David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 1 | /* audit -- definition of audit_context structure and supporting types |
| 2 | * |
| 3 | * Copyright 2003-2004 Red Hat, Inc. |
| 4 | * Copyright 2005 Hewlett-Packard Development Company, L.P. |
| 5 | * Copyright 2005 IBM Corporation |
| 6 | * |
| 7 | * This program is free software; you can redistribute it and/or modify |
| 8 | * it under the terms of the GNU General Public License as published by |
| 9 | * the Free Software Foundation; either version 2 of the License, or |
| 10 | * (at your option) any later version. |
| 11 | * |
| 12 | * This program is distributed in the hope that it will be useful, |
| 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 15 | * GNU General Public License for more details. |
| 16 | * |
| 17 | * You should have received a copy of the GNU General Public License |
| 18 | * along with this program; if not, write to the Free Software |
| 19 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| 20 | */ |
| 21 | |
| 22 | #include <linux/fs.h> |
| 23 | #include <linux/audit.h> |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 24 | #include <linux/skbuff.h> |
Eric Paris | b24a30a | 2013-04-30 15:30:32 -0400 | [diff] [blame] | 25 | #include <uapi/linux/mqueue.h> |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 26 | |
Eric Paris | b24a30a | 2013-04-30 15:30:32 -0400 | [diff] [blame] | 27 | /* AUDIT_NAMES is the number of slots we reserve in the audit_context |
| 28 | * for saving names from getname(). If we get more names we will allocate |
| 29 | * a name dynamically and also add those to the list anchored by names_list. */ |
| 30 | #define AUDIT_NAMES 5 |
| 31 | |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 32 | /* At task start time, the audit_state is set in the audit_context using |
| 33 | a per-task filter. At syscall entry, the audit_state is augmented by |
| 34 | the syscall filter. */ |
| 35 | enum audit_state { |
| 36 | AUDIT_DISABLED, /* Do not create per-task audit_context. |
| 37 | * No syscall-specific audit records can |
| 38 | * be generated. */ |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 39 | AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context, |
Eric Paris | 997f5b6 | 2012-01-03 14:23:06 -0500 | [diff] [blame] | 40 | * and fill it in at syscall |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 41 | * entry time. This makes a full |
| 42 | * syscall record available if some |
| 43 | * other part of the kernel decides it |
| 44 | * should be recorded. */ |
| 45 | AUDIT_RECORD_CONTEXT /* Create the per-task audit_context, |
| 46 | * always fill it in at syscall entry |
| 47 | * time, and always write out the audit |
| 48 | * record at syscall exit time. */ |
| 49 | }; |
| 50 | |
| 51 | /* Rule lists */ |
Eric Paris | cfcad62 | 2009-06-11 14:31:36 -0400 | [diff] [blame] | 52 | struct audit_watch; |
Richard Guy Briggs | 7f49294 | 2015-08-05 16:29:36 -0400 | [diff] [blame] | 53 | struct audit_fsnotify_mark; |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 54 | struct audit_tree; |
| 55 | struct audit_chunk; |
| 56 | |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 57 | struct audit_entry { |
Amy Griffis | 93315ed | 2006-02-07 12:05:27 -0500 | [diff] [blame] | 58 | struct list_head list; |
| 59 | struct rcu_head rcu; |
| 60 | struct audit_krule rule; |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 61 | }; |
| 62 | |
Eric Paris | b24a30a | 2013-04-30 15:30:32 -0400 | [diff] [blame] | 63 | struct audit_cap_data { |
| 64 | kernel_cap_t permitted; |
| 65 | kernel_cap_t inheritable; |
| 66 | union { |
| 67 | unsigned int fE; /* effective bit of file cap */ |
| 68 | kernel_cap_t effective; /* effective set of process */ |
| 69 | }; |
| 70 | }; |
| 71 | |
Paul Moore | 55422d0 | 2015-01-22 00:00:23 -0500 | [diff] [blame] | 72 | /* When fs/namei.c:getname() is called, we store the pointer in name and bump |
