1 /* auditsc.c -- System-call auditing support 2 * Handles all system-call specific auditing features. 3 * 4 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina. 5 * Copyright 2005 Hewlett-Packard Development Company, L.P. 6 * Copyright (C) 2005, 2006 IBM Corporation 7 * All Rights Reserved. 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License as published by 11 * the Free Software Foundation; either version 2 of the License, or 12 * (at your option) any later version. 13 * 14 * This program is distributed in the hope that it will be useful, 15 * but WITHOUT ANY WARRANTY; without even the implied warranty of 16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 17 * GNU General Public License for more details. 18 * 19 * You should have received a copy of the GNU General Public License 20 * along with this program; if not, write to the Free Software 21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 22 * 23 * Written by Rickard E. (Rik) Faith <faith@redhat.com> 24 * 25 * Many of the ideas implemented here are from Stephen C. Tweedie, 26 * especially the idea of avoiding a copy by using getname. 27 * 28 * The method for actual interception of syscall entry and exit (not in 29 * this file -- see entry.S) is based on a GPL'd patch written by 30 * okir@suse.de and Copyright 2003 SuSE Linux AG. 31 * 32 * POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>, 33 * 2006. 34 * 35 * The support of additional filter rules compares (>, <, >=, <=) was 36 * added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005. 37 * 38 * Modified by Amy Griffis <amy.griffis@hp.com> to collect additional 39 * filesystem information. 40 * 41 * Subject and object context labeling support added by <danjones@us.ibm.com> 42 * and <dustin.kirkland@us.ibm.com> for LSPP certification compliance. 43 */ 44 45 #include <linux/init.h> 46 #include <asm/types.h> 47 #include <asm/atomic.h> 48 #include <asm/types.h> 49 #include <linux/fs.h> 50 #include <linux/namei.h> 51 #include <linux/mm.h> 52 #include <linux/module.h> 53 #include <linux/mount.h> 54 #include <linux/socket.h> 55 #include <linux/mqueue.h> 56 #include <linux/audit.h> 57 #include <linux/personality.h> 58 #include <linux/time.h> 59 #include <linux/netlink.h> 60 #include <linux/compiler.h> 61 #include <asm/unistd.h> 62 #include <linux/security.h> 63 #include <linux/list.h> 64 #include <linux/tty.h> 65 #include <linux/selinux.h> 66 #include <linux/binfmts.h> 67 #include <linux/highmem.h> 68 #include <linux/syscalls.h> 69 70 #include "audit.h" 71 72 extern struct list_head audit_filter_list[]; 73 74 /* No syscall auditing will take place unless audit_enabled != 0. */ 75 extern int audit_enabled; 76 77 /* AUDIT_NAMES is the number of slots we reserve in the audit_context 78 * for saving names from getname(). */ 79 #define AUDIT_NAMES 20 80 81 /* AUDIT_NAMES_RESERVED is the number of slots we reserve in the 82 * audit_context from being used for nameless inodes from 83 * path_lookup. */ 84 #define AUDIT_NAMES_RESERVED 7 85 86 /* Indicates that audit should log the full pathname. */ 87 #define AUDIT_NAME_FULL -1 88 89 /* number of audit rules */ 90 int audit_n_rules; 91 92 /* When fs/namei.c:getname() is called, we store the pointer in name and 93 * we don't let putname() free it (instead we free all of the saved 94 * pointers at syscall exit time). 95 * 96 * Further, in fs/namei.c:path_lookup() we store the inode and device. */ 97 struct audit_names { 98 const char *name; 99 int name_len; /* number of name's characters to log */ 100 unsigned name_put; /* call __putname() for this name */ 101 unsigned long ino; 102 dev_t dev; 103 umode_t mode; 104 uid_t uid; 105 gid_t gid; 106 dev_t rdev; 107 u32 osid; 108 }; 109 110 struct audit_aux_data { 111 struct audit_aux_data *next; 112 int type; 113 }; 114 115 #define AUDIT_AUX_IPCPERM 0 116 117 struct audit_aux_data_mq_open { 118 struct audit_aux_data d; 119 int oflag; 120 mode_t mode; 121 struct mq_attr attr; 122 }; 123 124 struct audit_aux_data_mq_sendrecv { 125 struct audit_aux_data d; 126 mqd_t mqdes; 127 size_t msg_len; 128 unsigned int msg_prio; 129 struct timespec abs_timeout; 130 }; 131 132 struct audit_aux_data_mq_notify { 133 struct audit_aux_data d; 134 mqd_t mqdes; 135 struct sigevent notification; 136 }; 137 138 struct audit_aux_data_mq_getsetattr { 139 struct audit_aux_data d; 140 mqd_t mqdes; 141 struct mq_attr mqstat; 142 }; 143 144 struct audit_aux_data_ipcctl { 145 struct audit_aux_data d; 146 struct ipc_perm p; 147 unsigned long qbytes; 148 uid_t uid; 149 gid_t gid; 150 mode_t mode; 151 u32 osid; 152 }; 153 154 struct audit_aux_data_execve { 155 struct audit_aux_data d; 156 int argc; 157 int envc; 158 char mem[0]; 159 }; 160 161 struct audit_aux_data_socketcall { 162 struct audit_aux_data d; 163 int nargs; 164 unsigned long args[0]; 165 }; 166 167 struct audit_aux_data_sockaddr { 168 struct audit_aux_data d; 169 int len; 170 char a[0]; 171 }; 172 173 struct audit_aux_data_fd_pair { 174 struct audit_aux_data d; 175 int fd[2]; 176 }; 177 178 struct audit_aux_data_path { 179 struct audit_aux_data d; 180 struct dentry *dentry; 181 struct vfsmount *mnt; 182 }; 183 184 /* The per-task audit context. */ 185 struct audit_context { 186 int dummy; /* must be the first element */ 187 int in_syscall; /* 1 if task is in a syscall */ 188 enum audit_state state; 189 unsigned int serial; /* serial number for record */ 190 struct timespec ctime; /* time of syscall entry */ 191 uid_t loginuid; /* login uid (identity) */ 192 int major; /* syscall number */ 193 unsigned long argv[4]; /* syscall arguments */ 194 int return_valid; /* return code is valid */ 195 long return_code;/* syscall return code */ 196 int auditable; /* 1 if record should be written */ 197 int name_count; 198 struct audit_names names[AUDIT_NAMES]; 199 char * filterkey; /* key for rule that triggered record */ 200 struct dentry * pwd; 201 struct vfsmount * pwdmnt; 202 struct audit_context *previous; /* For nested syscalls */ 203 struct audit_aux_data *aux; 204 205 /* Save things to print about task_struct */ 206 pid_t pid, ppid; 207 uid_t uid, euid, suid, fsuid; 208 gid_t gid, egid, sgid, fsgid; 209 unsigned long personality; 210 int arch; 211 212 #if AUDIT_DEBUG 213 int put_count; 214 int ino_count; 215 #endif 216 }; 217 218 #define ACC_MODE(x) ("\004\002\006\006"[(x)&O_ACCMODE]) 219 static inline int open_arg(int flags, int mask) 220 { 221 int n = ACC_MODE(flags); 222 if (flags & (O_TRUNC | O_CREAT)) 223 n |= AUDIT_PERM_WRITE; 224 return n & mask; 225 } 226 227 static int audit_match_perm(struct audit_context *ctx, int mask) 228 { 229 unsigned n = ctx->major; 230 switch (audit_classify_syscall(ctx->arch, n)) { 231 case 0: /* native */ 232 if ((mask & AUDIT_PERM_WRITE) && 233 audit_match_class(AUDIT_CLASS_WRITE, n)) 234 return 1; 235 if ((mask & AUDIT_PERM_READ) && 236 audit_match_class(AUDIT_CLASS_READ, n)) 237 return 1; 238 if ((mask & AUDIT_PERM_ATTR) && 239 audit_match_class(AUDIT_CLASS_CHATTR, n)) 240 return 1; 241 return 0; 242 case 1: /* 32bit on biarch */ 243 if ((mask & AUDIT_PERM_WRITE) && 244 audit_match_class(AUDIT_CLASS_WRITE_32, n)) 245 return 1; 246 if ((mask & AUDIT_PERM_READ) && 247 audit_match_class(AUDIT_CLASS_READ_32, n)) 248 return 1; 249 if ((mask & AUDIT_PERM_ATTR) && 250 audit_match_class(AUDIT_CLASS_CHATTR_32, n)) 251 return 1; 252 return 0; 253 case 2: /* open */ 254 return mask & ACC_MODE(ctx->argv[1]); 255 case 3: /* openat */ 256 return mask & ACC_MODE(ctx->argv[2]); 257 case 4: /* socketcall */ 258 return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND); 259 case 5: /* execve */ 260 return mask & AUDIT_PERM_EXEC; 261 default: 262 return 0; 263 } 264 } 265 266 /* Determine if any context name data matches a rule's watch data */ 267 /* Compare a task_struct with an audit_rule. Return 1 on match, 0 268 * otherwise. */ 269 static int audit_filter_rules(struct task_struct *tsk, 270 struct audit_krule *rule, 271 struct audit_context *ctx, 272 struct audit_names *name, 273 enum audit_state *state) 274 { 275 int i, j, need_sid = 1; 276 u32 sid; 277 278 for (i = 0; i < rule->field_count; i++) { 279 struct audit_field *f = &rule->fields[i]; 280 int result = 0; 281 282 switch (f->type) { 283 case AUDIT_PID: 284 result = audit_comparator(tsk->pid, f->op, f->val); 285 break; 286 case AUDIT_PPID: 287 if (ctx) { 288 if (!ctx->ppid) 289 ctx->ppid = sys_getppid(); 290 result = audit_comparator(ctx->ppid, f->op, f->val); 291 } 292 break; 293 case AUDIT_UID: 294 result = audit_comparator(tsk->uid, f->op, f->val); 295 break; 296 case AUDIT_EUID: 297 result = audit_comparator(tsk->euid, f->op, f->val); 298 break; 299 case AUDIT_SUID: 300 result = audit_comparator(tsk->suid, f->op, f->val); 301 break; 302 case AUDIT_FSUID: 303 result = audit_comparator(tsk->fsuid, f->op, f->val); 304 break; 305 case AUDIT_GID: 306 result = audit_comparator(tsk->gid, f->op, f->val); 307 break; 308 case AUDIT_EGID: 309 result = audit_comparator(tsk->egid, f->op, f->val); 310 break; 311 case AUDIT_SGID: 312 result = audit_comparator(tsk->sgid, f->op, f->val); 313 break; 314 case AUDIT_FSGID: 315 result = audit_comparator(tsk->fsgid, f->op, f->val); 316 break; 317 case AUDIT_PERS: 318 result = audit_comparator(tsk->personality, f->op, f->val); 319 break; 320 case AUDIT_ARCH: 321 if (ctx) 322 result = audit_comparator(ctx->arch, f->op, f->val); 323 break; 324 325 case AUDIT_EXIT: 326 if (ctx && ctx->return_valid) 327 result = audit_comparator(ctx->return_code, f->op, f->val); 328 break; 329 case AUDIT_SUCCESS: 330 if (ctx && ctx->return_valid) { 331 if (f->val) 332 result = audit_comparator(ctx->return_valid, f->op, AUDITSC_SUCCESS); 333 else 334 result = audit_comparator(ctx->return_valid, f->op, AUDITSC_FAILURE); 335 } 336 break; 337 case AUDIT_DEVMAJOR: 338 if (name) 339 result = audit_comparator(MAJOR(name->dev), 340 f->op, f->val); 341 else if (ctx) { 342 for (j = 0; j < ctx->name_count; j++) { 343 if (audit_comparator(MAJOR(ctx->names[j].dev), f->op, f->val)) { 344 ++result; 345 break; 346 } 347 } 348 } 349 break; 350 case AUDIT_DEVMINOR: 351 if (name) 352 result = audit_comparator(MINOR(name->dev), 353 f->op, f->val); 354 else if (ctx) { 355 for (j = 0; j < ctx->name_count; j++) { 356 if (audit_comparator(MINOR(ctx->names[j].dev), f->op, f->val)) { 357 ++result; 358 break; 359 } 360 } 361 } 362 break; 363 case AUDIT_INODE: 364 if (name) 365 result = (name->ino == f->val); 366 else if (ctx) { 367 for (j = 0; j < ctx->name_count; j++) { 368 if (audit_comparator(ctx->names[j].ino, f->op, f->val)) { 369 ++result; 370 break; 371 } 372 } 373 } 374 break; 375 case AUDIT_WATCH: 376 if (name && rule->watch->ino != (unsigned long)-1) 377 result = (name->dev == rule->watch->dev && 378 name->ino == rule->watch->ino); 379 break; 380 case AUDIT_LOGINUID: 381 result = 0; 382 if (ctx) 383 result = audit_comparator(ctx->loginuid, f->op, f->val); 384 break; 385 case AUDIT_SUBJ_USER: 386 case AUDIT_SUBJ_ROLE: 387 case AUDIT_SUBJ_TYPE: 388 case AUDIT_SUBJ_SEN: 389 case AUDIT_SUBJ_CLR: 390 /* NOTE: this may return negative values indicating 391 a temporary error. We simply treat this as a 392 match for now to avoid losing information that 393 may be wanted. An error message will also be 394 logged upon error */ 395 if (f->se_rule) { 396 if (need_sid) { 397 selinux_get_task_sid(tsk, &sid); 398 need_sid = 0; 399 } 400 result = selinux_audit_rule_match(sid, f->type, 401 f->op, 402 f->se_rule, 403 ctx); 404 } 405 break; 406 case AUDIT_OBJ_USER: 407 case AUDIT_OBJ_ROLE: 408 case AUDIT_OBJ_TYPE: 409 case AUDIT_OBJ_LEV_LOW: 410 case AUDIT_OBJ_LEV_HIGH: 411 /* The above note for AUDIT_SUBJ_USER...AUDIT_SUBJ_CLR 412 also applies here */ 413 if (f->se_rule) { 414 /* Find files that match */ 415 if (name) { 416 result = selinux_audit_rule_match( 417 name->osid, f->type, f->op, 418 f->se_rule, ctx); 419 } else if (ctx) { 420 for (j = 0; j < ctx->name_count; j++) { 421 if (selinux_audit_rule_match( 422 ctx->names[j].osid, 423 f->type, f->op, 424 f->se_rule, ctx)) { 425 ++result; 426 break; 427 } 428 } 429 } 430 /* Find ipc objects that match */ 431 if (ctx) { 432 struct audit_aux_data *aux; 433 for (aux = ctx->aux; aux; 434 aux = aux->next) { 435 if (aux->type == AUDIT_IPC) { 436 struct audit_aux_data_ipcctl *axi = (void *)aux; 437 if (selinux_audit_rule_match(axi->osid, f->type, f->op, f->se_rule, ctx)) { 438 ++result; 439 break; 440 } 441 } 442 } 443 } 444 } 445 break; 446 case AUDIT_ARG0: 447 case AUDIT_ARG1: 448 case AUDIT_ARG2: 449 case AUDIT_ARG3: 450 if (ctx) 451 result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val); 452 break; 453 case AUDIT_FILTERKEY: 454 /* ignore this field for filtering */ 455 result = 1; 456 break; 457 case AUDIT_PERM: 458 result = audit_match_perm(ctx, f->val); 459 break; 460 } 461 462 if (!result) 463 return 0; 464 } 465 if (rule->filterkey) 466 ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC); 467 switch (rule->action) { 468 case AUDIT_NEVER: *state = AUDIT_DISABLED; break; 469 case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break; 470 } 471 return 1; 472 } 473 474 /* At process creation time, we can determine if system-call auditing is 475 * completely disabled for this task. Since we only have the task 476 * structure at this point, we can only check uid and gid. 477 */ 478 static enum audit_state audit_filter_task(struct task_struct *tsk) 479 { 480 struct audit_entry *e; 481 enum audit_state state; 482 483 rcu_read_lock(); 484 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) { 485 if (audit_filter_rules(tsk, &e->rule, NULL, NULL, &state)) { 486 rcu_read_unlock(); 487 return state; 488 } 489 } 490 rcu_read_unlock(); 491 return AUDIT_BUILD_CONTEXT; 492 } 493 494 /* At syscall entry and exit time, this filter is called if the 495 * audit_state is not low enough that auditing cannot take place, but is 496 * also not high enough that we already know we have to write an audit 497 * record (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT). 