David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 1 | /* audit -- definition of audit_context structure and supporting types |
| 2 | * |
| 3 | * Copyright 2003-2004 Red Hat, Inc. |
| 4 | * Copyright 2005 Hewlett-Packard Development Company, L.P. |
| 5 | * Copyright 2005 IBM Corporation |
| 6 | * |
| 7 | * This program is free software; you can redistribute it and/or modify |
| 8 | * it under the terms of the GNU General Public License as published by |
| 9 | * the Free Software Foundation; either version 2 of the License, or |
| 10 | * (at your option) any later version. |
| 11 | * |
| 12 | * This program is distributed in the hope that it will be useful, |
| 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 15 | * GNU General Public License for more details. |
| 16 | * |
| 17 | * You should have received a copy of the GNU General Public License |
| 18 | * along with this program; if not, write to the Free Software |
| 19 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| 20 | */ |
| 21 | |
| 22 | #include <linux/fs.h> |
| 23 | #include <linux/audit.h> |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 24 | #include <linux/skbuff.h> |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 25 | |
| 26 | /* 0 = no checking |
| 27 | 1 = put_count checking |
| 28 | 2 = verbose put_count checking |
| 29 | */ |
| 30 | #define AUDIT_DEBUG 0 |
| 31 | |
| 32 | /* At task start time, the audit_state is set in the audit_context using |
| 33 | a per-task filter. At syscall entry, the audit_state is augmented by |
| 34 | the syscall filter. */ |
| 35 | enum audit_state { |
| 36 | AUDIT_DISABLED, /* Do not create per-task audit_context. |
| 37 | * No syscall-specific audit records can |
| 38 | * be generated. */ |
| 39 | AUDIT_SETUP_CONTEXT, /* Create the per-task audit_context, |
| 40 | * but don't necessarily fill it in at |
| 41 | * syscall entry time (i.e., filter |
| 42 | * instead). */ |
| 43 | AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context, |
| 44 | * and always fill it in at syscall |
| 45 | * entry time. This makes a full |
| 46 | * syscall record available if some |
| 47 | * other part of the kernel decides it |
| 48 | * should be recorded. */ |
| 49 | AUDIT_RECORD_CONTEXT /* Create the per-task audit_context, |
| 50 | * always fill it in at syscall entry |
| 51 | * time, and always write out the audit |
| 52 | * record at syscall exit time. */ |
| 53 | }; |
| 54 | |
| 55 | /* Rule lists */ |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 56 | struct audit_parent; |
| 57 | |
| 58 | struct audit_watch { |
| 59 | atomic_t count; /* reference count */ |
| 60 | char *path; /* insertion path */ |
| 61 | dev_t dev; /* associated superblock device */ |
| 62 | unsigned long ino; /* associated inode number */ |
| 63 | struct audit_parent *parent; /* associated parent */ |
| 64 | struct list_head wlist; /* entry in parent->watches list */ |
| 65 | struct list_head rules; /* associated rules */ |
| 66 | }; |
| 67 | |
Amy Griffis | 93315ed | 2006-02-07 12:05:27 -0500 | [diff] [blame] | 68 | struct audit_field { |
Darrel Goeddel | 3dc7e31 | 2006-03-10 18:14:06 -0600 | [diff] [blame] | 69 | u32 type; |
| 70 | u32 val; |
| 71 | u32 op; |
| 72 | char *se_str; |
| 73 | struct selinux_audit_rule *se_rule; |
Amy Griffis | 93315ed | 2006-02-07 12:05:27 -0500 | [diff] [blame] | 74 | }; |
| 75 | |
| 76 | struct audit_krule { |
| 77 | int vers_ops; |
| 78 | u32 flags; |
| 79 | u32 listnr; |
| 80 | u32 action; |
| 81 | u32 mask[AUDIT_BITMASK_SIZE]; |
| 82 | u32 buflen; /* for data alloc on list rules */ |
| 83 | u32 field_count; |
Amy Griffis | 5adc8a6 | 2006-06-14 18:45:21 -0400 | [diff] [blame] | 84 | char *filterkey; /* ties events to rules */ |
Amy Griffis | 93315ed | 2006-02-07 12:05:27 -0500 | [diff] [blame] | 85 | struct audit_field *fields; |
Amy Griffis | e54dc24 | 2007-03-29 18:01:04 -0400 | [diff] [blame^] | 86 | struct audit_field *arch_f; /* quick access to arch field */ |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 87 | struct audit_field *inode_f; /* quick access to an inode field */ |
