audit.c 40.5 KB
Newer Older
1
/* audit.c -- Auditing support
L
Linus Torvalds 已提交
2 3 4
 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon.
 * System-call specific features have moved to auditsc.c
 *
S
Steve Grubb 已提交
5
 * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina.
L
Linus Torvalds 已提交
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
 * All Rights Reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
 *
24
 * Goals: 1) Integrate fully with Security Modules.
L
Linus Torvalds 已提交
25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40
 *	  2) Minimal run-time overhead:
 *	     a) Minimal when syscall auditing is disabled (audit_enable=0).
 *	     b) Small when syscall auditing is enabled and no audit record
 *		is generated (defer as much work as possible to record
 *		generation time):
 *		i) context is allocated,
 *		ii) names from getname are stored without a copy, and
 *		iii) inode information stored from path_lookup.
 *	  3) Ability to disable syscall auditing at boot time (audit=0).
 *	  4) Usable by other parts of the kernel (if audit_log* is called,
 *	     then a syscall record will be generated automatically for the
 *	     current syscall).
 *	  5) Netlink interface to user-space.
 *	  6) Support low-overhead kernel-based filtering to minimize the
 *	     information that must be passed to user-space.
 *
41
 * Example user-space utilities: http://people.redhat.com/sgrubb/audit/
L
Linus Torvalds 已提交
42 43 44 45
 */

#include <linux/init.h>
#include <asm/types.h>
A
Arun Sharma 已提交
46
#include <linux/atomic.h>
L
Linus Torvalds 已提交
47
#include <linux/mm.h>
48
#include <linux/export.h>
49
#include <linux/slab.h>
50 51
#include <linux/err.h>
#include <linux/kthread.h>
L
Linus Torvalds 已提交
52 53 54 55

#include <linux/audit.h>

#include <net/sock.h>
56
#include <net/netlink.h>
L
Linus Torvalds 已提交
57
#include <linux/skbuff.h>
58 59 60
#ifdef CONFIG_SECURITY
#include <linux/security.h>
#endif
L
Linus Torvalds 已提交
61
#include <linux/netlink.h>
62
#include <linux/freezer.h>
M
Miloslav Trmac 已提交
63
#include <linux/tty.h>
64
#include <linux/pid_namespace.h>
65 66

#include "audit.h"
L
Linus Torvalds 已提交
67

68
/* No auditing will take place until audit_initialized == AUDIT_INITIALIZED.
L
Linus Torvalds 已提交
69
 * (Initialization happens after skb_init is called.) */
70 71 72
#define AUDIT_DISABLED		-1
#define AUDIT_UNINITIALIZED	0
#define AUDIT_INITIALIZED	1
L
Linus Torvalds 已提交
73 74
static int	audit_initialized;

75 76 77
#define AUDIT_OFF	0
#define AUDIT_ON	1
#define AUDIT_LOCKED	2
L
Linus Torvalds 已提交
78
int		audit_enabled;
79
int		audit_ever_enabled;
L
Linus Torvalds 已提交
80

81 82
EXPORT_SYMBOL_GPL(audit_enabled);

L
Linus Torvalds 已提交
83 84 85 86 87 88
/* Default state when kernel boots without any parameters. */
static int	audit_default;

/* If auditing cannot proceed, audit_failure selects what happens. */
static int	audit_failure = AUDIT_FAIL_PRINTK;

89 90
/*
 * If audit records are to be written to the netlink socket, audit_pid
91 92
 * contains the pid of the auditd process and audit_nlk_portid contains
 * the portid to use to send netlink messages to that process.
93
 */
94
int		audit_pid;
95
static int	audit_nlk_portid;
L
Linus Torvalds 已提交
96

97
/* If audit_rate_limit is non-zero, limit the rate of sending audit records
L
Linus Torvalds 已提交
98 99 100 101 102 103
 * to that number per second.  This prevents DoS attacks, but results in
 * audit records being dropped. */
static int	audit_rate_limit;

/* Number of outstanding audit_buffers allowed. */
static int	audit_backlog_limit = 64;
104 105
static int	audit_backlog_wait_time = 60 * HZ;
static int	audit_backlog_wait_overflow = 0;
L
Linus Torvalds 已提交
106

107
/* The identity of the user shutting down the audit system. */
108
kuid_t		audit_sig_uid = INVALID_UID;
109
pid_t		audit_sig_pid = -1;
110
u32		audit_sig_sid = 0;
111

L
Linus Torvalds 已提交
112 113 114 115 116 117 118 119 120 121 122 123
/* Records can be lost in several ways:
   0) [suppressed in audit_alloc]
   1) out of memory in audit_log_start [kmalloc of struct audit_buffer]
   2) out of memory in audit_log_move [alloc_skb]
   3) suppressed due to audit_rate_limit
   4) suppressed due to audit_backlog_limit
*/
static atomic_t    audit_lost = ATOMIC_INIT(0);

/* The netlink socket. */
static struct sock *audit_sock;

A
Amy Griffis 已提交
124 125 126
/* Hash for inode-based rules */
struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];

127
/* The audit_freelist is a list of pre-allocated audit buffers (if more
L
Linus Torvalds 已提交
128 129 130
 * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of
 * being placed on the freelist). */
static DEFINE_SPINLOCK(audit_freelist_lock);
131
static int	   audit_freelist_count;
L
Linus Torvalds 已提交
132 133
static LIST_HEAD(audit_freelist);

134
static struct sk_buff_head audit_skb_queue;
135 136
/* queue of skbs to send to auditd when/if it comes back */
static struct sk_buff_head audit_skb_hold_queue;
137 138
static struct task_struct *kauditd_task;
static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
139
static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
L
Linus Torvalds 已提交
140

A
Amy Griffis 已提交
141
/* Serialize requests from userspace. */
A
Al Viro 已提交
142
DEFINE_MUTEX(audit_cmd_mutex);
L
Linus Torvalds 已提交
143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159

/* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
 * audit records.  Since printk uses a 1024 byte buffer, this buffer
 * should be at least that large. */
#define AUDIT_BUFSIZ 1024

/* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the
 * audit_freelist.  Doing so eliminates many kmalloc/kfree calls. */
#define AUDIT_MAXFREE  (2*NR_CPUS)

/* The audit_buffer is used when formatting an audit record.  The caller
 * locks briefly to get the record off the freelist or to allocate the
 * buffer, and locks briefly to send the buffer to the netlink layer or
 * to place it on a transmit queue.  Multiple audit_buffers can be in
 * use simultaneously. */
struct audit_buffer {
	struct list_head     list;
160
	struct sk_buff       *skb;	/* formatted skb ready to send */
L
Linus Torvalds 已提交
161
	struct audit_context *ctx;	/* NULL or associated context */
A
Al Viro 已提交
162
	gfp_t		     gfp_mask;
L
Linus Torvalds 已提交
163 164
};

165 166 167 168 169
struct audit_reply {
	int pid;
	struct sk_buff *skb;
};

170 171
static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
{
172 173 174 175
	if (ab) {
		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
		nlh->nlmsg_pid = pid;
	}
176 177
}