498 */ 499 static enum audit_state audit_filter_syscall(struct task_struct *tsk, 500 struct audit_context *ctx, 501 struct list_head *list) 502 { 503 struct audit_entry *e; 504 enum audit_state state; 505 506 if (audit_pid && tsk->tgid == audit_pid) 507 return AUDIT_DISABLED; 508 509 rcu_read_lock(); 510 if (!list_empty(list)) { 511 int word = AUDIT_WORD(ctx->major); 512 int bit = AUDIT_BIT(ctx->major); 513 514 list_for_each_entry_rcu(e, list, list) { 515 if ((e->rule.mask[word] & bit) == bit && 516 audit_filter_rules(tsk, &e->rule, ctx, NULL, 517 &state)) { 518 rcu_read_unlock(); 519 return state; 520 } 521 } 522 } 523 rcu_read_unlock(); 524 return AUDIT_BUILD_CONTEXT; 525 } 526 527 /* At syscall exit time, this filter is called if any audit_names[] have been 528 * collected during syscall processing. We only check rules in sublists at hash 529 * buckets applicable to the inode numbers in audit_names[]. 530 * Regarding audit_state, same rules apply as for audit_filter_syscall(). 531 */ 532 enum audit_state audit_filter_inodes(struct task_struct *tsk, 533 struct audit_context *ctx) 534 { 535 int i; 536 struct audit_entry *e; 537 enum audit_state state; 538 539 if (audit_pid && tsk->tgid == audit_pid) 540 return AUDIT_DISABLED; 541 542 rcu_read_lock(); 543 for (i = 0; i < ctx->name_count; i++) { 544 int word = AUDIT_WORD(ctx->major); 545 int bit = AUDIT_BIT(ctx->major); 546 struct audit_names *n = &ctx->names[i]; 547 int h = audit_hash_ino((u32)n->ino); 548 struct list_head *list = &audit_inode_hash[h]; 549 550 if (list_empty(list)) 551 continue; 552 553 list_for_each_entry_rcu(e, list, list) { 554 if ((e->rule.mask[word] & bit) == bit && 555 audit_filter_rules(tsk, &e->rule, ctx, n, &state)) { 556 rcu_read_unlock(); 557 return state; 558 } 559 } 560 } 561 rcu_read_unlock(); 562 return AUDIT_BUILD_CONTEXT; 563 } 564 565 void audit_set_auditable(struct audit_context *ctx) 566 { 567 ctx->auditable = 1; 568 } 569 570 static inline struct audit_context *audit_get_context(struct task_struct *tsk, 571 int return_valid, 572 int return_code) 573 { 574 struct audit_context *context = tsk->audit_context; 575 576 if (likely(!context)) 577 return NULL; 578 context->return_valid = return_valid; 579 context->return_code = return_code; 580 581 if (context->in_syscall && !context->dummy && !context->auditable) { 582 enum audit_state state; 583 584 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]); 585 if (state == AUDIT_RECORD_CONTEXT) { 586 context->auditable = 1; 587 goto get_context; 588 } 589 590 state = audit_filter_inodes(tsk, context); 591 if (state == AUDIT_RECORD_CONTEXT) 592 context->auditable = 1; 593 594 } 595 596 get_context: 597 598 tsk->audit_context = NULL; 599 return context; 600 } 601 602 static inline void audit_free_names(struct audit_context *context) 603 { 604 int i; 605 606 #if AUDIT_DEBUG == 2 607 if (context->auditable 608 ||context->put_count + context->ino_count != context->name_count) { 609 printk(KERN_ERR "%s:%d(:%d): major=%d in_syscall=%d" 610 " name_count=%d put_count=%d" 611 " ino_count=%d [NOT freeing]\n", 612 __FILE__, __LINE__, 613 context->serial, context->major, context->in_syscall, 614 context->name_count, context->put_count, 615 context->ino_count); 616 for (i = 0; i < context->name_count; i++) { 617 printk(KERN_ERR "names[%d] = %p = %s\n", i, 618 context->names[i].name, 619 context->names[i].name ?: "(null)"); 620 } 621 dump_stack(); 622 return; 623 } 624 #endif 625 #if AUDIT_DEBUG 626 context->put_count = 0; 627 context->ino_count = 0; 628 #endif 629 630 for (i = 0; i < context->name_count; i++) { 631 if (context->names[i].name && context->names[i].name_put) 632 __putname(context->names[i].name); 633 } 634 context->name_count = 0; 635 if (context->pwd) 636 dput(context->pwd); 637 if (context->pwdmnt) 638 mntput(context->pwdmnt); 639 context->pwd = NULL; 640 context->pwdmnt = NULL; 641 } 642 643 static inline void audit_free_aux(struct audit_context *context) 644 { 645 struct audit_aux_data *aux; 646 647 while ((aux = context->aux)) { 648 if (aux->type == AUDIT_AVC_PATH) { 649 struct audit_aux_data_path *axi = (void *)aux; 650 dput(axi->dentry); 651 mntput(axi->mnt); 652 } 653 654 context->aux = aux->next; 655 kfree(aux); 656 } 657 } 658 659 static inline void audit_zero_context(struct audit_context *context, 660 enum audit_state state) 661 { 662 uid_t loginuid = context->loginuid; 663 664 memset(context, 0, sizeof(*context)); 665 context->state = state; 666 context->loginuid = loginuid; 667 } 668 669 static inline struct audit_context *audit_alloc_context(enum audit_state state) 670 { 671 struct audit_context *context; 672 673 if (!(context = kmalloc(sizeof(*context), GFP_KERNEL))) 674 return NULL; 675 audit_zero_context(context, state); 676 return context; 677 } 678 679 /** 680 * audit_alloc - allocate an audit context block for a task 681 * @tsk: task 682 * 683 * Filter on the task information and allocate a per-task audit context 684 * if necessary. Doing so turns on system call auditing for the 685 * specified task. This is called from copy_process, so no lock is 686 * needed. 687 */ 688 int audit_alloc(struct task_struct *tsk) 689 { 690 struct audit_context *context; 691 enum audit_state state; 692 693 if (likely(!audit_enabled)) 694 return 0; /* Return if not auditing. */ 695 696 state = audit_filter_task(tsk); 697 if (likely(state == AUDIT_DISABLED)) 698 return 0; 699 700 if (!(context = audit_alloc_context(state))) { 701 audit_log_lost("out of memory in audit_alloc"); 702 return -ENOMEM; 703 } 704 705 /* Preserve login uid */ 706 context->loginuid = -1; 707 if (current->audit_context) 708 context->loginuid = current->audit_context->loginuid; 709 710 tsk->audit_context = context; 711 set_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT); 712 return 0; 713 } 714 715 static inline void audit_free_context(struct audit_context *context) 716 { 717 struct audit_context *previous; 718 int count = 0; 719 720 do { 721 previous = context->previous; 722 if (previous || (count && count < 10)) { 723 ++count; 724 printk(KERN_ERR "audit(:%d): major=%d name_count=%d:" 725 " freeing multiple contexts (%d)\n", 726 context->serial, context->major, 727 context->name_count, count); 728 } 729 audit_free_names(context); 730 audit_free_aux(context); 731 kfree(context->filterkey); 732 kfree(context); 733 context = previous; 734 } while (context); 735 if (count >= 10) 736 printk(KERN_ERR "audit: freed %d contexts\n", count); 737 } 738 739 void