xref: /linux/kernel/auditsc.c (revision fba2689ee77e63b05e203b3f26079ef915e55660)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* auditsc.c -- System-call auditing support
3  * Handles all system-call specific auditing features.
4  *
5  * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
6  * Copyright 2005 Hewlett-Packard Development Company, L.P.
7  * Copyright (C) 2005, 2006 IBM Corporation
8  * All Rights Reserved.
9  *
10  * Written by Rickard E. (Rik) Faith <faith@redhat.com>
11  *
12  * Many of the ideas implemented here are from Stephen C. Tweedie,
13  * especially the idea of avoiding a copy by using getname.
14  *
15  * The method for actual interception of syscall entry and exit (not in
16  * this file -- see entry.S) is based on a GPL'd patch written by
17  * okir@suse.de and Copyright 2003 SuSE Linux AG.
18  *
19  * POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>,
20  * 2006.
21  *
22  * The support of additional filter rules compares (>, <, >=, <=) was
23  * added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005.
24  *
25  * Modified by Amy Griffis <amy.griffis@hp.com> to collect additional
26  * filesystem information.
27  *
28  * Subject and object context labeling support added by <danjones@us.ibm.com>
29  * and <dustin.kirkland@us.ibm.com> for LSPP certification compliance.
30  */
31 
32 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
33 
34 #include <linux/init.h>
35 #include <asm/types.h>
36 #include <linux/atomic.h>
37 #include <linux/fs.h>
38 #include <linux/namei.h>
39 #include <linux/mm.h>
40 #include <linux/export.h>
41 #include <linux/slab.h>
42 #include <linux/mount.h>
43 #include <linux/socket.h>
44 #include <linux/mqueue.h>
45 #include <linux/audit.h>
46 #include <linux/personality.h>
47 #include <linux/time.h>
48 #include <linux/netlink.h>
49 #include <linux/compiler.h>
50 #include <asm/unistd.h>
51 #include <linux/security.h>
52 #include <linux/list.h>
53 #include <linux/binfmts.h>
54 #include <linux/highmem.h>
55 #include <linux/syscalls.h>
56 #include <asm/syscall.h>
57 #include <linux/capability.h>
58 #include <linux/fs_struct.h>
59 #include <linux/compat.h>
60 #include <linux/ctype.h>
61 #include <linux/string.h>
62 #include <linux/uaccess.h>
63 #include <linux/fsnotify_backend.h>
64 #include <uapi/linux/limits.h>
65 #include <uapi/linux/netfilter/nf_tables.h>
66 #include <uapi/linux/openat2.h> // struct open_how
67 
68 #include "audit.h"
69 
70 /* flags stating the success for a syscall */
71 #define AUDITSC_INVALID 0
72 #define AUDITSC_SUCCESS 1
73 #define AUDITSC_FAILURE 2
74 
75 /* no execve audit message should be longer than this (userspace limits),
76  * see the note near the top of audit_log_execve_info() about this value */
77 #define MAX_EXECVE_AUDIT_LEN 7500
78 
79 /* max length to print of cmdline/proctitle value during audit */
80 #define MAX_PROCTITLE_AUDIT_LEN 128
81 
82 /* number of audit rules */
83 int audit_n_rules;
84 
85 /* determines whether we collect data for signals sent */
86 int audit_signals;
87 
88 struct audit_aux_data {
89 	struct audit_aux_data	*next;
90 	int			type;
91 };
92 
93 /* Number of target pids per aux struct. */
94 #define AUDIT_AUX_PIDS	16
95 
96 struct audit_aux_data_pids {
97 	struct audit_aux_data	d;
98 	pid_t			target_pid[AUDIT_AUX_PIDS];
99 	kuid_t			target_auid[AUDIT_AUX_PIDS];
100 	kuid_t			target_uid[AUDIT_AUX_PIDS];
101 	unsigned int		target_sessionid[AUDIT_AUX_PIDS];
102 	u32			target_sid[AUDIT_AUX_PIDS];
103 	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
104 	int			pid_count;
105 };
106 
107 struct audit_aux_data_bprm_fcaps {
108 	struct audit_aux_data	d;
109 	struct audit_cap_data	fcap;
110 	unsigned int		fcap_ver;
111 	struct audit_cap_data	old_pcap;
112 	struct audit_cap_data	new_pcap;
113 };
114 
115 struct audit_tree_refs {
116 	struct audit_tree_refs *next;
117 	struct audit_chunk *c[31];
118 };
119 
120 struct audit_nfcfgop_tab {
121 	enum audit_nfcfgop	op;
122 	const char		*s;
123 };
124 
125 static const struct audit_nfcfgop_tab audit_nfcfgs[] = {
126 	{ AUDIT_XT_OP_REGISTER,			"xt_register"		   },
127 	{ AUDIT_XT_OP_REPLACE,			"xt_replace"		   },
128 	{ AUDIT_XT_OP_UNREGISTER,		"xt_unregister"		   },
129 	{ AUDIT_NFT_OP_TABLE_REGISTER,		"nft_register_table"	   },
130 	{ AUDIT_NFT_OP_TABLE_UNREGISTER,	"nft_unregister_table"	   },
131 	{ AUDIT_NFT_OP_CHAIN_REGISTER,		"nft_register_chain"	   },
132 	{ AUDIT_NFT_OP_CHAIN_UNREGISTER,	"nft_unregister_chain"	   },
133 	{ AUDIT_NFT_OP_RULE_REGISTER,		"nft_register_rule"	   },
134 	{ AUDIT_NFT_OP_RULE_UNREGISTER,		"nft_unregister_rule"	   },
135 	{ AUDIT_NFT_OP_SET_REGISTER,		"nft_register_set"	   },
136 	{ AUDIT_NFT_OP_SET_UNREGISTER,		"nft_unregister_set"	   },
137 	{ AUDIT_NFT_OP_SETELEM_REGISTER,	"nft_register_setelem"	   },
138 	{ AUDIT_NFT_OP_SETELEM_UNREGISTER,	"nft_unregister_setelem"   },
139 	{ AUDIT_NFT_OP_GEN_REGISTER,		"nft_register_gen"	   },
140 	{ AUDIT_NFT_OP_OBJ_REGISTER,		"nft_register_obj"	   },
141 	{ AUDIT_NFT_OP_OBJ_UNREGISTER,		"nft_unregister_obj"	   },
142 	{ AUDIT_NFT_OP_OBJ_RESET,		"nft_reset_obj"		   },
143 	{ AUDIT_NFT_OP_FLOWTABLE_REGISTER,	"nft_register_flowtable"   },
144 	{ AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,	"nft_unregister_flowtable" },
145 	{ AUDIT_NFT_OP_INVALID,			"nft_invalid"		   },
146 };
147 
148 static int audit_match_perm(struct audit_context *ctx, int mask)
149 {
150 	unsigned n;
151 
152 	if (unlikely(!ctx))
153 		return 0;
154 	n = ctx->major;
155 
156 	switch (audit_classify_syscall(ctx->arch, n)) {
157 	case AUDITSC_NATIVE:
158 		if ((mask & AUDIT_PERM_WRITE) &&
159 		     audit_match_class(AUDIT_CLASS_WRITE, n))
160 			return 1;
161 		if ((mask & AUDIT_PERM_READ) &&
162 		     audit_match_class(AUDIT_CLASS_READ, n))
163 			return 1;
164 		if ((mask & AUDIT_PERM_ATTR) &&
165 		     audit_match_class(AUDIT_CLASS_CHATTR, n))
166 			return 1;
167 		return 0;
168 	case AUDITSC_COMPAT: /* 32bit on biarch */
169 		if ((mask & AUDIT_PERM_WRITE) &&
170 		     audit_match_class(AUDIT_CLASS_WRITE_32, n))
171 			return 1;
172 		if ((mask & AUDIT_PERM_READ) &&
173 		     audit_match_class(AUDIT_CLASS_READ_32, n))
174 			return 1;
175 		if ((mask & AUDIT_PERM_ATTR) &&
176 		     audit_match_class(AUDIT_CLASS_CHATTR_32, n))
177 			return 1;
178 		return 0;
179 	case AUDITSC_OPEN:
180 		return mask & ACC_MODE(ctx->argv[1]);
181 	case AUDITSC_OPENAT:
182 		return mask & ACC_MODE(ctx->argv[2]);
183 	case AUDITSC_SOCKETCALL:
184 		return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);
185 	case AUDITSC_EXECVE:
186 		return mask & AUDIT_PERM_EXEC;
187 	case AUDITSC_OPENAT2:
188 		return mask & ACC_MODE((u32)ctx->openat2.flags);
189 	default:
190 		return 0;
191 	}
192 }
193 
194 static int audit_match_filetype(struct audit_context *ctx, int val)
195 {
196 	struct audit_names *n;
197 	umode_t mode = (umode_t)val;
198 
199 	if (unlikely(!ctx))
200 		return 0;
201 
202 	list_for_each_entry(n, &ctx->names_list, list) {
203 		if ((n->ino != AUDIT_INO_UNSET) &&
204 		    ((n->mode & S_IFMT) == mode))
205 			return 1;
206 	}
207 
208 	return 0;
209 }
210 
211 /*
212  * We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *;
213  * ->first_trees points to its beginning, ->trees - to the current end of data.
214  * ->tree_count is the number of free entries in array pointed to by ->trees.
215  * Original condition is (NULL, NULL, 0); as soon as it grows we never revert to NULL,
216  * "empty" becomes (p, p, 31) afterwards.  We don't shrink the list (and seriously,
217  * it's going to remain 1-element for almost any setup) until we free context itself.
218  * References in it _are_ dropped - at the same time we free/drop aux stuff.
219  */
220 
221 static void audit_set_auditable(struct audit_context *ctx)
222 {
223 	if (!ctx->prio) {
224 		ctx->prio = 1;
225 		ctx->current_state = AUDIT_STATE_RECORD;
226 	}
227 }
228 
229 static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk)
230 {
231 	struct audit_tree_refs *p = ctx->trees;
232 	int left = ctx->tree_count;
233 
234 	if (likely(left)) {
235 		p->c[--left] = chunk;
236 		ctx->tree_count = left;
237 		return 1;
238 	}
239 	if (!p)
240 		return 0;
241 	p = p->next;
242 	if (p) {
243 		p->c[30] = chunk;
244 		ctx->trees = p;
245 		ctx->tree_count = 30;
246 		return 1;
247 	}
248 	return 0;
249 }
250 
251 static int grow_tree_refs(struct audit_context *ctx)
252 {
253 	struct audit_tree_refs *p = ctx->trees;
254 
255 	ctx->trees = kzalloc(sizeof(struct audit_tree_refs), GFP_KERNEL);
256 	if (!ctx->trees) {
257 		ctx->trees = p;
258 		return 0;
259 	}
260 	if (p)
261 		p->next = ctx->trees;
262 	else
263 		ctx->first_trees = ctx->trees;
264 	ctx->tree_count = 31;
265 	return 1;
266 }
267 
268 static void unroll_tree_refs(struct audit_context *ctx,
269 		      struct audit_tree_refs *p, int count)
270 {
271 	struct audit_tree_refs *q;
272 	int n;
273 
274 	if (!p) {
275 		/* we started with empty chain */
276 		p = ctx->first_trees;
277 		count = 31;
278 		/* if the very first allocation has failed, nothing to do */
279 		if (!p)
280 			return;
281 	}
282 	n = count;
283 	for (q = p; q != ctx->trees; q = q->next, n = 31) {
284 		while (n--) {
285 			audit_put_chunk(q->c[n]);
286 			q->c[n] = NULL;
287 		}
288 	}
289 	while (n-- > ctx->tree_count) {
290 		audit_put_chunk(q->c[n]);
291 		q->c[n] = NULL;
292 	}
293 	ctx->trees = p;
294 	ctx->tree_count = count;
295 }
296 
297 static void free_tree_refs(struct audit_context *ctx)
298 {
299 	struct audit_tree_refs *p, *q;
300 
301 	for (p = ctx->first_trees; p; p = q) {
302 		q = p->next;
303 		kfree(p);
304 	}
305 }
306 
307 static int match_tree_refs(struct audit_context *ctx, struct audit_tree *tree)
308 {
309 	struct audit_tree_refs *p;
310 	int n;
311 
312 	if (!tree)
313 		return 0;
314 	/* full ones */
315 	for (p = ctx->first_trees; p != ctx->trees; p = p->next) {
316 		for (n = 0; n < 31; n++)
317 			if (audit_tree_match(p->c[n], tree))
318 				return 1;
319 	}
320 	/* partial */
321 	if (p) {
322 		for (n = ctx->tree_count; n < 31; n++)
323 			if (audit_tree_match(p->c[n], tree))
324 				return 1;
325 	}
326 	return 0;
327 }
328 
329 static int audit_compare_uid(kuid_t uid,
330 			     struct audit_names *name,
331 			     struct audit_field *f,
332 			     struct audit_context *ctx)
333 {
334 	struct audit_names *n;
335 	int rc;
336 
337 	if (name) {
338 		rc = audit_uid_comparator(uid, f->op, name->uid);
339 		if (rc)
340 			return rc;
341 	}
342 
343 	if (ctx) {
344 		list_for_each_entry(n, &ctx->names_list, list) {
345 			rc = audit_uid_comparator(uid, f->op, n->uid);
346 			if (rc)
347 				return rc;
348 		}
349 	}
350 	return 0;
351 }
352 
353 static int audit_compare_gid(kgid_t gid,
354 			     struct audit_names *name,
355 			     struct audit_field *f,
356 			     struct audit_context *ctx)
357 {
358 	struct audit_names *n;
359 	int rc;
360 
361 	if (name) {
362 		rc = audit_gid_comparator(gid, f->op, name->gid);
363 		if (rc)
364 			return rc;
365 	}
366 
367 	if (ctx) {
368 		list_for_each_entry(n, &ctx->names_list, list) {
369 			rc = audit_gid_comparator(gid, f->op, n->gid);
370 			if (rc)
371 				return rc;
372 		}
373 	}
374 	return 0;
375 }
376 
377 static int audit_field_compare(struct task_struct *tsk,
378 			       const struct cred *cred,
379 			       struct audit_field *f,
380 			       struct audit_context *ctx,
381 			       struct audit_names *name)
382 {
383 	switch (f->val) {
384 	/* process to file object comparisons */
385 	case AUDIT_COMPARE_UID_TO_OBJ_UID:
386 		return audit_compare_uid(cred->uid, name, f, ctx);
387 	case AUDIT_COMPARE_GID_TO_OBJ_GID:
388 		return audit_compare_gid(cred->gid, name, f, ctx);
389 	case AUDIT_COMPARE_EUID_TO_OBJ_UID:
390 		return audit_compare_uid(cred->euid, name, f, ctx);
391 	case AUDIT_COMPARE_EGID_TO_OBJ_GID:
392 		return audit_compare_gid(cred->egid, name, f, ctx);
393 	case AUDIT_COMPARE_AUID_TO_OBJ_UID:
394 		return audit_compare_uid(audit_get_loginuid(tsk), name, f, ctx);
395 	case AUDIT_COMPARE_SUID_TO_OBJ_UID:
396 		return audit_compare_uid(cred->suid, name, f, ctx);
397 	case AUDIT_COMPARE_SGID_TO_OBJ_GID:
398 		return audit_compare_gid(cred->sgid, name, f, ctx);
399 	case AUDIT_COMPARE_FSUID_TO_OBJ_UID:
400 		return audit_compare_uid(cred->fsuid, name, f, ctx);
401 	case AUDIT_COMPARE_FSGID_TO_OBJ_GID:
402 		return audit_compare_gid(cred->fsgid, name, f, ctx);
403 	/* uid comparisons */
404 	case AUDIT_COMPARE_UID_TO_AUID:
405 		return audit_uid_comparator(cred->uid, f->op,
406 					    audit_get_loginuid(tsk));
407 	case AUDIT_COMPARE_UID_TO_EUID:
408 		return audit_uid_comparator(cred->uid, f->op, cred->euid);
409 	case AUDIT_COMPARE_UID_TO_SUID:
410 		return audit_uid_comparator(cred->uid, f->op, cred->suid);
411 	case AUDIT_COMPARE_UID_TO_FSUID:
412 		return audit_uid_comparator(cred->uid, f->op, cred->fsuid);
413 	/* auid comparisons */
414 	case AUDIT_COMPARE_AUID_TO_EUID:
415 		return audit_uid_comparator(audit_get_loginuid(tsk), f->op,
416 					    cred->euid);
417 	case AUDIT_COMPARE_AUID_TO_SUID:
418 		return audit_uid_comparator(audit_get_loginuid(tsk), f->op,
419 					    cred->suid);
420 	case AUDIT_COMPARE_AUID_TO_FSUID:
421 		return audit_uid_comparator(audit_get_loginuid(tsk), f->op,
422 					    cred->fsuid);
423 	/* euid comparisons */
424 	case AUDIT_COMPARE_EUID_TO_SUID:
425 		return audit_uid_comparator(cred->euid, f->op, cred->suid);
426 	case AUDIT_COMPARE_EUID_TO_FSUID:
427 		return audit_uid_comparator(cred->euid, f->op, cred->fsuid);
428 	/* suid comparisons */
429 	case AUDIT_COMPARE_SUID_TO_FSUID:
430 		return audit_uid_comparator(cred->suid, f->op, cred->fsuid);
431 	/* gid comparisons */
432 	case AUDIT_COMPARE_GID_TO_EGID:
433 		return audit_gid_comparator(cred->gid, f->op, cred->egid);
434 	case AUDIT_COMPARE_GID_TO_SGID:
435 		return audit_gid_comparator(cred->gid, f->op, cred->sgid);
436 	case AUDIT_COMPARE_GID_TO_FSGID:
437 		return audit_gid_comparator(cred->gid, f->op, cred->fsgid);
438 	/* egid comparisons */
439 	case AUDIT_COMPARE_EGID_TO_SGID:
440 		return audit_gid_comparator(cred->egid, f->op, cred->sgid);
441 	case AUDIT_COMPARE_EGID_TO_FSGID:
442 		return audit_gid_comparator(cred->egid, f->op, cred->fsgid);
443 	/* sgid comparison */
444 	case AUDIT_COMPARE_SGID_TO_FSGID:
445 		return audit_gid_comparator(cred->sgid, f->op, cred->fsgid);
446 	default:
447 		WARN(1, "Missing AUDIT_COMPARE define.  Report as a bug\n");
448 		return 0;
449 	}
450 	return 0;
451 }
452 
453 /* Determine if any context name data matches a rule's watch data */
454 /* Compare a task_struct with an audit_rule.  Return 1 on match, 0
455  * otherwise.
