Commit | Line | Data |
---|---|---|
fe7752ba DW |
1 | /* audit -- definition of audit_context structure and supporting types |
2 | * | |
3 | * Copyright 2003-2004 Red Hat, Inc. | |
4 | * Copyright 2005 Hewlett-Packard Development Company, L.P. | |
5 | * Copyright 2005 IBM Corporation | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or modify | |
8 | * it under the terms of the GNU General Public License as published by | |
9 | * the Free Software Foundation; either version 2 of the License, or | |
10 | * (at your option) any later version. | |
11 | * | |
12 | * This program is distributed in the hope that it will be useful, | |
13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
15 | * GNU General Public License for more details. | |
16 | * | |
17 | * You should have received a copy of the GNU General Public License | |
18 | * along with this program; if not, write to the Free Software | |
19 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA | |
20 | */ | |
21 | ||
22 | #include <linux/fs.h> | |
23 | #include <linux/audit.h> | |
9044e6bc | 24 | #include <linux/skbuff.h> |
fe7752ba DW |
25 | |
26 | /* 0 = no checking | |
27 | 1 = put_count checking | |
28 | 2 = verbose put_count checking | |
29 | */ | |
30 | #define AUDIT_DEBUG 0 | |
31 | ||
32 | /* At task start time, the audit_state is set in the audit_context using | |
33 | a per-task filter. At syscall entry, the audit_state is augmented by | |
34 | the syscall filter. */ | |
35 | enum audit_state { | |
36 | AUDIT_DISABLED, /* Do not create per-task audit_context. | |
37 | * No syscall-specific audit records can | |
38 | * be generated. */ | |
39 | AUDIT_SETUP_CONTEXT, /* Create the per-task audit_context, | |
40 | * but don't necessarily fill it in at | |
41 | * syscall entry time (i.e., filter | |
42 | * instead). */ | |
43 | AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context, | |
44 | * and always fill it in at syscall | |
45 | * entry time. This makes a full | |
46 | * syscall record available if some | |
47 | * other part of the kernel decides it | |
48 | * should be recorded. */ | |
49 | AUDIT_RECORD_CONTEXT /* Create the per-task audit_context, | |
50 | * always fill it in at syscall entry | |
51 | * time, and always write out the audit | |
52 | * record at syscall exit time. */ | |
53 | }; | |
54 | ||
55 | /* Rule lists */ | |
f368c07d AG |
56 | struct audit_parent; |
57 | ||
58 | struct audit_watch { | |
59 | atomic_t count; /* reference count */ | |
60 | char *path; /* insertion path */ | |
61 | dev_t dev; /* associated superblock device */ | |
62 | unsigned long ino; /* associated inode number */ | |
63 | struct audit_parent *parent; /* associated parent */ | |
64 | struct list_head wlist; /* entry in parent->watches list */ | |
65 | struct list_head rules; /* associated rules */ | |
66 | }; | |
67 | ||
74c3cbe3 AV |
68 | struct audit_tree; |
69 | struct audit_chunk; | |
70 | ||
fe7752ba | 71 | struct audit_entry { |
93315ed6 AG |
72 | struct list_head list; |
73 | struct rcu_head rcu; | |
74 | struct audit_krule rule; | |
fe7752ba DW |
75 | }; |
76 | ||
fe7752ba | 77 | extern int audit_pid; |
fe7752ba | 78 | |
f368c07d AG |
79 | #define AUDIT_INODE_BUCKETS 32 |
80 | extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; | |
81 | ||
82 | static inline int audit_hash_ino(u32 ino) | |
83 | { | |
84 | return (ino & (AUDIT_INODE_BUCKETS-1)); | |
85 | } | |
86 | ||
