1 /* auditsc.c -- System-call auditing support
2 * Handles all system-call specific auditing features.
4 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
23 * Many of the ideas implemented here are from Stephen C. Tweedie,
24 * especially the idea of avoiding a copy by using getname.
26 * The method for actual interception of syscall entry and exit (not in
27 * this file -- see entry.S) is based on a GPL'd patch written by
28 * okir@suse.de and Copyright 2003 SuSE Linux AG.
32 #include <linux/init.h>
33 #include <asm/atomic.h>
34 #include <asm/types.h>
36 #include <linux/module.h>
37 #include <linux/mount.h>
38 #include <linux/socket.h>
39 #include <linux/audit.h>
40 #include <linux/personality.h>
41 #include <linux/time.h>
42 #include <linux/kthread.h>
43 #include <linux/netlink.h>
44 #include <linux/compiler.h>
45 #include <asm/unistd.h>
48 1 = put_count checking
49 2 = verbose put_count checking
53 /* No syscall auditing will take place unless audit_enabled != 0. */
54 extern int audit_enabled
;
56 /* AUDIT_NAMES is the number of slots we reserve in the audit_context
57 * for saving names from getname(). */
58 #define AUDIT_NAMES 20
60 /* AUDIT_NAMES_RESERVED is the number of slots we reserve in the
61 * audit_context from being used for nameless inodes from
63 #define AUDIT_NAMES_RESERVED 7
65 /* At task start time, the audit_state is set in the audit_context using
66 a per-task filter. At syscall entry, the audit_state is augmented by
67 the syscall filter. */
69 AUDIT_DISABLED
, /* Do not create per-task audit_context.
70 * No syscall-specific audit records can
72 AUDIT_SETUP_CONTEXT
, /* Create the per-task audit_context,
73 * but don't necessarily fill it in at
74 * syscall entry time (i.e., filter
76 AUDIT_BUILD_CONTEXT
, /* Create the per-task audit_context,
77 * and always fill it in at syscall
78 * entry time. This makes a full
79 * syscall record available if some
80 * other part of the kernel decides it
81 * should be recorded. */
82 AUDIT_RECORD_CONTEXT
/* Create the per-task audit_context,
83 * always fill it in at syscall entry
84 * time, and always write out the audit
85 * record at syscall exit time. */
88 /* When fs/namei.c:getname() is called, we store the pointer in name and
89 * we don't let putname() free it (instead we free all of the saved
90 * pointers at syscall exit time).
92 * Further, in fs/namei.c:path_lookup() we store the inode and device. */
104 struct audit_aux_data
{
105 struct audit_aux_data
*next
;
109 #define AUDIT_AUX_IPCPERM 0
111 struct audit_aux_data_ipcctl
{
112 struct audit_aux_data d
;
114 unsigned long qbytes
;
120 struct audit_aux_data_socketcall
{
121 struct audit_aux_data d
;
123 unsigned long args
[0];
126 struct audit_aux_data_sockaddr
{
127 struct audit_aux_data d
;
132 struct audit_aux_data_path
{
133 struct audit_aux_data d
;
134 struct dentry
*dentry
;
135 struct vfsmount
*mnt
;
138 /* The per-task audit context. */
139 struct audit_context
{
140 int in_syscall
; /* 1 if task is in a syscall */
141 enum audit_state state
;
142 unsigned int serial
; /* serial number for record */
143 struct timespec ctime
; /* time of syscall entry */
144 uid_t loginuid
; /* login uid (identity) */
145 int major
; /* syscall number */
146 unsigned long argv
[4]; /* syscall arguments */
147 int return_valid
; /* return code is valid */
148 long return_code
;/* syscall return code */
149 int auditable
; /* 1 if record should be written */
151 struct audit_names names
[AUDIT_NAMES
];
153 struct vfsmount
* pwdmnt
;
154 struct audit_context
*previous
; /* For nested syscalls */
