audit.c 39.8 KB
Newer Older
1
/* audit.c -- Auditing support
L
Linus Torvalds 已提交
2 3 4
 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon.
 * System-call specific features have moved to auditsc.c
 *
S
Steve Grubb 已提交
5
 * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina.
L
Linus Torvalds 已提交
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
 * All Rights Reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
 *
24
 * Goals: 1) Integrate fully with Security Modules.
L
Linus Torvalds 已提交
25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40
 *	  2) Minimal run-time overhead:
 *	     a) Minimal when syscall auditing is disabled (audit_enable=0).
 *	     b) Small when syscall auditing is enabled and no audit record
 *		is generated (defer as much work as possible to record
 *		generation time):
 *		i) context is allocated,
 *		ii) names from getname are stored without a copy, and
 *		iii) inode information stored from path_lookup.
 *	  3) Ability to disable syscall auditing at boot time (audit=0).
 *	  4) Usable by other parts of the kernel (if audit_log* is called,
 *	     then a syscall record will be generated automatically for the
 *	     current syscall).
 *	  5) Netlink interface to user-space.
 *	  6) Support low-overhead kernel-based filtering to minimize the
 *	     information that must be passed to user-space.
 *
41
 * Example user-space utilities: http://people.redhat.com/sgrubb/audit/
L
Linus Torvalds 已提交
42 43 44 45
 */

#include <linux/init.h>
#include <asm/types.h>
A
Alan Cox 已提交
46
#include <asm/atomic.h>
L
Linus Torvalds 已提交
47 48
#include <linux/mm.h>
#include <linux/module.h>
49 50
#include <linux/err.h>
#include <linux/kthread.h>
L
Linus Torvalds 已提交
51 52 53 54

#include <linux/audit.h>

#include <net/sock.h>
55
#include <net/netlink.h>
L
Linus Torvalds 已提交
56 57
#include <linux/skbuff.h>
#include <linux/netlink.h>
A
Amy Griffis 已提交
58
#include <linux/inotify.h>
59
#include <linux/freezer.h>
M
Miloslav Trmac 已提交
60
#include <linux/tty.h>
61 62

#include "audit.h"
L
Linus Torvalds 已提交
63

64
/* No auditing will take place until audit_initialized == AUDIT_INITIALIZED.
L
Linus Torvalds 已提交
65
 * (Initialization happens after skb_init is called.) */
66 67 68
#define AUDIT_DISABLED		-1
#define AUDIT_UNINITIALIZED	0
#define AUDIT_INITIALIZED	1
L
Linus Torvalds 已提交
69 70
static int	audit_initialized;

71 72 73
#define AUDIT_OFF	0
#define AUDIT_ON	1
#define AUDIT_LOCKED	2
L
Linus Torvalds 已提交
74
int		audit_enabled;
75
int		audit_ever_enabled;
L
Linus Torvalds 已提交
76 77 78 79 80 81 82

/* Default state when kernel boots without any parameters. */
static int	audit_default;

/* If auditing cannot proceed, audit_failure selects what happens. */
static int	audit_failure = AUDIT_FAIL_PRINTK;

83 84 85 86 87
/*
 * If audit records are to be written to the netlink socket, audit_pid
 * contains the pid of the auditd process and audit_nlk_pid contains
 * the pid to use to send netlink messages to that process.
 */
88
int		audit_pid;
89
static int	audit_nlk_pid;
L
Linus Torvalds 已提交
90

91
/* If audit_rate_limit is non-zero, limit the rate of sending audit records
L
Linus Torvalds 已提交
92 93 94 95 96 97
 * to that number per second.  This prevents DoS attacks, but results in
 * audit records being dropped. */
static int	audit_rate_limit;

/* Number of outstanding audit_buffers allowed. */
static int	audit_backlog_limit = 64;
98 99
static int	audit_backlog_wait_time = 60 * HZ;
static int	audit_backlog_wait_overflow = 0;
L
Linus Torvalds 已提交
100

101 102 103
/* The identity of the user shutting down the audit system. */
uid_t		audit_sig_uid = -1;
pid_t		audit_sig_pid = -1;
104
u32		audit_sig_sid = 0;
105

L
Linus Torvalds 已提交
106 107 108 109 110 111 112 113 114 115 116 117
/* Records can be lost in several ways:
   0) [suppressed in audit_alloc]
   1) out of memory in audit_log_start [kmalloc of struct audit_buffer]
   2) out of memory in audit_log_move [alloc_skb]
   3) suppressed due to audit_rate_limit
   4) suppressed due to audit_backlog_limit
*/
static atomic_t    audit_lost = ATOMIC_INIT(0);

/* The netlink socket. */
static struct sock *audit_sock;

A
Amy Griffis 已提交
118 119 120 121 122 123
/* Inotify handle. */
struct inotify_handle *audit_ih;

/* Hash for inode-based rules */
struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];

124
/* The audit_freelist is a list of pre-allocated audit buffers (if more
L
Linus Torvalds 已提交
125 126 127
 * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of
 * being placed on the freelist). */
static DEFINE_SPINLOCK(audit_freelist_lock);
128
static int	   audit_freelist_count;
L
Linus Torvalds 已提交
129 130
static LIST_HEAD(audit_freelist);

131
static struct sk_buff_head audit_skb_queue;
132 133
/* queue of skbs to send to auditd when/if it comes back */
static struct sk_buff_head audit_skb_hold_queue;
134 135
static struct task_struct *kauditd_task;
static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
136
static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
L
Linus Torvalds 已提交
137

A
Amy Griffis 已提交
138 139
/* Serialize requests from userspace. */
static DEFINE_MUTEX(audit_cmd_mutex);
L
Linus Torvalds 已提交
140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156

/* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
 * audit records.  Since printk uses a 1024 byte buffer, this buffer
 * should be at least that large. */
#define AUDIT_BUFSIZ 1024

/* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the
 * audit_freelist.  Doing so eliminates many kmalloc/kfree calls. */
#define AUDIT_MAXFREE  (2*NR_CPUS)

/* The audit_buffer is used when formatting an audit record.  The caller
 * locks briefly to get the record off the freelist or to allocate the
 * buffer, and locks briefly to send the buffer to the netlink layer or
 * to place it on a transmit queue.  Multiple audit_buffers can be in
 * use simultaneously. */
struct audit_buffer {
	struct list_head     list;
157
	struct sk_buff       *skb;	/* formatted skb ready to send */
L
Linus Torvalds 已提交
158
	struct audit_context *ctx;	/* NULL or associated context */
A
Al Viro 已提交
159
	gfp_t		     gfp_mask;
L
Linus Torvalds 已提交
160 161
};

162 163 164 165 166
struct audit_reply {
	int pid;
	struct sk_buff *skb;
};

167 168
static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
{
169 170 171 172
	if (ab) {
		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
		nlh->nlmsg_pid = pid;
	}
173 174
}

