584 uid_t loginuid; /* loginuid of sender */ 585 struct audit_sig_info *sig_data; 586 char *ctx; 587 u32 len; 588 589 err = audit_netlink_ok(skb, msg_type); 590 if (err) 591 return err; 592 593 /* As soon as there's any sign of userspace auditd, 594 * start kauditd to talk to it */ 595 if (!kauditd_task) 596 kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd"); 597 if (IS_ERR(kauditd_task)) { 598 err = PTR_ERR(kauditd_task); 599 kauditd_task = NULL; 600 return err; 601 } 602 603 pid = NETLINK_CREDS(skb)->pid; 604 uid = NETLINK_CREDS(skb)->uid; 605 loginuid = NETLINK_CB(skb).loginuid; 606 sid = NETLINK_CB(skb).sid; 607 seq = nlh->nlmsg_seq; 608 data = NLMSG_DATA(nlh); 609 610 switch (msg_type) { 611 case AUDIT_GET: 612 status_set.enabled = audit_enabled; 613 status_set.failure = audit_failure; 614 status_set.pid = audit_pid; 615 status_set.rate_limit = audit_rate_limit; 616 status_set.backlog_limit = audit_backlog_limit; 617 status_set.lost = atomic_read(&audit_lost); 618 status_set.backlog = skb_queue_len(&audit_skb_queue); 619 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0, 620 &status_set, sizeof(status_set)); 621 break; 622 case AUDIT_SET: 623 if (nlh->nlmsg_len < sizeof(struct audit_status)) 624 return -EINVAL; 625 status_get = (struct audit_status *)data; 626 if (status_get->mask & AUDIT_STATUS_ENABLED) { 627 err = audit_set_enabled(status_get->enabled, 628 loginuid, sid); 629 if (err < 0) return err; 630 } 631 if (status_get->mask & AUDIT_STATUS_FAILURE) { 632 err = audit_set_failure(status_get->failure, 633 loginuid, sid); 634 if (err < 0) return err; 635 } 636 if (status_get->mask & AUDIT_STATUS_PID) { 637 int old = audit_pid; 638 if (sid) { 639 if ((err = selinux_sid_to_string( 640 sid, &ctx, &len))) 641 return err; 642 else 643 audit_log(NULL, GFP_KERNEL, 644 AUDIT_CONFIG_CHANGE, 645 "audit_pid=%d old=%d by auid=%u subj=%s", 646 status_get->pid, old, 647 loginuid, ctx); 648 kfree(ctx); 649 } else 650 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 651 "audit_pid=%d old=%d by auid=%u", 652 status_get->pid, old, loginuid); 653 audit_pid = status_get->pid; 654 } 655 if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) 656 err = audit_set_rate_limit(status_get->rate_limit, 657 loginuid, sid); 658 if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT) 659 err = audit_set_backlog_limit(status_get->backlog_limit, 660 loginuid, sid); 661 break; 662 case AUDIT_USER: 663 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: 664 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: 665 if (!audit_enabled && msg_type != AUDIT_USER_AVC) 666 return 0; 667 668 err = audit_filter_user(&NETLINK_CB(skb), msg_type); 669 if (err == 1) { 670 err = 0; 671 if (msg_type == AUDIT_USER_TTY) { 672 err = audit_prepare_user_tty(pid, loginuid); 673 if (err) 674 break; 675 } 676 ab = audit_log_start(NULL, GFP_KERNEL, msg_type); 677 if (ab) { 678 audit_log_format(ab, 679 "user pid=%d uid=%u auid=%u", 680 pid, uid, loginuid); 681 if (sid) { 682 if (selinux_sid_to_string( 683 sid, &ctx, &len)) { 684 audit_log_format(ab, 685 " ssid=%u", sid); 686 /* Maybe call audit_panic? */ 687 } else 688 audit_log_format(ab, 689 " subj=%s", ctx); 690 kfree(ctx); 691 } 692 