1 /* auditsc.c -- System-call auditing support
2 * Handles all system-call specific auditing features.
4 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
23 * Many of the ideas implemented here are from Stephen C. Tweedie,
24 * especially the idea of avoiding a copy by using getname.
26 * The method for actual interception of syscall entry and exit (not in
27 * this file -- see entry.S) is based on a GPL'd patch written by
28 * okir@suse.de and Copyright 2003 SuSE Linux AG.
32 #include <linux/init.h>
33 #include <asm/atomic.h>
34 #include <asm/types.h>
36 #include <linux/module.h>
38 #include <linux/audit.h>
39 #include <linux/personality.h>
40 #include <linux/time.h>
41 #include <asm/unistd.h>
44 1 = put_count checking
45 2 = verbose put_count checking
49 /* No syscall auditing will take place unless audit_enabled != 0. */
50 extern int audit_enabled
;
52 /* AUDIT_NAMES is the number of slots we reserve in the audit_context
53 * for saving names from getname(). */
54 #define AUDIT_NAMES 20
56 /* AUDIT_NAMES_RESERVED is the number of slots we reserve in the
57 * audit_context from being used for nameless inodes from
59 #define AUDIT_NAMES_RESERVED 7
61 /* At task start time, the audit_state is set in the audit_context using
62 a per-task filter. At syscall entry, the audit_state is augmented by
63 the syscall filter. */
65 AUDIT_DISABLED
, /* Do not create per-task audit_context.
66 * No syscall-specific audit records can
68 AUDIT_SETUP_CONTEXT
, /* Create the per-task audit_context,
69 * but don't necessarily fill it in at
70 * syscall entry time (i.e., filter
72 AUDIT_BUILD_CONTEXT
, /* Create the per-task audit_context,
73 * and always fill it in at syscall
74 * entry time. This makes a full
75 * syscall record available if some
76 * other part of the kernel decides it
77 * should be recorded. */
78 AUDIT_RECORD_CONTEXT
/* Create the per-task audit_context,
79 * always fill it in at syscall entry
80 * time, and always write out the audit
81 * record at syscall exit time. */
84 /* When fs/namei.c:getname() is called, we store the pointer in name and
85 * we don't let putname() free it (instead we free all of the saved
86 * pointers at syscall exit time).
88 * Further, in fs/namei.c:path_lookup() we store the inode and device. */
99 struct audit_aux_data
{
100 struct audit_aux_data
*next
;
104 #define AUDIT_AUX_IPCPERM 0
106 struct audit_aux_data_ipcctl
{
107 struct audit_aux_data d
;
109 unsigned long qbytes
;
116 /* The per-task audit context. */
117 struct audit_context
{
118 int in_syscall
; /* 1 if task is in a syscall */
119 enum audit_state state
;
120 unsigned int serial
; /* serial number for record */
121 struct timespec ctime
; /* time of syscall entry */
122 uid_t loginuid
; /* login uid (identity) */
123 int major
; /* syscall number */
124 unsigned long argv
[4]; /* syscall arguments */
125 int return_valid
; /* return code is valid */
126 long return_code
;/* syscall return code */
127 int auditable
; /* 1 if record should be written */
129 struct audit_names names
[AUDIT_NAMES
];
130 struct audit_context
*previous
