audit.c 44.5 KB
Newer Older
1
/* audit.c -- Auditing support
L
Linus Torvalds 已提交
2 3 4
 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon.
 * System-call specific features have moved to auditsc.c
 *
S
Steve Grubb 已提交
5
 * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina.
L
Linus Torvalds 已提交
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
 * All Rights Reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
 *
24
 * Goals: 1) Integrate fully with Security Modules.
L
Linus Torvalds 已提交
25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40
 *	  2) Minimal run-time overhead:
 *	     a) Minimal when syscall auditing is disabled (audit_enable=0).
 *	     b) Small when syscall auditing is enabled and no audit record
 *		is generated (defer as much work as possible to record
 *		generation time):
 *		i) context is allocated,
 *		ii) names from getname are stored without a copy, and
 *		iii) inode information stored from path_lookup.
 *	  3) Ability to disable syscall auditing at boot time (audit=0).
 *	  4) Usable by other parts of the kernel (if audit_log* is called,
 *	     then a syscall record will be generated automatically for the
 *	     current syscall).
 *	  5) Netlink interface to user-space.
 *	  6) Support low-overhead kernel-based filtering to minimize the
 *	     information that must be passed to user-space.
 *
41
 * Example user-space utilities: http://people.redhat.com/sgrubb/audit/
L
Linus Torvalds 已提交
42 43 44 45
 */

#include <linux/init.h>
#include <asm/types.h>
A
Arun Sharma 已提交
46
#include <linux/atomic.h>
L
Linus Torvalds 已提交
47
#include <linux/mm.h>
48
#include <linux/export.h>
49
#include <linux/slab.h>
50 51
#include <linux/err.h>
#include <linux/kthread.h>
52
#include <linux/kernel.h>
53
#include <linux/syscalls.h>
L
Linus Torvalds 已提交
54 55 56 57

#include <linux/audit.h>

#include <net/sock.h>
58
#include <net/netlink.h>
L
Linus Torvalds 已提交
59
#include <linux/skbuff.h>
60 61 62
#ifdef CONFIG_SECURITY
#include <linux/security.h>
#endif
63
#include <linux/freezer.h>
M
Miloslav Trmac 已提交
64
#include <linux/tty.h>
65
#include <linux/pid_namespace.h>
66 67

#include "audit.h"
L
Linus Torvalds 已提交
68

69
/* No auditing will take place until audit_initialized == AUDIT_INITIALIZED.
L
Linus Torvalds 已提交
70
 * (Initialization happens after skb_init is called.) */
71 72 73
#define AUDIT_DISABLED		-1
#define AUDIT_UNINITIALIZED	0
#define AUDIT_INITIALIZED	1
L
Linus Torvalds 已提交
74 75
static int	audit_initialized;

76 77 78
#define AUDIT_OFF	0
#define AUDIT_ON	1
#define AUDIT_LOCKED	2
L
Linus Torvalds 已提交
79
int		audit_enabled;
80
int		audit_ever_enabled;
L
Linus Torvalds 已提交
81

82 83
EXPORT_SYMBOL_GPL(audit_enabled);

L
Linus Torvalds 已提交
84 85 86 87 88 89
/* Default state when kernel boots without any parameters. */
static int	audit_default;

/* If auditing cannot proceed, audit_failure selects what happens. */
static int	audit_failure = AUDIT_FAIL_PRINTK;

90 91
/*
 * If audit records are to be written to the netlink socket, audit_pid
92 93
 * contains the pid of the auditd process and audit_nlk_portid contains
 * the portid to use to send netlink messages to that process.
94
 */
95
int		audit_pid;
96
static int	audit_nlk_portid;
L
Linus Torvalds 已提交
97

98
/* If audit_rate_limit is non-zero, limit the rate of sending audit records
L
Linus Torvalds 已提交
99 100 101 102 103 104
 * to that number per second.  This prevents DoS attacks, but results in
 * audit records being dropped. */
static int	audit_rate_limit;

/* Number of outstanding audit_buffers allowed. */
static int	audit_backlog_limit = 64;
105 106
static int	audit_backlog_wait_time = 60 * HZ;
static int	audit_backlog_wait_overflow = 0;
L
Linus Torvalds 已提交
107

108
/* The identity of the user shutting down the audit system. */
109
kuid_t		audit_sig_uid = INVALID_UID;
110
pid_t		audit_sig_pid = -1;
111
u32		audit_sig_sid = 0;
112

L
Linus Torvalds 已提交
113 114 115 116 117 118 119 120 121 122 123 124
/* Records can be lost in several ways:
   0) [suppressed in audit_alloc]
   1) out of memory in audit_log_start [kmalloc of struct audit_buffer]
   2) out of memory in audit_log_move [alloc_skb]
   3) suppressed due to audit_rate_limit
   4) suppressed due to audit_backlog_limit
*/
static atomic_t    audit_lost = ATOMIC_INIT(0);

/* The netlink socket. */
static struct sock *audit_sock;

A
Amy Griffis 已提交
125 126 127
/* Hash for inode-based rules */
struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];

128
/* The audit_freelist is a list of pre-allocated audit buffers (if more
L
Linus Torvalds 已提交
129 130 131
 * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of
 * being placed on the freelist). */
static DEFINE_SPINLOCK(audit_freelist_lock);
132
static int	   audit_freelist_count;
L
Linus Torvalds 已提交
133 134
static LIST_HEAD(audit_freelist);

135
static struct sk_buff_head audit_skb_queue;
136 137
/* queue of skbs to send to auditd when/if it comes back */
static struct sk_buff_head audit_skb_hold_queue;
138 139
static struct task_struct *kauditd_task;
static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
140
static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
L
Linus Torvalds 已提交
141

A
Amy Griffis 已提交
142
/* Serialize requests from userspace. */
A
Al Viro 已提交
143
DEFINE_MUTEX(audit_cmd_mutex);
L
Linus Torvalds 已提交
144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160

/* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
 * audit records.  Since printk uses a 1024 byte buffer, this buffer
 * should be at least that large. */
#define AUDIT_BUFSIZ 1024

/* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the
 * audit_freelist.  Doing so eliminates many kmalloc/kfree calls. */
#define AUDIT_MAXFREE  (2*NR_CPUS)

/* The audit_buffer is used when formatting an audit record.  The caller
 * locks briefly to get the record off the freelist or to allocate the
 * buffer, and locks briefly to send the buffer to the netlink layer or
 * to place it on a transmit queue.  Multiple audit_buffers can be in
 * use simultaneously. */
struct audit_buffer {
	struct list_head     list;
161
	struct sk_buff       *skb;	/* formatted skb ready to send */
L
Linus Torvalds 已提交
162
	struct audit_context *ctx;	/* NULL or associated context */
A
Al Viro 已提交
163
	gfp_t		     gfp_mask;
L
Linus Torvalds 已提交
164 165
};

166 167 168 169 170
struct audit_reply {
	int pid;
	struct sk_buff *skb;
};

171 172
static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
{
173 174 175 176
	if (ab) {
		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
		nlh->nlmsg_pid = pid;
	}
177 178
}