175
void audit_panic(const char *message)
L
Linus Torvalds 已提交
176 177 178 179 180 181
{
	switch (audit_failure)
	{
	case AUDIT_FAIL_SILENT:
		break;
	case AUDIT_FAIL_PRINTK:
182 183
		if (printk_ratelimit())
			printk(KERN_ERR "audit: %s\n", message);
L
Linus Torvalds 已提交
184 185
		break;
	case AUDIT_FAIL_PANIC:
186 187 188
		/* test audit_pid since printk is always losey, why bother? */
		if (audit_pid)
			panic("audit: %s\n", message);
L
Linus Torvalds 已提交
189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221
		break;
	}
}

static inline int audit_rate_check(void)
{
	static unsigned long	last_check = 0;
	static int		messages   = 0;
	static DEFINE_SPINLOCK(lock);
	unsigned long		flags;
	unsigned long		now;
	unsigned long		elapsed;
	int			retval	   = 0;

	if (!audit_rate_limit) return 1;

	spin_lock_irqsave(&lock, flags);
	if (++messages < audit_rate_limit) {
		retval = 1;
	} else {
		now     = jiffies;
		elapsed = now - last_check;
		if (elapsed > HZ) {
			last_check = now;
			messages   = 0;
			retval     = 1;
		}
	}
	spin_unlock_irqrestore(&lock, flags);

	return retval;
}

222 223 224 225 226 227 228 229
/**
 * audit_log_lost - conditionally log lost audit message event
 * @message: the message stating reason for lost audit message
 *
 * Emit at least 1 message per second, even if audit_rate_check is
 * throttling.
 * Always increment the lost messages counter.
*/
L
Linus Torvalds 已提交
230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252
void audit_log_lost(const char *message)
{
	static unsigned long	last_msg = 0;
	static DEFINE_SPINLOCK(lock);
	unsigned long		flags;
	unsigned long		now;
	int			print;

	atomic_inc(&audit_lost);

	print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);

	if (!print) {
		spin_lock_irqsave(&lock, flags);
		now = jiffies;
		if (now - last_msg > HZ) {
			print = 1;
			last_msg = now;
		}
		spin_unlock_irqrestore(&lock, flags);
	}

	if (print) {
253 254 255 256 257 258 259
		if (printk_ratelimit())
			printk(KERN_WARNING
				"audit: audit_lost=%d audit_rate_limit=%d "
				"audit_backlog_limit=%d\n",
				atomic_read(&audit_lost),
				audit_rate_limit,
				audit_backlog_limit);
L
Linus Torvalds 已提交
260 261 262 263
		audit_panic(message);
	}
}

264
static int audit_log_config_change(char *function_name, int new, int old,
265 266
				   uid_t loginuid, u32 sessionid, u32 sid,
				   int allow_changes)
L
Linus Torvalds 已提交
267
{
268 269
	struct audit_buffer *ab;
	int rc = 0;
270

271
	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
272 273
	audit_log_format(ab, "%s=%d old=%d auid=%u ses=%u", function_name, new,
			 old, loginuid, sessionid);
274 275 276
	if (sid) {
		char *ctx = NULL;
		u32 len;
277

278
		rc = security_secid_to_secctx(sid, &ctx, &len);
279 280 281 282 283
		if (rc) {
			audit_log_format(ab, " sid=%u", sid);
			allow_changes = 0; /* Something weird, deny request */
		} else {
			audit_log_format(ab, " subj=%s", ctx);
284
			security_release_secctx(ctx, len);
285
		}
S
Steve Grubb 已提交
286
	}
287 288
	audit_log_format(ab, " res=%d", allow_changes);
	audit_log_end(ab);
S
Steve Grubb 已提交
289
	return rc;
L
Linus Torvalds 已提交
290 291
}

292
static int audit_do_config_change(char *function_name, int *to_change,
293 294
				  int new, uid_t loginuid, u32 sessionid,
				  u32 sid)
L
Linus Torvalds 已提交
295
{
296
	int allow_changes, rc = 0, old = *to_change;
S
Steve Grubb 已提交
297 298

	/* check if we are locked */
299 300
	if (audit_enabled == AUDIT_LOCKED)
		allow_changes = 0;
S
Steve Grubb 已提交
301
	else
302
		allow_changes = 1;
303

304
	if (audit_enabled != AUDIT_OFF) {
305 306
		rc = audit_log_config_change(function_name, new, old, loginuid,
					     sessionid, sid, allow_changes);
307 308
		if (rc)
			allow_changes = 0;
S
Steve Grubb 已提交
309 310 311
	}

	/* If we are allowed, make the change */
312 313
	if (allow_changes == 1)
		*to_change = new;
S
Steve Grubb 已提交
314 315 316 317
	/* Not allowed, update reason */
	else if (rc == 0)
		rc = -EPERM;
	return rc;
L
Linus Torvalds 已提交
318 319
}

320 321
static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sessionid,
				u32 sid)
L
Linus Torvalds 已提交
322
{
323
	return audit_do_config_change("audit_rate_limit", &audit_rate_limit,
324
				      limit, loginuid, sessionid, sid);
325
}
326

327 328
static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sessionid,
				   u32 sid)
329 330
{
	return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit,
331
				      limit, loginuid, sessionid, sid);
332
}
S
Steve Grubb 已提交
333

334
static int audit_set_enabled(int state, uid_t loginuid, u32 sessionid, u32 sid)
335
{
336
	int rc;
337 338
	if (state < AUDIT_OFF || state > AUDIT_LOCKED)
		return -EINVAL;
S
Steve Grubb 已提交
339

340
	rc =  audit_do_config_change("audit_enabled", &audit_enabled, state,
341
				     loginuid, sessionid, sid);
342 343 344 345 346

	if (!rc)
		audit_ever_enabled |= !!state;

	return rc;
L
Linus Torvalds 已提交
347 348
}

349
static int audit_set_failure(int state, uid_t loginuid, u32 sessionid, u32 sid)
L
Linus Torvalds 已提交
350 351 352 353 354
{
	if (state != AUDIT_FAIL_SILENT
	    && state != AUDIT_FAIL_PRINTK
	    && state != AUDIT_FAIL_PANIC)
		return -EINVAL;
355

356
	return audit_do_config_change("audit_failure", &audit_failure, state,
357
				      loginuid, sessionid, sid);
L
Linus Torvalds 已提交
358 359
}

360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395
/*
 * Queue skbs to be sent to auditd when/if it comes back.  These skbs should
 * already have been sent via prink/syslog and so if these messages are dropped
 * it is not a huge concern since we already passed the audit_log_lost()
 * notification and stuff.  This is just nice to get audit messages during
 * boot before auditd is running or messages generated while auditd is stopped.
 * This only holds messages is audit_default is set, aka booting with audit=1
 * or building your kernel that way.
 */
static void audit_hold_skb(struct sk_buff *skb)
{
	if (audit_default &&
	    skb_queue_len(&audit_skb_hold_queue) < audit_backlog_limit)
		skb_queue_tail(&audit_skb_hold_queue, skb);
	else
		kfree_skb(skb);
}

static void kauditd_send_skb(struct sk_buff *skb)
{
	int err;
	/* take a reference in case we can't send it and we want to hold it */
	skb_get(skb);
	err = netlink_unicast(audit_sock, skb, audit_nlk_pid, 0);
	if (err < 0) {
		BUG_ON(err != -ECONNREFUSED); /* Shoudn't happen */
		printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
		audit_log_lost("auditd dissapeared\n");
		audit_pid = 0;
		/* we might get lucky and get this in the next auditd */
		audit_hold_skb(skb);
	} else
		/* drop the extra reference if sent ok */
		kfree_skb(skb);
}