; /* For nested syscalls */
131 struct audit_aux_data
*aux
;
133 /* Save things to print about task_struct */
135 uid_t uid
, euid
, suid
, fsuid
;
136 gid_t gid
, egid
, sgid
, fsgid
;
137 unsigned long personality
;
147 /* There are three lists of rules -- one to search at task creation
148 * time, one to search at syscall entry time, and another to search at
149 * syscall exit time. */
150 static LIST_HEAD(audit_tsklist
);
151 static LIST_HEAD(audit_entlist
);
152 static LIST_HEAD(audit_extlist
);
155 struct list_head list
;
157 struct audit_rule rule
;
160 /* Check to see if two rules are identical. It is called from
161 * audit_del_rule during AUDIT_DEL. */
162 static int audit_compare_rule(struct audit_rule
*a
, struct audit_rule
*b
)
166 if (a
->flags
!= b
->flags
)
169 if (a
->action
!= b
->action
)
172 if (a
->field_count
!= b
->field_count
)
175 for (i
= 0; i
< a
->field_count
; i
++) {
176 if (a
->fields
[i
] != b
->fields
[i
]
177 || a
->values
[i
] != b
->values
[i
])
181 for (i
= 0; i
< AUDIT_BITMASK_SIZE
; i
++)
182 if (a
->mask
[i
] != b
->mask
[i
])
188 /* Note that audit_add_rule and audit_del_rule are called via
189 * audit_receive() in audit.c, and are protected by
190 * audit_netlink_sem. */
191 static inline int audit_add_rule(struct audit_entry
*entry
,
192 struct list_head
*list
)
194 if (entry
->rule
.flags
& AUDIT_PREPEND
) {
195 entry
->rule
.flags
&= ~AUDIT_PREPEND
;
196 list_add_rcu(&entry
->list
, list
);
198 list_add_tail_rcu(&entry
->list
, list
);
203 static void audit_free_rule(struct rcu_head
*head
)
205 struct audit_entry
*e
= container_of(head
, struct audit_entry
, rcu
);
209 /* Note that audit_add_rule and audit_del_rule are called via
210 * audit_receive() in audit.c, and are protected by
211 * audit_netlink_sem. */
212 static inline int audit_del_rule(struct audit_rule
*rule
,
213 struct list_head
*list
)
215 struct audit_entry
*e
;
217 /* Do not use the _rcu iterator here, since this is the only
218 * deletion routine. */
219 list_for_each_entry(e
, list
, list
) {
220 if (!audit_compare_rule(rule
, &e
->rule
)) {
221 list_del_rcu(&e
->list
);
222 call_rcu(&e
->rcu
, audit_free_rule
);
226 return -EFAULT
; /* No matching rule */
229 /* Copy rule from user-space to kernel-space. Called during
231 static int audit_copy_rule(struct audit_rule
*d
, struct audit_rule
*s
)
235 if (s
->action
!= AUDIT_NEVER
236 && s
->action
!= AUDIT_POSSIBLE
237 && s
->action
!= AUDIT_ALWAYS
)
239 if (s
->field_count
< 0 || s
->field_count
> AUDIT_MAX_FIELDS
)
243 d
->action
= s
->action
;
244 d
->field_count
= s
->field_count
;
245 for (i
= 0; i
< d
->field_count
; i
++) {
246 d
->fields
[i
] = s
->fields
[i
];
247 d
->values
[i
] = s
->values
[i
];
249 for (i
= 0; i
< AUDIT_BITMASK_SIZE
; i
++) d
->mask
[i
] = s
->mask
[i
];
253 int audit_receive_filter(int type
, int pid
, int uid
, int seq
, void *data
,
257 struct audit_entry
*entry
;
262 /* The *_rcu iterators not needed here because we are
263 always called with audit_netlink_sem held. */
264 list_for_each_entry(entry
, &audit_tsklist
, list
)
265 audit_send_reply(pid
, seq