178
void audit_panic(const char *message)
L
Linus Torvalds 已提交
179 180 181 182 183 184
{
	switch (audit_failure)
	{
	case AUDIT_FAIL_SILENT:
		break;
	case AUDIT_FAIL_PRINTK:
185 186
		if (printk_ratelimit())
			printk(KERN_ERR "audit: %s\n", message);
L
Linus Torvalds 已提交
187 188
		break;
	case AUDIT_FAIL_PANIC:
189 190 191
		/* test audit_pid since printk is always losey, why bother? */
		if (audit_pid)
			panic("audit: %s\n", message);
L
Linus Torvalds 已提交
192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224
		break;
	}
}

static inline int audit_rate_check(void)
{
	static unsigned long	last_check = 0;
	static int		messages   = 0;
	static DEFINE_SPINLOCK(lock);
	unsigned long		flags;
	unsigned long		now;
	unsigned long		elapsed;
	int			retval	   = 0;

	if (!audit_rate_limit) return 1;

	spin_lock_irqsave(&lock, flags);
	if (++messages < audit_rate_limit) {
		retval = 1;
	} else {
		now     = jiffies;
		elapsed = now - last_check;
		if (elapsed > HZ) {
			last_check = now;
			messages   = 0;
			retval     = 1;
		}
	}
	spin_unlock_irqrestore(&lock, flags);

	return retval;
}

225 226 227 228 229 230 231 232
/**
 * audit_log_lost - conditionally log lost audit message event
 * @message: the message stating reason for lost audit message
 *
 * Emit at least 1 message per second, even if audit_rate_check is
 * throttling.
 * Always increment the lost messages counter.
*/
L
Linus Torvalds 已提交
233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255
void audit_log_lost(const char *message)
{
	static unsigned long	last_msg = 0;
	static DEFINE_SPINLOCK(lock);
	unsigned long		flags;
	unsigned long		now;
	int			print;

	atomic_inc(&audit_lost);

	print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);

	if (!print) {
		spin_lock_irqsave(&lock, flags);
		now = jiffies;
		if (now - last_msg > HZ) {
			print = 1;
			last_msg = now;
		}
		spin_unlock_irqrestore(&lock, flags);
	}

	if (print) {
256 257 258 259 260 261 262
		if (printk_ratelimit())
			printk(KERN_WARNING
				"audit: audit_lost=%d audit_rate_limit=%d "
				"audit_backlog_limit=%d\n",
				atomic_read(&audit_lost),
				audit_rate_limit,
				audit_backlog_limit);
L
Linus Torvalds 已提交
263 264 265 266
		audit_panic(message);
	}
}

267
static int audit_log_config_change(char *function_name, int new, int old,
268
				   kuid_t loginuid, u32 sessionid, u32 sid,
269
				   int allow_changes)
L
Linus Torvalds 已提交
270
{
271 272
	struct audit_buffer *ab;
	int rc = 0;
273

274
	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
275
	audit_log_format(ab, "%s=%d old=%d auid=%u ses=%u", function_name, new,
276
			 old, from_kuid(&init_user_ns, loginuid), sessionid);
277 278 279
	if (sid) {
		char *ctx = NULL;
		u32 len;
280

281
		rc = security_secid_to_secctx(sid, &ctx, &len);
282 283 284 285 286
		if (rc) {
			audit_log_format(ab, " sid=%u", sid);
			allow_changes = 0; /* Something weird, deny request */
		} else {
			audit_log_format(ab, " subj=%s", ctx);
287
			security_release_secctx(ctx, len);
288
		}
S
Steve Grubb 已提交
289
	}
290 291
	audit_log_format(ab, " res=%d", allow_changes);
	audit_log_end(ab);
S
Steve Grubb 已提交
292
	return rc;
L
Linus Torvalds 已提交
293 294
}

295
static int audit_do_config_change(char *function_name, int *to_change,
296
				  int new, kuid_t loginuid, u32 sessionid,
297
				  u32 sid)
L
Linus Torvalds 已提交
298
{
299
	int allow_changes, rc = 0, old = *to_change;
S
Steve Grubb 已提交
300 301

	/* check if we are locked */
302 303
	if (audit_enabled == AUDIT_LOCKED)
		allow_changes = 0;
S
Steve Grubb 已提交
304
	else
305
		allow_changes = 1;
306

307
	if (audit_enabled != AUDIT_OFF) {
308 309
		rc = audit_log_config_change(function_name, new, old, loginuid,
					     sessionid, sid, allow_changes);
310 311
		if (rc)
			allow_changes = 0;
S
Steve Grubb 已提交
312 313 314
	}

	/* If we are allowed, make the change */
315 316
	if (allow_changes == 1)
		*to_change = new;
S
Steve Grubb 已提交
317 318 319 320
	/* Not allowed, update reason */
	else if (rc == 0)
		rc = -EPERM;
	return rc;
L
Linus Torvalds 已提交
321 322
}

323
static int audit_set_rate_limit(int limit, kuid_t loginuid, u32 sessionid,
324
				u32 sid)
L
Linus Torvalds 已提交
325
{
326
	return audit_do_config_change("audit_rate_limit", &audit_rate_limit,
327
				      limit, loginuid, sessionid, sid);
328
}
329

330
static int audit_set_backlog_limit(int limit, kuid_t loginuid, u32 sessionid,
331
				   u32 sid)
332 333
{
	return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit,
334
				      limit, loginuid, sessionid, sid);
335
}
S
Steve Grubb 已提交
336

337
static int audit_set_enabled(int state, kuid_t loginuid, u32 sessionid, u32 sid)
338
{
339
	int rc;
340 341
	if (state < AUDIT_OFF || state > AUDIT_LOCKED)
		return -EINVAL;
S
Steve Grubb 已提交
342

343
	rc =  audit_do_config_change("audit_enabled", &audit_enabled, state,
344
				     loginuid, sessionid, sid);
345 346 347 348 349

	if (!rc)
		audit_ever_enabled |= !!state;

	return rc;
L
Linus Torvalds 已提交
350 351
}

352
static int audit_set_failure(int state, kuid_t loginuid, u32 sessionid, u32 sid)
L
Linus Torvalds 已提交
353 354 355 356 357
{
	if (state != AUDIT_FAIL_SILENT
	    && state != AUDIT_FAIL_PRINTK
	    && state != AUDIT_FAIL_PANIC)
		return -EINVAL;
358

359
	return audit_do_config_change("audit_failure", &audit_failure, state,
360
				      loginuid, sessionid, sid);
L
Linus Torvalds 已提交
361 362
}

363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380
/*
 * Queue skbs to be sent to auditd when/if it comes back.  These skbs should
 * already have been sent via prink/syslog and so if these messages are dropped
 * it is not a huge concern since we already passed the audit_log_lost()
 * notification and stuff.  This is just nice to get audit messages during
 * boot before auditd is running or messages generated while auditd is stopped.
 * This only holds messages is audit_default is set, aka booting with audit=1
 * or building your kernel that way.
 */
static void audit_hold_skb(struct sk_buff *skb)
{
	if (audit_default &&
	    skb_queue_len(&audit_skb_hold_queue) < audit_backlog_limit)
		skb_queue_tail(&audit_skb_hold_queue, skb);
	else
		kfree_skb(skb);
}

