1 /* auditfilter.c -- filtering of audit events
3 * Copyright 2003-2004 Red Hat, Inc.
4 * Copyright 2005 Hewlett-Packard Development Company, L.P.
5 * Copyright 2005 IBM Corporation
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 #include <linux/kernel.h>
23 #include <linux/audit.h>
24 #include <linux/kthread.h>
25 #include <linux/mutex.h>
27 #include <linux/namei.h>
28 #include <linux/netlink.h>
29 #include <linux/sched.h>
30 #include <linux/slab.h>
31 #include <linux/security.h>
32 #include <net/net_namespace.h>
39 * Synchronizes writes and blocking reads of audit's filterlist
40 * data. Rcu is used to traverse the filterlist and access
41 * contents of structs audit_entry, audit_watch and opaque
42 * LSM rules during filtering. If modified, these structures
43 * must be copied and replace their counterparts in the filterlist.
44 * An audit_parent struct is not accessed during filtering, so may
45 * be written directly provided audit_filter_mutex is held.
48 /* Audit filter lists, defined in <linux/audit.h> */
49 struct list_head audit_filter_list
[AUDIT_NR_FILTERS
] = {
50 LIST_HEAD_INIT(audit_filter_list
[0]),
51 LIST_HEAD_INIT(audit_filter_list
[1]),
52 LIST_HEAD_INIT(audit_filter_list
[2]),
53 LIST_HEAD_INIT(audit_filter_list
[3]),
54 LIST_HEAD_INIT(audit_filter_list
[4]),
55 LIST_HEAD_INIT(audit_filter_list
[5]),
56 #if AUDIT_NR_FILTERS != 6
57 #error Fix audit_filter_list initialiser
60 static struct list_head audit_rules_list
[AUDIT_NR_FILTERS
] = {
61 LIST_HEAD_INIT(audit_rules_list
[0]),
62 LIST_HEAD_INIT(audit_rules_list
[1]),
63 LIST_HEAD_INIT(audit_rules_list
[2]),
64 LIST_HEAD_INIT(audit_rules_list
[3]),
65 LIST_HEAD_INIT(audit_rules_list
[4]),
66 LIST_HEAD_INIT(audit_rules_list
[5]),
69 DEFINE_MUTEX(audit_filter_mutex
);
71 static inline void audit_free_rule(struct audit_entry
*e
)
74 struct audit_krule
*erule
= &e
->rule
;
76 /* some rules don't have associated watches */
78 audit_put_watch(erule
->watch
);
80 for (i
= 0; i
< erule
->field_count
; i
++) {
81 struct audit_field
*f
= &erule
->fields
[i
];
83 security_audit_rule_free(f
->lsm_rule
);
86 kfree(erule
->filterkey
);
90 void audit_free_rule_rcu(struct rcu_head
*head
)
92 struct audit_entry
*e
= container_of(head
, struct audit_entry
, rcu
);
96 /* Initialize an audit filterlist entry. */
97 static inline struct audit_entry
*audit_init_entry(u32 field_count
)
99 struct audit_entry
*entry
;
100 struct audit_field
*fields
;
102 entry
= kzalloc(sizeof(*entry
), GFP_KERNEL
);
103 if (unlikely(!entry
))
106 fields
= kzalloc(sizeof(*fields
) * field_count
, GFP_KERNEL
);
107 if (unlikely(!fields
)) {
111 entry
->rule
.fields
= fields
;
116 /* Unpack a filter field's string representation from user-space
118 char *audit_unpack_string(void **bufp
, size_t *remain
, size_t len
)
122 if (!*bufp
|| (len
== 0) || (len
> *remain
))
123 return ERR_PTR(-EINVAL
);
125 /* Of the currently implemented string fields, PATH_MAX
126 * defines the longest valid length.