155 struct audit_aux_data
*aux
;
157 /* Save things to print about task_struct */
159 uid_t uid
, euid
, suid
, fsuid
;
160 gid_t gid
, egid
, sgid
, fsgid
;
161 unsigned long personality
;
171 /* There are three lists of rules -- one to search at task creation
172 * time, one to search at syscall entry time, and another to search at
173 * syscall exit time. */
174 static struct list_head audit_filter_list
[AUDIT_NR_FILTERS
] = {
175 LIST_HEAD_INIT(audit_filter_list
[0]),
176 LIST_HEAD_INIT(audit_filter_list
[1]),
177 LIST_HEAD_INIT(audit_filter_list
[2]),
178 LIST_HEAD_INIT(audit_filter_list
[3]),
179 LIST_HEAD_INIT(audit_filter_list
[4]),
180 #if AUDIT_NR_FILTERS != 5
181 #error Fix audit_filter_list initialiser
186 struct list_head list
;
188 struct audit_rule rule
;
191 extern int audit_pid
;
193 /* Check to see if two rules are identical. It is called from
194 * audit_del_rule during AUDIT_DEL. */
195 static int audit_compare_rule(struct audit_rule
*a
, struct audit_rule
*b
)
199 if (a
->flags
!= b
->flags
)
202 if (a
->action
!= b
->action
)
205 if (a
->field_count
!= b
->field_count
)
208 for (i
= 0; i
< a
->field_count
; i
++) {
209 if (a
->fields
[i
] != b
->fields
[i
]
210 || a
->values
[i
] != b
->values
[i
])
214 for (i
= 0; i
< AUDIT_BITMASK_SIZE
; i
++)
215 if (a
->mask
[i
] != b
->mask
[i
])
221 /* Note that audit_add_rule and audit_del_rule are called via
222 * audit_receive() in audit.c, and are protected by
223 * audit_netlink_sem. */
224 static inline void audit_add_rule(struct audit_entry
*entry
,
225 struct list_head
*list
)
227 if (entry
->rule
.flags
& AUDIT_FILTER_PREPEND
) {
228 entry
->rule
.flags
&= ~AUDIT_FILTER_PREPEND
;
229 list_add_rcu(&entry
->list
, list
);
231 list_add_tail_rcu(&entry
->list
, list
);
235 static void audit_free_rule(struct rcu_head
*head
)
237 struct audit_entry
*e
= container_of(head
, struct audit_entry
, rcu
);
241 /* Note that audit_add_rule and audit_del_rule are called via
242 * audit_receive() in audit.c, and are protected by
243 * audit_netlink_sem. */
244 static inline int audit_del_rule(struct audit_rule
*rule
,
245 struct list_head
*list
)
247 struct audit_entry
*e
;
249 /* Do not use the _rcu iterator here, since this is the only
250 * deletion routine. */
251 list_for_each_entry(e
, list
, list
) {
252 if (!audit_compare_rule(rule
, &e
->rule
)) {
253 list_del_rcu(&e
->list
);
254 call_rcu(&e
->rcu
, audit_free_rule
);
258 return -ENOENT
; /* No matching rule */
261 /* Copy rule from user-space to kernel-space. Called during
263 static int audit_copy_rule(struct audit_rule
*d
, struct audit_rule
*s
)
267 if (s
->action
!= AUDIT_NEVER
268 && s
->action
!= AUDIT_POSSIBLE
269 && s
->action
!= AUDIT_ALWAYS
)
271 if (s
->field_count
< 0 || s
->field_count
> AUDIT_MAX_FIELDS
)
273 if ((s
->flags
& ~AUDIT_FILTER_PREPEND
) >= AUDIT_NR_FILTERS
)
277 d
->action
= s
->action
;
278 d
->field_count
= s
->field_count
;
279 for (i
= 0; i
< d
->field_count
; i
++) {
280 d
->fields
[i
] = s
->fields
[i
];
281 d
->values
[i
] = s
->values
[i
];
283 for (i
= 0; i
< AUDIT_BITMASK_SIZE
; i
++) d
->mask
[i
] = s
->mask
[i
];
287 static int audit_list_rules(void *_dest
)
291 struct audit_entry
*entry
;
298 down(&audit_netlink_sem
);
300 /* The *_rcu iterators not needed here because we are
301 always called with audit_netlink_sem held. */
302 for (i
=0; i
<AUDIT_NR_FILTERS
; i
++) {
303 list_for_each_entry(entry
, &audit_filter_list
[i
], list
)
304 audit_send_reply(pid
, seq
, AUDIT_LIST
, 0, 1,
305 &entry
->rule
, sizeof(entry
->rule
));
307 audit_send_reply(pid
, seq
, AUDIT_LIST
, 1, 1, NULL
