2 * Creating audit events from TTY input.
4 * Copyright (C) 2007 Red Hat, Inc. All rights reserved. This copyrighted
5 * material is made available to anyone wishing to use, modify, copy, or
6 * redistribute it subject to the terms and conditions of the GNU General
9 * Authors: Miloslav Trmac <mitr@redhat.com>
12 #include <linux/audit.h>
13 #include <linux/slab.h>
14 #include <linux/tty.h>
16 struct tty_audit_buf
{
17 struct mutex mutex
; /* Protects all data below */
18 dev_t dev
; /* The TTY which the data is from */
21 unsigned char *data
; /* Allocated size N_TTY_BUF_SIZE */
24 static struct tty_audit_buf
*tty_audit_buf_ref(void)
26 struct tty_audit_buf
*buf
;
28 buf
= current
->signal
->tty_audit_buf
;
29 WARN_ON(buf
== ERR_PTR(-ESRCH
));
33 static struct tty_audit_buf
*tty_audit_buf_alloc(void)
35 struct tty_audit_buf
*buf
;
37 buf
= kmalloc(sizeof(*buf
), GFP_KERNEL
);
40 buf
->data
= kmalloc(N_TTY_BUF_SIZE
, GFP_KERNEL
);
43 mutex_init(&buf
->mutex
);
44 buf
->dev
= MKDEV(0, 0);
55 static void tty_audit_buf_free(struct tty_audit_buf
*buf
)
57 WARN_ON(buf
->valid
!= 0);
62 static void tty_audit_log(const char *description
, dev_t dev
,
63 unsigned char *data
, size_t size
)
65 struct audit_buffer
*ab
;
66 struct task_struct
*tsk
= current
;
67 pid_t pid
= task_pid_nr(tsk
);
68 uid_t uid
= from_kuid(&init_user_ns
, task_uid(tsk
));
69 uid_t loginuid
= from_kuid(&init_user_ns
, audit_get_loginuid(tsk
));
70 unsigned int sessionid
= audit_get_sessionid(tsk
);
72 ab
= audit_log_start(NULL
, GFP_KERNEL
, AUDIT_TTY
);
74 char name
[sizeof(tsk
->comm
)];
76 audit_log_format(ab
, "%s pid=%u uid=%u auid=%u ses=%u major=%d"
77 " minor=%d comm=", description
, pid
, uid
,
78 loginuid
, sessionid
, MAJOR(dev
), MINOR(dev
));
79 get_task_comm(name
, tsk
);
80 audit_log_untrustedstring(ab
, name
);
81 audit_log_format(ab
, " data=");
82 audit_log_n_hex(ab
, data
, size
);
88 * tty_audit_buf_push - Push buffered data out
90 * Generate an audit message from the contents of @buf, which is owned by
91 * the current task. @buf->mutex must be locked.
93 static void tty_audit_buf_push(struct tty_audit_buf
*buf
)
97 if (audit_enabled
== 0) {
101 tty_audit_log("tty", buf
->dev
, buf
->data
, buf
->valid
);
106 * tty_audit_exit - Handle a task exit
108 * Make sure all buffered data is written out and deallocate the buffer.
109 * Only needs to be called if current->signal->tty_audit_buf != %NULL.
111 * The process is single-threaded at this point; no other threads share
114 void tty_audit_exit(void)
116 struct tty_audit_buf
*buf
;
118 buf
= xchg(¤t
->signal
->tty_audit_buf
, ERR_PTR(-ESRCH
));
122 tty_audit_buf_push(buf
);
123 tty_audit_buf_free(buf
);
127 * tty_audit_fork - Copy TTY audit state for a new task
129 * Set up TTY audit state in @sig from current. @sig needs no locking.
131 void tty_audit_fork(struct signal_struct
*sig
)
133 sig
->audit_tty
= current
->signal
->audit_tty
;
137 * tty_audit_tiocsti - Log TIOCSTI
139 void tty_audit_tiocsti(struct tty_struct
*tty
, char ch
)
143 dev
= MKDEV(tty
->driver
->major
, tty
->driver
->minor_start
) + tty
->index
;
144 if (tty_audit_push())
148 tty_audit_log("ioctl=TIOCSTI", dev
, &ch
, 1);
152 * tty_audit_push - Flush current's pending audit data
154 * Returns 0 if success, -EPERM if tty audit is disabled
156 int tty_audit_push(void)
158 struct tty_audit_buf
*buf
;
160 if (~current
->signal
->audit_tty
& AUDIT_TTY_ENABLE
)
163 buf
= tty_audit_buf_ref();
164 if (!IS_ERR_OR_NULL(buf
)) {
165 mutex_lock(&buf
->mutex
);
166 tty_audit_buf_push(buf
);
167 mutex_unlock(&buf
->mutex
);
173 * tty_audit_buf_get - Get an audit buffer.
175 * Get an audit buffer, allocate it if necessary. Return %NULL
176 * if out of memory or ERR_PTR(-ESRCH) if tty_audit_exit() has already
177 * occurred. Otherwise, return a new reference to the buffer.
179 static struct tty_audit_buf
*tty_audit_buf_get(void)
181 struct tty_audit_buf
*buf
;
183 buf
= tty_audit_buf_ref();
187 buf
= tty_audit_buf_alloc();
189 audit_log_lost("out of memory in TTY auditing");
193 /* Race to use this buffer, free it if another wins */
194 if (cmpxchg(¤t
->signal
->tty_audit_buf
, NULL
, buf
) != NULL
)
195 tty_audit_buf_free(buf
);
196 return tty_audit_buf_ref();
200 * tty_audit_add_data - Add data for TTY auditing.
202 * Audit @data of @size from @tty, if necessary.
204 void tty_audit_add_data(struct tty_struct
*tty
, const void *data
, size_t size
)
206 struct tty_audit_buf
*buf
;
207 unsigned int icanon
= !!L_ICANON(tty
);
208 unsigned int audit_tty
;
211 audit_tty
= READ_ONCE(current
->signal
->audit_tty
);
212 if (~audit_tty
& AUDIT_TTY_ENABLE
)
215 if (unlikely(size
== 0))
218 if (tty
->driver
->type
== TTY_DRIVER_TYPE_PTY
219 && tty
->driver
->subtype
== PTY_TYPE_MASTER
)
222 if ((~audit_tty
& AUDIT_TTY_LOG_PASSWD
) && icanon
&& !L_ECHO(tty
))
225 buf
= tty_audit_buf_get();
226 if (IS_ERR_OR_NULL(buf
))
229 mutex_lock(&buf
->mutex
);
230 dev
= MKDEV(tty
->driver
->major
, tty
->driver
->minor_start
) + tty
->index
;
231 if (buf
->dev
!= dev
|| buf
->icanon
!= icanon
) {
232 tty_audit_buf_push(buf
);
234 buf
->icanon
= icanon
;
239 run
= N_TTY_BUF_SIZE
- buf
->valid
;
242 memcpy(buf
->data
+ buf
->valid
, data
, run
);
246 if (buf
->valid
== N_TTY_BUF_SIZE
)
247 tty_audit_buf_push(buf
);
249 mutex_unlock(&buf
->mutex
);
This page took 0.037083 seconds and 5 git commands to generate.