/* * AppArmor security module * * This file contains AppArmor auditing functions * * Copyright (C) 1998-2008 Novell/SUSE * Copyright 2009-2010 Canonical Ltd. * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License as * published by the Free Software Foundation, version 2 of the * License. */ #include <linux/audit.h>#include <linux/socket.h> #include "include/apparmor.h"#include "include/audit.h"#include "include/policy.h" const char *const op_table[] = {	"null", 	"sysctl",	"capable", 	"unlink",	"mkdir",	"rmdir",	"mknod",	"truncate",	"link",	"symlink",	"rename_src",	"rename_dest",	"chmod",	"chown",	"getattr",	"open", 	"file_perm",	"file_lock",	"file_mmap",	"file_mprotect", 	"create",	"post_create",	"bind",	"connect",	"listen",	"accept",	"sendmsg",	"recvmsg",	"getsockname",	"getpeername",	"getsockopt",	"setsockopt",	"socket_shutdown", 	"ptrace", 	"exec",	"change_hat",	"change_profile",	"change_onexec", 	"setprocattr",	"setrlimit", 	"profile_replace",	"profile_load",	"profile_remove"}; const char *const audit_mode_names[] = {	"normal",	"quiet_denied",	"quiet",	"noquiet",	"all"}; static const char *const aa_audit_type[] = {	"AUDIT",	"ALLOWED",	"DENIED",	"HINT",	"STATUS",	"ERROR",	"KILLED"	"AUTO"}; /* * Currently AppArmor auditing is fed straight into the audit framework. * * TODO: * netlink interface for complain mode * user auditing, - send user auditing to netlink interface * system control of whether user audit messages go to system log */ /** * audit_base - core AppArmor function. * @ab: audit buffer to fill (NOT NULL) * @ca: audit structure containing data to audit (NOT NULL) * * Record common AppArmor audit data from @sa */static void audit_pre(struct audit_buffer *ab, void *ca){	struct common_audit_data *sa = ca;	struct task_struct *tsk = sa->aad->tsk ? sa->aad->tsk : current; 	if (aa_g_audit_header) {		audit_log_format(ab, "apparmor=");		audit_log_string(ab, aa_audit_type[sa->aad->type]);	} 	if (sa->aad->op) {		audit_log_format(ab, " operation=");		audit_log_string(ab, op_table[sa->aad->op]);	} 	if (sa->aad->info) {		audit_log_format(ab, " info=");		audit_log_string(ab, sa->aad->info);		if (sa->aad->error)			audit_log_format(ab, " error=%d", sa->aad->error);	} 	if (sa->aad->profile) {		struct aa_profile *profile = sa->aad->profile;		pid_t pid;		rcu_read_lock();		pid = rcu_dereference(tsk->real_parent)->pid;		rcu_read_unlock();		audit_log_format(ab, " parent=%d", pid);		if (profile->ns != root_ns) {			audit_log_format(ab, " namespace=");			audit_log_untrustedstring(ab, profile->ns->base.hname);		}		audit_log_format(ab, " profile=");		audit_log_untrustedstring(ab, profile->base.hname);	} 	if (sa->aad->name) {		audit_log_format(ab, " name=");		audit_log_untrustedstring(ab, sa->aad->name);	} 	if (sa->aad->tsk) {		audit_log_format(ab, " pid=%d comm=", tsk->pid);		audit_log_untrustedstring(ab, tsk->comm);	} } /** * aa_audit_msg - Log a message to the audit subsystem * @sa: audit event structure (NOT NULL) * @cb: optional callback fn for type specific fields (MAYBE NULL) */void aa_audit_msg(int type, struct common_audit_data *sa,		  void (*cb) (struct audit_buffer *, void *)){	sa->aad->type = type;	common_lsm_audit(sa, audit_pre, cb);} /** * aa_audit - Log a profile based audit event to the audit subsystem * @type: audit type for the message * @profile: profile to check against (NOT NULL) * @gfp: allocation flags to use * @sa: audit event (NOT NULL) * @cb: optional callback fn for type specific fields (MAYBE NULL) * * Handle default message switching based off of audit mode flags * * Returns: error on failure */int aa_audit(int type, struct aa_profile *profile, gfp_t gfp,	     struct common_audit_data *sa,	     void (*cb) (struct audit_buffer *, void *)){	BUG_ON(!profile); 	if (type == AUDIT_APPARMOR_AUTO) {		if (likely(!sa->aad->error)) {			if (AUDIT_MODE(profile) != AUDIT_ALL)				return 0;			type = AUDIT_APPARMOR_AUDIT;		} else if (COMPLAIN_MODE(profile))			type = AUDIT_APPARMOR_ALLOWED;		else			type = AUDIT_APPARMOR_DENIED;	}	if (AUDIT_MODE(profile) == AUDIT_QUIET ||	    (type == AUDIT_APPARMOR_DENIED &&	     AUDIT_MODE(profile) == AUDIT_QUIET))		return sa->aad->error; 	if (KILL_MODE(profile) && type == AUDIT_APPARMOR_DENIED)		type = AUDIT_APPARMOR_KILL; 	if (!unconfined(profile))		sa->aad->profile = profile; 	aa_audit_msg(type, sa, cb); 	if (sa->aad->type == AUDIT_APPARMOR_KILL)		(void)send_sig_info(SIGKILL, NULL,				    sa->aad->tsk ?  sa->aad->tsk : current); 	if (sa->aad->type == AUDIT_APPARMOR_ALLOWED)		return complain_error(sa->aad->error); 	return sa->aad->error;}