xref: /linux/security/apparmor/audit.c (revision 8c994eff8fcfe8ecb1f1dbebed25b4d7bb75be12) 
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * AppArmor security module
4  *
5  * This file contains AppArmor auditing functions
6  *
7  * Copyright (C) 1998-2008 Novell/SUSE
8  * Copyright 2009-2010 Canonical Ltd.
9  */
10 
11 #include <linux/audit.h>
12 #include <linux/socket.h>
13 
14 #include "include/apparmor.h"
15 #include "include/audit.h"
16 #include "include/policy.h"
17 #include "include/policy_ns.h"
18 #include "include/secid.h"
19 
20 const char *const audit_mode_names[] = {
21 	"normal",
22 	"quiet_denied",
23 	"quiet",
24 	"noquiet",
25 	"all"
26 };
27 
28 static const char *const aa_audit_type[] = {
29 	"AUDIT",
30 	"ALLOWED",
31 	"DENIED",
32 	"HINT",
33 	"STATUS",
34 	"ERROR",
35 	"KILLED",
36 	"AUTO"
37 };
38 
39 static const char *const aa_class_names[] = {
40 	"none",
41 	"unknown",
42 	"file",
43 	"cap",
44 	"net",
45 	"rlimits",
46 	"domain",
47 	"mount",
48 	"unknown",
49 	"ptrace",
50 	"signal",
51 	"xmatch",
52 	"unknown",
53 	"unknown",
54 	"net",
55 	"unknown",
56 	"label",
57 	"posix_mqueue",
58 	"io_uring",
59 	"module",
60 	"lsm",
61 	"unknown",
62 	"unknown",
63 	"unknown",
64 	"unknown",
65 	"unknown",
66 	"unknown",
67 	"unknown",
68 	"unknown",
69 	"unknown",
70 	"unknown",
71 	"X",
72 	"dbus",
73 };
74 
75 
76 /*
77  * Currently AppArmor auditing is fed straight into the audit framework.
78  *
79  * TODO:
80  * netlink interface for complain mode
81  * user auditing, - send user auditing to netlink interface
82  * system control of whether user audit messages go to system log
83  */
84 
85 /**
86  * audit_pre() - core AppArmor function.
87  * @ab: audit buffer to fill (NOT NULL)
88  * @ca: audit structure containing data to audit (NOT NULL)
89  *
90  * Record common AppArmor audit data from @sa
91  */
92 static void audit_pre(struct audit_buffer *ab, void *ca)
93 {
94 	struct common_audit_data *sa = ca;
95 
96 	if (aa_g_audit_header) {
97 		audit_log_format(ab, "apparmor=\"%s\"",
98 				 aa_audit_type[aad(sa)->type]);
99 	}
100 
101 	if (aad(sa)->op) {
102 		audit_log_format(ab, " operation=\"%s\"", aad(sa)->op);
103 	}
104 
105 	if (aad(sa)->class)
106 		audit_log_format(ab, " class=\"%s\"",
107 				 aad(sa)->class <= AA_CLASS_LAST ?
108 				 aa_class_names[aad(sa)->class] :
109 				 "unknown");
110 
111 	if (aad(sa)->info) {
112 		audit_log_format(ab, " info=\"%s\"", aad(sa)->info);
113 		if (aad(sa)->error)
114 			audit_log_format(ab, " error=%d", aad(sa)->error);
115 	}
116 
117 	if (aad(sa)->label) {
118 		struct aa_label *label = aad(sa)->label;
119 
120 		if (label_isprofile(label)) {
121 			struct aa_profile *profile = labels_profile(label);
122 
123 			if (profile->ns != root_ns) {
124 				audit_log_format(ab, " namespace=");
125 				audit_log_untrustedstring(ab,
126 						       profile->ns->base.hname);
127 			}
128 			audit_log_format(ab, " profile=");
129 			audit_log_untrustedstring(ab, profile->base.hname);
130 		} else {
131 			audit_log_format(ab, " label=");
132 			aa_label_xaudit(ab, root_ns, label, FLAG_VIEW_SUBNS,
133 					GFP_ATOMIC);
134 		}
135 	}
136 
137 	if (aad(sa)->name) {
138 		audit_log_format(ab, " name=");
139 		audit_log_untrustedstring(ab, aad(sa)->name);
140 	}
141 }
142 
143 /**
144  * aa_audit_msg - Log a message to the audit subsystem
145  * @sa: audit event structure (NOT NULL)
146  * @cb: optional callback fn for type specific fields (MAYBE NULL)
147  */
148 void aa_audit_msg(int type, struct common_audit_data *sa,