audit_log_task_context(struct audit_buffer *ab) 740 { 741 char *ctx = NULL; 742 unsigned len; 743 int error; 744 u32 sid; 745 746 selinux_get_task_sid(current, &sid); 747 if (!sid) 748 return; 749 750 error = selinux_sid_to_string(sid, &ctx, &len); 751 if (error) { 752 if (error != -EINVAL) 753 goto error_path; 754 return; 755 } 756 757 audit_log_format(ab, " subj=%s", ctx); 758 kfree(ctx); 759 return; 760 761 error_path: 762 audit_panic("error in audit_log_task_context"); 763 return; 764 } 765 766 EXPORT_SYMBOL(audit_log_task_context); 767 768 static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk) 769 { 770 char name[sizeof(tsk->comm)]; 771 struct mm_struct *mm = tsk->mm; 772 struct vm_area_struct *vma; 773 774 /* tsk == current */ 775 776 get_task_comm(name, tsk); 777 audit_log_format(ab, " comm="); 778 audit_log_untrustedstring(ab, name); 779 780 if (mm) { 781 down_read(&mm->mmap_sem); 782 vma = mm->mmap; 783 while (vma) { 784 if ((vma->vm_flags & VM_EXECUTABLE) && 785 vma->vm_file) { 786 audit_log_d_path(ab, "exe=", 787 vma->vm_file->f_path.dentry, 788 vma->vm_file->f_path.mnt); 789 break; 790 } 791 vma = vma->vm_next; 792 } 793 up_read(&mm->mmap_sem); 794 } 795 audit_log_task_context(ab); 796 } 797 798 static void audit_log_exit(struct audit_context *context, struct task_struct *tsk) 799 { 800 int i, call_panic = 0; 801 struct audit_buffer *ab; 802 struct audit_aux_data *aux; 803 const char *tty; 804 805 /* tsk == current */ 806 context->pid = tsk->pid; 807 if (!context->ppid) 808 context->ppid = sys_getppid(); 809 context->uid = tsk->uid; 810 context->gid = tsk->gid; 811 context->euid = tsk->euid; 812 context->suid = tsk->suid; 813 context->fsuid = tsk->fsuid; 814 context->egid = tsk->egid; 815 context->sgid = tsk->sgid; 816 context->fsgid = tsk->fsgid; 817 context->personality = tsk->personality; 818 819 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL); 820 if (!ab) 821 return; /* audit_panic has been called */ 822 audit_log_format(ab, "arch=%x syscall=%d", 823 context->arch, context->major); 824 if (context->personality != PER_LINUX) 825 audit_log_format(ab, " per=%lx", context->personality); 826 if (context->return_valid) 827 audit_log_format(ab, " success=%s exit=%ld", 828 (context->return_valid==AUDITSC_SUCCESS)?"yes":"no", 829 context->return_code); 830 831 mutex_lock(&tty_mutex); 832 read_lock(&tasklist_lock); 833 if (tsk->signal && tsk->signal->tty && tsk->signal->tty->name) 834 tty = tsk->signal->tty->name; 835 else 836 tty = "(none)"; 837 read_unlock(&tasklist_lock); 838 audit_log_format(ab, 839 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d" 840 " ppid=%d pid=%d auid=%u uid=%u gid=%u" 841 " euid=%u suid=%u fsuid=%u" 842 " egid=%u sgid=%u fsgid=%u tty=%s", 843 context->argv[0], 844 context->argv[1], 845 context->argv[2], 846 context->argv[3], 847 context->name_count, 848 context->ppid, 849 context->pid, 850 context->loginuid, 851 context->uid, 852 context->gid, 853 context->euid, context->suid, context->fsuid, 854 context->egid, context->sgid, context->fsgid, tty); 855 856 mutex_unlock(&tty_mutex); 857 858 audit_log_task_info(ab, tsk); 859 if (context->filterkey) { 860 audit_log_format(ab, " key="); 861 audit_log_untrustedstring(ab, context->filterkey); 862 } else 863 audit_log_format(ab, " key=(null)"); 864 audit_log_end(ab); 865 866 for (aux = context->aux; aux; aux = aux->next) { 867 868 ab = audit_log_start(context, GFP_KERNEL, aux->type); 869 if (!ab) 870 continue; /* audit_panic has been called */ 871 872 switch (aux->type) { 873 case AUDIT_MQ_OPEN: { 874 struct audit_aux_data_mq_open *axi = (void *)aux; 875 audit_log_format(ab, 876 "oflag=0x%x mode=%#o mq_flags=0x%lx mq_maxmsg=%ld " 877 "mq_msgsize=%ld mq_curmsgs=%ld", 878 axi->oflag, axi->mode, axi->attr.mq_flags, 879 axi->attr.mq_maxmsg, axi->attr.mq_msgsize, 880 axi->attr.mq_curmsgs); 881 break; } 882 883 case AUDIT_MQ_SENDRECV: { 884 struct audit_aux_data_mq_sendrecv *axi = (void *)aux; 885 audit_log_format(ab, 886 "mqdes=%d msg_len=%zd msg_prio=%u " 887 "abs_timeout_sec=%ld abs_timeout_nsec=%ld", 888 axi->mqdes, axi->msg_len, axi->msg_prio, 889 axi->abs_timeout.tv_sec, axi->abs_timeout.tv_nsec); 890 break; } 891 892 case AUDIT_MQ_NOTIFY: { 893 struct audit_aux_data_mq_notify *axi = (void *)aux; 894 audit_log_format(ab, 895 "mqdes=%d sigev_signo=%d", 896 axi->mqdes, 897 axi->notification.sigev_signo); 898 break; } 899 900 case AUDIT_MQ_GETSETATTR: { 901 struct audit_aux_data_mq_getsetattr *axi = (void *)aux; 902 audit_log_format(ab, 903 "mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld " 904 "mq_curmsgs=%ld ", 905 axi->mqdes, 906 axi->mqstat.mq_flags, axi->mqstat.mq_maxmsg, 907 axi->mqstat.mq_msgsize, axi->mqstat.mq_curmsgs); 908 break; } 909 910 case AUDIT_IPC: { 911 struct audit_aux_data_ipcctl *axi = (void *)aux; 912 audit_log_format(ab, 913 "ouid=%u ogid=%u mode=%x", 914 axi->uid, axi->gid, axi->mode); 915 if (axi->osid != 0) { 916 char *ctx = NULL; 917 u32 len; 918 if (selinux_sid_to_string( 919 axi->osid, &ctx, &len)) { 920 audit_log_format(ab, " osid=%u", 921 axi->osid); 922 call_panic = 1; 923 } else 924 audit_log_format(ab, " obj=%s", ctx); 925 kfree(ctx); 926 } 927 break; } 928 929 case AUDIT_IPC_SET_PERM: { 930 struct audit_aux_data_ipcctl *axi = (void *)aux; 931 audit_log_format(ab, 932 "qbytes=%lx ouid=%u ogid=%u mode=%x", 933 axi->qbytes, axi->uid, axi->gid, axi->mode); 934 break; } 935 936 case AUDIT_EXECVE: { 937 struct audit_aux_data_execve *axi = (void *)aux; 938 int i; 939 const char *p; 940 for (i = 0, p = axi->mem; i < axi->argc; i++) { 941 audit_log_format(ab, "a%d=", i); 942 p = audit_log_untrustedstring(ab, p); 943 audit_log_format(ab, "\n"); 944 } 945 break; } 946 947 case AUDIT_SOCKETCALL: { 948 int i; 949 struct audit_aux_data_socketcall *axs = (void *)aux; 950 audit_log_format(ab, "nargs=%d", axs->nargs); 951 for (i=0; i<axs->nargs; i++) 952 audit_log_format(ab, " a%d=%lx", i, axs->args[i]); 953 break; } 954 955 case AUDIT_SOCKADDR: { 956 struct audit_aux_data_sockaddr *axs = (void *)aux; 957 958 audit_log_format(ab, "saddr="); 959 audit_log_hex(ab, axs->a, axs->len); 960 break; } 961 962 case AUDIT_AVC_PATH: { 963 struct audit_aux_data_path *axi = (void *)aux; 964 audit_log_d_path(ab, "path=", axi->dentry, axi->mnt); 965 break; } 966 967 case AUDIT_FD_PAIR: { 968 struct audit_aux_data_fd_pair *axs = (void *)aux; 969 audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]); 970 break; } 971 972 } 973 audit_log_end(ab); 974 } 975 976 if (context->pwd && context->pwdmnt) { 977 ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD); 978 if (ab) { 979 audit_log_d_path(ab, "cwd=", context->pwd, context->pwdmnt); 980 audit_log_end(ab); 981 } 982 } 983 for (i = 0; i < context->name_count; i++) { 984 struct audit_names *n = &context->names[i]; 985 986 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH); 