audit.c 39.6 KB
Newer Older
1
/* audit.c -- Auditing support
L
Linus Torvalds 已提交
2 3 4
 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon.
 * System-call specific features have moved to auditsc.c
 *
S
Steve Grubb 已提交
5
 * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina.
L
Linus Torvalds 已提交
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
 * All Rights Reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
 *
24
 * Goals: 1) Integrate fully with Security Modules.
L
Linus Torvalds 已提交
25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40
 *	  2) Minimal run-time overhead:
 *	     a) Minimal when syscall auditing is disabled (audit_enable=0).
 *	     b) Small when syscall auditing is enabled and no audit record
 *		is generated (defer as much work as possible to record
 *		generation time):
 *		i) context is allocated,
 *		ii) names from getname are stored without a copy, and
 *		iii) inode information stored from path_lookup.
 *	  3) Ability to disable syscall auditing at boot time (audit=0).
 *	  4) Usable by other parts of the kernel (if audit_log* is called,
 *	     then a syscall record will be generated automatically for the
 *	     current syscall).
 *	  5) Netlink interface to user-space.
 *	  6) Support low-overhead kernel-based filtering to minimize the
 *	     information that must be passed to user-space.
 *
41
 * Example user-space utilities: http://people.redhat.com/sgrubb/audit/
L
Linus Torvalds 已提交
42 43 44 45
 */

#include <linux/init.h>
#include <asm/types.h>
A
Alan Cox 已提交
46
#include <asm/atomic.h>
L
Linus Torvalds 已提交
47 48
#include <linux/mm.h>
#include <linux/module.h>
49 50
#include <linux/err.h>
#include <linux/kthread.h>
L
Linus Torvalds 已提交
51 52 53 54

#include <linux/audit.h>

#include <net/sock.h>
55
#include <net/netlink.h>
L
Linus Torvalds 已提交
56 57
#include <linux/skbuff.h>
#include <linux/netlink.h>
A
Amy Griffis 已提交
58
#include <linux/inotify.h>
59
#include <linux/freezer.h>
M
Miloslav Trmac 已提交
60
#include <linux/tty.h>
61 62

#include "audit.h"
L
Linus Torvalds 已提交
63

64
/* No auditing will take place until audit_initialized == AUDIT_INITIALIZED.
L
Linus Torvalds 已提交
65
 * (Initialization happens after skb_init is called.) */
66 67 68
#define AUDIT_DISABLED		-1
#define AUDIT_UNINITIALIZED	0
#define AUDIT_INITIALIZED	1
L
Linus Torvalds 已提交
69 70
static int	audit_initialized;

71 72 73
#define AUDIT_OFF	0
#define AUDIT_ON	1
#define AUDIT_LOCKED	2
L
Linus Torvalds 已提交
74
int		audit_enabled;
75
int		audit_ever_enabled;
L
Linus Torvalds 已提交
76 77 78 79 80 81 82

/* Default state when kernel boots without any parameters. */
static int	audit_default;

/* If auditing cannot proceed, audit_failure selects what happens. */
static int	audit_failure = AUDIT_FAIL_PRINTK;

83 84 85 86 87
/*
 * If audit records are to be written to the netlink socket, audit_pid
 * contains the pid of the auditd process and audit_nlk_pid contains
 * the pid to use to send netlink messages to that process.
 */
88
int		audit_pid;
89
static int	audit_nlk_pid;
L
Linus Torvalds 已提交
90

91
/* If audit_rate_limit is non-zero, limit the rate of sending audit records
L
Linus Torvalds 已提交
92 93 94 95 96 97
 * to that number per second.  This prevents DoS attacks, but results in
 * audit records being dropped. */
static int	audit_rate_limit;

/* Number of outstanding audit_buffers allowed. */
static int	audit_backlog_limit = 64;
98 99
static int	audit_backlog_wait_time = 60 * HZ;
static int	audit_backlog_wait_overflow = 0;
L
Linus Torvalds 已提交
100

101 102 103
/* The identity of the user shutting down the audit system. */
uid_t		audit_sig_uid = -1;
pid_t		audit_sig_pid = -1;
104
u32		audit_sig_sid = 0;
105

L
Linus Torvalds 已提交
106 107 108 109 110 111 112 113 114 115 116 117
/* Records can be lost in several ways:
   0) [suppressed in audit_alloc]
   1) out of memory in audit_log_start [kmalloc of struct audit_buffer]
   2) out of memory in audit_log_move [alloc_skb]
   3) suppressed due to audit_rate_limit
   4) suppressed due to audit_backlog_limit
*/
static atomic_t    audit_lost = ATOMIC_INIT(0);

/* The netlink socket. */
static struct sock *audit_sock;

A
Amy Griffis 已提交
118 119 120
/* Hash for inode-based rules */
struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];

121
/* The audit_freelist is a list of pre-allocated audit buffers (if more
L
Linus Torvalds 已提交
122 123 124
 * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of
 * being placed on the freelist). */
static DEFINE_SPINLOCK(audit_freelist_lock);
125
static int	   audit_freelist_count;
L
Linus Torvalds 已提交
126 127
static LIST_HEAD(audit_freelist);

128
static struct sk_buff_head audit_skb_queue;
129 130
/* queue of skbs to send to auditd when/if it comes back */
static struct sk_buff_head audit_skb_hold_queue;
131 132
static struct task_struct *kauditd_task;
static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
133
static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
L
Linus Torvalds 已提交
134

A
Amy Griffis 已提交
135 136
/* Serialize requests from userspace. */
static DEFINE_MUTEX(audit_cmd_mutex);
L
Linus Torvalds 已提交
137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153

/* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
 * audit records.  Since printk uses a 1024 byte buffer, this buffer
 * should be at least that large. */
#define AUDIT_BUFSIZ 1024

/* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the
 * audit_freelist.  Doing so eliminates many kmalloc/kfree calls. */
#define AUDIT_MAXFREE  (2*NR_CPUS)

/* The audit_buffer is used when formatting an audit record.  The caller
 * locks briefly to get the record off the freelist or to allocate the
 * buffer, and locks briefly to send the buffer to the netlink layer or
 * to place it on a transmit queue.  Multiple audit_buffers can be in
 * use simultaneously. */
struct audit_buffer {
	struct list_head     list;
154
	struct sk_buff       *skb;	/* formatted skb ready to send */
L
Linus Torvalds 已提交
155
	struct audit_context *ctx;	/* NULL or associated context */
A
Al Viro 已提交
156
	gfp_t		     gfp_mask;
L
Linus Torvalds 已提交
157 158
};

159 160 161 162 163
struct audit_reply {
	int pid;
	struct sk_buff *skb;
};

164 165
static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
{
166 167 168 169
	if (ab) {
		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
		nlh->nlmsg_pid = pid;
	}
170 171
}