381 382 383 384 385 386 387
/*
 * For one reason or another this nlh isn't getting delivered to the userspace
 * audit daemon, just send it to printk.
 */
static void audit_printk_skb(struct sk_buff *skb)
{
	struct nlmsghdr *nlh = nlmsg_hdr(skb);
388
	char *data = nlmsg_data(nlh);
389 390 391 392 393 394 395 396 397 398 399

	if (nlh->nlmsg_type != AUDIT_EOE) {
		if (printk_ratelimit())
			printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, data);
		else
			audit_log_lost("printk limit exceeded\n");
	}

	audit_hold_skb(skb);
}

400 401 402 403 404
static void kauditd_send_skb(struct sk_buff *skb)
{
	int err;
	/* take a reference in case we can't send it and we want to hold it */
	skb_get(skb);
405
	err = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
406
	if (err < 0) {
407
		BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
408
		printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
R
Ross Kirk 已提交
409
		audit_log_lost("auditd disappeared\n");
410 411 412 413 414
		audit_pid = 0;
		/* we might get lucky and get this in the next auditd */
		audit_hold_skb(skb);
	} else
		/* drop the extra reference if sent ok */
415
		consume_skb(skb);
416 417
}

A
Adrian Bunk 已提交
418
static int kauditd_thread(void *dummy)
419 420 421
{
	struct sk_buff *skb;

422
	set_freezable();
A
Andrew Morton 已提交
423
	while (!kthread_should_stop()) {
424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446
		/*
		 * if auditd just started drain the queue of messages already
		 * sent to syslog/printk.  remember loss here is ok.  we already
		 * called audit_log_lost() if it didn't go out normally.  so the
		 * race between the skb_dequeue and the next check for audit_pid
		 * doesn't matter.
		 *
		 * if you ever find kauditd to be too slow we can get a perf win
		 * by doing our own locking and keeping better track if there
		 * are messages in this queue.  I don't see the need now, but
		 * in 5 years when I want to play with this again I'll see this
		 * note and still have no friggin idea what i'm thinking today.
		 */
		if (audit_default && audit_pid) {
			skb = skb_dequeue(&audit_skb_hold_queue);
			if (unlikely(skb)) {
				while (skb && audit_pid) {
					kauditd_send_skb(skb);
					skb = skb_dequeue(&audit_skb_hold_queue);
				}
			}
		}

447
		skb = skb_dequeue(&audit_skb_queue);
448
		wake_up(&audit_backlog_wait);
449
		if (skb) {
450 451
			if (audit_pid)
				kauditd_send_skb(skb);
452 453
			else
				audit_printk_skb(skb);
454 455 456 457 458
		} else {
			DECLARE_WAITQUEUE(wait, current);
			set_current_state(TASK_INTERRUPTIBLE);
			add_wait_queue(&kauditd_wait, &wait);

459 460
			if (!skb_queue_len(&audit_skb_queue)) {
				try_to_freeze();
461
				schedule();
462
			}
463 464 465 466 467

			__set_current_state(TASK_RUNNING);
			remove_wait_queue(&kauditd_wait, &wait);
		}
	}
A
Andrew Morton 已提交
468
	return 0;
469 470
}

471 472 473 474 475 476 477
int audit_send_list(void *_dest)
{
	struct audit_netlink_list *dest = _dest;
	int pid = dest->pid;
	struct sk_buff *skb;

	/* wait for parent to finish and send an ACK */
A
Amy Griffis 已提交
478 479
	mutex_lock(&audit_cmd_mutex);
	mutex_unlock(&audit_cmd_mutex);
480 481 482 483 484 485 486 487 488 489

	while ((skb = __skb_dequeue(&dest->q)) != NULL)
		netlink_unicast(audit_sock, skb, pid, 0);

	kfree(dest);

	return 0;
}

struct sk_buff *audit_make_reply(int pid, int seq, int type, int done,
S
Stephen Hemminger 已提交
490
				 int multi, const void *payload, int size)
491 492 493 494 495 496 497
{
	struct sk_buff	*skb;
	struct nlmsghdr	*nlh;
	void		*data;
	int		flags = multi ? NLM_F_MULTI : 0;
	int		t     = done  ? NLMSG_DONE  : type;

498
	skb = nlmsg_new(size, GFP_KERNEL);
499 500 501
	if (!skb)
		return NULL;

502 503 504 505
	nlh	= nlmsg_put(skb, pid, seq, t, size, flags);
	if (!nlh)
		goto out_kfree_skb;
	data = nlmsg_data(nlh);
506 507 508
	memcpy(data, payload, size);
	return skb;

509 510
out_kfree_skb:
	kfree_skb(skb);
511 512 513
	return NULL;
}

514 515 516 517 518 519 520 521 522 523 524 525 526
static int audit_send_reply_thread(void *arg)
{
	struct audit_reply *reply = (struct audit_reply *)arg;

	mutex_lock(&audit_cmd_mutex);
	mutex_unlock(&audit_cmd_mutex);

	/* Ignore failure. It'll only happen if the sender goes away,
	   because our timeout is set to infinite. */
	netlink_unicast(audit_sock, reply->skb, reply->pid, 0);
	kfree(reply);
	return 0;
}
527 528 529 530 531 532 533 534 535 536 537 538 539
/**
 * audit_send_reply - send an audit reply message via netlink
 * @pid: process id to send reply to
 * @seq: sequence number
 * @type: audit message type
 * @done: done (last) flag
 * @multi: multi-part message flag
 * @payload: payload data
 * @size: payload size
 *
 * Allocates an skb, builds the netlink message, and sends it to the pid.
 * No failure notifications.
 */
S
Stephen Hemminger 已提交
540 541
static void audit_send_reply(int pid, int seq, int type, int done, int multi,
			     const void *payload, int size)
L
Linus Torvalds 已提交
542
{
543 544 545 546 547 548 549 550
	struct sk_buff *skb;
	struct task_struct *tsk;
	struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),
					    GFP_KERNEL);

	if (!reply)
		return;

551
	skb = audit_make_reply(pid, seq, type, done, multi, payload, size);
L
Linus Torvalds 已提交
552
	if (!skb)
553
		goto out;
554 555 556 557 558

	reply->pid = pid;
	reply->skb = skb;

	tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
559 560 561 562 563
	if (!IS_ERR(tsk))
		return;
	kfree_skb(skb);
out:
	kfree(reply);
L
Linus Torvalds 已提交
564 565 566 567 568 569
}

/*
 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit
 * control messages.
 */
570
static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
L
Linus Torvalds 已提交
571 572 573
{
	int err = 0;

574 575 576 577 578
	/* Only support the initial namespaces for now. */
	if ((current_user_ns() != &init_user_ns) ||
	    (task_active_pid_ns(current) != &init_pid_ns))
		return -EPERM;

