David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 1 | /* audit -- definition of audit_context structure and supporting types |
| 2 | * |
| 3 | * Copyright 2003-2004 Red Hat, Inc. |
| 4 | * Copyright 2005 Hewlett-Packard Development Company, L.P. |
| 5 | * Copyright 2005 IBM Corporation |
| 6 | * |
| 7 | * This program is free software; you can redistribute it and/or modify |
| 8 | * it under the terms of the GNU General Public License as published by |
| 9 | * the Free Software Foundation; either version 2 of the License, or |
| 10 | * (at your option) any later version. |
| 11 | * |
| 12 | * This program is distributed in the hope that it will be useful, |
| 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 15 | * GNU General Public License for more details. |
| 16 | * |
| 17 | * You should have received a copy of the GNU General Public License |
| 18 | * along with this program; if not, write to the Free Software |
| 19 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| 20 | */ |
| 21 | |
| 22 | #include <linux/fs.h> |
| 23 | #include <linux/audit.h> |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 24 | #include <linux/skbuff.h> |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 25 | |
| 26 | /* 0 = no checking |
| 27 | 1 = put_count checking |
| 28 | 2 = verbose put_count checking |
| 29 | */ |
| 30 | #define AUDIT_DEBUG 0 |
| 31 | |
| 32 | /* At task start time, the audit_state is set in the audit_context using |
| 33 | a per-task filter. At syscall entry, the audit_state is augmented by |
| 34 | the syscall filter. */ |
| 35 | enum audit_state { |
| 36 | AUDIT_DISABLED, /* Do not create per-task audit_context. |
| 37 | * No syscall-specific audit records can |
| 38 | * be generated. */ |
| 39 | AUDIT_SETUP_CONTEXT, /* Create the per-task audit_context, |
| 40 | * but don't necessarily fill it in at |
| 41 | * syscall entry time (i.e., filter |
| 42 | * instead). */ |
| 43 | AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context, |
| 44 | * and always fill it in at syscall |
| 45 | * entry time. This makes a full |
| 46 | * syscall record available if some |
| 47 | * other part of the kernel decides it |
| 48 | * should be recorded. */ |
| 49 | AUDIT_RECORD_CONTEXT /* Create the per-task audit_context, |
| 50 | * always fill it in at syscall entry |
| 51 | * time, and always write out the audit |
| 52 | * record at syscall exit time. */ |
| 53 | }; |
| 54 | |
| 55 | /* Rule lists */ |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 56 | struct audit_parent; |
| 57 | |
| 58 | struct audit_watch { |
| 59 | atomic_t count; /* reference count */ |
| 60 | char *path; /* insertion path */ |
| 61 | dev_t dev; /* associated superblock device */ |
| 62 | unsigned long ino; /* associated inode number */ |
| 63 | struct audit_parent *parent; /* associated parent */ |
| 64 | struct list_head wlist; /* entry in parent->watches list */ |
| 65 | struct list_head rules; /* associated rules */ |
| 66 | }; |
| 67 | |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 68 | struct audit_tree; |
| 69 | struct audit_chunk; |
| 70 | |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 71 | struct audit_entry { |
Amy Griffis | 93315ed | 2006-02-07 12:05:27 -0500 | [diff] [blame] | 72 | struct list_head list; |
| 73 | struct rcu_head rcu; |
| 74 | struct audit_krule rule; |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 75 | }; |
| 76 | |
Harvey Harrison | c782f24 | 2008-04-27 02:39:17 -0700 | [diff] [blame] | 77 | #ifdef CONFIG_AUDIT |
| 78 | extern int audit_enabled; |
| 79 | extern int audit_ever_enabled; |
| 80 | #endif |
| 81 | |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 82 | extern int audit_pid; |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 83 | |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 84 | #define AUDIT_INODE_BUCKETS 32 |
| 85 | extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; |
| 86 | |
| 87 | static inline int audit_hash_ino(u32 ino) |
| 88 | { |
| 89 | return (ino & (AUDIT_INODE_BUCKETS-1)); |
| 90 | } |
| 91 | |
Al Viro | 55669bf | 2006-08-31 19:26:40 -0400 | [diff] [blame] | 92 | extern int audit_match_class(int class, unsigned syscall); |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 93 | extern int audit_comparator(const u32 left, const u32 op, const u32 right); |
Amy Griffis | 9c937dc | 2006-06-08 23:19:31 -0400 | [diff] [blame] | 94 | extern int audit_compare_dname_path(const char *dname, const char *path, |