456  *
457  * If task_creation is true, this is an explicit indication that we are
458  * filtering a task rule at task creation time.  This and tsk == current are
459  * the only situations where tsk->cred may be accessed without an rcu read lock.
460  */
461 static int audit_filter_rules(struct task_struct *tsk,
462 			      struct audit_krule *rule,
463 			      struct audit_context *ctx,
464 			      struct audit_names *name,
465 			      enum audit_state *state,
466 			      bool task_creation)
467 {
468 	const struct cred *cred;
469 	int i, need_sid = 1;
470 	u32 sid;
471 	unsigned int sessionid;
472 
473 	if (ctx && rule->prio <= ctx->prio)
474 		return 0;
475 
476 	cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation);
477 
478 	for (i = 0; i < rule->field_count; i++) {
479 		struct audit_field *f = &rule->fields[i];
480 		struct audit_names *n;
481 		int result = 0;
482 		pid_t pid;
483 
484 		switch (f->type) {
485 		case AUDIT_PID:
486 			pid = task_tgid_nr(tsk);
487 			result = audit_comparator(pid, f->op, f->val);
488 			break;
489 		case AUDIT_PPID:
490 			if (ctx) {
491 				if (!ctx->ppid)
492 					ctx->ppid = task_ppid_nr(tsk);
493 				result = audit_comparator(ctx->ppid, f->op, f->val);
494 			}
495 			break;
496 		case AUDIT_EXE:
497 			result = audit_exe_compare(tsk, rule->exe);
498 			if (f->op == Audit_not_equal)
499 				result = !result;
500 			break;
501 		case AUDIT_UID:
502 			result = audit_uid_comparator(cred->uid, f->op, f->uid);
503 			break;
504 		case AUDIT_EUID:
505 			result = audit_uid_comparator(cred->euid, f->op, f->uid);
506 			break;
507 		case AUDIT_SUID:
508 			result = audit_uid_comparator(cred->suid, f->op, f->uid);
509 			break;
510 		case AUDIT_FSUID:
511 			result = audit_uid_comparator(cred->fsuid, f->op, f->uid);
512 			break;
513 		case AUDIT_GID:
514 			result = audit_gid_comparator(cred->gid, f->op, f->gid);
515 			if (f->op == Audit_equal) {
516 				if (!result)
517 					result = groups_search(cred->group_info, f->gid);
518 			} else if (f->op == Audit_not_equal) {
519 				if (result)
520 					result = !groups_search(cred->group_info, f->gid);
521 			}
522 			break;
523 		case AUDIT_EGID:
524 			result = audit_gid_comparator(cred->egid, f->op, f->gid);
525 			if (f->op == Audit_equal) {
526 				if (!result)
527 					result = groups_search(cred->group_info, f->gid);
528 			} else if (f->op == Audit_not_equal) {
529 				if (result)
530 					result = !groups_search(cred->group_info, f->gid);
531 			}
532 			break;
533 		case AUDIT_SGID:
534 			result = audit_gid_comparator(cred->sgid, f->op, f->gid);
535 			break;
536 		case AUDIT_FSGID:
537 			result = audit_gid_comparator(cred->fsgid, f->op, f->gid);
538 			break;
539 		case AUDIT_SESSIONID:
540 			sessionid = audit_get_sessionid(tsk);
541 			result = audit_comparator(sessionid, f->op, f->val);
542 			break;
543 		case AUDIT_PERS:
544 			result = audit_comparator(tsk->personality, f->op, f->val);
545 			break;
546 		case AUDIT_ARCH:
547 			if (ctx)
548 				result = audit_comparator(ctx->arch, f->op, f->val);
549 			break;
550 
551 		case AUDIT_EXIT:
552 			if (ctx && ctx->return_valid != AUDITSC_INVALID)
553 				result = audit_comparator(ctx->return_code, f->op, f->val);
554 			break;
555 		case AUDIT_SUCCESS:
556 			if (ctx && ctx->return_valid != AUDITSC_INVALID) {
557 				if (f->val)
558 					result = audit_comparator(ctx->return_valid, f->op, AUDITSC_SUCCESS);
559 				else
560 					result = audit_comparator(ctx->return_valid, f->op, AUDITSC_FAILURE);
561 			}
562 			break;
563 		case AUDIT_DEVMAJOR:
564 			if (name) {
565 				if (audit_comparator(MAJOR(name->dev), f->op, f->val) ||
566 				    audit_comparator(MAJOR(name->rdev), f->op, f->val))
567 					++result;
568 			} else if (ctx) {
569 				list_for_each_entry(n, &ctx->names_list, list) {
570 					if (audit_comparator(MAJOR(n->dev), f->op, f->val) ||
571 					    audit_comparator(MAJOR(n->rdev), f->op, f->val)) {
572 						++result;
573 						break;
574 					}
575 				}
576 			}
577 			break;
578 		case AUDIT_DEVMINOR:
579 			if (name) {
580 				if (audit_comparator(MINOR(name->dev), f->op, f->val) ||
581 				    audit_comparator(MINOR(name->rdev), f->op, f->val))
582 					++result;
583 			} else if (ctx) {
584 				list_for_each_entry(n, &ctx->names_list, list) {
585 					if (audit_comparator(MINOR(n->dev), f->op, f->val) ||
586 					    audit_comparator(MINOR(n->rdev), f->op, f->val)) {
587 						++result;
588 						break;
589 					}
590 				}
591 			}
592 			break;
593 		case AUDIT_INODE:
594 			if (name)
595 				result = audit_comparator(name->ino, f->op, f->val);
596 			else if (ctx) {
597 				list_for_each_entry(n, &ctx->names_list, list) {
598 					if (audit_comparator(n->ino, f->op, f->val)) {
599 						++result;
600 						break;
601 					}
602 				}
603 			}
604 			break;
605 		case AUDIT_OBJ_UID:
606 			if (name) {
607 				result = audit_uid_comparator(name->uid, f->op, f->uid);
608 			} else if (ctx) {
609 				list_for_each_entry(n, &ctx->names_list, list) {
610 					if (audit_uid_comparator(n->uid, f->op, f->uid)) {
611 						++result;
612 						break;
613 					}
614 				}
615 			}
616 			break;
617 		case AUDIT_OBJ_GID:
618 			if (name) {
619 				result = audit_gid_comparator(name->gid, f->op, f->gid);
620 			} else if (ctx) {
621 				list_for_each_entry(n, &ctx->names_list, list) {
622 					if (audit_gid_comparator(n->gid, f->op, f->gid)) {
623 						++result;
624 						break;
625 					}
626 				}
627 			}
628 			break;
629 		case AUDIT_WATCH:
630 			if (name) {
631 				result = audit_watch_compare(rule->watch,
632 							     name->ino,
633 							     name->dev);
634 				if (f->op == Audit_not_equal)
635 					result = !result;
636 			}
637 			break;
638 		case AUDIT_DIR:
639 			if (ctx) {
640 				result = match_tree_refs(ctx, rule->tree);
641 				if (f->op == Audit_not_equal)
642 					result = !result;
643 			}
644 			break;
645 		case AUDIT_LOGINUID:
646 			result = audit_uid_comparator(audit_get_loginuid(tsk),
647 						      f->op, f->uid);
648 			break;
649 		case AUDIT_LOGINUID_SET:
650 			result = audit_comparator(audit_loginuid_set(tsk), f->op, f->val);
651 			break;
652 		case AUDIT_SADDR_FAM:
653 			if (ctx && ctx->sockaddr)
654 				result = audit_comparator(ctx->sockaddr->ss_family,
655 							  f->op, f->val);
656 			break;
657 		case AUDIT_SUBJ_USER:
658 		case AUDIT_SUBJ_ROLE:
659 		case AUDIT_SUBJ_TYPE:
660 		case AUDIT_SUBJ_SEN:
661 		case AUDIT_SUBJ_CLR:
662 			/* NOTE: this may return negative values indicating
663 			   a temporary error.  We simply treat this as a
664 			   match for now to avoid losing information that
665 			   may be wanted.   An error message will also be
666 			   logged upon error */
667 			if (f->lsm_rule) {
668 				if (need_sid) {
669 					/* @tsk should always be equal to
670 					 * @current with the exception of
671 					 * fork()/copy_process() in which case
672 					 * the new @tsk creds are still a dup
673 					 * of @current's creds so we can still
674 					 * use security_current_getsecid_subj()
675 					 * here even though it always refs
676 					 * @current's creds
677 					 */
678 					security_current_getsecid_subj(&sid);
679 					need_sid = 0;
680 				}
681 				result = security_audit_rule_match(sid, f->type,
682 								   f->op,
683 								   f->lsm_rule);
684 			}
685 			break;
686 		case AUDIT_OBJ_USER:
687 		case AUDIT_OBJ_ROLE:
688 		case AUDIT_OBJ_TYPE:
689 		case AUDIT_OBJ_LEV_LOW:
690 		case AUDIT_OBJ_LEV_HIGH:
691 			/* The above note for AUDIT_SUBJ_USER...AUDIT_SUBJ_CLR
692 			   also applies here */
693 			if (f->lsm_rule) {
694 				/* Find files that match */
695 				if (name) {
696 					result = security_audit_rule_match(
697 								name->osid,
698 								f->type,
699 								f->op,
700 								f->lsm_rule);
701 				} else if (ctx) {
702 					list_for_each_entry(n, &ctx->names_list, list) {
703 						if (security_audit_rule_match(
704 								n->osid,
705 								f->type,
706 								f->op,
707 								f->lsm_rule)) {
708 							++result;
709 							break;
710 						}
711 					}
712 				}
713 				/* Find ipc objects that match */
714 				if (!ctx || ctx->type != AUDIT_IPC)
715 					break;
716 				if (security_audit_rule_match(ctx->ipc.osid,
717 							      f->type, f->op,
718 							      f->lsm_rule))
719 					++result;
720 			}
721 			break;
722 		case AUDIT_ARG0:
723 		case AUDIT_ARG1:
724 		case AUDIT_ARG2:
725 		case AUDIT_ARG3:
726 			if (ctx)
727 				result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
728 			break;
729 		case AUDIT_FILTERKEY:
730 			/* ignore this field for filtering */
731 			result = 1;
732 			break;
733 		case AUDIT_PERM:
734 			result = audit_match_perm(ctx, f->val);
735 			if (f->op == Audit_not_equal)
736 				result = !result;
737 			break;
738 		case AUDIT_FILETYPE:
739 			result = audit_match_filetype(ctx, f->val);
740 			if (f->op == Audit_not_equal)
741 				result = !result;
742 			break;
743 		case AUDIT_FIELD_COMPARE:
744 			result = audit_field_compare(tsk, cred, f, ctx, name);
745 			break;
746 		}
747 		if (!result)
748 			return 0;
749 	}
750 
751 	if (ctx) {
752 		if (rule->filterkey) {
753 			kfree(ctx->filterkey);
754 			ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
755 		}
756 		ctx->prio = rule->prio;
757 	}
758 	switch (rule->action) {
759 	case AUDIT_NEVER:
760 		*state = AUDIT_STATE_DISABLED;
761 		break;
762 	case AUDIT_ALWAYS:
763 		*state = AUDIT_STATE_RECORD;
764 		break;
765 	}
766 	return 1;
767 }
768 
769 /* At process creation time, we can determine if system-call auditing is
770  * completely disabled for this task.  Since we only have the task
771  * structure at this point, we can only check uid and gid.