149 		  void (*cb) (struct audit_buffer *, void *))
150 {
151 	aad(sa)->type = type;
152 	common_lsm_audit(sa, audit_pre, cb);
153 }
154 
155 /**
156  * aa_audit - Log a profile based audit event to the audit subsystem
157  * @type: audit type for the message
158  * @profile: profile to check against (NOT NULL)
159  * @sa: audit event (NOT NULL)
160  * @cb: optional callback fn for type specific fields (MAYBE NULL)
161  *
162  * Handle default message switching based off of audit mode flags
163  *
164  * Returns: error on failure
165  */
166 int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa,
167 	     void (*cb) (struct audit_buffer *, void *))
168 {
169 	AA_BUG(!profile);
170 
171 	if (type == AUDIT_APPARMOR_AUTO) {
172 		if (likely(!aad(sa)->error)) {
173 			if (AUDIT_MODE(profile) != AUDIT_ALL)
174 				return 0;
175 			type = AUDIT_APPARMOR_AUDIT;
176 		} else if (COMPLAIN_MODE(profile))
177 			type = AUDIT_APPARMOR_ALLOWED;
178 		else
179 			type = AUDIT_APPARMOR_DENIED;
180 	}
181 	if (AUDIT_MODE(profile) == AUDIT_QUIET ||
182 	    (type == AUDIT_APPARMOR_DENIED &&
183 	     AUDIT_MODE(profile) == AUDIT_QUIET_DENIED))
184 		return aad(sa)->error;
185 
186 	if (KILL_MODE(profile) && type == AUDIT_APPARMOR_DENIED)
187 		type = AUDIT_APPARMOR_KILL;
188 
189 	aad(sa)->label = &profile->label;
190 
191 	aa_audit_msg(type, sa, cb);
192 
193 	if (aad(sa)->type == AUDIT_APPARMOR_KILL)
194 		(void)send_sig_info(SIGKILL, NULL,
195 			sa->type == LSM_AUDIT_DATA_TASK && sa->u.tsk ?
196 				    sa->u.tsk : current);
197 
198 	if (aad(sa)->type == AUDIT_APPARMOR_ALLOWED)
199 		return complain_error(aad(sa)->error);
200 
201 	return aad(sa)->error;
202 }
203 
204 struct aa_audit_rule {
205 	struct aa_label *label;
206 };
207 
208 void aa_audit_rule_free(void *vrule)
209 {
210 	struct aa_audit_rule *rule = vrule;
211 
212 	if (rule) {
213 		if (!IS_ERR(rule->label))
214 			aa_put_label(rule->label);
215 		kfree(rule);
216 	}
217 }
218 
219 int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
220 {
221 	struct aa_audit_rule *rule;
222 
223 	switch (field) {
224 	case AUDIT_SUBJ_ROLE:
225 		if (op != Audit_equal && op != Audit_not_equal)
226 			return -EINVAL;
227 		break;
228 	default:
229 		return -EINVAL;
230 	}
231 
232 	rule = kzalloc(sizeof(struct aa_audit_rule), GFP_KERNEL);
233 
234 	if (!rule)
235 		return -ENOMEM;
236 
237 	/* Currently rules are treated as coming from the root ns */
238 	rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
239 				     GFP_KERNEL, true, false);
240 	if (IS_ERR(rule->label)) {
241 		int err = PTR_ERR(rule->label);
242 		aa_audit_rule_free(rule);
243 		return err;
244 	}
245 
246 	*vrule = rule;
247 	return 0;
248 }
249 
250 int aa_audit_rule_known(struct audit_krule *rule)
251 {
252 	int i;
253 
254 	for (i = 0; i < rule->field_count; i++) {
255 		struct audit_field *f = &rule->fields[i];
256 
257 		switch (f->type) {
258 		case AUDIT_SUBJ_ROLE:
259 			return 1;
260 		}
261 	}
262 
263 	return 0;
264 }
265 
266 int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule)
267 {
268 	struct aa_audit_rule *rule = vrule;
269 	struct aa_label *label;
270 	int found = 0;
271 
272 	label = aa_secid_to_label(sid);
273 
274 	if (!label)
275 		return -ENOENT;
276 
277 	if (aa_label_is_subset(label, rule->label))
278 		found = 1;
279 
280 	switch (field) {
281 	case AUDIT_SUBJ_ROLE:
282 		switch (op) {
283 		case Audit_equal:
284 			return found;
285 		case Audit_not_equal:
286 			return !found;
287 		}
288 	}
289 	return 0;
290 }
291