David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 1 | /* audit -- definition of audit_context structure and supporting types |
| 2 | * |
| 3 | * Copyright 2003-2004 Red Hat, Inc. |
| 4 | * Copyright 2005 Hewlett-Packard Development Company, L.P. |
| 5 | * Copyright 2005 IBM Corporation |
| 6 | * |
| 7 | * This program is free software; you can redistribute it and/or modify |
| 8 | * it under the terms of the GNU General Public License as published by |
| 9 | * the Free Software Foundation; either version 2 of the License, or |
| 10 | * (at your option) any later version. |
| 11 | * |
| 12 | * This program is distributed in the hope that it will be useful, |
| 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 15 | * GNU General Public License for more details. |
| 16 | * |
| 17 | * You should have received a copy of the GNU General Public License |
| 18 | * along with this program; if not, write to the Free Software |
| 19 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| 20 | */ |
| 21 | |
| 22 | #include <linux/fs.h> |
| 23 | #include <linux/audit.h> |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 24 | #include <linux/skbuff.h> |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 25 | |
| 26 | /* 0 = no checking |
| 27 | 1 = put_count checking |
| 28 | 2 = verbose put_count checking |
| 29 | */ |
| 30 | #define AUDIT_DEBUG 0 |
| 31 | |
| 32 | /* At task start time, the audit_state is set in the audit_context using |
| 33 | a per-task filter. At syscall entry, the audit_state is augmented by |
| 34 | the syscall filter. */ |
| 35 | enum audit_state { |
| 36 | AUDIT_DISABLED, /* Do not create per-task audit_context. |
| 37 | * No syscall-specific audit records can |
| 38 | * be generated. */ |
| 39 | AUDIT_SETUP_CONTEXT, /* Create the per-task audit_context, |
| 40 | * but don't necessarily fill it in at |
| 41 | * syscall entry time (i.e., filter |
| 42 | * instead). */ |
| 43 | AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context, |
| 44 | * and always fill it in at syscall |
| 45 | * entry time. This makes a full |
| 46 | * syscall record available if some |
| 47 | * other part of the kernel decides it |
| 48 | * should be recorded. */ |
| 49 | AUDIT_RECORD_CONTEXT /* Create the per-task audit_context, |
| 50 | * always fill it in at syscall entry |
| 51 | * time, and always write out the audit |
| 52 | * record at syscall exit time. */ |
| 53 | }; |
| 54 | |
| 55 | /* Rule lists */ |
Eric Paris | cfcad62 | 2009-06-11 14:31:36 -0400 | [diff] [blame] | 56 | struct audit_watch; |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 57 | struct audit_tree; |
| 58 | struct audit_chunk; |
| 59 | |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 60 | struct audit_entry { |
Amy Griffis | 93315ed | 2006-02-07 12:05:27 -0500 | [diff] [blame] | 61 | struct list_head list; |
| 62 | struct rcu_head rcu; |
| 63 | struct audit_krule rule; |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 64 | }; |
| 65 | |
Harvey Harrison | c782f24 | 2008-04-27 02:39:17 -0700 | [diff] [blame] | 66 | #ifdef CONFIG_AUDIT |
| 67 | extern int audit_enabled; |
| 68 | extern int audit_ever_enabled; |
| 69 | #endif |
| 70 | |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 71 | extern int audit_pid; |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 72 | |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 73 | #define AUDIT_INODE_BUCKETS 32 |
| 74 | extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; |
| 75 | |
| 76 | static inline int audit_hash_ino(u32 ino) |
| 77 | { |
| 78 | return (ino & (AUDIT_INODE_BUCKETS-1)); |
| 79 | } |
| 80 | |
Al Viro | 55669bf | 2006-08-31 19:26:40 -0400 | [diff] [blame] | 81 | extern int audit_match_class(int class, unsigned syscall); |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 82 | extern int audit_comparator(const u32 left, const u32 op, const u32 right); |
Amy Griffis | 9c937dc | 2006-06-08 23:19:31 -0400 | [diff] [blame] | 83 | extern int audit_compare_dname_path(const char *dname, const char *path, |
| 84 | int *dirlen); |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 85 | extern struct sk_buff * audit_make_reply(int pid, int seq, int type, |
| 86 | int done, int multi, |
| 87 | void *payload, int size); |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 88 | extern void audit_send_reply(int pid, int seq, int type, |
| 89 | int done, int multi, |
| 90 | void *payload, int size); |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 91 | extern void audit_panic(const char *message); |
Darrel Goeddel | 3dc7e31 | 2006-03-10 18:14:06 -0600 | [diff] [blame] | 92 | |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 93 | struct audit_netlink_list { |
| 94 | int pid; |
| 95 | struct sk_buff_head q; |
| 96 | }; |
| 97 | |
| 98 | int audit_send_list(void *); |
| 99 | |