987 if (!ab) 988 continue; /* audit_panic has been called */ 989 990 audit_log_format(ab, "item=%d", i); 991 992 if (n->name) { 993 switch(n->name_len) { 994 case AUDIT_NAME_FULL: 995 /* log the full path */ 996 audit_log_format(ab, " name="); 997 audit_log_untrustedstring(ab, n->name); 998 break; 999 case 0: 1000 /* name was specified as a relative path and the 1001 * directory component is the cwd */ 1002 audit_log_d_path(ab, " name=", context->pwd, 1003 context->pwdmnt); 1004 break; 1005 default: 1006 /* log the name's directory component */ 1007 audit_log_format(ab, " name="); 1008 audit_log_n_untrustedstring(ab, n->name_len, 1009 n->name); 1010 } 1011 } else 1012 audit_log_format(ab, " name=(null)"); 1013 1014 if (n->ino != (unsigned long)-1) { 1015 audit_log_format(ab, " inode=%lu" 1016 " dev=%02x:%02x mode=%#o" 1017 " ouid=%u ogid=%u rdev=%02x:%02x", 1018 n->ino, 1019 MAJOR(n->dev), 1020 MINOR(n->dev), 1021 n->mode, 1022 n->uid, 1023 n->gid, 1024 MAJOR(n->rdev), 1025 MINOR(n->rdev)); 1026 } 1027 if (n->osid != 0) { 1028 char *ctx = NULL; 1029 u32 len; 1030 if (selinux_sid_to_string( 1031 n->osid, &ctx, &len)) { 1032 audit_log_format(ab, " osid=%u", n->osid); 1033 call_panic = 2; 1034 } else 1035 audit_log_format(ab, " obj=%s", ctx); 1036 kfree(ctx); 1037 } 1038 1039 audit_log_end(ab); 1040 } 1041 if (call_panic) 1042 audit_panic("error converting sid to string"); 1043 } 1044 1045 /** 1046 * audit_free - free a per-task audit context 1047 * @tsk: task whose audit context block to free 1048 * 1049 * Called from copy_process and do_exit 1050 */ 1051 void audit_free(struct task_struct *tsk) 1052 { 1053 struct audit_context *context; 1054 1055 context = audit_get_context(tsk, 0, 0); 1056 if (likely(!context)) 1057 return; 1058 1059 /* Check for system calls that do not go through the exit 1060 * function (e.g., exit_group), then free context block. 1061 * We use GFP_ATOMIC here because we might be doing this 1062 * in the context of the idle thread */ 1063 /* that can happen only if we are called from do_exit() */ 1064 if (context->in_syscall && context->auditable) 1065 audit_log_exit(context, tsk); 1066 1067 audit_free_context(context); 1068 } 1069 1070 /** 1071 * audit_syscall_entry - fill in an audit record at syscall entry 1072 * @tsk: task being audited 1073 * @arch: architecture type 1074 * @major: major syscall type (function) 1075 * @a1: additional syscall register 1 1076 * @a2: additional syscall register 2 1077 * @a3: additional syscall register 3 1078 * @a4: additional syscall register 4 1079 * 1080 * Fill in audit context at syscall entry. This only happens if the 1081 * audit context was created when the task was created and the state or 1082 * filters demand the audit context be built. If the state from the 1083 * per-task filter or from the per-syscall filter is AUDIT_RECORD_CONTEXT, 1084 * then the record will be written at syscall exit time (otherwise, it 1085 * will only be written if another part of the kernel requests that it 1086 * be written). 1087 */ 1088 void audit_syscall_entry(int arch, int major, 1089 unsigned long a1, unsigned long a2, 1090 unsigned long a3, unsigned long a4) 1091 { 1092 struct task_struct *tsk = current; 1093 struct audit_context *context = tsk->audit_context; 1094 enum audit_state state; 1095 1096 BUG_ON(!context); 1097 1098 /* 1099 * This happens only on certain architectures that make system 1100 * calls in kernel_thread via the entry.S interface, instead of 1101 * with direct calls. (If you are porting to a new 1102 * architecture, hitting this condition can indicate that you 1103 * got the _exit/_leave calls backward in entry.S.) 1104 * 1105 * i386 no 1106 * x86_64 no 1107 * ppc64 yes (see arch/powerpc/platforms/iseries/misc.S) 1108 * 1109 * This also happens with vm86 emulation in a non-nested manner 1110 * (entries without exits), so this case must be caught. 1111 */ 1112 if (context->in_syscall) { 1113 struct audit_context *newctx; 1114 1115 #if AUDIT_DEBUG 1116 printk(KERN_ERR 1117 "audit(:%d) pid=%d in syscall=%d;" 1118 " entering syscall=%d\n", 1119 context->serial, tsk->pid, context->major, major); 1120 #endif 1121 newctx = audit_alloc_context(context->state); 1122 if (newctx) { 1123 newctx->previous = context; 1124 context = newctx; 1125 tsk->audit_context = newctx; 1126 } else { 1127 /* If we can't alloc a new context, the best we 1128 * can do is to leak memory (any pending putname 1129 * will be lost). The only other alternative is 1130 * to abandon auditing. */ 1131 audit_zero_context(context, context->state); 1132 } 1133 } 1134 BUG_ON(context->in_syscall || context->name_count); 1135 1136 if (!audit_enabled) 1137 return; 1138 1139 context->arch = arch; 1140 context->major = major; 1141 context->argv[0] = a1; 1142 context->argv[1] = a2; 1143 context->argv[2] = a3; 1144 context->argv[3] = a4; 1145 1146 state = context->state; 1147 context->dummy = !audit_n_rules; 1148 if (!context->dummy && (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT)) 1149 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]); 1150 if (likely(state == AUDIT_DISABLED)) 1151 return; 1152 1153 context->serial = 0; 1154 context->ctime = CURRENT_TIME; 1155 context->in_syscall = 1; 1156 context->auditable = !!(state == AUDIT_RECORD_CONTEXT); 1157 context->ppid = 0; 1158 } 1159 1160 /** 1161 * audit_syscall_exit - deallocate audit context after a system call 1162 * @tsk: task being audited 1163 * @valid: success/failure flag 1164 * @return_code: syscall return value 1165 * 1166 * Tear down after system call. If the audit context has been marked as 1167 * auditable (either because of the AUDIT_RECORD_CONTEXT state from 1168 * filtering, or because some other part of the kernel write an audit 1169 * message), then write out the syscall information. In call cases, 1170 * free the names stored from getname(). 1171 */ 1172 void audit_syscall_exit(int valid, long return_code) 1173 { 1174 struct task_struct *tsk = current; 1175 struct audit_context *context; 1176 1177 context = audit_get_context(tsk, valid, return_code); 1178 1179 if (likely(!context)) 1180 return; 1181 1182 if (context->in_syscall && context->auditable) 1183 audit_log_exit(context, tsk); 1184 1185 context->in_syscall = 0; 1186 context->auditable = 0; 1187 1188 if (context->previous) { 1189 struct audit_context *new_context = context->previous; 1190 context->previous = NULL; 1191 audit_free_context(context); 1192 tsk->audit_context = new_context; 1193 } else { 1194 audit_free_names(context); 1195 audit_free_aux(context); 1196 kfree(context->filterkey); 1197 context->filterkey = NULL; 1198 tsk->audit_context = context; 1199 } 1200 } 1201 1202 /** 1203 * audit_getname - add a name to the list 1204 * @name: name to add 1205 * 1206 * Add a name to the list of audit names for this context. 