Commit | Line | Data |
---|---|---|
fe7752ba DW |
1 | /* audit -- definition of audit_context structure and supporting types |
2 | * | |
3 | * Copyright 2003-2004 Red Hat, Inc. | |
4 | * Copyright 2005 Hewlett-Packard Development Company, L.P. | |
5 | * Copyright 2005 IBM Corporation | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or modify | |
8 | * it under the terms of the GNU General Public License as published by | |
9 | * the Free Software Foundation; either version 2 of the License, or | |
10 | * (at your option) any later version. | |
11 | * | |
12 | * This program is distributed in the hope that it will be useful, | |
13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
15 | * GNU General Public License for more details. | |
16 | * | |
17 | * You should have received a copy of the GNU General Public License | |
18 | * along with this program; if not, write to the Free Software | |
19 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA | |
20 | */ | |
21 | ||
22 | #include <linux/fs.h> | |
23 | #include <linux/audit.h> | |
9044e6bc | 24 | #include <linux/skbuff.h> |
fe7752ba DW |
25 | |
26 | /* 0 = no checking | |
27 | 1 = put_count checking | |
28 | 2 = verbose put_count checking | |
29 | */ | |
30 | #define AUDIT_DEBUG 0 | |
31 | ||
32 | /* At task start time, the audit_state is set in the audit_context using | |
33 | a per-task filter. At syscall entry, the audit_state is augmented by | |
34 | the syscall filter. */ | |
35 | enum audit_state { | |
36 | AUDIT_DISABLED, /* Do not create per-task audit_context. | |
37 | * No syscall-specific audit records can | |
38 | * be generated. */ | |
39 | AUDIT_SETUP_CONTEXT, /* Create the per-task audit_context, | |
40 | * but don't necessarily fill it in at | |
41 | * syscall entry time (i.e., filter | |
42 | * instead). */ | |
43 | AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context, | |
44 | * and always fill it in at syscall | |
45 | * entry time. This makes a full | |
46 | * syscall record available if some | |
47 | * other part of the kernel decides it | |
48 | * should be recorded. */ | |
49 | AUDIT_RECORD_CONTEXT /* Create the per-task audit_context, | |
50 | * always fill it in at syscall entry | |
51 | * time, and always write out the audit | |
52 | * record at syscall exit time. */ | |
53 | }; | |
54 | ||
55 | /* Rule lists */ | |
f368c07d AG |
56 | struct audit_parent; |
57 | ||
58 | struct audit_watch { | |
59 | atomic_t count; /* reference count */ | |
60 | char *path; /* insertion path */ | |
61 | dev_t dev; /* associated superblock device */ | |
62 | unsigned long ino; /* associated inode number */ | |
63 | struct audit_parent *parent; /* associated parent */ | |
64 | struct list_head wlist; /* entry in parent->watches list */ | |
65 | struct list_head rules; /* associated rules */ | |
66 | }; | |
67 | ||
93315ed6 | 68 | struct audit_field { |
3dc7e315 DG |
69 | u32 type; |
70 | u32 val; | |
71 | u32 op; | |
72 | char *se_str; | |
73 | struct selinux_audit_rule *se_rule; | |
93315ed6 AG |
74 | }; |
75 | ||
74c3cbe3 AV |
76 | struct audit_tree; |
77 | struct audit_chunk; | |
78 | ||
93315ed6 AG |
79 | struct audit_krule { |
80 | int vers_ops; | |
81 | u32 flags; | |
82 | u32 listnr; | |
83 | u32 action; | |
84 | u32 mask[AUDIT_BITMASK_SIZE]; | |
85 | u32 buflen; /* for data alloc on list rules */ | |
86 | u32 field_count; | |
5adc8a6a | 87 | char *filterkey; /* ties events to rules */ |
93315ed6 | 88 | struct audit_field *fields; |
e54dc243 | 89 | struct audit_field *arch_f; /* quick access to arch field */ |
f368c07d AG |
90 | struct audit_field *inode_f; /* quick access to an inode field */ |
91 | struct audit_watch *watch; /* associated watch */ | |
74c3cbe3 AV |
92 | struct audit_tree *tree; /* associated watched tree */ |
93 | struct list_head rlist; /* entry in audit_{watch,tree}.rules list */ | |
93315ed6 AG |
94 | }; |
95 | ||
fe7752ba | 96 | struct audit_entry { |
