1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
45
46#include <linux/file.h>
47#include <linux/init.h>
48#include <linux/types.h>
49#include <linux/atomic.h>
50#include <linux/mm.h>
51#include <linux/export.h>
52#include <linux/slab.h>
53#include <linux/err.h>
54#include <linux/kthread.h>
55#include <linux/kernel.h>
56#include <linux/syscalls.h>
57
58#include <linux/audit.h>
59
60#include <net/sock.h>
61#include <net/netlink.h>
62#include <linux/skbuff.h>
63#ifdef CONFIG_SECURITY
64#include <linux/security.h>
65#endif
66#include <linux/freezer.h>
67#include <linux/tty.h>
68#include <linux/pid_namespace.h>
69#include <net/netns/generic.h>
70
71#include "audit.h"
72
73
74
75#define AUDIT_DISABLED -1
76#define AUDIT_UNINITIALIZED 0
77#define AUDIT_INITIALIZED 1
78static int audit_initialized;
79
80#define AUDIT_OFF 0
81#define AUDIT_ON 1
82#define AUDIT_LOCKED 2
83u32 audit_enabled;
84u32 audit_ever_enabled;
85
86EXPORT_SYMBOL_GPL(audit_enabled);
87
88
89static u32 audit_default;
90
91
92static u32 audit_failure = AUDIT_FAIL_PRINTK;
93
94
95
96
97
98
99int audit_pid;
100static __u32 audit_nlk_portid;
101
102
103
104
105static u32 audit_rate_limit;
106
107
108
109static u32 audit_backlog_limit = 64;
110#define AUDIT_BACKLOG_WAIT_TIME (60 * HZ)
111static u32 audit_backlog_wait_time_master = AUDIT_BACKLOG_WAIT_TIME;
112static u32 audit_backlog_wait_time = AUDIT_BACKLOG_WAIT_TIME;
113static u32 audit_backlog_wait_overflow = 0;
114
115
116kuid_t audit_sig_uid = INVALID_UID;
117pid_t audit_sig_pid = -1;
118u32 audit_sig_sid = 0;
119
120
121
122
123
124
125
126
127static atomic_t audit_lost = ATOMIC_INIT(0);
128
129
130static struct sock *audit_sock;
131static int audit_net_id;
132
133
134struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
135
136
137
138
139static DEFINE_SPINLOCK(audit_freelist_lock);
140static int audit_freelist_count;
141static LIST_HEAD(audit_freelist);
142
143static struct sk_buff_head audit_skb_queue;
144
145static struct sk_buff_head audit_skb_hold_queue;
146static struct task_struct *kauditd_task;
147static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
148static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
149
150static struct audit_features af = {.vers = AUDIT_FEATURE_VERSION,
151 .mask = -1,
152 .features = 0,
153 .lock = 0,};
154
155static char *audit_feature_names[2] = {
156 "only_unset_loginuid",
157 "loginuid_immutable",
158};
159
160
161
162DEFINE_MUTEX(audit_cmd_mutex);
163
164
165
166
167#define AUDIT_BUFSIZ 1024
168
169
170
171#define AUDIT_MAXFREE (2*NR_CPUS)
172
173
174
175
176
177
178struct audit_buffer {
179 struct list_head list;
180 struct sk_buff *skb;
181 struct audit_context *ctx;
182 gfp_t gfp_mask;
183};
184
185struct audit_reply {
186 __u32 portid;
187 struct net *net;
188 struct sk_buff *skb;
189};
190
191static void audit_set_portid(struct audit_buffer *ab, __u32 portid)
192{
193 if (ab) {
194 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
195 nlh->nlmsg_pid = portid;
196 }
197}
198
199void audit_panic(const char *message)
200{
201 switch (audit_failure) {
202 case AUDIT_FAIL_SILENT:
203 break;
204 case AUDIT_FAIL_PRINTK:
205 if (printk_ratelimit())
206 pr_err("%s\n", message);
207 break;
208 case AUDIT_FAIL_PANIC:
209
210 if (audit_pid)
211 panic("audit: %s\n", message);
212 break;
213 }
214}
215
216static inline int audit_rate_check(void)
217{
218 static unsigned long last_check = 0;
219 static int messages = 0;
220 static DEFINE_SPINLOCK(lock);
221 unsigned long flags;
222 unsigned long now;
223 unsigned long elapsed;
224 int retval = 0;
225
226 if (!audit_rate_limit) return 1;
227
228 spin_lock_irqsave(&lock, flags);
229 if (++messages < audit_rate_limit) {
230 retval = 1;
231 } else {
232 now = jiffies;
233 elapsed = now - last_check;
234 if (elapsed > HZ) {
235 last_check = now;
236 messages = 0;
237 retval = 1;
238 }
239 }
240 spin_unlock_irqrestore(&lock, flags);
241
242 return retval;
243}
244
245
246
247
248
249
250
251
252
253void audit_log_lost(const char *message)
254{
255 static unsigned long last_msg = 0;
256 static DEFINE_SPINLOCK(lock);
257 unsigned long flags;
258 unsigned long now;
259 int print;
260
261 atomic_inc(&audit_lost);
262
263 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
264
265 if (!print) {
266 spin_lock_irqsave(&lock, flags);
267 now = jiffies;
268 if (now - last_msg > HZ) {
269 print = 1;
270 last_msg = now;
271 }
272 spin_unlock_irqrestore(&lock, flags);
273 }
274
275 if (print) {
276 if (printk_ratelimit())
277 pr_warn("audit_lost=%u audit_rate_limit=%u audit_backlog_limit=%u\n",
278 atomic_read(&audit_lost),
279 audit_rate_limit,
280 audit_backlog_limit);
281 audit_panic(message);
282 }
283}
284
285static int audit_log_config_change(char *function_name, u32 new, u32 old,
286 int allow_changes)
287{
288 struct audit_buffer *ab;
289 int rc = 0;
290
291 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
292 if (unlikely(!ab))
293 return rc;
294 audit_log_format(ab, "%s=%u old=%u", function_name, new, old);
295 audit_log_session_info(ab);
296 rc = audit_log_task_context(ab);
297 if (rc)
298 allow_changes = 0;
299 audit_log_format(ab, " res=%d", allow_changes);