A
Adrian Bunk 已提交
396
static int kauditd_thread(void *dummy)
397 398 399
{
	struct sk_buff *skb;

400
	set_freezable();
A
Andrew Morton 已提交
401
	while (!kthread_should_stop()) {
402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424
		/*
		 * if auditd just started drain the queue of messages already
		 * sent to syslog/printk.  remember loss here is ok.  we already
		 * called audit_log_lost() if it didn't go out normally.  so the
		 * race between the skb_dequeue and the next check for audit_pid
		 * doesn't matter.
		 *
		 * if you ever find kauditd to be too slow we can get a perf win
		 * by doing our own locking and keeping better track if there
		 * are messages in this queue.  I don't see the need now, but
		 * in 5 years when I want to play with this again I'll see this
		 * note and still have no friggin idea what i'm thinking today.
		 */
		if (audit_default && audit_pid) {
			skb = skb_dequeue(&audit_skb_hold_queue);
			if (unlikely(skb)) {
				while (skb && audit_pid) {
					kauditd_send_skb(skb);
					skb = skb_dequeue(&audit_skb_hold_queue);
				}
			}
		}

425
		skb = skb_dequeue(&audit_skb_queue);
426
		wake_up(&audit_backlog_wait);
427
		if (skb) {
428 429 430
			if (audit_pid)
				kauditd_send_skb(skb);
			else {
431
				if (printk_ratelimit())
432
					printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0));
433 434
				else
					audit_log_lost("printk limit exceeded\n");
435 436

				audit_hold_skb(skb);
437 438 439 440 441 442
			}
		} else {
			DECLARE_WAITQUEUE(wait, current);
			set_current_state(TASK_INTERRUPTIBLE);
			add_wait_queue(&kauditd_wait, &wait);

443 444
			if (!skb_queue_len(&audit_skb_queue)) {
				try_to_freeze();
445
				schedule();
446
			}
447 448 449 450 451

			__set_current_state(TASK_RUNNING);
			remove_wait_queue(&kauditd_wait, &wait);
		}
	}
A
Andrew Morton 已提交
452
	return 0;
453 454
}

455
static int audit_prepare_user_tty(pid_t pid, uid_t loginuid, u32 sessionid)
M
Miloslav Trmac 已提交
456 457 458 459 460
{
	struct task_struct *tsk;
	int err;

	read_lock(&tasklist_lock);
461
	tsk = find_task_by_vpid(pid);
M
Miloslav Trmac 已提交
462 463 464 465 466 467 468 469 470 471 472 473
	err = -ESRCH;
	if (!tsk)
		goto out;
	err = 0;

	spin_lock_irq(&tsk->sighand->siglock);
	if (!tsk->signal->audit_tty)
		err = -EPERM;
	spin_unlock_irq(&tsk->sighand->siglock);
	if (err)
		goto out;

474
	tty_audit_push_task(tsk, loginuid, sessionid);
M
Miloslav Trmac 已提交
475 476 477 478 479
out:
	read_unlock(&tasklist_lock);
	return err;
}

480 481 482 483 484 485 486
int audit_send_list(void *_dest)
{
	struct audit_netlink_list *dest = _dest;
	int pid = dest->pid;
	struct sk_buff *skb;

	/* wait for parent to finish and send an ACK */
A
Amy Griffis 已提交
487 488
	mutex_lock(&audit_cmd_mutex);
	mutex_unlock(&audit_cmd_mutex);
489 490 491 492 493 494 495 496 497

	while ((skb = __skb_dequeue(&dest->q)) != NULL)
		netlink_unicast(audit_sock, skb, pid, 0);

	kfree(dest);

	return 0;
}

A
Al Viro 已提交
498 499 500 501 502 503 504 505 506 507 508 509 510 511 512
#ifdef CONFIG_AUDIT_TREE
static int prune_tree_thread(void *unused)
{
	mutex_lock(&audit_cmd_mutex);
	audit_prune_trees();
	mutex_unlock(&audit_cmd_mutex);
	return 0;
}

void audit_schedule_prune(void)
{
	kthread_run(prune_tree_thread, NULL, "audit_prune_tree");
}
#endif

513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538
struct sk_buff *audit_make_reply(int pid, int seq, int type, int done,
				 int multi, void *payload, int size)
{
	struct sk_buff	*skb;
	struct nlmsghdr	*nlh;
	int		len = NLMSG_SPACE(size);
	void		*data;
	int		flags = multi ? NLM_F_MULTI : 0;
	int		t     = done  ? NLMSG_DONE  : type;

	skb = alloc_skb(len, GFP_KERNEL);
	if (!skb)
		return NULL;

	nlh		 = NLMSG_PUT(skb, pid, seq, t, size);
	nlh->nlmsg_flags = flags;
	data		 = NLMSG_DATA(nlh);
	memcpy(data, payload, size);
	return skb;

nlmsg_failure:			/* Used by NLMSG_PUT */
	if (skb)
		kfree_skb(skb);
	return NULL;
}

539 540 541 542 543 544 545 546 547 548 549 550 551
static int audit_send_reply_thread(void *arg)
{
	struct audit_reply *reply = (struct audit_reply *)arg;

	mutex_lock(&audit_cmd_mutex);
	mutex_unlock(&audit_cmd_mutex);

	/* Ignore failure. It'll only happen if the sender goes away,
	   because our timeout is set to infinite. */
	netlink_unicast(audit_sock, reply->skb, reply->pid, 0);
	kfree(reply);
	return 0;
}
552 553 554 555 556 557 558 559 560 561 562 563 564
/**
 * audit_send_reply - send an audit reply message via netlink
 * @pid: process id to send reply to
 * @seq: sequence number
 * @type: audit message type
 * @done: done (last) flag
 * @multi: multi-part message flag
 * @payload: payload data
 * @size: payload size
 *
 * Allocates an skb, builds the netlink message, and sends it to the pid.
 * No failure notifications.
 */
L
Linus Torvalds 已提交
565 566 567
void audit_send_reply(int pid, int seq, int type, int done, int multi,
		      void *payload, int size)
{
568 569 570 571 572 573 574 575
	struct sk_buff *skb;
	struct task_struct *tsk;
	struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),
					    GFP_KERNEL);

	if (!reply)
		return;

576
	skb = audit_make_reply(pid, seq, type, done, multi, payload, size);
L
Linus Torvalds 已提交
577
	if (!skb)
578
		goto out;
579 580 581 582 583

	reply->pid = pid;
	reply->skb = skb;

	tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
584 585 586 587 588
	if (!IS_ERR(tsk))
		return;
	kfree_skb(skb);
out:
	kfree(reply);
L
Linus Torvalds 已提交
589 590 591 592 593 594
}

