[deliverable/linux.git] / include / linux / audit.h

/* audit.h -- Auditing support
 *
 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
 * All Rights Reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
 *
 */
#ifndef _LINUX_AUDIT_H_
#define _LINUX_AUDIT_H_

#include <linux/sched.h>
#include <linux/ptrace.h>
#include <uapi/linux/audit.h>

#define AUDIT_INO_UNSET ((unsigned long)-1)
#define AUDIT_DEV_UNSET ((dev_t)-1)

struct audit_sig_info {
	uid_t		uid;
	pid_t		pid;
	char		ctx[0];
};

struct audit_buffer;
struct audit_context;
struct inode;
struct netlink_skb_parms;
struct path;
struct linux_binprm;
struct mq_attr;
struct mqstat;
struct audit_watch;
struct audit_tree;
struct sk_buff;

struct audit_krule {
	u32			pflags;
	u32			flags;
	u32			listnr;
	u32			action;
	u32			mask[AUDIT_BITMASK_SIZE];
	u32			buflen; /* for data alloc on list rules */
	u32			field_count;
	char			*filterkey; /* ties events to rules */
	struct audit_field	*fields;
	struct audit_field	*arch_f; /* quick access to arch field */
	struct audit_field	*inode_f; /* quick access to an inode field */
	struct audit_watch	*watch;	/* associated watch */
	struct audit_tree	*tree;	/* associated watched tree */
	struct audit_fsnotify_mark	*exe;
	struct list_head	rlist;	/* entry in audit_{watch,tree}.rules list */
	struct list_head	list;	/* for AUDIT_LIST* purposes only */
	u64			prio;
};

/* Flag to indicate legacy AUDIT_LOGINUID unset usage */
#define AUDIT_LOGINUID_LEGACY		0x1

struct audit_field {
	u32				type;
	union {
		u32			val;
		kuid_t			uid;
		kgid_t			gid;
		struct {
			char		*lsm_str;
			void		*lsm_rule;
		};
	};
	u32				op;
};

extern int is_audit_feature_set(int which);

extern int __init audit_register_class(int class, unsigned *list);
extern int audit_classify_syscall(int abi, unsigned syscall);
extern int audit_classify_arch(int arch);
/* only for compat system calls */
extern unsigned compat_write_class[];
extern unsigned compat_read_class[];
extern unsigned compat_dir_class[];
extern unsigned compat_chattr_class[];
extern unsigned compat_signal_class[];

extern int audit_classify_compat_syscall(int abi, unsigned syscall);

/* audit_names->type values */
#define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */
#define	AUDIT_TYPE_NORMAL	1	/* a "normal" audit record */
#define	AUDIT_TYPE_PARENT	2	/* a parent audit record */
#define	AUDIT_TYPE_CHILD_DELETE 3	/* a child being deleted */
#define	AUDIT_TYPE_CHILD_CREATE 4	/* a child being created */

/* maximized args number that audit_socketcall can process */
#define AUDITSC_ARGS		6

struct filename;

extern void audit_log_session_info(struct audit_buffer *ab);

#ifdef CONFIG_AUDIT
/* These are defined in audit.c */
				/* Public API */
extern __printf(4, 5)
void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
	       const char *fmt, ...);

extern struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type);
extern __printf(2, 3)
void audit_log_format(struct audit_buffer *ab, const char *fmt, ...);
extern void		    audit_log_end(struct audit_buffer *ab);
extern bool		    audit_string_contains_control(const char *string,
							  size_t len);
extern void		    audit_log_n_hex(struct audit_buffer *ab,
					  const unsigned char *buf,
					  size_t len);
extern void		    audit_log_n_string(struct audit_buffer *ab,
					       const char *buf,
					       size_t n);
extern void		    audit_log_n_untrustedstring(struct audit_buffer *ab,
							const char *string,
							size_t n);
extern void		    audit_log_untrustedstring(struct audit_buffer *ab,
						      const char *string);
extern void		    audit_log_d_path(struct audit_buffer *ab,
					     const char *prefix,
					     const struct path *path);
extern void		    audit_log_key(struct audit_buffer *ab,
					  char *key);
extern void		    audit_log_link_denied(const char *operation,
						  struct path *link);
extern void		    audit_log_lost(const char *message);
#ifdef CONFIG_SECURITY
extern void 		    audit_log_secctx(struct audit_buffer *ab, u32 secid);
#else
static inline void	    audit_log_secctx(struct audit_buffer *ab, u32 secid)
{ }
#endif

extern int audit_log_task_context(struct audit_buffer *ab);
extern void audit_log_task_info(struct audit_buffer *ab,
				struct task_struct *tsk);

extern int		    audit_update_lsm_rules(void);