, 0);
309 up(&audit_netlink_sem
);
313 int audit_receive_filter(int type
, int pid
, int uid
, int seq
, void *data
,
316 struct audit_entry
*entry
;
317 struct task_struct
*tsk
;
324 /* We can't just spew out the rules here because we might fill
325 * the available socket buffer space and deadlock waiting for
326 * auditctl to read from it... which isn't ever going to
327 * happen if we're actually running in the context of auditctl
328 * trying to _send_ the stuff */
330 dest
= kmalloc(2 * sizeof(int), GFP_KERNEL
);
336 tsk
= kthread_run(audit_list_rules
, dest
, "audit_list_rules");
343 if (!(entry
= kmalloc(sizeof(*entry
), GFP_KERNEL
)))
345 if (audit_copy_rule(&entry
->rule
, data
)) {
349 listnr
= entry
->rule
.flags
& ~AUDIT_FILTER_PREPEND
;
350 audit_add_rule(entry
, &audit_filter_list
[listnr
]);
351 audit_log(NULL
, GFP_KERNEL
, AUDIT_CONFIG_CHANGE
,
352 "auid=%u added an audit rule\n", loginuid
);
355 listnr
=((struct audit_rule
*)data
)->flags
& ~AUDIT_FILTER_PREPEND
;
356 if (listnr
>= AUDIT_NR_FILTERS
)
359 err
= audit_del_rule(data
, &audit_filter_list
[listnr
]);
361 audit_log(NULL
, GFP_KERNEL
, AUDIT_CONFIG_CHANGE
,
362 "auid=%u removed an audit rule\n", loginuid
);
371 /* Compare a task_struct with an audit_rule. Return 1 on match, 0
373 static int audit_filter_rules(struct task_struct
*tsk
,
374 struct audit_rule
*rule
,
375 struct audit_context
*ctx
,
376 enum audit_state
*state
)
380 for (i
= 0; i
< rule
->field_count
; i
++) {
381 u32 field
= rule
->fields
[i
] & ~AUDIT_NEGATE
;
382 u32 value
= rule
->values
[i
];
387 result
= (tsk
->pid
== value
);
390 result
= (tsk
->uid
== value
);
393 result
= (tsk
->euid
== value
);
396 result
= (tsk
->suid
== value
);
399 result
= (tsk
->fsuid
== value
);
402 result
= (tsk
->gid
== value
);
405 result
= (tsk
->egid
== value
);
408 result
= (tsk
->sgid
== value
);
411 result
= (tsk
->fsgid
== value
);
414 result
= (tsk
->personality
== value
);
418 result
= (ctx
->arch
== value
);
422 if (ctx
&& ctx
->return_valid
)
423 result
= (ctx
->return_code
== value
);
426 if (ctx
&& ctx
->return_valid
)
427 result
= (ctx
->return_valid
== AUDITSC_SUCCESS
);
431 for (j
= 0; j
< ctx
->name_count
; j
++) {
432 if (MAJOR(ctx
->names
[j
].dev
)==value
) {
441 for (j
= 0; j
< ctx
->name_count
; j
++) {
442 if (MINOR(ctx
->names
[j
].dev
)==value
) {
451 for (j
= 0; j
< ctx
->name_count
; j
++) {
452 if (ctx
->names
[j
].ino
== value
) {
462 result
= (ctx
->loginuid
== value
);
469 result
= (ctx
->argv
[field
-AUDIT_ARG0
]==value
);
473 if (rule
->fields
[i
] & AUDIT_NEGATE
)
478 switch (rule
->action
) {
479 case AUDIT_NEVER
: *state
= AUDIT_DISABLED
; break;
480 case AUDIT_POSSIBLE
: *state
= AUDIT_BUILD_CONTEXT
; break;
481 case AUDIT_ALWAYS
: *state
= AUDIT_RECORD_CONTEXT
; break;
486 /* At process creation time, we can determine if system-call auditing is
487 * completely disabled for this task. Since we only have the task
488 * structure at this point, we can only check uid and gid.
490 static enum audit_state
audit_filter_task(struct task_struct
*tsk
)
492 struct audit_entry
*e
;
493 enum audit_state state
;
496 list_for_each_entry_rcu(e
, &audit_filter_list
[AUDIT_FILTER_TASK
], list
) {
497 if (audit_filter_rules(tsk
, &e
->rule
, NULL
, &state
)) {
503 return AUDIT_BUILD_CONTEXT
;
506 /* At syscall entry and exit time, this filter is called if the
507 * audit_state is not low enough that auditing cannot take place, but is
508 * also not high enough that we already know we have to write an audit
509 * record (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT).