179
void audit_panic(const char *message)
L
Linus Torvalds 已提交
180 181 182 183 184 185
{
	switch (audit_failure)
	{
	case AUDIT_FAIL_SILENT:
		break;
	case AUDIT_FAIL_PRINTK:
186 187
		if (printk_ratelimit())
			printk(KERN_ERR "audit: %s\n", message);
L
Linus Torvalds 已提交
188 189
		break;
	case AUDIT_FAIL_PANIC:
190 191 192
		/* test audit_pid since printk is always losey, why bother? */
		if (audit_pid)
			panic("audit: %s\n", message);
L
Linus Torvalds 已提交
193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225
		break;
	}
}

static inline int audit_rate_check(void)
{
	static unsigned long	last_check = 0;
	static int		messages   = 0;
	static DEFINE_SPINLOCK(lock);
	unsigned long		flags;
	unsigned long		now;
	unsigned long		elapsed;
	int			retval	   = 0;

	if (!audit_rate_limit) return 1;

	spin_lock_irqsave(&lock, flags);
	if (++messages < audit_rate_limit) {
		retval = 1;
	} else {
		now     = jiffies;
		elapsed = now - last_check;
		if (elapsed > HZ) {
			last_check = now;
			messages   = 0;
			retval     = 1;
		}
	}
	spin_unlock_irqrestore(&lock, flags);

	return retval;
}

226 227 228 229 230 231 232 233
/**
 * audit_log_lost - conditionally log lost audit message event
 * @message: the message stating reason for lost audit message
 *
 * Emit at least 1 message per second, even if audit_rate_check is
 * throttling.
 * Always increment the lost messages counter.
*/
L
Linus Torvalds 已提交
234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256
void audit_log_lost(const char *message)
{
	static unsigned long	last_msg = 0;
	static DEFINE_SPINLOCK(lock);
	unsigned long		flags;
	unsigned long		now;
	int			print;

	atomic_inc(&audit_lost);

	print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);

	if (!print) {
		spin_lock_irqsave(&lock, flags);
		now = jiffies;
		if (now - last_msg > HZ) {
			print = 1;
			last_msg = now;
		}
		spin_unlock_irqrestore(&lock, flags);
	}

	if (print) {
257 258 259 260 261 262 263
		if (printk_ratelimit())
			printk(KERN_WARNING
				"audit: audit_lost=%d audit_rate_limit=%d "
				"audit_backlog_limit=%d\n",
				atomic_read(&audit_lost),
				audit_rate_limit,
				audit_backlog_limit);
L
Linus Torvalds 已提交
264 265 266 267
		audit_panic(message);
	}
}

268
static int audit_log_config_change(char *function_name, int new, int old,
269
				   int allow_changes)
L
Linus Torvalds 已提交
270
{
271 272
	struct audit_buffer *ab;
	int rc = 0;
273

274
	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
275 276
	if (unlikely(!ab))
		return rc;
E
Eric Paris 已提交
277 278
	audit_log_format(ab, "%s=%d old=%d", function_name, new, old);
	audit_log_session_info(ab);
279 280 281
	rc = audit_log_task_context(ab);
	if (rc)
		allow_changes = 0; /* Something weird, deny request */
282 283
	audit_log_format(ab, " res=%d", allow_changes);
	audit_log_end(ab);
S
Steve Grubb 已提交
284
	return rc;
L
Linus Torvalds 已提交
285 286
}

287
static int audit_do_config_change(char *function_name, int *to_change, int new)
L
Linus Torvalds 已提交
288
{
289
	int allow_changes, rc = 0, old = *to_change;
S
Steve Grubb 已提交
290 291

	/* check if we are locked */
292 293
	if (audit_enabled == AUDIT_LOCKED)
		allow_changes = 0;
S
Steve Grubb 已提交
294
	else
295
		allow_changes = 1;
296

297
	if (audit_enabled != AUDIT_OFF) {
298
		rc = audit_log_config_change(function_name, new, old, allow_changes);
299 300
		if (rc)
			allow_changes = 0;
S
Steve Grubb 已提交
301 302 303
	}

	/* If we are allowed, make the change */
304 305
	if (allow_changes == 1)
		*to_change = new;
S
Steve Grubb 已提交
306 307 308 309
	/* Not allowed, update reason */
	else if (rc == 0)
		rc = -EPERM;
	return rc;
L
Linus Torvalds 已提交
310 311
}

312
static int audit_set_rate_limit(int limit)
L
Linus Torvalds 已提交
313
{
314
	return audit_do_config_change("audit_rate_limit", &audit_rate_limit, limit);
315
}
316

317
static int audit_set_backlog_limit(int limit)
318
{
319
	return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit, limit);
320
}
S
Steve Grubb 已提交
321

322
static int audit_set_enabled(int state)
323
{
324
	int rc;
325 326
	if (state < AUDIT_OFF || state > AUDIT_LOCKED)
		return -EINVAL;
S
Steve Grubb 已提交
327

328
	rc =  audit_do_config_change("audit_enabled", &audit_enabled, state);
329 330 331 332
	if (!rc)
		audit_ever_enabled |= !!state;

	return rc;
L
Linus Torvalds 已提交
333 334
}

335
static int audit_set_failure(int state)
L
Linus Torvalds 已提交
336 337 338 339 340
{
	if (state != AUDIT_FAIL_SILENT
	    && state != AUDIT_FAIL_PRINTK
	    && state != AUDIT_FAIL_PANIC)
		return -EINVAL;
341

342
	return audit_do_config_change("audit_failure", &audit_failure, state);
L
Linus Torvalds 已提交
343 344
}

345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362
/*
 * Queue skbs to be sent to auditd when/if it comes back.  These skbs should
 * already have been sent via prink/syslog and so if these messages are dropped
 * it is not a huge concern since we already passed the audit_log_lost()
 * notification and stuff.  This is just nice to get audit messages during
 * boot before auditd is running or messages generated while auditd is stopped.
 * This only holds messages is audit_default is set, aka booting with audit=1
 * or building your kernel that way.
 */
static void audit_hold_skb(struct sk_buff *skb)
{
	if (audit_default &&
	    skb_queue_len(&audit_skb_hold_queue) < audit_backlog_limit)
		skb_queue_tail(&audit_skb_hold_queue, skb);
	else
		kfree_skb(skb);
}

363 364 365 366 367 368 369
/*
 * For one reason or another this nlh isn't getting delivered to the userspace
 * audit daemon, just send it to printk.
 */
static void audit_printk_skb(struct sk_buff *skb)
{
	struct nlmsghdr *nlh = nlmsg_hdr(skb);
370
	char *data = nlmsg_data(nlh);
371 372 373 374 375 376 377 378 379 380 381

	if (nlh->nlmsg_type != AUDIT_EOE) {
		if (printk_ratelimit())
			printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, data);
		else
			audit_log_lost("printk limit exceeded\n");
	}

	audit_hold_skb(skb);
}

382 383 384 385 386
static void kauditd_send_skb(struct sk_buff *skb)
{
	int err;
	/* take a reference in case we can't send it and we want to hold it */
	skb_get(skb);
387
	err = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
388
	if (err < 0) {
389
		BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
390
		printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
R
Ross Kirk 已提交
391
		audit_log_lost("auditd disappeared\n");
392 393 394 395 396
		audit_pid = 0;
		/* we might get lucky and get this in the next auditd */
		audit_hold_skb(skb);
	} else
		/* drop the extra reference if sent ok */
397
		consume_skb(skb);
398 399
}

400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415
/*
 * flush_hold_queue - empty the hold queue if auditd appears
 *
 * If auditd just started, drain the queue of messages already
 * sent to syslog/printk.  Remember loss here is ok.  We already
 * called audit_log_lost() if it didn't go out normally.  so the
 * race between the skb_dequeue and the next check for audit_pid
 * doesn't matter.
 *
 * If you ever find kauditd to be too slow we can get a perf win
 * by doing our own locking and keeping better track if there
 * are messages in this queue.  I don't see the need now, but
 * in 5 years when I want to play with this again I'll see this
 * note and still have no friggin idea what i'm thinking today.
 */
static void flush_hold_queue(void)
416 417 418
{
	struct sk_buff *skb;

419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438
	if (!audit_default || !audit_pid)
		return;

	skb = skb_dequeue(&audit_skb_hold_queue);
	if (likely(!skb))
		return;

	while (skb && audit_pid) {
		kauditd_send_skb(skb);
		skb = skb_dequeue(&audit_skb_hold_queue);
	}

	/*
	 * if auditd just disappeared but we
	 * dequeued an skb we need to drop ref
	 */
	if (skb)
		consume_skb(skb);
}