/*
 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit
 * control messages.
 */
595
static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
L
Linus Torvalds 已提交
596 597 598 599 600 601
{
	int err = 0;

	switch (msg_type) {
	case AUDIT_GET:
	case AUDIT_LIST:
602
	case AUDIT_LIST_RULES:
L
Linus Torvalds 已提交
603 604
	case AUDIT_SET:
	case AUDIT_ADD:
605
	case AUDIT_ADD_RULE:
L
Linus Torvalds 已提交
606
	case AUDIT_DEL:
607
	case AUDIT_DEL_RULE:
608
	case AUDIT_SIGNAL_INFO:
M
Miloslav Trmac 已提交
609 610
	case AUDIT_TTY_GET:
	case AUDIT_TTY_SET:
A
Al Viro 已提交
611 612
	case AUDIT_TRIM:
	case AUDIT_MAKE_EQUIV:
613
		if (security_netlink_recv(skb, CAP_AUDIT_CONTROL))
L
Linus Torvalds 已提交
614 615
			err = -EPERM;
		break;
616
	case AUDIT_USER:
617 618
	case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
	case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
619
		if (security_netlink_recv(skb, CAP_AUDIT_WRITE))
L
Linus Torvalds 已提交
620 621 622 623 624 625 626 627 628
			err = -EPERM;
		break;
	default:  /* bad msg */
		err = -EINVAL;
	}

	return err;
}

629
static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
630 631
				     u32 pid, u32 uid, uid_t auid, u32 ses,
				     u32 sid)
632 633 634 635 636 637 638 639 640 641 642
{
	int rc = 0;
	char *ctx = NULL;
	u32 len;

	if (!audit_enabled) {
		*ab = NULL;
		return rc;
	}

	*ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
643 644
	audit_log_format(*ab, "user pid=%d uid=%u auid=%u ses=%u",
			 pid, uid, auid, ses);
645
	if (sid) {
646
		rc = security_secid_to_secctx(sid, &ctx, &len);
647 648
		if (rc)
			audit_log_format(*ab, " ssid=%u", sid);
649
		else {
650
			audit_log_format(*ab, " subj=%s", ctx);
651 652
			security_release_secctx(ctx, len);
		}
653 654 655 656 657
	}

	return rc;
}

L
Linus Torvalds 已提交
658 659
static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
{
660
	u32			uid, pid, seq, sid;
L
Linus Torvalds 已提交
661 662 663
	void			*data;
	struct audit_status	*status_get, status_set;
	int			err;
664
	struct audit_buffer	*ab;
L
Linus Torvalds 已提交
665
	u16			msg_type = nlh->nlmsg_type;
666
	uid_t			loginuid; /* loginuid of sender */
667
	u32			sessionid;
668
	struct audit_sig_info   *sig_data;
669
	char			*ctx = NULL;
670
	u32			len;
L
Linus Torvalds 已提交
671

672
	err = audit_netlink_ok(skb, msg_type);
L
Linus Torvalds 已提交
673 674 675
	if (err)
		return err;

676 677
	/* As soon as there's any sign of userspace auditd,
	 * start kauditd to talk to it */
678 679 680 681 682 683 684 685
	if (!kauditd_task)
		kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
	if (IS_ERR(kauditd_task)) {
		err = PTR_ERR(kauditd_task);
		kauditd_task = NULL;
		return err;
	}

L
Linus Torvalds 已提交
686 687
	pid  = NETLINK_CREDS(skb)->pid;
	uid  = NETLINK_CREDS(skb)->uid;
688
	loginuid = NETLINK_CB(skb).loginuid;
689
	sessionid = NETLINK_CB(skb).sessionid;
690
	sid  = NETLINK_CB(skb).sid;
L
Linus Torvalds 已提交
691 692 693 694 695 696 697 698 699 700 701
	seq  = nlh->nlmsg_seq;
	data = NLMSG_DATA(nlh);

	switch (msg_type) {
	case AUDIT_GET:
		status_set.enabled	 = audit_enabled;
		status_set.failure	 = audit_failure;
		status_set.pid		 = audit_pid;
		status_set.rate_limit	 = audit_rate_limit;
		status_set.backlog_limit = audit_backlog_limit;
		status_set.lost		 = atomic_read(&audit_lost);
702
		status_set.backlog	 = skb_queue_len(&audit_skb_queue);
L
Linus Torvalds 已提交
703 704 705 706 707 708 709 710
		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
				 &status_set, sizeof(status_set));
		break;
	case AUDIT_SET:
		if (nlh->nlmsg_len < sizeof(struct audit_status))
			return -EINVAL;
		status_get   = (struct audit_status *)data;
		if (status_get->mask & AUDIT_STATUS_ENABLED) {
711
			err = audit_set_enabled(status_get->enabled,
712
						loginuid, sessionid, sid);
713 714
			if (err < 0)
				return err;
L
Linus Torvalds 已提交
715 716
		}
		if (status_get->mask & AUDIT_STATUS_FAILURE) {
717
			err = audit_set_failure(status_get->failure,
718
						loginuid, sessionid, sid);
719 720
			if (err < 0)
				return err;
L
Linus Torvalds 已提交
721 722
		}
		if (status_get->mask & AUDIT_STATUS_PID) {
723 724 725 726 727
			int new_pid = status_get->pid;

			if (audit_enabled != AUDIT_OFF)
				audit_log_config_change("audit_pid", new_pid,
							audit_pid, loginuid,
728
							sessionid, sid, 1);
729 730

			audit_pid = new_pid;
731
			audit_nlk_pid = NETLINK_CB(skb).pid;
L
Linus Torvalds 已提交
732
		}
733
		if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) {
S
Serge E. Hallyn 已提交
734
			err = audit_set_rate_limit(status_get->rate_limit,
735
						   loginuid, sessionid, sid);
736 737 738
			if (err < 0)
				return err;
		}
L
Linus Torvalds 已提交
739
		if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT)
S
Serge E. Hallyn 已提交
740
			err = audit_set_backlog_limit(status_get->backlog_limit,
741
						      loginuid, sessionid, sid);
L
Linus Torvalds 已提交
742
		break;
743
	case AUDIT_USER:
744 745
	case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
	case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
746 747 748
		if (!audit_enabled && msg_type != AUDIT_USER_AVC)
			return 0;

749
		err = audit_filter_user(&NETLINK_CB(skb));
750 751
		if (err == 1) {
			err = 0;
M
Miloslav Trmac 已提交
752
			if (msg_type == AUDIT_USER_TTY) {
753 754
				err = audit_prepare_user_tty(pid, loginuid,
							     sessionid);
M
Miloslav Trmac 已提交
755 756 757
				if (err)
					break;
			}
758
			audit_log_common_recv_msg(&ab, msg_type, pid, uid,
759
						  loginuid, sessionid, sid);
760 761 762 763 764 765 766 767 768

			if (msg_type != AUDIT_USER_TTY)
				audit_log_format(ab, " msg='%.1024s'",
						 (char *)data);
			else {
				int size;

				audit_log_format(ab, " msg=");
				size = nlmsg_len(nlh);
769
				audit_log_n_untrustedstring(ab, data, size);
770
			}
771 772
			audit_set_pid(ab, pid);
			audit_log_end(ab);
773
		}
L
Linus Torvalds 已提交
774 775 776
		break;
	case AUDIT_ADD:
	case AUDIT_DEL:
777
		if (nlmsg_len(nlh) < sizeof(struct audit_rule))
L
Linus Torvalds 已提交
778
			return -EINVAL;
779
		if (audit_enabled == AUDIT_LOCKED) {
780
			audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
781
						  uid, loginuid, sessionid, sid);
782 783 784 785