L
Linus Torvalds 已提交
579 580 581
	switch (msg_type) {
	case AUDIT_GET:
	case AUDIT_LIST:
582
	case AUDIT_LIST_RULES:
L
Linus Torvalds 已提交
583 584
	case AUDIT_SET:
	case AUDIT_ADD:
585
	case AUDIT_ADD_RULE:
L
Linus Torvalds 已提交
586
	case AUDIT_DEL:
587
	case AUDIT_DEL_RULE:
588
	case AUDIT_SIGNAL_INFO:
M
Miloslav Trmac 已提交
589 590
	case AUDIT_TTY_GET:
	case AUDIT_TTY_SET:
A
Al Viro 已提交
591 592
	case AUDIT_TRIM:
	case AUDIT_MAKE_EQUIV:
593
		if (!capable(CAP_AUDIT_CONTROL))
L
Linus Torvalds 已提交
594 595
			err = -EPERM;
		break;
596
	case AUDIT_USER:
597 598
	case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
	case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
599
		if (!capable(CAP_AUDIT_WRITE))
L
Linus Torvalds 已提交
600 601 602 603 604 605 606 607 608
			err = -EPERM;
		break;
	default:  /* bad msg */
		err = -EINVAL;
	}

	return err;
}

609
static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
610
				     kuid_t auid, u32 ses, u32 sid)
611 612 613 614 615 616 617 618 619 620 621
{
	int rc = 0;
	char *ctx = NULL;
	u32 len;

	if (!audit_enabled) {
		*ab = NULL;
		return rc;
	}

	*ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
622
	audit_log_format(*ab, "pid=%d uid=%u auid=%u ses=%u",
623 624
			 task_tgid_vnr(current),
			 from_kuid(&init_user_ns, current_uid()),
625
			 from_kuid(&init_user_ns, auid), ses);
626
	if (sid) {
627
		rc = security_secid_to_secctx(sid, &ctx, &len);
628 629
		if (rc)
			audit_log_format(*ab, " ssid=%u", sid);
630
		else {
631
			audit_log_format(*ab, " subj=%s", ctx);
632 633
			security_release_secctx(ctx, len);
		}
634 635 636 637 638
	}

	return rc;
}

L
Linus Torvalds 已提交
639 640
static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
{
641
	u32			seq, sid;
L
Linus Torvalds 已提交
642 643 644
	void			*data;
	struct audit_status	*status_get, status_set;
	int			err;
645
	struct audit_buffer	*ab;
L
Linus Torvalds 已提交
646
	u16			msg_type = nlh->nlmsg_type;
647
	kuid_t			loginuid; /* loginuid of sender */
648
	u32			sessionid;
649
	struct audit_sig_info   *sig_data;
650
	char			*ctx = NULL;
651
	u32			len;
L
Linus Torvalds 已提交
652

653
	err = audit_netlink_ok(skb, msg_type);
L
Linus Torvalds 已提交
654 655 656
	if (err)
		return err;

657 658
	/* As soon as there's any sign of userspace auditd,
	 * start kauditd to talk to it */
659 660 661 662 663 664 665 666
	if (!kauditd_task)
		kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
	if (IS_ERR(kauditd_task)) {
		err = PTR_ERR(kauditd_task);
		kauditd_task = NULL;
		return err;
	}

667 668 669
	loginuid = audit_get_loginuid(current);
	sessionid = audit_get_sessionid(current);
	security_task_getsecid(current, &sid);
L
Linus Torvalds 已提交
670
	seq  = nlh->nlmsg_seq;
671
	data = nlmsg_data(nlh);
L
Linus Torvalds 已提交
672 673 674 675 676 677 678 679 680

	switch (msg_type) {
	case AUDIT_GET:
		status_set.enabled	 = audit_enabled;
		status_set.failure	 = audit_failure;
		status_set.pid		 = audit_pid;
		status_set.rate_limit	 = audit_rate_limit;
		status_set.backlog_limit = audit_backlog_limit;
		status_set.lost		 = atomic_read(&audit_lost);
681
		status_set.backlog	 = skb_queue_len(&audit_skb_queue);
682
		audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
L
Linus Torvalds 已提交
683 684 685 686 687 688 689
				 &status_set, sizeof(status_set));
		break;
	case AUDIT_SET:
		if (nlh->nlmsg_len < sizeof(struct audit_status))
			return -EINVAL;
		status_get   = (struct audit_status *)data;
		if (status_get->mask & AUDIT_STATUS_ENABLED) {
690
			err = audit_set_enabled(status_get->enabled,
691
						loginuid, sessionid, sid);
692 693
			if (err < 0)
				return err;
L
Linus Torvalds 已提交
694 695
		}
		if (status_get->mask & AUDIT_STATUS_FAILURE) {
696
			err = audit_set_failure(status_get->failure,
697
						loginuid, sessionid, sid);
698 699
			if (err < 0)
				return err;
L
Linus Torvalds 已提交
700 701
		}
		if (status_get->mask & AUDIT_STATUS_PID) {
702 703 704 705 706
			int new_pid = status_get->pid;

			if (audit_enabled != AUDIT_OFF)
				audit_log_config_change("audit_pid", new_pid,
							audit_pid, loginuid,
707
							sessionid, sid, 1);
708 709

			audit_pid = new_pid;
710
			audit_nlk_portid = NETLINK_CB(skb).portid;
L
Linus Torvalds 已提交
711
		}
712
		if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) {
S
Serge E. Hallyn 已提交
713
			err = audit_set_rate_limit(status_get->rate_limit,
714
						   loginuid, sessionid, sid);
715 716 717
			if (err < 0)
				return err;
		}
L
Linus Torvalds 已提交
718
		if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT)
S
Serge E. Hallyn 已提交
719
			err = audit_set_backlog_limit(status_get->backlog_limit,
720
						      loginuid, sessionid, sid);
L
Linus Torvalds 已提交
721
		break;
722
	case AUDIT_USER:
723 724
	case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
	case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
725 726 727
		if (!audit_enabled && msg_type != AUDIT_USER_AVC)
			return 0;

728
		err = audit_filter_user();
729 730
		if (err == 1) {
			err = 0;
M
Miloslav Trmac 已提交
731
			if (msg_type == AUDIT_USER_TTY) {
732
				err = tty_audit_push_task(current, loginuid,
733
							     sessionid);
M
Miloslav Trmac 已提交
734 735 736
				if (err)
					break;
			}
737
			audit_log_common_recv_msg(&ab, msg_type,
738
						  loginuid, sessionid, sid);
739 740 741 742 743 744 745 746 747

			if (msg_type != AUDIT_USER_TTY)
				audit_log_format(ab, " msg='%.1024s'",
						 (char *)data);
			else {
				int size;

				audit_log_format(ab, " msg=");
				size = nlmsg_len(nlh);
748 749 750
				if (size > 0 &&
				    ((unsigned char *)data)[size - 1] == '\0')
					size--;
751
				audit_log_n_untrustedstring(ab, data, size);
752
			}
753
			audit_set_pid(ab, NETLINK_CB(skb).portid);
754
			audit_log_end(ab);
755
		}
L
Linus Torvalds 已提交
756 757 758
		break;
	case AUDIT_ADD:
	case AUDIT_DEL:
759
		if (nlmsg_len(nlh) < sizeof(struct audit_rule))
L
Linus Torvalds 已提交
760
			return -EINVAL;
761
		if (audit_enabled == AUDIT_LOCKED) {
762 763
			audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE,
						  loginuid, sessionid, sid);
764 765 766 767

			audit_log_format(ab, " audit_enabled=%d res=0",
					 audit_enabled);
			audit_log_end(ab);
S
Steve Grubb 已提交
768 769
			return -EPERM;
		}
L
Linus Torvalds 已提交
770 771
		/* fallthrough */
	case AUDIT_LIST:
772
		err = audit_receive_filter(msg_type, NETLINK_CB(skb).portid,
773
					   seq, data, nlmsg_len(nlh),
774
					   loginuid, sessionid, sid);
775 776 777 778 779
		break;
	case AUDIT_ADD_RULE:
	case AUDIT_DEL_RULE:
		if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
			return -EINVAL;
780
		if (audit_enabled == AUDIT_LOCKED) {
781 782
			audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE,
						  loginuid, sessionid, sid);
783 784 785 786

			audit_log_format(ab, " audit_enabled=%d res=0",
					 audit_enabled);
			audit_log_end(ab);
S
Steve Grubb 已提交
787 788
			return -EPERM;
		}
789 790
		/* fallthrough */
	case AUDIT_LIST_RULES:
791
		err = audit_receive_filter(msg_type, NETLINK_CB(skb).portid,
792
					   seq, data, nlmsg_len(nlh),
793
					   loginuid, sessionid, sid);
L
Linus Torvalds 已提交
794
		break;
A
Al Viro 已提交
795 796
	case AUDIT_TRIM:
		audit_trim_trees();
797