A
Adrian Bunk 已提交
439
static int kauditd_thread(void *dummy)
440
{
441
	set_freezable();
A
Andrew Morton 已提交
442
	while (!kthread_should_stop()) {
443 444 445
		struct sk_buff *skb;
		DECLARE_WAITQUEUE(wait, current);

446
		flush_hold_queue();
447

448
		skb = skb_dequeue(&audit_skb_queue);
449
		wake_up(&audit_backlog_wait);
450
		if (skb) {
451 452
			if (audit_pid)
				kauditd_send_skb(skb);
453 454
			else
				audit_printk_skb(skb);
455 456 457 458
			continue;
		}
		set_current_state(TASK_INTERRUPTIBLE);
		add_wait_queue(&kauditd_wait, &wait);
459

460 461 462
		if (!skb_queue_len(&audit_skb_queue)) {
			try_to_freeze();
			schedule();
463
		}
464 465 466

		__set_current_state(TASK_RUNNING);
		remove_wait_queue(&kauditd_wait, &wait);
467
	}
A
Andrew Morton 已提交
468
	return 0;
469 470
}

471 472 473 474 475 476 477
int audit_send_list(void *_dest)
{
	struct audit_netlink_list *dest = _dest;
	int pid = dest->pid;
	struct sk_buff *skb;

	/* wait for parent to finish and send an ACK */
A
Amy Griffis 已提交
478 479
	mutex_lock(&audit_cmd_mutex);
	mutex_unlock(&audit_cmd_mutex);
480 481 482 483 484 485 486 487 488 489

	while ((skb = __skb_dequeue(&dest->q)) != NULL)
		netlink_unicast(audit_sock, skb, pid, 0);

	kfree(dest);

	return 0;
}

struct sk_buff *audit_make_reply(int pid, int seq, int type, int done,
S
Stephen Hemminger 已提交
490
				 int multi, const void *payload, int size)
491 492 493 494 495 496 497
{
	struct sk_buff	*skb;
	struct nlmsghdr	*nlh;
	void		*data;
	int		flags = multi ? NLM_F_MULTI : 0;
	int		t     = done  ? NLMSG_DONE  : type;

498
	skb = nlmsg_new(size, GFP_KERNEL);
499 500 501
	if (!skb)
		return NULL;

502 503 504 505
	nlh	= nlmsg_put(skb, pid, seq, t, size, flags);
	if (!nlh)
		goto out_kfree_skb;
	data = nlmsg_data(nlh);
506 507 508
	memcpy(data, payload, size);
	return skb;

509 510
out_kfree_skb:
	kfree_skb(skb);
511 512 513
	return NULL;
}

514 515 516 517 518 519 520 521 522 523 524 525 526
static int audit_send_reply_thread(void *arg)
{
	struct audit_reply *reply = (struct audit_reply *)arg;

	mutex_lock(&audit_cmd_mutex);
	mutex_unlock(&audit_cmd_mutex);

	/* Ignore failure. It'll only happen if the sender goes away,
	   because our timeout is set to infinite. */
	netlink_unicast(audit_sock, reply->skb, reply->pid, 0);
	kfree(reply);
	return 0;
}
527 528 529 530 531 532 533 534 535 536 537 538 539
/**
 * audit_send_reply - send an audit reply message via netlink
 * @pid: process id to send reply to
 * @seq: sequence number
 * @type: audit message type
 * @done: done (last) flag
 * @multi: multi-part message flag
 * @payload: payload data
 * @size: payload size
 *
 * Allocates an skb, builds the netlink message, and sends it to the pid.
 * No failure notifications.
 */
S
Stephen Hemminger 已提交
540 541
static void audit_send_reply(int pid, int seq, int type, int done, int multi,
			     const void *payload, int size)
L
Linus Torvalds 已提交
542
{
543 544 545 546 547 548 549 550
	struct sk_buff *skb;
	struct task_struct *tsk;
	struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),
					    GFP_KERNEL);

	if (!reply)
		return;

551
	skb = audit_make_reply(pid, seq, type, done, multi, payload, size);
L
Linus Torvalds 已提交
552
	if (!skb)
553
		goto out;
554 555 556 557 558

	reply->pid = pid;
	reply->skb = skb;

	tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
559 560 561 562 563
	if (!IS_ERR(tsk))
		return;
	kfree_skb(skb);
out:
	kfree(reply);
L
Linus Torvalds 已提交
564 565 566 567 568 569
}

/*
 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit
 * control messages.
 */
570
static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
L
Linus Torvalds 已提交
571 572 573
{
	int err = 0;

574 575 576 577 578
	/* Only support the initial namespaces for now. */
	if ((current_user_ns() != &init_user_ns) ||
	    (task_active_pid_ns(current) != &init_pid_ns))
		return -EPERM;

L
Linus Torvalds 已提交
579 580 581 582
	switch (msg_type) {
	case AUDIT_LIST:
	case AUDIT_ADD:
	case AUDIT_DEL:
583 584 585 586 587
		return -EOPNOTSUPP;
	case AUDIT_GET:
	case AUDIT_SET:
	case AUDIT_LIST_RULES:
	case AUDIT_ADD_RULE:
588
	case AUDIT_DEL_RULE:
589
	case AUDIT_SIGNAL_INFO:
M
Miloslav Trmac 已提交
590 591
	case AUDIT_TTY_GET:
	case AUDIT_TTY_SET:
A
Al Viro 已提交
592 593
	case AUDIT_TRIM:
	case AUDIT_MAKE_EQUIV:
594
		if (!capable(CAP_AUDIT_CONTROL))
L
Linus Torvalds 已提交
595 596
			err = -EPERM;
		break;
597
	case AUDIT_USER:
598 599
	case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
	case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
600
		if (!capable(CAP_AUDIT_WRITE))
L
Linus Torvalds 已提交
601 602 603 604 605 606 607 608 609
			err = -EPERM;
		break;
	default:  /* bad msg */
		err = -EINVAL;
	}

	return err;
}

610
static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type)
611 612
{
	int rc = 0;
613
	uid_t uid = from_kuid(&init_user_ns, current_uid());
614 615 616 617 618 619 620

	if (!audit_enabled) {
		*ab = NULL;
		return rc;
	}

	*ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
621 622
	if (unlikely(!*ab))
		return rc;
E
Eric Paris 已提交
623 624
	audit_log_format(*ab, "pid=%d uid=%u", task_tgid_vnr(current), uid);
	audit_log_session_info(*ab);
625
	audit_log_task_context(*ab);
626 627 628 629

	return rc;
}

L
Linus Torvalds 已提交
630 631
static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
{
632
	u32			seq;
L
Linus Torvalds 已提交
633 634 635
	void			*data;
	struct audit_status	*status_get, status_set;
	int			err;
636
	struct audit_buffer	*ab;
L
Linus Torvalds 已提交
637
	u16			msg_type = nlh->nlmsg_type;
638
	struct audit_sig_info   *sig_data;
639
	char			*ctx = NULL;
640
	u32			len;
L
Linus Torvalds 已提交
641

642
	err = audit_netlink_ok(skb, msg_type);
L
Linus Torvalds 已提交
643 644 645
	if (err)
		return err;