1207 * Called from fs/namei.c:getname(). 1208 */ 1209 void __audit_getname(const char *name) 1210 { 1211 struct audit_context *context = current->audit_context; 1212 1213 if (IS_ERR(name) || !name) 1214 return; 1215 1216 if (!context->in_syscall) { 1217 #if AUDIT_DEBUG == 2 1218 printk(KERN_ERR "%s:%d(:%d): ignoring getname(%p)\n", 1219 __FILE__, __LINE__, context->serial, name); 1220 dump_stack(); 1221 #endif 1222 return; 1223 } 1224 BUG_ON(context->name_count >= AUDIT_NAMES); 1225 context->names[context->name_count].name = name; 1226 context->names[context->name_count].name_len = AUDIT_NAME_FULL; 1227 context->names[context->name_count].name_put = 1; 1228 context->names[context->name_count].ino = (unsigned long)-1; 1229 ++context->name_count; 1230 if (!context->pwd) { 1231 read_lock(¤t->fs->lock); 1232 context->pwd = dget(current->fs->pwd); 1233 context->pwdmnt = mntget(current->fs->pwdmnt); 1234 read_unlock(¤t->fs->lock); 1235 } 1236 1237 } 1238 1239 /* audit_putname - intercept a putname request 1240 * @name: name to intercept and delay for putname 1241 * 1242 * If we have stored the name from getname in the audit context, 1243 * then we delay the putname until syscall exit. 1244 * Called from include/linux/fs.h:putname(). 1245 */ 1246 void audit_putname(const char *name) 1247 { 1248 struct audit_context *context = current->audit_context; 1249 1250 BUG_ON(!context); 1251 if (!context->in_syscall) { 1252 #if AUDIT_DEBUG == 2 1253 printk(KERN_ERR "%s:%d(:%d): __putname(%p)\n", 1254 __FILE__, __LINE__, context->serial, name); 1255 if (context->name_count) { 1256 int i; 1257 for (i = 0; i < context->name_count; i++) 1258 printk(KERN_ERR "name[%d] = %p = %s\n", i, 1259 context->names[i].name, 1260 context->names[i].name ?: "(null)"); 1261 } 1262 #endif 1263 __putname(name); 1264 } 1265 #if AUDIT_DEBUG 1266 else { 1267 ++context->put_count; 1268 if (context->put_count > context->name_count) { 1269 printk(KERN_ERR "%s:%d(:%d): major=%d" 1270 " in_syscall=%d putname(%p) name_count=%d" 1271 " put_count=%d\n", 1272 __FILE__, __LINE__, 1273 context->serial, context->major, 1274 context->in_syscall, name, context->name_count, 1275 context->put_count); 1276 dump_stack(); 1277 } 1278 } 1279 #endif 1280 } 1281 1282 /* Copy inode data into an audit_names. */ 1283 static void audit_copy_inode(struct audit_names *name, const struct inode *inode) 1284 { 1285 name->ino = inode->i_ino; 1286 name->dev = inode->i_sb->s_dev; 1287 name->mode = inode->i_mode; 1288 name->uid = inode->i_uid; 1289 name->gid = inode->i_gid; 1290 name->rdev = inode->i_rdev; 1291 selinux_get_inode_sid(inode, &name->osid); 1292 } 1293 1294 /** 1295 * audit_inode - store the inode and device from a lookup 1296 * @name: name being audited 1297 * @inode: inode being audited 1298 * 1299 * Called from fs/namei.c:path_lookup(). 1300 */ 1301 void __audit_inode(const char *name, const struct inode *inode) 1302 { 1303 int idx; 1304 struct audit_context *context = current->audit_context; 1305 1306 if (!context->in_syscall) 1307 return; 1308 if (context->name_count 1309 && context->names[context->name_count-1].name 1310 && context->names[context->name_count-1].name == name) 1311 idx = context->name_count - 1; 1312 else if (context->name_count > 1 1313 && context->names[context->name_count-2].name 1314 && context->names[context->name_count-2].name == name) 1315 idx = context->name_count - 2; 1316 else { 1317 /* FIXME: how much do we care about inodes that have no 1318 * associated name? */ 1319 if (context->name_count >= AUDIT_NAMES - AUDIT_NAMES_RESERVED) 1320 return; 1321 idx = context->name_count++; 1322 context->names[idx].name = NULL; 1323 #if AUDIT_DEBUG 1324 ++context->ino_count; 1325 #endif 1326 } 1327 audit_copy_inode(&context->names[idx], inode); 1328 } 1329 1330 /** 1331 * audit_inode_child - collect inode info for created/removed objects 1332 * @dname: inode's dentry name 1333 * @inode: inode being audited 1334 * @parent: inode of dentry parent 1335 * 1336 * For syscalls that create or remove filesystem objects, audit_inode 1337 * can only collect information for the filesystem object's parent. 1338 * This call updates the audit context with the child's information. 1339 * Syscalls that create a new filesystem object must be hooked after 1340 * the object is created. Syscalls that remove a filesystem object 1341 * must be hooked prior, in order to capture the target inode during 1342 * unsuccessful attempts. 1343 */ 1344 void __audit_inode_child(const char *dname, const struct inode *inode, 1345 const struct inode *parent) 1346 { 1347 int idx; 1348 struct audit_context *context = current->audit_context; 1349 const char *found_name = NULL; 1350 int dirlen = 0; 1351 1352 if (!context->in_syscall) 1353 return; 1354 1355 /* determine matching parent */ 1356 if (!dname) 1357 goto update_context; 1358 for (idx = 0; idx < context->name_count; idx++) 1359 if (context->names[idx].ino == parent->i_ino) { 1360 const char *name = context->names[idx].name; 1361 1362 if (!name) 1363 continue; 1364 1365 if (audit_compare_dname_path(dname, name, &dirlen) == 0) { 1366 context->names[idx].name_len = dirlen; 1367 found_name = name; 1368 break; 1369 } 1370 } 1371 1372 update_context: 1373 idx = context->name_count; 1374 if (context->name_count == AUDIT_NAMES) { 1375 printk(KERN_DEBUG "name_count maxed and losing %s\n", 1376 found_name ?: "(null)"); 1377 return; 1378 } 1379 context->name_count++; 1380 #if AUDIT_DEBUG 1381 context->ino_count++; 1382 #endif 1383 /* Re-use the name belonging to the slot for a matching parent directory. 1384 * All names for this context are relinquished in audit_free_names() */ 1385 context->names[idx].name = found_name; 1386 context->names[idx].name_len = AUDIT_NAME_FULL; 1387 context->names[idx].name_put = 0; /* don't call __putname() */ 1388 1389 if (!inode) 1390 context->names[idx].ino = (unsigned long)-1; 1391 else 1392 audit_copy_inode(&context->names[idx], inode); 1393 1394 /* A parent was not found in audit_names, so copy the inode data for the 1395 * provided parent. */ 1396 if (!found_name) { 1397 idx = context->name_count; 1398 if (context->name_count == AUDIT_NAMES) { 1399 printk(KERN_DEBUG 1400 "name_count maxed and losing parent inode data: dev=%02x:%02x, inode=%lu", 1401 MAJOR(parent->i_sb->s_dev), 1402 MINOR(parent->i_sb->s_dev), 1403 parent->i_ino); 1404 return; 1405 } 1406 context->name_count++; 1407 #if AUDIT_DEBUG 1408 context->ino_count++; 1409 #endif 1410 audit_copy_inode(&context->names[idx], parent); 1411 } 1412 } 1413 1414 /** 1415 * audit_inode_update - update inode info for last collected name 1416 * @inode: inode being audited 1417 * 1418 * When open() is called on an existing object with the O_CREAT flag, the inode 1419 * data audit initially collects is incorrect. This additional hook ensures 1420 * audit has the inode data for the actual object to be opened. 