audit.c 36.2 KB
Newer Older
1
/* audit.c -- Auditing support
L
Linus Torvalds 已提交
2 3 4
 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon.
 * System-call specific features have moved to auditsc.c
 *
S
Steve Grubb 已提交
5
 * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina.
L
Linus Torvalds 已提交
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40
 * All Rights Reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
 *
 * Goals: 1) Integrate fully with SELinux.
 *	  2) Minimal run-time overhead:
 *	     a) Minimal when syscall auditing is disabled (audit_enable=0).
 *	     b) Small when syscall auditing is enabled and no audit record
 *		is generated (defer as much work as possible to record
 *		generation time):
 *		i) context is allocated,
 *		ii) names from getname are stored without a copy, and
 *		iii) inode information stored from path_lookup.
 *	  3) Ability to disable syscall auditing at boot time (audit=0).
 *	  4) Usable by other parts of the kernel (if audit_log* is called,
 *	     then a syscall record will be generated automatically for the
 *	     current syscall).
 *	  5) Netlink interface to user-space.
 *	  6) Support low-overhead kernel-based filtering to minimize the
 *	     information that must be passed to user-space.
 *
41
 * Example user-space utilities: http://people.redhat.com/sgrubb/audit/
L
Linus Torvalds 已提交
42 43 44 45
 */

#include <linux/init.h>
#include <asm/types.h>
A
Alan Cox 已提交
46
#include <asm/atomic.h>
L
Linus Torvalds 已提交
47 48
#include <linux/mm.h>
#include <linux/module.h>
49 50
#include <linux/err.h>
#include <linux/kthread.h>
L
Linus Torvalds 已提交
51 52 53 54

#include <linux/audit.h>

#include <net/sock.h>
55
#include <net/netlink.h>
L
Linus Torvalds 已提交
56 57
#include <linux/skbuff.h>
#include <linux/netlink.h>
58
#include <linux/selinux.h>
A
Amy Griffis 已提交
59
#include <linux/inotify.h>
60
#include <linux/freezer.h>
M
Miloslav Trmac 已提交
61
#include <linux/tty.h>
62 63

#include "audit.h"
L
Linus Torvalds 已提交
64 65 66 67 68

/* No auditing will take place until audit_initialized != 0.
 * (Initialization happens after skb_init is called.) */
static int	audit_initialized;

69 70 71
#define AUDIT_OFF	0
#define AUDIT_ON	1
#define AUDIT_LOCKED	2
L
Linus Torvalds 已提交
72
int		audit_enabled;
73
int		audit_ever_enabled;
L
Linus Torvalds 已提交
74 75 76 77 78 79 80 81 82

/* Default state when kernel boots without any parameters. */
static int	audit_default;

/* If auditing cannot proceed, audit_failure selects what happens. */
static int	audit_failure = AUDIT_FAIL_PRINTK;

/* If audit records are to be written to the netlink socket, audit_pid
 * contains the (non-zero) pid. */
83
int		audit_pid;
L
Linus Torvalds 已提交
84

85
/* If audit_rate_limit is non-zero, limit the rate of sending audit records
L
Linus Torvalds 已提交
86 87 88 89 90 91
 * to that number per second.  This prevents DoS attacks, but results in
 * audit records being dropped. */
static int	audit_rate_limit;

/* Number of outstanding audit_buffers allowed. */
static int	audit_backlog_limit = 64;
92 93
static int	audit_backlog_wait_time = 60 * HZ;
static int	audit_backlog_wait_overflow = 0;
L
Linus Torvalds 已提交
94

95 96 97
/* The identity of the user shutting down the audit system. */
uid_t		audit_sig_uid = -1;
pid_t		audit_sig_pid = -1;
98
u32		audit_sig_sid = 0;
99

L
Linus Torvalds 已提交
100 101 102 103 104 105 106 107 108 109 110 111
/* Records can be lost in several ways:
   0) [suppressed in audit_alloc]
   1) out of memory in audit_log_start [kmalloc of struct audit_buffer]
   2) out of memory in audit_log_move [alloc_skb]
   3) suppressed due to audit_rate_limit
   4) suppressed due to audit_backlog_limit
*/
static atomic_t    audit_lost = ATOMIC_INIT(0);

/* The netlink socket. */
static struct sock *audit_sock;

A
Amy Griffis 已提交
112 113 114 115 116 117
/* Inotify handle. */
struct inotify_handle *audit_ih;

/* Hash for inode-based rules */
struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];

118
/* The audit_freelist is a list of pre-allocated audit buffers (if more
L
Linus Torvalds 已提交
119 120 121
 * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of
 * being placed on the freelist). */
static DEFINE_SPINLOCK(audit_freelist_lock);
122
static int	   audit_freelist_count;
L
Linus Torvalds 已提交
123 124
static LIST_HEAD(audit_freelist);

125 126 127
static struct sk_buff_head audit_skb_queue;
static struct task_struct *kauditd_task;
static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
128
static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
L
Linus Torvalds 已提交
129

A
Amy Griffis 已提交
130 131
/* Serialize requests from userspace. */
static DEFINE_MUTEX(audit_cmd_mutex);
L
Linus Torvalds 已提交
132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148

/* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
 * audit records.  Since printk uses a 1024 byte buffer, this buffer
 * should be at least that large. */
#define AUDIT_BUFSIZ 1024

/* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the
 * audit_freelist.  Doing so eliminates many kmalloc/kfree calls. */
#define AUDIT_MAXFREE  (2*NR_CPUS)

/* The audit_buffer is used when formatting an audit record.  The caller
 * locks briefly to get the record off the freelist or to allocate the
 * buffer, and locks briefly to send the buffer to the netlink layer or
 * to place it on a transmit queue.  Multiple audit_buffers can be in
 * use simultaneously. */
struct audit_buffer {
	struct list_head     list;
149
	struct sk_buff       *skb;	/* formatted skb ready to send */
L
Linus Torvalds 已提交
150
	struct audit_context *ctx;	/* NULL or associated context */
A
Al Viro 已提交
151
	gfp_t		     gfp_mask;
L
Linus Torvalds 已提交
152 153
};

154 155
static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
{
156 157 158 159
	if (ab) {
		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
		nlh->nlmsg_pid = pid;
	}
160 161
}