172
void audit_panic(const char *message)
L
Linus Torvalds 已提交
173 174 175 176 177 178
{
	switch (audit_failure)
	{
	case AUDIT_FAIL_SILENT:
		break;
	case AUDIT_FAIL_PRINTK:
179 180
		if (printk_ratelimit())
			printk(KERN_ERR "audit: %s\n", message);
L
Linus Torvalds 已提交
181 182
		break;
	case AUDIT_FAIL_PANIC:
183 184 185
		/* test audit_pid since printk is always losey, why bother? */
		if (audit_pid)
			panic("audit: %s\n", message);
L
Linus Torvalds 已提交
186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218
		break;
	}
}

static inline int audit_rate_check(void)
{
	static unsigned long	last_check = 0;
	static int		messages   = 0;
	static DEFINE_SPINLOCK(lock);
	unsigned long		flags;
	unsigned long		now;
	unsigned long		elapsed;
	int			retval	   = 0;

	if (!audit_rate_limit) return 1;

	spin_lock_irqsave(&lock, flags);
	if (++messages < audit_rate_limit) {
		retval = 1;
	} else {
		now     = jiffies;
		elapsed = now - last_check;
		if (elapsed > HZ) {
			last_check = now;
			messages   = 0;
			retval     = 1;
		}
	}
	spin_unlock_irqrestore(&lock, flags);

	return retval;
}

219 220 221 222 223 224 225 226
/**
 * audit_log_lost - conditionally log lost audit message event
 * @message: the message stating reason for lost audit message
 *
 * Emit at least 1 message per second, even if audit_rate_check is
 * throttling.
 * Always increment the lost messages counter.
*/
L
Linus Torvalds 已提交
227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249
void audit_log_lost(const char *message)
{
	static unsigned long	last_msg = 0;
	static DEFINE_SPINLOCK(lock);
	unsigned long		flags;
	unsigned long		now;
	int			print;

	atomic_inc(&audit_lost);

	print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);

	if (!print) {
		spin_lock_irqsave(&lock, flags);
		now = jiffies;
		if (now - last_msg > HZ) {
			print = 1;
			last_msg = now;
		}
		spin_unlock_irqrestore(&lock, flags);
	}

	if (print) {
250 251 252 253 254 255 256
		if (printk_ratelimit())
			printk(KERN_WARNING
				"audit: audit_lost=%d audit_rate_limit=%d "
				"audit_backlog_limit=%d\n",
				atomic_read(&audit_lost),
				audit_rate_limit,
				audit_backlog_limit);
L
Linus Torvalds 已提交
257 258 259 260
		audit_panic(message);
	}
}

261
static int audit_log_config_change(char *function_name, int new, int old,
262 263
				   uid_t loginuid, u32 sessionid, u32 sid,
				   int allow_changes)
L
Linus Torvalds 已提交
264
{
265 266
	struct audit_buffer *ab;
	int rc = 0;
267

268
	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
269 270
	audit_log_format(ab, "%s=%d old=%d auid=%u ses=%u", function_name, new,
			 old, loginuid, sessionid);
271 272 273
	if (sid) {
		char *ctx = NULL;
		u32 len;
274

275
		rc = security_secid_to_secctx(sid, &ctx, &len);
276 277 278 279 280
		if (rc) {
			audit_log_format(ab, " sid=%u", sid);
			allow_changes = 0; /* Something weird, deny request */
		} else {
			audit_log_format(ab, " subj=%s", ctx);
281
			security_release_secctx(ctx, len);
282
		}
S
Steve Grubb 已提交
283
	}
284 285
	audit_log_format(ab, " res=%d", allow_changes);
	audit_log_end(ab);
S
Steve Grubb 已提交
286
	return rc;
L
Linus Torvalds 已提交
287 288
}

289
static int audit_do_config_change(char *function_name, int *to_change,
290 291
				  int new, uid_t loginuid, u32 sessionid,
				  u32 sid)
L
Linus Torvalds 已提交
292
{
293
	int allow_changes, rc = 0, old = *to_change;
S
Steve Grubb 已提交
294 295

	/* check if we are locked */
296 297
	if (audit_enabled == AUDIT_LOCKED)
		allow_changes = 0;
S
Steve Grubb 已提交
298
	else
299
		allow_changes = 1;
300

301
	if (audit_enabled != AUDIT_OFF) {
302 303
		rc = audit_log_config_change(function_name, new, old, loginuid,
					     sessionid, sid, allow_changes);
304 305
		if (rc)
			allow_changes = 0;
S
Steve Grubb 已提交
306 307 308
	}

	/* If we are allowed, make the change */
309 310
	if (allow_changes == 1)
		*to_change = new;
S
Steve Grubb 已提交
311 312 313 314
	/* Not allowed, update reason */
	else if (rc == 0)
		rc = -EPERM;
	return rc;
L
Linus Torvalds 已提交
315 316
}

317 318
static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sessionid,
				u32 sid)
L
Linus Torvalds 已提交
319
{
320
	return audit_do_config_change("audit_rate_limit", &audit_rate_limit,
321
				      limit, loginuid, sessionid, sid);
322
}
323

324 325
static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sessionid,
				   u32 sid)
326 327
{
	return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit,
328
				      limit, loginuid, sessionid, sid);
329
}
S
Steve Grubb 已提交
330

331
static int audit_set_enabled(int state, uid_t loginuid, u32 sessionid, u32 sid)
332
{
333
	int rc;
334 335
	if (state < AUDIT_OFF || state > AUDIT_LOCKED)
		return -EINVAL;
S
Steve Grubb 已提交
336

337
	rc =  audit_do_config_change("audit_enabled", &audit_enabled, state,
338
				     loginuid, sessionid, sid);
339 340 341 342 343

	if (!rc)
		audit_ever_enabled |= !!state;

	return rc;
L
Linus Torvalds 已提交
344 345
}

346
static int audit_set_failure(int state, uid_t loginuid, u32 sessionid, u32 sid)
L
Linus Torvalds 已提交
347 348 349 350 351
{
	if (state != AUDIT_FAIL_SILENT
	    && state != AUDIT_FAIL_PRINTK
	    && state != AUDIT_FAIL_PANIC)
		return -EINVAL;
352

353
	return audit_do_config_change("audit_failure", &audit_failure, state,
354
				      loginuid, sessionid, sid);
L
Linus Torvalds 已提交
355 356
}

357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374
/*
 * Queue skbs to be sent to auditd when/if it comes back.  These skbs should
 * already have been sent via prink/syslog and so if these messages are dropped
 * it is not a huge concern since we already passed the audit_log_lost()
 * notification and stuff.  This is just nice to get audit messages during
 * boot before auditd is running or messages generated while auditd is stopped.
 * This only holds messages is audit_default is set, aka booting with audit=1
 * or building your kernel that way.
 */
static void audit_hold_skb(struct sk_buff *skb)
{
	if (audit_default &&
	    skb_queue_len(&audit_skb_hold_queue) < audit_backlog_limit)
		skb_queue_tail(&audit_skb_hold_queue, skb);
	else
		kfree_skb(skb);
}