129 return ERR_PTR(-ENAMETOOLONG
);
131 str
= kmalloc(len
+ 1, GFP_KERNEL
);
133 return ERR_PTR(-ENOMEM
);
135 memcpy(str
, *bufp
, len
);
143 /* Translate an inode field to kernel respresentation. */
144 static inline int audit_to_inode(struct audit_krule
*krule
,
145 struct audit_field
*f
)
147 if (krule
->listnr
!= AUDIT_FILTER_EXIT
||
148 krule
->watch
|| krule
->inode_f
|| krule
->tree
||
149 (f
->op
!= Audit_equal
&& f
->op
!= Audit_not_equal
))
156 static __u32
*classes
[AUDIT_SYSCALL_CLASSES
];
158 int __init
audit_register_class(int class, unsigned *list
)
160 __u32
*p
= kzalloc(AUDIT_BITMASK_SIZE
* sizeof(__u32
), GFP_KERNEL
);
163 while (*list
!= ~0U) {
164 unsigned n
= *list
++;
165 if (n
>= AUDIT_BITMASK_SIZE
* 32 - AUDIT_SYSCALL_CLASSES
) {
169 p
[AUDIT_WORD(n
)] |= AUDIT_BIT(n
);
171 if (class >= AUDIT_SYSCALL_CLASSES
|| classes
[class]) {
179 int audit_match_class(int class, unsigned syscall
)
181 if (unlikely(syscall
>= AUDIT_BITMASK_SIZE
* 32))
183 if (unlikely(class >= AUDIT_SYSCALL_CLASSES
|| !classes
[class]))
185 return classes
[class][AUDIT_WORD(syscall
)] & AUDIT_BIT(syscall
);
188 #ifdef CONFIG_AUDITSYSCALL
189 static inline int audit_match_class_bits(int class, u32
*mask
)
193 if (classes
[class]) {
194 for (i
= 0; i
< AUDIT_BITMASK_SIZE
; i
++)
195 if (mask
[i
] & classes
[class][i
])
201 static int audit_match_signal(struct audit_entry
*entry
)
203 struct audit_field
*arch
= entry
->rule
.arch_f
;
206 /* When arch is unspecified, we must check both masks on biarch
207 * as syscall number alone is ambiguous. */
208 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL
,
210 audit_match_class_bits(AUDIT_CLASS_SIGNAL_32
,
214 switch(audit_classify_arch(arch
->val
)) {
216 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL
,
218 case 1: /* 32bit on biarch */
219 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32
,
227 /* Common user-space to kernel rule translation. */
228 static inline struct audit_entry
*audit_to_entry_common(struct audit_rule
*rule
)
231 struct audit_entry
*entry
;
235 listnr
= rule
->flags
& ~AUDIT_FILTER_PREPEND
;
239 #ifdef CONFIG_AUDITSYSCALL
240 case AUDIT_FILTER_ENTRY
:
241 if (rule
->action
== AUDIT_ALWAYS
)
243 case AUDIT_FILTER_EXIT
:
244 case AUDIT_FILTER_TASK
:
246 case AUDIT_FILTER_USER
:
247 case AUDIT_FILTER_TYPE
:
250 if (unlikely(rule
->action
== AUDIT_POSSIBLE
)) {
251 printk(KERN_ERR
"AUDIT_POSSIBLE is deprecated\n");
254 if (rule
->action
!= AUDIT_NEVER
&& rule
->action
!= AUDIT_ALWAYS
)
256 if (rule
->field_count
> AUDIT_MAX_FIELDS
)
260 entry
= audit_init_entry(rule
->field_count
);
264 entry
->rule
.flags
= rule
->flags
& AUDIT_FILTER_PREPEND
;
265 entry
->rule
.listnr
= listnr
;
266 entry
->rule
.action
= rule
->action
;
267 entry
->rule
.field_count
= rule
->field_count
;
269 for (i
= 0; i
< AUDIT_BITMASK_SIZE
; i
++)
270 entry
->rule
.mask
[i
] = rule
->mask
[i
];
272 for (i
= 0; i
< AUDIT_SYSCALL_CLASSES
; i
++) {
273 int bit
= AUDIT_BITMASK_SIZE
* 32 - i
- 1;
274 __u32
*p
= &entry
->rule
.mask
[AUDIT_WORD(bit
)];
277 if (!(*p
& AUDIT_BIT(bit
)))
279 *p
&= ~AUDIT_BIT(bit
);
283 for (j
= 0; j
< AUDIT_BITMASK_SIZE
; j
++)
284 entry
->rule
.mask
[j
] |= class[j
];
294 static u32 audit_ops
[] =
296 [Audit_equal
] = AUDIT_EQUAL
,
297 [Audit_not_equal
] = AUDIT_NOT_EQUAL
,
298 [Audit_bitmask
] = AUDIT_BIT_MASK
,
299 [Audit_bittest
] = AUDIT_BIT_TEST
,
300 [Audit_lt
] = AUDIT_LESS_THAN
,
301 [Audit_gt
] = AUDIT_GREATER_THAN
,
302 [Audit_le
] = AUDIT_LESS_THAN_OR_EQUAL
,
303 [Audit_ge
] = AUDIT_GREATER_THAN_OR_EQUAL
,