162
void audit_panic(const char *message)
L
Linus Torvalds 已提交
163 164 165 166 167 168
{
	switch (audit_failure)
	{
	case AUDIT_FAIL_SILENT:
		break;
	case AUDIT_FAIL_PRINTK:
169 170
		if (printk_ratelimit())
			printk(KERN_ERR "audit: %s\n", message);
L
Linus Torvalds 已提交
171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206
		break;
	case AUDIT_FAIL_PANIC:
		panic("audit: %s\n", message);
		break;
	}
}

static inline int audit_rate_check(void)
{
	static unsigned long	last_check = 0;
	static int		messages   = 0;
	static DEFINE_SPINLOCK(lock);
	unsigned long		flags;
	unsigned long		now;
	unsigned long		elapsed;
	int			retval	   = 0;

	if (!audit_rate_limit) return 1;

	spin_lock_irqsave(&lock, flags);
	if (++messages < audit_rate_limit) {
		retval = 1;
	} else {
		now     = jiffies;
		elapsed = now - last_check;
		if (elapsed > HZ) {
			last_check = now;
			messages   = 0;
			retval     = 1;
		}
	}
	spin_unlock_irqrestore(&lock, flags);

	return retval;
}

207 208 209 210 211 212 213 214
/**
 * audit_log_lost - conditionally log lost audit message event
 * @message: the message stating reason for lost audit message
 *
 * Emit at least 1 message per second, even if audit_rate_check is
 * throttling.
 * Always increment the lost messages counter.
*/
L
Linus Torvalds 已提交
215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237
void audit_log_lost(const char *message)
{
	static unsigned long	last_msg = 0;
	static DEFINE_SPINLOCK(lock);
	unsigned long		flags;
	unsigned long		now;
	int			print;

	atomic_inc(&audit_lost);

	print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);

	if (!print) {
		spin_lock_irqsave(&lock, flags);
		now = jiffies;
		if (now - last_msg > HZ) {
			print = 1;
			last_msg = now;
		}
		spin_unlock_irqrestore(&lock, flags);
	}

	if (print) {
238 239 240 241 242 243 244
		if (printk_ratelimit())
			printk(KERN_WARNING
				"audit: audit_lost=%d audit_rate_limit=%d "
				"audit_backlog_limit=%d\n",
				atomic_read(&audit_lost),
				audit_rate_limit,
				audit_backlog_limit);
L
Linus Torvalds 已提交
245 246 247 248
		audit_panic(message);
	}
}

249 250
static int audit_log_config_change(char *function_name, int new, int old,
				   uid_t loginuid, u32 sid, int allow_changes)
L
Linus Torvalds 已提交
251
{
252 253
	struct audit_buffer *ab;
	int rc = 0;
254

255 256 257
	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
	audit_log_format(ab, "%s=%d old=%d by auid=%u", function_name, new,
			 old, loginuid);
258 259 260
	if (sid) {
		char *ctx = NULL;
		u32 len;
261 262 263 264 265 266 267

		rc = selinux_sid_to_string(sid, &ctx, &len);
		if (rc) {
			audit_log_format(ab, " sid=%u", sid);
			allow_changes = 0; /* Something weird, deny request */
		} else {
			audit_log_format(ab, " subj=%s", ctx);
S
Steve Grubb 已提交
268
			kfree(ctx);
269
		}
S
Steve Grubb 已提交
270
	}
271 272
	audit_log_format(ab, " res=%d", allow_changes);
	audit_log_end(ab);
S
Steve Grubb 已提交
273
	return rc;
L
Linus Torvalds 已提交
274 275
}

276 277
static int audit_do_config_change(char *function_name, int *to_change,
				  int new, uid_t loginuid, u32 sid)
L
Linus Torvalds 已提交
278
{
279
	int allow_changes, rc = 0, old = *to_change;
S
Steve Grubb 已提交
280 281

	/* check if we are locked */
282 283
	if (audit_enabled == AUDIT_LOCKED)
		allow_changes = 0;
S
Steve Grubb 已提交
284
	else
285
		allow_changes = 1;
286

287 288 289 290 291
	if (audit_enabled != AUDIT_OFF) {
		rc = audit_log_config_change(function_name, new, old,
					     loginuid, sid, allow_changes);
		if (rc)
			allow_changes = 0;
S
Steve Grubb 已提交
292 293 294
	}

	/* If we are allowed, make the change */
295 296
	if (allow_changes == 1)
		*to_change = new;
S
Steve Grubb 已提交
297 298 299 300
	/* Not allowed, update reason */
	else if (rc == 0)
		rc = -EPERM;
	return rc;
L
Linus Torvalds 已提交
301 302
}

303
static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sid)
L
Linus Torvalds 已提交
304
{
305 306 307
	return audit_do_config_change("audit_rate_limit", &audit_rate_limit,
				      limit, loginuid, sid);
}
308

309 310 311 312 313
static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid)
{
	return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit,
				      limit, loginuid, sid);
}
S
Steve Grubb 已提交
314

315 316
static int audit_set_enabled(int state, uid_t loginuid, u32 sid)
{
317
	int rc;
318 319
	if (state < AUDIT_OFF || state > AUDIT_LOCKED)
		return -EINVAL;
S
Steve Grubb 已提交
320

321 322 323 324 325 326 327
	rc =  audit_do_config_change("audit_enabled", &audit_enabled, state,
				     loginuid, sid);

	if (!rc)
		audit_ever_enabled |= !!state;

	return rc;
L
Linus Torvalds 已提交
328 329
}

330
static int audit_set_failure(int state, uid_t loginuid, u32 sid)
L
Linus Torvalds 已提交
331 332 333 334 335
{
	if (state != AUDIT_FAIL_SILENT
	    && state != AUDIT_FAIL_PRINTK
	    && state != AUDIT_FAIL_PANIC)
		return -EINVAL;
336

337 338
	return audit_do_config_change("audit_failure", &audit_failure, state,
				      loginuid, sid);
L
Linus Torvalds 已提交
339 340
}

A
Adrian Bunk 已提交
341
static int kauditd_thread(void *dummy)
342 343 344
{
	struct sk_buff *skb;

345
	set_freezable();
A
Andrew Morton 已提交
346
	while (!kthread_should_stop()) {
347
		skb = skb_dequeue(&audit_skb_queue);
348
		wake_up(&audit_backlog_wait);
349 350 351 352 353 354 355 356 357
		if (skb) {
			if (audit_pid) {
				int err = netlink_unicast(audit_sock, skb, audit_pid, 0);
				if (err < 0) {
					BUG_ON(err != -ECONNREFUSED); /* Shoudn't happen */
					printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
					audit_pid = 0;
				}
			} else {
358 359 360 361 362
				if (printk_ratelimit())
					printk(KERN_NOTICE "%s\n", skb->data +
						NLMSG_SPACE(0));
				else
					audit_log_lost("printk limit exceeded\n");
363 364 365 366 367 368 369
				kfree_skb(skb);
			}
		} else {
			DECLARE_WAITQUEUE(wait, current);
			set_current_state(TASK_INTERRUPTIBLE);
			add_wait_queue(&kauditd_wait, &wait);