if (msg_type != AUDIT_USER_TTY) 693 audit_log_format(ab, " msg='%.1024s'", 694 (char *)data); 695 else { 696 int size; 697 698 audit_log_format(ab, " msg="); 699 size = nlmsg_len(nlh); 700 audit_log_n_untrustedstring(ab, size, 701 data); 702 } 703 audit_set_pid(ab, pid); 704 audit_log_end(ab); 705 } 706 } 707 break; 708 case AUDIT_ADD: 709 case AUDIT_DEL: 710 if (nlmsg_len(nlh) < sizeof(struct audit_rule)) 711 return -EINVAL; 712 if (audit_enabled == 2) { 713 ab = audit_log_start(NULL, GFP_KERNEL, 714 AUDIT_CONFIG_CHANGE); 715 if (ab) { 716 audit_log_format(ab, 717 "pid=%d uid=%u auid=%u", 718 pid, uid, loginuid); 719 if (sid) { 720 if (selinux_sid_to_string( 721 sid, &ctx, &len)) { 722 audit_log_format(ab, 723 " ssid=%u", sid); 724 /* Maybe call audit_panic? */ 725 } else 726 audit_log_format(ab, 727 " subj=%s", ctx); 728 kfree(ctx); 729 } 730 audit_log_format(ab, " audit_enabled=%d res=0", 731 audit_enabled); 732 audit_log_end(ab); 733 } 734 return -EPERM; 735 } 736 /* fallthrough */ 737 case AUDIT_LIST: 738 err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid, 739 uid, seq, data, nlmsg_len(nlh), 740 loginuid, sid); 741 break; 742 case AUDIT_ADD_RULE: 743 case AUDIT_DEL_RULE: 744 if (nlmsg_len(nlh) < sizeof(struct audit_rule_data)) 745 return -EINVAL; 746 if (audit_enabled == 2) { 747 ab = audit_log_start(NULL, GFP_KERNEL, 748 AUDIT_CONFIG_CHANGE); 749 if (ab) { 750 audit_log_format(ab, 751 "pid=%d uid=%u auid=%u", 752 pid, uid, loginuid); 753 if (sid) { 754 if (selinux_sid_to_string( 755 sid, &ctx, &len)) { 756 audit_log_format(ab, 757 " ssid=%u", sid); 758 /* Maybe call audit_panic? */ 759 } else 760 audit_log_format(ab, 761 " subj=%s", ctx); 762 kfree(ctx); 763 } 764 audit_log_format(ab, " audit_enabled=%d res=0", 765 audit_enabled); 766 audit_log_end(ab); 767 } 768 return -EPERM; 769 } 770 /* fallthrough */ 771 case AUDIT_LIST_RULES: 772 err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid, 773 uid, seq, data, nlmsg_len(nlh), 774 loginuid, sid); 775 break; 776 case AUDIT_TRIM: 777 audit_trim_trees(); 778 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE); 779 if (!ab) 780 break; 781 audit_log_format(ab, "auid=%u", loginuid); 782 if (sid) { 783 u32 len; 784 ctx = NULL; 785 if (selinux_sid_to_string(sid, &ctx, &len)) 786 audit_log_format(ab, " ssid=%u", sid); 787 else 788 audit_log_format(ab, " subj=%s", ctx); 789 kfree(ctx); 790 } 791 audit_log_format(ab, " op=trim res=1"); 792 audit_log_end(ab); 793 break; 794 case AUDIT_MAKE_EQUIV: { 795 void *bufp = data; 796 u32 sizes[2]; 797 size_t len = nlmsg_len(nlh); 798 char *old, *new; 799 800 err = -EINVAL; 801 if (len < 2 * sizeof(u32)) 802 break; 803 memcpy(sizes, bufp, 2 * sizeof(u32)); 804 bufp += 2 * sizeof(u32); 805 len -= 2 * sizeof(u32); 806 old = audit_unpack_string(&bufp, &len, sizes[0]); 807 if (IS_ERR(old)) { 808 err = PTR_ERR(old); 809 break; 810 } 811 new = audit_unpack_string(&bufp, &len, sizes[1]); 812 if (IS_ERR(new)) { 813 err = PTR_ERR(new); 814 kfree(old); 815 break; 816 } 817 /* OK, here comes... */ 818 err = audit_tag_tree(old, new); 819 820 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE); 821 if (!ab) { 822 kfree(old); 823 kfree(new); 824 break; 825 } 826 