511 static enum audit_state
audit_filter_syscall(struct task_struct
*tsk
,
512 struct audit_context
*ctx
,
513 struct list_head
*list
)
515 struct audit_entry
*e
;
516 enum audit_state state
;
517 int word
= AUDIT_WORD(ctx
->major
);
518 int bit
= AUDIT_BIT(ctx
->major
);
520 if (audit_pid
&& tsk
->tgid
== audit_pid
)
521 return AUDIT_DISABLED
;
524 list_for_each_entry_rcu(e
, list
, list
) {
525 if ((e
->rule
.mask
[word
] & bit
) == bit
526 && audit_filter_rules(tsk
, &e
->rule
, ctx
, &state
)) {
532 return AUDIT_BUILD_CONTEXT
;
535 static int audit_filter_user_rules(struct netlink_skb_parms
*cb
,
536 struct audit_rule
*rule
,
537 enum audit_state
*state
)
541 for (i
= 0; i
< rule
->field_count
; i
++) {
542 u32 field
= rule
->fields
[i
] & ~AUDIT_NEGATE
;
543 u32 value
= rule
->values
[i
];
548 result
= (cb
->creds
.pid
== value
);
551 result
= (cb
->creds
.uid
== value
);
554 result
= (cb
->creds
.gid
== value
);
557 result
= (cb
->loginuid
== value
);
561 if (rule
->fields
[i
] & AUDIT_NEGATE
)
566 switch (rule
->action
) {
567 case AUDIT_NEVER
: *state
= AUDIT_DISABLED
; break;
568 case AUDIT_POSSIBLE
: *state
= AUDIT_BUILD_CONTEXT
; break;
569 case AUDIT_ALWAYS
: *state
= AUDIT_RECORD_CONTEXT
; break;
574 int audit_filter_user(struct netlink_skb_parms
*cb
, int type
)
576 struct audit_entry
*e
;
577 enum audit_state state
;
581 list_for_each_entry_rcu(e
, &audit_filter_list
[AUDIT_FILTER_USER
], list
) {
582 if (audit_filter_user_rules(cb
, &e
->rule
, &state
)) {
583 if (state
== AUDIT_DISABLED
)
590 return ret
; /* Audit by default */
593 /* This should be called with task_lock() held. */
594 static inline struct audit_context
*audit_get_context(struct task_struct
*tsk
,
598 struct audit_context
*context
= tsk
->audit_context
;
600 if (likely(!context
))
602 context
->return_valid
= return_valid
;
603 context
->return_code
= return_code
;
605 if (context
->in_syscall
&& !context
->auditable
) {
606 enum audit_state state
;
607 state
= audit_filter_syscall(tsk
, context
, &audit_filter_list
[AUDIT_FILTER_EXIT
]);
608 if (state
== AUDIT_RECORD_CONTEXT
)
609 context
->auditable
= 1;
612 context
->pid
= tsk
->pid
;
613 context
->uid
= tsk
->uid
;
614 context
->gid
= tsk
->gid
;
615 context
->euid
= tsk
->euid
;
616 context
->suid
= tsk
->suid
;
617 context
->fsuid
= tsk
->fsuid
;
618 context
->egid
= tsk
->egid
;
619 context
->sgid
= tsk
->sgid
;
620 context
->fsgid
= tsk
->fsgid
;
621 context
->personality
= tsk
->personality
;
622 tsk
->audit_context
= NULL
;
626 static inline void audit_free_names(struct audit_context
*context
)
631 if (context
->auditable
632 ||context
->put_count
+ context
->ino_count
!= context
->name_count
) {
633 printk(KERN_ERR
"audit.c:%d(:%d): major=%d in_syscall=%d"
634 " name_count=%d put_count=%d"
635 " ino_count=%d [NOT freeing]\n",
637 context
->serial
, context
->major
, context
->in_syscall
,
638 context
->name_count
, context
->put_count
,
640 for (i
= 0; i
< context
->name_count
; i
++)
641 printk(KERN_ERR
"names[%d] = %p = %s\n", i
,
642 context
->names
[i
].name
,
643 context
->names
[i
].name
);
649 context
->put_count
= 0;
650 context
->ino_count
= 0;
653 for (i
= 0; i
< context
->name_count
; i
++)
654 if (context
->names
[i
].name
)
655 __putname(context
->names
[i
].name
);
656 context
->name_count
= 0;
660 mntput(context
->pwdmnt
);
662 context
->pwdmnt
= NULL
;
665 static inline void audit_free_aux(struct audit_context
*context
)
667 struct audit_aux_data
*aux
;
669 while ((aux
= context
->aux
)) {
670 if (aux
->type
== AUDIT_AVC_PATH
) {
671 struct audit_aux_data_path
*axi
= (void *)aux
;
675 context
->aux
= aux
->next
;
680 static inline void audit_zero_context(struct audit_context
*context
,
681 enum audit_state state
)
683 uid_t loginuid
= context
->loginuid
;