| 95 | int *dirlen); |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 96 | extern struct sk_buff * audit_make_reply(int pid, int seq, int type, |
| 97 | int done, int multi, |
| 98 | void *payload, int size); |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 99 | extern void audit_send_reply(int pid, int seq, int type, |
| 100 | int done, int multi, |
| 101 | void *payload, int size); |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 102 | extern void audit_panic(const char *message); |
Darrel Goeddel | 3dc7e31 | 2006-03-10 18:14:06 -0600 | [diff] [blame] | 103 | |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 104 | struct audit_netlink_list { |
| 105 | int pid; |
| 106 | struct sk_buff_head q; |
| 107 | }; |
| 108 | |
| 109 | int audit_send_list(void *); |
| 110 | |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 111 | struct inotify_watch; |
Harvey Harrison | c782f24 | 2008-04-27 02:39:17 -0700 | [diff] [blame] | 112 | /* Inotify handle */ |
| 113 | extern struct inotify_handle *audit_ih; |
| 114 | |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 115 | extern void audit_free_parent(struct inotify_watch *); |
| 116 | extern void audit_handle_ievent(struct inotify_watch *, u32, u32, u32, |
| 117 | const char *, struct inode *); |
Darrel Goeddel | 3dc7e31 | 2006-03-10 18:14:06 -0600 | [diff] [blame] | 118 | extern int selinux_audit_rule_update(void); |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 119 | |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 120 | extern struct mutex audit_filter_mutex; |
| 121 | extern void audit_free_rule_rcu(struct rcu_head *); |
Harvey Harrison | c782f24 | 2008-04-27 02:39:17 -0700 | [diff] [blame] | 122 | extern struct list_head audit_filter_list[]; |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 123 | |
| 124 | #ifdef CONFIG_AUDIT_TREE |
| 125 | extern struct audit_chunk *audit_tree_lookup(const struct inode *); |
| 126 | extern void audit_put_chunk(struct audit_chunk *); |
| 127 | extern int audit_tree_match(struct audit_chunk *, struct audit_tree *); |
| 128 | extern int audit_make_tree(struct audit_krule *, char *, u32); |
| 129 | extern int audit_add_tree_rule(struct audit_krule *); |
| 130 | extern int audit_remove_tree_rule(struct audit_krule *); |
| 131 | extern void audit_trim_trees(void); |
| 132 | extern int audit_tag_tree(char *old, char *new); |
| 133 | extern void audit_schedule_prune(void); |
| 134 | extern void audit_prune_trees(void); |
| 135 | extern const char *audit_tree_path(struct audit_tree *); |
| 136 | extern void audit_put_tree(struct audit_tree *); |
| 137 | #else |
| 138 | #define audit_remove_tree_rule(rule) BUG() |
| 139 | #define audit_add_tree_rule(rule) -EINVAL |
| 140 | #define audit_make_tree(rule, str, op) -EINVAL |
| 141 | #define audit_trim_trees() (void)0 |
| 142 | #define audit_put_tree(tree) (void)0 |
| 143 | #define audit_tag_tree(old, new) -EINVAL |
| 144 | #define audit_tree_path(rule) "" /* never called */ |
| 145 | #endif |
| 146 | |
| 147 | extern char *audit_unpack_string(void **, size_t *, size_t); |
| 148 | |
Harvey Harrison | c782f24 | 2008-04-27 02:39:17 -0700 | [diff] [blame] | 149 | extern pid_t audit_sig_pid; |
| 150 | extern uid_t audit_sig_uid; |
| 151 | extern u32 audit_sig_sid; |
| 152 | |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 153 | #ifdef CONFIG_AUDITSYSCALL |
Amy Griffis | e54dc24 | 2007-03-29 18:01:04 -0400 | [diff] [blame] | 154 | extern int __audit_signal_info(int sig, struct task_struct *t); |
| 155 | static inline int audit_signal_info(int sig, struct task_struct *t) |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 156 | { |
Amy Griffis | e54dc24 | 2007-03-29 18:01:04 -0400 | [diff] [blame] | 157 | if (unlikely((audit_pid && t->tgid == audit_pid) || |
| 158 | (audit_signals && !audit_dummy_context()))) |
| 159 | return __audit_signal_info(sig, t); |
| 160 | return 0; |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 161 | } |
Al Viro | 0590b93 | 2008-12-14 23:45:27 -0500 | [diff] [blame] | 162 | extern void audit_filter_inodes(struct task_struct *, struct audit_context *); |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 163 | #else |
Amy Griffis | e54dc24 | 2007-03-29 18:01:04 -0400 | [diff] [blame] | 164 | #define audit_signal_info(s,t) AUDIT_DISABLED |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 165 | #define audit_filter_inodes(t,c) AUDIT_DISABLED |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 166 | #endif |