			audit_log_format(ab, " audit_enabled=%d res=0",
					 audit_enabled);
			audit_log_end(ab);
S
Steve Grubb 已提交
786 787
			return -EPERM;
		}
L
Linus Torvalds 已提交
788 789
		/* fallthrough */
	case AUDIT_LIST:
790
		err = audit_receive_filter(msg_type, NETLINK_CB(skb).pid,
791
					   uid, seq, data, nlmsg_len(nlh),
792
					   loginuid, sessionid, sid);
793 794 795 796 797
		break;
	case AUDIT_ADD_RULE:
	case AUDIT_DEL_RULE:
		if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
			return -EINVAL;
798
		if (audit_enabled == AUDIT_LOCKED) {
799
			audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
800
						  uid, loginuid, sessionid, sid);
801 802 803 804

			audit_log_format(ab, " audit_enabled=%d res=0",
					 audit_enabled);
			audit_log_end(ab);
S
Steve Grubb 已提交
805 806
			return -EPERM;
		}
807 808
		/* fallthrough */
	case AUDIT_LIST_RULES:
809
		err = audit_receive_filter(msg_type, NETLINK_CB(skb).pid,
810
					   uid, seq, data, nlmsg_len(nlh),
811
					   loginuid, sessionid, sid);
L
Linus Torvalds 已提交
812
		break;
A
Al Viro 已提交
813 814
	case AUDIT_TRIM:
		audit_trim_trees();
815 816

		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
817
					  uid, loginuid, sessionid, sid);
818

A
Al Viro 已提交
819 820 821 822 823 824
		audit_log_format(ab, " op=trim res=1");
		audit_log_end(ab);
		break;
	case AUDIT_MAKE_EQUIV: {
		void *bufp = data;
		u32 sizes[2];
825
		size_t msglen = nlmsg_len(nlh);
A
Al Viro 已提交
826 827 828
		char *old, *new;

		err = -EINVAL;
829
		if (msglen < 2 * sizeof(u32))
A
Al Viro 已提交
830 831 832
			break;
		memcpy(sizes, bufp, 2 * sizeof(u32));
		bufp += 2 * sizeof(u32);
833 834
		msglen -= 2 * sizeof(u32);
		old = audit_unpack_string(&bufp, &msglen, sizes[0]);
A
Al Viro 已提交
835 836 837 838
		if (IS_ERR(old)) {
			err = PTR_ERR(old);
			break;
		}
839
		new = audit_unpack_string(&bufp, &msglen, sizes[1]);
A
Al Viro 已提交
840 841 842 843 844 845 846 847
		if (IS_ERR(new)) {
			err = PTR_ERR(new);
			kfree(old);
			break;
		}
		/* OK, here comes... */
		err = audit_tag_tree(old, new);

848
		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
849
					  uid, loginuid, sessionid, sid);
850

A
Al Viro 已提交
851 852 853 854 855 856 857 858 859 860
		audit_log_format(ab, " op=make_equiv old=");
		audit_log_untrustedstring(ab, old);
		audit_log_format(ab, " new=");
		audit_log_untrustedstring(ab, new);
		audit_log_format(ab, " res=%d", !err);
		audit_log_end(ab);
		kfree(old);
		kfree(new);
		break;
	}
861
	case AUDIT_SIGNAL_INFO:
862
		err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
863 864 865 866
		if (err)
			return err;
		sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
		if (!sig_data) {
867
			security_release_secctx(ctx, len);
868 869 870 871 872
			return -ENOMEM;
		}
		sig_data->uid = audit_sig_uid;
		sig_data->pid = audit_sig_pid;
		memcpy(sig_data->ctx, ctx, len);
873
		security_release_secctx(ctx, len);
D
Daniel Walker 已提交
874
		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO,
875 876
				0, 0, sig_data, sizeof(*sig_data) + len);
		kfree(sig_data);
877
		break;
M
Miloslav Trmac 已提交
878 879 880 881 882
	case AUDIT_TTY_GET: {
		struct audit_tty_status s;
		struct task_struct *tsk;

		read_lock(&tasklist_lock);
883
		tsk = find_task_by_vpid(pid);
M
Miloslav Trmac 已提交
884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905
		if (!tsk)
			err = -ESRCH;
		else {
			spin_lock_irq(&tsk->sighand->siglock);
			s.enabled = tsk->signal->audit_tty != 0;
			spin_unlock_irq(&tsk->sighand->siglock);
		}
		read_unlock(&tasklist_lock);
		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
				 &s, sizeof(s));
		break;
	}
	case AUDIT_TTY_SET: {
		struct audit_tty_status *s;
		struct task_struct *tsk;

		if (nlh->nlmsg_len < sizeof(struct audit_tty_status))
			return -EINVAL;
		s = data;
		if (s->enabled != 0 && s->enabled != 1)
			return -EINVAL;
		read_lock(&tasklist_lock);
906
		tsk = find_task_by_vpid(pid);
M
Miloslav Trmac 已提交
907 908 909 910 911 912 913 914 915 916
		if (!tsk)
			err = -ESRCH;
		else {
			spin_lock_irq(&tsk->sighand->siglock);
			tsk->signal->audit_tty = s->enabled != 0;
			spin_unlock_irq(&tsk->sighand->siglock);
		}
		read_unlock(&tasklist_lock);
		break;
	}
L
Linus Torvalds 已提交
917 918 919 920 921 922 923 924
	default:
		err = -EINVAL;
		break;
	}

	return err < 0 ? err : 0;
}

925 926
/*
 * Get message from skb (based on rtnetlink_rcv_skb).  Each message is
L
Linus Torvalds 已提交
927
 * processed by audit_receive_msg.  Malformed skbs with wrong length are
928 929
 * discarded silently.
 */
930
static void audit_receive_skb(struct sk_buff *skb)
L
Linus Torvalds 已提交
931 932 933 934 935 936
{
	int		err;
	struct nlmsghdr	*nlh;
	u32		rlen;

	while (skb->len >= NLMSG_SPACE(0)) {
937
		nlh = nlmsg_hdr(skb);
L
Linus Torvalds 已提交
938
		if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
939
			return;
L
Linus Torvalds 已提交
940 941 942 943 944 945 946 947 948 949 950 951
		rlen = NLMSG_ALIGN(nlh->nlmsg_len);
		if (rlen > skb->len)
			rlen = skb->len;
		if ((err = audit_receive_msg(skb, nlh))) {
			netlink_ack(skb, nlh, err);
		} else if (nlh->nlmsg_flags & NLM_F_ACK)
			netlink_ack(skb, nlh, 0);
		skb_pull(skb, rlen);
	}
}

/* Receive messages from netlink socket. */
952
static void audit_receive(struct sk_buff  *skb)
L
Linus Torvalds 已提交
953
{
A
Amy Griffis 已提交
954
	mutex_lock(&audit_cmd_mutex);
955
	audit_receive_skb(skb);
A
Amy Griffis 已提交
956
	mutex_unlock(&audit_cmd_mutex);
L
Linus Torvalds 已提交
957 958
}