685 memset(context
, 0, sizeof(*context
));
686 context
->state
= state
;
687 context
->loginuid
= loginuid
;
690 static inline struct audit_context
*audit_alloc_context(enum audit_state state
)
692 struct audit_context
*context
;
694 if (!(context
= kmalloc(sizeof(*context
), GFP_KERNEL
)))
696 audit_zero_context(context
, state
);
700 /* Filter on the task information and allocate a per-task audit context
701 * if necessary. Doing so turns on system call auditing for the
702 * specified task. This is called from copy_process, so no lock is
704 int audit_alloc(struct task_struct
*tsk
)
706 struct audit_context
*context
;
707 enum audit_state state
;
709 if (likely(!audit_enabled
))
710 return 0; /* Return if not auditing. */
712 state
= audit_filter_task(tsk
);
713 if (likely(state
== AUDIT_DISABLED
))
716 if (!(context
= audit_alloc_context(state
))) {
717 audit_log_lost("out of memory in audit_alloc");
721 /* Preserve login uid */
722 context
->loginuid
= -1;
723 if (current
->audit_context
)
724 context
->loginuid
= current
->audit_context
->loginuid
;
726 tsk
->audit_context
= context
;
727 set_tsk_thread_flag(tsk
, TIF_SYSCALL_AUDIT
);
731 static inline void audit_free_context(struct audit_context
*context
)
733 struct audit_context
*previous
;
737 previous
= context
->previous
;
738 if (previous
|| (count
&& count
< 10)) {
740 printk(KERN_ERR
"audit(:%d): major=%d name_count=%d:"
741 " freeing multiple contexts (%d)\n",
742 context
->serial
, context
->major
,
743 context
->name_count
, count
);
745 audit_free_names(context
);
746 audit_free_aux(context
);
751 printk(KERN_ERR
"audit: freed %d contexts\n", count
);
754 static void audit_log_task_info(struct audit_buffer
*ab
)
756 char name
[sizeof(current
->comm
)];
757 struct mm_struct
*mm
= current
->mm
;
758 struct vm_area_struct
*vma
;
760 get_task_comm(name
, current
);
761 audit_log_format(ab
, " comm=");
762 audit_log_untrustedstring(ab
, name
);
767 down_read(&mm
->mmap_sem
);
770 if ((vma
->vm_flags
& VM_EXECUTABLE
) &&
772 audit_log_d_path(ab
, "exe=",
773 vma
->vm_file
->f_dentry
,
774 vma
->vm_file
->f_vfsmnt
);
779 up_read(&mm
->mmap_sem
);
782 static void audit_log_exit(struct audit_context
*context
, unsigned int gfp_mask
)
785 struct audit_buffer
*ab
;
786 struct audit_aux_data
*aux
;
788 ab
= audit_log_start(context
, gfp_mask
, AUDIT_SYSCALL
);
790 return; /* audit_panic has been called */
791 audit_log_format(ab
, "arch=%x syscall=%d",
792 context
->arch
, context
->major
);
793 if (context
->personality
!= PER_LINUX
)
794 audit_log_format(ab
, " per=%lx", context
->personality
);
795 if (context
->return_valid
)
796 audit_log_format(ab
, " success=%s exit=%ld",
797 (context
->return_valid
==AUDITSC_SUCCESS
)?"yes":"no",
798 context
->return_code
);
800 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d"
801 " pid=%d auid=%u uid=%u gid=%u"
802 " euid=%u suid=%u fsuid=%u"
803 " egid=%u sgid=%u fsgid=%u",
813 context
->euid
, context
->suid
, context
->fsuid
,
814 context
->egid
, context
->sgid
, context
->fsgid
);
815 audit_log_task_info(ab
);
818 for (aux
= context
->aux
; aux
; aux
= aux
->next
) {
820 ab
= audit_log_start(context
, GFP_KERNEL
, aux
->type
);
822 continue; /* audit_panic has been called */
826 struct audit_aux_data_ipcctl
*axi
= (void *)aux
;
828 " qbytes=%lx iuid=%u igid=%u mode=%x",
829 axi
->qbytes
, axi
->uid
, axi
->gid
, axi
->mode
);
832 case AUDIT_SOCKETCALL
: {
834 struct audit_aux_data_socketcall
*axs
= (void *)aux
;
835 audit_log_format(ab
, "nargs=%d", axs
->nargs
);
836 for (i
=0; i
<axs
->nargs
; i
++)
837 audit_log_format(ab
, " a%d=%lx", i
, axs
->args
[i
]);
840 case AUDIT_SOCKADDR
: {
841 struct audit_aux_data_sockaddr
*axs
= (void *)aux
;
843 audit_log_format(ab
, "saddr=");
844 audit_log_hex(ab
, axs