audit_log_format(ab, "auid=%u", loginuid); 827 if (sid) { 828 u32 len; 829 ctx = NULL; 830 if (selinux_sid_to_string(sid, &ctx, &len)) 831 audit_log_format(ab, " ssid=%u", sid); 832 else 833 audit_log_format(ab, " subj=%s", ctx); 834 kfree(ctx); 835 } 836 audit_log_format(ab, " op=make_equiv old="); 837 audit_log_untrustedstring(ab, old); 838 audit_log_format(ab, " new="); 839 audit_log_untrustedstring(ab, new); 840 audit_log_format(ab, " res=%d", !err); 841 audit_log_end(ab); 842 kfree(old); 843 kfree(new); 844 break; 845 } 846 case AUDIT_SIGNAL_INFO: 847 err = selinux_sid_to_string(audit_sig_sid, &ctx, &len); 848 if (err) 849 return err; 850 sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL); 851 if (!sig_data) { 852 kfree(ctx); 853 return -ENOMEM; 854 } 855 sig_data->uid = audit_sig_uid; 856 sig_data->pid = audit_sig_pid; 857 memcpy(sig_data->ctx, ctx, len); 858 kfree(ctx); 859 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO, 860 0, 0, sig_data, sizeof(*sig_data) + len); 861 kfree(sig_data); 862 break; 863 case AUDIT_TTY_GET: { 864 struct audit_tty_status s; 865 struct task_struct *tsk; 866 867 read_lock(&tasklist_lock); 868 tsk = find_task_by_pid(pid); 869 if (!tsk) 870 err = -ESRCH; 871 else { 872 spin_lock_irq(&tsk->sighand->siglock); 873 s.enabled = tsk->signal->audit_tty != 0; 874 spin_unlock_irq(&tsk->sighand->siglock); 875 } 876 read_unlock(&tasklist_lock); 877 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0, 878 &s, sizeof(s)); 879 break; 880 } 881 case AUDIT_TTY_SET: { 882 struct audit_tty_status *s; 883 struct task_struct *tsk; 884 885 if (nlh->nlmsg_len < sizeof(struct audit_tty_status)) 886 return -EINVAL; 887 s = data; 888 if (s->enabled != 0 && s->enabled != 1) 889 return -EINVAL; 890 read_lock(&tasklist_lock); 891 tsk = find_task_by_pid(pid); 892 if (!tsk) 893 err = -ESRCH; 894 else { 895 spin_lock_irq(&tsk->sighand->siglock); 896 tsk->signal->audit_tty = s->enabled != 0; 897 spin_unlock_irq(&tsk->sighand->siglock); 898 } 899 read_unlock(&tasklist_lock); 900 break; 901 } 902 default: 903 err = -EINVAL; 904 break; 905 } 906 907 return err < 0 ? err : 0; 908 } 909 910 /* 911 * Get message from skb (based on rtnetlink_rcv_skb). Each message is 912 * processed by audit_receive_msg. Malformed skbs with wrong length are 913 * discarded silently. 914 */ 915 static void audit_receive_skb(struct sk_buff *skb) 916 { 917 int err; 918 struct nlmsghdr *nlh; 919 u32 rlen; 920 921 while (skb->len >= NLMSG_SPACE(0)) { 922 nlh = nlmsg_hdr(skb); 923 if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) 924 return; 925 rlen = NLMSG_ALIGN(nlh->nlmsg_len); 926 if (rlen > skb->len) 927 rlen = skb->len; 928 if ((err = audit_receive_msg(skb, nlh))) { 929 netlink_ack(skb, nlh, err); 930 } else if (nlh->nlmsg_flags & NLM_F_ACK) 931 netlink_ack(skb, nlh, 0); 932 skb_pull(skb, rlen); 933 } 934 } 935 936 /* Receive messages from netlink socket. */ 937 static void audit_receive(struct sk_buff *skb) 938 { 939 mutex_lock(&audit_cmd_mutex); 940 audit_receive_skb(skb); 941 mutex_unlock(&audit_cmd_mutex); 942 } 943 944 #ifdef CONFIG_AUDITSYSCALL 945 static const struct inotify_operations audit_inotify_ops = { 946 .handle_event = audit_handle_ievent, 947 .destroy_watch = audit_free_parent, 948 }; 949 #endif 950 951 /* Initialize audit support at boot time. */ 952 static int __init audit_init(void) 953 { 954 int i; 955 956 printk(KERN_INFO "audit: initializing netlink socket (%s)\n", 957 audit_default ? "enabled" : "disabled"); 958 audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, 0, 959 audit_receive, NULL, THIS_MODULE); 960 if (!audit_sock) 961 audit_panic("cannot initialize netlink socket"); 962 else 963 audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; 964 965 skb_queue_head_init(&audit_skb_queue); 966 audit_initialized = 1; 967 audit_enabled = audit_default; 968 969 /* Register the callback with selinux. This callback will be invoked 970 * when a new policy is loaded. */ 971 selinux_audit_set_callback(&selinux_audit_rule_update); 972 973 audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized"); 974 975 #ifdef CONFIG_AUDITSYSCALL 976 audit_ih = inotify_init(&audit_inotify_ops); 977 if (IS_ERR(audit_ih)) 978 audit_panic("cannot initialize inotify handle"); 979 #endif 980 981 for (i = 0; i < AUDIT_INODE_BUCKETS; i++) 982 INIT_LIST_HEAD(&audit_inode_hash[i]); 983 984 return 0; 985 } 986 __initcall(audit_init); 987 988 /* Process kernel command-line parameter at boot time. audit=0 or audit=1. */ 989 static int __init audit_enable(char *str) 990 { 991 audit_default = !!simple_strtol(str, NULL, 0); 992 printk(KERN_INFO "audit: %s%s\n", 993 audit_default ? "enabled" : "disabled", 994 audit_initialized ? "" : " (after initialization)"); 995 if (audit_initialized) 996 audit_enabled = audit_default; 997 return 1; 998 } 999 1000 __setup("audit=", audit_enable); 1001 1002 static void audit_buffer_free(struct audit_buffer *ab) 1003 { 1004 unsigned long flags; 1005 1006 if (!ab) 1007 return; 1008 1009 if (ab->skb) 1010 kfree_skb(ab->skb); 1011 1012 spin_lock_irqsave(&audit_freelist_lock, flags); 1013 if (audit_freelist_count > AUDIT_MAXFREE) 1014 kfree(ab); 1015 else { 1016 audit_freelist_count++; 1017 list_add(&ab->list, &audit_freelist); 1018 } 1019 spin_unlock_irqrestore(&audit_freelist_lock, flags); 1020 } 1021 1022 static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx, 1023 gfp_t gfp_mask, int type) 1024 { 1025 unsigned long flags; 1026 struct audit_buffer *ab = NULL; 1027 struct nlmsghdr *nlh; 1028 1029 spin_lock_irqsave(&audit_freelist_lock, flags); 1030 if (!list_empty(&audit_freelist)) { 1031 ab = list_entry(audit_freelist.next, 1032 struct audit_buffer, list); 1033 list_del(&ab->list); 1034 --audit_freelist_count; 1035 } 1036 spin_unlock_irqrestore(&audit_freelist_lock, flags); 1037 1038 if (!ab) { 1039 ab = kmalloc(sizeof(*ab), gfp_mask); 1040 if (!ab) 1041 goto err; 1042 } 1043 1044 ab->skb = alloc_skb(AUDIT_BUFSIZ, gfp_mask); 1045 if (!ab->skb) 1046 goto err; 1047 1048 ab->ctx = ctx; 1049 ab->gfp_mask = gfp_mask; 1050 nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0)); 1051 nlh->nlmsg_type = type; 1052 nlh->nlmsg_flags = 0; 1053 nlh->nlmsg_pid = 0; 1054 nlh->nlmsg_seq = 0; 1055 return ab; 1056 err: 1057 audit_buffer_free(ab); 1058 return NULL; 1059 } 1060 1061 /** 1062 * audit_serial - compute a serial number for the audit record 1063 * 1064 * Compute a serial number for the audit record. Audit