A
Amy Griffis 已提交
959 960 961 962 963 964
#ifdef CONFIG_AUDITSYSCALL
static const struct inotify_operations audit_inotify_ops = {
	.handle_event	= audit_handle_ievent,
	.destroy_watch	= audit_free_parent,
};
#endif
L
Linus Torvalds 已提交
965 966 967 968

/* Initialize audit support at boot time. */
static int __init audit_init(void)
{
A
Amy Griffis 已提交
969 970
	int i;

971 972 973
	if (audit_initialized == AUDIT_DISABLED)
		return 0;

L
Linus Torvalds 已提交
974 975
	printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
	       audit_default ? "enabled" : "disabled");
976 977
	audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, 0,
					   audit_receive, NULL, THIS_MODULE);
L
Linus Torvalds 已提交
978 979
	if (!audit_sock)
		audit_panic("cannot initialize netlink socket");
980 981
	else
		audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
L
Linus Torvalds 已提交
982

983
	skb_queue_head_init(&audit_skb_queue);
984
	skb_queue_head_init(&audit_skb_hold_queue);
985
	audit_initialized = AUDIT_INITIALIZED;
L
Linus Torvalds 已提交
986
	audit_enabled = audit_default;
987
	audit_ever_enabled |= !!audit_default;
988

989
	audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
A
Amy Griffis 已提交
990 991 992 993 994

#ifdef CONFIG_AUDITSYSCALL
	audit_ih = inotify_init(&audit_inotify_ops);
	if (IS_ERR(audit_ih))
		audit_panic("cannot initialize inotify handle");
995
#endif
A
Amy Griffis 已提交
996 997 998 999

	for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
		INIT_LIST_HEAD(&audit_inode_hash[i]);

L
Linus Torvalds 已提交
1000 1001 1002 1003 1004 1005 1006 1007
	return 0;
}
__initcall(audit_init);

/* Process kernel command-line parameter at boot time.  audit=0 or audit=1. */
static int __init audit_enable(char *str)
{
	audit_default = !!simple_strtol(str, NULL, 0);
1008 1009 1010 1011 1012 1013
	if (!audit_default)
		audit_initialized = AUDIT_DISABLED;

	printk(KERN_INFO "audit: %s", audit_default ? "enabled" : "disabled");

	if (audit_initialized == AUDIT_INITIALIZED) {
L
Linus Torvalds 已提交
1014
		audit_enabled = audit_default;
1015
		audit_ever_enabled |= !!audit_default;
1016 1017 1018 1019
	} else if (audit_initialized == AUDIT_UNINITIALIZED) {
		printk(" (after initialization)");
	} else {
		printk(" (until reboot)");
1020
	}
1021 1022
	printk("\n");

1023
	return 1;
L
Linus Torvalds 已提交
1024 1025 1026 1027
}

__setup("audit=", audit_enable);

1028 1029 1030 1031
static void audit_buffer_free(struct audit_buffer *ab)
{
	unsigned long flags;

1032 1033 1034
	if (!ab)
		return;

1035 1036
	if (ab->skb)
		kfree_skb(ab->skb);
1037

1038
	spin_lock_irqsave(&audit_freelist_lock, flags);
S
Serge E. Hallyn 已提交
1039
	if (audit_freelist_count > AUDIT_MAXFREE)
1040
		kfree(ab);
S
Serge E. Hallyn 已提交
1041 1042
	else {
		audit_freelist_count++;
1043
		list_add(&ab->list, &audit_freelist);
S
Serge E. Hallyn 已提交
1044
	}
1045 1046 1047
	spin_unlock_irqrestore(&audit_freelist_lock, flags);
}

1048
static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
A
Al Viro 已提交
1049
						gfp_t gfp_mask, int type)
1050 1051 1052
{
	unsigned long flags;
	struct audit_buffer *ab = NULL;
1053
	struct nlmsghdr *nlh;
1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064

	spin_lock_irqsave(&audit_freelist_lock, flags);
	if (!list_empty(&audit_freelist)) {
		ab = list_entry(audit_freelist.next,
				struct audit_buffer, list);
		list_del(&ab->list);
		--audit_freelist_count;
	}
	spin_unlock_irqrestore(&audit_freelist_lock, flags);

	if (!ab) {
1065
		ab = kmalloc(sizeof(*ab), gfp_mask);
1066
		if (!ab)
1067
			goto err;
1068
	}
1069

1070
	ab->skb = alloc_skb(AUDIT_BUFSIZ, gfp_mask);
1071
	if (!ab->skb)
1072 1073
		goto err;

1074
	ab->ctx = ctx;
1075
	ab->gfp_mask = gfp_mask;
1076 1077 1078 1079 1080
	nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0));
	nlh->nlmsg_type = type;
	nlh->nlmsg_flags = 0;
	nlh->nlmsg_pid = 0;
	nlh->nlmsg_seq = 0;
1081
	return ab;
1082 1083 1084
err:
	audit_buffer_free(ab);
	return NULL;
1085
}
L
Linus Torvalds 已提交
1086

1087 1088 1089 1090
/**
 * audit_serial - compute a serial number for the audit record
 *
 * Compute a serial number for the audit record.  Audit records are
1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101
 * written to user-space as soon as they are generated, so a complete
 * audit record may be written in several pieces.  The timestamp of the
 * record and this serial number are used by the user-space tools to
 * determine which pieces belong to the same audit record.  The
 * (timestamp,serial) tuple is unique for each syscall and is live from
 * syscall entry to syscall exit.
 *
 * NOTE: Another possibility is to store the formatted records off the
 * audit context (for those records that have a context), and emit them
 * all at syscall exit.  However, this could delay the reporting of
 * significant errors until syscall exit (or never, if the system
1102 1103
 * halts).
 */
1104 1105
unsigned int audit_serial(void)
{
I
Ingo Molnar 已提交
1106
	static DEFINE_SPINLOCK(serial_lock);
1107 1108 1109 1110
	static unsigned int serial = 0;

	unsigned long flags;
	unsigned int ret;
1111

1112
	spin_lock_irqsave(&serial_lock, flags);
1113
	do {
1114 1115
		ret = ++serial;
	} while (unlikely(!ret));
1116
	spin_unlock_irqrestore(&serial_lock, flags);
1117

1118
	return ret;
1119 1120
}

D
Daniel Walker 已提交
1121
static inline void audit_get_stamp(struct audit_context *ctx,
1122 1123
				   struct timespec *t, unsigned int *serial)
{
1124
	if (!ctx || !auditsc_get_stamp(ctx, t, serial)) {
1125 1126 1127 1128 1129
		*t = CURRENT_TIME;
		*serial = audit_serial();
	}
}

L
Linus Torvalds 已提交
1130 1131 1132 1133 1134 1135
/* Obtain an audit buffer.  This routine does locking to obtain the
 * audit buffer, but then no locking is required for calls to
 * audit_log_*format.  If the tsk is a task that is currently in a
 * syscall, then the syscall is marked as auditable and an audit record
 * will be written at syscall exit.  If there is no associated task, tsk
 * should be NULL. */
1136