300 audit_log_end(ab);
301 return rc;
302}
303
304static int audit_do_config_change(char *function_name, u32 *to_change, u32 new)
305{
306 int allow_changes, rc = 0;
307 u32 old = *to_change;
308
309
310 if (audit_enabled == AUDIT_LOCKED)
311 allow_changes = 0;
312 else
313 allow_changes = 1;
314
315 if (audit_enabled != AUDIT_OFF) {
316 rc = audit_log_config_change(function_name, new, old, allow_changes);
317 if (rc)
318 allow_changes = 0;
319 }
320
321
322 if (allow_changes == 1)
323 *to_change = new;
324
325 else if (rc == 0)
326 rc = -EPERM;
327 return rc;
328}
329
330static int audit_set_rate_limit(u32 limit)
331{
332 return audit_do_config_change("audit_rate_limit", &audit_rate_limit, limit);
333}
334
335static int audit_set_backlog_limit(u32 limit)
336{
337 return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit, limit);
338}
339
340static int audit_set_backlog_wait_time(u32 timeout)
341{
342 return audit_do_config_change("audit_backlog_wait_time",
343 &audit_backlog_wait_time_master, timeout);
344}
345
346static int audit_set_enabled(u32 state)
347{
348 int rc;
349 if (state > AUDIT_LOCKED)
350 return -EINVAL;
351
352 rc = audit_do_config_change("audit_enabled", &audit_enabled, state);
353 if (!rc)
354 audit_ever_enabled |= !!state;
355
356 return rc;
357}
358
359static int audit_set_failure(u32 state)
360{
361 if (state != AUDIT_FAIL_SILENT
362 && state != AUDIT_FAIL_PRINTK
363 && state != AUDIT_FAIL_PANIC)
364 return -EINVAL;
365
366 return audit_do_config_change("audit_failure", &audit_failure, state);
367}
368
369
370
371
372
373
374
375
376
377
378static void audit_hold_skb(struct sk_buff *skb)
379{
380 if (audit_default &&
381 (!audit_backlog_limit ||
382 skb_queue_len(&audit_skb_hold_queue) < audit_backlog_limit))
383 skb_queue_tail(&audit_skb_hold_queue, skb);
384 else
385 kfree_skb(skb);
386}
387
388
389
390
391
392static void audit_printk_skb(struct sk_buff *skb)
393{
394 struct nlmsghdr *nlh = nlmsg_hdr(skb);
395 char *data = nlmsg_data(nlh);
396
397 if (nlh->nlmsg_type != AUDIT_EOE) {
398 if (printk_ratelimit())
399 pr_notice("type=%d %s\n", nlh->nlmsg_type, data);
400 else
401 audit_log_lost("printk limit exceeded");
402 }
403
404 audit_hold_skb(skb);
405}
406
407static void kauditd_send_skb(struct sk_buff *skb)
408{
409 int err;
410
411 skb_get(skb);
412 err = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
413 if (err < 0) {
414 BUG_ON(err != -ECONNREFUSED);
415 if (audit_pid) {
416 pr_err("*NO* daemon at audit_pid=%d\n", audit_pid);
417 audit_log_lost("auditd disappeared");
418 audit_pid = 0;
419 audit_sock = NULL;
420 }
421
422 audit_hold_skb(skb);
423 } else
424
425 consume_skb(skb);
426}
427
428
429
430
431
432
433
434static void kauditd_send_multicast_skb(struct sk_buff *skb, gfp_t gfp_mask)
435{
436 struct sk_buff *copy;
437 struct audit_net *aunet = net_generic(&init_net, audit_net_id);
438 struct sock *sock = aunet->nlsk;
439
440 if (!netlink_has_listeners(sock, AUDIT_NLGRP_READLOG))
441 return;
442
443
444
445
446
447
448
449
450
451
452
453 copy = skb_copy(skb, gfp_mask);
454 if (!copy)
455 return;
456
457 nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, gfp_mask);
458}
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475static void flush_hold_queue(void)
476{
477 struct sk_buff *skb;
478
479 if (!audit_default || !audit_pid)
480 return;
481
482 skb = skb_dequeue(&audit_skb_hold_queue);
483 if (likely(!skb))
484 return;
485
486 while (skb && audit_pid) {
487 kauditd_send_skb(skb);
488 skb = skb_dequeue(&audit_skb_hold_queue);
489 }
490
491
492
493
494
495 if (skb)
496 consume_skb(skb);
497}
498
499static int kauditd_thread(void *dummy)
500{
501 set_freezable();
502 while (!kthread_should_stop()) {
503 struct sk_buff *skb;
504
505 flush_hold_queue();
506
507 skb = skb_dequeue(&audit_skb_queue);
508
509 if (skb) {
510 if (skb_queue_len(&audit_skb_queue) <= audit_backlog_limit)
511 wake_up(&audit_backlog_wait);
512 if (audit_pid)
513 kauditd_send_skb(skb);
514 else
515 audit_printk_skb(skb);
516 continue;
517 }
518
519 wait_event_freezable(kauditd_wait, skb_queue_len(&audit_skb_queue));
520 }
521 return 0;
522}
523
524int audit_send_list(void *_dest)
525{
526 struct audit_netlink_list *dest = _dest;
527 struct sk_buff *skb;
528 struct net *net = dest->net;
529 struct audit_net *aunet = net_generic(net, audit_net_id);
530
531
532 mutex_lock(&audit_cmd_mutex);
533 mutex_unlock(&audit_cmd_mutex);
534
535 while ((skb = __skb_dequeue(&dest->q)) != NULL)
536 netlink_unicast(aunet->nlsk, skb, dest->portid, 0);
537
538 put_net(net);
539 kfree(dest);
540
541 return 0;
542}
543
544struct sk_buff *audit_make_reply(__u32 portid, int seq, int type, int done,
545 int multi, const void *payload, int size)
546{
547 struct sk_buff *skb;
548 struct nlmsghdr *nlh;
549 void *data;
550 int flags = multi ? NLM_F_MULTI : 0;
551 int t = done ? NLMSG_DONE : type;
552
553 skb = nlmsg_new(size, GFP_KERNEL);
554 if (!skb)
555 return NULL;
556
557 nlh = nlmsg_put(skb, portid, seq, t, size, flags);
558 if (!nlh)
559 goto out_kfree_skb;
560 data = nlmsg_data(nlh);
561 memcpy(data, payload, size);
562 return skb;
563