->a
, axs
->len
);
847 case AUDIT_AVC_PATH
: {
848 struct audit_aux_data_path
*axi
= (void *)aux
;
849 audit_log_d_path(ab
, "path=", axi
->dentry
, axi
->mnt
);
856 if (context
->pwd
&& context
->pwdmnt
) {
857 ab
= audit_log_start(context
, GFP_KERNEL
, AUDIT_CWD
);
859 audit_log_d_path(ab
, "cwd=", context
->pwd
, context
->pwdmnt
);
863 for (i
= 0; i
< context
->name_count
; i
++) {
864 ab
= audit_log_start(context
, GFP_KERNEL
, AUDIT_PATH
);
866 continue; /* audit_panic has been called */
868 audit_log_format(ab
, "item=%d", i
);
869 if (context
->names
[i
].name
) {
870 audit_log_format(ab
, " name=");
871 audit_log_untrustedstring(ab
, context
->names
[i
].name
);
873 audit_log_format(ab
, " flags=%x\n", context
->names
[i
].flags
);
875 if (context
->names
[i
].ino
!= (unsigned long)-1)
876 audit_log_format(ab
, " inode=%lu dev=%02x:%02x mode=%#o"
877 " ouid=%u ogid=%u rdev=%02x:%02x",
878 context
->names
[i
].ino
,
879 MAJOR(context
->names
[i
].dev
),
880 MINOR(context
->names
[i
].dev
),
881 context
->names
[i
].mode
,
882 context
->names
[i
].uid
,
883 context
->names
[i
].gid
,
884 MAJOR(context
->names
[i
].rdev
),
885 MINOR(context
->names
[i
].rdev
));
890 /* Free a per-task audit context. Called from copy_process and
891 * __put_task_struct. */
892 void audit_free(struct task_struct
*tsk
)
894 struct audit_context
*context
;
897 context
= audit_get_context(tsk
, 0, 0);
900 if (likely(!context
))
903 /* Check for system calls that do not go through the exit
904 * function (e.g., exit_group), then free context block.
905 * We use GFP_ATOMIC here because we might be doing this
906 * in the context of the idle thread */
907 if (context
->in_syscall
&& context
->auditable
)
908 audit_log_exit(context
, GFP_ATOMIC
);
910 audit_free_context(context
);
913 /* Fill in audit context at syscall entry. This only happens if the
914 * audit context was created when the task was created and the state or
915 * filters demand the audit context be built. If the state from the
916 * per-task filter or from the per-syscall filter is AUDIT_RECORD_CONTEXT,
917 * then the record will be written at syscall exit time (otherwise, it
918 * will only be written if another part of the kernel requests that it
920 void audit_syscall_entry(struct task_struct
*tsk
, int arch
, int major
,
921 unsigned long a1
, unsigned long a2
,
922 unsigned long a3
, unsigned long a4
)
924 struct audit_context
*context
= tsk
->audit_context
;
925 enum audit_state state
;
929 /* This happens only on certain architectures that make system
930 * calls in kernel_thread via the entry.S interface, instead of
931 * with direct calls. (If you are porting to a new
932 * architecture, hitting this condition can indicate that you
933 * got the _exit/_leave calls backward in entry.S.)
937 * ppc64 yes (see arch/ppc64/kernel/misc.S)
939 * This also happens with vm86 emulation in a non-nested manner
940 * (entries without exits), so this case must be caught.
942 if (context
->in_syscall
) {
943 struct audit_context
*newctx
;
945 #if defined(__NR_vm86) && defined(__NR_vm86old)
946 /* vm86 mode should only be entered once */
947 if (major
== __NR_vm86
|| major
== __NR_vm86old
)
952 "audit(:%d) pid=%d in syscall=%d;"
953 " entering syscall=%d\n",
954 context
->serial
, tsk
->pid
, context
->major
, major
);
956 newctx
= audit_alloc_context(context
->state
);
958 newctx
->previous
= context
;
960 tsk
->audit_context
= newctx
;
962 /* If we can't alloc a new context, the best we
963 * can do is to leak memory (any pending putname
964 * will be lost). The only other alternative is
965 * to abandon auditing. */
966 audit_zero_context(context
, context
->state
);
969 BUG_ON(context
->in_syscall
|| context
->name_count
);
974 context
->arch
= arch
;
975 context
->major