375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393
/*
 * For one reason or another this nlh isn't getting delivered to the userspace
 * audit daemon, just send it to printk.
 */
static void audit_printk_skb(struct sk_buff *skb)
{
	struct nlmsghdr *nlh = nlmsg_hdr(skb);
	char *data = NLMSG_DATA(nlh);

	if (nlh->nlmsg_type != AUDIT_EOE) {
		if (printk_ratelimit())
			printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, data);
		else
			audit_log_lost("printk limit exceeded\n");
	}

	audit_hold_skb(skb);
}

394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411
static void kauditd_send_skb(struct sk_buff *skb)
{
	int err;
	/* take a reference in case we can't send it and we want to hold it */
	skb_get(skb);
	err = netlink_unicast(audit_sock, skb, audit_nlk_pid, 0);
	if (err < 0) {
		BUG_ON(err != -ECONNREFUSED); /* Shoudn't happen */
		printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
		audit_log_lost("auditd dissapeared\n");
		audit_pid = 0;
		/* we might get lucky and get this in the next auditd */
		audit_hold_skb(skb);
	} else
		/* drop the extra reference if sent ok */
		kfree_skb(skb);
}

A
Adrian Bunk 已提交
412
static int kauditd_thread(void *dummy)
413 414 415
{
	struct sk_buff *skb;

416
	set_freezable();
A
Andrew Morton 已提交
417
	while (!kthread_should_stop()) {
418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440
		/*
		 * if auditd just started drain the queue of messages already
		 * sent to syslog/printk.  remember loss here is ok.  we already
		 * called audit_log_lost() if it didn't go out normally.  so the
		 * race between the skb_dequeue and the next check for audit_pid
		 * doesn't matter.
		 *
		 * if you ever find kauditd to be too slow we can get a perf win
		 * by doing our own locking and keeping better track if there
		 * are messages in this queue.  I don't see the need now, but
		 * in 5 years when I want to play with this again I'll see this
		 * note and still have no friggin idea what i'm thinking today.
		 */
		if (audit_default && audit_pid) {
			skb = skb_dequeue(&audit_skb_hold_queue);
			if (unlikely(skb)) {
				while (skb && audit_pid) {
					kauditd_send_skb(skb);
					skb = skb_dequeue(&audit_skb_hold_queue);
				}
			}
		}

441
		skb = skb_dequeue(&audit_skb_queue);
442
		wake_up(&audit_backlog_wait);
443
		if (skb) {
444 445
			if (audit_pid)
				kauditd_send_skb(skb);
446 447
			else
				audit_printk_skb(skb);
448 449 450 451 452
		} else {
			DECLARE_WAITQUEUE(wait, current);
			set_current_state(TASK_INTERRUPTIBLE);
			add_wait_queue(&kauditd_wait, &wait);

453 454
			if (!skb_queue_len(&audit_skb_queue)) {
				try_to_freeze();
455
				schedule();
456
			}
457 458 459 460 461

			__set_current_state(TASK_RUNNING);
			remove_wait_queue(&kauditd_wait, &wait);
		}
	}
A
Andrew Morton 已提交
462
	return 0;
463 464
}

465
static int audit_prepare_user_tty(pid_t pid, uid_t loginuid, u32 sessionid)
M
Miloslav Trmac 已提交
466 467 468 469 470
{
	struct task_struct *tsk;
	int err;

	read_lock(&tasklist_lock);
471
	tsk = find_task_by_vpid(pid);
M
Miloslav Trmac 已提交
472 473 474 475 476 477 478 479 480 481 482 483
	err = -ESRCH;
	if (!tsk)
		goto out;
	err = 0;

	spin_lock_irq(&tsk->sighand->siglock);
	if (!tsk->signal->audit_tty)
		err = -EPERM;
	spin_unlock_irq(&tsk->sighand->siglock);
	if (err)
		goto out;

484
	tty_audit_push_task(tsk, loginuid, sessionid);
M
Miloslav Trmac 已提交
485 486 487 488 489
out:
	read_unlock(&tasklist_lock);
	return err;
}

490 491 492 493 494 495 496
int audit_send_list(void *_dest)
{
	struct audit_netlink_list *dest = _dest;
	int pid = dest->pid;
	struct sk_buff *skb;

	/* wait for parent to finish and send an ACK */
A
Amy Griffis 已提交
497 498
	mutex_lock(&audit_cmd_mutex);
	mutex_unlock(&audit_cmd_mutex);
499 500 501 502 503 504 505 506 507

	while ((skb = __skb_dequeue(&dest->q)) != NULL)
		netlink_unicast(audit_sock, skb, pid, 0);

	kfree(dest);

	return 0;
}

A
Al Viro 已提交
508 509 510 511 512 513 514 515 516 517 518 519 520 521 522
#ifdef CONFIG_AUDIT_TREE
static int prune_tree_thread(void *unused)
{
	mutex_lock(&audit_cmd_mutex);
	audit_prune_trees();
	mutex_unlock(&audit_cmd_mutex);
	return 0;
}

void audit_schedule_prune(void)
{
	kthread_run(prune_tree_thread, NULL, "audit_prune_tree");
}
#endif

523 524 525 526 527 528 529 530 531
struct sk_buff *audit_make_reply(int pid, int seq, int type, int done,
				 int multi, void *payload, int size)
{
	struct sk_buff	*skb;
	struct nlmsghdr	*nlh;
	void		*data;
	int		flags = multi ? NLM_F_MULTI : 0;
	int		t     = done  ? NLMSG_DONE  : type;

532
	skb = nlmsg_new(size, GFP_KERNEL);
533 534 535
	if (!skb)
		return NULL;

536 537
	nlh	= NLMSG_NEW(skb, pid, seq, t, size, flags);
	data	= NLMSG_DATA(nlh);
538 539 540
	memcpy(data, payload, size);
	return skb;

541
nlmsg_failure:			/* Used by NLMSG_NEW */
542 543 544 545 546
	if (skb)
		kfree_skb(skb);
	return NULL;
}

547 548 549 550 551 552 553 554 555 556 557 558 559
static int audit_send_reply_thread(void *arg)
{
	struct audit_reply *reply = (struct audit_reply *)arg;

	mutex_lock(&audit_cmd_mutex);
	mutex_unlock(&audit_cmd_mutex);

	/* Ignore failure. It'll only happen if the sender goes away,
	   because our timeout is set to infinite. */
	netlink_unicast(audit_sock, reply->skb, reply->pid, 0);
	kfree(reply);
	return 0;
}
560 561 562 563 564 565 566 567 568 569 570 571 572
/**
 * audit_send_reply - send an audit reply message via netlink
 * @pid: process id to send reply to
 * @seq: sequence number
 * @type: audit message type
 * @done: done (last) flag
 * @multi: multi-part message flag
 * @payload: payload data
 * @size: payload size
 *
 * Allocates an skb, builds the netlink message, and sends it to the pid.
 * No failure notifications.
 */
L
Linus Torvalds 已提交
573 574 575
void audit_send_reply(int pid, int seq, int type, int done, int multi,
		      void *payload, int size)
{
576 577 578 579 580 581 582 583
	struct sk_buff *skb;
	struct task_struct *tsk;
	struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),
					    GFP_KERNEL);

	if (!reply)
		return;

584
	skb = audit_make_reply(pid, seq, type, done, multi, payload, size);
L
Linus Torvalds 已提交
585
	if (!skb)
586
		goto out;
587 588 589 590 591

	reply->pid = pid;
	reply->skb = skb;

	tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
592 593 594 595 596
	if (!IS_ERR(tsk))
		return;
	kfree_skb(skb);
out:
	kfree(reply);
L
Linus Torvalds 已提交
597 598 599 600 601 602
}