564out_kfree_skb:
565 kfree_skb(skb);
566 return NULL;
567}
568
569static int audit_send_reply_thread(void *arg)
570{
571 struct audit_reply *reply = (struct audit_reply *)arg;
572 struct net *net = reply->net;
573 struct audit_net *aunet = net_generic(net, audit_net_id);
574
575 mutex_lock(&audit_cmd_mutex);
576 mutex_unlock(&audit_cmd_mutex);
577
578
579
580 netlink_unicast(aunet->nlsk , reply->skb, reply->portid, 0);
581 put_net(net);
582 kfree(reply);
583 return 0;
584}
585
586
587
588
589
590
591
592
593
594
595
596
597
598static void audit_send_reply(struct sk_buff *request_skb, int seq, int type, int done,
599 int multi, const void *payload, int size)
600{
601 u32 portid = NETLINK_CB(request_skb).portid;
602 struct net *net = sock_net(NETLINK_CB(request_skb).sk);
603 struct sk_buff *skb;
604 struct task_struct *tsk;
605 struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),
606 GFP_KERNEL);
607
608 if (!reply)
609 return;
610
611 skb = audit_make_reply(portid, seq, type, done, multi, payload, size);
612 if (!skb)
613 goto out;
614
615 reply->net = get_net(net);
616 reply->portid = portid;
617 reply->skb = skb;
618
619 tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
620 if (!IS_ERR(tsk))
621 return;
622 kfree_skb(skb);
623out:
624 kfree(reply);
625}
626
627
628
629
630
631static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
632{
633 int err = 0;
634
635
636
637
638
639
640
641
642
643
644
645
646 if (current_user_ns() != &init_user_ns)
647 return -ECONNREFUSED;
648
649 switch (msg_type) {
650 case AUDIT_LIST:
651 case AUDIT_ADD:
652 case AUDIT_DEL:
653 return -EOPNOTSUPP;
654 case AUDIT_GET:
655 case AUDIT_SET:
656 case AUDIT_GET_FEATURE:
657 case AUDIT_SET_FEATURE:
658 case AUDIT_LIST_RULES:
659 case AUDIT_ADD_RULE:
660 case AUDIT_DEL_RULE:
661 case AUDIT_SIGNAL_INFO:
662 case AUDIT_TTY_GET:
663 case AUDIT_TTY_SET:
664 case AUDIT_TRIM:
665 case AUDIT_MAKE_EQUIV:
666
667
668 if (task_active_pid_ns(current) != &init_pid_ns)
669 return -EPERM;
670
671 if (!netlink_capable(skb, CAP_AUDIT_CONTROL))
672 err = -EPERM;
673 break;
674 case AUDIT_USER:
675 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
676 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
677 if (!netlink_capable(skb, CAP_AUDIT_WRITE))
678 err = -EPERM;
679 break;
680 default:
681 err = -EINVAL;
682 }
683
684 return err;
685}
686
687static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type)
688{
689 int rc = 0;
690 uid_t uid = from_kuid(&init_user_ns, current_uid());
691 pid_t pid = task_tgid_nr(current);
692
693 if (!audit_enabled && msg_type != AUDIT_USER_AVC) {
694 *ab = NULL;
695 return rc;
696 }
697
698 *ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
699 if (unlikely(!*ab))
700 return rc;
701 audit_log_format(*ab, "pid=%d uid=%u", pid, uid);
702 audit_log_session_info(*ab);
703 audit_log_task_context(*ab);
704
705 return rc;
706}
707
708int is_audit_feature_set(int i)
709{
710 return af.features & AUDIT_FEATURE_TO_MASK(i);
711}
712
713
714static int audit_get_feature(struct sk_buff *skb)
715{
716 u32 seq;
717
718 seq = nlmsg_hdr(skb)->nlmsg_seq;
719
720 audit_send_reply(skb, seq, AUDIT_GET_FEATURE, 0, 0, &af, sizeof(af));
721
722 return 0;
723}
724
725static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature,
726 u32 old_lock, u32 new_lock, int res)
727{
728 struct audit_buffer *ab;
729
730 if (audit_enabled == AUDIT_OFF)
731 return;
732
733 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_FEATURE_CHANGE);
734 audit_log_task_info(ab, current);
735 audit_log_format(ab, " feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d",
736 audit_feature_names[which], !!old_feature, !!new_feature,
737 !!old_lock, !!new_lock, res);
738 audit_log_end(ab);
739}
740
741static int audit_set_feature(struct sk_buff *skb)
742{
743 struct audit_features *uaf;
744 int i;
745
746 BUILD_BUG_ON(AUDIT_LAST_FEATURE + 1 > ARRAY_SIZE(audit_feature_names));
747 uaf = nlmsg_data(nlmsg_hdr(skb));
748
749
750
751 for (i = 0; i <= AUDIT_LAST_FEATURE; i++) {
752 u32 feature = AUDIT_FEATURE_TO_MASK(i);
753 u32 old_feature, new_feature, old_lock, new_lock;
754
755
756 if (!(feature & uaf->mask))
757 continue;
758
759 old_feature = af.features & feature;
760 new_feature = uaf->features & feature;
761 new_lock = (uaf->lock | af.lock) & feature;
762 old_lock = af.lock & feature;
763
764
765 if (old_lock && (new_feature != old_feature)) {
766 audit_log_feature_change(i, old_feature, new_feature,
767 old_lock, new_lock, 0);
768 return -EPERM;
769 }
770 }
771
772 for (i = 0; i <= AUDIT_LAST_FEATURE; i++) {
773 u32 feature = AUDIT_FEATURE_TO_MASK(i);
774 u32 old_feature, new_feature, old_lock, new_lock;
775
776
777 if (!(feature & uaf->mask))
778 continue;
779
780 old_feature = af.features & feature;
781 new_feature = uaf->features & feature;
782 old_lock = af.lock & feature;
783 new_lock = (uaf->lock | af.lock) & feature;
784
785 if (new_feature != old_feature)
786 audit_log_feature_change(i, old_feature, new_feature,
787 old_lock, new_lock, 1);
788
789 if (new_feature)
790 af.features |= feature;
791 else
792 af.features &= ~feature;
793 af.lock |= new_lock;
794 }
795
796 return 0;