				/* Private API (for audit.c only) */
extern int audit_filter_user(int type);
extern int audit_filter_type(int type);
extern int audit_rule_change(int type, __u32 portid, int seq,
				void *data, size_t datasz);
extern int audit_list_rules_send(struct sk_buff *request_skb, int seq);

extern u32 audit_enabled;
#else /* CONFIG_AUDIT */
static inline __printf(4, 5)
void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
	       const char *fmt, ...)
{ }
static inline struct audit_buffer *audit_log_start(struct audit_context *ctx,
						   gfp_t gfp_mask, int type)
{
	return NULL;
}
static inline __printf(2, 3)
void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
{ }
static inline void audit_log_end(struct audit_buffer *ab)
{ }
static inline void audit_log_n_hex(struct audit_buffer *ab,
				   const unsigned char *buf, size_t len)
{ }
static inline void audit_log_n_string(struct audit_buffer *ab,
				      const char *buf, size_t n)
{ }
static inline void  audit_log_n_untrustedstring(struct audit_buffer *ab,
						const char *string, size_t n)
{ }
static inline void audit_log_untrustedstring(struct audit_buffer *ab,
					     const char *string)
{ }
static inline void audit_log_d_path(struct audit_buffer *ab,
				    const char *prefix,
				    const struct path *path)
{ }
static inline void audit_log_key(struct audit_buffer *ab, char *key)
{ }
static inline void audit_log_link_denied(const char *string,
					 const struct path *link)
{ }
static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid)
{ }
static inline int audit_log_task_context(struct audit_buffer *ab)
{
	return 0;
}
static inline void audit_log_task_info(struct audit_buffer *ab,
				       struct task_struct *tsk)
{ }
#define audit_enabled 0
#endif /* CONFIG_AUDIT */

#ifdef CONFIG_AUDIT_COMPAT_GENERIC
#define audit_is_compat(arch)  (!((arch) & __AUDIT_ARCH_64BIT))
#else
#define audit_is_compat(arch)  false
#endif

#ifdef CONFIG_AUDITSYSCALL
#include <asm/syscall.h> /* for syscall_get_arch() */

/* These are defined in auditsc.c */
				/* Public API */
extern int  audit_alloc(struct task_struct *task);
extern void __audit_free(struct task_struct *task);
extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
				  unsigned long a2, unsigned long a3);
extern void __audit_syscall_exit(int ret_success, long ret_value);
extern struct filename *__audit_reusename(const __user char *uptr);
extern void __audit_getname(struct filename *name);

#define AUDIT_INODE_PARENT	1	/* dentry represents the parent */
#define AUDIT_INODE_HIDDEN	2	/* audit record should be hidden */
extern void __audit_inode(struct filename *name, const struct dentry *dentry,
				unsigned int flags);
extern void __audit_file(const struct file *);
extern void __audit_inode_child(struct inode *parent,
				const struct dentry *dentry,
				const unsigned char type);
extern void __audit_seccomp(unsigned long syscall, long signr, int code);
extern void __audit_ptrace(struct task_struct *t);

static inline bool audit_dummy_context(void)
{
	void *p = current->audit_context;
	return !p || *(int *)p;
}
static inline void audit_free(struct task_struct *task)
{
	if (unlikely(task->audit_context))
		__audit_free(task);
}
static inline void audit_syscall_entry(int major, unsigned long a0,
				       unsigned long a1, unsigned long a2,
				       unsigned long a3)
{
	if (unlikely(current->audit_context))
		__audit_syscall_entry(major, a0, a1, a2, a3);
}
static inline void audit_syscall_exit(void *pt_regs)
{
	if (unlikely(current->audit_context)) {
		int success = is_syscall_success(pt_regs);
		long return_code = regs_return_value(pt_regs);

		__audit_syscall_exit(success, return_code);
	}
}
static inline struct filename *audit_reusename(const __user char *name)
{
	if (unlikely(!audit_dummy_context()))
		return __audit_reusename(name);
	return NULL;
}
static inline void audit_getname(struct filename *name)
{
	if (unlikely(!audit_dummy_context()))
		__audit_getname(name);
}
static inline void audit_inode(struct filename *name,
				const struct dentry *dentry,
				unsigned int parent) {
	if (unlikely(!audit_dummy_context())) {
		unsigned int flags = 0;
		if (parent)
			flags |= AUDIT_INODE_PARENT;
		__audit_inode(name, dentry, flags);
	}
}
static inline void audit_file(struct file *file)
{
	if (unlikely(!audit_dummy_context()))
		__audit_file(file);
}
static inline void audit_inode_parent_hidden(struct filename *name,
						const struct dentry *dentry)
{
	if (unlikely(!audit_dummy_context()))
		__audit_inode(name, dentry,
				AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN);
}
static inline void audit_inode_child(struct inode *parent,
				     const struct dentry *dentry,
				     const unsigned char type) {
	if (unlikely(!audit_dummy_context()))
		__audit_inode_child(parent, dentry, type);
}
void audit_core_dumps(long signr);

static inline void audit_seccomp(unsigned long syscall, long signr, int code)
{
	if (!audit_enabled)
		return;

	/* Force a record to be reported if a signal was delivered. */
	if (signr || unlikely(!audit_dummy_context()))
		__audit_seccomp(syscall, signr, code);
}

static inline void audit_ptrace(struct task_struct *t)
{
	if (unlikely(!audit_dummy_context()))
		__audit_ptrace(t);
}