93315ed6 AG |
97 | struct list_head list; |
98 | struct rcu_head rcu; | |
99 | struct audit_krule rule; | |
fe7752ba DW |
100 | }; |
101 | ||
fe7752ba | 102 | extern int audit_pid; |
fe7752ba | 103 | |
f368c07d AG |
104 | #define AUDIT_INODE_BUCKETS 32 |
105 | extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; | |
106 | ||
107 | static inline int audit_hash_ino(u32 ino) | |
108 | { | |
109 | return (ino & (AUDIT_INODE_BUCKETS-1)); | |
110 | } | |
111 | ||
55669bfa | 112 | extern int audit_match_class(int class, unsigned syscall); |
f368c07d | 113 | extern int audit_comparator(const u32 left, const u32 op, const u32 right); |
9c937dcc AG |
114 | extern int audit_compare_dname_path(const char *dname, const char *path, |
115 | int *dirlen); | |
9044e6bc AV |
116 | extern struct sk_buff * audit_make_reply(int pid, int seq, int type, |
117 | int done, int multi, | |
118 | void *payload, int size); | |
fe7752ba DW |
119 | extern void audit_send_reply(int pid, int seq, int type, |
120 | int done, int multi, | |
121 | void *payload, int size); | |
fe7752ba | 122 | extern void audit_panic(const char *message); |
3dc7e315 | 123 | |
9044e6bc AV |
124 | struct audit_netlink_list { |
125 | int pid; | |
126 | struct sk_buff_head q; | |
127 | }; | |
128 | ||
129 | int audit_send_list(void *); | |
130 | ||
f368c07d AG |
131 | struct inotify_watch; |
132 | extern void audit_free_parent(struct inotify_watch *); | |
133 | extern void audit_handle_ievent(struct inotify_watch *, u32, u32, u32, | |
134 | const char *, struct inode *); | |
3dc7e315 | 135 | extern int selinux_audit_rule_update(void); |
e1396065 | 136 | |
74c3cbe3 AV |
137 | extern struct mutex audit_filter_mutex; |
138 | extern void audit_free_rule_rcu(struct rcu_head *); | |
139 | ||
140 | #ifdef CONFIG_AUDIT_TREE | |
141 | extern struct audit_chunk *audit_tree_lookup(const struct inode *); | |
142 | extern void audit_put_chunk(struct audit_chunk *); | |
143 | extern int audit_tree_match(struct audit_chunk *, struct audit_tree *); | |
144 | extern int audit_make_tree(struct audit_krule *, char *, u32); | |
145 | extern int audit_add_tree_rule(struct audit_krule *); | |
146 | extern int audit_remove_tree_rule(struct audit_krule *); | |
147 | extern void audit_trim_trees(void); | |
148 | extern int audit_tag_tree(char *old, char *new); | |
149 | extern void audit_schedule_prune(void); | |
150 | extern void audit_prune_trees(void); | |
151 | extern const char *audit_tree_path(struct audit_tree *); | |
152 | extern void audit_put_tree(struct audit_tree *); | |
153 | #else | |
154 | #define audit_remove_tree_rule(rule) BUG() | |
155 | #define audit_add_tree_rule(rule) -EINVAL | |
156 | #define audit_make_tree(rule, str, op) -EINVAL | |
157 | #define audit_trim_trees() (void)0 | |
158 | #define audit_put_tree(tree) (void)0 | |
159 | #define audit_tag_tree(old, new) -EINVAL | |
160 | #define audit_tree_path(rule) "" /* never called */ | |
161 | #endif | |
162 | ||
163 | extern char *audit_unpack_string(void **, size_t *, size_t); | |
164 | ||
e1396065 | 165 | #ifdef CONFIG_AUDITSYSCALL |
e54dc243 AG |
166 | extern int __audit_signal_info(int sig, struct task_struct *t); |
167 | static inline int audit_signal_info(int sig, struct task_struct *t) | |
e1396065 | 168 | { |
e54dc243 AG |
169 | if (unlikely((audit_pid && t->tgid == audit_pid) || |
170 | (audit_signals && !audit_dummy_context()))) | |
171 | return __audit_signal_info(sig, t); | |
172 | return 0; | |
e1396065 | 173 | } |
f368c07d AG |
174 | extern enum audit_state audit_filter_inodes(struct task_struct *, |
175 | struct audit_context *); | |
176 | extern void audit_set_auditable(struct audit_context *); | |
e1396065 | 177 | #else |
e54dc243 | 178 | #define audit_signal_info(s,t) AUDIT_DISABLED |
f368c07d AG |
179 | #define audit_filter_inodes(t,c) AUDIT_DISABLED |
180 | #define audit_set_auditable(c) | |
e1396065 | 181 | #endif |