646 647
	/* As soon as there's any sign of userspace auditd,
	 * start kauditd to talk to it */
648
	if (!kauditd_task) {
649
		kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
650 651 652 653 654
		if (IS_ERR(kauditd_task)) {
			err = PTR_ERR(kauditd_task);
			kauditd_task = NULL;
			return err;
		}
655
	}
L
Linus Torvalds 已提交
656
	seq  = nlh->nlmsg_seq;
657
	data = nlmsg_data(nlh);
L
Linus Torvalds 已提交
658 659 660 661 662 663 664 665 666

	switch (msg_type) {
	case AUDIT_GET:
		status_set.enabled	 = audit_enabled;
		status_set.failure	 = audit_failure;
		status_set.pid		 = audit_pid;
		status_set.rate_limit	 = audit_rate_limit;
		status_set.backlog_limit = audit_backlog_limit;
		status_set.lost		 = atomic_read(&audit_lost);
667
		status_set.backlog	 = skb_queue_len(&audit_skb_queue);
668
		audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
L
Linus Torvalds 已提交
669 670 671 672 673 674 675
				 &status_set, sizeof(status_set));
		break;
	case AUDIT_SET:
		if (nlh->nlmsg_len < sizeof(struct audit_status))
			return -EINVAL;
		status_get   = (struct audit_status *)data;
		if (status_get->mask & AUDIT_STATUS_ENABLED) {
676
			err = audit_set_enabled(status_get->enabled);
677 678
			if (err < 0)
				return err;
L
Linus Torvalds 已提交
679 680
		}
		if (status_get->mask & AUDIT_STATUS_FAILURE) {
681
			err = audit_set_failure(status_get->failure);
682 683
			if (err < 0)
				return err;
L
Linus Torvalds 已提交
684 685
		}
		if (status_get->mask & AUDIT_STATUS_PID) {
686 687 688
			int new_pid = status_get->pid;

			if (audit_enabled != AUDIT_OFF)
689
				audit_log_config_change("audit_pid", new_pid, audit_pid, 1);
690
			audit_pid = new_pid;
691
			audit_nlk_portid = NETLINK_CB(skb).portid;
L
Linus Torvalds 已提交
692
		}
693
		if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) {
694
			err = audit_set_rate_limit(status_get->rate_limit);
695 696 697
			if (err < 0)
				return err;
		}
L
Linus Torvalds 已提交
698
		if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT)
699
			err = audit_set_backlog_limit(status_get->backlog_limit);
L
Linus Torvalds 已提交
700
		break;
701
	case AUDIT_USER:
702 703
	case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
	case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
704 705 706
		if (!audit_enabled && msg_type != AUDIT_USER_AVC)
			return 0;

707
		err = audit_filter_user(msg_type);
708 709
		if (err == 1) {
			err = 0;
M
Miloslav Trmac 已提交
710
			if (msg_type == AUDIT_USER_TTY) {
711
				err = tty_audit_push_current();
M
Miloslav Trmac 已提交
712 713 714
				if (err)
					break;
			}
715
			audit_log_common_recv_msg(&ab, msg_type);
716
			if (msg_type != AUDIT_USER_TTY)
717 718
				audit_log_format(ab, " msg='%.*s'",
						 AUDIT_MESSAGE_TEXT_MAX,
719 720 721 722
						 (char *)data);
			else {
				int size;

723
				audit_log_format(ab, " data=");
724
				size = nlmsg_len(nlh);
725 726 727
				if (size > 0 &&
				    ((unsigned char *)data)[size - 1] == '\0')
					size--;
728
				audit_log_n_untrustedstring(ab, data, size);
729
			}
730
			audit_set_pid(ab, NETLINK_CB(skb).portid);
731
			audit_log_end(ab);
732
		}
L
Linus Torvalds 已提交
733
		break;
734 735 736 737
	case AUDIT_ADD_RULE:
	case AUDIT_DEL_RULE:
		if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
			return -EINVAL;
738
		if (audit_enabled == AUDIT_LOCKED) {
739 740
			audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
			audit_log_format(ab, " audit_enabled=%d res=0", audit_enabled);
741
			audit_log_end(ab);
S
Steve Grubb 已提交
742 743
			return -EPERM;
		}
744 745
		/* fallthrough */
	case AUDIT_LIST_RULES:
746
		err = audit_receive_filter(msg_type, NETLINK_CB(skb).portid,
747
					   seq, data, nlmsg_len(nlh));
L
Linus Torvalds 已提交
748
		break;
A
Al Viro 已提交
749 750
	case AUDIT_TRIM:
		audit_trim_trees();
751
		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
A
Al Viro 已提交
752 753 754 755 756 757
		audit_log_format(ab, " op=trim res=1");
		audit_log_end(ab);
		break;
	case AUDIT_MAKE_EQUIV: {
		void *bufp = data;
		u32 sizes[2];
758
		size_t msglen = nlmsg_len(nlh);
A
Al Viro 已提交
759 760 761
		char *old, *new;

		err = -EINVAL;
762
		if (msglen < 2 * sizeof(u32))
A
Al Viro 已提交
763 764 765
			break;
		memcpy(sizes, bufp, 2 * sizeof(u32));
		bufp += 2 * sizeof(u32);
766 767
		msglen -= 2 * sizeof(u32);
		old = audit_unpack_string(&bufp, &msglen, sizes[0]);
A
Al Viro 已提交
768 769 770 771
		if (IS_ERR(old)) {
			err = PTR_ERR(old);
			break;
		}
772
		new = audit_unpack_string(&bufp, &msglen, sizes[1]);
A
Al Viro 已提交
773 774 775 776 777 778 779 780
		if (IS_ERR(new)) {
			err = PTR_ERR(new);
			kfree(old);
			break;
		}
		/* OK, here comes... */
		err = audit_tag_tree(old, new);

781
		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
782

A
Al Viro 已提交
783 784 785 786 787 788 789 790 791 792
		audit_log_format(ab, " op=make_equiv old=");
		audit_log_untrustedstring(ab, old);
		audit_log_format(ab, " new=");
		audit_log_untrustedstring(ab, new);
		audit_log_format(ab, " res=%d", !err);
		audit_log_end(ab);
		kfree(old);
		kfree(new);
		break;
	}
793
	case AUDIT_SIGNAL_INFO:
794 795 796 797 798 799
		len = 0;
		if (audit_sig_sid) {
			err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
			if (err)
				return err;
		}
800 801
		sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
		if (!sig_data) {
802 803
			if (audit_sig_sid)
				security_release_secctx(ctx, len);
804 805
			return -ENOMEM;
		}
806
		sig_data->uid = from_kuid(&init_user_ns, audit_sig_uid);
807
		sig_data->pid = audit_sig_pid;
808 809 810 811
		if (audit_sig_sid) {
			memcpy(sig_data->ctx, ctx, len);
			security_release_secctx(ctx, len);
		}
812
		audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_SIGNAL_INFO,
813 814
				0, 0, sig_data, sizeof(*sig_data) + len);
		kfree(sig_data);
815
		break;
M
Miloslav Trmac 已提交
816 817
	case AUDIT_TTY_GET: {
		struct audit_tty_status s;
818 819
		struct task_struct *tsk = current;

820
		spin_lock(&tsk->sighand->siglock);
821
		s.enabled = tsk->signal->audit_tty != 0;
822
		s.log_passwd = tsk->signal->audit_tty_log_passwd;
823
		spin_unlock(&tsk->sighand->siglock);
824

825
		audit_send_reply(NETLINK_CB(skb).portid, seq,
826
				 AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
M
Miloslav Trmac 已提交
827 828 829
		break;
	}
	case AUDIT_TTY_SET: {
830
		struct audit_tty_status s;
831
		struct task_struct *tsk = current;
M
Miloslav Trmac 已提交
832

833 834 835 836 837
		memset(&s, 0, sizeof(s));
		/* guard against past and future API changes */
		memcpy(&s, data, min(sizeof(s), (size_t)nlh->nlmsg_len));
		if ((s.enabled != 0 && s.enabled != 1) ||
		    (s.log_passwd != 0 && s.log_passwd != 1))
M
Miloslav Trmac 已提交
838
			return -EINVAL;
839