= major
;
976 context
->argv
[0] = a1
;
977 context
->argv
[1] = a2
;
978 context
->argv
[2] = a3
;
979 context
->argv
[3] = a4
;
981 state
= context
->state
;
982 if (state
== AUDIT_SETUP_CONTEXT
|| state
== AUDIT_BUILD_CONTEXT
)
983 state
= audit_filter_syscall(tsk
, context
, &audit_filter_list
[AUDIT_FILTER_ENTRY
]);
984 if (likely(state
== AUDIT_DISABLED
))
988 context
->ctime
= CURRENT_TIME
;
989 context
->in_syscall
= 1;
990 context
->auditable
= !!(state
== AUDIT_RECORD_CONTEXT
);
993 /* Tear down after system call. If the audit context has been marked as
994 * auditable (either because of the AUDIT_RECORD_CONTEXT state from
995 * filtering, or because some other part of the kernel write an audit
996 * message), then write out the syscall information. In call cases,
997 * free the names stored from getname(). */
998 void audit_syscall_exit(struct task_struct
*tsk
, int valid
, long return_code
)
1000 struct audit_context
*context
;
1002 get_task_struct(tsk
);
1004 context
= audit_get_context(tsk
, valid
, return_code
);
1007 /* Not having a context here is ok, since the parent may have
1008 * called __put_task_struct. */
1009 if (likely(!context
))
1012 if (context
->in_syscall
&& context
->auditable
)
1013 audit_log_exit(context
, GFP_KERNEL
);
1015 context
->in_syscall
= 0;
1016 context
->auditable
= 0;
1018 if (context
->previous
) {
1019 struct audit_context
*new_context
= context
->previous
;
1020 context
->previous
= NULL
;
1021 audit_free_context(context
);
1022 tsk
->audit_context
= new_context
;
1024 audit_free_names(context
);
1025 audit_free_aux(context
);
1026 audit_zero_context(context
, context
->state
);
1027 tsk
->audit_context
= context
;
1029 put_task_struct(tsk
);
1032 /* Add a name to the list. Called from fs/namei.c:getname(). */
1033 void audit_getname(const char *name
)
1035 struct audit_context
*context
= current
->audit_context
;
1037 if (!context
|| IS_ERR(name
) || !name
)
1040 if (!context
->in_syscall
) {
1041 #if AUDIT_DEBUG == 2
1042 printk(KERN_ERR
"%s:%d(:%d): ignoring getname(%p)\n",
1043 __FILE__
, __LINE__
, context
->serial
, name
);
1048 BUG_ON(context
->name_count
>= AUDIT_NAMES
);
1049 context
->names
[context
->name_count
].name
= name
;
1050 context
->names
[context
->name_count
].ino
= (unsigned long)-1;
1051 ++context
->name_count
;
1052 if (!context
->pwd
) {
1053 read_lock(¤t
->fs
->lock
);
1054 context
->pwd
= dget(current
->fs
->pwd
);
1055 context
->pwdmnt
= mntget(current
->fs
->pwdmnt
);
1056 read_unlock(¤t
->fs
->lock
);
1061 /* Intercept a putname request. Called from
1062 * include/linux/fs.h:putname(). If we have stored the name from
1063 * getname in the audit context, then we delay the putname until syscall
1065 void audit_putname(const char *name
)
1067 struct audit_context
*context
= current
->audit_context
;
1070 if (!context
->in_syscall
) {
1071 #if AUDIT_DEBUG == 2
1072 printk(KERN_ERR
"%s:%d(:%d): __putname(%p)\n",
1073 __FILE__
, __LINE__
, context
->serial
, name
);
1074 if (context
->name_count
) {
1076 for (i
= 0; i
< context
->name_count
; i
++)
1077 printk(KERN_ERR
"name[%d] = %p = %s\n", i
,
1078 context
->names
[i
].name
,
1079 context
->names
[i
].name
);
1086 ++context
->put_count
;
1087 if (context
->put_count
> context
->name_count
) {
1088 printk(KERN_ERR
"%s:%d(:%d): major=%d"
1089 " in_syscall=%d putname(%p) name_count=%d"
1092 context
->serial
, context
->major
,
1093 context
->in_syscall
, name
, context
->name_count
,
1094 context
->put_count
);
1101 /* Store the inode and device from a lookup. Called from
1102 * fs/namei.c:path_lookup(). */
1103 void audit_inode(const char *name
, const struct inode
*inode
, unsigned flags
)
1106 struct audit_context
*context
= current
->audit_context
;
1108 if (!context
->in_syscall
)