370 371
			if (!skb_queue_len(&audit_skb_queue)) {
				try_to_freeze();
372
				schedule();
373
			}
374 375 376 377 378

			__set_current_state(TASK_RUNNING);
			remove_wait_queue(&kauditd_wait, &wait);
		}
	}
A
Andrew Morton 已提交
379
	return 0;
380 381
}

M
Miloslav Trmac 已提交
382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406
static int audit_prepare_user_tty(pid_t pid, uid_t loginuid)
{
	struct task_struct *tsk;
	int err;

	read_lock(&tasklist_lock);
	tsk = find_task_by_pid(pid);
	err = -ESRCH;
	if (!tsk)
		goto out;
	err = 0;

	spin_lock_irq(&tsk->sighand->siglock);
	if (!tsk->signal->audit_tty)
		err = -EPERM;
	spin_unlock_irq(&tsk->sighand->siglock);
	if (err)
		goto out;

	tty_audit_push_task(tsk, loginuid);
out:
	read_unlock(&tasklist_lock);
	return err;
}

407 408 409 410 411 412 413
int audit_send_list(void *_dest)
{
	struct audit_netlink_list *dest = _dest;
	int pid = dest->pid;
	struct sk_buff *skb;

	/* wait for parent to finish and send an ACK */
A
Amy Griffis 已提交
414 415
	mutex_lock(&audit_cmd_mutex);
	mutex_unlock(&audit_cmd_mutex);
416 417 418 419 420 421 422 423 424

	while ((skb = __skb_dequeue(&dest->q)) != NULL)
		netlink_unicast(audit_sock, skb, pid, 0);

	kfree(dest);

	return 0;
}

A
Al Viro 已提交
425 426 427 428 429 430 431 432 433 434 435 436 437 438 439
#ifdef CONFIG_AUDIT_TREE
static int prune_tree_thread(void *unused)
{
	mutex_lock(&audit_cmd_mutex);
	audit_prune_trees();
	mutex_unlock(&audit_cmd_mutex);
	return 0;
}

void audit_schedule_prune(void)
{
	kthread_run(prune_tree_thread, NULL, "audit_prune_tree");
}
#endif

440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465
struct sk_buff *audit_make_reply(int pid, int seq, int type, int done,
				 int multi, void *payload, int size)
{
	struct sk_buff	*skb;
	struct nlmsghdr	*nlh;
	int		len = NLMSG_SPACE(size);
	void		*data;
	int		flags = multi ? NLM_F_MULTI : 0;
	int		t     = done  ? NLMSG_DONE  : type;

	skb = alloc_skb(len, GFP_KERNEL);
	if (!skb)
		return NULL;

	nlh		 = NLMSG_PUT(skb, pid, seq, t, size);
	nlh->nlmsg_flags = flags;
	data		 = NLMSG_DATA(nlh);
	memcpy(data, payload, size);
	return skb;

nlmsg_failure:			/* Used by NLMSG_PUT */
	if (skb)
		kfree_skb(skb);
	return NULL;
}

466 467 468 469 470 471 472 473 474 475 476 477 478
/**
 * audit_send_reply - send an audit reply message via netlink
 * @pid: process id to send reply to
 * @seq: sequence number
 * @type: audit message type
 * @done: done (last) flag
 * @multi: multi-part message flag
 * @payload: payload data
 * @size: payload size
 *
 * Allocates an skb, builds the netlink message, and sends it to the pid.
 * No failure notifications.
 */
L
Linus Torvalds 已提交
479 480 481 482
void audit_send_reply(int pid, int seq, int type, int done, int multi,
		      void *payload, int size)
{
	struct sk_buff	*skb;
483
	skb = audit_make_reply(pid, seq, type, done, multi, payload, size);
L
Linus Torvalds 已提交
484
	if (!skb)
485 486 487 488
		return;
	/* Ignore failure. It'll only happen if the sender goes away,
	   because our timeout is set to infinite. */
	netlink_unicast(audit_sock, skb, pid, 0);
L
Linus Torvalds 已提交
489 490 491 492 493 494 495
	return;
}

/*
 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit
 * control messages.
 */
496
static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
L
Linus Torvalds 已提交
497 498 499 500 501 502
{
	int err = 0;

	switch (msg_type) {
	case AUDIT_GET:
	case AUDIT_LIST:
503
	case AUDIT_LIST_RULES:
L
Linus Torvalds 已提交
504 505
	case AUDIT_SET:
	case AUDIT_ADD:
506
	case AUDIT_ADD_RULE:
L
Linus Torvalds 已提交
507
	case AUDIT_DEL:
508
	case AUDIT_DEL_RULE:
509
	case AUDIT_SIGNAL_INFO:
M
Miloslav Trmac 已提交
510 511
	case AUDIT_TTY_GET:
	case AUDIT_TTY_SET:
A
Al Viro 已提交
512 513
	case AUDIT_TRIM:
	case AUDIT_MAKE_EQUIV:
514
		if (security_netlink_recv(skb, CAP_AUDIT_CONTROL))
L
Linus Torvalds 已提交
515 516
			err = -EPERM;
		break;
517
	case AUDIT_USER:
518 519
	case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
	case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
520
		if (security_netlink_recv(skb, CAP_AUDIT_WRITE))
L
Linus Torvalds 已提交
521 522 523 524 525 526 527 528 529
			err = -EPERM;
		break;
	default:  /* bad msg */
		err = -EINVAL;
	}

	return err;
}

530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556
static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
				     u32 pid, u32 uid, uid_t auid, u32 sid)
{
	int rc = 0;
	char *ctx = NULL;
	u32 len;

	if (!audit_enabled) {
		*ab = NULL;
		return rc;
	}

	*ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
	audit_log_format(*ab, "user pid=%d uid=%u auid=%u",
			 pid, uid, auid);
	if (sid) {
		rc = selinux_sid_to_string(sid, &ctx, &len);
		if (rc)
			audit_log_format(*ab, " ssid=%u", sid);
		else
			audit_log_format(*ab, " subj=%s", ctx);
		kfree(ctx);
	}

	return rc;
}

L
Linus Torvalds 已提交
557 558
static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
{
559
	u32			uid, pid, seq, sid;
L
Linus Torvalds 已提交
560 561 562
	void			*data;
	struct audit_status	*status_get, status_set;
	int			err;
563
	struct audit_buffer	*ab;
L
Linus Torvalds 已提交
564
	u16			msg_type = nlh->nlmsg_type;
565
	uid_t			loginuid; /* loginuid of sender */
566
	struct audit_sig_info   *sig_data;
567
	char			*ctx = NULL;
568
	u32			len;
L
Linus Torvalds 已提交
569