records are 1065 * written to user-space as soon as they are generated, so a complete 1066 * audit record may be written in several pieces. The timestamp of the 1067 * record and this serial number are used by the user-space tools to 1068 * determine which pieces belong to the same audit record. The 1069 * (timestamp,serial) tuple is unique for each syscall and is live from 1070 * syscall entry to syscall exit. 1071 * 1072 * NOTE: Another possibility is to store the formatted records off the 1073 * audit context (for those records that have a context), and emit them 1074 * all at syscall exit. However, this could delay the reporting of 1075 * significant errors until syscall exit (or never, if the system 1076 * halts). 1077 */ 1078 unsigned int audit_serial(void) 1079 { 1080 static DEFINE_SPINLOCK(serial_lock); 1081 static unsigned int serial = 0; 1082 1083 unsigned long flags; 1084 unsigned int ret; 1085 1086 spin_lock_irqsave(&serial_lock, flags); 1087 do { 1088 ret = ++serial; 1089 } while (unlikely(!ret)); 1090 spin_unlock_irqrestore(&serial_lock, flags); 1091 1092 return ret; 1093 } 1094 1095 static inline void audit_get_stamp(struct audit_context *ctx, 1096 struct timespec *t, unsigned int *serial) 1097 { 1098 if (ctx) 1099 auditsc_get_stamp(ctx, t, serial); 1100 else { 1101 *t = CURRENT_TIME; 1102 *serial = audit_serial(); 1103 } 1104 } 1105 1106 /* Obtain an audit buffer. This routine does locking to obtain the 1107 * audit buffer, but then no locking is required for calls to 1108 * audit_log_*format. If the tsk is a task that is currently in a 1109 * syscall, then the syscall is marked as auditable and an audit record 1110 * will be written at syscall exit. If there is no associated task, tsk 1111 * should be NULL. */ 1112 1113 /** 1114 * audit_log_start - obtain an audit buffer 1115 * @ctx: audit_context (may be NULL) 1116 * @gfp_mask: type of allocation 1117 * @type: audit message type 1118 * 1119 * Returns audit_buffer pointer on success or NULL on error. 1120 * 1121 * Obtain an audit buffer. This routine does locking to obtain the 1122 * audit buffer, but then no locking is required for calls to 1123 * audit_log_*format. If the task (ctx) is a task that is currently in a 1124 * syscall, then the syscall is marked as auditable and an audit record 1125 * will be written at syscall exit. If there is no associated task, then 1126 * task context (ctx) should be NULL. 1127 */ 1128 struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, 1129 int type) 1130 { 1131 struct audit_buffer *ab = NULL; 1132 struct timespec t; 1133 unsigned int serial; 1134 int reserve; 1135 unsigned long timeout_start = jiffies; 1136 1137 if (!audit_initialized) 1138 return NULL; 1139 1140 if (unlikely(audit_filter_type(type))) 1141 return NULL; 1142 1143 if (gfp_mask & __GFP_WAIT) 1144 reserve = 0; 1145 else 1146 reserve = 5; /* Allow atomic callers to go up to five 1147 entries over the normal backlog limit */ 1148 1149 while (audit_backlog_limit 1150 && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) { 1151 if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time 1152 && time_before(jiffies, timeout_start + audit_backlog_wait_time)) { 1153 1154 /* Wait for auditd