| 73 | * the refcnt in the associated filename struct. |
Eric Paris | b24a30a | 2013-04-30 15:30:32 -0400 | [diff] [blame] | 74 | * |
| 75 | * Further, in fs/namei.c:path_lookup() we store the inode and device. |
| 76 | */ |
| 77 | struct audit_names { |
| 78 | struct list_head list; /* audit_context->names_list */ |
| 79 | |
| 80 | struct filename *name; |
| 81 | int name_len; /* number of chars to log */ |
Jeff Layton | 79f6530 | 2013-07-08 15:59:36 -0700 | [diff] [blame] | 82 | bool hidden; /* don't log this record */ |
Eric Paris | b24a30a | 2013-04-30 15:30:32 -0400 | [diff] [blame] | 83 | |
| 84 | unsigned long ino; |
| 85 | dev_t dev; |
| 86 | umode_t mode; |
| 87 | kuid_t uid; |
| 88 | kgid_t gid; |
| 89 | dev_t rdev; |
| 90 | u32 osid; |
| 91 | struct audit_cap_data fcap; |
| 92 | unsigned int fcap_ver; |
| 93 | unsigned char type; /* record type */ |
| 94 | /* |
| 95 | * This was an allocated audit_names and not from the array of |
| 96 | * names allocated in the task audit context. Thus this name |
| 97 | * should be freed on syscall exit. |
| 98 | */ |
| 99 | bool should_free; |
| 100 | }; |
| 101 | |
William Roberts | 3f1c825 | 2014-02-11 10:12:01 -0800 | [diff] [blame] | 102 | struct audit_proctitle { |
| 103 | int len; /* length of the cmdline field. */ |
| 104 | char *value; /* the cmdline field */ |
| 105 | }; |
| 106 | |
Eric Paris | b24a30a | 2013-04-30 15:30:32 -0400 | [diff] [blame] | 107 | /* The per-task audit context. */ |
| 108 | struct audit_context { |
| 109 | int dummy; /* must be the first element */ |
| 110 | int in_syscall; /* 1 if task is in a syscall */ |
| 111 | enum audit_state state, current_state; |
| 112 | unsigned int serial; /* serial number for record */ |
| 113 | int major; /* syscall number */ |
| 114 | struct timespec ctime; /* time of syscall entry */ |
| 115 | unsigned long argv[4]; /* syscall arguments */ |
| 116 | long return_code;/* syscall return code */ |
| 117 | u64 prio; |
| 118 | int return_valid; /* return code is valid */ |
| 119 | /* |
| 120 | * The names_list is the list of all audit_names collected during this |
| 121 | * syscall. The first AUDIT_NAMES entries in the names_list will |
| 122 | * actually be from the preallocated_names array for performance |
| 123 | * reasons. Except during allocation they should never be referenced |
| 124 | * through the preallocated_names array and should only be found/used |
| 125 | * by running the names_list. |
| 126 | */ |
| 127 | struct audit_names preallocated_names[AUDIT_NAMES]; |
| 128 | int name_count; /* total records in names_list */ |
| 129 | struct list_head names_list; /* struct audit_names->list anchor */ |
| 130 | char *filterkey; /* key for rule that triggered record */ |
| 131 | struct path pwd; |
| 132 | struct audit_aux_data *aux; |
| 133 | struct audit_aux_data *aux_pids; |
| 134 | struct sockaddr_storage *sockaddr; |
| 135 | size_t sockaddr_len; |
| 136 | /* Save things to print about task_struct */ |
| 137 | pid_t pid, ppid; |
| 138 | kuid_t uid, euid, suid, fsuid; |
| 139 | kgid_t gid, egid, sgid, fsgid; |
| 140 | unsigned long personality; |
| 141 | int arch; |
| 142 | |
| 143 | pid_t target_pid; |
| 144 | kuid_t target_auid; |
| 145 | kuid_t target_uid; |
| 146 | unsigned int target_sessionid; |
| 147 | u32 target_sid; |
| 148 | char target_comm[TASK_COMM_LEN]; |
| 149 | |
| 150 | struct audit_tree_refs *trees, *first_trees; |
| 151 | struct list_head killed_trees; |
| 152 | int tree_count; |
| 153 | |
| 154 | int type; |
| 155 | union { |
| 156 | struct { |
| 157 | int nargs; |
| 158 | long args[6]; |
| 159 | } socketcall; |
| 160 | struct { |
| 161 | kuid_t uid; |
| 162 | kgid_t gid; |
| 163 | umode_t mode; |
| 164 | u32 osid; |
| 165 | int has_perm; |
| 166 | uid_t perm_uid; |
| 167 | gid_t perm_gid; |
| 168 | umode_t perm_mode; |
| 169 | unsigned long qbytes; |
| 170 | } ipc; |
| 171 | struct { |
| 172 | mqd_t mqdes; |
| 173 | struct mq_attr mqstat; |