, AUDIT_LIST
, 0, 1,
266 &entry
->rule
, sizeof(entry
->rule
));
267 list_for_each_entry(entry
, &audit_entlist
, list
)
268 audit_send_reply(pid
, seq
, AUDIT_LIST
, 0, 1,
269 &entry
->rule
, sizeof(entry
->rule
));
270 list_for_each_entry(entry
, &audit_extlist
, list
)
271 audit_send_reply(pid
, seq
, AUDIT_LIST
, 0, 1,
272 &entry
->rule
, sizeof(entry
->rule
));
273 audit_send_reply(pid
, seq
, AUDIT_LIST
, 1, 1, NULL
, 0);
276 if (!(entry
= kmalloc(sizeof(*entry
), GFP_KERNEL
)))
278 if (audit_copy_rule(&entry
->rule
, data
)) {
282 flags
= entry
->rule
.flags
;
283 if (!err
&& (flags
& AUDIT_PER_TASK
))
284 err
= audit_add_rule(entry
, &audit_tsklist
);
285 if (!err
&& (flags
& AUDIT_AT_ENTRY
))
286 err
= audit_add_rule(entry
, &audit_entlist
);
287 if (!err
&& (flags
& AUDIT_AT_EXIT
))
288 err
= audit_add_rule(entry
, &audit_extlist
);
289 audit_log(NULL
, "auid %u added an audit rule\n", loginuid
);
292 flags
=((struct audit_rule
*)data
)->flags
;
293 if (!err
&& (flags
& AUDIT_PER_TASK
))
294 err
= audit_del_rule(data
, &audit_tsklist
);
295 if (!err
&& (flags
& AUDIT_AT_ENTRY
))
296 err
= audit_del_rule(data
, &audit_entlist
);
297 if (!err
&& (flags
& AUDIT_AT_EXIT
))
298 err
= audit_del_rule(data
, &audit_extlist
);
299 audit_log(NULL
, "auid %u removed an audit rule\n", loginuid
);
308 /* Compare a task_struct with an audit_rule. Return 1 on match, 0
310 static int audit_filter_rules(struct task_struct
*tsk
,
311 struct audit_rule
*rule
,
312 struct audit_context
*ctx
,
313 enum audit_state
*state
)
317 for (i
= 0; i
< rule
->field_count
; i
++) {
318 u32 field
= rule
->fields
[i
] & ~AUDIT_NEGATE
;
319 u32 value
= rule
->values
[i
];
324 result
= (tsk
->pid
== value
);
327 result
= (tsk
->uid
== value
);
330 result
= (tsk
->euid
== value
);
333 result
= (tsk
->suid
== value
);
336 result
= (tsk
->fsuid
== value
);
339 result
= (tsk
->gid
== value
);
342 result
= (tsk
->egid
== value
);
345 result
= (tsk
->sgid
== value
);
348 result
= (tsk
->fsgid
== value
);
351 result
= (tsk
->personality
== value
);
355 result
= (ctx
->arch
== value
);
359 if (ctx
&& ctx
->return_valid
)
360 result
= (ctx
->return_code
== value
);
363 if (ctx
&& ctx
->return_valid
)
364 result
= (ctx
->return_valid
== AUDITSC_SUCCESS
);
368 for (j
= 0; j
< ctx
->name_count
; j
++) {
369 if (MAJOR(ctx
->names
[j
].dev
)==value
) {
378 for (j
= 0; j
< ctx
->name_count
; j
++) {
379 if (MINOR(ctx
->names
[j
].dev
)==value
) {
388 for (j
= 0; j
< ctx
->name_count
; j
++) {
389 if (ctx
->names
[j
].ino
== value
) {
399 result
= (ctx
->loginuid
== value
);
406 result
= (ctx
->argv
[field
-AUDIT_ARG0
]==value
);
410 if (rule
->fields
[i
] & AUDIT_NEGATE
)
415 switch (rule
->action
) {
416 case AUDIT_NEVER
: *state
= AUDIT_DISABLED
; break;
417 case AUDIT_POSSIBLE
: *state
= AUDIT_BUILD_CONTEXT
; break;
418 case AUDIT_ALWAYS
: *state
= AUDIT_RECORD_CONTEXT
; break;
423 /* At process creation time, we can determine if system-call auditing is
424 * completely disabled for this task. Since we only have the task
425 * structure at this point, we can only check uid and gid.