797}
798
799static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
800{
801 u32 seq;
802 void *data;
803 int err;
804 struct audit_buffer *ab;
805 u16 msg_type = nlh->nlmsg_type;
806 struct audit_sig_info *sig_data;
807 char *ctx = NULL;
808 u32 len;
809
810 err = audit_netlink_ok(skb, msg_type);
811 if (err)
812 return err;
813
814
815
816 if (!kauditd_task) {
817 kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
818 if (IS_ERR(kauditd_task)) {
819 err = PTR_ERR(kauditd_task);
820 kauditd_task = NULL;
821 return err;
822 }
823 }
824 seq = nlh->nlmsg_seq;
825 data = nlmsg_data(nlh);
826
827 switch (msg_type) {
828 case AUDIT_GET: {
829 struct audit_status s;
830 memset(&s, 0, sizeof(s));
831 s.enabled = audit_enabled;
832 s.failure = audit_failure;
833 s.pid = audit_pid;
834 s.rate_limit = audit_rate_limit;
835 s.backlog_limit = audit_backlog_limit;
836 s.lost = atomic_read(&audit_lost);
837 s.backlog = skb_queue_len(&audit_skb_queue);
838 s.feature_bitmap = AUDIT_FEATURE_BITMAP_ALL;
839 s.backlog_wait_time = audit_backlog_wait_time_master;
840 audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &s, sizeof(s));
841 break;
842 }
843 case AUDIT_SET: {
844 struct audit_status s;
845 memset(&s, 0, sizeof(s));
846
847 memcpy(&s, data, min_t(size_t, sizeof(s), nlmsg_len(nlh)));
848 if (s.mask & AUDIT_STATUS_ENABLED) {
849 err = audit_set_enabled(s.enabled);
850 if (err < 0)
851 return err;
852 }
853 if (s.mask & AUDIT_STATUS_FAILURE) {
854 err = audit_set_failure(s.failure);
855 if (err < 0)
856 return err;
857 }
858 if (s.mask & AUDIT_STATUS_PID) {
859 int new_pid = s.pid;
860
861 if ((!new_pid) && (task_tgid_vnr(current) != audit_pid))
862 return -EACCES;
863 if (audit_enabled != AUDIT_OFF)
864 audit_log_config_change("audit_pid", new_pid, audit_pid, 1);
865 audit_pid = new_pid;
866 audit_nlk_portid = NETLINK_CB(skb).portid;
867 audit_sock = skb->sk;
868 }
869 if (s.mask & AUDIT_STATUS_RATE_LIMIT) {
870 err = audit_set_rate_limit(s.rate_limit);
871 if (err < 0)
872 return err;
873 }
874 if (s.mask & AUDIT_STATUS_BACKLOG_LIMIT) {
875 err = audit_set_backlog_limit(s.backlog_limit);
876 if (err < 0)
877 return err;
878 }
879 if (s.mask & AUDIT_STATUS_BACKLOG_WAIT_TIME) {
880 if (sizeof(s) > (size_t)nlh->nlmsg_len)
881 return -EINVAL;
882 if (s.backlog_wait_time > 10*AUDIT_BACKLOG_WAIT_TIME)
883 return -EINVAL;
884 err = audit_set_backlog_wait_time(s.backlog_wait_time);
885 if (err < 0)
886 return err;
887 }
888 break;
889 }
890 case AUDIT_GET_FEATURE:
891 err = audit_get_feature(skb);
892 if (err)
893 return err;
894 break;
895 case AUDIT_SET_FEATURE:
896 err = audit_set_feature(skb);
897 if (err)
898 return err;
899 break;
900 case AUDIT_USER:
901 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
902 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
903 if (!audit_enabled && msg_type != AUDIT_USER_AVC)
904 return 0;
905
906 err = audit_filter_user(msg_type);
907 if (err == 1) {
908 err = 0;
909 if (msg_type == AUDIT_USER_TTY) {
910 err = tty_audit_push_current();
911 if (err)
912 break;
913 }
914 mutex_unlock(&audit_cmd_mutex);
915 audit_log_common_recv_msg(&ab, msg_type);
916 if (msg_type != AUDIT_USER_TTY)
917 audit_log_format(ab, " msg='%.*s'",
918 AUDIT_MESSAGE_TEXT_MAX,
919 (char *)data);
920 else {
921 int size;
922
923 audit_log_format(ab, " data=");
924 size = nlmsg_len(nlh);
925 if (size > 0 &&
926 ((unsigned char *)data)[size - 1] == '\0')
927 size--;
928 audit_log_n_untrustedstring(ab, data, size);
929 }
930 audit_set_portid(ab, NETLINK_CB(skb).portid);
931 audit_log_end(ab);
932 mutex_lock(&audit_cmd_mutex);
933 }
934 break;
935 case AUDIT_ADD_RULE:
936 case AUDIT_DEL_RULE:
937 if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
938 return -EINVAL;
939 if (audit_enabled == AUDIT_LOCKED) {
940 audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
941 audit_log_format(ab, " audit_enabled=%d res=0", audit_enabled);
942 audit_log_end(ab);
943 return -EPERM;
944 }
945 err = audit_rule_change(msg_type, NETLINK_CB(skb).portid,
946 seq, data, nlmsg_len(nlh));
947 break;
948 case AUDIT_LIST_RULES:
949 err = audit_list_rules_send(skb, seq);
950 break;
951 case AUDIT_TRIM:
952 audit_trim_trees();
953 audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
954 audit_log_format(ab, " op=trim res=1");
955 audit_log_end(ab);
956 break;
957 case AUDIT_MAKE_EQUIV: {
958 void *bufp = data;
959 u32 sizes[2];
960 size_t msglen = nlmsg_len(nlh);
961 char *old, *new;
962
963 err = -EINVAL;
964 if (msglen < 2 * sizeof(u32))
965 break;
966 memcpy(sizes, bufp, 2 * sizeof(u32));
967 bufp += 2 * sizeof(u32);
968 msglen -= 2 * sizeof(u32);
969 old = audit_unpack_string(&bufp, &msglen, sizes[0]);
970 if (IS_ERR(old)) {
971 err = PTR_ERR(old);
972 break;
973 }
974 new = audit_unpack_string(&bufp, &msglen, sizes[1]);
975 if (IS_ERR(new)) {
976 err = PTR_ERR(new);
977 kfree(old);
978 break;
979 }
980
981 err = audit_tag_tree(old, new);
982
983 audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
984
985 audit_log_format(ab, " op=make_equiv old=");
986 audit_log_untrustedstring(ab, old);
987 audit_log_format(ab, " new=");
988 audit_log_untrustedstring(ab, new);