570
	err = audit_netlink_ok(skb, msg_type);
L
Linus Torvalds 已提交
571 572 573
	if (err)
		return err;

574 575
	/* As soon as there's any sign of userspace auditd,
	 * start kauditd to talk to it */
576 577 578 579 580 581 582 583
	if (!kauditd_task)
		kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
	if (IS_ERR(kauditd_task)) {
		err = PTR_ERR(kauditd_task);
		kauditd_task = NULL;
		return err;
	}

L
Linus Torvalds 已提交
584 585
	pid  = NETLINK_CREDS(skb)->pid;
	uid  = NETLINK_CREDS(skb)->uid;
586
	loginuid = NETLINK_CB(skb).loginuid;
587
	sid  = NETLINK_CB(skb).sid;
L
Linus Torvalds 已提交
588 589 590 591 592 593 594 595 596 597 598
	seq  = nlh->nlmsg_seq;
	data = NLMSG_DATA(nlh);

	switch (msg_type) {
	case AUDIT_GET:
		status_set.enabled	 = audit_enabled;
		status_set.failure	 = audit_failure;
		status_set.pid		 = audit_pid;
		status_set.rate_limit	 = audit_rate_limit;
		status_set.backlog_limit = audit_backlog_limit;
		status_set.lost		 = atomic_read(&audit_lost);
599
		status_set.backlog	 = skb_queue_len(&audit_skb_queue);
L
Linus Torvalds 已提交
600 601 602 603 604 605 606 607
		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
				 &status_set, sizeof(status_set));
		break;
	case AUDIT_SET:
		if (nlh->nlmsg_len < sizeof(struct audit_status))
			return -EINVAL;
		status_get   = (struct audit_status *)data;
		if (status_get->mask & AUDIT_STATUS_ENABLED) {
608 609
			err = audit_set_enabled(status_get->enabled,
							loginuid, sid);
L
Linus Torvalds 已提交
610 611 612
			if (err < 0) return err;
		}
		if (status_get->mask & AUDIT_STATUS_FAILURE) {
613 614
			err = audit_set_failure(status_get->failure,
							 loginuid, sid);
L
Linus Torvalds 已提交
615 616 617
			if (err < 0) return err;
		}
		if (status_get->mask & AUDIT_STATUS_PID) {
618 619 620 621 622 623 624 625
			int new_pid = status_get->pid;

			if (audit_enabled != AUDIT_OFF)
				audit_log_config_change("audit_pid", new_pid,
							audit_pid, loginuid,
							sid, 1);

			audit_pid = new_pid;
L
Linus Torvalds 已提交
626 627
		}
		if (status_get->mask & AUDIT_STATUS_RATE_LIMIT)
S
Serge E. Hallyn 已提交
628
			err = audit_set_rate_limit(status_get->rate_limit,
629
							 loginuid, sid);
L
Linus Torvalds 已提交
630
		if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT)
S
Serge E. Hallyn 已提交
631
			err = audit_set_backlog_limit(status_get->backlog_limit,
632
							loginuid, sid);
L
Linus Torvalds 已提交
633
		break;
634
	case AUDIT_USER:
635 636
	case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
	case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
637 638 639
		if (!audit_enabled && msg_type != AUDIT_USER_AVC)
			return 0;

640
		err = audit_filter_user(&NETLINK_CB(skb), msg_type);
641 642
		if (err == 1) {
			err = 0;
M
Miloslav Trmac 已提交
643 644 645 646 647
			if (msg_type == AUDIT_USER_TTY) {
				err = audit_prepare_user_tty(pid, loginuid);
				if (err)
					break;
			}
648 649 650 651 652 653 654 655 656 657 658 659 660
			audit_log_common_recv_msg(&ab, msg_type, pid, uid,
						  loginuid, sid);

			if (msg_type != AUDIT_USER_TTY)
				audit_log_format(ab, " msg='%.1024s'",
						 (char *)data);
			else {
				int size;

				audit_log_format(ab, " msg=");
				size = nlmsg_len(nlh);
				audit_log_n_untrustedstring(ab, size,
							    data);
661
			}
662 663
			audit_set_pid(ab, pid);
			audit_log_end(ab);
664
		}
L
Linus Torvalds 已提交
665 666 667
		break;
	case AUDIT_ADD:
	case AUDIT_DEL:
668
		if (nlmsg_len(nlh) < sizeof(struct audit_rule))
L
Linus Torvalds 已提交
669
			return -EINVAL;
670
		if (audit_enabled == AUDIT_LOCKED) {
671 672 673 674 675 676
			audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
						  uid, loginuid, sid);

			audit_log_format(ab, " audit_enabled=%d res=0",
					 audit_enabled);
			audit_log_end(ab);
S
Steve Grubb 已提交
677 678
			return -EPERM;
		}
L
Linus Torvalds 已提交
679 680 681
		/* fallthrough */
	case AUDIT_LIST:
		err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
682
					   uid, seq, data, nlmsg_len(nlh),
683
					   loginuid, sid);
684 685 686 687 688
		break;
	case AUDIT_ADD_RULE:
	case AUDIT_DEL_RULE:
		if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
			return -EINVAL;
689
		if (audit_enabled == AUDIT_LOCKED) {
690 691 692 693 694 695
			audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
						  uid, loginuid, sid);

			audit_log_format(ab, " audit_enabled=%d res=0",
					 audit_enabled);
			audit_log_end(ab);
S
Steve Grubb 已提交
696 697
			return -EPERM;
		}
698 699 700 701
		/* fallthrough */
	case AUDIT_LIST_RULES:
		err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
					   uid, seq, data, nlmsg_len(nlh),
702
					   loginuid, sid);
L
Linus Torvalds 已提交
703
		break;
A
Al Viro 已提交
704 705
	case AUDIT_TRIM:
		audit_trim_trees();
706 707 708 709