427 static enum audit_state
audit_filter_task(struct task_struct
*tsk
)
429 struct audit_entry
*e
;
430 enum audit_state state
;
433 list_for_each_entry_rcu(e
, &audit_tsklist
, list
) {
434 if (audit_filter_rules(tsk
, &e
->rule
, NULL
, &state
)) {
440 return AUDIT_BUILD_CONTEXT
;
443 /* At syscall entry and exit time, this filter is called if the
444 * audit_state is not low enough that auditing cannot take place, but is
445 * also not high enough that we already know we have to write and audit
446 * record (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT).
448 static enum audit_state
audit_filter_syscall(struct task_struct
*tsk
,
449 struct audit_context
*ctx
,
450 struct list_head
*list
)
452 struct audit_entry
*e
;
453 enum audit_state state
;
454 int word
= AUDIT_WORD(ctx
->major
);
455 int bit
= AUDIT_BIT(ctx
->major
);
458 list_for_each_entry_rcu(e
, list
, list
) {
459 if ((e
->rule
.mask
[word
] & bit
) == bit
460 && audit_filter_rules(tsk
, &e
->rule
, ctx
, &state
)) {
466 return AUDIT_BUILD_CONTEXT
;
469 /* This should be called with task_lock() held. */
470 static inline struct audit_context
*audit_get_context(struct task_struct
*tsk
,
474 struct audit_context
*context
= tsk
->audit_context
;
476 if (likely(!context
))
478 context
->return_valid
= return_valid
;
479 context
->return_code
= return_code
;
481 if (context
->in_syscall
&& !context
->auditable
) {
482 enum audit_state state
;
483 state
= audit_filter_syscall(tsk
, context
, &audit_extlist
);
484 if (state
== AUDIT_RECORD_CONTEXT
)
485 context
->auditable
= 1;
488 context
->pid
= tsk
->pid
;
489 context
->uid
= tsk
->uid
;
490 context
->gid
= tsk
->gid
;
491 context
->euid
= tsk
->euid
;
492 context
->suid
= tsk
->suid
;
493 context
->fsuid
= tsk
->fsuid
;
494 context
->egid
= tsk
->egid
;
495 context
->sgid
= tsk
->sgid
;
496 context
->fsgid
= tsk
->fsgid
;
497 context
->personality
= tsk
->personality
;
498 tsk
->audit_context
= NULL
;
502 static inline void audit_free_names(struct audit_context
*context
)
507 if (context
->auditable
508 ||context
->put_count
+ context
->ino_count
!= context
->name_count
) {
509 printk(KERN_ERR
"audit.c:%d(:%d): major=%d in_syscall=%d"
510 " name_count=%d put_count=%d"
511 " ino_count=%d [NOT freeing]\n",
513 context
->serial
, context
->major
, context
->in_syscall
,
514 context
->name_count
, context
->put_count
,
516 for (i
= 0; i
< context
->name_count
; i
++)
517 printk(KERN_ERR
"names[%d] = %p = %s\n", i
,
518 context
->names
[i
].name
,
519 context
->names
[i
].name
);
525 context
->put_count
= 0;
526 context
->ino_count
= 0;
529 for (i
= 0; i
< context
->name_count
; i
++)
530 if (context
->names
[i
].name
)
531 __putname(context
->names
[i
].name
);
532 context
->name_count
= 0;
535 static inline void audit_free_aux(struct audit_context
*context
)
537 struct audit_aux_data
*aux
;
539 while ((aux
= context
->aux
)) {
540 context
->aux
= aux
->next
;
545 static inline void audit_zero_context(struct audit_context
*context
,
546 enum audit_state state
)
548 uid_t loginuid
= context
->loginuid
;
550 memset(context
, 0, sizeof(*context
));
551 context
->state
= state
;
552 context
->loginuid
= loginuid
;
555 static inline struct audit_context
*audit_alloc_context(enum audit_state state
)
557 struct audit_context
*context
;
559 if (!(context