/*
 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit
 * control messages.
 */
603
static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
L
Linus Torvalds 已提交
604 605 606 607 608 609
{
	int err = 0;

	switch (msg_type) {
	case AUDIT_GET:
	case AUDIT_LIST:
610
	case AUDIT_LIST_RULES:
L
Linus Torvalds 已提交
611 612
	case AUDIT_SET:
	case AUDIT_ADD:
613
	case AUDIT_ADD_RULE:
L
Linus Torvalds 已提交
614
	case AUDIT_DEL:
615
	case AUDIT_DEL_RULE:
616
	case AUDIT_SIGNAL_INFO:
M
Miloslav Trmac 已提交
617 618
	case AUDIT_TTY_GET:
	case AUDIT_TTY_SET:
A
Al Viro 已提交
619 620
	case AUDIT_TRIM:
	case AUDIT_MAKE_EQUIV:
621
		if (security_netlink_recv(skb, CAP_AUDIT_CONTROL))
L
Linus Torvalds 已提交
622 623
			err = -EPERM;
		break;
624
	case AUDIT_USER:
625 626
	case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
	case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
627
		if (security_netlink_recv(skb, CAP_AUDIT_WRITE))
L
Linus Torvalds 已提交
628 629 630 631 632 633 634 635 636
			err = -EPERM;
		break;
	default:  /* bad msg */
		err = -EINVAL;
	}

	return err;
}

637
static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
638 639
				     u32 pid, u32 uid, uid_t auid, u32 ses,
				     u32 sid)
640 641 642 643 644 645 646 647 648 649 650
{
	int rc = 0;
	char *ctx = NULL;
	u32 len;

	if (!audit_enabled) {
		*ab = NULL;
		return rc;
	}

	*ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
651 652
	audit_log_format(*ab, "user pid=%d uid=%u auid=%u ses=%u",
			 pid, uid, auid, ses);
653
	if (sid) {
654
		rc = security_secid_to_secctx(sid, &ctx, &len);
655 656
		if (rc)
			audit_log_format(*ab, " ssid=%u", sid);
657
		else {
658
			audit_log_format(*ab, " subj=%s", ctx);
659 660
			security_release_secctx(ctx, len);
		}
661 662 663 664 665
	}

	return rc;
}

L
Linus Torvalds 已提交
666 667
static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
{
668
	u32			uid, pid, seq, sid;
L
Linus Torvalds 已提交
669 670 671
	void			*data;
	struct audit_status	*status_get, status_set;
	int			err;
672
	struct audit_buffer	*ab;
L
Linus Torvalds 已提交
673
	u16			msg_type = nlh->nlmsg_type;
674
	uid_t			loginuid; /* loginuid of sender */
675
	u32			sessionid;
676
	struct audit_sig_info   *sig_data;
677
	char			*ctx = NULL;
678
	u32			len;
L
Linus Torvalds 已提交
679

680
	err = audit_netlink_ok(skb, msg_type);
L
Linus Torvalds 已提交
681 682 683
	if (err)
		return err;

684 685
	/* As soon as there's any sign of userspace auditd,
	 * start kauditd to talk to it */
686 687 688 689 690 691 692 693
	if (!kauditd_task)
		kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
	if (IS_ERR(kauditd_task)) {
		err = PTR_ERR(kauditd_task);
		kauditd_task = NULL;
		return err;
	}

L
Linus Torvalds 已提交
694 695
	pid  = NETLINK_CREDS(skb)->pid;
	uid  = NETLINK_CREDS(skb)->uid;
696
	loginuid = NETLINK_CB(skb).loginuid;
697
	sessionid = NETLINK_CB(skb).sessionid;
698
	sid  = NETLINK_CB(skb).sid;
L
Linus Torvalds 已提交
699 700 701 702 703 704 705 706 707 708 709
	seq  = nlh->nlmsg_seq;
	data = NLMSG_DATA(nlh);

	switch (msg_type) {
	case AUDIT_GET:
		status_set.enabled	 = audit_enabled;
		status_set.failure	 = audit_failure;
		status_set.pid		 = audit_pid;
		status_set.rate_limit	 = audit_rate_limit;
		status_set.backlog_limit = audit_backlog_limit;
		status_set.lost		 = atomic_read(&audit_lost);
710
		status_set.backlog	 = skb_queue_len(&audit_skb_queue);
L
Linus Torvalds 已提交
711 712 713 714 715 716 717 718
		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
				 &status_set, sizeof(status_set));
		break;
	case AUDIT_SET:
		if (nlh->nlmsg_len < sizeof(struct audit_status))
			return -EINVAL;
		status_get   = (struct audit_status *)data;
		if (status_get->mask & AUDIT_STATUS_ENABLED) {
719
			err = audit_set_enabled(status_get->enabled,
720
						loginuid, sessionid, sid);
721 722
			if (err < 0)
				return err;
L
Linus Torvalds 已提交
723 724
		}
		if (status_get->mask & AUDIT_STATUS_FAILURE) {
725
			err = audit_set_failure(status_get->failure,
726
						loginuid, sessionid, sid);
727 728
			if (err < 0)
				return err;
L
Linus Torvalds 已提交
729 730
		}
		if (status_get->mask & AUDIT_STATUS_PID) {
731 732 733 734 735
			int new_pid = status_get->pid;

			if (audit_enabled != AUDIT_OFF)
				audit_log_config_change("audit_pid", new_pid,
							audit_pid, loginuid,
736
							sessionid, sid, 1);
737 738

			audit_pid = new_pid;
739
			audit_nlk_pid = NETLINK_CB(skb).pid;
L
Linus Torvalds 已提交
740
		}
741
		if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) {
S
Serge E. Hallyn 已提交
742
			err = audit_set_rate_limit(status_get->rate_limit,
743
						   loginuid, sessionid, sid);
744 745 746
			if (err < 0)
				return err;
		}
L
Linus Torvalds 已提交
747
		if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT)
S
Serge E. Hallyn 已提交
748
			err = audit_set_backlog_limit(status_get->backlog_limit,
749
						      loginuid, sessionid, sid);
L
Linus Torvalds 已提交
750
		break;
751
	case AUDIT_USER:
752 753
	case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
	case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
754 755 756
		if (!audit_enabled && msg_type != AUDIT_USER_AVC)
			return 0;