1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151
/**
 * audit_log_start - obtain an audit buffer
 * @ctx: audit_context (may be NULL)
 * @gfp_mask: type of allocation
 * @type: audit message type
 *
 * Returns audit_buffer pointer on success or NULL on error.
 *
 * Obtain an audit buffer.  This routine does locking to obtain the
 * audit buffer, but then no locking is required for calls to
 * audit_log_*format.  If the task (ctx) is a task that is currently in a
 * syscall, then the syscall is marked as auditable and an audit record
 * will be written at syscall exit.  If there is no associated task, then
 * task context (ctx) should be NULL.
 */
A
Al Viro 已提交
1152
struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
1153
				     int type)
L
Linus Torvalds 已提交
1154 1155 1156
{
	struct audit_buffer	*ab	= NULL;
	struct timespec		t;
1157
	unsigned int		uninitialized_var(serial);
1158
	int reserve;
1159
	unsigned long timeout_start = jiffies;
L
Linus Torvalds 已提交
1160

1161
	if (audit_initialized != AUDIT_INITIALIZED)
L
Linus Torvalds 已提交
1162 1163
		return NULL;

1164 1165 1166
	if (unlikely(audit_filter_type(type)))
		return NULL;

1167 1168 1169
	if (gfp_mask & __GFP_WAIT)
		reserve = 0;
	else
D
Daniel Walker 已提交
1170
		reserve = 5; /* Allow atomic callers to go up to five
1171 1172 1173 1174
				entries over the normal backlog limit */

	while (audit_backlog_limit
	       && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
1175 1176 1177
		if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time
		    && time_before(jiffies, timeout_start + audit_backlog_wait_time)) {

1178 1179 1180 1181 1182 1183 1184
			/* Wait for auditd to drain the queue a little */
			DECLARE_WAITQUEUE(wait, current);
			set_current_state(TASK_INTERRUPTIBLE);
			add_wait_queue(&audit_backlog_wait, &wait);

			if (audit_backlog_limit &&
			    skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
1185
				schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies);
1186 1187 1188

			__set_current_state(TASK_RUNNING);
			remove_wait_queue(&audit_backlog_wait, &wait);
1189
			continue;
1190
		}
1191
		if (audit_rate_check() && printk_ratelimit())
1192 1193 1194 1195 1196 1197
			printk(KERN_WARNING
			       "audit: audit_backlog=%d > "
			       "audit_backlog_limit=%d\n",
			       skb_queue_len(&audit_skb_queue),
			       audit_backlog_limit);
		audit_log_lost("backlog limit exceeded");
1198 1199
		audit_backlog_wait_time = audit_backlog_wait_overflow;
		wake_up(&audit_backlog_wait);
1200 1201 1202
		return NULL;
	}

1203
	ab = audit_buffer_alloc(ctx, gfp_mask, type);
L
Linus Torvalds 已提交
1204 1205 1206 1207 1208
	if (!ab) {
		audit_log_lost("out of memory in audit_log_start");
		return NULL;
	}

1209
	audit_get_stamp(ab->ctx, &t, &serial);
1210

L
Linus Torvalds 已提交
1211 1212 1213 1214 1215
	audit_log_format(ab, "audit(%lu.%03lu:%u): ",
			 t.tv_sec, t.tv_nsec/1000000, serial);
	return ab;
}

1216
/**
1217
 * audit_expand - expand skb in the audit buffer
1218
 * @ab: audit_buffer
1219
 * @extra: space to add at tail of the skb
1220 1221 1222 1223
 *
 * Returns 0 (no space) on failed expansion, or available space if
 * successful.
 */
1224
static inline int audit_expand(struct audit_buffer *ab, int extra)
1225
{
1226
	struct sk_buff *skb = ab->skb;
1227 1228 1229 1230
	int oldtail = skb_tailroom(skb);
	int ret = pskb_expand_head(skb, 0, extra, ab->gfp_mask);
	int newtail = skb_tailroom(skb);

1231 1232
	if (ret < 0) {
		audit_log_lost("out of memory in audit_expand");
1233
		return 0;
1234
	}
1235 1236 1237

	skb->truesize += newtail - oldtail;
	return newtail;
1238
}
L
Linus Torvalds 已提交
1239

1240 1241
/*
 * Format an audit message into the audit buffer.  If there isn't enough
L
Linus Torvalds 已提交
1242 1243
 * room in the audit buffer, more room will be allocated and vsnprint
 * will be called a second time.  Currently, we assume that a printk
1244 1245
 * can't format message larger than 1024 bytes, so we don't either.
 */
L
Linus Torvalds 已提交
1246 1247 1248 1249
static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
			      va_list args)
{
	int len, avail;
1250
	struct sk_buff *skb;
D
David Woodhouse 已提交
1251
	va_list args2;
L
Linus Torvalds 已提交
1252 1253 1254 1255

	if (!ab)
		return;

1256 1257 1258 1259
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	if (avail == 0) {
1260
		avail = audit_expand(ab, AUDIT_BUFSIZ);
1261 1262
		if (!avail)
			goto out;
L
Linus Torvalds 已提交
1263
	}
D
David Woodhouse 已提交
1264
	va_copy(args2, args);
1265
	len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args);
L
Linus Torvalds 已提交
1266 1267 1268 1269
	if (len >= avail) {
		/* The printk buffer is 1024 bytes long, so if we get
		 * here and AUDIT_BUFSIZ is at least 1024, then we can
		 * log everything that printk could have logged. */
1270 1271
		avail = audit_expand(ab,
			max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
1272 1273
		if (!avail)
			goto out;
1274
		len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
L
Linus Torvalds 已提交
1275
	}
1276
	va_end(args2);
1277 1278
	if (len > 0)
		skb_put(skb, len);
1279 1280
out:
	return;
L
Linus Torvalds 已提交
1281 1282
}

1283 1284 1285 1286 1287 1288 1289 1290
/**
 * audit_log_format - format a message into the audit buffer.
 * @ab: audit_buffer
 * @fmt: format string
 * @...: optional parameters matching @fmt string
 *
 * All the work is done in audit_log_vformat.
 */
L
Linus Torvalds 已提交
1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301
void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
{
	va_list args;

	if (!ab)
		return;
	va_start(args, fmt);
	audit_log_vformat(ab, fmt, args);
	va_end(args);
}

1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312
/**
 * audit_log_hex - convert a buffer to hex and append it to the audit skb
 * @ab: the audit_buffer
 * @buf: buffer to convert to hex
 * @len: length of @buf to be converted
 *
 * No return value; failure to expand is silently ignored.
 *
 * This function will take the passed buf and convert it into a string of
 * ascii hex digits. The new string is placed onto the skb.
 */
1313
void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
1314
		size_t len)
1315
{
1316 1317 1318 1319 1320
	int i, avail, new_len;
	unsigned char *ptr;
	struct sk_buff *skb;
	static const unsigned char *hex = "0123456789ABCDEF";

A
Amy Griffis 已提交
1321 1322 1323
	if (!ab)
		return;

1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	new_len = len<<1;
	if (new_len >= avail) {
		/* Round the buffer request up to the next multiple */
		new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
		avail = audit_expand(ab, new_len);
		if (!avail)
			return;
	}
1335