= kmalloc(sizeof(*context
), GFP_KERNEL
)))
561 audit_zero_context(context
, state
);
565 /* Filter on the task information and allocate a per-task audit context
566 * if necessary. Doing so turns on system call auditing for the
567 * specified task. This is called from copy_process, so no lock is
569 int audit_alloc(struct task_struct
*tsk
)
571 struct audit_context
*context
;
572 enum audit_state state
;
574 if (likely(!audit_enabled
))
575 return 0; /* Return if not auditing. */
577 state
= audit_filter_task(tsk
);
578 if (likely(state
== AUDIT_DISABLED
))
581 if (!(context
= audit_alloc_context(state
))) {
582 audit_log_lost("out of memory in audit_alloc");
586 /* Preserve login uid */
587 context
->loginuid
= -1;
588 if (current
->audit_context
)
589 context
->loginuid
= current
->audit_context
->loginuid
;
591 tsk
->audit_context
= context
;
592 set_tsk_thread_flag(tsk
, TIF_SYSCALL_AUDIT
);
596 static inline void audit_free_context(struct audit_context
*context
)
598 struct audit_context
*previous
;
602 previous
= context
->previous
;
603 if (previous
|| (count
&& count
< 10)) {
605 printk(KERN_ERR
"audit(:%d): major=%d name_count=%d:"
606 " freeing multiple contexts (%d)\n",
607 context
->serial
, context
->major
,
608 context
->name_count
, count
);
610 audit_free_names(context
);
611 audit_free_aux(context
);
616 printk(KERN_ERR
"audit: freed %d contexts\n", count
);
619 static void audit_log_task_info(struct audit_buffer
*ab
)
621 char name
[sizeof(current
->comm
)];
622 struct mm_struct
*mm
= current
->mm
;
623 struct vm_area_struct
*vma
;
625 get_task_comm(name
, current
);
626 audit_log_format(ab
, " comm=%s", name
);
631 down_read(&mm
->mmap_sem
);
634 if ((vma
->vm_flags
& VM_EXECUTABLE
) &&
636 audit_log_d_path(ab
, "exe=",
637 vma
->vm_file
->f_dentry
,
638 vma
->vm_file
->f_vfsmnt
);
643 up_read(&mm
->mmap_sem
);
646 static void audit_log_exit(struct audit_context
*context
)
649 struct audit_buffer
*ab
;
651 ab
= audit_log_start(context
);
653 return; /* audit_panic has been called */
654 audit_log_format(ab
, "syscall=%d", context
->major
);
655 if (context
->personality
!= PER_LINUX
)
656 audit_log_format(ab
, " per=%lx", context
->personality
);
657 audit_log_format(ab
, " arch=%x", context
->arch
);
658 if (context
->return_valid
)
659 audit_log_format(ab
, " success=%s exit=%ld",
660 (context
->return_valid
==AUDITSC_SUCCESS
)?"yes":"no",
661 context
->return_code
);
663 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d"
664 " pid=%d loginuid=%d uid=%d gid=%d"
665 " euid=%d suid=%d fsuid=%d"
666 " egid=%d sgid=%d fsgid=%d",
676 context
->euid
, context
->suid
, context
->fsuid
,
677 context
->egid
, context
->sgid
, context
->fsgid
);
678 audit_log_task_info(ab
);
680 while (context
->aux
) {
681 struct audit_aux_data
*aux
;
683 ab
= audit_log_start(context
);
685 continue; /* audit_panic has been called */
688 context
->aux
= aux
->next
;
690 audit_log_format(ab
, "auxitem=%d", aux
->type
);
692 case AUDIT_AUX_IPCPERM
: {
693 struct audit_aux_data_ipcctl
*axi
= (void *)aux
;
695 " qbytes=%lx uid=%d gid=%d mode=%x",
696 axi
->qbytes
, axi
->uid
, axi
->gid
, axi
->mode
);
703 for (i
= 0; i
< context
->name_count
; i
++) {
704 ab
= audit_log_start(context
);
706 continue; /* audit_panic has been called */
707 audit_log_format(ab
, "item=%d", i
);