Darrel Goeddel | 3dc7e31 | 2006-03-10 18:14:06 -0600 | [diff] [blame] | 100 | extern int selinux_audit_rule_update(void); |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 101 | |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 102 | extern struct mutex audit_filter_mutex; |
| 103 | extern void audit_free_rule_rcu(struct rcu_head *); |
Harvey Harrison | c782f24 | 2008-04-27 02:39:17 -0700 | [diff] [blame] | 104 | extern struct list_head audit_filter_list[]; |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 105 | |
Eric Paris | cfcad62 | 2009-06-11 14:31:36 -0400 | [diff] [blame] | 106 | /* audit watch functions */ |
| 107 | extern unsigned long audit_watch_inode(struct audit_watch *watch); |
| 108 | extern dev_t audit_watch_dev(struct audit_watch *watch); |
| 109 | extern void audit_put_watch(struct audit_watch *watch); |
| 110 | extern void audit_get_watch(struct audit_watch *watch); |
| 111 | extern int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op); |
Eric Paris | 35fe4d0 | 2009-06-11 14:31:36 -0400 | [diff] [blame] | 112 | extern int audit_add_watch(struct audit_krule *krule); |
Eric Paris | cfcad62 | 2009-06-11 14:31:36 -0400 | [diff] [blame] | 113 | extern void audit_remove_watch(struct audit_watch *watch); |
| 114 | extern void audit_remove_watch_rule(struct audit_krule *krule, struct list_head *list); |
| 115 | extern void audit_inotify_unregister(struct list_head *in_list); |
| 116 | extern char *audit_watch_path(struct audit_watch *watch); |
| 117 | extern struct list_head *audit_watch_rules(struct audit_watch *watch); |
| 118 | |
| 119 | extern struct audit_entry *audit_dupe_rule(struct audit_krule *old, |
| 120 | struct audit_watch *watch); |
| 121 | |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 122 | #ifdef CONFIG_AUDIT_TREE |
| 123 | extern struct audit_chunk *audit_tree_lookup(const struct inode *); |
| 124 | extern void audit_put_chunk(struct audit_chunk *); |
| 125 | extern int audit_tree_match(struct audit_chunk *, struct audit_tree *); |
| 126 | extern int audit_make_tree(struct audit_krule *, char *, u32); |
| 127 | extern int audit_add_tree_rule(struct audit_krule *); |
| 128 | extern int audit_remove_tree_rule(struct audit_krule *); |
| 129 | extern void audit_trim_trees(void); |
| 130 | extern int audit_tag_tree(char *old, char *new); |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 131 | extern const char *audit_tree_path(struct audit_tree *); |
| 132 | extern void audit_put_tree(struct audit_tree *); |
Al Viro | 916d757 | 2009-06-24 00:02:38 -0400 | [diff] [blame] | 133 | extern void audit_kill_trees(struct list_head *); |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 134 | #else |
| 135 | #define audit_remove_tree_rule(rule) BUG() |
| 136 | #define audit_add_tree_rule(rule) -EINVAL |
| 137 | #define audit_make_tree(rule, str, op) -EINVAL |
| 138 | #define audit_trim_trees() (void)0 |
| 139 | #define audit_put_tree(tree) (void)0 |
| 140 | #define audit_tag_tree(old, new) -EINVAL |
| 141 | #define audit_tree_path(rule) "" /* never called */ |
Al Viro | 916d757 | 2009-06-24 00:02:38 -0400 | [diff] [blame] | 142 | #define audit_kill_trees(list) BUG() |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 143 | #endif |
| 144 | |
| 145 | extern char *audit_unpack_string(void **, size_t *, size_t); |
| 146 | |
Harvey Harrison | c782f24 | 2008-04-27 02:39:17 -0700 | [diff] [blame] | 147 | extern pid_t audit_sig_pid; |
| 148 | extern uid_t audit_sig_uid; |
| 149 | extern u32 audit_sig_sid; |
| 150 | |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 151 | #ifdef CONFIG_AUDITSYSCALL |
Amy Griffis | e54dc24 | 2007-03-29 18:01:04 -0400 | [diff] [blame] | 152 | extern int __audit_signal_info(int sig, struct task_struct *t); |
| 153 | static inline int audit_signal_info(int sig, struct task_struct *t) |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 154 | { |
Amy Griffis | e54dc24 | 2007-03-29 18:01:04 -0400 | [diff] [blame] | 155 | if (unlikely((audit_pid && t->tgid == audit_pid) || |
| 156 | (audit_signals && !audit_dummy_context()))) |
| 157 | return __audit_signal_info(sig, t); |
| 158 | return 0; |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 159 | } |
Al Viro | 0590b93 | 2008-12-14 23:45:27 -0500 | [diff] [blame] | 160 | extern void audit_filter_inodes(struct task_struct *, struct audit_context *); |
Al Viro | 916d757 | 2009-06-24 00:02:38 -0400 | [diff] [blame] | 161 | extern struct list_head *audit_killed_trees(void); |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 162 | #else |
Amy Griffis | e54dc24 | 2007-03-29 18:01:04 -0400 | [diff] [blame] | 163 | #define audit_signal_info(s,t) AUDIT_DISABLED |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 164 | #define audit_filter_inodes(t,c) AUDIT_DISABLED |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 165 | #endif |
Al Viro | 916d757 | 2009-06-24 00:02:38 -0400 | [diff] [blame] | 166 | |
| 167 | extern struct mutex audit_cmd_mutex; |