757
		err = audit_filter_user(&NETLINK_CB(skb));
758 759
		if (err == 1) {
			err = 0;
M
Miloslav Trmac 已提交
760
			if (msg_type == AUDIT_USER_TTY) {
761 762
				err = audit_prepare_user_tty(pid, loginuid,
							     sessionid);
M
Miloslav Trmac 已提交
763 764 765
				if (err)
					break;
			}
766
			audit_log_common_recv_msg(&ab, msg_type, pid, uid,
767
						  loginuid, sessionid, sid);
768 769 770 771 772 773 774 775 776

			if (msg_type != AUDIT_USER_TTY)
				audit_log_format(ab, " msg='%.1024s'",
						 (char *)data);
			else {
				int size;

				audit_log_format(ab, " msg=");
				size = nlmsg_len(nlh);
777 778 779
				if (size > 0 &&
				    ((unsigned char *)data)[size - 1] == '\0')
					size--;
780
				audit_log_n_untrustedstring(ab, data, size);
781
			}
782 783
			audit_set_pid(ab, pid);
			audit_log_end(ab);
784
		}
L
Linus Torvalds 已提交
785 786 787
		break;
	case AUDIT_ADD:
	case AUDIT_DEL:
788
		if (nlmsg_len(nlh) < sizeof(struct audit_rule))
L
Linus Torvalds 已提交
789
			return -EINVAL;
790
		if (audit_enabled == AUDIT_LOCKED) {
791
			audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
792
						  uid, loginuid, sessionid, sid);
793 794 795 796

			audit_log_format(ab, " audit_enabled=%d res=0",
					 audit_enabled);
			audit_log_end(ab);
S
Steve Grubb 已提交
797 798
			return -EPERM;
		}
L
Linus Torvalds 已提交
799 800
		/* fallthrough */
	case AUDIT_LIST:
801
		err = audit_receive_filter(msg_type, NETLINK_CB(skb).pid,
802
					   uid, seq, data, nlmsg_len(nlh),
803
					   loginuid, sessionid, sid);
804 805 806 807 808
		break;
	case AUDIT_ADD_RULE:
	case AUDIT_DEL_RULE:
		if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
			return -EINVAL;
809
		if (audit_enabled == AUDIT_LOCKED) {
810
			audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
811
						  uid, loginuid, sessionid, sid);
812 813 814 815

			audit_log_format(ab, " audit_enabled=%d res=0",
					 audit_enabled);
			audit_log_end(ab);
S
Steve Grubb 已提交
816 817
			return -EPERM;
		}
818 819
		/* fallthrough */
	case AUDIT_LIST_RULES:
820
		err = audit_receive_filter(msg_type, NETLINK_CB(skb).pid,
821
					   uid, seq, data, nlmsg_len(nlh),
822
					   loginuid, sessionid, sid);
L
Linus Torvalds 已提交
823
		break;
A
Al Viro 已提交
824 825
	case AUDIT_TRIM:
		audit_trim_trees();
826 827

		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
828
					  uid, loginuid, sessionid, sid);
829

A
Al Viro 已提交
830 831 832 833 834 835
		audit_log_format(ab, " op=trim res=1");
		audit_log_end(ab);
		break;
	case AUDIT_MAKE_EQUIV: {
		void *bufp = data;
		u32 sizes[2];
836
		size_t msglen = nlmsg_len(nlh);
A
Al Viro 已提交
837 838 839
		char *old, *new;

		err = -EINVAL;
840
		if (msglen < 2 * sizeof(u32))
A
Al Viro 已提交
841 842 843
			break;
		memcpy(sizes, bufp, 2 * sizeof(u32));
		bufp += 2 * sizeof(u32);
844 845
		msglen -= 2 * sizeof(u32);
		old = audit_unpack_string(&bufp, &msglen, sizes[0]);
A
Al Viro 已提交
846 847 848 849
		if (IS_ERR(old)) {
			err = PTR_ERR(old);
			break;
		}
850
		new = audit_unpack_string(&bufp, &msglen, sizes[1]);
A
Al Viro 已提交
851 852 853 854 855 856 857 858
		if (IS_ERR(new)) {
			err = PTR_ERR(new);
			kfree(old);
			break;
		}
		/* OK, here comes... */
		err = audit_tag_tree(old, new);

859
		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
860
					  uid, loginuid, sessionid, sid);
861

A
Al Viro 已提交
862 863 864 865 866 867 868 869 870 871
		audit_log_format(ab, " op=make_equiv old=");
		audit_log_untrustedstring(ab, old);
		audit_log_format(ab, " new=");
		audit_log_untrustedstring(ab, new);
		audit_log_format(ab, " res=%d", !err);
		audit_log_end(ab);
		kfree(old);
		kfree(new);
		break;
	}
872
	case AUDIT_SIGNAL_INFO:
873
		err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
874 875 876 877
		if (err)
			return err;
		sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
		if (!sig_data) {
878
			security_release_secctx(ctx, len);
879 880 881 882 883
			return -ENOMEM;
		}
		sig_data->uid = audit_sig_uid;
		sig_data->pid = audit_sig_pid;
		memcpy(sig_data->ctx, ctx, len);
884
		security_release_secctx(ctx, len);
D
Daniel Walker 已提交
885
		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO,
886 887
				0, 0, sig_data, sizeof(*sig_data) + len);
		kfree(sig_data);
888
		break;
M
Miloslav Trmac 已提交
889 890 891 892 893
	case AUDIT_TTY_GET: {
		struct audit_tty_status s;
		struct task_struct *tsk;

		read_lock(&tasklist_lock);
894
		tsk = find_task_by_vpid(pid);
M
Miloslav Trmac 已提交
895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916
		if (!tsk)
			err = -ESRCH;
		else {
			spin_lock_irq(&tsk->sighand->siglock);
			s.enabled = tsk->signal->audit_tty != 0;
			spin_unlock_irq(&tsk->sighand->siglock);
		}
		read_unlock(&tasklist_lock);
		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
				 &s, sizeof(s));
		break;
	}
	case AUDIT_TTY_SET: {
		struct audit_tty_status *s;
		struct task_struct *tsk;

		if (nlh->nlmsg_len < sizeof(struct audit_tty_status))
			return -EINVAL;
		s = data;
		if (s->enabled != 0 && s->enabled != 1)
			return -EINVAL;
		read_lock(&tasklist_lock);
917
		tsk = find_task_by_vpid(pid);
M
Miloslav Trmac 已提交
918 919 920 921 922 923 924 925 926 927
		if (!tsk)
			err = -ESRCH;
		else {
			spin_lock_irq(&tsk->sighand->siglock);
			tsk->signal->audit_tty = s->enabled != 0;
			spin_unlock_irq(&tsk->sighand->siglock);
		}
		read_unlock(&tasklist_lock);
		break;
	}
L
Linus Torvalds 已提交
928 929 930 931 932 933 934 935
	default:
		err = -EINVAL;
		break;
	}

	return err < 0 ? err : 0;
}

936
/*
E
Eric Paris 已提交
937 938
 * Get message from skb.  Each message is processed by audit_receive_msg.
 * Malformed skbs with wrong length are discarded silently.
939
 */
940
static void audit_receive_skb(struct sk_buff *skb)
L
Linus Torvalds 已提交
941
{
E
Eric Paris 已提交
942 943 944 945 946 947 948 949 950 951 952 953 954 955 956
	struct nlmsghdr *nlh;
	/*
	 * len MUST be signed for NLMSG_NEXT to be able to dec it below 0
	 * if the nlmsg_len was not aligned
	 */
	int len;
	int err;

	nlh = nlmsg_hdr(skb);
	len = skb->len;

	while (NLMSG_OK(nlh, len)) {
		err = audit_receive_msg(skb, nlh);
		/* if err or if this message says it wants a response */
		if (err || (nlh->nlmsg_flags & NLM_F_ACK))
L
Linus Torvalds 已提交
957
			netlink_ack(skb, nlh, err);
E
Eric Paris 已提交
958 959

		nlh = NLMSG_NEXT(nlh, len);
L
Linus Torvalds 已提交
960 961 962 963
	}
}

/* Receive messages from netlink socket. */
964
static void audit_receive(struct sk_buff  *skb)
L
Linus Torvalds 已提交
965
{
A
Amy Griffis 已提交
966
	mutex_lock(&audit_cmd_mutex);
967
	audit_receive_skb(skb);
A
Amy Griffis 已提交
968
	mutex_unlock(&audit_cmd_mutex);
L
Linus Torvalds 已提交
969 970 971 972 973
}