		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
					  uid, loginuid, sid);

A
Al Viro 已提交
710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738
		audit_log_format(ab, " op=trim res=1");
		audit_log_end(ab);
		break;
	case AUDIT_MAKE_EQUIV: {
		void *bufp = data;
		u32 sizes[2];
		size_t len = nlmsg_len(nlh);
		char *old, *new;

		err = -EINVAL;
		if (len < 2 * sizeof(u32))
			break;
		memcpy(sizes, bufp, 2 * sizeof(u32));
		bufp += 2 * sizeof(u32);
		len -= 2 * sizeof(u32);
		old = audit_unpack_string(&bufp, &len, sizes[0]);
		if (IS_ERR(old)) {
			err = PTR_ERR(old);
			break;
		}
		new = audit_unpack_string(&bufp, &len, sizes[1]);
		if (IS_ERR(new)) {
			err = PTR_ERR(new);
			kfree(old);
			break;
		}
		/* OK, here comes... */
		err = audit_tag_tree(old, new);

739 740 741
		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
					  uid, loginuid, sid);

A
Al Viro 已提交
742 743 744 745 746 747 748 749 750 751
		audit_log_format(ab, " op=make_equiv old=");
		audit_log_untrustedstring(ab, old);
		audit_log_format(ab, " new=");
		audit_log_untrustedstring(ab, new);
		audit_log_format(ab, " res=%d", !err);
		audit_log_end(ab);
		kfree(old);
		kfree(new);
		break;
	}
752
	case AUDIT_SIGNAL_INFO:
753
		err = selinux_sid_to_string(audit_sig_sid, &ctx, &len);
754 755 756 757 758 759 760 761 762 763 764
		if (err)
			return err;
		sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
		if (!sig_data) {
			kfree(ctx);
			return -ENOMEM;
		}
		sig_data->uid = audit_sig_uid;
		sig_data->pid = audit_sig_pid;
		memcpy(sig_data->ctx, ctx, len);
		kfree(ctx);
D
Daniel Walker 已提交
765
		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO,
766 767
				0, 0, sig_data, sizeof(*sig_data) + len);
		kfree(sig_data);
768
		break;
M
Miloslav Trmac 已提交
769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807
	case AUDIT_TTY_GET: {
		struct audit_tty_status s;
		struct task_struct *tsk;

		read_lock(&tasklist_lock);
		tsk = find_task_by_pid(pid);
		if (!tsk)
			err = -ESRCH;
		else {
			spin_lock_irq(&tsk->sighand->siglock);
			s.enabled = tsk->signal->audit_tty != 0;
			spin_unlock_irq(&tsk->sighand->siglock);
		}
		read_unlock(&tasklist_lock);
		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
				 &s, sizeof(s));
		break;
	}
	case AUDIT_TTY_SET: {
		struct audit_tty_status *s;
		struct task_struct *tsk;

		if (nlh->nlmsg_len < sizeof(struct audit_tty_status))
			return -EINVAL;
		s = data;
		if (s->enabled != 0 && s->enabled != 1)
			return -EINVAL;
		read_lock(&tasklist_lock);
		tsk = find_task_by_pid(pid);
		if (!tsk)
			err = -ESRCH;
		else {
			spin_lock_irq(&tsk->sighand->siglock);
			tsk->signal->audit_tty = s->enabled != 0;
			spin_unlock_irq(&tsk->sighand->siglock);
		}
		read_unlock(&tasklist_lock);
		break;
	}
L
Linus Torvalds 已提交
808 809 810 811 812 813 814 815
	default:
		err = -EINVAL;
		break;
	}

	return err < 0 ? err : 0;
}

816 817
/*
 * Get message from skb (based on rtnetlink_rcv_skb).  Each message is
L
Linus Torvalds 已提交
818
 * processed by audit_receive_msg.  Malformed skbs with wrong length are
819 820
 * discarded silently.
 */
821
static void audit_receive_skb(struct sk_buff *skb)
L
Linus Torvalds 已提交
822 823 824 825 826 827
{
	int		err;
	struct nlmsghdr	*nlh;
	u32		rlen;

	while (skb->len >= NLMSG_SPACE(0)) {
828
		nlh = nlmsg_hdr(skb);
L
Linus Torvalds 已提交
829
		if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
830
			return;
L
Linus Torvalds 已提交
831 832 833 834 835 836 837 838 839 840 841 842
		rlen = NLMSG_ALIGN(nlh->nlmsg_len);
		if (rlen > skb->len)
			rlen = skb->len;
		if ((err = audit_receive_msg(skb, nlh))) {
			netlink_ack(skb, nlh, err);
		} else if (nlh->nlmsg_flags & NLM_F_ACK)
			netlink_ack(skb, nlh, 0);
		skb_pull(skb, rlen);
	}
}

/* Receive messages from netlink socket. */
843
static void audit_receive(struct sk_buff  *skb)
L
Linus Torvalds 已提交
844
{
A
Amy Griffis 已提交
845
	mutex_lock(&audit_cmd_mutex);
846
	audit_receive_skb(skb);
A
Amy Griffis 已提交
847
	mutex_unlock(&audit_cmd_mutex);
L
Linus Torvalds 已提交
848 849
}

A
Amy Griffis 已提交
850 851 852 853 854 855
#ifdef CONFIG_AUDITSYSCALL
static const struct inotify_operations audit_inotify_ops = {
	.handle_event	= audit_handle_ievent,
	.destroy_watch	= audit_free_parent,
};
#endif
L
Linus Torvalds 已提交
856 857 858 859

/* Initialize audit support at boot time. */
static int __init audit_init(void)
{
A
Amy Griffis 已提交
860 861
	int i;

L
Linus Torvalds 已提交
862 863
	printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
	       audit_default ? "enabled" : "disabled");
864 865
	audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, 0,
					   audit_receive, NULL, THIS_MODULE);
L
Linus Torvalds 已提交
866 867
	if (!audit_sock)
		audit_panic("cannot initialize netlink socket");
868 869
	else
		audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
L
Linus Torvalds 已提交
870

871
	skb_queue_head_init(&audit_skb_queue);
L
Linus Torvalds 已提交
872 873
	audit_initialized = 1;
	audit_enabled = audit_default;
874
	audit_ever_enabled |= !!audit_default;
875 876 877 878 879

	/* Register the callback with selinux.  This callback will be invoked
	 * when a new policy is loaded. */
	selinux_audit_set_callback(&selinux_audit_rule_update);

880
	audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
A
Amy Griffis 已提交
881 882 883 884 885