772  */
773 static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
774 {
775 	struct audit_entry *e;
776 	enum audit_state   state;
777 
778 	rcu_read_lock();
779 	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
780 		if (audit_filter_rules(tsk, &e->rule, NULL, NULL,
781 				       &state, true)) {
782 			if (state == AUDIT_STATE_RECORD)
783 				*key = kstrdup(e->rule.filterkey, GFP_ATOMIC);
784 			rcu_read_unlock();
785 			return state;
786 		}
787 	}
788 	rcu_read_unlock();
789 	return AUDIT_STATE_BUILD;
790 }
791 
792 static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
793 {
794 	int word, bit;
795 
796 	if (val > 0xffffffff)
797 		return false;
798 
799 	word = AUDIT_WORD(val);
800 	if (word >= AUDIT_BITMASK_SIZE)
801 		return false;
802 
803 	bit = AUDIT_BIT(val);
804 
805 	return rule->mask[word] & bit;
806 }
807 
808 /**
809  * audit_filter_uring - apply filters to an io_uring operation
810  * @tsk: associated task
811  * @ctx: audit context
812  */
813 static void audit_filter_uring(struct task_struct *tsk,
814 			       struct audit_context *ctx)
815 {
816 	struct audit_entry *e;
817 	enum audit_state state;
818 
819 	if (auditd_test_task(tsk))
820 		return;
821 
822 	rcu_read_lock();
823 	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_URING_EXIT],
824 				list) {
825 		if (audit_in_mask(&e->rule, ctx->uring_op) &&
826 		    audit_filter_rules(tsk, &e->rule, ctx, NULL, &state,
827 				       false)) {
828 			rcu_read_unlock();
829 			ctx->current_state = state;
830 			return;
831 		}
832 	}
833 	rcu_read_unlock();
834 }
835 
836 /* At syscall exit time, this filter is called if the audit_state is
837  * not low enough that auditing cannot take place, but is also not
838  * high enough that we already know we have to write an audit record
839  * (i.e., the state is AUDIT_STATE_BUILD).
840  */
841 static void audit_filter_syscall(struct task_struct *tsk,
842 				 struct audit_context *ctx)
843 {
844 	struct audit_entry *e;
845 	enum audit_state state;
846 
847 	if (auditd_test_task(tsk))
848 		return;
849 
850 	rcu_read_lock();
851 	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_EXIT], list) {
852 		if (audit_in_mask(&e->rule, ctx->major) &&
853 		    audit_filter_rules(tsk, &e->rule, ctx, NULL,
854 				       &state, false)) {
855 			rcu_read_unlock();
856 			ctx->current_state = state;
857 			return;
858 		}
859 	}
860 	rcu_read_unlock();
861 	return;
862 }
863 
864 /*
865  * Given an audit_name check the inode hash table to see if they match.
866  * Called holding the rcu read lock to protect the use of audit_inode_hash
867  */
868 static int audit_filter_inode_name(struct task_struct *tsk,
869 				   struct audit_names *n,
870 				   struct audit_context *ctx) {
871 	int h = audit_hash_ino((u32)n->ino);
872 	struct list_head *list = &audit_inode_hash[h];
873 	struct audit_entry *e;
874 	enum audit_state state;
875 
876 	list_for_each_entry_rcu(e, list, list) {
877 		if (audit_in_mask(&e->rule, ctx->major) &&
878 		    audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
879 			ctx->current_state = state;
880 			return 1;
881 		}
882 	}
883 	return 0;
884 }
885 
886 /* At syscall exit time, this filter is called if any audit_names have been
887  * collected during syscall processing.  We only check rules in sublists at hash
888  * buckets applicable to the inode numbers in audit_names.
889  * Regarding audit_state, same rules apply as for audit_filter_syscall().
890  */
891 void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx)
892 {
893 	struct audit_names *n;
894 
895 	if (auditd_test_task(tsk))
896 		return;
897 
898 	rcu_read_lock();
899 
900 	list_for_each_entry(n, &ctx->names_list, list) {
901 		if (audit_filter_inode_name(tsk, n, ctx))
902 			break;
903 	}
904 	rcu_read_unlock();
905 }
906 
907 static inline void audit_proctitle_free(struct audit_context *context)
908 {
909 	kfree(context->proctitle.value);
910 	context->proctitle.value = NULL;
911 	context->proctitle.len = 0;
912 }
913 
914 static inline void audit_free_module(struct audit_context *context)
915 {
916 	if (context->type == AUDIT_KERN_MODULE) {
917 		kfree(context->module.name);
918 		context->module.name = NULL;
919 	}
920 }
921 static inline void audit_free_names(struct audit_context *context)
922 {
923 	struct audit_names *n, *next;
924 
925 	list_for_each_entry_safe(n, next, &context->names_list, list) {
926 		list_del(&n->list);
927 		if (n->name)
928 			putname(n->name);
929 		if (n->should_free)
930 			kfree(n);
931 	}
932 	context->name_count = 0;
933 	path_put(&context->pwd);
934 	context->pwd.dentry = NULL;
935 	context->pwd.mnt = NULL;
936 }
937 
938 static inline void audit_free_aux(struct audit_context *context)
939 {
940 	struct audit_aux_data *aux;
941 
942 	while ((aux = context->aux)) {
943 		context->aux = aux->next;
944 		kfree(aux);
945 	}
946 	context->aux = NULL;
947 	while ((aux = context->aux_pids)) {
948 		context->aux_pids = aux->next;
949 		kfree(aux);
950 	}
951 	context->aux_pids = NULL;
952 }
953 
954 /**
955  * audit_reset_context - reset a audit_context structure
956  * @ctx: the audit_context to reset
957  *
958  * All fields in the audit_context will be reset to an initial state, all
959  * references held by fields will be dropped, and private memory will be
960  * released.  When this function returns the audit_context will be suitable
961  * for reuse, so long as the passed context is not NULL or a dummy context.
962  */
963 static void audit_reset_context(struct audit_context *ctx)
964 {
965 	if (!ctx)
966 		return;
967 
968 	/* if ctx is non-null, reset the "ctx->state" regardless */
969 	ctx->context = AUDIT_CTX_UNUSED;
970 	if (ctx->dummy)
971 		return;
972 
973 	/*
974 	 * NOTE: It shouldn't matter in what order we release the fields, so
975 	 *       release them in the order in which they appear in the struct;
976 	 *       this gives us some hope of quickly making sure we are
977 	 *       resetting the audit_context properly.
978 	 *
979 	 *       Other things worth mentioning:
980 	 *       - we don't reset "dummy"
981 	 *       - we don't reset "state", we do reset "current_state"
982 	 *       - we preserve "filterkey" if "state" is AUDIT_STATE_RECORD
983 	 *       - much of this is likely overkill, but play it safe for now
984 	 *       - we really need to work on improving the audit_context struct
985 	 */
986 
987 	ctx->current_state = ctx->state;
988 	ctx->serial = 0;
989 	ctx->major = 0;
990 	ctx->uring_op = 0;
991 	ctx->ctime = (struct timespec64){ .tv_sec = 0, .tv_nsec = 0 };
992 	memset(ctx->argv, 0, sizeof(ctx->argv));
993 	ctx->return_code = 0;
994 	ctx->prio = (ctx->state == AUDIT_STATE_RECORD ? ~0ULL : 0);
995 	ctx->return_valid = AUDITSC_INVALID;
996 	audit_free_names(ctx);
997 	if (ctx->state != AUDIT_STATE_RECORD) {
998 		kfree(ctx->filterkey);
999 		ctx->filterkey = NULL;
1000 	}
1001 	audit_free_aux(ctx);
1002 	kfree(ctx->sockaddr);
1003 	ctx->sockaddr = NULL;
1004 	ctx->sockaddr_len = 0;
1005 	ctx->pid = ctx->ppid = 0;
1006 	ctx->uid = ctx->euid = ctx->suid = ctx->fsuid = KUIDT_INIT(0);
1007 	ctx->gid = ctx->egid = ctx->sgid = ctx->fsgid = KGIDT_INIT(0);
1008 	ctx->personality = 0;
1009 	ctx->arch = 0;
1010 	ctx->target_pid = 0;
1011 	ctx->target_auid = ctx->target_uid = KUIDT_INIT(0);
1012 	ctx->target_sessionid = 0;
1013 	ctx->target_sid = 0;
1014 	ctx->target_comm[0] = '\0';
1015 	unroll_tree_refs(ctx, NULL, 0);
1016 	WARN_ON(!list_empty(&ctx->killed_trees));
1017 	ctx->type = 0;
1018 	audit_free_module(ctx);
1019 	ctx->fds[0] = -1;
1020 	audit_proctitle_free(ctx);
1021 }
1022 
1023 static inline struct audit_context *audit_alloc_context(enum audit_state state)
1024 {
1025 	struct audit_context *context;
1026 
1027 	context = kzalloc(sizeof(*context), GFP_KERNEL);
1028 	if (!context)
1029 		return NULL;
1030 	context->context = AUDIT_CTX_UNUSED;
1031 	context->state = state;
1032 	context->prio = state == AUDIT_STATE_RECORD ? ~0ULL : 0;
1033 	INIT_LIST_HEAD(&context->killed_trees);
1034 	INIT_LIST_HEAD(&context->names_list);
1035 	context->fds[0] = -1;
1036 	context->return_valid = AUDITSC_INVALID;
1037 	return context;
1038 }
1039 
1040 /**
1041  * audit_alloc - allocate an audit context block for a task
1042  * @tsk: task
1043  *
1044  * Filter on the task information and allocate a per-task audit context
1045  * if necessary.  Doing so turns on system call auditing for the
1046  * specified task.  This is called from copy_process, so no lock is
1047  * needed.
1048  */
1049 int audit_alloc(struct task_struct *tsk)
1050 {
1051 	struct audit_context *context;
1052 	enum audit_state     state;
1053 	char *key = NULL;
1054 
1055 	if (likely(!audit_ever_enabled))
1056 		return 0;
1057 
1058 	state = audit_filter_task(tsk, &key);
1059 	if (state == AUDIT_STATE_DISABLED) {
1060 		clear_task_syscall_work(tsk, SYSCALL_AUDIT);
1061 		return 0;
1062 	}
1063 
1064 	if (!(context = audit_alloc_context(state))) {
1065 		kfree(key);
1066 		audit_log_lost("out of memory in audit_alloc");
1067 		return -ENOMEM;
1068 	}
1069 	context->filterkey = key;
1070 
1071 	audit_set_context(tsk, context);
1072 	set_task_syscall_work(tsk, SYSCALL_AUDIT);
1073 	return 0;
1074 }
1075 
1076 /**
1077  * audit_alloc_kernel - allocate an audit_context for a kernel task
1078  * @tsk: the kernel task
1079  *
1080  * Similar to the audit_alloc() function, but intended for kernel private
1081  * threads.  Returns zero on success, negative values on failure.
1082  */
1083 int audit_alloc_kernel(struct task_struct *tsk)
1084 {
1085 	/*
1086 	 * At the moment we are just going to call into audit_alloc() to
1087 	 * simplify the code, but there two things to keep in mind with this
1088 	 * approach:
1089 	 *
1090 	 * 1. Filtering internal kernel tasks is a bit laughable in almost all
1091 	 * cases, but there is at least one case where there is a benefit:
1092 	 * the '-a task,never' case allows the admin to effectively disable
1093 	 * task auditing at runtime.
1094 	 *
1095 	 * 2. The {set,clear}_task_syscall_work() ops likely have zero effect
1096 	 * on these internal kernel tasks, but they probably don't hurt either.