55669bfa | 87 | extern int audit_match_class(int class, unsigned syscall); |
f368c07d | 88 | extern int audit_comparator(const u32 left, const u32 op, const u32 right); |
9c937dcc AG |
89 | extern int audit_compare_dname_path(const char *dname, const char *path, |
90 | int *dirlen); | |
9044e6bc AV |
91 | extern struct sk_buff * audit_make_reply(int pid, int seq, int type, |
92 | int done, int multi, | |
93 | void *payload, int size); | |
fe7752ba DW |
94 | extern void audit_send_reply(int pid, int seq, int type, |
95 | int done, int multi, | |
96 | void *payload, int size); | |
fe7752ba | 97 | extern void audit_panic(const char *message); |
3dc7e315 | 98 | |
9044e6bc AV |
99 | struct audit_netlink_list { |
100 | int pid; | |
101 | struct sk_buff_head q; | |
102 | }; | |
103 | ||
104 | int audit_send_list(void *); | |
105 | ||
f368c07d AG |
106 | struct inotify_watch; |
107 | extern void audit_free_parent(struct inotify_watch *); | |
108 | extern void audit_handle_ievent(struct inotify_watch *, u32, u32, u32, | |
109 | const char *, struct inode *); | |
3dc7e315 | 110 | extern int selinux_audit_rule_update(void); |
e1396065 | 111 | |
74c3cbe3 AV |
112 | extern struct mutex audit_filter_mutex; |
113 | extern void audit_free_rule_rcu(struct rcu_head *); | |
114 | ||
115 | #ifdef CONFIG_AUDIT_TREE | |
116 | extern struct audit_chunk *audit_tree_lookup(const struct inode *); | |
117 | extern void audit_put_chunk(struct audit_chunk *); | |
118 | extern int audit_tree_match(struct audit_chunk *, struct audit_tree *); | |
119 | extern int audit_make_tree(struct audit_krule *, char *, u32); | |
120 | extern int audit_add_tree_rule(struct audit_krule *); | |
121 | extern int audit_remove_tree_rule(struct audit_krule *); | |
122 | extern void audit_trim_trees(void); | |
123 | extern int audit_tag_tree(char *old, char *new); | |
124 | extern void audit_schedule_prune(void); | |
125 | extern void audit_prune_trees(void); | |
126 | extern const char *audit_tree_path(struct audit_tree *); | |
127 | extern void audit_put_tree(struct audit_tree *); | |
128 | #else | |
129 | #define audit_remove_tree_rule(rule) BUG() | |
130 | #define audit_add_tree_rule(rule) -EINVAL | |
131 | #define audit_make_tree(rule, str, op) -EINVAL | |
132 | #define audit_trim_trees() (void)0 | |
133 | #define audit_put_tree(tree) (void)0 | |
134 | #define audit_tag_tree(old, new) -EINVAL | |
135 | #define audit_tree_path(rule) "" /* never called */ | |
136 | #endif | |
137 | ||
138 | extern char *audit_unpack_string(void **, size_t *, size_t); | |
139 | ||
e1396065 | 140 | #ifdef CONFIG_AUDITSYSCALL |
e54dc243 AG |
141 | extern int __audit_signal_info(int sig, struct task_struct *t); |
142 | static inline int audit_signal_info(int sig, struct task_struct *t) | |
e1396065 | 143 | { |
e54dc243 AG |
144 | if (unlikely((audit_pid && t->tgid == audit_pid) || |
145 | (audit_signals && !audit_dummy_context()))) | |
146 | return __audit_signal_info(sig, t); | |
147 | return 0; | |
e1396065 | 148 | } |
f368c07d AG |
149 | extern enum audit_state audit_filter_inodes(struct task_struct *, |
150 | struct audit_context *); | |
151 | extern void audit_set_auditable(struct audit_context *); | |
e1396065 | 152 | #else |
e54dc243 | 153 | #define audit_signal_info(s,t) AUDIT_DISABLED |
f368c07d AG |
154 | #define audit_filter_inodes(t,c) AUDIT_DISABLED |
155 | #define audit_set_auditable(c) | |
e1396065 | 156 | #endif |