1421 */ 1422 void __audit_inode_update(const struct inode *inode) 1423 { 1424 struct audit_context *context = current->audit_context; 1425 int idx; 1426 1427 if (!context->in_syscall || !inode) 1428 return; 1429 1430 if (context->name_count == 0) { 1431 context->name_count++; 1432 #if AUDIT_DEBUG 1433 context->ino_count++; 1434 #endif 1435 } 1436 idx = context->name_count - 1; 1437 1438 audit_copy_inode(&context->names[idx], inode); 1439 } 1440 1441 /** 1442 * auditsc_get_stamp - get local copies of audit_context values 1443 * @ctx: audit_context for the task 1444 * @t: timespec to store time recorded in the audit_context 1445 * @serial: serial value that is recorded in the audit_context 1446 * 1447 * Also sets the context as auditable. 1448 */ 1449 void auditsc_get_stamp(struct audit_context *ctx, 1450 struct timespec *t, unsigned int *serial) 1451 { 1452 if (!ctx->serial) 1453 ctx->serial = audit_serial(); 1454 t->tv_sec = ctx->ctime.tv_sec; 1455 t->tv_nsec = ctx->ctime.tv_nsec; 1456 *serial = ctx->serial; 1457 ctx->auditable = 1; 1458 } 1459 1460 /** 1461 * audit_set_loginuid - set a task's audit_context loginuid 1462 * @task: task whose audit context is being modified 1463 * @loginuid: loginuid value 1464 * 1465 * Returns 0. 1466 * 1467 * Called (set) from fs/proc/base.c::proc_loginuid_write(). 1468 */ 1469 int audit_set_loginuid(struct task_struct *task, uid_t loginuid) 1470 { 1471 struct audit_context *context = task->audit_context; 1472 1473 if (context) { 1474 /* Only log if audit is enabled */ 1475 if (context->in_syscall) { 1476 struct audit_buffer *ab; 1477 1478 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN); 1479 if (ab) { 1480 audit_log_format(ab, "login pid=%d uid=%u " 1481 "old auid=%u new auid=%u", 1482 task->pid, task->uid, 1483 context->loginuid, loginuid); 1484 audit_log_end(ab); 1485 } 1486 } 1487 context->loginuid = loginuid; 1488 } 1489 return 0; 1490 } 1491 1492 /** 1493 * audit_get_loginuid - get the loginuid for an audit_context 1494 * @ctx: the audit_context 1495 * 1496 * Returns the context's loginuid or -1 if @ctx is NULL. 1497 */ 1498 uid_t audit_get_loginuid(struct audit_context *ctx) 1499 { 1500 return ctx ? ctx->loginuid : -1; 1501 } 1502 1503 EXPORT_SYMBOL(audit_get_loginuid); 1504 1505 /** 1506 * __audit_mq_open - record audit data for a POSIX MQ open 1507 * @oflag: open flag 1508 * @mode: mode bits 1509 * @u_attr: queue attributes 1510 * 1511 * Returns 0 for success or NULL context or < 0 on error. 1512 */ 1513 int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr) 1514 { 1515 struct audit_aux_data_mq_open *ax; 1516 struct audit_context *context = current->audit_context; 1517 1518 if (!audit_enabled) 1519 return 0; 1520 1521 if (likely(!context)) 1522 return 0; 1523 1524 ax = kmalloc(sizeof(*ax), GFP_ATOMIC); 1525 if (!ax) 1526 return -ENOMEM; 1527 1528 if (u_attr != NULL) { 1529 if (copy_from_user(&ax->attr, u_attr, sizeof(ax->attr))) { 1530 kfree(ax); 1531 return -EFAULT; 1532 } 1533 } else 1534 memset(&ax->attr, 0, sizeof(ax->attr)); 1535 1536 ax->oflag = oflag; 1537 ax->mode = mode; 1538 1539 ax->d.type = AUDIT_MQ_OPEN; 1540 ax->d.next = context->aux; 1541 context->aux = (void *)ax; 1542 return 0; 1543 } 1544 1545 /** 1546 * __audit_mq_timedsend - record audit data for a POSIX MQ timed send 1547 * @mqdes: MQ descriptor 1548 * @msg_len: Message length 1549 * @msg_prio: Message priority 1550 * @u_abs_timeout: Message timeout in absolute time 1551 * 1552 * Returns 0 for success or NULL context or < 0 on error. 1553 */ 1554 int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, 1555 const struct timespec __user *u_abs_timeout) 1556 { 1557 struct audit_aux_data_mq_sendrecv *ax; 1558 struct audit_context *context = current->audit_context; 1559 1560 if (!audit_enabled) 1561 return 0; 1562 1563 if (likely(!context)) 1564 return 0; 1565 1566 ax = kmalloc(sizeof(*ax), GFP_ATOMIC); 1567 if (!ax) 1568 return -ENOMEM; 1569 1570 if (u_abs_timeout != NULL) { 1571 if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) { 1572 kfree(ax); 1573 return -EFAULT; 1574 } 1575 } else 1576 memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout)); 1577 1578 ax->mqdes = mqdes; 1579 ax->msg_len = msg_len; 1580 ax->msg_prio = msg_prio; 1581 1582 ax->d.type = AUDIT_MQ_SENDRECV; 1583 ax->d.next = context->aux; 1584 context->aux = (void *)ax; 1585 return 0; 1586 } 1587 1588 /** 1589 * __audit_mq_timedreceive - record audit data for a POSIX MQ timed receive 1590 * @mqdes: MQ descriptor 1591 * @msg_len: Message length 1592 * @u_msg_prio: Message priority 1593 * @u_abs_timeout: Message timeout in absolute time 1594 * 1595 * Returns 0 for success or NULL context or < 0 on error. 1596 */ 1597 int __audit_mq_timedreceive(mqd_t mqdes, size_t msg_len, 1598 unsigned int __user *u_msg_prio, 1599 const struct timespec __user *u_abs_timeout) 1600 { 1601 struct audit_aux_data_mq_sendrecv *ax; 1602 struct audit_context *context = current->audit_context; 1603 1604 if (!audit_enabled) 1605 return 0; 1606 1607 if (likely(!context)) 1608 return 0; 1609 1610 ax = kmalloc(sizeof(*ax), GFP_ATOMIC); 1611 if (!ax) 1612 return -ENOMEM; 1613 1614 if (u_msg_prio != NULL) { 1615 if (get_user(ax->msg_prio, u_msg_prio)) { 1616 kfree(ax); 1617 return -EFAULT; 1618 } 1619 } else 1620 ax->msg_prio = 0; 1621 1622 if (u_abs_timeout != NULL) { 1623 if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) { 1624 kfree(ax); 1625 return -EFAULT; 1626 } 1627 } else 1628 memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout)); 1629 1630 ax->mqdes = mqdes; 1631 ax->msg_len = msg_len; 1632 1633 ax->d.type = AUDIT_MQ_SENDRECV; 1634 ax->d.next = context->aux; 1635 context->aux = (void *)ax; 1636 return 0; 1637 } 1638 1639 /** 1640 * __audit_mq_notify - record audit data for a POSIX MQ notify 1641 * @mqdes: MQ descriptor 1642 * @u_notification: Notification event 1643 * 1644 * Returns 0 for success or NULL context or < 0 on error. 1645 */ 1646 1647 int __audit_mq_notify(mqd_t mqdes, const struct sigevent __user *u_notification) 1648 { 1649 struct audit_aux_data_mq_notify *ax; 1650 struct audit_context *context = current->audit_context; 1651 1652 if (!audit_enabled) 1653 return 0; 1654 1655 if (likely(!context)) 1656 return 0; 1657 1658 ax = kmalloc(sizeof(*ax), GFP_ATOMIC); 1659 if (!ax) 1660 return -ENOMEM; 1661 1662 if (u_notification != NULL) { 1663 if (copy_from_user(&ax->notification, u_notification, sizeof(ax->notification))) { 1664 kfree(ax); 1665 return -EFAULT; 1666 } 1667 } else 1668 memset(&ax->notification, 0, sizeof(ax->notification)); 1669 1670 ax->mqdes = mqdes; 1671 1672 ax->d.type = AUDIT_MQ_NOTIFY; 1673 ax->d.next = context->aux; 1674 context->aux = (void *)ax; 1675 return 0; 1676 } 1677 1678 /** 1679 * __audit_mq_getsetattr - record audit data for a POSIX MQ get/set attribute 1680 * @mqdes: MQ descriptor 1681 * @mqstat: MQ flags 1682 * 1683 * Returns 0 for success or NULL context or < 0 on error. 