1097 	 */
1098 	return audit_alloc(tsk);
1099 }
1100 
1101 static inline void audit_free_context(struct audit_context *context)
1102 {
1103 	/* resetting is extra work, but it is likely just noise */
1104 	audit_reset_context(context);
1105 	free_tree_refs(context);
1106 	kfree(context->filterkey);
1107 	kfree(context);
1108 }
1109 
1110 static int audit_log_pid_context(struct audit_context *context, pid_t pid,
1111 				 kuid_t auid, kuid_t uid, unsigned int sessionid,
1112 				 u32 sid, char *comm)
1113 {
1114 	struct audit_buffer *ab;
1115 	char *ctx = NULL;
1116 	u32 len;
1117 	int rc = 0;
1118 
1119 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
1120 	if (!ab)
1121 		return rc;
1122 
1123 	audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid,
1124 			 from_kuid(&init_user_ns, auid),
1125 			 from_kuid(&init_user_ns, uid), sessionid);
1126 	if (sid) {
1127 		if (security_secid_to_secctx(sid, &ctx, &len)) {
1128 			audit_log_format(ab, " obj=(none)");
1129 			rc = 1;
1130 		} else {
1131 			audit_log_format(ab, " obj=%s", ctx);
1132 			security_release_secctx(ctx, len);
1133 		}
1134 	}
1135 	audit_log_format(ab, " ocomm=");
1136 	audit_log_untrustedstring(ab, comm);
1137 	audit_log_end(ab);
1138 
1139 	return rc;
1140 }
1141 
1142 static void audit_log_execve_info(struct audit_context *context,
1143 				  struct audit_buffer **ab)
1144 {
1145 	long len_max;
1146 	long len_rem;
1147 	long len_full;
1148 	long len_buf;
1149 	long len_abuf = 0;
1150 	long len_tmp;
1151 	bool require_data;
1152 	bool encode;
1153 	unsigned int iter;
1154 	unsigned int arg;
1155 	char *buf_head;
1156 	char *buf;
1157 	const char __user *p = (const char __user *)current->mm->arg_start;
1158 
1159 	/* NOTE: this buffer needs to be large enough to hold all the non-arg
1160 	 *       data we put in the audit record for this argument (see the
1161 	 *       code below) ... at this point in time 96 is plenty */
1162 	char abuf[96];
1163 
1164 	/* NOTE: we set MAX_EXECVE_AUDIT_LEN to a rather arbitrary limit, the
1165 	 *       current value of 7500 is not as important as the fact that it
1166 	 *       is less than 8k, a setting of 7500 gives us plenty of wiggle
1167 	 *       room if we go over a little bit in the logging below */
1168 	WARN_ON_ONCE(MAX_EXECVE_AUDIT_LEN > 7500);
1169 	len_max = MAX_EXECVE_AUDIT_LEN;
1170 
1171 	/* scratch buffer to hold the userspace args */
1172 	buf_head = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
1173 	if (!buf_head) {
1174 		audit_panic("out of memory for argv string");
1175 		return;
1176 	}
1177 	buf = buf_head;
1178 
1179 	audit_log_format(*ab, "argc=%d", context->execve.argc);
1180 
1181 	len_rem = len_max;
1182 	len_buf = 0;
1183 	len_full = 0;
1184 	require_data = true;
1185 	encode = false;
1186 	iter = 0;
1187 	arg = 0;
1188 	do {
1189 		/* NOTE: we don't ever want to trust this value for anything
1190 		 *       serious, but the audit record format insists we
1191 		 *       provide an argument length for really long arguments,
1192 		 *       e.g. > MAX_EXECVE_AUDIT_LEN, so we have no choice but
1193 		 *       to use strncpy_from_user() to obtain this value for
1194 		 *       recording in the log, although we don't use it
1195 		 *       anywhere here to avoid a double-fetch problem */
1196 		if (len_full == 0)
1197 			len_full = strnlen_user(p, MAX_ARG_STRLEN) - 1;
1198 
1199 		/* read more data from userspace */
1200 		if (require_data) {
1201 			/* can we make more room in the buffer? */
1202 			if (buf != buf_head) {
1203 				memmove(buf_head, buf, len_buf);
1204 				buf = buf_head;
1205 			}
1206 
1207 			/* fetch as much as we can of the argument */
1208 			len_tmp = strncpy_from_user(&buf_head[len_buf], p,
1209 						    len_max - len_buf);
1210 			if (len_tmp == -EFAULT) {
1211 				/* unable to copy from userspace */
1212 				send_sig(SIGKILL, current, 0);
1213 				goto out;
1214 			} else if (len_tmp == (len_max - len_buf)) {
1215 				/* buffer is not large enough */
1216 				require_data = true;
1217 				/* NOTE: if we are going to span multiple
1218 				 *       buffers force the encoding so we stand
1219 				 *       a chance at a sane len_full value and
1220 				 *       consistent record encoding */
1221 				encode = true;
1222 				len_full = len_full * 2;
1223 				p += len_tmp;
1224 			} else {
1225 				require_data = false;
1226 				if (!encode)
1227 					encode = audit_string_contains_control(
1228 								buf, len_tmp);
1229 				/* try to use a trusted value for len_full */
1230 				if (len_full < len_max)
1231 					len_full = (encode ?
1232 						    len_tmp * 2 : len_tmp);
1233 				p += len_tmp + 1;
1234 			}
1235 			len_buf += len_tmp;
1236 			buf_head[len_buf] = '\0';
1237 
1238 			/* length of the buffer in the audit record? */
1239 			len_abuf = (encode ? len_buf * 2 : len_buf + 2);
1240 		}
1241 
1242 		/* write as much as we can to the audit log */
1243 		if (len_buf >= 0) {
1244 			/* NOTE: some magic numbers here - basically if we
1245 			 *       can't fit a reasonable amount of data into the
1246 			 *       existing audit buffer, flush it and start with
1247 			 *       a new buffer */
1248 			if ((sizeof(abuf) + 8) > len_rem) {
1249 				len_rem = len_max;
1250 				audit_log_end(*ab);
1251 				*ab = audit_log_start(context,
1252 						      GFP_KERNEL, AUDIT_EXECVE);
1253 				if (!*ab)
1254 					goto out;
1255 			}
1256 
1257 			/* create the non-arg portion of the arg record */
1258 			len_tmp = 0;
1259 			if (require_data || (iter > 0) ||
1260 			    ((len_abuf + sizeof(abuf)) > len_rem)) {
1261 				if (iter == 0) {
1262 					len_tmp += snprintf(&abuf[len_tmp],
1263 							sizeof(abuf) - len_tmp,
1264 							" a%d_len=%lu",
1265 							arg, len_full);
1266 				}
1267 				len_tmp += snprintf(&abuf[len_tmp],
1268 						    sizeof(abuf) - len_tmp,
1269 						    " a%d[%d]=", arg, iter++);
1270 			} else
1271 				len_tmp += snprintf(&abuf[len_tmp],
1272 						    sizeof(abuf) - len_tmp,
1273 						    " a%d=", arg);
1274 			WARN_ON(len_tmp >= sizeof(abuf));
1275 			abuf[sizeof(abuf) - 1] = '\0';
1276 
1277 			/* log the arg in the audit record */
1278 			audit_log_format(*ab, "%s", abuf);
1279 			len_rem -= len_tmp;
1280 			len_tmp = len_buf;
1281 			if (encode) {
1282 				if (len_abuf > len_rem)
1283 					len_tmp = len_rem / 2; /* encoding */
1284 				audit_log_n_hex(*ab, buf, len_tmp);
1285 				len_rem -= len_tmp * 2;
1286 				len_abuf -= len_tmp * 2;
1287 			} else {
1288 				if (len_abuf > len_rem)
1289 					len_tmp = len_rem - 2; /* quotes */
1290 				audit_log_n_string(*ab, buf, len_tmp);
1291 				len_rem -= len_tmp + 2;
1292 				/* don't subtract the "2" because we still need
1293 				 * to add quotes to the remaining string */
1294 				len_abuf -= len_tmp;
1295 			}
1296 			len_buf -= len_tmp;
1297 			buf += len_tmp;
1298 		}
1299 
1300 		/* ready to move to the next argument? */
1301 		if ((len_buf == 0) && !require_data) {
1302 			arg++;
1303 			iter = 0;
1304 			len_full = 0;
1305 			require_data = true;
1306 			encode = false;
1307 		}
1308 	} while (arg < context->execve.argc);
1309 
1310 	/* NOTE: the caller handles the final audit_log_end() call */
1311 
1312 out:
1313 	kfree(buf_head);
1314 }
1315 
1316 static void audit_log_cap(struct audit_buffer *ab, char *prefix,
1317 			  kernel_cap_t *cap)
1318 {
1319 	int i;
1320 
1321 	if (cap_isclear(*cap)) {
1322 		audit_log_format(ab, " %s=0", prefix);
1323 		return;
1324 	}
1325 	audit_log_format(ab, " %s=", prefix);
1326 	CAP_FOR_EACH_U32(i)
1327 		audit_log_format(ab, "%08x", cap->cap[CAP_LAST_U32 - i]);
1328 }
1329 
1330 static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
1331 {
1332 	if (name->fcap_ver == -1) {
1333 		audit_log_format(ab, " cap_fe=? cap_fver=? cap_fp=? cap_fi=?");
1334 		return;
1335 	}
1336 	audit_log_cap(ab, "cap_fp", &name->fcap.permitted);
1337 	audit_log_cap(ab, "cap_fi", &name->fcap.inheritable);
1338 	audit_log_format(ab, " cap_fe=%d cap_fver=%x cap_frootid=%d",
1339 			 name->fcap.fE, name->fcap_ver,
1340 			 from_kuid(&init_user_ns, name->fcap.rootid));
1341 }
1342 
1343 static void audit_log_time(struct audit_context *context, struct audit_buffer **ab)
1344 {
1345 	const struct audit_ntp_data *ntp = &context->time.ntp_data;
1346 	const struct timespec64 *tk = &context->time.tk_injoffset;
1347 	static const char * const ntp_name[] = {
1348 		"offset",
1349 		"freq",
1350 		"status",
1351 		"tai",
1352 		"tick",
1353 		"adjust",
1354 	};
1355 	int type;
1356 
1357 	if (context->type == AUDIT_TIME_ADJNTPVAL) {
1358 		for (type = 0; type < AUDIT_NTP_NVALS; type++) {
1359 			if (ntp->vals[type].newval != ntp->vals[type].oldval) {
1360 				if (!*ab) {
1361 					*ab = audit_log_start(context,
1362 							GFP_KERNEL,
1363 							AUDIT_TIME_ADJNTPVAL);
1364 					if (!*ab)
1365 						return;
1366 				}
1367 				audit_log_format(*ab, "op=%s old=%lli new=%lli",
1368 						 ntp_name[type],
1369 						 ntp->vals[type].oldval,
1370 						 ntp->vals[type].newval);
1371 				audit_log_end(*ab);
1372 				*ab = NULL;
1373 			}
1374 		}
1375 	}
1376 	if (tk->tv_sec != 0 || tk->tv_nsec != 0) {
1377 		if (!*ab) {
1378 			*ab = audit_log_start(context, GFP_KERNEL,
1379 					      AUDIT_TIME_INJOFFSET);
1380 			if (!*ab)
1381 				return;
1382 		}
1383 		audit_log_format(*ab, "sec=%lli nsec=%li",
1384 				 (long long)tk->tv_sec, tk->tv_nsec);
1385 		audit_log_end(*ab);
1386 		*ab = NULL;
1387 	}
1388 }
1389 
1390 static void show_special(struct audit_context *context, int *call_panic)
1391 {
1392 	struct audit_buffer *ab;
1393 	int i;
1394 
1395 	ab = audit_log_start(context, GFP_KERNEL, context->type);
1396 	if (!ab)
1397 		return;
1398 
1399 	switch (context->type) {
1400 	case AUDIT_SOCKETCALL: {
1401 		int nargs = context->socketcall.nargs;
1402 
1403 		audit_log_format(ab, "nargs=%d", nargs);
1404 		for (i = 0; i < nargs; i++)
1405 			audit_log_format(ab, " a%d=%lx", i,
1406 				context->socketcall.args[i]);
1407 		break; }
1408 	case AUDIT_IPC: {
1409 		u32 osid = context->ipc.osid;
1410 
1411 		audit_log_format(ab, "ouid=%u ogid=%u mode=%#ho",
1412 				 from_kuid(&init_user_ns, context->ipc.uid),
1413 				 from_kgid(&init_user_ns, context->ipc.gid),
1414 				 context->ipc.mode);
1415 		if (osid) {
1416 			char *ctx = NULL;
1417 			u32 len;
1418 
1419 			if (security_secid_to_secctx(osid, &ctx, &len)) {
1420 				audit_log_format(ab, " osid=%u", osid);
1421 				*call_panic = 1;
1422 			} else {
1423 				audit_log_format(ab, " obj=%s", ctx);
1424 				security_release_secctx(ctx, len);
1425 			}
1426 		}
1427 		if (context->ipc.has_perm) {
1428 			audit_log_end(ab);
1429 			ab = audit_log_start(context, GFP_KERNEL,
1430 					     AUDIT_IPC_SET_PERM);
1431 			if (unlikely(!ab))
1432 				return;
1433 			audit_log_format(ab,
1434 				"qbytes=%lx ouid=%u ogid=%u mode=%#ho",
1435 				context->ipc.qbytes,
1436 				context->ipc.perm_uid,
1437 				context->ipc.perm_gid,
1438 				context->ipc.perm_mode);
1439 		}
1440 		break; }
1441 	case AUDIT_MQ_OPEN:
1442 		audit_log_format(ab,
1443 			"oflag=0x%x mode=%#ho mq_flags=0x%lx mq_maxmsg=%ld "
1444 			"mq_msgsize=%ld mq_curmsgs=%ld",
1445 			context->mq_open.oflag, context->mq_open.mode,
1446 			context->mq_open.attr.mq_flags,
1447 			context->mq_open.attr.mq_maxmsg,
1448 			context->mq_open.attr.mq_msgsize,
1449 			context->mq_open.attr.mq_curmsgs);
1450 		break;
1451 	case AUDIT_MQ_SENDRECV:
1452 		audit_log_format(ab,
1453 			"mqdes=%d msg_len=%zd msg_prio=%u "
1454 			"abs_timeout_sec=%lld abs_timeout_nsec=%ld",
1455 			context->mq_sendrecv.mqdes,
1456 			context->mq_sendrecv.msg_len,
1457 			context->mq_sendrecv.msg_prio,
1458 			(long long) context->mq_sendrecv.abs_timeout.tv_sec,
1459 			context->mq_sendrecv.abs_timeout.tv_nsec);
1460 		break;
1461 	case AUDIT_MQ_NOTIFY:
1462 		audit_log_format(ab, "mqdes=%d sigev_signo=%d",
1463 				context->mq_notify.mqdes,
1464 				context->mq_notify.sigev_signo);
1465 		break;
1466 	case AUDIT_MQ_GETSETATTR: {
1467 		struct mq_attr *attr = &context->mq_getsetattr.mqstat;
1468 
1469 		audit_log_format(ab,
1470 			"mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
1471 			"mq_curmsgs=%ld ",
1472 			context->mq_getsetattr.mqdes,
1473 			attr->mq_flags, attr->mq_maxmsg,
1474 			attr->mq_msgsize, attr->mq_curmsgs);
1475 		break; }
1476 	case AUDIT_CAPSET:
1477 		audit_log_format(ab, "pid=%d", context->capset.pid);
1478 		audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable);
