[PATCH] support for context based audit filtering, part 2

[deliverable/linux.git] / kernel / audit.c

diff --git a/kernel/audit.c b/kernel/audit.c
index 973ca5a9e0d65c1244eb2c4262d8ecadbee6c7a6..9060be750c48151f6f61a67c9f0eb344fb11a583 100644 (file)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -52,8 +52,12 @@
 #include <linux/audit.h>
 
 #include <net/sock.h>
+#include <net/netlink.h>
 #include <linux/skbuff.h>
 #include <linux/netlink.h>
+#include <linux/selinux.h>
+
+#include "audit.h"
 
 /* No auditing will take place until audit_initialized != 0.
  * (Initialization happens after skb_init is called.) */
@@ -113,7 +117,7 @@ static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
 /* The netlink socket is only to be read by 1 CPU, which lets us assume
  * that list additions and deletions never happen simultaneously in
  * auditsc.c */
-DECLARE_MUTEX(audit_netlink_sem);
+DEFINE_MUTEX(audit_netlink_mutex);
 
 /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
  * audit records.  Since printk uses a 1024 byte buffer, this buffer
@@ -142,7 +146,7 @@ static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
        nlh->nlmsg_pid = pid;
 }
 
-static void audit_panic(const char *message)
+void audit_panic(const char *message)
 {
        switch (audit_failure)
        {
@@ -305,6 +309,7 @@ static int kauditd_thread(void *dummy)
                        remove_wait_queue(&kauditd_wait, &wait);
                }
        }
+       return 0;
 }
 
 /**
@@ -360,15 +365,19 @@ static int audit_netlink_ok(kernel_cap_t eff_cap, u16 msg_type)
        switch (msg_type) {
        case AUDIT_GET:
        case AUDIT_LIST:
+       case AUDIT_LIST_RULES:
        case AUDIT_SET:
        case AUDIT_ADD:
+       case AUDIT_ADD_RULE:
        case AUDIT_DEL:
+       case AUDIT_DEL_RULE:
        case AUDIT_SIGNAL_INFO:
                if (!cap_raised(eff_cap, CAP_AUDIT_CONTROL))
                        err = -EPERM;
                break;
        case AUDIT_USER:
        case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG:
+       case AUDIT_FIRST_USER_MSG2...AUDIT_LAST_USER_MSG2:
                if (!cap_raised(eff_cap, CAP_AUDIT_WRITE))
                        err = -EPERM;
                break;
@@ -449,6 +458,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                break;
        case AUDIT_USER:
        case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG:
+       case AUDIT_FIRST_USER_MSG2...AUDIT_LAST_USER_MSG2:
                if (!audit_enabled && msg_type != AUDIT_USER_AVC)
                        return 0;
 
@@ -467,12 +477,23 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                break;
        case AUDIT_ADD:
        case AUDIT_DEL:
-               if (nlh->nlmsg_len < sizeof(struct audit_rule))
+               if (nlmsg_len(nlh) < sizeof(struct audit_rule))
                        return -EINVAL;
                /* fallthrough */
        case AUDIT_LIST:
                err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
-                                          uid, seq, data, loginuid);
+                                          uid, seq, data, nlmsg_len(nlh),
+                                          loginuid);
+               break;
+       case AUDIT_ADD_RULE:
+       case AUDIT_DEL_RULE:
+               if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
+                       return -EINVAL;
+               /* fallthrough */
+       case AUDIT_LIST_RULES:
+               err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
+                                          uid, seq, data, nlmsg_len(nlh),
+                                          loginuid);
                break;
        case AUDIT_SIGNAL_INFO:
                sig_data.uid = audit_sig_uid;
@@ -520,14 +541,14 @@ static void audit_receive(struct sock *sk, int length)
        struct sk_buff  *skb;
        unsigned int qlen;
 
-       down(&audit_netlink_sem);
+       mutex_lock(&audit_netlink_mutex);
 
        for (qlen = skb_queue_len(&sk->sk_receive_queue); qlen; qlen--) {
                skb = skb_dequeue(&sk->sk_receive_queue);
                audit_receive_skb(skb);
                kfree_skb(skb);
        }
-       up(&audit_netlink_sem);
+       mutex_unlock(&audit_netlink_mutex);
 }
 
 
@@ -540,11 +561,17 @@ static int __init audit_init(void)
                                           THIS_MODULE);
        if (!audit_sock)
                audit_panic("cannot initialize netlink socket");
+       else
+               audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
 
-       audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
        skb_queue_head_init(&audit_skb_queue);
        audit_initialized = 1;
        audit_enabled = audit_default;
+
+       /* Register the callback with selinux.  This callback will be invoked
+        * when a new policy is loaded. */
+       selinux_audit_set_callback(&selinux_audit_rule_update);
+
        audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
        return 0;
 }
@@ -559,7 +586,7 @@ static int __init audit_enable(char *str)
               audit_initialized ? "" : " (after initialization)");
        if (audit_initialized)
                audit_enabled = audit_default;
-       return 0;
+       return 1;
 }
 
 __setup("audit=", audit_enable);
@@ -700,6 +727,9 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
        if (!audit_initialized)
                return NULL;
 
+       if (unlikely(audit_filter_type(type)))
+               return NULL;
+
        if (gfp_mask & __GFP_WAIT)
                reserve = 0;
        else
@@ -973,3 +1003,8 @@ void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
                audit_log_end(ab);
        }
 }
+
+EXPORT_SYMBOL(audit_log_start);
+EXPORT_SYMBOL(audit_log_end);
+EXPORT_SYMBOL(audit_log_format);
+EXPORT_SYMBOL(audit_log);