| 88 | struct audit_watch *watch; /* associated watch */ |
| 89 | struct list_head rlist; /* entry in audit_watch.rules list */ |
Amy Griffis | 93315ed | 2006-02-07 12:05:27 -0500 | [diff] [blame] | 90 | }; |
| 91 | |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 92 | struct audit_entry { |
Amy Griffis | 93315ed | 2006-02-07 12:05:27 -0500 | [diff] [blame] | 93 | struct list_head list; |
| 94 | struct rcu_head rcu; |
| 95 | struct audit_krule rule; |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 96 | }; |
| 97 | |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 98 | extern int audit_pid; |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 99 | |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 100 | #define AUDIT_INODE_BUCKETS 32 |
| 101 | extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; |
| 102 | |
| 103 | static inline int audit_hash_ino(u32 ino) |
| 104 | { |
| 105 | return (ino & (AUDIT_INODE_BUCKETS-1)); |
| 106 | } |
| 107 | |
Al Viro | 55669bf | 2006-08-31 19:26:40 -0400 | [diff] [blame] | 108 | extern int audit_match_class(int class, unsigned syscall); |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 109 | extern int audit_comparator(const u32 left, const u32 op, const u32 right); |
Amy Griffis | 9c937dc | 2006-06-08 23:19:31 -0400 | [diff] [blame] | 110 | extern int audit_compare_dname_path(const char *dname, const char *path, |
| 111 | int *dirlen); |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 112 | extern struct sk_buff * audit_make_reply(int pid, int seq, int type, |
| 113 | int done, int multi, |
| 114 | void *payload, int size); |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 115 | extern void audit_send_reply(int pid, int seq, int type, |
| 116 | int done, int multi, |
| 117 | void *payload, int size); |
| 118 | extern void audit_log_lost(const char *message); |
| 119 | extern void audit_panic(const char *message); |
Darrel Goeddel | 3dc7e31 | 2006-03-10 18:14:06 -0600 | [diff] [blame] | 120 | |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 121 | struct audit_netlink_list { |
| 122 | int pid; |
| 123 | struct sk_buff_head q; |
| 124 | }; |
| 125 | |
| 126 | int audit_send_list(void *); |
| 127 | |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 128 | struct inotify_watch; |
| 129 | extern void audit_free_parent(struct inotify_watch *); |
| 130 | extern void audit_handle_ievent(struct inotify_watch *, u32, u32, u32, |
| 131 | const char *, struct inode *); |
Darrel Goeddel | 3dc7e31 | 2006-03-10 18:14:06 -0600 | [diff] [blame] | 132 | extern int selinux_audit_rule_update(void); |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 133 | |
| 134 | #ifdef CONFIG_AUDITSYSCALL |
Amy Griffis | e54dc24 | 2007-03-29 18:01:04 -0400 | [diff] [blame^] | 135 | extern int __audit_signal_info(int sig, struct task_struct *t); |
| 136 | static inline int audit_signal_info(int sig, struct task_struct *t) |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 137 | { |
Amy Griffis | e54dc24 | 2007-03-29 18:01:04 -0400 | [diff] [blame^] | 138 | if (unlikely((audit_pid && t->tgid == audit_pid) || |
| 139 | (audit_signals && !audit_dummy_context()))) |
| 140 | return __audit_signal_info(sig, t); |
| 141 | return 0; |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 142 | } |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 143 | extern enum audit_state audit_filter_inodes(struct task_struct *, |
| 144 | struct audit_context *); |
| 145 | extern void audit_set_auditable(struct audit_context *); |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 146 | #else |
Amy Griffis | e54dc24 | 2007-03-29 18:01:04 -0400 | [diff] [blame^] | 147 | #define audit_signal_info(s,t) AUDIT_DISABLED |
Amy Griffis | f368c07d | 2006-04-07 16:55:56 -0400 | [diff] [blame] | 148 | #define audit_filter_inodes(t,c) AUDIT_DISABLED |
| 149 | #define audit_set_auditable(c) |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame] | 150 | #endif |