1479 		audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted);
1480 		audit_log_cap(ab, "cap_pe", &context->capset.cap.effective);
1481 		audit_log_cap(ab, "cap_pa", &context->capset.cap.ambient);
1482 		break;
1483 	case AUDIT_MMAP:
1484 		audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd,
1485 				 context->mmap.flags);
1486 		break;
1487 	case AUDIT_OPENAT2:
1488 		audit_log_format(ab, "oflag=0%llo mode=0%llo resolve=0x%llx",
1489 				 context->openat2.flags,
1490 				 context->openat2.mode,
1491 				 context->openat2.resolve);
1492 		break;
1493 	case AUDIT_EXECVE:
1494 		audit_log_execve_info(context, &ab);
1495 		break;
1496 	case AUDIT_KERN_MODULE:
1497 		audit_log_format(ab, "name=");
1498 		if (context->module.name) {
1499 			audit_log_untrustedstring(ab, context->module.name);
1500 		} else
1501 			audit_log_format(ab, "(null)");
1502 
1503 		break;
1504 	case AUDIT_TIME_ADJNTPVAL:
1505 	case AUDIT_TIME_INJOFFSET:
1506 		/* this call deviates from the rest, eating the buffer */
1507 		audit_log_time(context, &ab);
1508 		break;
1509 	}
1510 	audit_log_end(ab);
1511 }
1512 
1513 static inline int audit_proctitle_rtrim(char *proctitle, int len)
1514 {
1515 	char *end = proctitle + len - 1;
1516 
1517 	while (end > proctitle && !isprint(*end))
1518 		end--;
1519 
1520 	/* catch the case where proctitle is only 1 non-print character */
1521 	len = end - proctitle + 1;
1522 	len -= isprint(proctitle[len-1]) == 0;
1523 	return len;
1524 }
1525 
1526 /*
1527  * audit_log_name - produce AUDIT_PATH record from struct audit_names
1528  * @context: audit_context for the task
1529  * @n: audit_names structure with reportable details
1530  * @path: optional path to report instead of audit_names->name
1531  * @record_num: record number to report when handling a list of names
1532  * @call_panic: optional pointer to int that will be updated if secid fails
1533  */
1534 static void audit_log_name(struct audit_context *context, struct audit_names *n,
1535 		    const struct path *path, int record_num, int *call_panic)
1536 {
1537 	struct audit_buffer *ab;
1538 
1539 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
1540 	if (!ab)
1541 		return;
1542 
1543 	audit_log_format(ab, "item=%d", record_num);
1544 
1545 	if (path)
1546 		audit_log_d_path(ab, " name=", path);
1547 	else if (n->name) {
1548 		switch (n->name_len) {
1549 		case AUDIT_NAME_FULL:
1550 			/* log the full path */
1551 			audit_log_format(ab, " name=");
1552 			audit_log_untrustedstring(ab, n->name->name);
1553 			break;
1554 		case 0:
1555 			/* name was specified as a relative path and the
1556 			 * directory component is the cwd
1557 			 */
1558 			if (context->pwd.dentry && context->pwd.mnt)
1559 				audit_log_d_path(ab, " name=", &context->pwd);
1560 			else
1561 				audit_log_format(ab, " name=(null)");
1562 			break;
1563 		default:
1564 			/* log the name's directory component */
1565 			audit_log_format(ab, " name=");
1566 			audit_log_n_untrustedstring(ab, n->name->name,
1567 						    n->name_len);
1568 		}
1569 	} else
1570 		audit_log_format(ab, " name=(null)");
1571 
1572 	if (n->ino != AUDIT_INO_UNSET)
1573 		audit_log_format(ab, " inode=%lu dev=%02x:%02x mode=%#ho ouid=%u ogid=%u rdev=%02x:%02x",
1574 				 n->ino,
1575 				 MAJOR(n->dev),
1576 				 MINOR(n->dev),
1577 				 n->mode,
1578 				 from_kuid(&init_user_ns, n->uid),
1579 				 from_kgid(&init_user_ns, n->gid),
1580 				 MAJOR(n->rdev),
1581 				 MINOR(n->rdev));
1582 	if (n->osid != 0) {
1583 		char *ctx = NULL;
1584 		u32 len;
1585 
1586 		if (security_secid_to_secctx(
1587 			n->osid, &ctx, &len)) {
1588 			audit_log_format(ab, " osid=%u", n->osid);
1589 			if (call_panic)
1590 				*call_panic = 2;
1591 		} else {
1592 			audit_log_format(ab, " obj=%s", ctx);
1593 			security_release_secctx(ctx, len);
1594 		}
1595 	}
1596 
1597 	/* log the audit_names record type */
1598 	switch (n->type) {
1599 	case AUDIT_TYPE_NORMAL:
1600 		audit_log_format(ab, " nametype=NORMAL");
1601 		break;
1602 	case AUDIT_TYPE_PARENT:
1603 		audit_log_format(ab, " nametype=PARENT");
1604 		break;
1605 	case AUDIT_TYPE_CHILD_DELETE:
1606 		audit_log_format(ab, " nametype=DELETE");
1607 		break;
1608 	case AUDIT_TYPE_CHILD_CREATE:
1609 		audit_log_format(ab, " nametype=CREATE");
1610 		break;
1611 	default:
1612 		audit_log_format(ab, " nametype=UNKNOWN");
1613 		break;
1614 	}
1615 
1616 	audit_log_fcaps(ab, n);
1617 	audit_log_end(ab);
1618 }
1619 
1620 static void audit_log_proctitle(void)
1621 {
1622 	int res;
1623 	char *buf;
1624 	char *msg = "(null)";
1625 	int len = strlen(msg);
1626 	struct audit_context *context = audit_context();
1627 	struct audit_buffer *ab;
1628 
1629 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE);
1630 	if (!ab)
1631 		return;	/* audit_panic or being filtered */
1632 
1633 	audit_log_format(ab, "proctitle=");
1634 
1635 	/* Not  cached */
1636 	if (!context->proctitle.value) {
1637 		buf = kmalloc(MAX_PROCTITLE_AUDIT_LEN, GFP_KERNEL);
1638 		if (!buf)
1639 			goto out;
1640 		/* Historically called this from procfs naming */
1641 		res = get_cmdline(current, buf, MAX_PROCTITLE_AUDIT_LEN);
1642 		if (res == 0) {
1643 			kfree(buf);
1644 			goto out;
1645 		}
1646 		res = audit_proctitle_rtrim(buf, res);
1647 		if (res == 0) {
1648 			kfree(buf);
1649 			goto out;
1650 		}
1651 		context->proctitle.value = buf;
1652 		context->proctitle.len = res;
1653 	}
1654 	msg = context->proctitle.value;
1655 	len = context->proctitle.len;
1656 out:
1657 	audit_log_n_untrustedstring(ab, msg, len);
1658 	audit_log_end(ab);
1659 }
1660 
1661 /**
1662  * audit_log_uring - generate a AUDIT_URINGOP record
1663  * @ctx: the audit context
1664  */
1665 static void audit_log_uring(struct audit_context *ctx)
1666 {
1667 	struct audit_buffer *ab;
1668 	const struct cred *cred;
1669 
1670 	ab = audit_log_start(ctx, GFP_ATOMIC, AUDIT_URINGOP);
1671 	if (!ab)
1672 		return;
1673 	cred = current_cred();
1674 	audit_log_format(ab, "uring_op=%d", ctx->uring_op);
1675 	if (ctx->return_valid != AUDITSC_INVALID)
1676 		audit_log_format(ab, " success=%s exit=%ld",
1677 				 (ctx->return_valid == AUDITSC_SUCCESS ?
1678 				  "yes" : "no"),
1679 				 ctx->return_code);
1680 	audit_log_format(ab,
1681 			 " items=%d"
1682 			 " ppid=%d pid=%d uid=%u gid=%u euid=%u suid=%u"
1683 			 " fsuid=%u egid=%u sgid=%u fsgid=%u",
1684 			 ctx->name_count,
1685 			 task_ppid_nr(current), task_tgid_nr(current),
1686 			 from_kuid(&init_user_ns, cred->uid),
1687 			 from_kgid(&init_user_ns, cred->gid),
1688 			 from_kuid(&init_user_ns, cred->euid),
1689 			 from_kuid(&init_user_ns, cred->suid),
1690 			 from_kuid(&init_user_ns, cred->fsuid),
1691 			 from_kgid(&init_user_ns, cred->egid),
1692 			 from_kgid(&init_user_ns, cred->sgid),
1693 			 from_kgid(&init_user_ns, cred->fsgid));
1694 	audit_log_task_context(ab);
1695 	audit_log_key(ab, ctx->filterkey);
1696 	audit_log_end(ab);
1697 }
1698 
1699 static void audit_log_exit(void)
1700 {
1701 	int i, call_panic = 0;
1702 	struct audit_context *context = audit_context();
1703 	struct audit_buffer *ab;
1704 	struct audit_aux_data *aux;
1705 	struct audit_names *n;
1706 
1707 	context->personality = current->personality;
1708 
1709 	switch (context->context) {
1710 	case AUDIT_CTX_SYSCALL:
1711 		ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
1712 		if (!ab)
1713 			return;
1714 		audit_log_format(ab, "arch=%x syscall=%d",
1715 				 context->arch, context->major);
1716 		if (context->personality != PER_LINUX)
1717 			audit_log_format(ab, " per=%lx", context->personality);
1718 		if (context->return_valid != AUDITSC_INVALID)
1719 			audit_log_format(ab, " success=%s exit=%ld",
1720 					 (context->return_valid == AUDITSC_SUCCESS ?
1721 					  "yes" : "no"),
1722 					 context->return_code);
1723 		audit_log_format(ab,
1724 				 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d",
1725 				 context->argv[0],
1726 				 context->argv[1],
1727 				 context->argv[2],
1728 				 context->argv[3],
1729 				 context->name_count);
1730 		audit_log_task_info(ab);
1731 		audit_log_key(ab, context->filterkey);
1732 		audit_log_end(ab);
1733 		break;
1734 	case AUDIT_CTX_URING:
1735 		audit_log_uring(context);
1736 		break;
1737 	default:
1738 		BUG();
1739 		break;
1740 	}
1741 
1742 	for (aux = context->aux; aux; aux = aux->next) {
1743 
1744 		ab = audit_log_start(context, GFP_KERNEL, aux->type);
1745 		if (!ab)
1746 			continue; /* audit_panic has been called */
1747 
1748 		switch (aux->type) {
1749 
1750 		case AUDIT_BPRM_FCAPS: {
1751 			struct audit_aux_data_bprm_fcaps *axs = (void *)aux;
1752 
1753 			audit_log_format(ab, "fver=%x", axs->fcap_ver);
1754 			audit_log_cap(ab, "fp", &axs->fcap.permitted);
1755 			audit_log_cap(ab, "fi", &axs->fcap.inheritable);
1756 			audit_log_format(ab, " fe=%d", axs->fcap.fE);
1757 			audit_log_cap(ab, "old_pp", &axs->old_pcap.permitted);
1758 			audit_log_cap(ab, "old_pi", &axs->old_pcap.inheritable);
1759 			audit_log_cap(ab, "old_pe", &axs->old_pcap.effective);
1760 			audit_log_cap(ab, "old_pa", &axs->old_pcap.ambient);
1761 			audit_log_cap(ab, "pp", &axs->new_pcap.permitted);
1762 			audit_log_cap(ab, "pi", &axs->new_pcap.inheritable);
1763 			audit_log_cap(ab, "pe", &axs->new_pcap.effective);
1764 			audit_log_cap(ab, "pa", &axs->new_pcap.ambient);
1765 			audit_log_format(ab, " frootid=%d",
1766 					 from_kuid(&init_user_ns,
1767 						   axs->fcap.rootid));
1768 			break; }
1769 
1770 		}
1771 		audit_log_end(ab);
1772 	}
1773 
1774 	if (context->type)
1775 		show_special(context, &call_panic);
1776 
1777 	if (context->fds[0] >= 0) {
1778 		ab = audit_log_start(context, GFP_KERNEL, AUDIT_FD_PAIR);
1779 		if (ab) {
1780 			audit_log_format(ab, "fd0=%d fd1=%d",
1781 					context->fds[0], context->fds[1]);
1782 			audit_log_end(ab);
1783 		}
1784 	}
1785 
1786 	if (context->sockaddr_len) {
1787 		ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR);
1788 		if (ab) {
1789 			audit_log_format(ab, "saddr=");
1790 			audit_log_n_hex(ab, (void *)context->sockaddr,
1791 					context->sockaddr_len);
1792 			audit_log_end(ab);
1793 		}
1794 	}
1795 
1796 	for (aux = context->aux_pids; aux; aux = aux->next) {
1797 		struct audit_aux_data_pids *axs = (void *)aux;
1798 
1799 		for (i = 0; i < axs->pid_count; i++)
1800 			if (audit_log_pid_context(context, axs->target_pid[i],
1801 						  axs->target_auid[i],
1802 						  axs->target_uid[i],
1803 						  axs->target_sessionid[i],
1804 						  axs->target_sid[i],
1805 						  axs->target_comm[i]))
1806 				call_panic = 1;
1807 	}
1808 
1809 	if (context->target_pid &&
1810 	    audit_log_pid_context(context, context->target_pid,
1811 				  context->target_auid, context->target_uid,
1812 				  context->target_sessionid,
1813 				  context->target_sid, context->target_comm))
1814 			call_panic = 1;
1815 
1816 	if (context->pwd.dentry && context->pwd.mnt) {
1817 		ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
1818 		if (ab) {
1819 			audit_log_d_path(ab, "cwd=", &context->pwd);
1820 			audit_log_end(ab);
1821 		}
1822 	}
1823 
1824 	i = 0;
1825 	list_for_each_entry(n, &context->names_list, list) {
1826 		if (n->hidden)
1827 			continue;
1828 		audit_log_name(context, n, NULL, i++, &call_panic);
1829 	}
1830 
1831 	if (context->context == AUDIT_CTX_SYSCALL)
1832 		audit_log_proctitle();
1833 
1834 	/* Send end of event record to help user space know we are finished */
1835 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
1836 	if (ab)
1837 		audit_log_end(ab);
1838 	if (call_panic)
1839 		audit_panic("error in audit_log_exit()");
1840 }
1841 
1842 /**
1843  * __audit_free - free a per-task audit context
1844  * @tsk: task whose audit context block to free
1845  *
1846  * Called from copy_process, do_exit, and the io_uring code
1847  */
1848 void __audit_free(struct task_struct *tsk)
1849 {
1850 	struct audit_context *context = tsk->audit_context;
1851 
1852 	if (!context)
1853 		return;
1854 
1855 	/* this may generate CONFIG_CHANGE records */
1856 	if (!list_empty(&context->killed_trees))
1857 		audit_kill_trees(context);
1858 
1859 	/* We are called either by do_exit() or the fork() error handling code;
1860 	 * in the former case tsk == current and in the latter tsk is a
1861 	 * random task_struct that doesn't doesn't have any meaningful data we
1862 	 * need to log via audit_log_exit().
