1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * AppArmor security module 4 * 5 * This file contains AppArmor auditing function definitions. 6 * 7 * Copyright (C) 1998-2008 Novell/SUSE 8 * Copyright 2009-2010 Canonical Ltd. 9 */ 10 11 #ifndef __AA_AUDIT_H 12 #define __AA_AUDIT_H 13 14 #include <linux/audit.h> 15 #include <linux/fs.h> 16 #include <linux/lsm_audit.h> 17 #include <linux/sched.h> 18 #include <linux/slab.h> 19 20 #include "file.h" 21 #include "label.h" 22 23 extern const char *const audit_mode_names[]; 24 enum audit_mode { 25 AUDIT_NORMAL, /* follow normal auditing of accesses */ 26 AUDIT_QUIET_DENIED, /* quiet all denied access messages */ 27 AUDIT_QUIET_ALLOWED, /* quiet all allowed access messages */ 28 AUDIT_QUIET, /* quiet all messages */ 29 AUDIT_NOQUIET, /* do not quiet audit messages */ 30 AUDIT_ALL, /* audit all accesses */ 31 AUDIT_MODE_NAMES_COUNT /* Must be last entry */ 32 }; 33 34 enum audit_type { 35 AUDIT_APPARMOR_AUDIT, 36 AUDIT_APPARMOR_ALLOWED, 37 AUDIT_APPARMOR_DENIED, 38 AUDIT_APPARMOR_HINT, 39 AUDIT_APPARMOR_STATUS, 40 AUDIT_APPARMOR_ERROR, 41 AUDIT_APPARMOR_KILL, 42 AUDIT_APPARMOR_AUTO 43 }; 44 45 #define OP_NULL NULL 46 47 #define OP_SYSCTL "sysctl" 48 #define OP_CAPABLE "capable" 49 50 #define OP_UNLINK "unlink" 51 #define OP_MKDIR "mkdir" 52 #define OP_RMDIR "rmdir" 53 #define OP_MKNOD "mknod" 54 #define OP_TRUNC "truncate" 55 #define OP_LINK "link" 56 #define OP_SYMLINK "symlink" 57 #define OP_RENAME_SRC "rename_src" 58 #define OP_RENAME_DEST "rename_dest" 59 #define OP_CHMOD "chmod" 60 #define OP_CHOWN "chown" 61 #define OP_GETATTR "getattr" 62 #define OP_OPEN "open" 63 64 #define OP_FRECEIVE "file_receive" 65 #define OP_FPERM "file_perm" 66 #define OP_FLOCK "file_lock" 67 #define OP_FMMAP "file_mmap" 68 #define OP_FMPROT "file_mprotect" 69 #define OP_INHERIT "file_inherit" 70 71 #define OP_PIVOTROOT "pivotroot" 72 #define OP_MOUNT "mount" 73 #define OP_UMOUNT "umount" 74 75 #define OP_CREATE "create" 76 #define OP_POST_CREATE "post_create" 77 #define OP_BIND "bind" 78 #define OP_CONNECT "connect" 79 #define OP_LISTEN "listen" 80 #define OP_ACCEPT "accept" 81 #define OP_SENDMSG "sendmsg" 82 #define OP_RECVMSG "recvmsg" 83 #define OP_GETSOCKNAME "getsockname" 84 #define OP_GETPEERNAME "getpeername" 85 #define OP_GETSOCKOPT "getsockopt" 86 #define OP_SETSOCKOPT "setsockopt" 87 #define OP_SHUTDOWN "socket_shutdown" 88 89 #define OP_PTRACE "ptrace" 90 #define OP_SIGNAL "signal" 91 92 #define OP_EXEC "exec" 93 94 #define OP_CHANGE_HAT "change_hat" 95 #define OP_CHANGE_PROFILE "change_profile" 96 #define OP_CHANGE_ONEXEC "change_onexec" 97 #define OP_STACK "stack" 98 #define OP_STACK_ONEXEC "stack_onexec" 99 100 #define OP_SETPROCATTR "setprocattr" 101 #define OP_SETRLIMIT "setrlimit" 102 103 #define OP_PROF_REPL "profile_replace" 104 #define OP_PROF_LOAD "profile_load" 105 #define OP_PROF_RM "profile_remove" 106 107 #define OP_USERNS_CREATE "userns_create" 108 109 #define OP_URING_OVERRIDE "uring_override" 110 #define OP_URING_SQPOLL "uring_sqpoll" 111 112 struct apparmor_audit_data { 113 int error; 114 int type; 115 u16 class; 116 const char *op; 117 const struct cred *subj_cred; 118 struct aa_label *subj_label; 119 const char *name; 120 const char *info; 121 u32 request; 122 u32 denied; 123 u32 tags; 124 125 union { 126 /* these entries require a custom callback fn */ 127 struct { 128 struct aa_label *peer; 129 union { 130 struct { 131 const char *target; 132 kuid_t ouid; 133 } fs; 134 struct { 135 int rlim; 136 unsigned long max; 137 } rlim; 138 struct { 139 int signal; 140 int unmappedsig; 141 }; 142 struct { 143 int type, protocol; 144 void *addr; 145 int addrlen; 146 struct { 147 void *addr; 148 int addrlen; 149 } peer; 150 } net; 151 }; 152 }; 153 struct { 154 struct aa_profile *profile; 155 const char *ns; 156 long pos; 157 } iface; 158 struct { 159 const char *src_name; 160 const char *type; 161 const char *trans; 162 const char *data; 163 unsigned long flags; 164 } mnt; 165 struct { 166 struct aa_label *target; 167 } uring; 168 }; 169 170 struct common_audit_data common; 171 }; 172 173 /* macros for dealing with apparmor_audit_data structure */ 174 #define aad(SA) (container_of(SA, struct apparmor_audit_data, common)) 175 #define aad_of_va(VA) aad((struct common_audit_data *)(VA)) 176 177 #define DEFINE_AUDIT_DATA(NAME, T, C, X) \ 178 /* TODO: cleanup audit init so we don't need _aad = {0,} */ \ 179 struct apparmor_audit_data NAME = { \ 180 .class = (C), \ 181 .op = (X), \ 182 .common.type = (T), \ 183 .common.u.tsk = NULL, \ 184 .common.apparmor_audit_data = &NAME, \ 185 }; 186 187 int aa_select_audit_type(u32 denied, const struct aa_perms *perms); 188 189 void aa_audit_msg(int type, struct apparmor_audit_data *ad, 190 void (*cb) (struct audit_buffer *, void *)); 191 int aa_audit(int type, struct aa_profile *profile, 192 struct apparmor_audit_data *ad, 193 void (*cb) (struct audit_buffer *, void *)); 194 195 #define aa_audit_error(ERROR, AD, CB) \ 196 ({ \ 197 (AD)->error = (ERROR); \ 198 aa_audit_msg(AUDIT_APPARMOR_ERROR, (AD), (CB)); \ 199 (AD)->error; \ 200 }) 201 202 int aa_audit_perm_error(struct aa_label *label, u32 request, int error, 203 struct apparmor_audit_data *ad, 204 void (*cb)(struct audit_buffer *, void *)); 205 206 static inline int complain_error(int error) 207 { 208 if (error == -EPERM || error == -EACCES) 209 return 0; 210 return error; 211 } 212 213 void aa_audit_rule_free(void *vrule); 214 int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule, gfp_t gfp); 215 int aa_audit_rule_known(struct audit_krule *rule); 216 int aa_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, void *vrule); 217 218 #endif /* __AA_AUDIT_H */ 219