708 if (context
->names
[i
].name
) {
709 audit_log_format(ab
, " name=");
710 audit_log_untrustedstring(ab
, context
->names
[i
].name
);
712 if (context
->names
[i
].ino
!= (unsigned long)-1)
713 audit_log_format(ab
, " inode=%lu dev=%02x:%02x mode=%#o"
714 " uid=%d gid=%d rdev=%02x:%02x",
715 context
->names
[i
].ino
,
716 MAJOR(context
->names
[i
].dev
),
717 MINOR(context
->names
[i
].dev
),
718 context
->names
[i
].mode
,
719 context
->names
[i
].uid
,
720 context
->names
[i
].gid
,
721 MAJOR(context
->names
[i
].rdev
),
722 MINOR(context
->names
[i
].rdev
));
727 /* Free a per-task audit context. Called from copy_process and
728 * __put_task_struct. */
729 void audit_free(struct task_struct
*tsk
)
731 struct audit_context
*context
;
734 context
= audit_get_context(tsk
, 0, 0);
737 if (likely(!context
))
740 /* Check for system calls that do not go through the exit
741 * function (e.g., exit_group), then free context block. */
742 if (context
->in_syscall
&& context
->auditable
)
743 audit_log_exit(context
);
745 audit_free_context(context
);
748 /* Compute a serial number for the audit record. Audit records are
749 * written to user-space as soon as they are generated, so a complete
750 * audit record may be written in several pieces. The timestamp of the
751 * record and this serial number are used by the user-space daemon to
752 * determine which pieces belong to the same audit record. The
753 * (timestamp,serial) tuple is unique for each syscall and is live from
754 * syscall entry to syscall exit.
756 * Atomic values are only guaranteed to be 24-bit, so we count down.
758 * NOTE: Another possibility is to store the formatted records off the
759 * audit context (for those records that have a context), and emit them
760 * all at syscall exit. However, this could delay the reporting of
761 * significant errors until syscall exit (or never, if the system
763 static inline unsigned int audit_serial(void)
765 static atomic_t serial
= ATOMIC_INIT(0xffffff);
769 a
= atomic_read(&serial
);
770 if (atomic_dec_and_test(&serial
))
771 atomic_set(&serial
, 0xffffff);
772 b
= atomic_read(&serial
);
773 } while (b
!= a
- 1);
778 /* Fill in audit context at syscall entry. This only happens if the
779 * audit context was created when the task was created and the state or
780 * filters demand the audit context be built. If the state from the
781 * per-task filter or from the per-syscall filter is AUDIT_RECORD_CONTEXT,
782 * then the record will be written at syscall exit time (otherwise, it
783 * will only be written if another part of the kernel requests that it
785 void audit_syscall_entry(struct task_struct
*tsk
, int arch
, int major
,
786 unsigned long a1
, unsigned long a2
,
787 unsigned long a3
, unsigned long a4
)
789 struct audit_context
*context
= tsk
->audit_context
;
790 enum audit_state state
;
794 /* This happens only on certain architectures that make system
795 * calls in kernel_thread via the entry.S interface, instead of
796 * with direct calls. (If you are porting to a new
797 * architecture, hitting this condition can indicate that you
798 * got the _exit/_leave calls backward in entry.S.)
802 * ppc64 yes (see arch/ppc64/kernel/misc.S)
804 * This also happens with vm86 emulation in a non-nested manner
805 * (entries without exits), so this case must be caught.