1863 	 */
1864 	if (tsk == current && !context->dummy) {
1865 		context->return_valid = AUDITSC_INVALID;
1866 		context->return_code = 0;
1867 		if (context->context == AUDIT_CTX_SYSCALL) {
1868 			audit_filter_syscall(tsk, context);
1869 			audit_filter_inodes(tsk, context);
1870 			if (context->current_state == AUDIT_STATE_RECORD)
1871 				audit_log_exit();
1872 		} else if (context->context == AUDIT_CTX_URING) {
1873 			/* TODO: verify this case is real and valid */
1874 			audit_filter_uring(tsk, context);
1875 			audit_filter_inodes(tsk, context);
1876 			if (context->current_state == AUDIT_STATE_RECORD)
1877 				audit_log_uring(context);
1878 		}
1879 	}
1880 
1881 	audit_set_context(tsk, NULL);
1882 	audit_free_context(context);
1883 }
1884 
1885 /**
1886  * audit_return_fixup - fixup the return codes in the audit_context
1887  * @ctx: the audit_context
1888  * @success: true/false value to indicate if the operation succeeded or not
1889  * @code: operation return code
1890  *
1891  * We need to fixup the return code in the audit logs if the actual return
1892  * codes are later going to be fixed by the arch specific signal handlers.
1893  */
1894 static void audit_return_fixup(struct audit_context *ctx,
1895 			       int success, long code)
1896 {
1897 	/*
1898 	 * This is actually a test for:
1899 	 * (rc == ERESTARTSYS ) || (rc == ERESTARTNOINTR) ||
1900 	 * (rc == ERESTARTNOHAND) || (rc == ERESTART_RESTARTBLOCK)
1901 	 *
1902 	 * but is faster than a bunch of ||
1903 	 */
1904 	if (unlikely(code <= -ERESTARTSYS) &&
1905 	    (code >= -ERESTART_RESTARTBLOCK) &&
1906 	    (code != -ENOIOCTLCMD))
1907 		ctx->return_code = -EINTR;
1908 	else
1909 		ctx->return_code  = code;
1910 	ctx->return_valid = (success ? AUDITSC_SUCCESS : AUDITSC_FAILURE);
1911 }
1912 
1913 /**
1914  * __audit_uring_entry - prepare the kernel task's audit context for io_uring
1915  * @op: the io_uring opcode
1916  *
1917  * This is similar to audit_syscall_entry() but is intended for use by io_uring
1918  * operations.  This function should only ever be called from
1919  * audit_uring_entry() as we rely on the audit context checking present in that
1920  * function.
1921  */
1922 void __audit_uring_entry(u8 op)
1923 {
1924 	struct audit_context *ctx = audit_context();
1925 
1926 	if (ctx->state == AUDIT_STATE_DISABLED)
1927 		return;
1928 
1929 	/*
1930 	 * NOTE: It's possible that we can be called from the process' context
1931 	 *       before it returns to userspace, and before audit_syscall_exit()
1932 	 *       is called.  In this case there is not much to do, just record
1933 	 *       the io_uring details and return.
1934 	 */
1935 	ctx->uring_op = op;
1936 	if (ctx->context == AUDIT_CTX_SYSCALL)
1937 		return;
1938 
1939 	ctx->dummy = !audit_n_rules;
1940 	if (!ctx->dummy && ctx->state == AUDIT_STATE_BUILD)
1941 		ctx->prio = 0;
1942 
1943 	ctx->context = AUDIT_CTX_URING;
1944 	ctx->current_state = ctx->state;
1945 	ktime_get_coarse_real_ts64(&ctx->ctime);
1946 }
1947 
1948 /**
1949  * __audit_uring_exit - wrap up the kernel task's audit context after io_uring
1950  * @success: true/false value to indicate if the operation succeeded or not
1951  * @code: operation return code
1952  *
1953  * This is similar to audit_syscall_exit() but is intended for use by io_uring
1954  * operations.  This function should only ever be called from
1955  * audit_uring_exit() as we rely on the audit context checking present in that
1956  * function.
1957  */
1958 void __audit_uring_exit(int success, long code)
1959 {
1960 	struct audit_context *ctx = audit_context();
1961 
1962 	if (ctx->context == AUDIT_CTX_SYSCALL) {
1963 		/*
1964 		 * NOTE: See the note in __audit_uring_entry() about the case
1965 		 *       where we may be called from process context before we
1966 		 *       return to userspace via audit_syscall_exit().  In this
1967 		 *       case we simply emit a URINGOP record and bail, the
1968 		 *       normal syscall exit handling will take care of
1969 		 *       everything else.
1970 		 *       It is also worth mentioning that when we are called,
1971 		 *       the current process creds may differ from the creds
1972 		 *       used during the normal syscall processing; keep that
1973 		 *       in mind if/when we move the record generation code.
1974 		 */
1975 
1976 		/*
1977 		 * We need to filter on the syscall info here to decide if we
1978 		 * should emit a URINGOP record.  I know it seems odd but this
1979 		 * solves the problem where users have a filter to block *all*
1980 		 * syscall records in the "exit" filter; we want to preserve
1981 		 * the behavior here.
1982 		 */
1983 		audit_filter_syscall(current, ctx);
1984 		if (ctx->current_state != AUDIT_STATE_RECORD)
1985 			audit_filter_uring(current, ctx);
1986 		audit_filter_inodes(current, ctx);
1987 		if (ctx->current_state != AUDIT_STATE_RECORD)
1988 			return;
1989 
1990 		audit_log_uring(ctx);
1991 		return;
1992 	}
1993 
1994 	/* this may generate CONFIG_CHANGE records */
1995 	if (!list_empty(&ctx->killed_trees))
1996 		audit_kill_trees(ctx);
1997 
1998 	/* run through both filters to ensure we set the filterkey properly */
1999 	audit_filter_uring(current, ctx);
2000 	audit_filter_inodes(current, ctx);
2001 	if (ctx->current_state != AUDIT_STATE_RECORD)
2002 		goto out;
2003 	audit_return_fixup(ctx, success, code);
2004 	audit_log_exit();
2005 
2006 out:
2007 	audit_reset_context(ctx);
2008 }
2009 
2010 /**
2011  * __audit_syscall_entry - fill in an audit record at syscall entry
2012  * @major: major syscall type (function)
2013  * @a1: additional syscall register 1
2014  * @a2: additional syscall register 2
2015  * @a3: additional syscall register 3
2016  * @a4: additional syscall register 4
2017  *
2018  * Fill in audit context at syscall entry.  This only happens if the
2019  * audit context was created when the task was created and the state or
2020  * filters demand the audit context be built.  If the state from the
2021  * per-task filter or from the per-syscall filter is AUDIT_STATE_RECORD,
2022  * then the record will be written at syscall exit time (otherwise, it
2023  * will only be written if another part of the kernel requests that it
2024  * be written).
2025  */
2026 void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
2027 			   unsigned long a3, unsigned long a4)
2028 {
2029 	struct audit_context *context = audit_context();
2030 	enum audit_state     state;
2031 
2032 	if (!audit_enabled || !context)
2033 		return;
2034 
2035 	WARN_ON(context->context != AUDIT_CTX_UNUSED);
2036 	WARN_ON(context->name_count);
2037 	if (context->context != AUDIT_CTX_UNUSED || context->name_count) {
2038 		audit_panic("unrecoverable error in audit_syscall_entry()");
2039 		return;
2040 	}
2041 
2042 	state = context->state;
2043 	if (state == AUDIT_STATE_DISABLED)
2044 		return;
2045 
2046 	context->dummy = !audit_n_rules;
2047 	if (!context->dummy && state == AUDIT_STATE_BUILD) {
2048 		context->prio = 0;
2049 		if (auditd_test_task(current))
2050 			return;
2051 	}
2052 
2053 	context->arch	    = syscall_get_arch(current);
2054 	context->major      = major;
2055 	context->argv[0]    = a1;
2056 	context->argv[1]    = a2;
2057 	context->argv[2]    = a3;
2058 	context->argv[3]    = a4;
2059 	context->context = AUDIT_CTX_SYSCALL;
2060 	context->current_state  = state;
2061 	ktime_get_coarse_real_ts64(&context->ctime);
2062 }
2063 
2064 /**
2065  * __audit_syscall_exit - deallocate audit context after a system call
2066  * @success: success value of the syscall
2067  * @return_code: return value of the syscall
2068  *
2069  * Tear down after system call.  If the audit context has been marked as
2070  * auditable (either because of the AUDIT_STATE_RECORD state from
2071  * filtering, or because some other part of the kernel wrote an audit
2072  * message), then write out the syscall information.  In call cases,
2073  * free the names stored from getname().
2074  */
2075 void __audit_syscall_exit(int success, long return_code)
2076 {
2077 	struct audit_context *context = audit_context();
2078 
2079 	if (!context || context->dummy ||
2080 	    context->context != AUDIT_CTX_SYSCALL)
2081 		goto out;
2082 
2083 	/* this may generate CONFIG_CHANGE records */
2084 	if (!list_empty(&context->killed_trees))
2085 		audit_kill_trees(context);
2086 
2087 	/* run through both filters to ensure we set the filterkey properly */
2088 	audit_filter_syscall(current, context);
2089 	audit_filter_inodes(current, context);
2090 	if (context->current_state < AUDIT_STATE_RECORD)
2091 		goto out;
2092 
2093 	audit_return_fixup(context, success, return_code);
2094 	audit_log_exit();
2095 
2096 out:
2097 	audit_reset_context(context);
2098 }
2099 
2100 static inline void handle_one(const struct inode *inode)
2101 {
2102 	struct audit_context *context;
2103 	struct audit_tree_refs *p;
2104 	struct audit_chunk *chunk;
2105 	int count;
2106 
2107 	if (likely(!inode->i_fsnotify_marks))
2108 		return;
2109 	context = audit_context();
2110 	p = context->trees;
2111 	count = context->tree_count;
2112 	rcu_read_lock();
2113 	chunk = audit_tree_lookup(inode);
2114 	rcu_read_unlock();
2115 	if (!chunk)
2116 		return;
2117 	if (likely(put_tree_ref(context, chunk)))
2118 		return;
2119 	if (unlikely(!grow_tree_refs(context))) {
2120 		pr_warn("out of memory, audit has lost a tree reference\n");
2121 		audit_set_auditable(context);
2122 		audit_put_chunk(chunk);
2123 		unroll_tree_refs(context, p, count);
2124 		return;
2125 	}
2126 	put_tree_ref(context, chunk);
2127 }
2128 
2129 static void handle_path(const struct dentry *dentry)
2130 {
2131 	struct audit_context *context;
2132 	struct audit_tree_refs *p;
2133 	const struct dentry *d, *parent;
2134 	struct audit_chunk *drop;
2135 	unsigned long seq;
2136 	int count;
2137 
2138 	context = audit_context();
2139 	p = context->trees;
2140 	count = context->tree_count;
2141 retry:
2142 	drop = NULL;
2143 	d = dentry;
2144 	rcu_read_lock();
2145 	seq = read_seqbegin(&rename_lock);
2146 	for(;;) {
2147 		struct inode *inode = d_backing_inode(d);
2148 
2149 		if (inode && unlikely(inode->i_fsnotify_marks)) {
2150 			struct audit_chunk *chunk;
2151 
2152 			chunk = audit_tree_lookup(inode);
2153 			if (chunk) {
2154 				if (unlikely(!put_tree_ref(context, chunk))) {
2155 					drop = chunk;
2156 					break;
2157 				}
2158 			}
2159 		}
2160 		parent = d->d_parent;
2161 		if (parent == d)
2162 			break;
2163 		d = parent;
2164 	}
2165 	if (unlikely(read_seqretry(&rename_lock, seq) || drop)) {  /* in this order */
2166 		rcu_read_unlock();
2167 		if (!drop) {
2168 			/* just a race with rename */
2169 			unroll_tree_refs(context, p, count);
2170 			goto retry;
2171 		}
2172 		audit_put_chunk(drop);
2173 		if (grow_tree_refs(context)) {
2174 			/* OK, got more space */
2175 			unroll_tree_refs(context, p, count);
2176 			goto retry;
2177 		}
2178 		/* too bad */
2179 		pr_warn("out of memory, audit has lost a tree reference\n");
2180 		unroll_tree_refs(context, p, count);
2181 		audit_set_auditable(context);
2182 		return;
2183 	}
2184 	rcu_read_unlock();
2185 }
2186 
2187 static struct audit_names *audit_alloc_name(struct audit_context *context,
2188 						unsigned char type)
2189 {
2190 	struct audit_names *aname;
2191 
2192 	if (context->name_count < AUDIT_NAMES) {
2193 		aname = &context->preallocated_names[context->name_count];
2194 		memset(aname, 0, sizeof(*aname));
2195 	} else {
2196 		aname = kzalloc(sizeof(*aname), GFP_NOFS);
2197 		if (!aname)
2198 			return NULL;
2199 		aname->should_free = true;
2200 	}
2201 
2202 	aname->ino = AUDIT_INO_UNSET;
2203 	aname->type = type;
2204 	list_add_tail(&aname->list, &context->names_list);
2205 
2206 	context->name_count++;
2207 	if (!context->pwd.dentry)
2208 		get_fs_pwd(current->fs, &context->pwd);
2209 	return aname;
2210 }
2211 
2212 /**
2213  * __audit_reusename - fill out filename with info from existing entry
2214  * @uptr: userland ptr to pathname
2215  *
2216  * Search the audit_names list for the current audit context. If there is an
2217  * existing entry with a matching "uptr" then return the filename
2218  * associated with that audit_name. If not, return NULL.
2219  */
2220 struct filename *
2221 __audit_reusename(const __user char *uptr)
2222 {
2223 	struct audit_context *context = audit_context();
2224 	struct audit_names *n;
2225 
2226 	list_for_each_entry(n, &context->names_list, list) {
2227 		if (!n->name)
2228 			continue;
2229 		if (n->name->uptr == uptr) {
2230 			n->name->refcnt++;
2231 			return n->name;
2232 		}
2233 	}
2234 	return NULL;
2235 }
2236 
2237 /**
2238  * __audit_getname - add a name to the list
2239  * @name: name to add
2240  *
2241  * Add a name to the list of audit names for this context.
2242  * Called from fs/namei.c:getname().