/* Initialize audit support at boot time. */
static int __init audit_init(void)
{
A
Amy Griffis 已提交
974 975
	int i;

976 977 978
	if (audit_initialized == AUDIT_DISABLED)
		return 0;

L
Linus Torvalds 已提交
979 980
	printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
	       audit_default ? "enabled" : "disabled");
981 982
	audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, 0,
					   audit_receive, NULL, THIS_MODULE);
L
Linus Torvalds 已提交
983 984
	if (!audit_sock)
		audit_panic("cannot initialize netlink socket");
985 986
	else
		audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
L
Linus Torvalds 已提交
987

988
	skb_queue_head_init(&audit_skb_queue);
989
	skb_queue_head_init(&audit_skb_hold_queue);
990
	audit_initialized = AUDIT_INITIALIZED;
L
Linus Torvalds 已提交
991
	audit_enabled = audit_default;
992
	audit_ever_enabled |= !!audit_default;
993

994
	audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
A
Amy Griffis 已提交
995 996 997 998

	for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
		INIT_LIST_HEAD(&audit_inode_hash[i]);

L
Linus Torvalds 已提交
999 1000 1001 1002 1003 1004 1005 1006
	return 0;
}
__initcall(audit_init);

/* Process kernel command-line parameter at boot time.  audit=0 or audit=1. */
static int __init audit_enable(char *str)
{
	audit_default = !!simple_strtol(str, NULL, 0);
1007 1008 1009 1010 1011 1012
	if (!audit_default)
		audit_initialized = AUDIT_DISABLED;

	printk(KERN_INFO "audit: %s", audit_default ? "enabled" : "disabled");

	if (audit_initialized == AUDIT_INITIALIZED) {
L
Linus Torvalds 已提交
1013
		audit_enabled = audit_default;
1014
		audit_ever_enabled |= !!audit_default;
1015 1016 1017 1018
	} else if (audit_initialized == AUDIT_UNINITIALIZED) {
		printk(" (after initialization)");
	} else {
		printk(" (until reboot)");
1019
	}
1020 1021
	printk("\n");

1022
	return 1;
L
Linus Torvalds 已提交
1023 1024 1025 1026
}

__setup("audit=", audit_enable);

1027 1028 1029 1030
static void audit_buffer_free(struct audit_buffer *ab)
{
	unsigned long flags;

1031 1032 1033
	if (!ab)
		return;

1034 1035
	if (ab->skb)
		kfree_skb(ab->skb);
1036

1037
	spin_lock_irqsave(&audit_freelist_lock, flags);
S
Serge E. Hallyn 已提交
1038
	if (audit_freelist_count > AUDIT_MAXFREE)
1039
		kfree(ab);
S
Serge E. Hallyn 已提交
1040 1041
	else {
		audit_freelist_count++;
1042
		list_add(&ab->list, &audit_freelist);
S
Serge E. Hallyn 已提交
1043
	}
1044 1045 1046
	spin_unlock_irqrestore(&audit_freelist_lock, flags);
}

1047
static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
A
Al Viro 已提交
1048
						gfp_t gfp_mask, int type)
1049 1050 1051
{
	unsigned long flags;
	struct audit_buffer *ab = NULL;
1052
	struct nlmsghdr *nlh;
1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063

	spin_lock_irqsave(&audit_freelist_lock, flags);
	if (!list_empty(&audit_freelist)) {
		ab = list_entry(audit_freelist.next,
				struct audit_buffer, list);
		list_del(&ab->list);
		--audit_freelist_count;
	}
	spin_unlock_irqrestore(&audit_freelist_lock, flags);

	if (!ab) {
1064
		ab = kmalloc(sizeof(*ab), gfp_mask);
1065
		if (!ab)
1066
			goto err;
1067
	}
1068

1069
	ab->ctx = ctx;
1070
	ab->gfp_mask = gfp_mask;
1071 1072 1073 1074 1075 1076 1077

	ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask);
	if (!ab->skb)
		goto nlmsg_failure;

	nlh = NLMSG_NEW(ab->skb, 0, 0, type, 0, 0);

1078
	return ab;
1079 1080 1081 1082

nlmsg_failure:                  /* Used by NLMSG_NEW */
	kfree_skb(ab->skb);
	ab->skb = NULL;
1083 1084 1085
err:
	audit_buffer_free(ab);
	return NULL;
1086
}
L
Linus Torvalds 已提交
1087

1088 1089 1090 1091
/**
 * audit_serial - compute a serial number for the audit record
 *
 * Compute a serial number for the audit record.  Audit records are
1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102
 * written to user-space as soon as they are generated, so a complete
 * audit record may be written in several pieces.  The timestamp of the
 * record and this serial number are used by the user-space tools to
 * determine which pieces belong to the same audit record.  The
 * (timestamp,serial) tuple is unique for each syscall and is live from
 * syscall entry to syscall exit.
 *
 * NOTE: Another possibility is to store the formatted records off the
 * audit context (for those records that have a context), and emit them
 * all at syscall exit.  However, this could delay the reporting of
 * significant errors until syscall exit (or never, if the system
1103 1104
 * halts).
 */
1105 1106
unsigned int audit_serial(void)
{
I
Ingo Molnar 已提交
1107
	static DEFINE_SPINLOCK(serial_lock);
1108 1109 1110 1111
	static unsigned int serial = 0;

	unsigned long flags;
	unsigned int ret;
1112

1113
	spin_lock_irqsave(&serial_lock, flags);
1114
	do {
1115 1116
		ret = ++serial;
	} while (unlikely(!ret));
1117
	spin_unlock_irqrestore(&serial_lock, flags);
1118

1119
	return ret;
1120 1121
}

D
Daniel Walker 已提交
1122
static inline void audit_get_stamp(struct audit_context *ctx,
1123 1124
				   struct timespec *t, unsigned int *serial)
{
1125
	if (!ctx || !auditsc_get_stamp(ctx, t, serial)) {
1126 1127 1128 1129 1130
		*t = CURRENT_TIME;
		*serial = audit_serial();
	}
}

L
Linus Torvalds 已提交
1131 1132 1133 1134 1135 1136
/* Obtain an audit buffer.  This routine does locking to obtain the
 * audit buffer, but then no locking is required for calls to
 * audit_log_*format.  If the tsk is a task that is currently in a
 * syscall, then the syscall is marked as auditable and an audit record
 * will be written at syscall exit.  If there is no associated task, tsk
 * should be NULL. */
1137