| 174 | } mq_getsetattr; |
| 175 | struct { |
| 176 | mqd_t mqdes; |
| 177 | int sigev_signo; |
| 178 | } mq_notify; |
| 179 | struct { |
| 180 | mqd_t mqdes; |
| 181 | size_t msg_len; |
| 182 | unsigned int msg_prio; |
| 183 | struct timespec abs_timeout; |
| 184 | } mq_sendrecv; |
| 185 | struct { |
| 186 | int oflag; |
| 187 | umode_t mode; |
| 188 | struct mq_attr attr; |
| 189 | } mq_open; |
| 190 | struct { |
| 191 | pid_t pid; |
| 192 | struct audit_cap_data cap; |
| 193 | } capset; |
| 194 | struct { |
| 195 | int fd; |
| 196 | int flags; |
| 197 | } mmap; |
Richard Guy Briggs | d9cfea9 | 2013-10-30 17:56:13 -0400 | [diff] [blame] | 198 | struct { |
| 199 | int argc; |
Richard Guy Briggs | d9cfea9 | 2013-10-30 17:56:13 -0400 | [diff] [blame] | 200 | } execve; |
Eric Paris | b24a30a | 2013-04-30 15:30:32 -0400 | [diff] [blame] | 201 | }; |
| 202 | int fds[2]; |
William Roberts | 3f1c825 | 2014-02-11 10:12:01 -0800 | [diff] [blame] | 203 | struct audit_proctitle proctitle; |
Eric Paris | b24a30a | 2013-04-30 15:30:32 -0400 | [diff] [blame] | 204 | }; |
| 205 | |
Joe Perches | 3e1d0bb | 2014-01-14 10:33:13 -0800 | [diff] [blame] | 206 | extern u32 audit_ever_enabled; |
Harvey Harrison | c782f24 | 2008-04-27 02:39:17 -0700 | [diff] [blame] | 207 | |
Eric Paris | b24a30a | 2013-04-30 15:30:32 -0400 | [diff] [blame] | 208 | extern void audit_copy_inode(struct audit_names *name, |
| 209 | const struct dentry *dentry, |
| 210 | const struct inode *inode); |
| 211 | extern void audit_log_cap(struct audit_buffer *ab, char *prefix, |
| 212 | kernel_cap_t *cap); |
Eric Paris | b24a30a | 2013-04-30 15:30:32 -0400 | [diff] [blame] | 213 | extern void audit_log_name(struct audit_context *context, |
| 214 | struct audit_names *n, struct path *path, |
| 215 | int record_num, int *call_panic); |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 216 | |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 217 | extern int audit_pid; |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 218 | |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 219 | #define AUDIT_INODE_BUCKETS 32 |
| 220 | extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; |
| 221 | |
| 222 | static inline int audit_hash_ino(u32 ino) |
| 223 | { |
| 224 | return (ino & (AUDIT_INODE_BUCKETS-1)); |
| 225 | } |
| 226 | |
Jeff Layton | e3d6b07 | 2012-10-10 15:25:25 -0400 | [diff] [blame] | 227 | /* Indicates that audit should log the full pathname. */ |
| 228 | #define AUDIT_NAME_FULL -1 |
| 229 | |
Al Viro | 55669bf | 2006-08-31 19:26:40 -0400 | [diff] [blame] | 230 | extern int audit_match_class(int class, unsigned syscall); |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 231 | extern int audit_comparator(const u32 left, const u32 op, const u32 right); |
Eric W. Biederman | ca57ec0 | 2012-09-11 02:18:08 -0700 | [diff] [blame] | 232 | extern int audit_uid_comparator(kuid_t left, u32 op, kuid_t right); |
| 233 | extern int audit_gid_comparator(kgid_t left, u32 op, kgid_t right); |
Jeff Layton | bfcec70 | 2012-10-10 15:25:23 -0400 | [diff] [blame] | 234 | extern int parent_len(const char *path); |
Jeff Layton | e3d6b07 | 2012-10-10 15:25:25 -0400 | [diff] [blame] | 235 | extern int audit_compare_dname_path(const char *dname, const char *path, int plen); |
Richard Guy Briggs | f944163 | 2013-08-14 11:32:45 -0400 | [diff] [blame] | 236 | extern struct sk_buff *audit_make_reply(__u32 portid, int seq, int type, |
| 237 | int done, int multi, |
| 238 | const void *payload, int size); |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 239 | extern void audit_panic(const char *message); |
Darrel Goeddel | 3dc7e31 | 2006-03-10 18:14:06 -0600 | [diff] [blame] | 240 | |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 241 | struct audit_netlink_list { |
Richard Guy Briggs | f944163 | 2013-08-14 11:32:45 -0400 | [diff] [blame] | 242 | __u32 portid; |