306 static u32
audit_to_op(u32 op
)
309 for (n
= Audit_equal
; n
< Audit_bad
&& audit_ops
[n
] != op
; n
++)
314 /* check if an audit field is valid */
315 static int audit_field_valid(struct audit_entry
*entry
, struct audit_field
*f
)
319 if (entry
->rule
.listnr
!= AUDIT_FILTER_TYPE
&&
320 entry
->rule
.listnr
!= AUDIT_FILTER_USER
)
348 /* bit ops are only useful on syscall args */
349 if (f
->op
== Audit_bitmask
|| f
->op
== Audit_bittest
)
356 case AUDIT_SUBJ_USER
:
357 case AUDIT_SUBJ_ROLE
:
358 case AUDIT_SUBJ_TYPE
:
364 case AUDIT_OBJ_LEV_LOW
:
365 case AUDIT_OBJ_LEV_HIGH
:
368 case AUDIT_FILTERKEY
:
370 case AUDIT_LOGINUID_SET
:
371 if ((f
->val
!= 0) && (f
->val
!= 1))
375 if (f
->op
!= Audit_not_equal
&& f
->op
!= Audit_equal
)
383 if (f
->val
& ~S_IFMT
)
386 case AUDIT_FIELD_COMPARE
:
387 if (f
->val
> AUDIT_MAX_FIELD_COMPARE
)
394 /* Translate struct audit_rule_data to kernel's rule respresentation. */
395 static struct audit_entry
*audit_data_to_entry(struct audit_rule_data
*data
,
399 struct audit_entry
*entry
;
401 size_t remain
= datasz
- sizeof(struct audit_rule_data
);
405 entry
= audit_to_entry_common((struct audit_rule
*)data
);
410 entry
->rule
.vers_ops
= 2;
411 for (i
= 0; i
< data
->field_count
; i
++) {
412 struct audit_field
*f
= &entry
->rule
.fields
[i
];
416 f
->op
= audit_to_op(data
->fieldflags
[i
]);
417 if (f
->op
== Audit_bad
)
420 f
->type
= data
->fields
[i
];
421 f
->val
= data
->values
[i
];
422 f
->uid
= INVALID_UID
;
423 f
->gid
= INVALID_GID
;
427 /* Support legacy tests for a valid loginuid */
428 if ((f
->type
== AUDIT_LOGINUID
) && (f
->val
== AUDIT_UID_UNSET
)) {
429 f
->type
= AUDIT_LOGINUID_SET
;
433 err
= audit_field_valid(entry
, f
);
445 f
->uid
= make_kuid(current_user_ns(), f
->val
);
446 if (!uid_valid(f
->uid
))
454 f
->gid
= make_kgid(current_user_ns(), f
->val
);
455 if (!gid_valid(f
->gid
))
459 entry
->rule
.arch_f
= f
;
461 case AUDIT_SUBJ_USER
:
462 case AUDIT_SUBJ_ROLE
:
463 case AUDIT_SUBJ_TYPE
:
469 case AUDIT_OBJ_LEV_LOW
:
470 case AUDIT_OBJ_LEV_HIGH
:
471 str
= audit_unpack_string(&bufp
, &remain
, f
->val
);
474 entry
->rule
.buflen
+= f
->val
;
476 err
= security_audit_rule_init(f
->type
, f
->op
, str
,
477 (void **)&f
->lsm_rule
);
478 /* Keep currently invalid fields around in case they
479 * become valid after a policy reload. */
480 if (err
== -EINVAL
) {
481 printk(KERN_WARNING
"audit rule for LSM "
482 "\'%s\' is invalid\n", str
);
492 str
= audit_unpack_string(&bufp
, &remain
, f
->val
);
495 entry
->rule
.buflen
+= f
->val
;
497 err
= audit_to_watch(&entry
->rule
, str
, f
->val
, f
->op
);
504 str
= audit_unpack_string(&bufp
, &remain
, f
->val
);
507 entry
->rule
.buflen
+= f
->val
;
509 err
= audit_make_tree(&entry
->rule
, str
, f
->op
);
515 err
= audit_to_inode(&entry
->rule
, f
);
519 case AUDIT_FILTERKEY
:
520 if (entry
->rule
.filterkey
|| f
->val
> AUDIT_MAX_KEY_LEN
)
522 str
= audit_unpack_string(&bufp
, &remain
, f
->val
);
525 entry
->rule
.buflen
+= f
->val
;
526 entry
->rule
.filterkey
= str
;
531 if (entry
->rule
.inode_f
&& entry
->rule
.inode_f
->op
== Audit_not_equal
)
532 entry
->rule
.inode_f
= NULL
;
538 if (entry
->rule
.watch
)
539 audit_put_watch(entry
->rule
.watch
); /* matches initial get */
540 if (entry
->rule
.tree
)
541 audit_put_tree(entry
->rule
.tree
); /* that's the temporary one */
542 audit_free_rule(entry
);
546 /* Pack a filter field's string representation into data block. */
547 static inline size_t audit_pack_string(void **bufp
, const char *str
)
549 size_t len
= strlen(str
);