798 799
		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE,
					  loginuid, sessionid, sid);
800

A
Al Viro 已提交
801 802 803 804 805 806
		audit_log_format(ab, " op=trim res=1");
		audit_log_end(ab);
		break;
	case AUDIT_MAKE_EQUIV: {
		void *bufp = data;
		u32 sizes[2];
807
		size_t msglen = nlmsg_len(nlh);
A
Al Viro 已提交
808 809 810
		char *old, *new;

		err = -EINVAL;
811
		if (msglen < 2 * sizeof(u32))
A
Al Viro 已提交
812 813 814
			break;
		memcpy(sizes, bufp, 2 * sizeof(u32));
		bufp += 2 * sizeof(u32);
815 816
		msglen -= 2 * sizeof(u32);
		old = audit_unpack_string(&bufp, &msglen, sizes[0]);
A
Al Viro 已提交
817 818 819 820
		if (IS_ERR(old)) {
			err = PTR_ERR(old);
			break;
		}
821
		new = audit_unpack_string(&bufp, &msglen, sizes[1]);
A
Al Viro 已提交
822 823 824 825 826 827 828 829
		if (IS_ERR(new)) {
			err = PTR_ERR(new);
			kfree(old);
			break;
		}
		/* OK, here comes... */
		err = audit_tag_tree(old, new);

830 831
		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE,
					  loginuid, sessionid, sid);
832

A
Al Viro 已提交
833 834 835 836 837 838 839 840 841 842
		audit_log_format(ab, " op=make_equiv old=");
		audit_log_untrustedstring(ab, old);
		audit_log_format(ab, " new=");
		audit_log_untrustedstring(ab, new);
		audit_log_format(ab, " res=%d", !err);
		audit_log_end(ab);
		kfree(old);
		kfree(new);
		break;
	}
843
	case AUDIT_SIGNAL_INFO:
844 845 846 847 848 849
		len = 0;
		if (audit_sig_sid) {
			err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
			if (err)
				return err;
		}
850 851
		sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
		if (!sig_data) {
852 853
			if (audit_sig_sid)
				security_release_secctx(ctx, len);
854 855
			return -ENOMEM;
		}
856
		sig_data->uid = from_kuid(&init_user_ns, audit_sig_uid);
857
		sig_data->pid = audit_sig_pid;
858 859 860 861
		if (audit_sig_sid) {
			memcpy(sig_data->ctx, ctx, len);
			security_release_secctx(ctx, len);
		}
862
		audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_SIGNAL_INFO,
863 864
				0, 0, sig_data, sizeof(*sig_data) + len);
		kfree(sig_data);
865
		break;
M
Miloslav Trmac 已提交
866 867
	case AUDIT_TTY_GET: {
		struct audit_tty_status s;
868 869 870 871 872 873
		struct task_struct *tsk = current;

		spin_lock_irq(&tsk->sighand->siglock);
		s.enabled = tsk->signal->audit_tty != 0;
		spin_unlock_irq(&tsk->sighand->siglock);

874
		audit_send_reply(NETLINK_CB(skb).portid, seq,
875
				 AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
M
Miloslav Trmac 已提交
876 877 878 879
		break;
	}
	case AUDIT_TTY_SET: {
		struct audit_tty_status *s;
880
		struct task_struct *tsk = current;
M
Miloslav Trmac 已提交
881 882 883 884 885 886

		if (nlh->nlmsg_len < sizeof(struct audit_tty_status))
			return -EINVAL;
		s = data;
		if (s->enabled != 0 && s->enabled != 1)
			return -EINVAL;
887 888 889 890

		spin_lock_irq(&tsk->sighand->siglock);
		tsk->signal->audit_tty = s->enabled != 0;
		spin_unlock_irq(&tsk->sighand->siglock);
M
Miloslav Trmac 已提交
891 892
		break;
	}
L
Linus Torvalds 已提交
893 894 895 896 897 898 899 900
	default:
		err = -EINVAL;
		break;
	}

	return err < 0 ? err : 0;
}

901
/*
E
Eric Paris 已提交
902 903
 * Get message from skb.  Each message is processed by audit_receive_msg.
 * Malformed skbs with wrong length are discarded silently.
904
 */
905
static void audit_receive_skb(struct sk_buff *skb)
L
Linus Torvalds 已提交
906
{
E
Eric Paris 已提交
907 908 909 910 911 912 913 914 915 916 917 918 919 920 921
	struct nlmsghdr *nlh;
	/*
	 * len MUST be signed for NLMSG_NEXT to be able to dec it below 0
	 * if the nlmsg_len was not aligned
	 */
	int len;
	int err;

	nlh = nlmsg_hdr(skb);
	len = skb->len;

	while (NLMSG_OK(nlh, len)) {
		err = audit_receive_msg(skb, nlh);
		/* if err or if this message says it wants a response */
		if (err || (nlh->nlmsg_flags & NLM_F_ACK))
L
Linus Torvalds 已提交
922
			netlink_ack(skb, nlh, err);
E
Eric Paris 已提交
923 924

		nlh = NLMSG_NEXT(nlh, len);
L
Linus Torvalds 已提交
925 926 927 928
	}
}

/* Receive messages from netlink socket. */
929
static void audit_receive(struct sk_buff  *skb)
L
Linus Torvalds 已提交
930
{
A
Amy Griffis 已提交
931
	mutex_lock(&audit_cmd_mutex);
932
	audit_receive_skb(skb);
A
Amy Griffis 已提交
933
	mutex_unlock(&audit_cmd_mutex);
L
Linus Torvalds 已提交
934 935 936 937 938
}

/* Initialize audit support at boot time. */
static int __init audit_init(void)
{
A
Amy Griffis 已提交
939
	int i;
940 941 942
	struct netlink_kernel_cfg cfg = {
		.input	= audit_receive,
	};
A
Amy Griffis 已提交
943

944 945 946
	if (audit_initialized == AUDIT_DISABLED)
		return 0;

L
Linus Torvalds 已提交
947 948
	printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
	       audit_default ? "enabled" : "disabled");
949
	audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, &cfg);
L
Linus Torvalds 已提交
950 951
	if (!audit_sock)
		audit_panic("cannot initialize netlink socket");
952 953
	else
		audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
L
Linus Torvalds 已提交
954