#ifdef CONFIG_AUDITSYSCALL
	audit_ih = inotify_init(&audit_inotify_ops);
	if (IS_ERR(audit_ih))
		audit_panic("cannot initialize inotify handle");
886
#endif
A
Amy Griffis 已提交
887 888 889 890

	for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
		INIT_LIST_HEAD(&audit_inode_hash[i]);

L
Linus Torvalds 已提交
891 892 893 894 895 896 897 898 899 900 901
	return 0;
}
__initcall(audit_init);

/* Process kernel command-line parameter at boot time.  audit=0 or audit=1. */
static int __init audit_enable(char *str)
{
	audit_default = !!simple_strtol(str, NULL, 0);
	printk(KERN_INFO "audit: %s%s\n",
	       audit_default ? "enabled" : "disabled",
	       audit_initialized ? "" : " (after initialization)");
902
	if (audit_initialized) {
L
Linus Torvalds 已提交
903
		audit_enabled = audit_default;
904 905
		audit_ever_enabled |= !!audit_default;
	}
906
	return 1;
L
Linus Torvalds 已提交
907 908 909 910
}

__setup("audit=", audit_enable);

911 912 913 914
static void audit_buffer_free(struct audit_buffer *ab)
{
	unsigned long flags;

915 916 917
	if (!ab)
		return;

918 919
	if (ab->skb)
		kfree_skb(ab->skb);
920

921
	spin_lock_irqsave(&audit_freelist_lock, flags);
S
Serge E. Hallyn 已提交
922
	if (audit_freelist_count > AUDIT_MAXFREE)
923
		kfree(ab);
S
Serge E. Hallyn 已提交
924 925
	else {
		audit_freelist_count++;
926
		list_add(&ab->list, &audit_freelist);
S
Serge E. Hallyn 已提交
927
	}
928 929 930
	spin_unlock_irqrestore(&audit_freelist_lock, flags);
}

931
static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
A
Al Viro 已提交
932
						gfp_t gfp_mask, int type)
933 934 935
{
	unsigned long flags;
	struct audit_buffer *ab = NULL;
936
	struct nlmsghdr *nlh;
937 938 939 940 941 942 943 944 945 946 947

	spin_lock_irqsave(&audit_freelist_lock, flags);
	if (!list_empty(&audit_freelist)) {
		ab = list_entry(audit_freelist.next,
				struct audit_buffer, list);
		list_del(&ab->list);
		--audit_freelist_count;
	}
	spin_unlock_irqrestore(&audit_freelist_lock, flags);

	if (!ab) {
948
		ab = kmalloc(sizeof(*ab), gfp_mask);
949
		if (!ab)
950
			goto err;
951
	}
952

953
	ab->skb = alloc_skb(AUDIT_BUFSIZ, gfp_mask);
954
	if (!ab->skb)
955 956
		goto err;

957
	ab->ctx = ctx;
958
	ab->gfp_mask = gfp_mask;
959 960 961 962 963
	nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0));
	nlh->nlmsg_type = type;
	nlh->nlmsg_flags = 0;
	nlh->nlmsg_pid = 0;
	nlh->nlmsg_seq = 0;
964
	return ab;
965 966 967
err:
	audit_buffer_free(ab);
	return NULL;
968
}
L
Linus Torvalds 已提交
969

970 971 972 973
/**
 * audit_serial - compute a serial number for the audit record
 *
 * Compute a serial number for the audit record.  Audit records are
974 975 976 977 978 979 980 981 982 983 984
 * written to user-space as soon as they are generated, so a complete
 * audit record may be written in several pieces.  The timestamp of the
 * record and this serial number are used by the user-space tools to
 * determine which pieces belong to the same audit record.  The
 * (timestamp,serial) tuple is unique for each syscall and is live from
 * syscall entry to syscall exit.
 *
 * NOTE: Another possibility is to store the formatted records off the
 * audit context (for those records that have a context), and emit them
 * all at syscall exit.  However, this could delay the reporting of
 * significant errors until syscall exit (or never, if the system
985 986
 * halts).
 */
987 988
unsigned int audit_serial(void)
{
I
Ingo Molnar 已提交
989
	static DEFINE_SPINLOCK(serial_lock);
990 991 992 993
	static unsigned int serial = 0;

	unsigned long flags;
	unsigned int ret;
994

995
	spin_lock_irqsave(&serial_lock, flags);
996
	do {
997 998
		ret = ++serial;
	} while (unlikely(!ret));
999
	spin_unlock_irqrestore(&serial_lock, flags);
1000

1001
	return ret;
1002 1003
}

D
Daniel Walker 已提交
1004
static inline void audit_get_stamp(struct audit_context *ctx,
1005 1006 1007 1008 1009 1010 1011 1012 1013 1014
				   struct timespec *t, unsigned int *serial)
{
	if (ctx)
		auditsc_get_stamp(ctx, t, serial);
	else {
		*t = CURRENT_TIME;
		*serial = audit_serial();
	}
}

L
Linus Torvalds 已提交
1015 1016 1017 1018 1019 1020
/* Obtain an audit buffer.  This routine does locking to obtain the
 * audit buffer, but then no locking is required for calls to
 * audit_log_*format.  If the tsk is a task that is currently in a
 * syscall, then the syscall is marked as auditable and an audit record
 * will be written at syscall exit.  If there is no associated task, tsk
 * should be NULL. */
1021

1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036
/**
 * audit_log_start - obtain an audit buffer
 * @ctx: audit_context (may be NULL)
 * @gfp_mask: type of allocation
 * @type: audit message type
 *
 * Returns audit_buffer pointer on success or NULL on error.
 *
 * Obtain an audit buffer.  This routine does locking to obtain the
 * audit buffer, but then no locking is required for calls to
 * audit_log_*format.  If the task (ctx) is a task that is currently in a
 * syscall, then the syscall is marked as auditable and an audit record
 * will be written at syscall exit.  If there is no associated task, then
 * task context (ctx) should be NULL.
 */
A
Al Viro 已提交
1037
struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
1038
				     int type)
L
Linus Torvalds 已提交
1039 1040 1041
{
	struct audit_buffer	*ab	= NULL;
	struct timespec		t;
1042
	unsigned int		uninitialized_var(serial);
1043
	int reserve;
1044
	unsigned long timeout_start = jiffies;
L
Linus Torvalds 已提交
1045 1046 1047 1048

	if (!audit_initialized)
		return NULL;