551 memcpy(*bufp
, str
, len
);
557 /* Translate kernel rule respresentation to struct audit_rule_data. */
558 static struct audit_rule_data
*audit_krule_to_data(struct audit_krule
*krule
)
560 struct audit_rule_data
*data
;
564 data
= kmalloc(sizeof(*data
) + krule
->buflen
, GFP_KERNEL
);
567 memset(data
, 0, sizeof(*data
));
569 data
->flags
= krule
->flags
| krule
->listnr
;
570 data
->action
= krule
->action
;
571 data
->field_count
= krule
->field_count
;
573 for (i
= 0; i
< data
->field_count
; i
++) {
574 struct audit_field
*f
= &krule
->fields
[i
];
576 data
->fields
[i
] = f
->type
;
577 data
->fieldflags
[i
] = audit_ops
[f
->op
];
579 case AUDIT_SUBJ_USER
:
580 case AUDIT_SUBJ_ROLE
:
581 case AUDIT_SUBJ_TYPE
:
587 case AUDIT_OBJ_LEV_LOW
:
588 case AUDIT_OBJ_LEV_HIGH
:
589 data
->buflen
+= data
->values
[i
] =
590 audit_pack_string(&bufp
, f
->lsm_str
);
593 data
->buflen
+= data
->values
[i
] =
594 audit_pack_string(&bufp
,
595 audit_watch_path(krule
->watch
));
598 data
->buflen
+= data
->values
[i
] =
599 audit_pack_string(&bufp
,
600 audit_tree_path(krule
->tree
));
602 case AUDIT_FILTERKEY
:
603 data
->buflen
+= data
->values
[i
] =
604 audit_pack_string(&bufp
, krule
->filterkey
);
607 data
->values
[i
] = f
->val
;
610 for (i
= 0; i
< AUDIT_BITMASK_SIZE
; i
++) data
->mask
[i
] = krule
->mask
[i
];
615 /* Compare two rules in kernel format. Considered success if rules
617 static int audit_compare_rule(struct audit_krule
*a
, struct audit_krule
*b
)
621 if (a
->flags
!= b
->flags
||
622 a
->listnr
!= b
->listnr
||
623 a
->action
!= b
->action
||
624 a
->field_count
!= b
->field_count
)
627 for (i
= 0; i
< a
->field_count
; i
++) {
628 if (a
->fields
[i
].type
!= b
->fields
[i
].type
||
629 a
->fields
[i
].op
!= b
->fields
[i
].op
)
632 switch(a
->fields
[i
].type
) {
633 case AUDIT_SUBJ_USER
:
634 case AUDIT_SUBJ_ROLE
:
635 case AUDIT_SUBJ_TYPE
:
641 case AUDIT_OBJ_LEV_LOW
:
642 case AUDIT_OBJ_LEV_HIGH
:
643 if (strcmp(a
->fields
[i
].lsm_str
, b
->fields
[i
].lsm_str
))
647 if (strcmp(audit_watch_path(a
->watch
),
648 audit_watch_path(b
->watch
)))
652 if (strcmp(audit_tree_path(a
->tree
),
653 audit_tree_path(b
->tree
)))
656 case AUDIT_FILTERKEY
:
657 /* both filterkeys exist based on above type compare */
658 if (strcmp(a
->filterkey
, b
->filterkey
))
667 if (!uid_eq(a
->fields
[i
].uid
, b
->fields
[i
].uid
))
675 if (!gid_eq(a
->fields
[i
].gid
, b
->fields
[i
].gid
))
679 if (a
->fields
[i
].val
!= b
->fields
[i
].val
)
684 for (i
= 0; i
< AUDIT_BITMASK_SIZE
; i
++)
685 if (a
->mask
[i
] != b
->mask
[i
])
691 /* Duplicate LSM field information. The lsm_rule is opaque, so must be
693 static inline int audit_dupe_lsm_field(struct audit_field
*df
,
694 struct audit_field
*sf
)
699 /* our own copy of lsm_str */
700 lsm_str
= kstrdup(sf
->lsm_str
, GFP_KERNEL
);
701 if (unlikely(!lsm_str
))
703 df
->lsm_str
= lsm_str
;
705 /* our own (refreshed) copy of lsm_rule */
706 ret
= security_audit_rule_init(df
->type
, df
->op
, df
->lsm_str
,
707 (void **)&df
->lsm_rule
);
708 /* Keep currently invalid fields around in case they
709 * become valid after a policy reload. */
710 if (ret
== -EINVAL
) {
711 printk(KERN_WARNING
"audit rule for LSM \'%s\' is "
712 "invalid\n", df
->lsm_str
);
719 /* Duplicate an audit rule. This will be a deep copy with the exception
720 * of the watch - that pointer is carried over. The LSM specific fields
721 * will be updated in the copy. The point is to be able to replace the old
722 * rule with the new rule in the filterlist, then free the old rule.