955
	skb_queue_head_init(&audit_skb_queue);
956
	skb_queue_head_init(&audit_skb_hold_queue);
957
	audit_initialized = AUDIT_INITIALIZED;
L
Linus Torvalds 已提交
958
	audit_enabled = audit_default;
959
	audit_ever_enabled |= !!audit_default;
960

961
	audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
A
Amy Griffis 已提交
962 963 964 965

	for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
		INIT_LIST_HEAD(&audit_inode_hash[i]);

L
Linus Torvalds 已提交
966 967 968 969 970 971 972 973
	return 0;
}
__initcall(audit_init);

/* Process kernel command-line parameter at boot time.  audit=0 or audit=1. */
static int __init audit_enable(char *str)
{
	audit_default = !!simple_strtol(str, NULL, 0);
974 975 976 977 978 979
	if (!audit_default)
		audit_initialized = AUDIT_DISABLED;

	printk(KERN_INFO "audit: %s", audit_default ? "enabled" : "disabled");

	if (audit_initialized == AUDIT_INITIALIZED) {
L
Linus Torvalds 已提交
980
		audit_enabled = audit_default;
981
		audit_ever_enabled |= !!audit_default;
982 983 984 985
	} else if (audit_initialized == AUDIT_UNINITIALIZED) {
		printk(" (after initialization)");
	} else {
		printk(" (until reboot)");
986
	}
987 988
	printk("\n");

989
	return 1;
L
Linus Torvalds 已提交
990 991 992 993
}

__setup("audit=", audit_enable);

994 995 996 997
static void audit_buffer_free(struct audit_buffer *ab)
{
	unsigned long flags;

998 999 1000
	if (!ab)
		return;

1001 1002
	if (ab->skb)
		kfree_skb(ab->skb);
1003

1004
	spin_lock_irqsave(&audit_freelist_lock, flags);
S
Serge E. Hallyn 已提交
1005
	if (audit_freelist_count > AUDIT_MAXFREE)
1006
		kfree(ab);
S
Serge E. Hallyn 已提交
1007 1008
	else {
		audit_freelist_count++;
1009
		list_add(&ab->list, &audit_freelist);
S
Serge E. Hallyn 已提交
1010
	}
1011 1012 1013
	spin_unlock_irqrestore(&audit_freelist_lock, flags);
}

1014
static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
A
Al Viro 已提交
1015
						gfp_t gfp_mask, int type)
1016 1017 1018
{
	unsigned long flags;
	struct audit_buffer *ab = NULL;
1019
	struct nlmsghdr *nlh;
1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030

	spin_lock_irqsave(&audit_freelist_lock, flags);
	if (!list_empty(&audit_freelist)) {
		ab = list_entry(audit_freelist.next,
				struct audit_buffer, list);
		list_del(&ab->list);
		--audit_freelist_count;
	}
	spin_unlock_irqrestore(&audit_freelist_lock, flags);

	if (!ab) {
1031
		ab = kmalloc(sizeof(*ab), gfp_mask);
1032
		if (!ab)
1033
			goto err;
1034
	}
1035

1036
	ab->ctx = ctx;
1037
	ab->gfp_mask = gfp_mask;
1038 1039 1040

	ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask);
	if (!ab->skb)
1041
		goto err;
1042

1043 1044 1045
	nlh = nlmsg_put(ab->skb, 0, 0, type, 0, 0);
	if (!nlh)
		goto out_kfree_skb;
1046

1047
	return ab;
1048

1049
out_kfree_skb:
1050 1051
	kfree_skb(ab->skb);
	ab->skb = NULL;
1052 1053 1054
err:
	audit_buffer_free(ab);
	return NULL;
1055
}
L
Linus Torvalds 已提交
1056

1057 1058 1059 1060
/**
 * audit_serial - compute a serial number for the audit record
 *
 * Compute a serial number for the audit record.  Audit records are
1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071
 * written to user-space as soon as they are generated, so a complete
 * audit record may be written in several pieces.  The timestamp of the
 * record and this serial number are used by the user-space tools to
 * determine which pieces belong to the same audit record.  The
 * (timestamp,serial) tuple is unique for each syscall and is live from
 * syscall entry to syscall exit.
 *
 * NOTE: Another possibility is to store the formatted records off the
 * audit context (for those records that have a context), and emit them
 * all at syscall exit.  However, this could delay the reporting of
 * significant errors until syscall exit (or never, if the system
1072 1073
 * halts).
 */
1074 1075
unsigned int audit_serial(void)
{
I
Ingo Molnar 已提交
1076
	static DEFINE_SPINLOCK(serial_lock);
1077 1078 1079 1080
	static unsigned int serial = 0;

	unsigned long flags;
	unsigned int ret;
1081

1082
	spin_lock_irqsave(&serial_lock, flags);
1083
	do {
1084 1085
		ret = ++serial;
	} while (unlikely(!ret));
1086
	spin_unlock_irqrestore(&serial_lock, flags);
1087

1088
	return ret;
1089 1090
}

D
Daniel Walker 已提交
1091
static inline void audit_get_stamp(struct audit_context *ctx,
1092 1093
				   struct timespec *t, unsigned int *serial)
{
1094
	if (!ctx || !auditsc_get_stamp(ctx, t, serial)) {
1095 1096 1097 1098 1099
		*t = CURRENT_TIME;
		*serial = audit_serial();
	}
}

L
Linus Torvalds 已提交
1100 1101 1102 1103 1104 1105
/* Obtain an audit buffer.  This routine does locking to obtain the
 * audit buffer, but then no locking is required for calls to
 * audit_log_*format.  If the tsk is a task that is currently in a
 * syscall, then the syscall is marked as auditable and an audit record
 * will be written at syscall exit.  If there is no associated task, tsk
 * should be NULL. */
1106

1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121
/**
 * audit_log_start - obtain an audit buffer
 * @ctx: audit_context (may be NULL)
 * @gfp_mask: type of allocation
 * @type: audit message type
 *
 * Returns audit_buffer pointer on success or NULL on error.
 *
 * Obtain an audit buffer.  This routine does locking to obtain the
 * audit buffer, but then no locking is required for calls to
 * audit_log_*format.  If the task (ctx) is a task that is currently in a
 * syscall, then the syscall is marked as auditable and an audit record
 * will be written at syscall exit.  If there is no associated task, then
 * task context (ctx) should be NULL.
 */
A
Al Viro 已提交
1122
struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
1123
				     int type)
L
Linus Torvalds 已提交
1124 1125 1126
{
	struct audit_buffer	*ab	= NULL;
	struct timespec		t;
1127
	unsigned int		uninitialized_var(serial);
1128
	int reserve;
1129
	unsigned long timeout_start = jiffies;
L
Linus Torvalds 已提交
1130

1131
	if (audit_initialized != AUDIT_INITIALIZED)
L
Linus Torvalds 已提交
1132 1133
		return NULL;

1134 1135 1136
	if (unlikely(audit_filter_type(type)))
		return NULL;

1137 1138 1139
	if (gfp_mask & __GFP_WAIT)
		reserve = 0;
	else
D
Daniel Walker 已提交
1140
		reserve = 5; /* Allow atomic callers to go up to five
1141 1142 1143 1144
				entries over the normal backlog limit */

	while (audit_backlog_limit
	       && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
1145 1146 1147
		if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time
		    && time_before(jiffies, timeout_start + audit_backlog_wait_time)) {