807 if (context
->in_syscall
) {
808 struct audit_context
*newctx
;
810 #if defined(__NR_vm86) && defined(__NR_vm86old)
811 /* vm86 mode should only be entered once */
812 if (major
== __NR_vm86
|| major
== __NR_vm86old
)
817 "audit(:%d) pid=%d in syscall=%d;"
818 " entering syscall=%d\n",
819 context
->serial
, tsk
->pid
, context
->major
, major
);
821 newctx
= audit_alloc_context(context
->state
);
823 newctx
->previous
= context
;
825 tsk
->audit_context
= newctx
;
827 /* If we can't alloc a new context, the best we
828 * can do is to leak memory (any pending putname
829 * will be lost). The only other alternative is
830 * to abandon auditing. */
831 audit_zero_context(context
, context
->state
);
834 BUG_ON(context
->in_syscall
|| context
->name_count
);
839 context
->arch
= arch
;
840 context
->major
= major
;
841 context
->argv
[0] = a1
;
842 context
->argv
[1] = a2
;
843 context
->argv
[2] = a3
;
844 context
->argv
[3] = a4
;
846 state
= context
->state
;
847 if (state
== AUDIT_SETUP_CONTEXT
|| state
== AUDIT_BUILD_CONTEXT
)
848 state
= audit_filter_syscall(tsk
, context
, &audit_entlist
);
849 if (likely(state
== AUDIT_DISABLED
))
852 context
->serial
= audit_serial();
853 context
->ctime
= CURRENT_TIME
;
854 context
->in_syscall
= 1;
855 context
->auditable
= !!(state
== AUDIT_RECORD_CONTEXT
);
858 /* Tear down after system call. If the audit context has been marked as
859 * auditable (either because of the AUDIT_RECORD_CONTEXT state from
860 * filtering, or because some other part of the kernel write an audit
861 * message), then write out the syscall information. In call cases,
862 * free the names stored from getname(). */
863 void audit_syscall_exit(struct task_struct
*tsk
, int valid
, long return_code
)
865 struct audit_context
*context
;
867 get_task_struct(tsk
);
869 context
= audit_get_context(tsk
, valid
, return_code
);
872 /* Not having a context here is ok, since the parent may have
873 * called __put_task_struct. */
874 if (likely(!context
))
877 if (context
->in_syscall
&& context
->auditable
)
878 audit_log_exit(context
);
880 context
->in_syscall
= 0;
881 context
->auditable
= 0;
883 if (context
->previous
) {
884 struct audit_context
*new_context
= context
->previous
;
885 context
->previous
= NULL
;
886 audit_free_context(context
);
887 tsk
->audit_context
= new_context
;
889 audit_free_names(context
);
890 audit_free_aux(context
);
891 audit_zero_context(context
, context
->state
);
892 tsk
->audit_context
= context
;
894 put_task_struct(tsk
);
897 /* Add a name to the list. Called from fs/namei.c:getname(). */
898 void audit_getname(const char *name
)
900 struct audit_context
*context
= current
->audit_context
;
902 if (!context
|| IS_ERR(name
) || !name
)
905 if (!context
->in_syscall
) {
907 printk(KERN_ERR
"%s:%d(:%d): ignoring getname(%p)\n",
908 __FILE__
, __LINE__
, context
->serial
, name
);
913 BUG_ON(context
->name_count
>= AUDIT_NAMES
);
914 context
->names
[context
->name_count
].name
= name
;
915 context
->names
[context
->name_count
].ino
= (unsigned long)-1;
916 ++context
->name_count
;
919 /* Intercept a putname request. Called from
920 * include/linux/fs.h:putname(). If we have stored the name from
921 * getname in the audit context, then we delay the putname until syscall
923 void audit_putname(const char *name
)
925 struct audit_context
*context
= current
->audit_context
;
928 if (!context
->in_syscall