723 * The rlist element is undefined; list manipulations are handled apart from
724 * the initial copy. */
725 struct audit_entry
*audit_dupe_rule(struct audit_krule
*old
)
727 u32 fcount
= old
->field_count
;
728 struct audit_entry
*entry
;
729 struct audit_krule
*new;
733 entry
= audit_init_entry(fcount
);
734 if (unlikely(!entry
))
735 return ERR_PTR(-ENOMEM
);
738 new->vers_ops
= old
->vers_ops
;
739 new->flags
= old
->flags
;
740 new->listnr
= old
->listnr
;
741 new->action
= old
->action
;
742 for (i
= 0; i
< AUDIT_BITMASK_SIZE
; i
++)
743 new->mask
[i
] = old
->mask
[i
];
744 new->prio
= old
->prio
;
745 new->buflen
= old
->buflen
;
746 new->inode_f
= old
->inode_f
;
747 new->field_count
= old
->field_count
;
750 * note that we are OK with not refcounting here; audit_match_tree()
751 * never dereferences tree and we can't get false positives there
752 * since we'd have to have rule gone from the list *and* removed
753 * before the chunks found by lookup had been allocated, i.e. before
754 * the beginning of list scan.
756 new->tree
= old
->tree
;
757 memcpy(new->fields
, old
->fields
, sizeof(struct audit_field
) * fcount
);
759 /* deep copy this information, updating the lsm_rule fields, because
760 * the originals will all be freed when the old rule is freed. */
761 for (i
= 0; i
< fcount
; i
++) {
762 switch (new->fields
[i
].type
) {
763 case AUDIT_SUBJ_USER
:
764 case AUDIT_SUBJ_ROLE
:
765 case AUDIT_SUBJ_TYPE
:
771 case AUDIT_OBJ_LEV_LOW
:
772 case AUDIT_OBJ_LEV_HIGH
:
773 err
= audit_dupe_lsm_field(&new->fields
[i
],
776 case AUDIT_FILTERKEY
:
777 fk
= kstrdup(old
->filterkey
, GFP_KERNEL
);
784 audit_free_rule(entry
);
790 audit_get_watch(old
->watch
);
791 new->watch
= old
->watch
;
797 /* Find an existing audit rule.
798 * Caller must hold audit_filter_mutex to prevent stale rule data. */
799 static struct audit_entry
*audit_find_rule(struct audit_entry
*entry
,
800 struct list_head
**p
)
802 struct audit_entry
*e
, *found
= NULL
;
803 struct list_head
*list
;
806 if (entry
->rule
.inode_f
) {
807 h
= audit_hash_ino(entry
->rule
.inode_f
->val
);
808 *p
= list
= &audit_inode_hash
[h
];
809 } else if (entry
->rule
.watch
) {
810 /* we don't know the inode number, so must walk entire hash */
811 for (h
= 0; h
< AUDIT_INODE_BUCKETS
; h
++) {
812 list
= &audit_inode_hash
[h
];
813 list_for_each_entry(e
, list
, list
)
814 if (!audit_compare_rule(&entry
->rule
, &e
->rule
)) {
821 *p
= list
= &audit_filter_list
[entry
->rule
.listnr
];
824 list_for_each_entry(e
, list
, list
)
825 if (!audit_compare_rule(&entry
->rule
, &e
->rule
)) {
834 static u64 prio_low
= ~0ULL/2;
835 static u64 prio_high
= ~0ULL/2 - 1;
837 /* Add rule to given filterlist if not a duplicate. */
838 static inline int audit_add_rule(struct audit_entry
*entry
)
840 struct audit_entry
*e
;
841 struct audit_watch
*watch
= entry
->rule
.watch
;
842 struct audit_tree
*tree
= entry
->rule
.tree
;
843 struct list_head
*list
;
845 #ifdef CONFIG_AUDITSYSCALL
848 /* If either of these, don't count towards total */
849 if (entry
->rule
.listnr
== AUDIT_FILTER_USER
||
850 entry
->rule
.listnr
== AUDIT_FILTER_TYPE
)
854 mutex_lock(&audit_filter_mutex
);
855 e
= audit_find_rule(entry
, &list
);
857 mutex_unlock(&audit_filter_mutex
);
859 /* normally audit_add_tree_rule() will free it on failure */
861 audit_put_tree(tree
);
866 /* audit_filter_mutex is dropped and re-taken during this call */
867 err
= audit_add_watch(&entry
->rule
, &list
);