				/* Private API (for audit.c only) */
extern unsigned int audit_serial(void);
extern int auditsc_get_stamp(struct audit_context *ctx,
			      struct timespec *t, unsigned int *serial);
extern int audit_set_loginuid(kuid_t loginuid);

static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
{
	return tsk->loginuid;
}

static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
{
	return tsk->sessionid;
}

extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);
extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode);
extern void __audit_bprm(struct linux_binprm *bprm);
extern int __audit_socketcall(int nargs, unsigned long *args);
extern int __audit_sockaddr(int len, void *addr);
extern void __audit_fd_pair(int fd1, int fd2);
extern void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr);
extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout);
extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification);
extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat);
extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
				  const struct cred *new,
				  const struct cred *old);
extern void __audit_log_capset(const struct cred *new, const struct cred *old);
extern void __audit_mmap_fd(int fd, int flags);

static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
{
	if (unlikely(!audit_dummy_context()))
		__audit_ipc_obj(ipcp);
}
static inline void audit_fd_pair(int fd1, int fd2)
{
	if (unlikely(!audit_dummy_context()))
		__audit_fd_pair(fd1, fd2);
}
static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode)
{
	if (unlikely(!audit_dummy_context()))
		__audit_ipc_set_perm(qbytes, uid, gid, mode);
}
static inline void audit_bprm(struct linux_binprm *bprm)
{
	if (unlikely(!audit_dummy_context()))
		__audit_bprm(bprm);
}
static inline int audit_socketcall(int nargs, unsigned long *args)
{
	if (unlikely(!audit_dummy_context()))
		return __audit_socketcall(nargs, args);
	return 0;
}
static inline int audit_sockaddr(int len, void *addr)
{
	if (unlikely(!audit_dummy_context()))
		return __audit_sockaddr(len, addr);
	return 0;
}
static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
{
	if (unlikely(!audit_dummy_context()))
		__audit_mq_open(oflag, mode, attr);
}
static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout)
{
	if (unlikely(!audit_dummy_context()))
		__audit_mq_sendrecv(mqdes, msg_len, msg_prio, abs_timeout);
}
static inline void audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
{
	if (unlikely(!audit_dummy_context()))
		__audit_mq_notify(mqdes, notification);
}
static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
{
	if (unlikely(!audit_dummy_context()))
		__audit_mq_getsetattr(mqdes, mqstat);
}

static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
				       const struct cred *new,
				       const struct cred *old)
{
	if (unlikely(!audit_dummy_context()))
		return __audit_log_bprm_fcaps(bprm, new, old);
	return 0;
}

static inline void audit_log_capset(const struct cred *new,
				   const struct cred *old)
{
	if (unlikely(!audit_dummy_context()))
		__audit_log_capset(new, old);
}

static inline void audit_mmap_fd(int fd, int flags)
{
	if (unlikely(!audit_dummy_context()))
		__audit_mmap_fd(fd, flags);
}

extern int audit_n_rules;
extern int audit_signals;
#else /* CONFIG_AUDITSYSCALL */
static inline int audit_alloc(struct task_struct *task)
{
	return 0;
}
static inline void audit_free(struct task_struct *task)
{ }
static inline void audit_syscall_entry(int major, unsigned long a0,
				       unsigned long a1, unsigned long a2,
				       unsigned long a3)
{ }
static inline void audit_syscall_exit(void *pt_regs)
{ }
static inline bool audit_dummy_context(void)
{
	return true;
}
static inline struct filename *audit_reusename(const __user char *name)
{
	return NULL;
}
static inline void audit_getname(struct filename *name)
{ }
static inline void __audit_inode(struct filename *name,
					const struct dentry *dentry,
					unsigned int flags)
{ }
static inline void __audit_inode_child(struct inode *parent,
					const struct dentry *dentry,
					const unsigned char type)
{ }
static inline void audit_inode(struct filename *name,
				const struct dentry *dentry,
				unsigned int parent)
{ }
static inline void audit_file(struct file *file)
{
}
static inline void audit_inode_parent_hidden(struct filename *name,
				const struct dentry *dentry)
{ }
static inline void audit_inode_child(struct inode *parent,
				     const struct dentry *dentry,
				     const unsigned char type)
{ }
static inline void audit_core_dumps(long signr)
{ }
static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
{ }
static inline void audit_seccomp(unsigned long syscall, long signr, int code)
{ }
static inline int auditsc_get_stamp(struct audit_context *ctx,
			      struct timespec *t, unsigned int *serial)
{
	return 0;
}
static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
{
	return INVALID_UID;
}
static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
{
	return -1;
}
static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
{ }
static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,
					gid_t gid, umode_t mode)
{ }
static inline void audit_bprm(struct linux_binprm *bprm)
{ }
static inline int audit_socketcall(int nargs, unsigned long *args)
{
	return 0;
}
static inline void audit_fd_pair(int fd1, int fd2)
{ }
static inline int audit_sockaddr(int len, void *addr)
{
	return 0;
}
static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
{ }
static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len,
				     unsigned int msg_prio,
				     const struct timespec *abs_timeout)
{ }
static inline void audit_mq_notify(mqd_t mqdes,
				   const struct sigevent *notification)
{ }
static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
{ }
static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
				       const struct cred *new,
				       const struct cred *old)
{
	return 0;
}
static inline void audit_log_capset(const struct cred *new,
				    const struct cred *old)
{ }
static inline void audit_mmap_fd(int fd, int flags)
{ }
static inline void audit_ptrace(struct task_struct *t)
{ }
#define audit_n_rules 0
#define audit_signals 0
#endif /* CONFIG_AUDITSYSCALL */