1049 1050 1051
	if (unlikely(audit_filter_type(type)))
		return NULL;

1052 1053 1054
	if (gfp_mask & __GFP_WAIT)
		reserve = 0;
	else
D
Daniel Walker 已提交
1055
		reserve = 5; /* Allow atomic callers to go up to five
1056 1057 1058 1059
				entries over the normal backlog limit */

	while (audit_backlog_limit
	       && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
1060 1061 1062
		if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time
		    && time_before(jiffies, timeout_start + audit_backlog_wait_time)) {

1063 1064 1065 1066 1067 1068 1069
			/* Wait for auditd to drain the queue a little */
			DECLARE_WAITQUEUE(wait, current);
			set_current_state(TASK_INTERRUPTIBLE);
			add_wait_queue(&audit_backlog_wait, &wait);

			if (audit_backlog_limit &&
			    skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
1070
				schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies);
1071 1072 1073

			__set_current_state(TASK_RUNNING);
			remove_wait_queue(&audit_backlog_wait, &wait);
1074
			continue;
1075
		}
1076
		if (audit_rate_check() && printk_ratelimit())
1077 1078 1079 1080 1081 1082
			printk(KERN_WARNING
			       "audit: audit_backlog=%d > "
			       "audit_backlog_limit=%d\n",
			       skb_queue_len(&audit_skb_queue),
			       audit_backlog_limit);
		audit_log_lost("backlog limit exceeded");
1083 1084
		audit_backlog_wait_time = audit_backlog_wait_overflow;
		wake_up(&audit_backlog_wait);
1085 1086 1087
		return NULL;
	}

1088
	ab = audit_buffer_alloc(ctx, gfp_mask, type);
L
Linus Torvalds 已提交
1089 1090 1091 1092 1093
	if (!ab) {
		audit_log_lost("out of memory in audit_log_start");
		return NULL;
	}

1094
	audit_get_stamp(ab->ctx, &t, &serial);
1095

L
Linus Torvalds 已提交
1096 1097 1098 1099 1100
	audit_log_format(ab, "audit(%lu.%03lu:%u): ",
			 t.tv_sec, t.tv_nsec/1000000, serial);
	return ab;
}

1101
/**
1102
 * audit_expand - expand skb in the audit buffer
1103
 * @ab: audit_buffer
1104
 * @extra: space to add at tail of the skb
1105 1106 1107 1108
 *
 * Returns 0 (no space) on failed expansion, or available space if
 * successful.
 */
1109
static inline int audit_expand(struct audit_buffer *ab, int extra)
1110
{
1111
	struct sk_buff *skb = ab->skb;
1112 1113 1114 1115
	int oldtail = skb_tailroom(skb);
	int ret = pskb_expand_head(skb, 0, extra, ab->gfp_mask);
	int newtail = skb_tailroom(skb);

1116 1117
	if (ret < 0) {
		audit_log_lost("out of memory in audit_expand");
1118
		return 0;
1119
	}
1120 1121 1122

	skb->truesize += newtail - oldtail;
	return newtail;
1123
}
L
Linus Torvalds 已提交
1124

1125 1126
/*
 * Format an audit message into the audit buffer.  If there isn't enough
L
Linus Torvalds 已提交
1127 1128
 * room in the audit buffer, more room will be allocated and vsnprint
 * will be called a second time.  Currently, we assume that a printk
1129 1130
 * can't format message larger than 1024 bytes, so we don't either.
 */
L
Linus Torvalds 已提交
1131 1132 1133 1134
static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
			      va_list args)
{
	int len, avail;
1135
	struct sk_buff *skb;
D
David Woodhouse 已提交
1136
	va_list args2;
L
Linus Torvalds 已提交
1137 1138 1139 1140

	if (!ab)
		return;

1141 1142 1143 1144
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	if (avail == 0) {
1145
		avail = audit_expand(ab, AUDIT_BUFSIZ);
1146 1147
		if (!avail)
			goto out;
L
Linus Torvalds 已提交
1148
	}
D
David Woodhouse 已提交
1149
	va_copy(args2, args);
1150
	len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args);
L
Linus Torvalds 已提交
1151 1152 1153 1154
	if (len >= avail) {
		/* The printk buffer is 1024 bytes long, so if we get
		 * here and AUDIT_BUFSIZ is at least 1024, then we can
		 * log everything that printk could have logged. */
1155 1156
		avail = audit_expand(ab,
			max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
1157 1158
		if (!avail)
			goto out;
1159
		len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
L
Linus Torvalds 已提交
1160
	}
1161
	va_end(args2);
1162 1163
	if (len > 0)
		skb_put(skb, len);
1164 1165
out:
	return;
L
Linus Torvalds 已提交
1166 1167
}

1168 1169 1170 1171 1172 1173 1174 1175
/**
 * audit_log_format - format a message into the audit buffer.
 * @ab: audit_buffer
 * @fmt: format string
 * @...: optional parameters matching @fmt string
 *
 * All the work is done in audit_log_vformat.
 */
L
Linus Torvalds 已提交
1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186
void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
{
	va_list args;

	if (!ab)
		return;
	va_start(args, fmt);
	audit_log_vformat(ab, fmt, args);
	va_end(args);
}

1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198
/**
 * audit_log_hex - convert a buffer to hex and append it to the audit skb
 * @ab: the audit_buffer
 * @buf: buffer to convert to hex
 * @len: length of @buf to be converted
 *
 * No return value; failure to expand is silently ignored.
 *
 * This function will take the passed buf and convert it into a string of
 * ascii hex digits. The new string is placed onto the skb.
 */
void audit_log_hex(struct audit_buffer *ab, const unsigned char *buf,
1199
		size_t len)
1200
{
1201 1202 1203 1204 1205
	int i, avail, new_len;
	unsigned char *ptr;
	struct sk_buff *skb;
	static const unsigned char *hex = "0123456789ABCDEF";

A
Amy Griffis 已提交
1206 1207 1208
	if (!ab)
		return;

1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	new_len = len<<1;
	if (new_len >= avail) {
		/* Round the buffer request up to the next multiple */
		new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
		avail = audit_expand(ab, new_len);
		if (!avail)
			return;
	}
1220

1221
	ptr = skb_tail_pointer(skb);
1222 1223 1224 1225 1226 1227
	for (i=0; i<len; i++) {
		*ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */
		*ptr++ = hex[buf[i] & 0x0F];	  /* Lower nibble */
	}
	*ptr = 0;
	skb_put(skb, len << 1); /* new string is twice the old string */
1228 1229
}