869 mutex_unlock(&audit_filter_mutex
);
871 * normally audit_add_tree_rule() will free it
875 audit_put_tree(tree
);
880 err
= audit_add_tree_rule(&entry
->rule
);
882 mutex_unlock(&audit_filter_mutex
);
887 entry
->rule
.prio
= ~0ULL;
888 if (entry
->rule
.listnr
== AUDIT_FILTER_EXIT
) {
889 if (entry
->rule
.flags
& AUDIT_FILTER_PREPEND
)
890 entry
->rule
.prio
= ++prio_high
;
892 entry
->rule
.prio
= --prio_low
;
895 if (entry
->rule
.flags
& AUDIT_FILTER_PREPEND
) {
896 list_add(&entry
->rule
.list
,
897 &audit_rules_list
[entry
->rule
.listnr
]);
898 list_add_rcu(&entry
->list
, list
);
899 entry
->rule
.flags
&= ~AUDIT_FILTER_PREPEND
;
901 list_add_tail(&entry
->rule
.list
,
902 &audit_rules_list
[entry
->rule
.listnr
]);
903 list_add_tail_rcu(&entry
->list
, list
);
905 #ifdef CONFIG_AUDITSYSCALL
909 if (!audit_match_signal(entry
))
912 mutex_unlock(&audit_filter_mutex
);
918 audit_put_watch(watch
); /* tmp watch, matches initial get */
922 /* Remove an existing rule from filterlist. */
923 static inline int audit_del_rule(struct audit_entry
*entry
)
925 struct audit_entry
*e
;
926 struct audit_watch
*watch
= entry
->rule
.watch
;
927 struct audit_tree
*tree
= entry
->rule
.tree
;
928 struct list_head
*list
;
930 #ifdef CONFIG_AUDITSYSCALL
933 /* If either of these, don't count towards total */
934 if (entry
->rule
.listnr
== AUDIT_FILTER_USER
||
935 entry
->rule
.listnr
== AUDIT_FILTER_TYPE
)
939 mutex_lock(&audit_filter_mutex
);
940 e
= audit_find_rule(entry
, &list
);
942 mutex_unlock(&audit_filter_mutex
);
948 audit_remove_watch_rule(&e
->rule
);
951 audit_remove_tree_rule(&e
->rule
);
953 list_del_rcu(&e
->list
);
954 list_del(&e
->rule
.list
);
955 call_rcu(&e
->rcu
, audit_free_rule_rcu
);
957 #ifdef CONFIG_AUDITSYSCALL
961 if (!audit_match_signal(entry
))
964 mutex_unlock(&audit_filter_mutex
);
968 audit_put_watch(watch
); /* match initial get */
970 audit_put_tree(tree
); /* that's the temporary one */
975 /* List rules using struct audit_rule_data. */
976 static void audit_list_rules(__u32 portid
, int seq
, struct sk_buff_head
*q
)
979 struct audit_krule
*r
;
982 /* This is a blocking read, so use audit_filter_mutex instead of rcu
983 * iterator to sync with list writers. */
984 for (i
=0; i
<AUDIT_NR_FILTERS
; i
++) {
985 list_for_each_entry(r
, &audit_rules_list
[i
], list
) {
986 struct audit_rule_data
*data
;
988 data
= audit_krule_to_data(r
);
991 skb
= audit_make_reply(portid
, seq
, AUDIT_LIST_RULES
,
993 sizeof(*data
) + data
->buflen
);
995 skb_queue_tail(q
, skb
);
999 skb
= audit_make_reply(portid
, seq
, AUDIT_LIST_RULES
, 1, 1, NULL
, 0);
1001 skb_queue_tail(q
, skb
);
1004 /* Log rule additions and removals */
1005 static void audit_log_rule_change(char *action
, struct audit_krule
*rule
, int res
)
1007 struct audit_buffer
*ab
;
1008 uid_t loginuid
= from_kuid(&init_user_ns
, audit_get_loginuid(current
));
1009 unsigned int sessionid
= audit_get_sessionid(current
);
1014 ab
= audit_log_start(NULL
, GFP_KERNEL
, AUDIT_CONFIG_CHANGE
);
1017 audit_log_format(ab
, "auid=%u ses=%u" ,loginuid
, sessionid
);
1018 audit_log_task_context(ab
);
1019 audit_log_format(ab
, " op=");
1020 audit_log_string(ab
, action
);
1021 audit_log_key(ab
, rule
->filterkey
);
1022 audit_log_format(ab
, " list=%d res=%d", rule
->listnr
, res
);
1027 * audit_rule_change - apply all rules to the specified message type
1028 * @type: audit message type
1029 * @portid: target port id for netlink audit messages