2243  */
2244 void __audit_getname(struct filename *name)
2245 {
2246 	struct audit_context *context = audit_context();
2247 	struct audit_names *n;
2248 
2249 	if (context->context == AUDIT_CTX_UNUSED)
2250 		return;
2251 
2252 	n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
2253 	if (!n)
2254 		return;
2255 
2256 	n->name = name;
2257 	n->name_len = AUDIT_NAME_FULL;
2258 	name->aname = n;
2259 	name->refcnt++;
2260 }
2261 
2262 static inline int audit_copy_fcaps(struct audit_names *name,
2263 				   const struct dentry *dentry)
2264 {
2265 	struct cpu_vfs_cap_data caps;
2266 	int rc;
2267 
2268 	if (!dentry)
2269 		return 0;
2270 
2271 	rc = get_vfs_caps_from_disk(&init_user_ns, dentry, &caps);
2272 	if (rc)
2273 		return rc;
2274 
2275 	name->fcap.permitted = caps.permitted;
2276 	name->fcap.inheritable = caps.inheritable;
2277 	name->fcap.fE = !!(caps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
2278 	name->fcap.rootid = caps.rootid;
2279 	name->fcap_ver = (caps.magic_etc & VFS_CAP_REVISION_MASK) >>
2280 				VFS_CAP_REVISION_SHIFT;
2281 
2282 	return 0;
2283 }
2284 
2285 /* Copy inode data into an audit_names. */
2286 static void audit_copy_inode(struct audit_names *name,
2287 			     const struct dentry *dentry,
2288 			     struct inode *inode, unsigned int flags)
2289 {
2290 	name->ino   = inode->i_ino;
2291 	name->dev   = inode->i_sb->s_dev;
2292 	name->mode  = inode->i_mode;
2293 	name->uid   = inode->i_uid;
2294 	name->gid   = inode->i_gid;
2295 	name->rdev  = inode->i_rdev;
2296 	security_inode_getsecid(inode, &name->osid);
2297 	if (flags & AUDIT_INODE_NOEVAL) {
2298 		name->fcap_ver = -1;
2299 		return;
2300 	}
2301 	audit_copy_fcaps(name, dentry);
2302 }
2303 
2304 /**
2305  * __audit_inode - store the inode and device from a lookup
2306  * @name: name being audited
2307  * @dentry: dentry being audited
2308  * @flags: attributes for this particular entry
2309  */
2310 void __audit_inode(struct filename *name, const struct dentry *dentry,
2311 		   unsigned int flags)
2312 {
2313 	struct audit_context *context = audit_context();
2314 	struct inode *inode = d_backing_inode(dentry);
2315 	struct audit_names *n;
2316 	bool parent = flags & AUDIT_INODE_PARENT;
2317 	struct audit_entry *e;
2318 	struct list_head *list = &audit_filter_list[AUDIT_FILTER_FS];
2319 	int i;
2320 
2321 	if (context->context == AUDIT_CTX_UNUSED)
2322 		return;
2323 
2324 	rcu_read_lock();
2325 	list_for_each_entry_rcu(e, list, list) {
2326 		for (i = 0; i < e->rule.field_count; i++) {
2327 			struct audit_field *f = &e->rule.fields[i];
2328 
2329 			if (f->type == AUDIT_FSTYPE
2330 			    && audit_comparator(inode->i_sb->s_magic,
2331 						f->op, f->val)
2332 			    && e->rule.action == AUDIT_NEVER) {
2333 				rcu_read_unlock();
2334 				return;
2335 			}
2336 		}
2337 	}
2338 	rcu_read_unlock();
2339 
2340 	if (!name)
2341 		goto out_alloc;
2342 
2343 	/*
2344 	 * If we have a pointer to an audit_names entry already, then we can
2345 	 * just use it directly if the type is correct.
2346 	 */
2347 	n = name->aname;
2348 	if (n) {
2349 		if (parent) {
2350 			if (n->type == AUDIT_TYPE_PARENT ||
2351 			    n->type == AUDIT_TYPE_UNKNOWN)
2352 				goto out;
2353 		} else {
2354 			if (n->type != AUDIT_TYPE_PARENT)
2355 				goto out;
2356 		}
2357 	}
2358 
2359 	list_for_each_entry_reverse(n, &context->names_list, list) {
2360 		if (n->ino) {
2361 			/* valid inode number, use that for the comparison */
2362 			if (n->ino != inode->i_ino ||
2363 			    n->dev != inode->i_sb->s_dev)
2364 				continue;
2365 		} else if (n->name) {
2366 			/* inode number has not been set, check the name */
2367 			if (strcmp(n->name->name, name->name))
2368 				continue;
2369 		} else
2370 			/* no inode and no name (?!) ... this is odd ... */
2371 			continue;
2372 
2373 		/* match the correct record type */
2374 		if (parent) {
2375 			if (n->type == AUDIT_TYPE_PARENT ||
2376 			    n->type == AUDIT_TYPE_UNKNOWN)
2377 				goto out;
2378 		} else {
2379 			if (n->type != AUDIT_TYPE_PARENT)
2380 				goto out;
2381 		}
2382 	}
2383 
2384 out_alloc:
2385 	/* unable to find an entry with both a matching name and type */
2386 	n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
2387 	if (!n)
2388 		return;
2389 	if (name) {
2390 		n->name = name;
2391 		name->refcnt++;
2392 	}
2393 
2394 out:
2395 	if (parent) {
2396 		n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;
2397 		n->type = AUDIT_TYPE_PARENT;
2398 		if (flags & AUDIT_INODE_HIDDEN)
2399 			n->hidden = true;
2400 	} else {
2401 		n->name_len = AUDIT_NAME_FULL;
2402 		n->type = AUDIT_TYPE_NORMAL;
2403 	}
2404 	handle_path(dentry);
2405 	audit_copy_inode(n, dentry, inode, flags & AUDIT_INODE_NOEVAL);
2406 }
2407 
2408 void __audit_file(const struct file *file)
2409 {
2410 	__audit_inode(NULL, file->f_path.dentry, 0);
2411 }
2412 
2413 /**
2414  * __audit_inode_child - collect inode info for created/removed objects
2415  * @parent: inode of dentry parent
2416  * @dentry: dentry being audited
2417  * @type:   AUDIT_TYPE_* value that we're looking for
2418  *
2419  * For syscalls that create or remove filesystem objects, audit_inode
2420  * can only collect information for the filesystem object's parent.
2421  * This call updates the audit context with the child's information.
2422  * Syscalls that create a new filesystem object must be hooked after
2423  * the object is created.  Syscalls that remove a filesystem object
2424  * must be hooked prior, in order to capture the target inode during
2425  * unsuccessful attempts.
2426  */
2427 void __audit_inode_child(struct inode *parent,
2428 			 const struct dentry *dentry,
2429 			 const unsigned char type)
2430 {
2431 	struct audit_context *context = audit_context();
2432 	struct inode *inode = d_backing_inode(dentry);
2433 	const struct qstr *dname = &dentry->d_name;
2434 	struct audit_names *n, *found_parent = NULL, *found_child = NULL;
2435 	struct audit_entry *e;
2436 	struct list_head *list = &audit_filter_list[AUDIT_FILTER_FS];
2437 	int i;
2438 
2439 	if (context->context == AUDIT_CTX_UNUSED)
2440 		return;
2441 
2442 	rcu_read_lock();
2443 	list_for_each_entry_rcu(e, list, list) {
2444 		for (i = 0; i < e->rule.field_count; i++) {
2445 			struct audit_field *f = &e->rule.fields[i];
2446 
2447 			if (f->type == AUDIT_FSTYPE
2448 			    && audit_comparator(parent->i_sb->s_magic,
2449 						f->op, f->val)
2450 			    && e->rule.action == AUDIT_NEVER) {
2451 				rcu_read_unlock();
2452 				return;
2453 			}
2454 		}
2455 	}
2456 	rcu_read_unlock();
2457 
2458 	if (inode)
2459 		handle_one(inode);
2460 
2461 	/* look for a parent entry first */
2462 	list_for_each_entry(n, &context->names_list, list) {
2463 		if (!n->name ||
2464 		    (n->type != AUDIT_TYPE_PARENT &&
2465 		     n->type != AUDIT_TYPE_UNKNOWN))
2466 			continue;
2467 
2468 		if (n->ino == parent->i_ino && n->dev == parent->i_sb->s_dev &&
2469 		    !audit_compare_dname_path(dname,
2470 					      n->name->name, n->name_len)) {
2471 			if (n->type == AUDIT_TYPE_UNKNOWN)
2472 				n->type = AUDIT_TYPE_PARENT;
2473 			found_parent = n;
2474 			break;
2475 		}
2476 	}
2477 
2478 	/* is there a matching child entry? */
2479 	list_for_each_entry(n, &context->names_list, list) {
2480 		/* can only match entries that have a name */
2481 		if (!n->name ||
2482 		    (n->type != type && n->type != AUDIT_TYPE_UNKNOWN))
2483 			continue;
2484 
2485 		if (!strcmp(dname->name, n->name->name) ||
2486 		    !audit_compare_dname_path(dname, n->name->name,
2487 						found_parent ?
2488 						found_parent->name_len :
2489 						AUDIT_NAME_FULL)) {
2490 			if (n->type == AUDIT_TYPE_UNKNOWN)
2491 				n->type = type;
2492 			found_child = n;
2493 			break;
2494 		}
2495 	}
2496 
2497 	if (!found_parent) {
2498 		/* create a new, "anonymous" parent record */
2499 		n = audit_alloc_name(context, AUDIT_TYPE_PARENT);
2500 		if (!n)
2501 			return;
2502 		audit_copy_inode(n, NULL, parent, 0);
2503 	}
2504 
2505 	if (!found_child) {
2506 		found_child = audit_alloc_name(context, type);
2507 		if (!found_child)
2508 			return;
2509 
2510 		/* Re-use the name belonging to the slot for a matching parent
2511 		 * directory. All names for this context are relinquished in
2512 		 * audit_free_names() */
2513 		if (found_parent) {
2514 			found_child->name = found_parent->name;
2515 			found_child->name_len = AUDIT_NAME_FULL;
2516 			found_child->name->refcnt++;
2517 		}
2518 	}
2519 
2520 	if (inode)
2521 		audit_copy_inode(found_child, dentry, inode, 0);
2522 	else
2523 		found_child->ino = AUDIT_INO_UNSET;
2524 }
2525 EXPORT_SYMBOL_GPL(__audit_inode_child);
2526 
2527 /**
2528  * auditsc_get_stamp - get local copies of audit_context values
2529  * @ctx: audit_context for the task
2530  * @t: timespec64 to store time recorded in the audit_context
2531  * @serial: serial value that is recorded in the audit_context
2532  *
2533  * Also sets the context as auditable.
2534  */
2535 int auditsc_get_stamp(struct audit_context *ctx,
2536 		       struct timespec64 *t, unsigned int *serial)
2537 {
2538 	if (ctx->context == AUDIT_CTX_UNUSED)
2539 		return 0;
2540 	if (!ctx->serial)
2541 		ctx->serial = audit_serial();
2542 	t->tv_sec  = ctx->ctime.tv_sec;
2543 	t->tv_nsec = ctx->ctime.tv_nsec;
2544 	*serial    = ctx->serial;
2545 	if (!ctx->prio) {
2546 		ctx->prio = 1;
2547 		ctx->current_state = AUDIT_STATE_RECORD;
2548 	}
2549 	return 1;
2550 }
2551 
2552 /**
2553  * __audit_mq_open - record audit data for a POSIX MQ open
2554  * @oflag: open flag
2555  * @mode: mode bits
2556  * @attr: queue attributes
2557  *
2558  */
2559 void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
2560 {
2561 	struct audit_context *context = audit_context();
2562 
2563 	if (attr)
2564 		memcpy(&context->mq_open.attr, attr, sizeof(struct mq_attr));
2565 	else
2566 		memset(&context->mq_open.attr, 0, sizeof(struct mq_attr));
2567 
2568 	context->mq_open.oflag = oflag;
2569 	context->mq_open.mode = mode;
2570 
2571 	context->type = AUDIT_MQ_OPEN;
2572 }
2573 
2574 /**
2575  * __audit_mq_sendrecv - record audit data for a POSIX MQ timed send/receive
2576  * @mqdes: MQ descriptor
2577  * @msg_len: Message length
2578  * @msg_prio: Message priority
2579  * @abs_timeout: Message timeout in absolute time
2580  *
2581  */
2582 void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio,
2583 			const struct timespec64 *abs_timeout)
2584 {
2585 	struct audit_context *context = audit_context();
2586 	struct timespec64 *p = &context->mq_sendrecv.abs_timeout;
2587 
2588 	if (abs_timeout)
2589 		memcpy(p, abs_timeout, sizeof(*p));
2590 	else
2591 		memset(p, 0, sizeof(*p));
2592 
2593 	context->mq_sendrecv.mqdes = mqdes;
2594 	context->mq_sendrecv.msg_len = msg_len;
2595 	context->mq_sendrecv.msg_prio = msg_prio;
2596 
2597 	context->type = AUDIT_MQ_SENDRECV;
2598 }
2599 
2600 /**
2601  * __audit_mq_notify - record audit data for a POSIX MQ notify
2602  * @mqdes: MQ descriptor
2603  * @notification: Notification event
2604  *
2605  */
2606 
2607 void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
2608 {
2609 	struct audit_context *context = audit_context();
2610 
2611 	if (notification)
2612 		context->mq_notify.sigev_signo = notification->sigev_signo;
2613 	else
2614 		context->mq_notify.sigev_signo = 0;
2615 
2616 	context->mq_notify.mqdes = mqdes;
2617 	context->type = AUDIT_MQ_NOTIFY;
2618 }
2619 
2620 /**
2621  * __audit_mq_getsetattr - record audit data for a POSIX MQ get/set attribute
2622  * @mqdes: MQ descriptor
2623  * @mqstat: MQ flags
2624  *
2625  */
2626 void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
2627 {
2628 	struct audit_context *context = audit_context();
2629 
2630 	context->mq_getsetattr.mqdes = mqdes;
2631 	context->mq_getsetattr.mqstat = *mqstat;
2632 	context->type = AUDIT_MQ_GETSETATTR;
2633 }
2634 
2635 /**
2636  * __audit_ipc_obj - record audit data for ipc object
2637  * @ipcp: ipc permissions
2638  *
2639  */
2640 void __audit_ipc_obj(struct kern_ipc_perm *ipcp)
2641 {
2642 	struct audit_context *context = audit_context();
2643 
2644 	context->ipc.uid = ipcp->uid;
2645 	context->ipc.gid = ipcp->gid;
2646 	context->ipc.mode = ipcp->mode;
2647 	context->ipc.has_perm = 0;
2648 	security_ipc_getsecid(ipcp, &context->ipc.osid);
2649 	context->type = AUDIT_IPC;
2650 }
2651 
2652 /**
2653  * __audit_ipc_set_perm - record audit data for new ipc permissions
2654  * @qbytes: msgq bytes
2655  * @uid: msgq user id
2656  * @gid: msgq group id
2657  * @mode: msgq mode (permissions)
2658  *
2659  * Called only after audit_ipc_obj().