1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240
/*
 * Format a string of no more than slen characters into the audit buffer,
 * enclosed in quote marks.
 */
static void audit_log_n_string(struct audit_buffer *ab, size_t slen,
			       const char *string)
{
	int avail, new_len;
	unsigned char *ptr;
	struct sk_buff *skb;

A
Amy Griffis 已提交
1241 1242 1243
	if (!ab)
		return;

1244 1245 1246 1247 1248 1249 1250 1251 1252
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	new_len = slen + 3;	/* enclosing quotes + null terminator */
	if (new_len > avail) {
		avail = audit_expand(ab, new_len);
		if (!avail)
			return;
	}
1253
	ptr = skb_tail_pointer(skb);
1254 1255 1256 1257 1258 1259 1260 1261
	*ptr++ = '"';
	memcpy(ptr, string, slen);
	ptr += slen;
	*ptr++ = '"';
	*ptr = 0;
	skb_put(skb, slen + 2);	/* don't include null terminator */
}

1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276
/**
 * audit_string_contains_control - does a string need to be logged in hex
 * @string - string to be checked
 * @len - max length of the string to check
 */
int audit_string_contains_control(const char *string, size_t len)
{
	const unsigned char *p;
	for (p = string; p < (const unsigned char *)string + len && *p; p++) {
		if (*p == '"' || *p < 0x21 || *p > 0x7f)
			return 1;
	}
	return 0;
}

1277
/**
M
Miloslav Trmac 已提交
1278
 * audit_log_n_untrustedstring - log a string that may contain random characters
1279
 * @ab: audit_buffer
1280
 * @len: lenth of string (not including trailing null)
1281 1282 1283 1284
 * @string: string to be logged
 *
 * This code will escape a string that is passed to it if the string
 * contains a control character, unprintable character, double quote mark,
1285
 * or a space. Unescaped strings will start and end with a double quote mark.
1286
 * Strings that are escaped are printed in hex (2 digits per char).
1287 1288 1289
 *
 * The caller specifies the number of characters in the string to log, which may
 * or may not be the entire string.
1290
 */
1291 1292
void audit_log_n_untrustedstring(struct audit_buffer *ab, size_t len,
				 const char *string)
1293
{
1294 1295 1296 1297
	if (audit_string_contains_control(string, len))
		audit_log_hex(ab, string, len);
	else
		audit_log_n_string(ab, len, string);
1298 1299
}

1300
/**
M
Miloslav Trmac 已提交
1301
 * audit_log_untrustedstring - log a string that may contain random characters
1302 1303 1304
 * @ab: audit_buffer
 * @string: string to be logged
 *
M
Miloslav Trmac 已提交
1305
 * Same as audit_log_n_untrustedstring(), except that strlen is used to
1306 1307
 * determine string length.
 */
1308
void audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
1309
{
1310
	audit_log_n_untrustedstring(ab, strlen(string), string);
1311 1312
}

1313
/* This is a helper-function to print the escaped d_path */
L
Linus Torvalds 已提交
1314 1315 1316
void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
		      struct dentry *dentry, struct vfsmount *vfsmnt)
{
1317
	char *p, *path;
L
Linus Torvalds 已提交
1318

1319 1320
	if (prefix)
		audit_log_format(ab, " %s", prefix);
L
Linus Torvalds 已提交
1321

1322
	/* We will allow 11 spaces for ' (deleted)' to be appended */
1323
	path = kmalloc(PATH_MAX+11, ab->gfp_mask);
1324 1325 1326
	if (!path) {
		audit_log_format(ab, "<no memory>");
		return;
L
Linus Torvalds 已提交
1327
	}
1328 1329 1330 1331
	p = d_path(dentry, vfsmnt, path, PATH_MAX+11);
	if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */
		/* FIXME: can we save some information here? */
		audit_log_format(ab, "<too long>");
D
Daniel Walker 已提交
1332
	} else
1333 1334
		audit_log_untrustedstring(ab, p);
	kfree(path);
L
Linus Torvalds 已提交
1335 1336
}

1337 1338 1339 1340 1341 1342
/**
 * audit_log_end - end one audit record
 * @ab: the audit_buffer
 *
 * The netlink_* functions cannot be called inside an irq context, so
 * the audit buffer is placed on a queue and a tasklet is scheduled to
L
Linus Torvalds 已提交
1343
 * remove them from the queue outside the irq context.  May be called in
1344 1345
 * any context.
 */
1346
void audit_log_end(struct audit_buffer *ab)
L
Linus Torvalds 已提交
1347 1348 1349 1350 1351 1352
{
	if (!ab)
		return;
	if (!audit_rate_check()) {
		audit_log_lost("rate limit exceeded");
	} else {
1353
		if (audit_pid) {
1354
			struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
1355 1356 1357 1358
			nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0);
			skb_queue_tail(&audit_skb_queue, ab->skb);
			ab->skb = NULL;
			wake_up_interruptible(&kauditd_wait);
1359
		} else if (printk_ratelimit()) {
1360 1361
			struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
			printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, ab->skb->data + NLMSG_SPACE(0));
1362 1363
		} else {
			audit_log_lost("printk limit exceeded\n");
1364
		}
L
Linus Torvalds 已提交
1365
	}
1366
	audit_buffer_free(ab);
L
Linus Torvalds 已提交
1367 1368
}

1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380
/**
 * audit_log - Log an audit record
 * @ctx: audit context
 * @gfp_mask: type of allocation
 * @type: audit message type
 * @fmt: format string to use
 * @...: variable parameters matching the format string
 *
 * This is a convenience function that calls audit_log_start,
 * audit_log_vformat, and audit_log_end.  It may be called
 * in any context.
 */
D
Daniel Walker 已提交
1381
void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
1382
	       const char *fmt, ...)
L
Linus Torvalds 已提交
1383 1384 1385 1386
{
	struct audit_buffer *ab;
	va_list args;

1387
	ab = audit_log_start(ctx, gfp_mask, type);
L
Linus Torvalds 已提交
1388 1389 1390 1391 1392 1393 1394
	if (ab) {
		va_start(args, fmt);
		audit_log_vformat(ab, fmt, args);
		va_end(args);
		audit_log_end(ab);
	}
}
1395 1396 1397 1398 1399

EXPORT_SYMBOL(audit_log_start);
EXPORT_SYMBOL(audit_log_end);
EXPORT_SYMBOL(audit_log_format);
EXPORT_SYMBOL(audit_log);