1684 */ 1685 int __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) 1686 { 1687 struct audit_aux_data_mq_getsetattr *ax; 1688 struct audit_context *context = current->audit_context; 1689 1690 if (!audit_enabled) 1691 return 0; 1692 1693 if (likely(!context)) 1694 return 0; 1695 1696 ax = kmalloc(sizeof(*ax), GFP_ATOMIC); 1697 if (!ax) 1698 return -ENOMEM; 1699 1700 ax->mqdes = mqdes; 1701 ax->mqstat = *mqstat; 1702 1703 ax->d.type = AUDIT_MQ_GETSETATTR; 1704 ax->d.next = context->aux; 1705 context->aux = (void *)ax; 1706 return 0; 1707 } 1708 1709 /** 1710 * audit_ipc_obj - record audit data for ipc object 1711 * @ipcp: ipc permissions 1712 * 1713 * Returns 0 for success or NULL context or < 0 on error. 1714 */ 1715 int __audit_ipc_obj(struct kern_ipc_perm *ipcp) 1716 { 1717 struct audit_aux_data_ipcctl *ax; 1718 struct audit_context *context = current->audit_context; 1719 1720 ax = kmalloc(sizeof(*ax), GFP_ATOMIC); 1721 if (!ax) 1722 return -ENOMEM; 1723 1724 ax->uid = ipcp->uid; 1725 ax->gid = ipcp->gid; 1726 ax->mode = ipcp->mode; 1727 selinux_get_ipc_sid(ipcp, &ax->osid); 1728 1729 ax->d.type = AUDIT_IPC; 1730 ax->d.next = context->aux; 1731 context->aux = (void *)ax; 1732 return 0; 1733 } 1734 1735 /** 1736 * audit_ipc_set_perm - record audit data for new ipc permissions 1737 * @qbytes: msgq bytes 1738 * @uid: msgq user id 1739 * @gid: msgq group id 1740 * @mode: msgq mode (permissions) 1741 * 1742 * Returns 0 for success or NULL context or < 0 on error. 1743 */ 1744 int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode) 1745 { 1746 struct audit_aux_data_ipcctl *ax; 1747 struct audit_context *context = current->audit_context; 1748 1749 ax = kmalloc(sizeof(*ax), GFP_ATOMIC); 1750 if (!ax) 1751 return -ENOMEM; 1752 1753 ax->qbytes = qbytes; 1754 ax->uid = uid; 1755 ax->gid = gid; 1756 ax->mode = mode; 1757 1758 ax->d.type = AUDIT_IPC_SET_PERM; 1759 ax->d.next = context->aux; 1760 context->aux = (void *)ax; 1761 return 0; 1762 } 1763 1764 int audit_bprm(struct linux_binprm *bprm) 1765 { 1766 struct audit_aux_data_execve *ax; 1767 struct audit_context *context = current->audit_context; 1768 unsigned long p, next; 1769 void *to; 1770 1771 if (likely(!audit_enabled || !context || context->dummy)) 1772 return 0; 1773 1774 ax = kmalloc(sizeof(*ax) + PAGE_SIZE * MAX_ARG_PAGES - bprm->p, 1775 GFP_KERNEL); 1776 if (!ax) 1777 return -ENOMEM; 1778 1779 ax->argc = bprm->argc; 1780 ax->envc = bprm->envc; 1781 for (p = bprm->p, to = ax->mem; p < MAX_ARG_PAGES*PAGE_SIZE; p = next) { 1782 struct page *page = bprm->page[p / PAGE_SIZE]; 1783 void *kaddr = kmap(page); 1784 next = (p + PAGE_SIZE) & ~(PAGE_SIZE - 1); 1785 memcpy(to, kaddr + (p & (PAGE_SIZE - 1)), next - p); 1786 to += next - p; 1787 kunmap(page); 1788 } 1789 1790 ax->d.type = AUDIT_EXECVE; 1791 ax->d.next = context->aux; 1792 context->aux = (void *)ax; 1793 return 0; 1794 } 1795 1796 1797 /** 1798 * audit_socketcall - record audit data for sys_socketcall 1799 * @nargs: number of args 1800 * @args: args array 1801 * 1802 * Returns 0 for success or NULL context or < 0 on error. 1803 */ 1804 int audit_socketcall(int nargs, unsigned long *args) 1805 { 1806 struct audit_aux_data_socketcall *ax; 1807 struct audit_context *context = current->audit_context; 1808 1809 if (likely(!context || context->dummy)) 1810 return 0; 1811 1812 ax = kmalloc(sizeof(*ax) + nargs * sizeof(unsigned long), GFP_KERNEL); 1813 if (!ax) 1814 return -ENOMEM; 1815 1816 ax->nargs = nargs; 1817 memcpy(ax->args, args, nargs * sizeof(unsigned long)); 1818 1819 ax->d.type = AUDIT_SOCKETCALL; 1820 ax->d.next = context->aux; 1821 context->aux = (void *)ax; 1822 return 0; 1823 } 1824 1825 /** 1826 * __audit_fd_pair - record audit data for pipe and socketpair 1827 * @fd1: the first file descriptor 1828 * @fd2: the second file descriptor 1829 * 1830 * Returns 0 for success or NULL context or < 0 on error. 1831 */ 1832 int __audit_fd_pair(int fd1, int fd2) 1833 { 1834 struct audit_context *context = current->audit_context; 1835 struct audit_aux_data_fd_pair *ax; 1836 1837 if (likely(!context)) { 1838 return 0; 1839 } 1840 1841 ax = kmalloc(sizeof(*ax), GFP_KERNEL); 1842 if (!ax) { 1843 return -ENOMEM; 1844 } 1845 1846 ax->fd[0] = fd1; 1847 ax->fd[1] = fd2; 1848 1849 ax->d.type = AUDIT_FD_PAIR; 1850 ax->d.next = context->aux; 1851 context->aux = (void *)ax; 1852 return 0; 1853 } 1854 1855 /** 1856 * audit_sockaddr - record audit data for sys_bind, sys_connect, sys_sendto 1857 * @len: data length in user space 1858 * @a: data address in kernel space 1859 * 1860 * Returns 0 for success or NULL context or < 0 on error. 1861 */ 1862 int audit_sockaddr(int len, void *a) 1863 { 1864 struct audit_aux_data_sockaddr *ax; 1865 struct audit_context *context = current->audit_context; 1866 1867 if (likely(!context || context->dummy)) 1868 return 0; 1869 1870 ax = kmalloc(sizeof(*ax) + len, GFP_KERNEL); 1871 if (!ax) 1872 return -ENOMEM; 1873 1874 ax->len = len; 1875 memcpy(ax->a, a, len); 1876 1877 ax->d.type = AUDIT_SOCKADDR; 1878 ax->d.next = context->aux; 1879 context->aux = (void *)ax; 1880 return 0; 1881 } 1882 1883 /** 1884 * audit_avc_path - record the granting or denial of permissions 1885 * @dentry: dentry to record 1886 * @mnt: mnt to record 1887 * 1888 * Returns 0 for success or NULL context or < 0 on error. 1889 * 1890 * Called from security/selinux/avc.c::avc_audit() 1891 */ 1892 int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt) 1893 { 1894 struct audit_aux_data_path *ax; 1895 struct audit_context *context = current->audit_context; 1896 1897 if (likely(!context)) 1898 return 0; 1899 1900 ax = kmalloc(sizeof(*ax), GFP_ATOMIC); 1901 if (!ax) 1902 return -ENOMEM; 1903 1904 ax->dentry = dget(dentry); 1905 ax->mnt = mntget(mnt); 1906 1907 ax->d.type = AUDIT_AVC_PATH; 1908 ax->d.next = context->aux; 1909 context->aux = (void *)ax; 1910 return 0; 1911 } 1912 1913 /** 1914 * audit_signal_info - record signal info for shutting down audit subsystem 1915 * @sig: signal value 1916 * @t: task being signaled 1917 * 1918 * If the audit subsystem is being terminated, record the task (pid) 1919 * and uid that is doing that. 1920 */ 1921 void __audit_signal_info(int sig, struct task_struct *t) 1922 { 1923 extern pid_t audit_sig_pid; 1924 extern uid_t audit_sig_uid; 1925 extern u32 audit_sig_sid; 1926 1927 if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1) { 1928 struct task_struct *tsk = current; 1929 struct audit_context *ctx = tsk->audit_context; 1930 audit_sig_pid = tsk->pid; 1931 if (ctx) 1932 audit_sig_uid = ctx->loginuid; 1933 else 1934 audit_sig_uid = tsk->uid; 1935 selinux_get_task_sid(tsk, &audit_sig_sid); 1936 } 1937 } 1938