989 audit_log_format(ab, " res=%d", !err);
990 audit_log_end(ab);
991 kfree(old);
992 kfree(new);
993 break;
994 }
995 case AUDIT_SIGNAL_INFO:
996 len = 0;
997 if (audit_sig_sid) {
998 err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
999 if (err)
1000 return err;
1001 }
1002 sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
1003 if (!sig_data) {
1004 if (audit_sig_sid)
1005 security_release_secctx(ctx, len);
1006 return -ENOMEM;
1007 }
1008 sig_data->uid = from_kuid(&init_user_ns, audit_sig_uid);
1009 sig_data->pid = audit_sig_pid;
1010 if (audit_sig_sid) {
1011 memcpy(sig_data->ctx, ctx, len);
1012 security_release_secctx(ctx, len);
1013 }
1014 audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0,
1015 sig_data, sizeof(*sig_data) + len);
1016 kfree(sig_data);
1017 break;
1018 case AUDIT_TTY_GET: {
1019 struct audit_tty_status s;
1020 struct task_struct *tsk = current;
1021
1022 spin_lock(&tsk->sighand->siglock);
1023 s.enabled = tsk->signal->audit_tty;
1024 s.log_passwd = tsk->signal->audit_tty_log_passwd;
1025 spin_unlock(&tsk->sighand->siglock);
1026
1027 audit_send_reply(skb, seq, AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
1028 break;
1029 }
1030 case AUDIT_TTY_SET: {
1031 struct audit_tty_status s, old;
1032 struct task_struct *tsk = current;
1033 struct audit_buffer *ab;
1034
1035 memset(&s, 0, sizeof(s));
1036
1037 memcpy(&s, data, min_t(size_t, sizeof(s), nlmsg_len(nlh)));
1038
1039 if ((s.enabled != 0 && s.enabled != 1) ||
1040 (s.log_passwd != 0 && s.log_passwd != 1))
1041 err = -EINVAL;
1042
1043 spin_lock(&tsk->sighand->siglock);
1044 old.enabled = tsk->signal->audit_tty;
1045 old.log_passwd = tsk->signal->audit_tty_log_passwd;
1046 if (!err) {
1047 tsk->signal->audit_tty = s.enabled;
1048 tsk->signal->audit_tty_log_passwd = s.log_passwd;
1049 }
1050 spin_unlock(&tsk->sighand->siglock);
1051
1052 audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
1053 audit_log_format(ab, " op=tty_set old-enabled=%d new-enabled=%d"
1054 " old-log_passwd=%d new-log_passwd=%d res=%d",
1055 old.enabled, s.enabled, old.log_passwd,
1056 s.log_passwd, !err);
1057 audit_log_end(ab);
1058 break;
1059 }
1060 default:
1061 err = -EINVAL;
1062 break;
1063 }
1064
1065 return err < 0 ? err : 0;
1066}
1067
1068
1069
1070
1071
1072static void audit_receive_skb(struct sk_buff *skb)
1073{
1074 struct nlmsghdr *nlh;
1075
1076
1077
1078
1079 int len;
1080 int err;
1081
1082 nlh = nlmsg_hdr(skb);
1083 len = skb->len;
1084
1085 while (nlmsg_ok(nlh, len)) {
1086 err = audit_receive_msg(skb, nlh);
1087
1088 if (err || (nlh->nlmsg_flags & NLM_F_ACK))
1089 netlink_ack(skb, nlh, err);
1090
1091 nlh = nlmsg_next(nlh, &len);
1092 }
1093}
1094
1095
1096static void audit_receive(struct sk_buff *skb)
1097{
1098 mutex_lock(&audit_cmd_mutex);
1099 audit_receive_skb(skb);
1100 mutex_unlock(&audit_cmd_mutex);
1101}
1102
1103
1104static int audit_bind(struct net *net, int group)
1105{
1106 if (!capable(CAP_AUDIT_READ))
1107 return -EPERM;
1108
1109 return 0;
1110}
1111
1112static int __net_init audit_net_init(struct net *net)
1113{
1114 struct netlink_kernel_cfg cfg = {
1115 .input = audit_receive,
1116 .bind = audit_bind,
1117 .flags = NL_CFG_F_NONROOT_RECV,
1118 .groups = AUDIT_NLGRP_MAX,
1119 };
1120
1121 struct audit_net *aunet = net_generic(net, audit_net_id);
1122
1123 aunet->nlsk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg);
1124 if (aunet->nlsk == NULL) {
1125 audit_panic("cannot initialize netlink socket in namespace");
1126 return -ENOMEM;
1127 }
1128 aunet->nlsk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
1129 return 0;
1130}
1131
1132static void __net_exit audit_net_exit(struct net *net)
1133{
1134 struct audit_net *aunet = net_generic(net, audit_net_id);
1135 struct sock *sock = aunet->nlsk;
1136 if (sock == audit_sock) {
1137 audit_pid = 0;
1138 audit_sock = NULL;
1139 }
1140
1141 RCU_INIT_POINTER(aunet->nlsk, NULL);
1142 synchronize_net();
1143 netlink_kernel_release(sock);
1144}
1145
1146static struct pernet_operations audit_net_ops __net_initdata = {
1147 .init = audit_net_init,
1148 .exit = audit_net_exit,
1149 .id = &audit_net_id,
1150 .size = sizeof(struct audit_net),
1151};
1152
1153
1154static int __init audit_init(void)
1155{
1156 int i;
1157
1158 if (audit_initialized == AUDIT_DISABLED)
1159 return 0;
1160
1161 pr_info("initializing netlink subsys (%s)\n",
1162 audit_default ? "enabled" : "disabled");
1163 register_pernet_subsys(&audit_net_ops);
1164
1165 skb_queue_head_init(&audit_skb_queue);
1166 skb_queue_head_init(&audit_skb_hold_queue);
1167 audit_initialized = AUDIT_INITIALIZED;
1168 audit_enabled = audit_default;
1169 audit_ever_enabled |= !!audit_default;
1170
1171 audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
1172
1173 for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
1174 INIT_LIST_HEAD(&audit_inode_hash[i]);
1175
1176 return 0;
1177}
1178__initcall(audit_init);
1179
1180
1181static int __init audit_enable(char *str)
1182{
1183 audit_default = !!simple_strtol(str, NULL, 0);
1184 if (!audit_default)
1185 audit_initialized = AUDIT_DISABLED;
1186
1187 pr_info("%s\n", audit_default ?