1110 if (context
->name_count
1111 && context
->names
[context
->name_count
-1].name
1112 && context
->names
[context
->name_count
-1].name
== name
)
1113 idx
= context
->name_count
- 1;
1114 else if (context
->name_count
> 1
1115 && context
->names
[context
->name_count
-2].name
1116 && context
->names
[context
->name_count
-2].name
== name
)
1117 idx
= context
->name_count
- 2;
1119 /* FIXME: how much do we care about inodes that have no
1120 * associated name? */
1121 if (context
->name_count
>= AUDIT_NAMES
- AUDIT_NAMES_RESERVED
)
1123 idx
= context
->name_count
++;
1124 context
->names
[idx
].name
= NULL
;
1126 ++context
->ino_count
;
1129 context
->names
[idx
].flags
= flags
;
1130 context
->names
[idx
].ino
= inode
->i_ino
;
1131 context
->names
[idx
].dev
= inode
->i_sb
->s_dev
;
1132 context
->names
[idx
].mode
= inode
->i_mode
;
1133 context
->names
[idx
].uid
= inode
->i_uid
;
1134 context
->names
[idx
].gid
= inode
->i_gid
;
1135 context
->names
[idx
].rdev
= inode
->i_rdev
;
1138 void auditsc_get_stamp(struct audit_context
*ctx
,
1139 struct timespec
*t
, unsigned int *serial
)
1142 ctx
->serial
= audit_serial();
1143 t
->tv_sec
= ctx
->ctime
.tv_sec
;
1144 t
->tv_nsec
= ctx
->ctime
.tv_nsec
;
1145 *serial
= ctx
->serial
;
1149 int audit_set_loginuid(struct task_struct
*task
, uid_t loginuid
)
1151 if (task
->audit_context
) {
1152 struct audit_buffer
*ab
;
1154 ab
= audit_log_start(NULL
, GFP_KERNEL
, AUDIT_LOGIN
);
1156 audit_log_format(ab
, "login pid=%d uid=%u "
1157 "old auid=%u new auid=%u",
1158 task
->pid
, task
->uid
,
1159 task
->audit_context
->loginuid
, loginuid
);
1162 task
->audit_context
->loginuid
= loginuid
;
1167 uid_t
audit_get_loginuid(struct audit_context
*ctx
)
1169 return ctx
? ctx
->loginuid
: -1;
1172 int audit_ipc_perms(unsigned long qbytes
, uid_t uid
, gid_t gid
, mode_t mode
)
1174 struct audit_aux_data_ipcctl
*ax
;
1175 struct audit_context
*context
= current
->audit_context
;
1177 if (likely(!context
))
1180 ax
= kmalloc(sizeof(*ax
), GFP_KERNEL
);
1184 ax
->qbytes
= qbytes
;
1189 ax
->d
.type
= AUDIT_IPC
;
1190 ax
->d
.next
= context
->aux
;
1191 context
->aux
= (void *)ax
;
1195 int audit_socketcall(int nargs
, unsigned long *args
)
1197 struct audit_aux_data_socketcall
*ax
;
1198 struct audit_context
*context
= current
->audit_context
;
1200 if (likely(!context
))
1203 ax
= kmalloc(sizeof(*ax
) + nargs
* sizeof(unsigned long), GFP_KERNEL
);
1208 memcpy(ax
->args
, args
, nargs
* sizeof(unsigned long));
1210 ax
->d
.type
= AUDIT_SOCKETCALL
;
1211 ax
->d
.next
= context
->aux
;
1212 context
->aux
= (void *)ax
;
1216 int audit_sockaddr(int len
, void *a
)
1218 struct audit_aux_data_sockaddr
*ax
;
1219 struct audit_context
*context
= current
->audit_context
;
1221 if (likely(!context
))
1224 ax
= kmalloc(sizeof(*ax
) + len
, GFP_KERNEL
);
1229 memcpy(ax
->a
, a
, len
);
1231 ax
->d
.type
= AUDIT_SOCKADDR
;
1232 ax
->d
.next
= context
->aux
;
1233 context
->aux
= (void *)ax
;
1237 int audit_avc_path(struct dentry
*dentry
, struct vfsmount
*mnt
)
1239 struct audit_aux_data_path
*ax
;
1240 struct audit_context
*context
= current
->audit_context
;
1242 if (likely(!context
))
1245 ax
= kmalloc(sizeof(*ax
), GFP_ATOMIC
);
1249 ax
->dentry
= dget(dentry
);
1250 ax
->mnt
= mntget(mnt
);
1252 ax
->d
.type
= AUDIT_AVC_PATH
;
1253 ax
->d
.next
= context
->aux
;
1254 context
->aux
= (void *)ax
;
1258 void audit_signal_info(int sig
, struct task_struct
*t
)
1260 extern pid_t audit_sig_pid
;
1261 extern uid_t audit_sig_uid
;
1263 if (unlikely(audit_pid
&& t
->tgid
== audit_pid
)) {
1264 if (sig
== SIGTERM
|| sig
== SIGHUP
) {
1265 struct audit_context
*ctx
= current
->audit_context
;
1266 audit_sig_pid
= current
->pid
;
1268 audit_sig_uid
= ctx
->loginuid
;
1270 audit_sig_uid
= current
->uid
;