840
		spin_lock(&tsk->sighand->siglock);
841 842
		tsk->signal->audit_tty = s.enabled;
		tsk->signal->audit_tty_log_passwd = s.log_passwd;
843
		spin_unlock(&tsk->sighand->siglock);
M
Miloslav Trmac 已提交
844 845
		break;
	}
L
Linus Torvalds 已提交
846 847 848 849 850 851 852 853
	default:
		err = -EINVAL;
		break;
	}

	return err < 0 ? err : 0;
}

854
/*
E
Eric Paris 已提交
855 856
 * Get message from skb.  Each message is processed by audit_receive_msg.
 * Malformed skbs with wrong length are discarded silently.
857
 */
858
static void audit_receive_skb(struct sk_buff *skb)
L
Linus Torvalds 已提交
859
{
E
Eric Paris 已提交
860 861
	struct nlmsghdr *nlh;
	/*
862
	 * len MUST be signed for nlmsg_next to be able to dec it below 0
E
Eric Paris 已提交
863 864 865 866 867 868 869 870
	 * if the nlmsg_len was not aligned
	 */
	int len;
	int err;

	nlh = nlmsg_hdr(skb);
	len = skb->len;

871
	while (nlmsg_ok(nlh, len)) {
E
Eric Paris 已提交
872 873 874
		err = audit_receive_msg(skb, nlh);
		/* if err or if this message says it wants a response */
		if (err || (nlh->nlmsg_flags & NLM_F_ACK))
L
Linus Torvalds 已提交
875
			netlink_ack(skb, nlh, err);
E
Eric Paris 已提交
876

A
Alexandru Copot 已提交
877
		nlh = nlmsg_next(nlh, &len);
L
Linus Torvalds 已提交
878 879 880 881
	}
}

/* Receive messages from netlink socket. */
882
static void audit_receive(struct sk_buff  *skb)
L
Linus Torvalds 已提交
883
{
A
Amy Griffis 已提交
884
	mutex_lock(&audit_cmd_mutex);
885
	audit_receive_skb(skb);
A
Amy Griffis 已提交
886
	mutex_unlock(&audit_cmd_mutex);
L
Linus Torvalds 已提交
887 888 889 890 891
}

/* Initialize audit support at boot time. */
static int __init audit_init(void)
{
A
Amy Griffis 已提交
892
	int i;
893 894 895
	struct netlink_kernel_cfg cfg = {
		.input	= audit_receive,
	};
A
Amy Griffis 已提交
896

897 898 899
	if (audit_initialized == AUDIT_DISABLED)
		return 0;

L
Linus Torvalds 已提交
900 901
	printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
	       audit_default ? "enabled" : "disabled");
902
	audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, &cfg);
L
Linus Torvalds 已提交
903 904
	if (!audit_sock)
		audit_panic("cannot initialize netlink socket");
905 906
	else
		audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
L
Linus Torvalds 已提交
907

908
	skb_queue_head_init(&audit_skb_queue);
909
	skb_queue_head_init(&audit_skb_hold_queue);
910
	audit_initialized = AUDIT_INITIALIZED;
L
Linus Torvalds 已提交
911
	audit_enabled = audit_default;
912
	audit_ever_enabled |= !!audit_default;
913

914
	audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
A
Amy Griffis 已提交
915 916 917 918

	for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
		INIT_LIST_HEAD(&audit_inode_hash[i]);

L
Linus Torvalds 已提交
919 920 921 922 923 924 925 926
	return 0;
}
__initcall(audit_init);

/* Process kernel command-line parameter at boot time.  audit=0 or audit=1. */
static int __init audit_enable(char *str)
{
	audit_default = !!simple_strtol(str, NULL, 0);
927 928 929 930 931 932
	if (!audit_default)
		audit_initialized = AUDIT_DISABLED;

	printk(KERN_INFO "audit: %s", audit_default ? "enabled" : "disabled");

	if (audit_initialized == AUDIT_INITIALIZED) {
L
Linus Torvalds 已提交
933
		audit_enabled = audit_default;
934
		audit_ever_enabled |= !!audit_default;
935 936 937 938
	} else if (audit_initialized == AUDIT_UNINITIALIZED) {
		printk(" (after initialization)");
	} else {
		printk(" (until reboot)");
939
	}
940 941
	printk("\n");

942
	return 1;
L
Linus Torvalds 已提交
943 944 945 946
}

__setup("audit=", audit_enable);

947 948 949 950
static void audit_buffer_free(struct audit_buffer *ab)
{
	unsigned long flags;

951 952 953
	if (!ab)
		return;

954 955
	if (ab->skb)
		kfree_skb(ab->skb);
956

957
	spin_lock_irqsave(&audit_freelist_lock, flags);
S
Serge E. Hallyn 已提交
958
	if (audit_freelist_count > AUDIT_MAXFREE)
959
		kfree(ab);
S
Serge E. Hallyn 已提交
960 961
	else {
		audit_freelist_count++;
962
		list_add(&ab->list, &audit_freelist);
S
Serge E. Hallyn 已提交
963
	}
964 965 966
	spin_unlock_irqrestore(&audit_freelist_lock, flags);
}

967
static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
A
Al Viro 已提交
968
						gfp_t gfp_mask, int type)
969 970 971
{
	unsigned long flags;
	struct audit_buffer *ab = NULL;
972
	struct nlmsghdr *nlh;
973 974 975 976 977 978 979 980 981 982 983

	spin_lock_irqsave(&audit_freelist_lock, flags);
	if (!list_empty(&audit_freelist)) {
		ab = list_entry(audit_freelist.next,
				struct audit_buffer, list);
		list_del(&ab->list);
		--audit_freelist_count;
	}
	spin_unlock_irqrestore(&audit_freelist_lock, flags);

	if (!ab) {
984
		ab = kmalloc(sizeof(*ab), gfp_mask);
985
		if (!ab)
986
			goto err;
987
	}
988

989
	ab->ctx = ctx;
990
	ab->gfp_mask = gfp_mask;
991 992 993

	ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask);
	if (!ab->skb)
994
		goto err;
995

996 997 998
	nlh = nlmsg_put(ab->skb, 0, 0, type, 0, 0);
	if (!nlh)
		goto out_kfree_skb;
999

1000
	return ab;
1001

1002
out_kfree_skb:
1003 1004
	kfree_skb(ab->skb);
	ab->skb = NULL;
1005 1006 1007
err:
	audit_buffer_free(ab);
	return NULL;
1008
}
L
Linus Torvalds 已提交
1009

1010 1011 1012 1013
/**
 * audit_serial - compute a serial number for the audit record
 *
 * Compute a serial number for the audit record.  Audit records are
1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024
 * written to user-space as soon as they are generated, so a complete
 * audit record may be written in several pieces.  The timestamp of the
 * record and this serial number are used by the user-space tools to
 * determine which pieces belong to the same audit record.  The
 * (timestamp,serial) tuple is unique for each syscall and is live from
 * syscall entry to syscall exit.
 *
 * NOTE: Another possibility is to store the formatted records off the
 * audit context (for those records that have a context), and emit them
 * all at syscall exit.  However, this could delay the reporting of
 * significant errors until syscall exit (or never, if the system
1025 1026
 * halts).
 */
1027 1028
unsigned int audit_serial(void)
{
I
Ingo Molnar 已提交
1029
	static DEFINE_SPINLOCK(serial_lock);
1030 1031 1032 1033
	static unsigned int serial = 0;

	unsigned long flags;
	unsigned int ret;
1034

1035
	spin_lock_irqsave(&serial_lock, flags);
1036
	do {
1037 1038
		ret = ++serial;
	} while (unlikely(!ret));
1039
	spin_unlock_irqrestore(&serial_lock, flags);
1040

1041
	return ret;
1042 1043
}

D
Daniel Walker 已提交
1044
static inline void audit_get_stamp(struct audit_context *ctx,
1045 1046
				   struct timespec *t, unsigned int *serial)
{
1047
	if (!ctx || !auditsc_get_stamp(ctx, t, serial)) {
1048 1049 1050 1051 1052
		*t = CURRENT_TIME;
		*serial = audit_serial();
	}
}

1053 1054 1055 1056 1057 1058
/*
 * Wait for auditd to drain the queue a little
 */
static void wait_for_auditd(unsigned long sleep_time)
{
	DECLARE_WAITQUEUE(wait, current);
1059
	set_current_state(TASK_UNINTERRUPTIBLE);
1060 1061 1062 1063 1064 1065 1066 1067 1068 1069
	add_wait_queue(&audit_backlog_wait, &wait);

	if (audit_backlog_limit &&
	    skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
		schedule_timeout(sleep_time);