1188 "enabled (after initialization)" : "disabled (until reboot)");
1189
1190 return 1;
1191}
1192__setup("audit=", audit_enable);
1193
1194
1195
1196static int __init audit_backlog_limit_set(char *str)
1197{
1198 u32 audit_backlog_limit_arg;
1199
1200 pr_info("audit_backlog_limit: ");
1201 if (kstrtouint(str, 0, &audit_backlog_limit_arg)) {
1202 pr_cont("using default of %u, unable to parse %s\n",
1203 audit_backlog_limit, str);
1204 return 1;
1205 }
1206
1207 audit_backlog_limit = audit_backlog_limit_arg;
1208 pr_cont("%d\n", audit_backlog_limit);
1209
1210 return 1;
1211}
1212__setup("audit_backlog_limit=", audit_backlog_limit_set);
1213
1214static void audit_buffer_free(struct audit_buffer *ab)
1215{
1216 unsigned long flags;
1217
1218 if (!ab)
1219 return;
1220
1221 if (ab->skb)
1222 kfree_skb(ab->skb);
1223
1224 spin_lock_irqsave(&audit_freelist_lock, flags);
1225 if (audit_freelist_count > AUDIT_MAXFREE)
1226 kfree(ab);
1227 else {
1228 audit_freelist_count++;
1229 list_add(&ab->list, &audit_freelist);
1230 }
1231 spin_unlock_irqrestore(&audit_freelist_lock, flags);
1232}
1233
1234static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
1235 gfp_t gfp_mask, int type)
1236{
1237 unsigned long flags;
1238 struct audit_buffer *ab = NULL;
1239 struct nlmsghdr *nlh;
1240
1241 spin_lock_irqsave(&audit_freelist_lock, flags);
1242 if (!list_empty(&audit_freelist)) {
1243 ab = list_entry(audit_freelist.next,
1244 struct audit_buffer, list);
1245 list_del(&ab->list);
1246 --audit_freelist_count;
1247 }
1248 spin_unlock_irqrestore(&audit_freelist_lock, flags);
1249
1250 if (!ab) {
1251 ab = kmalloc(sizeof(*ab), gfp_mask);
1252 if (!ab)
1253 goto err;
1254 }
1255
1256 ab->ctx = ctx;
1257 ab->gfp_mask = gfp_mask;
1258
1259 ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask);
1260 if (!ab->skb)
1261 goto err;
1262
1263 nlh = nlmsg_put(ab->skb, 0, 0, type, 0, 0);
1264 if (!nlh)
1265 goto out_kfree_skb;
1266
1267 return ab;
1268
1269out_kfree_skb:
1270 kfree_skb(ab->skb);
1271 ab->skb = NULL;
1272err:
1273 audit_buffer_free(ab);
1274 return NULL;
1275}
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294unsigned int audit_serial(void)
1295{
1296 static atomic_t serial = ATOMIC_INIT(0);
1297
1298 return atomic_add_return(1, &serial);
1299}
1300
1301static inline void audit_get_stamp(struct audit_context *ctx,
1302 struct timespec *t, unsigned int *serial)
1303{
1304 if (!ctx || !auditsc_get_stamp(ctx, t, serial)) {
1305 *t = CURRENT_TIME;
1306 *serial = audit_serial();
1307 }
1308}
1309
1310
1311
1312
1313static long wait_for_auditd(long sleep_time)
1314{
1315 DECLARE_WAITQUEUE(wait, current);
1316 set_current_state(TASK_UNINTERRUPTIBLE);
1317 add_wait_queue_exclusive(&audit_backlog_wait, &wait);
1318
1319 if (audit_backlog_limit &&
1320 skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
1321 sleep_time = schedule_timeout(sleep_time);
1322
1323 __set_current_state(TASK_RUNNING);
1324 remove_wait_queue(&audit_backlog_wait, &wait);
1325
1326 return sleep_time;
1327}
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
1345 int type)
1346{
1347 struct audit_buffer *ab = NULL;
1348 struct timespec t;
1349 unsigned int uninitialized_var(serial);
1350 int reserve = 5;
1351
1352 unsigned long timeout_start = jiffies;
1353
1354 if (audit_initialized != AUDIT_INITIALIZED)
1355 return NULL;
1356
1357 if (unlikely(audit_filter_type(type)))
1358 return NULL;
1359
1360 if (gfp_mask & __GFP_WAIT) {
1361 if (audit_pid && audit_pid == current->pid)
1362 gfp_mask &= ~__GFP_WAIT;
1363 else
1364 reserve = 0;
1365 }
1366
1367 while (audit_backlog_limit
1368 && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
1369 if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time) {
1370 long sleep_time;
1371
1372 sleep_time = timeout_start + audit_backlog_wait_time - jiffies;
1373 if (sleep_time > 0) {
1374 sleep_time = wait_for_auditd(sleep_time);
1375 if (sleep_time > 0)
1376 continue;
1377 }
1378 }
1379 if (audit_rate_check() && printk_ratelimit())
1380 pr_warn("audit_backlog=%d > audit_backlog_limit=%d\n",
1381 skb_queue_len(&audit_skb_queue),
1382 audit_backlog_limit);
1383 audit_log_lost("backlog limit exceeded");
1384 audit_backlog_wait_time = audit_backlog_wait_overflow;
1385 wake_up(&audit_backlog_wait);
1386 return NULL;
1387 }
1388
1389 if (!reserve)
1390 audit_backlog_wait_time = audit_backlog_wait_time_master;
1391
1392 ab = audit_buffer_alloc(ctx, gfp_mask, type);
1393 if (!ab) {
1394 audit_log_lost("out of memory in audit_log_start");
1395 return NULL;
1396 }
1397
1398 audit_get_stamp(ab->ctx, &t, &serial);
1399
1400 audit_log_format(ab, "audit(%lu.%03lu:%u): ",
1401 t.tv_sec, t.tv_nsec/1000000, serial);
1402 return ab;
1403}
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413static inline int audit_expand(struct audit_buffer *ab, int extra)
1414{
1415 struct sk_buff *skb = ab->skb;
1416 int oldtail = skb_tailroom(skb);
1417 int ret = pskb_expand_head(skb, 0, extra, ab->gfp_mask);
1418 int newtail = skb_tailroom(skb);
1419
1420 if (ret < 0) {
1421 audit_log_lost("out of memory in audit_expand");
1422 return 0;
1423 }
1424
1425 skb->truesize += newtail - oldtail;
1426 return newtail;
1427}
1428
1429
1430
1431
1432
1433
1434
1435static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
1436 va_list args)
1437{
1438 int len, avail;
1439 struct sk_buff *skb;
1440 va_list args2;
1441
1442 if (!ab)
1443 return;
1444
1445 BUG_ON(!ab->skb);
1446 skb = ab->skb;
1447 avail = skb_tailroom(skb);
1448 if (avail == 0) {
1449 avail = audit_expand(ab, AUDIT_BUFSIZ);
1450 if (!avail)
1451 goto out;
1452 }
1453 va_copy(args2, args);
1454 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args);
1455 if (len >= avail) {
1456
1457
1458
1459 avail = audit_expand(ab,
1460 max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
1461 if (!avail)
1462 goto out_va_end;
1463 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
1464 }
1465 if (len > 0)