to drain the queue a little */ 1155 DECLARE_WAITQUEUE(wait, current); 1156 set_current_state(TASK_INTERRUPTIBLE); 1157 add_wait_queue(&audit_backlog_wait, &wait); 1158 1159 if (audit_backlog_limit && 1160 skb_queue_len(&audit_skb_queue) > audit_backlog_limit) 1161 schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies); 1162 1163 __set_current_state(TASK_RUNNING); 1164 remove_wait_queue(&audit_backlog_wait, &wait); 1165 continue; 1166 } 1167 if (audit_rate_check()) 1168 printk(KERN_WARNING 1169 "audit: audit_backlog=%d > " 1170 "audit_backlog_limit=%d\n", 1171 skb_queue_len(&audit_skb_queue), 1172 audit_backlog_limit); 1173 audit_log_lost("backlog limit exceeded"); 1174 audit_backlog_wait_time = audit_backlog_wait_overflow; 1175 wake_up(&audit_backlog_wait); 1176 return NULL; 1177 } 1178 1179 ab = audit_buffer_alloc(ctx, gfp_mask, type); 1180 if (!ab) { 1181 audit_log_lost("out of memory in audit_log_start"); 1182 return NULL; 1183 } 1184 1185 audit_get_stamp(ab->ctx, &t, &serial); 1186 1187 audit_log_format(ab, "audit(%lu.%03lu:%u): ", 1188 t.tv_sec, t.tv_nsec/1000000, serial); 1189 return ab; 1190 } 1191 1192 /** 1193 * audit_expand - expand skb in the audit buffer 1194 * @ab: audit_buffer 1195 * @extra: space to add at tail of the skb 1196 * 1197 * Returns 0 (no space) on failed expansion, or available space if 1198 * successful. 1199 */ 1200 static inline int audit_expand(struct audit_buffer *ab, int extra) 1201 { 1202 struct sk_buff *skb = ab->skb; 1203 int ret = pskb_expand_head(skb, skb_headroom(skb), extra, 1204 ab->gfp_mask); 1205 if (ret < 0) { 1206 audit_log_lost("out of memory in audit_expand"); 1207 return 0; 1208 } 1209 return skb_tailroom(skb); 1210 } 1211 1212 /* 1213 * Format an audit message into the audit buffer. If there isn't enough 1214 * room in the audit buffer, more room will be allocated and vsnprint 1215 * will be called a second time. Currently, we assume that a printk 1216 * can't format message larger than 1024 bytes, so we don't either. 1217 */ 1218 static void audit_log_vformat(struct audit_buffer *ab, const char *fmt, 1219 va_list args) 1220 { 1221 int len, avail; 1222 struct sk_buff *skb; 1223 va_list args2; 1224 1225 if (!ab) 1226 return; 1227 1228 BUG_ON(!ab->skb); 1229 skb = ab->skb; 1230 avail = skb_tailroom(skb); 1231 if (avail == 0) { 1232 avail = audit_expand(ab, AUDIT_BUFSIZ); 1233 if (!avail) 1234 goto out; 1235 } 1236 va_copy(args2, args); 1237 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args); 1238 if (len >= avail) { 1239 /* The printk buffer is 1024 bytes long, so if we get 1240 * here and AUDIT_BUFSIZ is at least 1024, then we can 1241 * log everything that printk could have logged. */ 1242 avail = audit_expand(ab, 1243 max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail)); 1244 if (!avail) 1245 goto out; 1246 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2); 1247 } 1248 if (len > 0) 1249 skb_put(skb, len); 1250 out: 1251 return; 1252 } 1253 1254 /** 1255 * audit_log_format - format a message into the audit buffer. 1256 * @ab: audit_buffer 1257 * @fmt: format string 1258 * @...: optional parameters matching @fmt string 1259 * 1260 * All the work is done in audit_log_vformat. 