1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152
/**
 * audit_log_start - obtain an audit buffer
 * @ctx: audit_context (may be NULL)
 * @gfp_mask: type of allocation
 * @type: audit message type
 *
 * Returns audit_buffer pointer on success or NULL on error.
 *
 * Obtain an audit buffer.  This routine does locking to obtain the
 * audit buffer, but then no locking is required for calls to
 * audit_log_*format.  If the task (ctx) is a task that is currently in a
 * syscall, then the syscall is marked as auditable and an audit record
 * will be written at syscall exit.  If there is no associated task, then
 * task context (ctx) should be NULL.
 */
A
Al Viro 已提交
1153
struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
1154
				     int type)
L
Linus Torvalds 已提交
1155 1156 1157
{
	struct audit_buffer	*ab	= NULL;
	struct timespec		t;
1158
	unsigned int		uninitialized_var(serial);
1159
	int reserve;
1160
	unsigned long timeout_start = jiffies;
L
Linus Torvalds 已提交
1161

1162
	if (audit_initialized != AUDIT_INITIALIZED)
L
Linus Torvalds 已提交
1163 1164
		return NULL;

1165 1166 1167
	if (unlikely(audit_filter_type(type)))
		return NULL;

1168 1169 1170
	if (gfp_mask & __GFP_WAIT)
		reserve = 0;
	else
D
Daniel Walker 已提交
1171
		reserve = 5; /* Allow atomic callers to go up to five
1172 1173 1174 1175
				entries over the normal backlog limit */

	while (audit_backlog_limit
	       && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
1176 1177 1178
		if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time
		    && time_before(jiffies, timeout_start + audit_backlog_wait_time)) {

1179 1180 1181 1182 1183 1184 1185
			/* Wait for auditd to drain the queue a little */
			DECLARE_WAITQUEUE(wait, current);
			set_current_state(TASK_INTERRUPTIBLE);
			add_wait_queue(&audit_backlog_wait, &wait);

			if (audit_backlog_limit &&
			    skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
1186
				schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies);
1187 1188 1189

			__set_current_state(TASK_RUNNING);
			remove_wait_queue(&audit_backlog_wait, &wait);
1190
			continue;
1191
		}
1192
		if (audit_rate_check() && printk_ratelimit())
1193 1194 1195 1196 1197 1198
			printk(KERN_WARNING
			       "audit: audit_backlog=%d > "
			       "audit_backlog_limit=%d\n",
			       skb_queue_len(&audit_skb_queue),
			       audit_backlog_limit);
		audit_log_lost("backlog limit exceeded");
1199 1200
		audit_backlog_wait_time = audit_backlog_wait_overflow;
		wake_up(&audit_backlog_wait);
1201 1202 1203
		return NULL;
	}

1204
	ab = audit_buffer_alloc(ctx, gfp_mask, type);
L
Linus Torvalds 已提交
1205 1206 1207 1208 1209
	if (!ab) {
		audit_log_lost("out of memory in audit_log_start");
		return NULL;
	}

1210
	audit_get_stamp(ab->ctx, &t, &serial);
1211

L
Linus Torvalds 已提交
1212 1213 1214 1215 1216
	audit_log_format(ab, "audit(%lu.%03lu:%u): ",
			 t.tv_sec, t.tv_nsec/1000000, serial);
	return ab;
}

1217
/**
1218
 * audit_expand - expand skb in the audit buffer
1219
 * @ab: audit_buffer
1220
 * @extra: space to add at tail of the skb
1221 1222 1223 1224
 *
 * Returns 0 (no space) on failed expansion, or available space if
 * successful.
 */
1225
static inline int audit_expand(struct audit_buffer *ab, int extra)
1226
{
1227
	struct sk_buff *skb = ab->skb;
1228 1229 1230 1231
	int oldtail = skb_tailroom(skb);
	int ret = pskb_expand_head(skb, 0, extra, ab->gfp_mask);
	int newtail = skb_tailroom(skb);

1232 1233
	if (ret < 0) {
		audit_log_lost("out of memory in audit_expand");
1234
		return 0;
1235
	}
1236 1237 1238

	skb->truesize += newtail - oldtail;
	return newtail;
1239
}
L
Linus Torvalds 已提交
1240

1241 1242
/*
 * Format an audit message into the audit buffer.  If there isn't enough
L
Linus Torvalds 已提交
1243 1244
 * room in the audit buffer, more room will be allocated and vsnprint
 * will be called a second time.  Currently, we assume that a printk
1245 1246
 * can't format message larger than 1024 bytes, so we don't either.
 */
L
Linus Torvalds 已提交
1247 1248 1249 1250
static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
			      va_list args)
{
	int len, avail;
1251
	struct sk_buff *skb;
D
David Woodhouse 已提交
1252
	va_list args2;
L
Linus Torvalds 已提交
1253 1254 1255 1256

	if (!ab)
		return;

1257 1258 1259 1260
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	if (avail == 0) {
1261
		avail = audit_expand(ab, AUDIT_BUFSIZ);
1262 1263
		if (!avail)
			goto out;
L
Linus Torvalds 已提交
1264
	}
D
David Woodhouse 已提交
1265
	va_copy(args2, args);
1266
	len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args);
L
Linus Torvalds 已提交
1267 1268 1269 1270
	if (len >= avail) {
		/* The printk buffer is 1024 bytes long, so if we get
		 * here and AUDIT_BUFSIZ is at least 1024, then we can
		 * log everything that printk could have logged. */
1271 1272
		avail = audit_expand(ab,
			max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
1273 1274
		if (!avail)
			goto out;
1275
		len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
L
Linus Torvalds 已提交
1276
	}
1277
	va_end(args2);
1278 1279
	if (len > 0)
		skb_put(skb, len);
1280 1281
out:
	return;
L
Linus Torvalds 已提交
1282 1283
}

1284 1285 1286 1287 1288 1289 1290 1291
/**
 * audit_log_format - format a message into the audit buffer.
 * @ab: audit_buffer
 * @fmt: format string
 * @...: optional parameters matching @fmt string
 *
 * All the work is done in audit_log_vformat.
 */
L
Linus Torvalds 已提交
1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302
void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
{
	va_list args;

	if (!ab)
		return;
	va_start(args, fmt);
	audit_log_vformat(ab, fmt, args);
	va_end(args);
}

1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313
/**
 * audit_log_hex - convert a buffer to hex and append it to the audit skb
 * @ab: the audit_buffer
 * @buf: buffer to convert to hex
 * @len: length of @buf to be converted
 *
 * No return value; failure to expand is silently ignored.
 *
 * This function will take the passed buf and convert it into a string of
 * ascii hex digits. The new string is placed onto the skb.
 */
1314
void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
1315
		size_t len)
1316
{
1317 1318 1319 1320 1321
	int i, avail, new_len;
	unsigned char *ptr;
	struct sk_buff *skb;
	static const unsigned char *hex = "0123456789ABCDEF";

A
Amy Griffis 已提交
1322 1323 1324
	if (!ab)
		return;

1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	new_len = len<<1;
	if (new_len >= avail) {
		/* Round the buffer request up to the next multiple */
		new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
		avail = audit_expand(ab, new_len);
		if (!avail)
			return;
	}
1336