1336
	ptr = skb_tail_pointer(skb);
1337 1338 1339 1340 1341 1342
	for (i=0; i<len; i++) {
		*ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */
		*ptr++ = hex[buf[i] & 0x0F];	  /* Lower nibble */
	}
	*ptr = 0;
	skb_put(skb, len << 1); /* new string is twice the old string */
1343 1344
}

1345 1346 1347 1348
/*
 * Format a string of no more than slen characters into the audit buffer,
 * enclosed in quote marks.
 */
1349 1350
void audit_log_n_string(struct audit_buffer *ab, const char *string,
			size_t slen)
1351 1352 1353 1354 1355
{
	int avail, new_len;
	unsigned char *ptr;
	struct sk_buff *skb;

A
Amy Griffis 已提交
1356 1357 1358
	if (!ab)
		return;

1359 1360 1361 1362 1363 1364 1365 1366 1367
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	new_len = slen + 3;	/* enclosing quotes + null terminator */
	if (new_len > avail) {
		avail = audit_expand(ab, new_len);
		if (!avail)
			return;
	}
1368
	ptr = skb_tail_pointer(skb);
1369 1370 1371 1372 1373 1374 1375 1376
	*ptr++ = '"';
	memcpy(ptr, string, slen);
	ptr += slen;
	*ptr++ = '"';
	*ptr = 0;
	skb_put(skb, slen + 2);	/* don't include null terminator */
}

1377 1378
/**
 * audit_string_contains_control - does a string need to be logged in hex
1379 1380
 * @string: string to be checked
 * @len: max length of the string to check
1381 1382 1383 1384 1385
 */
int audit_string_contains_control(const char *string, size_t len)
{
	const unsigned char *p;
	for (p = string; p < (const unsigned char *)string + len && *p; p++) {
1386
		if (*p == '"' || *p < 0x21 || *p > 0x7e)
1387 1388 1389 1390 1391
			return 1;
	}
	return 0;
}

1392
/**
M
Miloslav Trmac 已提交
1393
 * audit_log_n_untrustedstring - log a string that may contain random characters
1394
 * @ab: audit_buffer
1395
 * @len: length of string (not including trailing null)
1396 1397 1398 1399
 * @string: string to be logged
 *
 * This code will escape a string that is passed to it if the string
 * contains a control character, unprintable character, double quote mark,
1400
 * or a space. Unescaped strings will start and end with a double quote mark.
1401
 * Strings that are escaped are printed in hex (2 digits per char).
1402 1403 1404
 *
 * The caller specifies the number of characters in the string to log, which may
 * or may not be the entire string.
1405
 */
1406 1407
void audit_log_n_untrustedstring(struct audit_buffer *ab, const char *string,
				 size_t len)
1408
{
1409
	if (audit_string_contains_control(string, len))
1410
		audit_log_n_hex(ab, string, len);
1411
	else
1412
		audit_log_n_string(ab, string, len);
1413 1414
}

1415
/**
M
Miloslav Trmac 已提交
1416
 * audit_log_untrustedstring - log a string that may contain random characters
1417 1418 1419
 * @ab: audit_buffer
 * @string: string to be logged
 *
M
Miloslav Trmac 已提交
1420
 * Same as audit_log_n_untrustedstring(), except that strlen is used to
1421 1422
 * determine string length.
 */
1423
void audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
1424
{
1425
	audit_log_n_untrustedstring(ab, string, strlen(string));
1426 1427
}

1428
/* This is a helper-function to print the escaped d_path */
L
Linus Torvalds 已提交
1429
void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
1430
		      struct path *path)
L
Linus Torvalds 已提交
1431
{
1432
	char *p, *pathname;
L
Linus Torvalds 已提交
1433

1434 1435
	if (prefix)
		audit_log_format(ab, " %s", prefix);
L
Linus Torvalds 已提交
1436

1437
	/* We will allow 11 spaces for ' (deleted)' to be appended */
1438 1439
	pathname = kmalloc(PATH_MAX+11, ab->gfp_mask);
	if (!pathname) {
1440 1441
		audit_log_format(ab, "<no memory>");
		return;
L
Linus Torvalds 已提交
1442
	}
1443
	p = d_path(path, pathname, PATH_MAX+11);
1444 1445 1446
	if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */
		/* FIXME: can we save some information here? */
		audit_log_format(ab, "<too long>");
D
Daniel Walker 已提交
1447
	} else
1448
		audit_log_untrustedstring(ab, p);
1449
	kfree(pathname);
L
Linus Torvalds 已提交
1450 1451
}

1452 1453 1454 1455 1456 1457
/**
 * audit_log_end - end one audit record
 * @ab: the audit_buffer
 *
 * The netlink_* functions cannot be called inside an irq context, so
 * the audit buffer is placed on a queue and a tasklet is scheduled to
L
Linus Torvalds 已提交
1458
 * remove them from the queue outside the irq context.  May be called in
1459 1460
 * any context.
 */
1461
void audit_log_end(struct audit_buffer *ab)
L
Linus Torvalds 已提交
1462 1463 1464 1465 1466 1467
{
	if (!ab)
		return;
	if (!audit_rate_check()) {
		audit_log_lost("rate limit exceeded");
	} else {
1468
		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
1469 1470
		nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0);

1471 1472 1473
		if (audit_pid) {
			skb_queue_tail(&audit_skb_queue, ab->skb);
			wake_up_interruptible(&kauditd_wait);
1474 1475 1476 1477 1478 1479 1480 1481 1482 1483
		} else {
			if (nlh->nlmsg_type != AUDIT_EOE) {
				if (printk_ratelimit()) {
					printk(KERN_NOTICE "type=%d %s\n",
						nlh->nlmsg_type,
						ab->skb->data + NLMSG_SPACE(0));
				} else
					audit_log_lost("printk limit exceeded\n");
			}
			audit_hold_skb(ab->skb);
1484
		}
1485
		ab->skb = NULL;
L
Linus Torvalds 已提交
1486
	}
1487
	audit_buffer_free(ab);
L
Linus Torvalds 已提交
1488 1489
}

1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501
/**
 * audit_log - Log an audit record
 * @ctx: audit context
 * @gfp_mask: type of allocation
 * @type: audit message type
 * @fmt: format string to use
 * @...: variable parameters matching the format string
 *
 * This is a convenience function that calls audit_log_start,
 * audit_log_vformat, and audit_log_end.  It may be called
 * in any context.
 */
D
Daniel Walker 已提交
1502
void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
1503
	       const char *fmt, ...)
L
Linus Torvalds 已提交
1504 1505 1506 1507
{
	struct audit_buffer *ab;
	va_list args;

1508
	ab = audit_log_start(ctx, gfp_mask, type);
L
Linus Torvalds 已提交
1509 1510 1511 1512 1513 1514 1515
	if (ab) {
		va_start(args, fmt);
		audit_log_vformat(ab, fmt, args);
		va_end(args);
		audit_log_end(ab);
	}
}
1516 1517 1518 1519 1520

EXPORT_SYMBOL(audit_log_start);
EXPORT_SYMBOL(audit_log_end);
EXPORT_SYMBOL(audit_log_format);
EXPORT_SYMBOL(audit_log);