1466 skb_put(skb, len);
1467out_va_end:
1468 va_end(args2);
1469out:
1470 return;
1471}
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
1482{
1483 va_list args;
1484
1485 if (!ab)
1486 return;
1487 va_start(args, fmt);
1488 audit_log_vformat(ab, fmt, args);
1489 va_end(args);
1490}
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
1504 size_t len)
1505{
1506 int i, avail, new_len;
1507 unsigned char *ptr;
1508 struct sk_buff *skb;
1509
1510 if (!ab)
1511 return;
1512
1513 BUG_ON(!ab->skb);
1514 skb = ab->skb;
1515 avail = skb_tailroom(skb);
1516 new_len = len<<1;
1517 if (new_len >= avail) {
1518
1519 new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
1520 avail = audit_expand(ab, new_len);
1521 if (!avail)
1522 return;
1523 }
1524
1525 ptr = skb_tail_pointer(skb);
1526 for (i = 0; i < len; i++)
1527 ptr = hex_byte_pack_upper(ptr, buf[i]);
1528 *ptr = 0;
1529 skb_put(skb, len << 1);
1530}
1531
1532
1533
1534
1535
1536void audit_log_n_string(struct audit_buffer *ab, const char *string,
1537 size_t slen)
1538{
1539 int avail, new_len;
1540 unsigned char *ptr;
1541 struct sk_buff *skb;
1542
1543 if (!ab)
1544 return;
1545
1546 BUG_ON(!ab->skb);
1547 skb = ab->skb;
1548 avail = skb_tailroom(skb);
1549 new_len = slen + 3;
1550 if (new_len > avail) {
1551 avail = audit_expand(ab, new_len);
1552 if (!avail)
1553 return;
1554 }
1555 ptr = skb_tail_pointer(skb);
1556 *ptr++ = '"';
1557 memcpy(ptr, string, slen);
1558 ptr += slen;
1559 *ptr++ = '"';
1560 *ptr = 0;
1561 skb_put(skb, slen + 2);
1562}
1563
1564
1565
1566
1567
1568
1569int audit_string_contains_control(const char *string, size_t len)
1570{
1571 const unsigned char *p;
1572 for (p = string; p < (const unsigned char *)string + len; p++) {
1573 if (*p == '"' || *p < 0x21 || *p > 0x7e)
1574 return 1;
1575 }
1576 return 0;
1577}
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593void audit_log_n_untrustedstring(struct audit_buffer *ab, const char *string,
1594 size_t len)
1595{
1596 if (audit_string_contains_control(string, len))
1597 audit_log_n_hex(ab, string, len);
1598 else
1599 audit_log_n_string(ab, string, len);
1600}
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610void audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
1611{
1612 audit_log_n_untrustedstring(ab, string, strlen(string));
1613}
1614
1615
1616void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
1617 const struct path *path)
1618{
1619 char *p, *pathname;
1620
1621 if (prefix)
1622 audit_log_format(ab, "%s", prefix);
1623
1624
1625 pathname = kmalloc(PATH_MAX+11, ab->gfp_mask);
1626 if (!pathname) {
1627 audit_log_string(ab, "<no_memory>");
1628 return;
1629 }
1630 p = d_path(path, pathname, PATH_MAX+11);
1631 if (IS_ERR(p)) {
1632
1633 audit_log_string(ab, "<too_long>");
1634 } else
1635 audit_log_untrustedstring(ab, p);
1636 kfree(pathname);
1637}
1638
1639void audit_log_session_info(struct audit_buffer *ab)
1640{
1641 unsigned int sessionid = audit_get_sessionid(current);
1642 uid_t auid = from_kuid(&init_user_ns, audit_get_loginuid(current));
1643
1644 audit_log_format(ab, " auid=%u ses=%u", auid, sessionid);
1645}
1646
1647void audit_log_key(struct audit_buffer *ab, char *key)
1648{
1649 audit_log_format(ab, " key=");
1650 if (key)
1651 audit_log_untrustedstring(ab, key);
1652 else
1653 audit_log_format(ab, "(null)");
1654}
1655
1656void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap)
1657{
1658 int i;
1659
1660 audit_log_format(ab, " %s=", prefix);
1661 CAP_FOR_EACH_U32(i) {
1662 audit_log_format(ab, "%08x",
1663 cap->cap[CAP_LAST_U32 - i]);
1664 }
1665}
1666
1667static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
1668{
1669 kernel_cap_t *perm = &name->fcap.permitted;
1670 kernel_cap_t *inh = &name->fcap.inheritable;
1671 int log = 0;
1672
1673 if (!cap_isclear(*perm)) {
1674 audit_log_cap(ab, "cap_fp", perm);
1675 log = 1;
1676 }
1677 if (!cap_isclear(*inh)) {
1678 audit_log_cap(ab, "cap_fi", inh);
1679 log = 1;
1680 }
1681
1682 if (log)
1683 audit_log_format(ab, " cap_fe=%d cap_fver=%x",
1684 name->fcap.fE, name->fcap_ver);
1685}
1686
1687static inline int audit_copy_fcaps(struct audit_names *name,
1688 const struct dentry *dentry)
1689{
1690 struct cpu_vfs_cap_data caps;
1691 int rc;
1692
1693 if (!dentry)
1694 return 0;
1695
1696 rc = get_vfs_caps_from_disk(dentry, &caps);
1697 if (rc)
1698 return rc;
1699
1700 name->fcap.permitted = caps.permitted;
1701 name->fcap.inheritable = caps.inheritable;
1702 name->fcap.fE = !!(caps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
1703 name->fcap_ver = (caps.magic_etc & VFS_CAP_REVISION_MASK) >>
1704 VFS_CAP_REVISION_SHIFT;
1705
1706 return 0;
1707}
1708
1709
1710void audit_copy_inode(struct audit_names *name, const struct dentry *dentry,
1711 const struct inode *inode)
1712{
1713 name->ino = inode->i_ino;
1714 name->dev = inode->i_sb->s_dev;
1715 name->mode = inode->i_mode;
1716 name->uid = inode->i_uid;
1717 name->gid = inode->i_gid;
1718 name->rdev = inode->i_rdev;
1719 security_inode_getsecid(inode, &name->osid);
1720 audit_copy_fcaps(name, dentry);
1721}
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731void audit_log_name(struct audit_context *context, struct audit_names *n,
1732 struct path *path, int record_num, int *call_panic)
1733{
1734 struct audit_buffer *ab;
1735 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
1736 if (!ab)
1737 return;
1738
1739 audit_log_format(ab, "item=%d", record_num);
1740
1741 if (path)
1742 audit_log_d_path(ab, " name=", path);
1743 else if (n->name) {
1744 switch (n->name_len) {
1745 case AUDIT_NAME_FULL:
1746
1747 audit_log_format(ab, " name=");
1748 audit_log_untrustedstring(ab, n->name->name);
1749 break;
1750 case 0:
1751
1752
1753 audit_log_d_path(ab, " name=", &context->pwd);
1754 break;
1755 default:
1756
1757 audit_log_format(ab, " name=");
1758 audit_log_n_untrustedstring(ab, n->name->name,
1759 n->name_len);
1760 }
1761 } else