	__set_current_state(TASK_RUNNING);
	remove_wait_queue(&audit_backlog_wait, &wait);
}

1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084
/**
 * audit_log_start - obtain an audit buffer
 * @ctx: audit_context (may be NULL)
 * @gfp_mask: type of allocation
 * @type: audit message type
 *
 * Returns audit_buffer pointer on success or NULL on error.
 *
 * Obtain an audit buffer.  This routine does locking to obtain the
 * audit buffer, but then no locking is required for calls to
 * audit_log_*format.  If the task (ctx) is a task that is currently in a
 * syscall, then the syscall is marked as auditable and an audit record
 * will be written at syscall exit.  If there is no associated task, then
 * task context (ctx) should be NULL.
 */
A
Al Viro 已提交
1085
struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
1086
				     int type)
L
Linus Torvalds 已提交
1087 1088 1089
{
	struct audit_buffer	*ab	= NULL;
	struct timespec		t;
1090
	unsigned int		uninitialized_var(serial);
1091
	int reserve;
1092
	unsigned long timeout_start = jiffies;
L
Linus Torvalds 已提交
1093

1094
	if (audit_initialized != AUDIT_INITIALIZED)
L
Linus Torvalds 已提交
1095 1096
		return NULL;

1097 1098 1099
	if (unlikely(audit_filter_type(type)))
		return NULL;

1100 1101 1102
	if (gfp_mask & __GFP_WAIT)
		reserve = 0;
	else
D
Daniel Walker 已提交
1103
		reserve = 5; /* Allow atomic callers to go up to five
1104 1105 1106 1107
				entries over the normal backlog limit */

	while (audit_backlog_limit
	       && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
1108 1109
		if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time) {
			unsigned long sleep_time;
1110

1111 1112 1113 1114
			sleep_time = timeout_start + audit_backlog_wait_time -
					jiffies;
			if ((long)sleep_time > 0)
				wait_for_auditd(sleep_time);
1115
			continue;
1116
		}
1117
		if (audit_rate_check() && printk_ratelimit())
1118 1119 1120 1121 1122 1123
			printk(KERN_WARNING
			       "audit: audit_backlog=%d > "
			       "audit_backlog_limit=%d\n",
			       skb_queue_len(&audit_skb_queue),
			       audit_backlog_limit);
		audit_log_lost("backlog limit exceeded");
1124 1125
		audit_backlog_wait_time = audit_backlog_wait_overflow;
		wake_up(&audit_backlog_wait);
1126 1127 1128
		return NULL;
	}

1129
	ab = audit_buffer_alloc(ctx, gfp_mask, type);
L
Linus Torvalds 已提交
1130 1131 1132 1133 1134
	if (!ab) {
		audit_log_lost("out of memory in audit_log_start");
		return NULL;
	}

1135
	audit_get_stamp(ab->ctx, &t, &serial);
1136

L
Linus Torvalds 已提交
1137 1138 1139 1140 1141
	audit_log_format(ab, "audit(%lu.%03lu:%u): ",
			 t.tv_sec, t.tv_nsec/1000000, serial);
	return ab;
}

1142
/**
1143
 * audit_expand - expand skb in the audit buffer
1144
 * @ab: audit_buffer
1145
 * @extra: space to add at tail of the skb
1146 1147 1148 1149
 *
 * Returns 0 (no space) on failed expansion, or available space if
 * successful.
 */
1150
static inline int audit_expand(struct audit_buffer *ab, int extra)
1151
{
1152
	struct sk_buff *skb = ab->skb;
1153 1154 1155 1156
	int oldtail = skb_tailroom(skb);
	int ret = pskb_expand_head(skb, 0, extra, ab->gfp_mask);
	int newtail = skb_tailroom(skb);

1157 1158
	if (ret < 0) {
		audit_log_lost("out of memory in audit_expand");
1159
		return 0;
1160
	}
1161 1162 1163

	skb->truesize += newtail - oldtail;
	return newtail;
1164
}
L
Linus Torvalds 已提交
1165

1166 1167
/*
 * Format an audit message into the audit buffer.  If there isn't enough
L
Linus Torvalds 已提交
1168 1169
 * room in the audit buffer, more room will be allocated and vsnprint
 * will be called a second time.  Currently, we assume that a printk
1170 1171
 * can't format message larger than 1024 bytes, so we don't either.
 */
L
Linus Torvalds 已提交
1172 1173 1174 1175
static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
			      va_list args)
{
	int len, avail;
1176
	struct sk_buff *skb;
D
David Woodhouse 已提交
1177
	va_list args2;
L
Linus Torvalds 已提交
1178 1179 1180 1181

	if (!ab)
		return;

1182 1183 1184 1185
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	if (avail == 0) {
1186
		avail = audit_expand(ab, AUDIT_BUFSIZ);
1187 1188
		if (!avail)
			goto out;
L
Linus Torvalds 已提交
1189
	}
D
David Woodhouse 已提交
1190
	va_copy(args2, args);
1191
	len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args);
L
Linus Torvalds 已提交
1192 1193 1194 1195
	if (len >= avail) {
		/* The printk buffer is 1024 bytes long, so if we get
		 * here and AUDIT_BUFSIZ is at least 1024, then we can
		 * log everything that printk could have logged. */
1196 1197
		avail = audit_expand(ab,
			max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
1198
		if (!avail)
1199
			goto out_va_end;
1200
		len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
L
Linus Torvalds 已提交
1201
	}
1202 1203
	if (len > 0)
		skb_put(skb, len);
1204 1205
out_va_end:
	va_end(args2);
1206 1207
out:
	return;
L
Linus Torvalds 已提交
1208 1209
}

1210 1211 1212 1213 1214 1215 1216 1217
/**
 * audit_log_format - format a message into the audit buffer.
 * @ab: audit_buffer
 * @fmt: format string
 * @...: optional parameters matching @fmt string
 *
 * All the work is done in audit_log_vformat.
 */
L
Linus Torvalds 已提交
1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228
void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
{
	va_list args;

	if (!ab)
		return;
	va_start(args, fmt);
	audit_log_vformat(ab, fmt, args);
	va_end(args);
}

1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239
/**
 * audit_log_hex - convert a buffer to hex and append it to the audit skb
 * @ab: the audit_buffer
 * @buf: buffer to convert to hex
 * @len: length of @buf to be converted
 *
 * No return value; failure to expand is silently ignored.
 *
 * This function will take the passed buf and convert it into a string of
 * ascii hex digits. The new string is placed onto the skb.
 */
1240
void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
1241
		size_t len)
1242
{
1243 1244 1245 1246 1247
	int i, avail, new_len;
	unsigned char *ptr;
	struct sk_buff *skb;
	static const unsigned char *hex = "0123456789ABCDEF";

A
Amy Griffis 已提交
1248 1249 1250
	if (!ab)
		return;

1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	new_len = len<<1;
	if (new_len >= avail) {
		/* Round the buffer request up to the next multiple */
		new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
		avail = audit_expand(ab, new_len);
		if (!avail)
			return;
	}
1262

1263
	ptr = skb_tail_pointer(skb);
1264 1265 1266 1267 1268 1269
	for (i=0; i<len; i++) {
		*ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */
		*ptr++ = hex[buf[i] & 0x0F];	  /* Lower nibble */
	}
	*ptr = 0;
	skb_put(skb, len << 1); /* new string is twice the old string */
1270 1271
}

1272 1273 1274 1275
/*
 * Format a string of no more than slen characters into the audit buffer,
 * enclosed in quote marks.
 */
1276 1277
void audit_log_n_string(struct audit_buffer *ab, const char *string,
			size_t slen)
1278 1279 1280 1281 1282
{
	int avail, new_len;
	unsigned char *ptr;
	struct sk_buff *skb;