1030 * @seq: netlink audit message sequence (serial) number
1031 * @data: payload data
1032 * @datasz: size of payload data
1034 int audit_rule_change(int type
, __u32 portid
, int seq
, void *data
,
1038 struct audit_entry
*entry
;
1041 case AUDIT_ADD_RULE
:
1042 entry
= audit_data_to_entry(data
, datasz
);
1044 return PTR_ERR(entry
);
1046 err
= audit_add_rule(entry
);
1047 audit_log_rule_change("add rule", &entry
->rule
, !err
);
1049 audit_free_rule(entry
);
1051 case AUDIT_DEL_RULE
:
1052 entry
= audit_data_to_entry(data
, datasz
);
1054 return PTR_ERR(entry
);
1056 err
= audit_del_rule(entry
);
1057 audit_log_rule_change("remove rule", &entry
->rule
, !err
);
1058 audit_free_rule(entry
);
1068 * audit_list_rules_send - list the audit rules
1069 * @portid: target portid for netlink audit messages
1070 * @seq: netlink audit message sequence (serial) number
1072 int audit_list_rules_send(__u32 portid
, int seq
)
1074 struct task_struct
*tsk
;
1075 struct audit_netlink_list
*dest
;
1078 /* We can't just spew out the rules here because we might fill
1079 * the available socket buffer space and deadlock waiting for
1080 * auditctl to read from it... which isn't ever going to
1081 * happen if we're actually running in the context of auditctl
1082 * trying to _send_ the stuff */
1084 dest
= kmalloc(sizeof(struct audit_netlink_list
), GFP_KERNEL
);
1087 dest
->net
= get_net(current
->nsproxy
->net_ns
);
1088 dest
->portid
= portid
;
1089 skb_queue_head_init(&dest
->q
);
1091 mutex_lock(&audit_filter_mutex
);
1092 audit_list_rules(portid
, seq
, &dest
->q
);
1093 mutex_unlock(&audit_filter_mutex
);
1095 tsk
= kthread_run(audit_send_list
, dest
, "audit_send_list");
1097 skb_queue_purge(&dest
->q
);
1105 int audit_comparator(u32 left
, u32 op
, u32 right
)
1109 return (left
== right
);
1110 case Audit_not_equal
:
1111 return (left
!= right
);
1113 return (left
< right
);
1115 return (left
<= right
);
1117 return (left
> right
);
1119 return (left
>= right
);
1121 return (left
& right
);
1123 return ((left
& right
) == right
);
1130 int audit_uid_comparator(kuid_t left
, u32 op
, kuid_t right
)
1134 return uid_eq(left
, right
);
1135 case Audit_not_equal
:
1136 return !uid_eq(left
, right
);
1138 return uid_lt(left
, right
);
1140 return uid_lte(left
, right
);
1142 return uid_gt(left
, right
);
1144 return uid_gte(left
, right
);
1153 int audit_gid_comparator(kgid_t left
, u32 op
, kgid_t right
)
1157 return gid_eq(left
, right
);
1158 case Audit_not_equal
:
1159 return !gid_eq(left
, right
);
1161 return gid_lt(left
, right
);
1163 return gid_lte(left
, right
);
1165 return gid_gt(left
, right
);
1167 return gid_gte(left
, right
);
1177 * parent_len - find the length of the parent portion of a pathname
1178 * @path: pathname of which to determine length
1180 int parent_len(const char *path
)
1185 plen
= strlen(path
);
1190 /* disregard trailing slashes */
1191 p
= path
+ plen
- 1;
1192 while ((*p
== '/') && (p
> path
))
1195 /* walk backward until we find the next slash or hit beginning */
1196 while ((*p
!= '/') && (p
> path
))
1199 /* did we find a slash? Then increment to include it in path */
1207 * audit_compare_dname_path - compare given dentry name with last component in
1208 * given path. Return of 0 indicates a match.
1209 * @dname: dentry name that we're comparing
1210 * @path: full pathname that we're comparing
1211 * @parentlen: length of the parent if known. Passing in AUDIT_NAME_FULL
1212 * here indicates that we must compute this value.