) {
930 printk(KERN_ERR
"%s:%d(:%d): __putname(%p)\n",
931 __FILE__
, __LINE__
, context
->serial
, name
);
932 if (context
->name_count
) {
934 for (i
= 0; i
< context
->name_count
; i
++)
935 printk(KERN_ERR
"name[%d] = %p = %s\n", i
,
936 context
->names
[i
].name
,
937 context
->names
[i
].name
);
944 ++context
->put_count
;
945 if (context
->put_count
> context
->name_count
) {
946 printk(KERN_ERR
"%s:%d(:%d): major=%d"
947 " in_syscall=%d putname(%p) name_count=%d"
950 context
->serial
, context
->major
,
951 context
->in_syscall
, name
, context
->name_count
,
959 /* Store the inode and device from a lookup. Called from
960 * fs/namei.c:path_lookup(). */
961 void audit_inode(const char *name
, const struct inode
*inode
)
964 struct audit_context
*context
= current
->audit_context
;
966 if (!context
->in_syscall
)
968 if (context
->name_count
969 && context
->names
[context
->name_count
-1].name
970 && context
->names
[context
->name_count
-1].name
== name
)
971 idx
= context
->name_count
- 1;
972 else if (context
->name_count
> 1
973 && context
->names
[context
->name_count
-2].name
974 && context
->names
[context
->name_count
-2].name
== name
)
975 idx
= context
->name_count
- 2;
977 /* FIXME: how much do we care about inodes that have no
978 * associated name? */
979 if (context
->name_count
>= AUDIT_NAMES
- AUDIT_NAMES_RESERVED
)
981 idx
= context
->name_count
++;
982 context
->names
[idx
].name
= NULL
;
984 ++context
->ino_count
;
987 context
->names
[idx
].ino
= inode
->i_ino
;
988 context
->names
[idx
].dev
= inode
->i_sb
->s_dev
;
989 context
->names
[idx
].mode
= inode
->i_mode
;
990 context
->names
[idx
].uid
= inode
->i_uid
;
991 context
->names
[idx
].gid
= inode
->i_gid
;
992 context
->names
[idx
].rdev
= inode
->i_rdev
;
995 void audit_get_stamp(struct audit_context
*ctx
,
996 struct timespec
*t
, unsigned int *serial
)
999 t
->tv_sec
= ctx
->ctime
.tv_sec
;
1000 t
->tv_nsec
= ctx
->ctime
.tv_nsec
;
1001 *serial
= ctx
->serial
;
1009 extern int audit_set_type(struct audit_buffer
*ab
, int type
);
1011 int audit_set_loginuid(struct task_struct
*task
, uid_t loginuid
)
1013 if (task
->audit_context
) {
1014 struct audit_buffer
*ab
;
1016 ab
= audit_log_start(NULL
);
1018 audit_log_format(ab
, "login pid=%d uid=%u "
1019 "old loginuid=%u new loginuid=%u",
1020 task
->pid
, task
->uid
,
1021 task
->audit_context
->loginuid
, loginuid
);
1022 audit_set_type(ab
, AUDIT_LOGIN
);
1025 task
->audit_context
->loginuid
= loginuid
;
1030 uid_t
audit_get_loginuid(struct audit_context
*ctx
)
1032 return ctx
? ctx
->loginuid
: -1;
1035 int audit_ipc_perms(unsigned long qbytes
, uid_t uid
, gid_t gid
, mode_t mode
)
1037 struct audit_aux_data_ipcctl
*ax
;
1038 struct audit_context
*context
= current
->audit_context
;
1040 if (likely(!context
))
1043 ax
= kmalloc(sizeof(*ax
), GFP_KERNEL
);
1047 ax
->qbytes
= qbytes
;
1052 ax
->d
.type
= AUDIT_AUX_IPCPERM
;
1053 ax
->d
.next
= context
->aux
;
1054 context
->aux
= (void *)ax
;
1058 void audit_signal_info(int sig
, struct task_struct
*t
)
1060 extern pid_t audit_sig_pid
;
1061 extern uid_t audit_sig_uid
;
1062 extern int audit_pid
;
1064 if (unlikely(audit_pid
&& t
->pid
== audit_pid
)) {
1065 if (sig
== SIGTERM
|| sig
== SIGHUP
) {
1066 struct audit_context
*ctx
= current
->audit_context
;
1067 audit_sig_pid
= current
->pid
;
1069 audit_sig_uid
= ctx
->loginuid
;
1071 audit_sig_uid
= current
->uid
;