A
Amy Griffis 已提交
1283 1284 1285
	if (!ab)
		return;

1286 1287 1288 1289 1290 1291 1292 1293 1294
	BUG_ON(!ab->skb);
	skb = ab->skb;
	avail = skb_tailroom(skb);
	new_len = slen + 3;	/* enclosing quotes + null terminator */
	if (new_len > avail) {
		avail = audit_expand(ab, new_len);
		if (!avail)
			return;
	}
1295
	ptr = skb_tail_pointer(skb);
1296 1297 1298 1299 1300 1301 1302 1303
	*ptr++ = '"';
	memcpy(ptr, string, slen);
	ptr += slen;
	*ptr++ = '"';
	*ptr = 0;
	skb_put(skb, slen + 2);	/* don't include null terminator */
}

1304 1305
/**
 * audit_string_contains_control - does a string need to be logged in hex
1306 1307
 * @string: string to be checked
 * @len: max length of the string to check
1308 1309 1310 1311
 */
int audit_string_contains_control(const char *string, size_t len)
{
	const unsigned char *p;
1312
	for (p = string; p < (const unsigned char *)string + len; p++) {
1313
		if (*p == '"' || *p < 0x21 || *p > 0x7e)
1314 1315 1316 1317 1318
			return 1;
	}
	return 0;
}

1319
/**
M
Miloslav Trmac 已提交
1320
 * audit_log_n_untrustedstring - log a string that may contain random characters
1321
 * @ab: audit_buffer
1322
 * @len: length of string (not including trailing null)
1323 1324 1325 1326
 * @string: string to be logged
 *
 * This code will escape a string that is passed to it if the string
 * contains a control character, unprintable character, double quote mark,
1327
 * or a space. Unescaped strings will start and end with a double quote mark.
1328
 * Strings that are escaped are printed in hex (2 digits per char).
1329 1330 1331
 *
 * The caller specifies the number of characters in the string to log, which may
 * or may not be the entire string.
1332
 */
1333 1334
void audit_log_n_untrustedstring(struct audit_buffer *ab, const char *string,
				 size_t len)
1335
{
1336
	if (audit_string_contains_control(string, len))
1337
		audit_log_n_hex(ab, string, len);
1338
	else
1339
		audit_log_n_string(ab, string, len);
1340 1341
}

1342
/**
M
Miloslav Trmac 已提交
1343
 * audit_log_untrustedstring - log a string that may contain random characters
1344 1345 1346
 * @ab: audit_buffer
 * @string: string to be logged
 *
M
Miloslav Trmac 已提交
1347
 * Same as audit_log_n_untrustedstring(), except that strlen is used to
1348 1349
 * determine string length.
 */
1350
void audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
1351
{
1352
	audit_log_n_untrustedstring(ab, string, strlen(string));
1353 1354
}

1355
/* This is a helper-function to print the escaped d_path */
L
Linus Torvalds 已提交
1356
void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
1357
		      const struct path *path)
L
Linus Torvalds 已提交
1358
{
1359
	char *p, *pathname;
L
Linus Torvalds 已提交
1360

1361
	if (prefix)
1362
		audit_log_format(ab, "%s", prefix);
L
Linus Torvalds 已提交
1363

1364
	/* We will allow 11 spaces for ' (deleted)' to be appended */
1365 1366
	pathname = kmalloc(PATH_MAX+11, ab->gfp_mask);
	if (!pathname) {
1367
		audit_log_string(ab, "<no_memory>");
1368
		return;
L
Linus Torvalds 已提交
1369
	}
1370
	p = d_path(path, pathname, PATH_MAX+11);
1371 1372
	if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */
		/* FIXME: can we save some information here? */
1373
		audit_log_string(ab, "<too_long>");
D
Daniel Walker 已提交
1374
	} else
1375
		audit_log_untrustedstring(ab, p);
1376
	kfree(pathname);
L
Linus Torvalds 已提交
1377 1378
}

E
Eric Paris 已提交
1379 1380 1381 1382 1383
void audit_log_session_info(struct audit_buffer *ab)
{
	u32 sessionid = audit_get_sessionid(current);
	uid_t auid = from_kuid(&init_user_ns, audit_get_loginuid(current));

1384
	audit_log_format(ab, " auid=%u ses=%u", auid, sessionid);
E
Eric Paris 已提交
1385 1386
}

1387 1388 1389 1390 1391 1392 1393 1394 1395
void audit_log_key(struct audit_buffer *ab, char *key)
{
	audit_log_format(ab, " key=");
	if (key)
		audit_log_untrustedstring(ab, key);
	else
		audit_log_format(ab, "(null)");
}

1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613
void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap)
{
	int i;

	audit_log_format(ab, " %s=", prefix);
	CAP_FOR_EACH_U32(i) {
		audit_log_format(ab, "%08x",
				 cap->cap[(_KERNEL_CAPABILITY_U32S-1) - i]);
	}
}

void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
{
	kernel_cap_t *perm = &name->fcap.permitted;
	kernel_cap_t *inh = &name->fcap.inheritable;
	int log = 0;

	if (!cap_isclear(*perm)) {
		audit_log_cap(ab, "cap_fp", perm);
		log = 1;
	}
	if (!cap_isclear(*inh)) {
		audit_log_cap(ab, "cap_fi", inh);
		log = 1;
	}

	if (log)
		audit_log_format(ab, " cap_fe=%d cap_fver=%x",
				 name->fcap.fE, name->fcap_ver);
}

static inline int audit_copy_fcaps(struct audit_names *name,
				   const struct dentry *dentry)
{
	struct cpu_vfs_cap_data caps;
	int rc;

	if (!dentry)
		return 0;

	rc = get_vfs_caps_from_disk(dentry, &caps);
	if (rc)
		return rc;

	name->fcap.permitted = caps.permitted;
	name->fcap.inheritable = caps.inheritable;
	name->fcap.fE = !!(caps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
	name->fcap_ver = (caps.magic_etc & VFS_CAP_REVISION_MASK) >>
				VFS_CAP_REVISION_SHIFT;

	return 0;
}

/* Copy inode data into an audit_names. */
void audit_copy_inode(struct audit_names *name, const struct dentry *dentry,
		      const struct inode *inode)
{
	name->ino   = inode->i_ino;
	name->dev   = inode->i_sb->s_dev;
	name->mode  = inode->i_mode;
	name->uid   = inode->i_uid;
	name->gid   = inode->i_gid;
	name->rdev  = inode->i_rdev;
	security_inode_getsecid(inode, &name->osid);
	audit_copy_fcaps(name, dentry);
}

/**
 * audit_log_name - produce AUDIT_PATH record from struct audit_names
 * @context: audit_context for the task
 * @n: audit_names structure with reportable details
 * @path: optional path to report instead of audit_names->name
 * @record_num: record number to report when handling a list of names
 * @call_panic: optional pointer to int that will be updated if secid fails
 */
void audit_log_name(struct audit_context *context, struct audit_names *n,
		    struct path *path, int record_num, int *call_panic)
{
	struct audit_buffer *ab;
	ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
	if (!ab)
		return;

	audit_log_format(ab, "item=%d", record_num);

	if (path)
		audit_log_d_path(ab, " name=", path);
	else if (n->name) {
		switch (n->name_len) {
		case AUDIT_NAME_FULL:
			/* log the full path */
			audit_log_format(ab, " name=");
			audit_log_untrustedstring(ab, n->name->name);
			break;
		case 0:
			/* name was specified as a relative path and the
			 * directory component is the cwd */
			audit_log_d_path(ab, " name=", &context->pwd);
			break;
		default:
			/* log the name's directory component */
			audit_log_format(ab, " name=");
			audit_log_n_untrustedstring(ab, n->name->name,
						    n->name_len);
		}
	} else
		audit_log_format(ab, " name=(null)");