static inline bool audit_loginuid_set(struct task_struct *tsk)
{
	return uid_valid(audit_get_loginuid(tsk));
}

static inline void audit_log_string(struct audit_buffer *ab, const char *buf)
{
	audit_log_n_string(ab, buf, strlen(buf));
}

#endif
Commit	Line	Data
85c8721f	1	/* audit.h -- Auditing support
1da177e4 LT	2	*
	3	* Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
	4	* All Rights Reserved.
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License as published by
	8	* the Free Software Foundation; either version 2 of the License, or
	9	* (at your option) any later version.
	10	*
	11	* This program is distributed in the hope that it will be useful,
	12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	14	* GNU General Public License for more details.
	15	*
	16	* You should have received a copy of the GNU General Public License
	17	* along with this program; if not, write to the Free Software
	18	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	19	*
	20	* Written by Rickard E. (Rik) Faith <faith@redhat.com>
	21	*
	22	*/
1da177e4 LT	23	#ifndef _LINUX_AUDIT_H_
	24	#define _LINUX_AUDIT_H_
	25
f001e47f	26	#include <linux/sched.h>
c0a3a20b	27	#include <linux/ptrace.h>
607ca46e	28	#include <uapi/linux/audit.h>
1da177e4	29
84cb777e RGB	30	#define AUDIT_INO_UNSET ((unsigned long)-1)
	31	#define AUDIT_DEV_UNSET ((dev_t)-1)
	32
c2f0c7c3 SG	33	struct audit_sig_info {
	34	uid_t uid;
	35	pid_t pid;
e1396065	36	char ctx[0];
c2f0c7c3 SG	37	};
c2f0c7c3 SG	38
1da177e4 LT	39	struct audit_buffer;
	40	struct audit_context;
	41	struct inode;
5bb289b5	42	struct netlink_skb_parms;
37721e1b	43	struct path;
473ae30b	44	struct linux_binprm;
20ca73bc GW	45	struct mq_attr;
20ca73bc GW	46	struct mqstat;
9d57a7f9 AD	47	struct audit_watch;
9d57a7f9 AD	48	struct audit_tree;
099dd235	49	struct sk_buff;
9d57a7f9 AD	50
9d57a7f9 AD	51	struct audit_krule {
041d7b98	52	u32 pflags;
9d57a7f9 AD	53	u32 flags;
	54	u32 listnr;
	55	u32 action;
	56	u32 mask[AUDIT_BITMASK_SIZE];
	57	u32 buflen; /* for data alloc on list rules */
	58	u32 field_count;
	59	char filterkey; / ties events to rules */
	60	struct audit_field *fields;
	61	struct audit_field arch_f; / quick access to arch field */
	62	struct audit_field inode_f; / quick access to an inode field */
	63	struct audit_watch watch; / associated watch */
	64	struct audit_tree tree; / associated watched tree */
34d99af5	65	struct audit_fsnotify_mark *exe;
9d57a7f9	66	struct list_head rlist; /* entry in audit_{watch,tree}.rules list */
e45aa212	67	struct list_head list; /* for AUDIT_LIST* purposes only */
0590b933	68	u64 prio;
9d57a7f9 AD	69	};
9d57a7f9 AD	70
041d7b98 RGB	71	/* Flag to indicate legacy AUDIT_LOGINUID unset usage */
	72	#define AUDIT_LOGINUID_LEGACY 0x1
	73
9d57a7f9 AD	74	struct audit_field {
9d57a7f9 AD	75	u32 type;
219ca394 RGB	76	union {
	77	u32 val;
	78	kuid_t uid;
	79	kgid_t gid;
	80	struct {
	81	char *lsm_str;
	82	void *lsm_rule;
	83	};
	84	};
9d57a7f9	85	u32 op;
9d57a7f9	86	};
1da177e4	87
b0fed402 EP	88	extern int is_audit_feature_set(int which);
b0fed402 EP	89
b915543b	90	extern int __init audit_register_class(int class, unsigned *list);
55669bfa	91	extern int audit_classify_syscall(int abi, unsigned syscall);
e54dc243	92	extern int audit_classify_arch(int arch);
4b588411 AT	93	/* only for compat system calls */
	94	extern unsigned compat_write_class[];
	95	extern unsigned compat_read_class[];
	96	extern unsigned compat_dir_class[];
	97	extern unsigned compat_chattr_class[];
	98	extern unsigned compat_signal_class[];
	99
9e8beeb7	100	extern int audit_classify_compat_syscall(int abi, unsigned syscall);
78e2e802 JL	101
	102	/* audit_names->type values */
	103	#define AUDIT_TYPE_UNKNOWN 0 /* we don't know yet */
	104	#define AUDIT_TYPE_NORMAL 1 /* a "normal" audit record */
bfcec708	105	#define AUDIT_TYPE_PARENT 2 /* a parent audit record */
4fa6b5ec JL	106	#define AUDIT_TYPE_CHILD_DELETE 3 /* a child being deleted */
4fa6b5ec JL	107	#define AUDIT_TYPE_CHILD_CREATE 4 /* a child being created */
78e2e802	108
2950fa9d CG	109	/* maximized args number that audit_socketcall can process */
	110	#define AUDITSC_ARGS 6
	111
91a27b2a JL	112	struct filename;
91a27b2a JL	113