1214 int audit_compare_dname_path(const char *dname
, const char *path
, int parentlen
)
1219 dlen
= strlen(dname
);
1220 pathlen
= strlen(path
);
1224 parentlen
= parentlen
== AUDIT_NAME_FULL
? parent_len(path
) : parentlen
;
1225 if (pathlen
- parentlen
!= dlen
)
1228 p
= path
+ parentlen
;
1230 return strncmp(p
, dname
, dlen
);
1233 static int audit_filter_user_rules(struct audit_krule
*rule
, int type
,
1234 enum audit_state
*state
)
1238 for (i
= 0; i
< rule
->field_count
; i
++) {
1239 struct audit_field
*f
= &rule
->fields
[i
];
1245 result
= audit_comparator(task_pid_vnr(current
), f
->op
, f
->val
);
1248 result
= audit_uid_comparator(current_uid(), f
->op
, f
->uid
);
1251 result
= audit_gid_comparator(current_gid(), f
->op
, f
->gid
);
1253 case AUDIT_LOGINUID
:
1254 result
= audit_uid_comparator(audit_get_loginuid(current
),
1257 case AUDIT_LOGINUID_SET
:
1258 result
= audit_comparator(audit_loginuid_set(current
),
1262 result
= audit_comparator(type
, f
->op
, f
->val
);
1264 case AUDIT_SUBJ_USER
:
1265 case AUDIT_SUBJ_ROLE
:
1266 case AUDIT_SUBJ_TYPE
:
1267 case AUDIT_SUBJ_SEN
:
1268 case AUDIT_SUBJ_CLR
:
1270 security_task_getsecid(current
, &sid
);
1271 result
= security_audit_rule_match(sid
,
1283 switch (rule
->action
) {
1284 case AUDIT_NEVER
: *state
= AUDIT_DISABLED
; break;
1285 case AUDIT_ALWAYS
: *state
= AUDIT_RECORD_CONTEXT
; break;
1290 int audit_filter_user(int type
)
1292 enum audit_state state
= AUDIT_DISABLED
;
1293 struct audit_entry
*e
;
1296 ret
= 1; /* Audit by default */
1299 list_for_each_entry_rcu(e
, &audit_filter_list
[AUDIT_FILTER_USER
], list
) {
1300 rc
= audit_filter_user_rules(&e
->rule
, type
, &state
);
1302 if (rc
> 0 && state
== AUDIT_DISABLED
)
1312 int audit_filter_type(int type
)
1314 struct audit_entry
*e
;
1318 if (list_empty(&audit_filter_list
[AUDIT_FILTER_TYPE
]))
1319 goto unlock_and_return
;
1321 list_for_each_entry_rcu(e
, &audit_filter_list
[AUDIT_FILTER_TYPE
],
1324 for (i
= 0; i
< e
->rule
.field_count
; i
++) {
1325 struct audit_field
*f
= &e
->rule
.fields
[i
];
1326 if (f
->type
== AUDIT_MSGTYPE
) {
1327 result
= audit_comparator(type
, f
->op
, f
->val
);
1333 goto unlock_and_return
;
1340 static int update_lsm_rule(struct audit_krule
*r
)
1342 struct audit_entry
*entry
= container_of(r
, struct audit_entry
, rule
);
1343 struct audit_entry
*nentry
;
1346 if (!security_audit_rule_known(r
))
1349 nentry
= audit_dupe_rule(r
);
1350 if (IS_ERR(nentry
)) {
1351 /* save the first error encountered for the
1353 err
= PTR_ERR(nentry
);
1354 audit_panic("error updating LSM filters");
1356 list_del(&r
->rlist
);
1357 list_del_rcu(&entry
->list
);
1360 if (r
->watch
|| r
->tree
)
1361 list_replace_init(&r
->rlist
, &nentry
->rule
.rlist
);
1362 list_replace_rcu(&entry
->list
, &nentry
->list
);
1363 list_replace(&r
->list
, &nentry
->rule
.list
);
1365 call_rcu(&entry
->rcu
, audit_free_rule_rcu
);
1370 /* This function will re-initialize the lsm_rule field of all applicable rules.
1371 * It will traverse the filter lists serarching for rules that contain LSM
1372 * specific filter fields. When such a rule is found, it is copied, the
1373 * LSM field is re-initialized, and the old rule is replaced with the
1375 int audit_update_lsm_rules(void)
1377 struct audit_krule
*r
, *n
;
1380 /* audit_filter_mutex synchronizes the writers */
1381 mutex_lock(&audit_filter_mutex
);
1383 for (i
= 0; i
< AUDIT_NR_FILTERS
; i
++) {
1384 list_for_each_entry_safe(r
, n
, &audit_rules_list
[i
], list
) {
1385 int res
= update_lsm_rule(r
);
1390 mutex_unlock(&audit_filter_mutex
);