1762 audit_log_format(ab, " name=(null)");
1763
1764 if (n->ino != (unsigned long)-1)
1765 audit_log_format(ab, " inode=%lu"
1766 " dev=%02x:%02x mode=%#ho"
1767 " ouid=%u ogid=%u rdev=%02x:%02x",
1768 n->ino,
1769 MAJOR(n->dev),
1770 MINOR(n->dev),
1771 n->mode,
1772 from_kuid(&init_user_ns, n->uid),
1773 from_kgid(&init_user_ns, n->gid),
1774 MAJOR(n->rdev),
1775 MINOR(n->rdev));
1776 if (n->osid != 0) {
1777 char *ctx = NULL;
1778 u32 len;
1779 if (security_secid_to_secctx(
1780 n->osid, &ctx, &len)) {
1781 audit_log_format(ab, " osid=%u", n->osid);
1782 if (call_panic)
1783 *call_panic = 2;
1784 } else {
1785 audit_log_format(ab, " obj=%s", ctx);
1786 security_release_secctx(ctx, len);
1787 }
1788 }
1789
1790
1791 audit_log_format(ab, " nametype=");
1792 switch(n->type) {
1793 case AUDIT_TYPE_NORMAL:
1794 audit_log_format(ab, "NORMAL");
1795 break;
1796 case AUDIT_TYPE_PARENT:
1797 audit_log_format(ab, "PARENT");
1798 break;
1799 case AUDIT_TYPE_CHILD_DELETE:
1800 audit_log_format(ab, "DELETE");
1801 break;
1802 case AUDIT_TYPE_CHILD_CREATE:
1803 audit_log_format(ab, "CREATE");
1804 break;
1805 default:
1806 audit_log_format(ab, "UNKNOWN");
1807 break;
1808 }
1809
1810 audit_log_fcaps(ab, n);
1811 audit_log_end(ab);
1812}
1813
1814int audit_log_task_context(struct audit_buffer *ab)
1815{
1816 char *ctx = NULL;
1817 unsigned len;
1818 int error;
1819 u32 sid;
1820
1821 security_task_getsecid(current, &sid);
1822 if (!sid)
1823 return 0;
1824
1825 error = security_secid_to_secctx(sid, &ctx, &len);
1826 if (error) {
1827 if (error != -EINVAL)
1828 goto error_path;
1829 return 0;
1830 }
1831
1832 audit_log_format(ab, " subj=%s", ctx);
1833 security_release_secctx(ctx, len);
1834 return 0;
1835
1836error_path:
1837 audit_panic("error in audit_log_task_context");
1838 return error;
1839}
1840EXPORT_SYMBOL(audit_log_task_context);
1841
1842void audit_log_d_path_exe(struct audit_buffer *ab,
1843 struct mm_struct *mm)
1844{
1845 struct file *exe_file;
1846
1847 if (!mm)
1848 goto out_null;
1849
1850 exe_file = get_mm_exe_file(mm);
1851 if (!exe_file)
1852 goto out_null;
1853
1854 audit_log_d_path(ab, " exe=", &exe_file->f_path);
1855 fput(exe_file);
1856 return;
1857out_null:
1858 audit_log_format(ab, " exe=(null)");
1859}
1860
1861void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
1862{
1863 const struct cred *cred;
1864 char comm[sizeof(tsk->comm)];
1865 char *tty;
1866
1867 if (!ab)
1868 return;
1869
1870
1871 cred = current_cred();
1872
1873 spin_lock_irq(&tsk->sighand->siglock);
1874 if (tsk->signal && tsk->signal->tty && tsk->signal->tty->name)
1875 tty = tsk->signal->tty->name;
1876 else
1877 tty = "(none)";
1878 spin_unlock_irq(&tsk->sighand->siglock);
1879
1880 audit_log_format(ab,
1881 " ppid=%d pid=%d auid=%u uid=%u gid=%u"
1882 " euid=%u suid=%u fsuid=%u"
1883 " egid=%u sgid=%u fsgid=%u tty=%s ses=%u",
1884 task_ppid_nr(tsk),
1885 task_pid_nr(tsk),
1886 from_kuid(&init_user_ns, audit_get_loginuid(tsk)),
1887 from_kuid(&init_user_ns, cred->uid),
1888 from_kgid(&init_user_ns, cred->gid),
1889 from_kuid(&init_user_ns, cred->euid),
1890 from_kuid(&init_user_ns, cred->suid),
1891 from_kuid(&init_user_ns, cred->fsuid),
1892 from_kgid(&init_user_ns, cred->egid),
1893 from_kgid(&init_user_ns, cred->sgid),
1894 from_kgid(&init_user_ns, cred->fsgid),
1895 tty, audit_get_sessionid(tsk));
1896
1897 audit_log_format(ab, " comm=");
1898 audit_log_untrustedstring(ab, get_task_comm(comm, tsk));
1899
1900 audit_log_d_path_exe(ab, tsk->mm);
1901 audit_log_task_context(ab);
1902}
1903EXPORT_SYMBOL(audit_log_task_info);
1904
1905
1906
1907
1908
1909
1910void audit_log_link_denied(const char *operation, struct path *link)
1911{
1912 struct audit_buffer *ab;
1913 struct audit_names *name;
1914
1915 name = kzalloc(sizeof(*name), GFP_NOFS);
1916 if (!name)
1917 return;
1918
1919
1920 ab = audit_log_start(current->audit_context, GFP_KERNEL,
1921 AUDIT_ANOM_LINK);
1922 if (!ab)
1923 goto out;
1924 audit_log_format(ab, "op=%s", operation);
1925 audit_log_task_info(ab, current);
1926 audit_log_format(ab, " res=0");
1927 audit_log_end(ab);
1928
1929
1930 name->type = AUDIT_TYPE_NORMAL;
1931 audit_copy_inode(name, link->dentry, d_backing_inode(link->dentry));
1932 audit_log_name(current->audit_context, name, link, 0, NULL);
1933out:
1934 kfree(name);
1935}
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946void audit_log_end(struct audit_buffer *ab)
1947{
1948 if (!ab)
1949 return;
1950 if (!audit_rate_check()) {
1951 audit_log_lost("rate limit exceeded");
1952 } else {
1953 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
1954
1955 nlh->nlmsg_len = ab->skb->len;
1956 kauditd_send_multicast_skb(ab->skb, ab->gfp_mask);
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967 nlh->nlmsg_len -= NLMSG_HDRLEN;
1968
1969 if (audit_pid) {
1970 skb_queue_tail(&audit_skb_queue, ab->skb);
1971 wake_up_interruptible(&kauditd_wait);
1972 } else {
1973 audit_printk_skb(ab->skb);
1974 }
1975 ab->skb = NULL;
1976 }
1977 audit_buffer_free(ab);
1978}
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
1993 const char *fmt, ...)
1994{
1995 struct audit_buffer *ab;
1996 va_list args;
1997
1998 ab = audit_log_start(ctx, gfp_mask, type);
1999 if (ab) {
2000 va_start(args, fmt);
2001 audit_log_vformat(ab, fmt, args);
2002 va_end(args);
2003 audit_log_end(ab);
2004 }
2005}
2006
2007#ifdef CONFIG_SECURITY
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018void audit_log_secctx(struct audit_buffer *ab, u32 secid)
2019{
2020 u32 len;
2021 char *secctx;
2022
2023 if (security_secid_to_secctx(secid, &secctx, &len)) {
2024 audit_panic("Cannot convert secid to context");
2025 } else {
2026 audit_log_format(ab, " obj=%s", secctx);
2027 security_release_secctx(secctx, len);
2028 }
2029}
2030EXPORT_SYMBOL(audit_log_secctx);
2031#endif
2032
2033EXPORT_SYMBOL(audit_log_start);
2034EXPORT_SYMBOL(audit_log_end);
2035EXPORT_SYMBOL(audit_log_format);
2036EXPORT_SYMBOL(audit_log);
2037