1148 1149 1150 1151 1152 1153 1154
			/* Wait for auditd to drain the queue a little */
			DECLARE_WAITQUEUE(wait, current);
			set_current_state(TASK_INTERRUPTIBLE);
			add_wait_queue(&audit_backlog_wait, &wait);

			if (audit_backlog_limit &&
			    skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
1155
				schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies);
1156 1157 1158

			__set_current_state(TASK_RUNNING);
			remove_wait_queue(&audit_backlog_wait, &wait);
1159
			continue;
1160
		}
1161
		if (audit_rate_check() && printk_ratelimit())
1162 1163 1164 1165 1166 1167
			printk(KERN_WARNING
			       "audit: audit_backlog=%d > "
			       "audit_backlog_limit=%d\n",
			       skb_queue_len(&audit_skb_queue),
			       audit_backlog_limit);
		audit_log_lost("backlog limit exceeded");
1168 1169
		audit_backlog_wait_time = audit_backlog_wait_overflow;
		wake_up(&audit_backlog_wait);
1170 1171 1172
		return NULL;
	}

1173
	ab = audit_buffer_alloc(ctx, gfp_mask, type);
L
Linus Torvalds 已提交
1174 1175 1176 1177 1178
	if (!ab) {
		audit_log_lost("out of memory in audit_log_start");
		return NULL;
	}

1179
	audit_get_stamp(ab->ctx, &t, &serial);
1180

L
Linus Torvalds 已提交
1181 1182 1183 1184 1185
	audit_log_format(ab, "audit(%lu.%03lu:%u): ",
			 t.tv_sec, t.tv_nsec/1000000, serial);
	return ab;
}

1186
/**
1187
 * audit_expand - expand skb in the audit buffer
1188
 * @ab: audit_buffer
1189
 * @extra: space to add at tail of the skb
1190 1191 1192 1193
 *
 * Returns 0 (no space) on failed expansion, or available space if
 * successful.
 */
1194
static inline int audit_expand(struct audit_buffer *ab, int extra)
1195
{
1196
	struct sk_buff *skb = ab->skb;
1197 1198 1199 1200
	int oldtail = skb_tailroom(skb);
	int ret = pskb_expand_head(skb, 0, extra, ab->gfp_mask);
	int newtail = skb_tailroom(skb);

1201 1202
	if (ret < 0) {
		audit_log_lost("out of memory in audit_expand");
1203
		return 0;
1204
	}
1205 1206 1207

	skb->truesize += newtail - oldtail;
	return newtail;
1208
}
L
Linus Torvalds 已提交
1209

1210 1211
/*
 * Format an audit message into the audit buffer.  If there isn't enough
L
Linus Torvalds 已提交
1212 1213
 * room in the audit buffer, more room will be allocated and vsnprint
 * will be called a second time.  Currently, we assume that a printk
1214 1215
 * can't format message larger than 1024 bytes, so we don't either.
 */
L
Linus Torvalds 已提交
1216 1217 1218 1219
static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
			      va_list args)
{
	int len, avail;
1220
	struct sk_buff *skb;
D
David Woodhouse 已提交
1221
	va_list args2;
L
Linus Torvalds 已提交
1222 1223 1224 1225

	if (!ab)
		return;

1226 1227 1228 1229
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	if (avail == 0) {
1230
		avail = audit_expand(ab, AUDIT_BUFSIZ);
1231 1232
		if (!avail)
			goto out;
L
Linus Torvalds 已提交
1233
	}
D
David Woodhouse 已提交
1234
	va_copy(args2, args);
1235
	len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args);
L
Linus Torvalds 已提交
1236 1237 1238 1239
	if (len >= avail) {
		/* The printk buffer is 1024 bytes long, so if we get
		 * here and AUDIT_BUFSIZ is at least 1024, then we can
		 * log everything that printk could have logged. */
1240 1241
		avail = audit_expand(ab,
			max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
1242
		if (!avail)
1243
			goto out_va_end;
1244
		len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
L
Linus Torvalds 已提交
1245
	}
1246 1247
	if (len > 0)
		skb_put(skb, len);
1248 1249
out_va_end:
	va_end(args2);
1250 1251
out:
	return;
L
Linus Torvalds 已提交
1252 1253
}

1254 1255 1256 1257 1258 1259 1260 1261
/**
 * audit_log_format - format a message into the audit buffer.
 * @ab: audit_buffer
 * @fmt: format string
 * @...: optional parameters matching @fmt string
 *
 * All the work is done in audit_log_vformat.
 */
L
Linus Torvalds 已提交
1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272
void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
{
	va_list args;

	if (!ab)
		return;
	va_start(args, fmt);
	audit_log_vformat(ab, fmt, args);
	va_end(args);
}

1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283
/**
 * audit_log_hex - convert a buffer to hex and append it to the audit skb
 * @ab: the audit_buffer
 * @buf: buffer to convert to hex
 * @len: length of @buf to be converted
 *
 * No return value; failure to expand is silently ignored.
 *
 * This function will take the passed buf and convert it into a string of
 * ascii hex digits. The new string is placed onto the skb.
 */
1284
void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
1285
		size_t len)
1286
{
1287 1288 1289 1290 1291
	int i, avail, new_len;
	unsigned char *ptr;
	struct sk_buff *skb;
	static const unsigned char *hex = "0123456789ABCDEF";

A
Amy Griffis 已提交
1292 1293 1294
	if (!ab)
		return;

1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	new_len = len<<1;
	if (new_len >= avail) {
		/* Round the buffer request up to the next multiple */
		new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
		avail = audit_expand(ab, new_len);
		if (!avail)
			return;
	}
1306

1307
	ptr = skb_tail_pointer(skb);
1308 1309 1310 1311 1312 1313
	for (i=0; i<len; i++) {
		*ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */
		*ptr++ = hex[buf[i] & 0x0F];	  /* Lower nibble */
	}
	*ptr = 0;
	skb_put(skb, len << 1); /* new string is twice the old string */
1314 1315
}

1316 1317 1318 1319
/*
 * Format a string of no more than slen characters into the audit buffer,
 * enclosed in quote marks.
 */
1320 1321
void audit_log_n_string(struct audit_buffer *ab, const char *string,
			size_t slen)
1322 1323 1324 1325 1326
{
	int avail, new_len;
	unsigned char *ptr;
	struct sk_buff *skb;

A
Amy Griffis 已提交
1327 1328 1329
	if (!ab)
		return;

1330 1331 1332 1333 1334 1335 1336 1337 1338
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	new_len = slen + 3;	/* enclosing quotes + null terminator */
	if (new_len > avail) {
		avail = audit_expand(ab, new_len);
		if (!avail)
			return;
	}
1339
	ptr = skb_tail_pointer(skb);
1340 1341 1342 1343 1344 1345 1346 1347
	*ptr++ = '"';
	memcpy(ptr, string, slen);
	ptr += slen;
	*ptr++ = '"';
	*ptr = 0;
	skb_put(skb, slen + 2);	/* don't include null terminator */
}