4d3fb709 EP	114	extern void audit_log_session_info(struct audit_buffer *ab);
4d3fb709 EP	115
96368701 PM	116	#ifdef CONFIG_AUDIT
	117	/* These are defined in audit.c */
	118	/* Public API */
	119	extern __printf(4, 5)
	120	void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
	121	const char *fmt, ...);
	122
	123	extern struct audit_buffer audit_log_start(struct audit_context ctx, gfp_t gfp_mask, int type);
	124	extern __printf(2, 3)
	125	void audit_log_format(struct audit_buffer ab, const char fmt, ...);
	126	extern void audit_log_end(struct audit_buffer *ab);
	127	extern bool audit_string_contains_control(const char *string,
	128	size_t len);
	129	extern void audit_log_n_hex(struct audit_buffer *ab,
	130	const unsigned char *buf,
	131	size_t len);
	132	extern void audit_log_n_string(struct audit_buffer *ab,
	133	const char *buf,
	134	size_t n);
	135	extern void audit_log_n_untrustedstring(struct audit_buffer *ab,
	136	const char *string,
	137	size_t n);
	138	extern void audit_log_untrustedstring(struct audit_buffer *ab,
	139	const char *string);
	140	extern void audit_log_d_path(struct audit_buffer *ab,
	141	const char *prefix,
	142	const struct path *path);
	143	extern void audit_log_key(struct audit_buffer *ab,
	144	char *key);
	145	extern void audit_log_link_denied(const char *operation,
	146	struct path *link);
	147	extern void audit_log_lost(const char *message);
	148	#ifdef CONFIG_SECURITY
	149	extern void audit_log_secctx(struct audit_buffer *ab, u32 secid);
	150	#else
	151	static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid)
	152	{ }
	153	#endif
	154
	155	extern int audit_log_task_context(struct audit_buffer *ab);
	156	extern void audit_log_task_info(struct audit_buffer *ab,
	157	struct task_struct *tsk);
	158
	159	extern int audit_update_lsm_rules(void);
	160
	161	/* Private API (for audit.c only) */
	162	extern int audit_filter_user(int type);
	163	extern int audit_filter_type(int type);
	164	extern int audit_rule_change(int type, __u32 portid, int seq,
	165	void *data, size_t datasz);
	166	extern int audit_list_rules_send(struct sk_buff *request_skb, int seq);
	167
	168	extern u32 audit_enabled;
	169	#else /* CONFIG_AUDIT */
	170	static inline __printf(4, 5)
	171	void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
	172	const char *fmt, ...)
	173	{ }
	174	static inline struct audit_buffer audit_log_start(struct audit_context ctx,
	175	gfp_t gfp_mask, int type)
	176	{
	177	return NULL;
	178	}
	179	static inline __printf(2, 3)
180	void audit_log_format(struct audit_buffer ab, const char fmt, ...)
181	{ }
182	static inline void audit_log_end(struct audit_buffer *ab)
183	{ }
184	static inline void audit_log_n_hex(struct audit_buffer *ab,
185	const unsigned char *buf, size_t len)
186	{ }
187	static inline void audit_log_n_string(struct audit_buffer *ab,
188	const char *buf, size_t n)
189	{ }
190	static inline void audit_log_n_untrustedstring(struct audit_buffer *ab,
191	const char *string, size_t n)
192	{ }
193	static inline void audit_log_untrustedstring(struct audit_buffer *ab,
194	const char *string)
195	{ }
196	static inline void audit_log_d_path(struct audit_buffer *ab,
197	const char *prefix,
198	const struct path *path)
199	{ }
200	static inline void audit_log_key(struct audit_buffer ab, char key)
201	{ }
202	static inline void audit_log_link_denied(const char *string,
203	const struct path *link)
204	{ }
205	static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid)
206	{ }
207	static inline int audit_log_task_context(struct audit_buffer *ab)
208	{
209	return 0;
210	}
211	static inline void audit_log_task_info(struct audit_buffer *ab,
212	struct task_struct *tsk)
213	{ }
214	#define audit_enabled 0
215	#endif /* CONFIG_AUDIT */
216
312103d6	217	#ifdef CONFIG_AUDIT_COMPAT_GENERIC
356750e3 EP	218	#define audit_is_compat(arch) (!((arch) & __AUDIT_ARCH_64BIT))
	219	#else
	220	#define audit_is_compat(arch) false
	221	#endif
	222
1da177e4	223	#ifdef CONFIG_AUDITSYSCALL
a9ebe0b9 EP	224	#include <asm/syscall.h> /* for syscall_get_arch() */
a9ebe0b9 EP	225
1da177e4 LT	226	/* These are defined in auditsc.c */
	227	/* Public API */
	228	extern int audit_alloc(struct task_struct *task);