2660  */
2661 void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode)
2662 {
2663 	struct audit_context *context = audit_context();
2664 
2665 	context->ipc.qbytes = qbytes;
2666 	context->ipc.perm_uid = uid;
2667 	context->ipc.perm_gid = gid;
2668 	context->ipc.perm_mode = mode;
2669 	context->ipc.has_perm = 1;
2670 }
2671 
2672 void __audit_bprm(struct linux_binprm *bprm)
2673 {
2674 	struct audit_context *context = audit_context();
2675 
2676 	context->type = AUDIT_EXECVE;
2677 	context->execve.argc = bprm->argc;
2678 }
2679 
2680 
2681 /**
2682  * __audit_socketcall - record audit data for sys_socketcall
2683  * @nargs: number of args, which should not be more than AUDITSC_ARGS.
2684  * @args: args array
2685  *
2686  */
2687 int __audit_socketcall(int nargs, unsigned long *args)
2688 {
2689 	struct audit_context *context = audit_context();
2690 
2691 	if (nargs <= 0 || nargs > AUDITSC_ARGS || !args)
2692 		return -EINVAL;
2693 	context->type = AUDIT_SOCKETCALL;
2694 	context->socketcall.nargs = nargs;
2695 	memcpy(context->socketcall.args, args, nargs * sizeof(unsigned long));
2696 	return 0;
2697 }
2698 
2699 /**
2700  * __audit_fd_pair - record audit data for pipe and socketpair
2701  * @fd1: the first file descriptor
2702  * @fd2: the second file descriptor
2703  *
2704  */
2705 void __audit_fd_pair(int fd1, int fd2)
2706 {
2707 	struct audit_context *context = audit_context();
2708 
2709 	context->fds[0] = fd1;
2710 	context->fds[1] = fd2;
2711 }
2712 
2713 /**
2714  * __audit_sockaddr - record audit data for sys_bind, sys_connect, sys_sendto
2715  * @len: data length in user space
2716  * @a: data address in kernel space
2717  *
2718  * Returns 0 for success or NULL context or < 0 on error.
2719  */
2720 int __audit_sockaddr(int len, void *a)
2721 {
2722 	struct audit_context *context = audit_context();
2723 
2724 	if (!context->sockaddr) {
2725 		void *p = kmalloc(sizeof(struct sockaddr_storage), GFP_KERNEL);
2726 
2727 		if (!p)
2728 			return -ENOMEM;
2729 		context->sockaddr = p;
2730 	}
2731 
2732 	context->sockaddr_len = len;
2733 	memcpy(context->sockaddr, a, len);
2734 	return 0;
2735 }
2736 
2737 void __audit_ptrace(struct task_struct *t)
2738 {
2739 	struct audit_context *context = audit_context();
2740 
2741 	context->target_pid = task_tgid_nr(t);
2742 	context->target_auid = audit_get_loginuid(t);
2743 	context->target_uid = task_uid(t);
2744 	context->target_sessionid = audit_get_sessionid(t);
2745 	security_task_getsecid_obj(t, &context->target_sid);
2746 	memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
2747 }
2748 
2749 /**
2750  * audit_signal_info_syscall - record signal info for syscalls
2751  * @t: task being signaled
2752  *
2753  * If the audit subsystem is being terminated, record the task (pid)
2754  * and uid that is doing that.
2755  */
2756 int audit_signal_info_syscall(struct task_struct *t)
2757 {
2758 	struct audit_aux_data_pids *axp;
2759 	struct audit_context *ctx = audit_context();
2760 	kuid_t t_uid = task_uid(t);
2761 
2762 	if (!audit_signals || audit_dummy_context())
2763 		return 0;
2764 
2765 	/* optimize the common case by putting first signal recipient directly
2766 	 * in audit_context */
2767 	if (!ctx->target_pid) {
2768 		ctx->target_pid = task_tgid_nr(t);
2769 		ctx->target_auid = audit_get_loginuid(t);
2770 		ctx->target_uid = t_uid;
2771 		ctx->target_sessionid = audit_get_sessionid(t);
2772 		security_task_getsecid_obj(t, &ctx->target_sid);
2773 		memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
2774 		return 0;
2775 	}
2776 
2777 	axp = (void *)ctx->aux_pids;
2778 	if (!axp || axp->pid_count == AUDIT_AUX_PIDS) {
2779 		axp = kzalloc(sizeof(*axp), GFP_ATOMIC);
2780 		if (!axp)
2781 			return -ENOMEM;
2782 
2783 		axp->d.type = AUDIT_OBJ_PID;
2784 		axp->d.next = ctx->aux_pids;
2785 		ctx->aux_pids = (void *)axp;
2786 	}
2787 	BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
2788 
2789 	axp->target_pid[axp->pid_count] = task_tgid_nr(t);
2790 	axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
2791 	axp->target_uid[axp->pid_count] = t_uid;
2792 	axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t);
2793 	security_task_getsecid_obj(t, &axp->target_sid[axp->pid_count]);
2794 	memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
2795 	axp->pid_count++;
2796 
2797 	return 0;
2798 }
2799 
2800 /**
2801  * __audit_log_bprm_fcaps - store information about a loading bprm and relevant fcaps
2802  * @bprm: pointer to the bprm being processed
2803  * @new: the proposed new credentials
2804  * @old: the old credentials
2805  *
2806  * Simply check if the proc already has the caps given by the file and if not
2807  * store the priv escalation info for later auditing at the end of the syscall
2808  *
2809  * -Eric
2810  */
2811 int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
2812 			   const struct cred *new, const struct cred *old)
2813 {
2814 	struct audit_aux_data_bprm_fcaps *ax;
2815 	struct audit_context *context = audit_context();
2816 	struct cpu_vfs_cap_data vcaps;
2817 
2818 	ax = kmalloc(sizeof(*ax), GFP_KERNEL);
2819 	if (!ax)
2820 		return -ENOMEM;
2821 
2822 	ax->d.type = AUDIT_BPRM_FCAPS;
2823 	ax->d.next = context->aux;
2824 	context->aux = (void *)ax;
2825 
2826 	get_vfs_caps_from_disk(&init_user_ns,
2827 			       bprm->file->f_path.dentry, &vcaps);
2828 
2829 	ax->fcap.permitted = vcaps.permitted;
2830 	ax->fcap.inheritable = vcaps.inheritable;
2831 	ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
2832 	ax->fcap.rootid = vcaps.rootid;
2833 	ax->fcap_ver = (vcaps.magic_etc & VFS_CAP_REVISION_MASK) >> VFS_CAP_REVISION_SHIFT;
2834 
2835 	ax->old_pcap.permitted   = old->cap_permitted;
2836 	ax->old_pcap.inheritable = old->cap_inheritable;
2837 	ax->old_pcap.effective   = old->cap_effective;
2838 	ax->old_pcap.ambient     = old->cap_ambient;
2839 
2840 	ax->new_pcap.permitted   = new->cap_permitted;
2841 	ax->new_pcap.inheritable = new->cap_inheritable;
2842 	ax->new_pcap.effective   = new->cap_effective;
2843 	ax->new_pcap.ambient     = new->cap_ambient;
2844 	return 0;
2845 }
2846 
2847 /**
2848  * __audit_log_capset - store information about the arguments to the capset syscall
2849  * @new: the new credentials
2850  * @old: the old (current) credentials
2851  *
2852  * Record the arguments userspace sent to sys_capset for later printing by the
2853  * audit system if applicable
2854  */
2855 void __audit_log_capset(const struct cred *new, const struct cred *old)
2856 {
2857 	struct audit_context *context = audit_context();
2858 
2859 	context->capset.pid = task_tgid_nr(current);
2860 	context->capset.cap.effective   = new->cap_effective;
2861 	context->capset.cap.inheritable = new->cap_effective;
2862 	context->capset.cap.permitted   = new->cap_permitted;
2863 	context->capset.cap.ambient     = new->cap_ambient;
2864 	context->type = AUDIT_CAPSET;
2865 }
2866 
2867 void __audit_mmap_fd(int fd, int flags)
2868 {
2869 	struct audit_context *context = audit_context();
2870 
2871 	context->mmap.fd = fd;
2872 	context->mmap.flags = flags;
2873 	context->type = AUDIT_MMAP;
2874 }
2875 
2876 void __audit_openat2_how(struct open_how *how)
2877 {
2878 	struct audit_context *context = audit_context();
2879 
2880 	context->openat2.flags = how->flags;
2881 	context->openat2.mode = how->mode;
2882 	context->openat2.resolve = how->resolve;
2883 	context->type = AUDIT_OPENAT2;
2884 }
2885 
2886 void __audit_log_kern_module(char *name)
2887 {
2888 	struct audit_context *context = audit_context();
2889 
2890 	context->module.name = kstrdup(name, GFP_KERNEL);
2891 	if (!context->module.name)
2892 		audit_log_lost("out of memory in __audit_log_kern_module");
2893 	context->type = AUDIT_KERN_MODULE;
2894 }
2895 
2896 void __audit_fanotify(unsigned int response)
2897 {
2898 	audit_log(audit_context(), GFP_KERNEL,
2899 		AUDIT_FANOTIFY,	"resp=%u", response);
2900 }
2901 
2902 void __audit_tk_injoffset(struct timespec64 offset)
2903 {
2904 	struct audit_context *context = audit_context();
2905 
2906 	/* only set type if not already set by NTP */
2907 	if (!context->type)
2908 		context->type = AUDIT_TIME_INJOFFSET;
2909 	memcpy(&context->time.tk_injoffset, &offset, sizeof(offset));
2910 }
2911 
2912 void __audit_ntp_log(const struct audit_ntp_data *ad)
2913 {
2914 	struct audit_context *context = audit_context();
2915 	int type;
2916 
2917 	for (type = 0; type < AUDIT_NTP_NVALS; type++)
2918 		if (ad->vals[type].newval != ad->vals[type].oldval) {
2919 			/* unconditionally set type, overwriting TK */
2920 			context->type = AUDIT_TIME_ADJNTPVAL;
2921 			memcpy(&context->time.ntp_data, ad, sizeof(*ad));
2922 			break;
2923 		}
2924 }
2925 
2926 void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
2927 		       enum audit_nfcfgop op, gfp_t gfp)
2928 {
2929 	struct audit_buffer *ab;
2930 	char comm[sizeof(current->comm)];
2931 
2932 	ab = audit_log_start(audit_context(), gfp, AUDIT_NETFILTER_CFG);
2933 	if (!ab)
2934 		return;
2935 	audit_log_format(ab, "table=%s family=%u entries=%u op=%s",
2936 			 name, af, nentries, audit_nfcfgs[op].s);
2937 
2938 	audit_log_format(ab, " pid=%u", task_pid_nr(current));
2939 	audit_log_task_context(ab); /* subj= */
2940 	audit_log_format(ab, " comm=");
2941 	audit_log_untrustedstring(ab, get_task_comm(comm, current));
2942 	audit_log_end(ab);
2943 }
2944 EXPORT_SYMBOL_GPL(__audit_log_nfcfg);
2945 
2946 static void audit_log_task(struct audit_buffer *ab)
2947 {
2948 	kuid_t auid, uid;
2949 	kgid_t gid;
2950 	unsigned int sessionid;
2951 	char comm[sizeof(current->comm)];
2952 
2953 	auid = audit_get_loginuid(current);
2954 	sessionid = audit_get_sessionid(current);
2955 	current_uid_gid(&uid, &gid);
2956 
2957 	audit_log_format(ab, "auid=%u uid=%u gid=%u ses=%u",
2958 			 from_kuid(&init_user_ns, auid),
2959 			 from_kuid(&init_user_ns, uid),
2960 			 from_kgid(&init_user_ns, gid),
2961 			 sessionid);
2962 	audit_log_task_context(ab);
2963 	audit_log_format(ab, " pid=%d comm=", task_tgid_nr(current));
2964 	audit_log_untrustedstring(ab, get_task_comm(comm, current));
2965 	audit_log_d_path_exe(ab, current->mm);
2966 }
2967 
2968 /**
2969  * audit_core_dumps - record information about processes that end abnormally
2970  * @signr: signal value
2971  *
2972  * If a process ends with a core dump, something fishy is going on and we
2973  * should record the event for investigation.
2974  */
2975 void audit_core_dumps(long signr)
2976 {
2977 	struct audit_buffer *ab;
2978 
2979 	if (!audit_enabled)
2980 		return;
2981 
2982 	if (signr == SIGQUIT)	/* don't care for those */
2983 		return;
2984 
2985 	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_ANOM_ABEND);
2986 	if (unlikely(!ab))
2987 		return;
2988 	audit_log_task(ab);
2989 	audit_log_format(ab, " sig=%ld res=1", signr);
2990 	audit_log_end(ab);
2991 }
2992 
2993 /**
2994  * audit_seccomp - record information about a seccomp action
2995  * @syscall: syscall number
2996  * @signr: signal value
2997  * @code: the seccomp action
2998  *
2999  * Record the information associated with a seccomp action. Event filtering for
3000  * seccomp actions that are not to be logged is done in seccomp_log().
3001  * Therefore, this function forces auditing independent of the audit_enabled
3002  * and dummy context state because seccomp actions should be logged even when
3003  * audit is not in use.
3004  */
3005 void audit_seccomp(unsigned long syscall, long signr, int code)
3006 {
3007 	struct audit_buffer *ab;
3008 
3009 	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_SECCOMP);
3010 	if (unlikely(!ab))
3011 		return;
3012 	audit_log_task(ab);
3013 	audit_log_format(ab, " sig=%ld arch=%x syscall=%ld compat=%d ip=0x%lx code=0x%x",
3014 			 signr, syscall_get_arch(current), syscall,
3015 			 in_compat_syscall(), KSTK_EIP(current), code);
3016 	audit_log_end(ab);
3017 }
3018 
3019 void audit_seccomp_actions_logged(const char *names, const char *old_names,
3020 				  int res)
3021 {
3022 	struct audit_buffer *ab;
3023 
3024 	if (!audit_enabled)
3025 		return;
3026 
3027 	ab = audit_log_start(audit_context(), GFP_KERNEL,
3028 			     AUDIT_CONFIG_CHANGE);
3029 	if (unlikely(!ab))
3030 		return;
3031 
3032 	audit_log_format(ab,
3033 			 "op=seccomp-logging actions=%s old-actions=%s res=%d",
3034 			 names, old_names, res);
3035 	audit_log_end(ab);
3036 }
3037 
3038 struct list_head *audit_killed_trees(void)
3039 {
3040 	struct audit_context *ctx = audit_context();
3041 	if (likely(!ctx || ctx->context == AUDIT_CTX_UNUSED))
3042 		return NULL;
3043 	return &ctx->killed_trees;
3044 }
3045