1348 1349
/**
 * audit_string_contains_control - does a string need to be logged in hex
1350 1351
 * @string: string to be checked
 * @len: max length of the string to check
1352 1353 1354 1355
 */
int audit_string_contains_control(const char *string, size_t len)
{
	const unsigned char *p;
1356
	for (p = string; p < (const unsigned char *)string + len; p++) {
1357
		if (*p == '"' || *p < 0x21 || *p > 0x7e)
1358 1359 1360 1361 1362
			return 1;
	}
	return 0;
}

1363
/**
M
Miloslav Trmac 已提交
1364
 * audit_log_n_untrustedstring - log a string that may contain random characters
1365
 * @ab: audit_buffer
1366
 * @len: length of string (not including trailing null)
1367 1368 1369 1370
 * @string: string to be logged
 *
 * This code will escape a string that is passed to it if the string
 * contains a control character, unprintable character, double quote mark,
1371
 * or a space. Unescaped strings will start and end with a double quote mark.
1372
 * Strings that are escaped are printed in hex (2 digits per char).
1373 1374 1375
 *
 * The caller specifies the number of characters in the string to log, which may
 * or may not be the entire string.
1376
 */
1377 1378
void audit_log_n_untrustedstring(struct audit_buffer *ab, const char *string,
				 size_t len)
1379
{
1380
	if (audit_string_contains_control(string, len))
1381
		audit_log_n_hex(ab, string, len);
1382
	else
1383
		audit_log_n_string(ab, string, len);
1384 1385
}

1386
/**
M
Miloslav Trmac 已提交
1387
 * audit_log_untrustedstring - log a string that may contain random characters
1388 1389 1390
 * @ab: audit_buffer
 * @string: string to be logged
 *
M
Miloslav Trmac 已提交
1391
 * Same as audit_log_n_untrustedstring(), except that strlen is used to
1392 1393
 * determine string length.
 */
1394
void audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
1395
{
1396
	audit_log_n_untrustedstring(ab, string, strlen(string));
1397 1398
}

1399
/* This is a helper-function to print the escaped d_path */
L
Linus Torvalds 已提交
1400
void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
1401
		      const struct path *path)
L
Linus Torvalds 已提交
1402
{
1403
	char *p, *pathname;
L
Linus Torvalds 已提交
1404

1405
	if (prefix)
1406
		audit_log_format(ab, "%s", prefix);
L
Linus Torvalds 已提交
1407

1408
	/* We will allow 11 spaces for ' (deleted)' to be appended */
1409 1410
	pathname = kmalloc(PATH_MAX+11, ab->gfp_mask);
	if (!pathname) {
1411
		audit_log_string(ab, "<no_memory>");
1412
		return;
L
Linus Torvalds 已提交
1413
	}
1414
	p = d_path(path, pathname, PATH_MAX+11);
1415 1416
	if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */
		/* FIXME: can we save some information here? */
1417
		audit_log_string(ab, "<too_long>");
D
Daniel Walker 已提交
1418
	} else
1419
		audit_log_untrustedstring(ab, p);
1420
	kfree(pathname);
L
Linus Torvalds 已提交
1421 1422
}

1423 1424 1425 1426 1427 1428 1429 1430 1431
void audit_log_key(struct audit_buffer *ab, char *key)
{
	audit_log_format(ab, " key=");
	if (key)
		audit_log_untrustedstring(ab, key);
	else
		audit_log_format(ab, "(null)");
}

1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442
/**
 * audit_log_link_denied - report a link restriction denial
 * @operation: specific link opreation
 * @link: the path that triggered the restriction
 */
void audit_log_link_denied(const char *operation, struct path *link)
{
	struct audit_buffer *ab;

	ab = audit_log_start(current->audit_context, GFP_KERNEL,
			     AUDIT_ANOM_LINK);
1443 1444
	if (!ab)
		return;
1445 1446 1447 1448 1449 1450 1451 1452 1453 1454
	audit_log_format(ab, "op=%s action=denied", operation);
	audit_log_format(ab, " pid=%d comm=", current->pid);
	audit_log_untrustedstring(ab, current->comm);
	audit_log_d_path(ab, " path=", link);
	audit_log_format(ab, " dev=");
	audit_log_untrustedstring(ab, link->dentry->d_inode->i_sb->s_id);
	audit_log_format(ab, " ino=%lu", link->dentry->d_inode->i_ino);
	audit_log_end(ab);
}

1455 1456 1457 1458 1459 1460
/**
 * audit_log_end - end one audit record
 * @ab: the audit_buffer
 *
 * The netlink_* functions cannot be called inside an irq context, so
 * the audit buffer is placed on a queue and a tasklet is scheduled to
L
Linus Torvalds 已提交
1461
 * remove them from the queue outside the irq context.  May be called in
1462 1463
 * any context.
 */
1464
void audit_log_end(struct audit_buffer *ab)
L
Linus Torvalds 已提交
1465 1466 1467 1468 1469 1470
{
	if (!ab)
		return;
	if (!audit_rate_check()) {
		audit_log_lost("rate limit exceeded");
	} else {
1471
		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
1472 1473
		nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0);

1474 1475 1476
		if (audit_pid) {
			skb_queue_tail(&audit_skb_queue, ab->skb);
			wake_up_interruptible(&kauditd_wait);
1477
		} else {
1478
			audit_printk_skb(ab->skb);
1479
		}
1480
		ab->skb = NULL;
L
Linus Torvalds 已提交
1481
	}
1482
	audit_buffer_free(ab);
L
Linus Torvalds 已提交
1483 1484
}

1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496
/**
 * audit_log - Log an audit record
 * @ctx: audit context
 * @gfp_mask: type of allocation
 * @type: audit message type
 * @fmt: format string to use
 * @...: variable parameters matching the format string
 *
 * This is a convenience function that calls audit_log_start,
 * audit_log_vformat, and audit_log_end.  It may be called
 * in any context.
 */
D
Daniel Walker 已提交
1497
void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
1498
	       const char *fmt, ...)
L
Linus Torvalds 已提交
1499 1500 1501 1502
{
	struct audit_buffer *ab;
	va_list args;

1503
	ab = audit_log_start(ctx, gfp_mask, type);
L
Linus Torvalds 已提交
1504 1505 1506 1507 1508 1509 1510
	if (ab) {
		va_start(args, fmt);
		audit_log_vformat(ab, fmt, args);
		va_end(args);
		audit_log_end(ab);
	}
}
1511

1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537
#ifdef CONFIG_SECURITY
/**
 * audit_log_secctx - Converts and logs SELinux context
 * @ab: audit_buffer
 * @secid: security number
 *
 * This is a helper function that calls security_secid_to_secctx to convert
 * secid to secctx and then adds the (converted) SELinux context to the audit
 * log by calling audit_log_format, thus also preventing leak of internal secid
 * to userspace. If secid cannot be converted audit_panic is called.
 */
void audit_log_secctx(struct audit_buffer *ab, u32 secid)
{
	u32 len;
	char *secctx;

	if (security_secid_to_secctx(secid, &secctx, &len)) {
		audit_panic("Cannot convert secid to context");
	} else {
		audit_log_format(ab, " obj=%s", secctx);
		security_release_secctx(secctx, len);
	}
}
EXPORT_SYMBOL(audit_log_secctx);
#endif

1538 1539 1540 1541
EXPORT_SYMBOL(audit_log_start);
EXPORT_SYMBOL(audit_log_end);
EXPORT_SYMBOL(audit_log_format);
EXPORT_SYMBOL(audit_log);