a4ff8dba	229	extern void __audit_free(struct task_struct *task);
b4f0d375	230	extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
b05d8447	231	unsigned long a2, unsigned long a3);
d7e7528b	232	extern void __audit_syscall_exit(int ret_success, long ret_value);
7ac86265	233	extern struct filename __audit_reusename(const __user char uptr);
91a27b2a	234	extern void __audit_getname(struct filename *name);
79f6530c JL	235
	236	#define AUDIT_INODE_PARENT 1 /* dentry represents the parent */
	237	#define AUDIT_INODE_HIDDEN 2 /* audit record should be hidden */
adb5c247	238	extern void __audit_inode(struct filename name, const struct dentry dentry,
79f6530c	239	unsigned int flags);
9f45f5bf	240	extern void __audit_file(const struct file *);
d6335d77	241	extern void __audit_inode_child(struct inode *parent,
4fa6b5ec JL	242	const struct dentry *dentry,
4fa6b5ec JL	243	const unsigned char type);
3dc1c1b2	244	extern void __audit_seccomp(unsigned long syscall, long signr, int code);
a5cb013d AV	245	extern void __audit_ptrace(struct task_struct *t);
a5cb013d AV	246
36734810	247	static inline bool audit_dummy_context(void)
d51374ad AV	248	{
	249	void *p = current->audit_context;
	250	return !p \|\| (int )p;
	251	}
a4ff8dba EP	252	static inline void audit_free(struct task_struct *task)
	253	{
	254	if (unlikely(task->audit_context))
	255	__audit_free(task);
	256	}
91397401	257	static inline void audit_syscall_entry(int major, unsigned long a0,
b05d8447 EP	258	unsigned long a1, unsigned long a2,
	259	unsigned long a3)
	260	{
cdee3904	261	if (unlikely(current->audit_context))
b4f0d375	262	__audit_syscall_entry(major, a0, a1, a2, a3);
b05d8447	263	}
d7e7528b EP	264	static inline void audit_syscall_exit(void *pt_regs)
	265	{
	266	if (unlikely(current->audit_context)) {
	267	int success = is_syscall_success(pt_regs);
06bdadd7	268	long return_code = regs_return_value(pt_regs);
d7e7528b EP	269
	270	__audit_syscall_exit(success, return_code);
	271	}
	272	}
7ac86265 JL	273	static inline struct filename audit_reusename(const __user char name)
	274	{
	275	if (unlikely(!audit_dummy_context()))
	276	return __audit_reusename(name);
	277	return NULL;
	278	}
91a27b2a	279	static inline void audit_getname(struct filename *name)
d8945bb5	280	{
5ac3a9c2	281	if (unlikely(!audit_dummy_context()))
d8945bb5 AV	282	__audit_getname(name);
d8945bb5 AV	283	}
79f6530c JL	284	static inline void audit_inode(struct filename *name,
79f6530c JL	285	const struct dentry *dentry,
bfcec708	286	unsigned int parent) {
79f6530c JL	287	if (unlikely(!audit_dummy_context())) {
	288	unsigned int flags = 0;
	289	if (parent)
	290	flags \|= AUDIT_INODE_PARENT;
	291	__audit_inode(name, dentry, flags);
	292	}
	293	}
9f45f5bf AV	294	static inline void audit_file(struct file *file)
	295	{
	296	if (unlikely(!audit_dummy_context()))
	297	__audit_file(file);
	298	}
79f6530c JL	299	static inline void audit_inode_parent_hidden(struct filename *name,
	300	const struct dentry *dentry)
	301	{
5ac3a9c2	302	if (unlikely(!audit_dummy_context()))
79f6530c JL	303	__audit_inode(name, dentry,
79f6530c JL	304	AUDIT_INODE_PARENT \| AUDIT_INODE_HIDDEN);
73241ccc	305	}
d6335d77	306	static inline void audit_inode_child(struct inode *parent,
4fa6b5ec JL	307	const struct dentry *dentry,
4fa6b5ec JL	308	const unsigned char type) {
5ac3a9c2	309	if (unlikely(!audit_dummy_context()))
4fa6b5ec	310	__audit_inode_child(parent, dentry, type);
73241ccc	311	}
0a4ff8c2	312	void audit_core_dumps(long signr);
1da177e4	313
3dc1c1b2	314	static inline void audit_seccomp(unsigned long syscall, long signr, int code)
85e7bac3	315	{
96368701 PM	316	if (!audit_enabled)
	317	return;
	318
7b9205bd KC	319	/* Force a record to be reported if a signal was delivered. */
7b9205bd KC	320	if (signr \|\| unlikely(!audit_dummy_context()))
3dc1c1b2	321	__audit_seccomp(syscall, signr, code);
85e7bac3 EP	322	}
85e7bac3 EP	323
a5cb013d AV	324	static inline void audit_ptrace(struct task_struct *t)
	325	{
	326	if (unlikely(!audit_dummy_context()))
	327	__audit_ptrace(t);
	328	}
	329
1da177e4	330	/* Private API (for audit.c only) */
bfb4496e	331	extern unsigned int audit_serial(void);
48887e63	332	extern int auditsc_get_stamp(struct audit_context *ctx,