1261 */ 1262 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...) 1263 { 1264 va_list args; 1265 1266 if (!ab) 1267 return; 1268 va_start(args, fmt); 1269 audit_log_vformat(ab, fmt, args); 1270 va_end(args); 1271 } 1272 1273 /** 1274 * audit_log_hex - convert a buffer to hex and append it to the audit skb 1275 * @ab: the audit_buffer 1276 * @buf: buffer to convert to hex 1277 * @len: length of @buf to be converted 1278 * 1279 * No return value; failure to expand is silently ignored. 1280 * 1281 * This function will take the passed buf and convert it into a string of 1282 * ascii hex digits. The new string is placed onto the skb. 1283 */ 1284 void audit_log_hex(struct audit_buffer *ab, const unsigned char *buf, 1285 size_t len) 1286 { 1287 int i, avail, new_len; 1288 unsigned char *ptr; 1289 struct sk_buff *skb; 1290 static const unsigned char *hex = "0123456789ABCDEF"; 1291 1292 if (!ab) 1293 return; 1294 1295 BUG_ON(!ab->skb); 1296 skb = ab->skb; 1297 avail = skb_tailroom(skb); 1298 new_len = len<<1; 1299 if (new_len >= avail) { 1300 /* Round the buffer request up to the next multiple */ 1301 new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1); 1302 avail = audit_expand(ab, new_len); 1303 if (!avail) 1304 return; 1305 } 1306 1307 ptr = skb_tail_pointer(skb); 1308 for (i=0; i<len; i++) { 1309 *ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */ 1310 *ptr++ = hex[buf[i] & 0x0F]; /* Lower nibble */ 1311 } 1312 *ptr = 0; 1313 skb_put(skb, len << 1); /* new string is twice the old string */ 1314 } 1315 1316 /* 1317 * Format a string of no more than slen characters into the audit buffer, 1318 * enclosed in quote marks. 1319 */ 1320 static void audit_log_n_string(struct audit_buffer *ab, size_t slen, 1321 const char *string) 1322 { 1323 int avail, new_len; 1324 unsigned char *ptr; 1325 struct sk_buff *skb; 1326 1327 if (!ab) 1328 return; 1329 1330 BUG_ON(!ab->skb); 1331 skb = ab->skb; 1332 avail = skb_tailroom(skb); 1333 new_len = slen + 3; /* enclosing quotes + null terminator */ 1334 if (new_len > avail) { 1335 avail = audit_expand(ab, new_len); 1336 if (!avail) 1337 return; 1338 } 1339 ptr = skb_tail_pointer(skb); 1340 *ptr++ = '"'; 1341 memcpy(ptr, string, slen); 1342 ptr += slen; 1343 *ptr++ = '"'; 1344 *ptr = 0; 1345 skb_put(skb, slen + 2); /* don't include null terminator */ 1346 } 1347 1348 /** 1349 * audit_log_n_untrustedstring - log a string that may contain random characters 1350 * @ab: audit_buffer 1351 * @len: lenth of string (not including trailing null) 1352 * @string: string to be logged 1353 * 1354 * This code will escape a string that is passed to it if the string 1355 * contains a control character, unprintable character, double quote mark, 1356 * or a space. Unescaped strings will start and end with a double quote mark. 1357 * Strings that are escaped are printed in hex (2 digits per char). 1358 * 1359 * The caller specifies the number of characters in the string to log, which may 1360 * or may not be the entire string. 