1337
	ptr = skb_tail_pointer(skb);
1338 1339 1340 1341 1342 1343
	for (i=0; i<len; i++) {
		*ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */
		*ptr++ = hex[buf[i] & 0x0F];	  /* Lower nibble */
	}
	*ptr = 0;
	skb_put(skb, len << 1); /* new string is twice the old string */
1344 1345
}

1346 1347 1348 1349
/*
 * Format a string of no more than slen characters into the audit buffer,
 * enclosed in quote marks.
 */
1350 1351
void audit_log_n_string(struct audit_buffer *ab, const char *string,
			size_t slen)
1352 1353 1354 1355 1356
{
	int avail, new_len;
	unsigned char *ptr;
	struct sk_buff *skb;

A
Amy Griffis 已提交
1357 1358 1359
	if (!ab)
		return;

1360 1361 1362 1363 1364 1365 1366 1367 1368
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	new_len = slen + 3;	/* enclosing quotes + null terminator */
	if (new_len > avail) {
		avail = audit_expand(ab, new_len);
		if (!avail)
			return;
	}
1369
	ptr = skb_tail_pointer(skb);
1370 1371 1372 1373 1374 1375 1376 1377
	*ptr++ = '"';
	memcpy(ptr, string, slen);
	ptr += slen;
	*ptr++ = '"';
	*ptr = 0;
	skb_put(skb, slen + 2);	/* don't include null terminator */
}

1378 1379
/**
 * audit_string_contains_control - does a string need to be logged in hex
1380 1381
 * @string: string to be checked
 * @len: max length of the string to check
1382 1383 1384 1385
 */
int audit_string_contains_control(const char *string, size_t len)
{
	const unsigned char *p;
1386
	for (p = string; p < (const unsigned char *)string + len; p++) {
1387
		if (*p == '"' || *p < 0x21 || *p > 0x7e)
1388 1389 1390 1391 1392
			return 1;
	}
	return 0;
}

1393
/**
M
Miloslav Trmac 已提交
1394
 * audit_log_n_untrustedstring - log a string that may contain random characters
1395
 * @ab: audit_buffer
1396
 * @len: length of string (not including trailing null)
1397 1398 1399 1400
 * @string: string to be logged
 *
 * This code will escape a string that is passed to it if the string
 * contains a control character, unprintable character, double quote mark,
1401
 * or a space. Unescaped strings will start and end with a double quote mark.
1402
 * Strings that are escaped are printed in hex (2 digits per char).
1403 1404 1405
 *
 * The caller specifies the number of characters in the string to log, which may
 * or may not be the entire string.
1406
 */
1407 1408
void audit_log_n_untrustedstring(struct audit_buffer *ab, const char *string,
				 size_t len)
1409
{
1410
	if (audit_string_contains_control(string, len))
1411
		audit_log_n_hex(ab, string, len);
1412
	else
1413
		audit_log_n_string(ab, string, len);
1414 1415
}

1416
/**
M
Miloslav Trmac 已提交
1417
 * audit_log_untrustedstring - log a string that may contain random characters
1418 1419 1420
 * @ab: audit_buffer
 * @string: string to be logged
 *
M
Miloslav Trmac 已提交
1421
 * Same as audit_log_n_untrustedstring(), except that strlen is used to
1422 1423
 * determine string length.
 */
1424
void audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
1425
{
1426
	audit_log_n_untrustedstring(ab, string, strlen(string));
1427 1428
}

1429
/* This is a helper-function to print the escaped d_path */
L
Linus Torvalds 已提交
1430
void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
1431
		      struct path *path)
L
Linus Torvalds 已提交
1432
{
1433
	char *p, *pathname;
L
Linus Torvalds 已提交
1434

1435 1436
	if (prefix)
		audit_log_format(ab, " %s", prefix);
L
Linus Torvalds 已提交
1437

1438
	/* We will allow 11 spaces for ' (deleted)' to be appended */
1439 1440
	pathname = kmalloc(PATH_MAX+11, ab->gfp_mask);
	if (!pathname) {
1441
		audit_log_string(ab, "<no_memory>");
1442
		return;
L
Linus Torvalds 已提交
1443
	}
1444
	p = d_path(path, pathname, PATH_MAX+11);
1445 1446
	if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */
		/* FIXME: can we save some information here? */
1447
		audit_log_string(ab, "<too_long>");
D
Daniel Walker 已提交
1448
	} else
1449
		audit_log_untrustedstring(ab, p);
1450
	kfree(pathname);
L
Linus Torvalds 已提交
1451 1452
}

1453 1454 1455 1456 1457 1458 1459 1460 1461
void audit_log_key(struct audit_buffer *ab, char *key)
{
	audit_log_format(ab, " key=");
	if (key)
		audit_log_untrustedstring(ab, key);
	else
		audit_log_format(ab, "(null)");
}

1462 1463 1464 1465 1466 1467
/**
 * audit_log_end - end one audit record
 * @ab: the audit_buffer
 *
 * The netlink_* functions cannot be called inside an irq context, so
 * the audit buffer is placed on a queue and a tasklet is scheduled to
L
Linus Torvalds 已提交
1468
 * remove them from the queue outside the irq context.  May be called in
1469 1470
 * any context.
 */
1471
void audit_log_end(struct audit_buffer *ab)
L
Linus Torvalds 已提交
1472 1473 1474 1475 1476 1477
{
	if (!ab)
		return;
	if (!audit_rate_check()) {
		audit_log_lost("rate limit exceeded");
	} else {
1478
		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
1479 1480
		nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0);

1481 1482 1483
		if (audit_pid) {
			skb_queue_tail(&audit_skb_queue, ab->skb);
			wake_up_interruptible(&kauditd_wait);
1484
		} else {
1485
			audit_printk_skb(ab->skb);
1486
		}
1487
		ab->skb = NULL;
L
Linus Torvalds 已提交
1488
	}
1489
	audit_buffer_free(ab);
L
Linus Torvalds 已提交
1490 1491
}

1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503
/**
 * audit_log - Log an audit record
 * @ctx: audit context
 * @gfp_mask: type of allocation
 * @type: audit message type
 * @fmt: format string to use
 * @...: variable parameters matching the format string
 *
 * This is a convenience function that calls audit_log_start,
 * audit_log_vformat, and audit_log_end.  It may be called
 * in any context.
 */
D
Daniel Walker 已提交
1504
void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
1505
	       const char *fmt, ...)
L
Linus Torvalds 已提交
1506 1507 1508 1509
{
	struct audit_buffer *ab;
	va_list args;

1510
	ab = audit_log_start(ctx, gfp_mask, type);
L
Linus Torvalds 已提交
1511 1512 1513 1514 1515 1516 1517
	if (ab) {
		va_start(args, fmt);
		audit_log_vformat(ab, fmt, args);
		va_end(args);
		audit_log_end(ab);
	}
}
1518 1519 1520 1521 1522

EXPORT_SYMBOL(audit_log_start);
EXPORT_SYMBOL(audit_log_end);
EXPORT_SYMBOL(audit_log_format);
EXPORT_SYMBOL(audit_log);