bfb4496e	333	struct timespec t, unsigned int serial);
9321d526 KC	334	extern int audit_set_loginuid(kuid_t loginuid);
	335
	336	static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
	337	{
	338	return tsk->loginuid;
	339	}
	340
b6cfee4c	341	static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
9321d526 KC	342	{
	343	return tsk->sessionid;
	344	}
	345
a33e6751	346	extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);
2570ebbd	347	extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode);
d9cfea91	348	extern void __audit_bprm(struct linux_binprm *bprm);
2950fa9d	349	extern int __audit_socketcall(int nargs, unsigned long *args);
07c49417	350	extern int __audit_sockaddr(int len, void *addr);
157cf649	351	extern void __audit_fd_pair(int fd1, int fd2);
df0a4283	352	extern void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr);
c32c8af4	353	extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout);
20114f71	354	extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification);
7392906e	355	extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat);
d84f4f99 DH	356	extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
	357	const struct cred *new,
	358	const struct cred *old);
ca24a23e	359	extern void __audit_log_capset(const struct cred new, const struct cred old);
120a795d	360	extern void __audit_mmap_fd(int fd, int flags);
d8945bb5	361
a33e6751	362	static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
d8945bb5	363	{
5ac3a9c2	364	if (unlikely(!audit_dummy_context()))
a33e6751	365	__audit_ipc_obj(ipcp);
db349509	366	}
157cf649	367	static inline void audit_fd_pair(int fd1, int fd2)
d8945bb5	368	{
5ac3a9c2	369	if (unlikely(!audit_dummy_context()))
157cf649	370	__audit_fd_pair(fd1, fd2);
d8945bb5	371	}
2570ebbd	372	static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode)
20ca73bc	373	{
5ac3a9c2	374	if (unlikely(!audit_dummy_context()))
e816f370	375	__audit_ipc_set_perm(qbytes, uid, gid, mode);
20ca73bc	376	}
9410d228	377	static inline void audit_bprm(struct linux_binprm *bprm)
07c49417 EP	378	{
07c49417 EP	379	if (unlikely(!audit_dummy_context()))
d9cfea91	380	__audit_bprm(bprm);
07c49417	381	}
2950fa9d	382	static inline int audit_socketcall(int nargs, unsigned long *args)
07c49417 EP	383	{
07c49417 EP	384	if (unlikely(!audit_dummy_context()))
2950fa9d CG	385	return __audit_socketcall(nargs, args);
2950fa9d CG	386	return 0;
07c49417 EP	387	}
	388	static inline int audit_sockaddr(int len, void *addr)
	389	{
	390	if (unlikely(!audit_dummy_context()))
	391	return __audit_sockaddr(len, addr);
	392	return 0;
	393	}
df0a4283	394	static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
20ca73bc	395	{
5ac3a9c2	396	if (unlikely(!audit_dummy_context()))
564f6993	397	__audit_mq_open(oflag, mode, attr);
20ca73bc	398	}
c32c8af4	399	static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout)
20ca73bc	400	{
5ac3a9c2	401	if (unlikely(!audit_dummy_context()))
c32c8af4	402	__audit_mq_sendrecv(mqdes, msg_len, msg_prio, abs_timeout);
20ca73bc	403	}
20114f71	404	static inline void audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
20ca73bc	405	{
5ac3a9c2	406	if (unlikely(!audit_dummy_context()))
20114f71	407	__audit_mq_notify(mqdes, notification);
20ca73bc	408	}
7392906e	409	static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
20ca73bc	410	{
5ac3a9c2	411	if (unlikely(!audit_dummy_context()))
7392906e	412	__audit_mq_getsetattr(mqdes, mqstat);
20ca73bc	413	}
3fc689e9	414
d84f4f99 DH	415	static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
	416	const struct cred *new,
	417	const struct cred *old)
3fc689e9 EP	418	{
3fc689e9 EP	419	if (unlikely(!audit_dummy_context()))
d84f4f99 DH	420	return __audit_log_bprm_fcaps(bprm, new, old);
d84f4f99 DH	421	return 0;
3fc689e9 EP	422	}
3fc689e9 EP	423
ca24a23e	424	static inline void audit_log_capset(const struct cred *new,
d84f4f99	425	const struct cred *old)
e68b75a0 EP	426	{
e68b75a0 EP	427	if (unlikely(!audit_dummy_context()))
ca24a23e	428	__audit_log_capset(new, old);
e68b75a0 EP	429	}
e68b75a0 EP	430
120a795d AV	431	static inline void audit_mmap_fd(int fd, int flags)
	432	{
	433	if (unlikely(!audit_dummy_context()))
	434	__audit_mmap_fd(fd, flags);