Eric W. Biederman | 638a0fd | 2014-02-28 10:49:05 -0800 | [diff] [blame] | 243 | struct net *net; |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 244 | struct sk_buff_head q; |
| 245 | }; |
| 246 | |
| 247 | int audit_send_list(void *); |
| 248 | |
Richard Guy Briggs | 33faba7 | 2013-07-16 13:18:45 -0400 | [diff] [blame] | 249 | struct audit_net { |
| 250 | struct sock *nlsk; |
| 251 | }; |
| 252 | |
Darrel Goeddel | 3dc7e31 | 2006-03-10 18:14:06 -0600 | [diff] [blame] | 253 | extern int selinux_audit_rule_update(void); |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 254 | |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 255 | extern struct mutex audit_filter_mutex; |
Richard Guy Briggs | 7f49294 | 2015-08-05 16:29:36 -0400 | [diff] [blame] | 256 | extern int audit_del_rule(struct audit_entry *); |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 257 | extern void audit_free_rule_rcu(struct rcu_head *); |
Harvey Harrison | c782f24 | 2008-04-27 02:39:17 -0700 | [diff] [blame] | 258 | extern struct list_head audit_filter_list[]; |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 259 | |
Eric Paris | 939a67f | 2009-12-17 20:12:06 -0500 | [diff] [blame] | 260 | extern struct audit_entry *audit_dupe_rule(struct audit_krule *old); |
| 261 | |
Davidlohr Bueso | 4766b19 | 2015-02-22 18:20:00 -0800 | [diff] [blame] | 262 | extern void audit_log_d_path_exe(struct audit_buffer *ab, |
| 263 | struct mm_struct *mm); |
| 264 | |
Eric Paris | cfcad62 | 2009-06-11 14:31:36 -0400 | [diff] [blame] | 265 | /* audit watch functions */ |
Eric Paris | 939a67f | 2009-12-17 20:12:06 -0500 | [diff] [blame] | 266 | #ifdef CONFIG_AUDIT_WATCH |
Eric Paris | cfcad62 | 2009-06-11 14:31:36 -0400 | [diff] [blame] | 267 | extern void audit_put_watch(struct audit_watch *watch); |
| 268 | extern void audit_get_watch(struct audit_watch *watch); |
| 269 | extern int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op); |
Eric Paris | ae7b8f4 | 2009-12-17 20:12:04 -0500 | [diff] [blame] | 270 | extern int audit_add_watch(struct audit_krule *krule, struct list_head **list); |
Eric Paris | a05fb6c | 2009-12-17 20:12:05 -0500 | [diff] [blame] | 271 | extern void audit_remove_watch_rule(struct audit_krule *krule); |
Eric Paris | cfcad62 | 2009-06-11 14:31:36 -0400 | [diff] [blame] | 272 | extern char *audit_watch_path(struct audit_watch *watch); |
Eric Paris | ae7b8f4 | 2009-12-17 20:12:04 -0500 | [diff] [blame] | 273 | extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev); |
Richard Guy Briggs | 7f49294 | 2015-08-05 16:29:36 -0400 | [diff] [blame] | 274 | |
| 275 | extern struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len); |
| 276 | extern char *audit_mark_path(struct audit_fsnotify_mark *mark); |
| 277 | extern void audit_remove_mark(struct audit_fsnotify_mark *audit_mark); |
| 278 | extern void audit_remove_mark_rule(struct audit_krule *krule); |
| 279 | extern int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev); |
Richard Guy Briggs | 34d99af5 | 2015-08-05 16:29:37 -0400 | [diff] [blame] | 280 | extern int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old); |
| 281 | extern int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark); |
Richard Guy Briggs | 7f49294 | 2015-08-05 16:29:36 -0400 | [diff] [blame] | 282 | |
Eric Paris | 939a67f | 2009-12-17 20:12:06 -0500 | [diff] [blame] | 283 | #else |
| 284 | #define audit_put_watch(w) {} |
| 285 | #define audit_get_watch(w) {} |
| 286 | #define audit_to_watch(k, p, l, o) (-EINVAL) |
| 287 | #define audit_add_watch(k, l) (-EINVAL) |
| 288 | #define audit_remove_watch_rule(k) BUG() |
| 289 | #define audit_watch_path(w) "" |
| 290 | #define audit_watch_compare(w, i, d) 0 |
| 291 | |
Richard Guy Briggs | 7f49294 | 2015-08-05 16:29:36 -0400 | [diff] [blame] | 292 | #define audit_alloc_mark(k, p, l) (ERR_PTR(-EINVAL)) |
| 293 | #define audit_mark_path(m) "" |
| 294 | #define audit_remove_mark(m) |
| 295 | #define audit_remove_mark_rule(k) |