1361 */ 1362 const char *audit_log_n_untrustedstring(struct audit_buffer *ab, size_t len, 1363 const char *string) 1364 { 1365 const unsigned char *p; 1366 1367 for (p = string; p < (const unsigned char *)string + len && *p; p++) { 1368 if (*p == '"' || *p < 0x21 || *p > 0x7f) { 1369 audit_log_hex(ab, string, len); 1370 return string + len + 1; 1371 } 1372 } 1373 audit_log_n_string(ab, len, string); 1374 return p + 1; 1375 } 1376 1377 /** 1378 * audit_log_untrustedstring - log a string that may contain random characters 1379 * @ab: audit_buffer 1380 * @string: string to be logged 1381 * 1382 * Same as audit_log_n_untrustedstring(), except that strlen is used to 1383 * determine string length. 1384 */ 1385 const char *audit_log_untrustedstring(struct audit_buffer *ab, const char *string) 1386 { 1387 return audit_log_n_untrustedstring(ab, strlen(string), string); 1388 } 1389 1390 /* This is a helper-function to print the escaped d_path */ 1391 void audit_log_d_path(struct audit_buffer *ab, const char *prefix, 1392 struct dentry *dentry, struct vfsmount *vfsmnt) 1393 { 1394 char *p, *path; 1395 1396 if (prefix) 1397 audit_log_format(ab, " %s", prefix); 1398 1399 /* We will allow 11 spaces for ' (deleted)' to be appended */ 1400 path = kmalloc(PATH_MAX+11, ab->gfp_mask); 1401 if (!path) { 1402 audit_log_format(ab, "<no memory>"); 1403 return; 1404 } 1405 p = d_path(dentry, vfsmnt, path, PATH_MAX+11); 1406 if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */ 1407 /* FIXME: can we save some information here? */ 1408 audit_log_format(ab, "<too long>"); 1409 } else 1410 audit_log_untrustedstring(ab, p); 1411 kfree(path); 1412 } 1413 1414 /** 1415 * audit_log_end - end one audit record 1416 * @ab: the audit_buffer 1417 * 1418 * The netlink_* functions cannot be called inside an irq context, so 1419 * the audit buffer is placed on a queue and a tasklet is scheduled to 1420 * remove them from the queue outside the irq context. May be called in 1421 * any context. 1422 */ 1423 void audit_log_end(struct audit_buffer *ab) 1424 { 1425 if (!ab) 1426 return; 1427 if (!audit_rate_check()) { 1428 audit_log_lost("rate limit exceeded"); 1429 } else { 1430 if (audit_pid) { 1431 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb); 1432 nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0); 1433 skb_queue_tail(&audit_skb_queue, ab->skb); 1434 ab->skb = NULL; 1435 wake_up_interruptible(&kauditd_wait); 1436 } else { 1437 printk(KERN_NOTICE "%s\n", ab->skb->data + NLMSG_SPACE(0)); 1438 } 1439 } 1440 audit_buffer_free(ab); 1441 } 1442 1443 /** 1444 * audit_log - Log an audit record 1445 * @ctx: audit context 1446 * @gfp_mask: type of allocation 1447 * @type: audit message type 1448 * @fmt: format string to use 1449 * @...: variable parameters matching the format string 1450 * 1451 * This is a convenience function that calls audit_log_start, 1452 * audit_log_vformat, and audit_log_end. It may be called 1453 * in any context. 1454 */ 1455 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 1456 const char *fmt, ...) 1457 { 1458 struct audit_buffer *ab; 1459 va_list args; 1460 1461 ab = audit_log_start(ctx, gfp_mask, type); 1462 if (ab) { 1463 va_start(args, fmt); 1464 audit_log_vformat(ab, fmt, args); 1465 va_end(args); 1466 audit_log_end(ab); 1467 } 1468 } 1469 1470 EXPORT_SYMBOL(audit_log_start); 1471 EXPORT_SYMBOL(audit_log_end); 1472 EXPORT_SYMBOL(audit_log_format); 1473 EXPORT_SYMBOL(audit_log); 1474