	435	}
	436
471a5c7c	437	extern int audit_n_rules;
e54dc243	438	extern int audit_signals;
d7e7528b	439	#else /* CONFIG_AUDITSYSCALL */
9321d526 KC	440	static inline int audit_alloc(struct task_struct *task)
	441	{
	442	return 0;
	443	}
	444	static inline void audit_free(struct task_struct *task)
	445	{ }
91397401	446	static inline void audit_syscall_entry(int major, unsigned long a0,
9321d526 KC	447	unsigned long a1, unsigned long a2,
	448	unsigned long a3)
	449	{ }
	450	static inline void audit_syscall_exit(void *pt_regs)
	451	{ }
36734810	452	static inline bool audit_dummy_context(void)
9321d526	453	{
36734810	454	return true;
9321d526	455	}
7ac86265 JL	456	static inline struct filename audit_reusename(const __user char name)
	457	{
	458	return NULL;
	459	}
91a27b2a	460	static inline void audit_getname(struct filename *name)
9321d526	461	{ }
adb5c247 JL	462	static inline void __audit_inode(struct filename *name,
adb5c247 JL	463	const struct dentry *dentry,
79f6530c	464	unsigned int flags)
9321d526	465	{ }
d6335d77	466	static inline void __audit_inode_child(struct inode *parent,
4fa6b5ec JL	467	const struct dentry *dentry,
4fa6b5ec JL	468	const unsigned char type)
9321d526	469	{ }
adb5c247 JL	470	static inline void audit_inode(struct filename *name,
adb5c247 JL	471	const struct dentry *dentry,
bfcec708	472	unsigned int parent)
9321d526	473	{ }
9f45f5bf AV	474	static inline void audit_file(struct file *file)
	475	{
	476	}
79f6530c JL	477	static inline void audit_inode_parent_hidden(struct filename *name,
	478	const struct dentry *dentry)
	479	{ }
d6335d77	480	static inline void audit_inode_child(struct inode *parent,
4fa6b5ec JL	481	const struct dentry *dentry,
4fa6b5ec JL	482	const unsigned char type)
9321d526 KC	483	{ }
	484	static inline void audit_core_dumps(long signr)
	485	{ }
	486	static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
	487	{ }
	488	static inline void audit_seccomp(unsigned long syscall, long signr, int code)
	489	{ }
	490	static inline int auditsc_get_stamp(struct audit_context *ctx,
	491	struct timespec t, unsigned int serial)
	492	{
	493	return 0;
	494	}
	495	static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
	496	{
	497	return INVALID_UID;
	498	}
b6cfee4c	499	static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
9321d526 KC	500	{
	501	return -1;
	502	}
9321d526 KC	503	static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
	504	{ }
	505	static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,
	506	gid_t gid, umode_t mode)
	507	{ }
9410d228 RGB	508	static inline void audit_bprm(struct linux_binprm *bprm)
9410d228 RGB	509	{ }
2950fa9d CG	510	static inline int audit_socketcall(int nargs, unsigned long *args)
	511	{
	512	return 0;
	513	}
9321d526 KC	514	static inline void audit_fd_pair(int fd1, int fd2)
	515	{ }
	516	static inline int audit_sockaddr(int len, void *addr)
	517	{
	518	return 0;
	519	}
	520	static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
	521	{ }
	522	static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len,
	523	unsigned int msg_prio,
	524	const struct timespec *abs_timeout)
	525	{ }
	526	static inline void audit_mq_notify(mqd_t mqdes,
	527	const struct sigevent *notification)
	528	{ }
	529	static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
	530	{ }
	531	static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
	532	const struct cred *new,
	533	const struct cred *old)
	534	{
	535	return 0;
	536	}
ca24a23e EB	537	static inline void audit_log_capset(const struct cred *new,
ca24a23e EB	538	const struct cred *old)
9321d526 KC	539	{ }
	540	static inline void audit_mmap_fd(int fd, int flags)
	541	{ }
	542	static inline void audit_ptrace(struct task_struct *t)
	543	{ }
471a5c7c	544	#define audit_n_rules 0
e54dc243	545	#define audit_signals 0
d7e7528b	546	#endif /* CONFIG_AUDITSYSCALL */
1da177e4	547
780a7654 EB	548	static inline bool audit_loginuid_set(struct task_struct *tsk)
	549	{
	550	return uid_valid(audit_get_loginuid(tsk));
	551	}
	552
9321d526 KC	553	static inline void audit_log_string(struct audit_buffer ab, const char buf)
	554	{
	555	audit_log_n_string(ab, buf, strlen(buf));
	556	}
	557
1da177e4	558	#endif