| 296 | #define audit_mark_compare(m, i, d) 0 |
Richard Guy Briggs | 34d99af5 | 2015-08-05 16:29:37 -0400 | [diff] [blame] | 297 | #define audit_exe_compare(t, m) (-EINVAL) |
| 298 | #define audit_dupe_exe(n, o) (-EINVAL) |
Eric Paris | 939a67f | 2009-12-17 20:12:06 -0500 | [diff] [blame] | 299 | #endif /* CONFIG_AUDIT_WATCH */ |
Eric Paris | cfcad62 | 2009-06-11 14:31:36 -0400 | [diff] [blame] | 300 | |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 301 | #ifdef CONFIG_AUDIT_TREE |
| 302 | extern struct audit_chunk *audit_tree_lookup(const struct inode *); |
| 303 | extern void audit_put_chunk(struct audit_chunk *); |
Yaowei Bai | 6f1b5d7 | 2015-11-04 08:23:51 -0500 | [diff] [blame] | 304 | extern bool audit_tree_match(struct audit_chunk *, struct audit_tree *); |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 305 | extern int audit_make_tree(struct audit_krule *, char *, u32); |
| 306 | extern int audit_add_tree_rule(struct audit_krule *); |
| 307 | extern int audit_remove_tree_rule(struct audit_krule *); |
| 308 | extern void audit_trim_trees(void); |
| 309 | extern int audit_tag_tree(char *old, char *new); |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 310 | extern const char *audit_tree_path(struct audit_tree *); |
| 311 | extern void audit_put_tree(struct audit_tree *); |
Al Viro | 916d757 | 2009-06-24 00:02:38 -0400 | [diff] [blame] | 312 | extern void audit_kill_trees(struct list_head *); |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 313 | #else |
| 314 | #define audit_remove_tree_rule(rule) BUG() |
| 315 | #define audit_add_tree_rule(rule) -EINVAL |
| 316 | #define audit_make_tree(rule, str, op) -EINVAL |
| 317 | #define audit_trim_trees() (void)0 |
| 318 | #define audit_put_tree(tree) (void)0 |
| 319 | #define audit_tag_tree(old, new) -EINVAL |
| 320 | #define audit_tree_path(rule) "" /* never called */ |
Al Viro | 916d757 | 2009-06-24 00:02:38 -0400 | [diff] [blame] | 321 | #define audit_kill_trees(list) BUG() |
Al Viro | 74c3cbe | 2007-07-22 08:04:18 -0400 | [diff] [blame] | 322 | #endif |
| 323 | |
| 324 | extern char *audit_unpack_string(void **, size_t *, size_t); |
| 325 | |
Harvey Harrison | c782f24 | 2008-04-27 02:39:17 -0700 | [diff] [blame] | 326 | extern pid_t audit_sig_pid; |
Eric W. Biederman | cca080d | 2012-02-07 16:53:48 -0800 | [diff] [blame] | 327 | extern kuid_t audit_sig_uid; |
Harvey Harrison | c782f24 | 2008-04-27 02:39:17 -0700 | [diff] [blame] | 328 | extern u32 audit_sig_sid; |
| 329 | |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 330 | #ifdef CONFIG_AUDITSYSCALL |
Amy Griffis | e54dc24 | 2007-03-29 18:01:04 -0400 | [diff] [blame] | 331 | extern int __audit_signal_info(int sig, struct task_struct *t); |
| 332 | static inline int audit_signal_info(int sig, struct task_struct *t) |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 333 | { |
Amy Griffis | e54dc24 | 2007-03-29 18:01:04 -0400 | [diff] [blame] | 334 | if (unlikely((audit_pid && t->tgid == audit_pid) || |
| 335 | (audit_signals && !audit_dummy_context()))) |
| 336 | return __audit_signal_info(sig, t); |
| 337 | return 0; |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 338 | } |
Al Viro | 0590b93 | 2008-12-14 23:45:27 -0500 | [diff] [blame] | 339 | extern void audit_filter_inodes(struct task_struct *, struct audit_context *); |
Al Viro | 916d757 | 2009-06-24 00:02:38 -0400 | [diff] [blame] | 340 | extern struct list_head *audit_killed_trees(void); |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 341 | #else |
Amy Griffis | e54dc24 | 2007-03-29 18:01:04 -0400 | [diff] [blame] | 342 | #define audit_signal_info(s,t) AUDIT_DISABLED |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 343 | #define audit_filter_inodes(t,c) AUDIT_DISABLED |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 344 | #endif |
Al Viro | 916d757 | 2009-06-24 00:02:38 -0400 | [diff] [blame] | 345 | |
| 346 | extern struct mutex audit_cmd_mutex; |