	if (n->ino != (unsigned long)-1) {
		audit_log_format(ab, " inode=%lu"
				 " dev=%02x:%02x mode=%#ho"
				 " ouid=%u ogid=%u rdev=%02x:%02x",
				 n->ino,
				 MAJOR(n->dev),
				 MINOR(n->dev),
				 n->mode,
				 from_kuid(&init_user_ns, n->uid),
				 from_kgid(&init_user_ns, n->gid),
				 MAJOR(n->rdev),
				 MINOR(n->rdev));
	}
	if (n->osid != 0) {
		char *ctx = NULL;
		u32 len;
		if (security_secid_to_secctx(
			n->osid, &ctx, &len)) {
			audit_log_format(ab, " osid=%u", n->osid);
			if (call_panic)
				*call_panic = 2;
		} else {
			audit_log_format(ab, " obj=%s", ctx);
			security_release_secctx(ctx, len);
		}
	}

	audit_log_fcaps(ab, n);
	audit_log_end(ab);
}

int audit_log_task_context(struct audit_buffer *ab)
{
	char *ctx = NULL;
	unsigned len;
	int error;
	u32 sid;

	security_task_getsecid(current, &sid);
	if (!sid)
		return 0;

	error = security_secid_to_secctx(sid, &ctx, &len);
	if (error) {
		if (error != -EINVAL)
			goto error_path;
		return 0;
	}

	audit_log_format(ab, " subj=%s", ctx);
	security_release_secctx(ctx, len);
	return 0;

error_path:
	audit_panic("error in audit_log_task_context");
	return error;
}
EXPORT_SYMBOL(audit_log_task_context);

void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
{
	const struct cred *cred;
	char name[sizeof(tsk->comm)];
	struct mm_struct *mm = tsk->mm;
	char *tty;

	if (!ab)
		return;

	/* tsk == current */
	cred = current_cred();

	spin_lock_irq(&tsk->sighand->siglock);
	if (tsk->signal && tsk->signal->tty && tsk->signal->tty->name)
		tty = tsk->signal->tty->name;
	else
		tty = "(none)";
	spin_unlock_irq(&tsk->sighand->siglock);

	audit_log_format(ab,
			 " ppid=%ld pid=%d auid=%u uid=%u gid=%u"
			 " euid=%u suid=%u fsuid=%u"
			 " egid=%u sgid=%u fsgid=%u ses=%u tty=%s",
			 sys_getppid(),
			 tsk->pid,
			 from_kuid(&init_user_ns, audit_get_loginuid(tsk)),
			 from_kuid(&init_user_ns, cred->uid),
			 from_kgid(&init_user_ns, cred->gid),
			 from_kuid(&init_user_ns, cred->euid),
			 from_kuid(&init_user_ns, cred->suid),
			 from_kuid(&init_user_ns, cred->fsuid),
			 from_kgid(&init_user_ns, cred->egid),
			 from_kgid(&init_user_ns, cred->sgid),
			 from_kgid(&init_user_ns, cred->fsgid),
			 audit_get_sessionid(tsk), tty);

	get_task_comm(name, tsk);
	audit_log_format(ab, " comm=");
	audit_log_untrustedstring(ab, name);

	if (mm) {
		down_read(&mm->mmap_sem);
		if (mm->exe_file)
			audit_log_d_path(ab, " exe=", &mm->exe_file->f_path);
		up_read(&mm->mmap_sem);
	}
	audit_log_task_context(ab);
}
EXPORT_SYMBOL(audit_log_task_info);

1614 1615 1616 1617 1618 1619 1620 1621
/**
 * audit_log_link_denied - report a link restriction denial
 * @operation: specific link opreation
 * @link: the path that triggered the restriction
 */
void audit_log_link_denied(const char *operation, struct path *link)
{
	struct audit_buffer *ab;
1622 1623 1624 1625 1626
	struct audit_names *name;

	name = kzalloc(sizeof(*name), GFP_NOFS);
	if (!name)
		return;
1627

1628
	/* Generate AUDIT_ANOM_LINK with subject, operation, outcome. */
1629 1630
	ab = audit_log_start(current->audit_context, GFP_KERNEL,
			     AUDIT_ANOM_LINK);
1631
	if (!ab)
1632 1633 1634 1635
		goto out;
	audit_log_format(ab, "op=%s", operation);
	audit_log_task_info(ab, current);
	audit_log_format(ab, " res=0");
1636
	audit_log_end(ab);
1637 1638 1639 1640 1641 1642 1643

	/* Generate AUDIT_PATH record with object. */
	name->type = AUDIT_TYPE_NORMAL;
	audit_copy_inode(name, link->dentry, link->dentry->d_inode);
	audit_log_name(current->audit_context, name, link, 0, NULL);
out:
	kfree(name);
1644 1645
}

1646 1647 1648 1649 1650 1651
/**
 * audit_log_end - end one audit record
 * @ab: the audit_buffer
 *
 * The netlink_* functions cannot be called inside an irq context, so
 * the audit buffer is placed on a queue and a tasklet is scheduled to
L
Linus Torvalds 已提交
1652
 * remove them from the queue outside the irq context.  May be called in
1653 1654
 * any context.
 */
1655
void audit_log_end(struct audit_buffer *ab)
L
Linus Torvalds 已提交
1656 1657 1658 1659 1660 1661
{
	if (!ab)
		return;
	if (!audit_rate_check()) {
		audit_log_lost("rate limit exceeded");
	} else {
1662
		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
1663
		nlh->nlmsg_len = ab->skb->len - NLMSG_HDRLEN;
1664

1665 1666 1667
		if (audit_pid) {
			skb_queue_tail(&audit_skb_queue, ab->skb);
			wake_up_interruptible(&kauditd_wait);
1668
		} else {
1669
			audit_printk_skb(ab->skb);
1670
		}
1671
		ab->skb = NULL;
L
Linus Torvalds 已提交
1672
	}
1673
	audit_buffer_free(ab);
L
Linus Torvalds 已提交
1674 1675
}

1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687
/**
 * audit_log - Log an audit record
 * @ctx: audit context
 * @gfp_mask: type of allocation
 * @type: audit message type
 * @fmt: format string to use
 * @...: variable parameters matching the format string
 *
 * This is a convenience function that calls audit_log_start,
 * audit_log_vformat, and audit_log_end.  It may be called
 * in any context.
 */
D
Daniel Walker 已提交
1688
void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
1689
	       const char *fmt, ...)
L
Linus Torvalds 已提交
1690 1691 1692 1693
{
	struct audit_buffer *ab;
	va_list args;

1694
	ab = audit_log_start(ctx, gfp_mask, type);
L
Linus Torvalds 已提交
1695 1696 1697 1698 1699 1700 1701
	if (ab) {
		va_start(args, fmt);
		audit_log_vformat(ab, fmt, args);
		va_end(args);
		audit_log_end(ab);
	}
}
1702

1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728
#ifdef CONFIG_SECURITY
/**
 * audit_log_secctx - Converts and logs SELinux context
 * @ab: audit_buffer
 * @secid: security number
 *
 * This is a helper function that calls security_secid_to_secctx to convert
 * secid to secctx and then adds the (converted) SELinux context to the audit
 * log by calling audit_log_format, thus also preventing leak of internal secid
 * to userspace. If secid cannot be converted audit_panic is called.
 */
void audit_log_secctx(struct audit_buffer *ab, u32 secid)
{
	u32 len;
	char *secctx;

	if (security_secid_to_secctx(secid, &secctx, &len)) {
		audit_panic("Cannot convert secid to context");
	} else {
		audit_log_format(ab, " obj=%s", secctx);
		security_release_secctx(secctx, len);
	}
}
EXPORT_SYMBOL(audit_log_secctx);
#endif

1729 1730 1731 1732
EXPORT_SYMBOL(audit_log_start);
EXPORT_SYMBOL(audit_log_end);
EXPORT_SYMBOL(audit_log_format);
EXPORT_SYMBOL(audit_log);