/* auditsc.c -- System-call auditing support * Handles all system-call specific auditing features. * * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina. * Copyright 2005 Hewlett-Packard Development Company, L.P. * Copyright (C) 2005, 2006 IBM Corporation * All Rights Reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA * * Written by Rickard E. (Rik) Faith <faith@redhat.com> * * Many of the ideas implemented here are from Stephen C. Tweedie, * especially the idea of avoiding a copy by using getname. * * The method for actual interception of syscall entry and exit (not in * this file -- see entry.S) is based on a GPL'd patch written by * okir@suse.de and Copyright 2003 SuSE Linux AG. * * POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>, * 2006. * * The support of additional filter rules compares (>, <, >=, <=) was * added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005. * * Modified by Amy Griffis <amy.griffis@hp.com> to collect additional * filesystem information. * * Subject and object context labeling support added by <danjones@us.ibm.com> * and <dustin.kirkland@us.ibm.com> for LSPP certification compliance. */ #include <linux/init.h>#include <asm/types.h>#include <asm/atomic.h>#include <asm/types.h>#include <linux/fs.h>#include <linux/namei.h>#include <linux/mm.h>#include <linux/module.h>#include <linux/mount.h>#include <linux/socket.h>#include <linux/mqueue.h>#include <linux/audit.h>#include <linux/personality.h>#include <linux/time.h>#include <linux/netlink.h>#include <linux/compiler.h>#include <asm/unistd.h>#include <linux/security.h>#include <linux/list.h>#include <linux/tty.h>#include <linux/selinux.h>#include <linux/binfmts.h>#include <linux/syscalls.h> #include "audit.h" extern struct list_head audit_filter_list[]; /* No syscall auditing will take place unless audit_enabled != 0. */extern int audit_enabled; /* AUDIT_NAMES is the number of slots we reserve in the audit_context * for saving names from getname(). */#define AUDIT_NAMES    20 /* AUDIT_NAMES_RESERVED is the number of slots we reserve in the * audit_context from being used for nameless inodes from * path_lookup. */#define AUDIT_NAMES_RESERVED 7 /* Indicates that audit should log the full pathname. */#define AUDIT_NAME_FULL -1 /* When fs/namei.c:getname() is called, we store the pointer in name and * we don't let putname() free it (instead we free all of the saved * pointers at syscall exit time). * * Further, in fs/namei.c:path_lookup() we store the inode and device. */struct audit_names {	const char	*name;	int		name_len;	/* number of name's characters to log */	unsigned	name_put;	/* call __putname() for this name */	unsigned long	ino;	dev_t		dev;	umode_t		mode;	uid_t		uid;	gid_t		gid;	dev_t		rdev;	u32		osid;}; struct audit_aux_data {	struct audit_aux_data	*next;	int			type;}; #define AUDIT_AUX_IPCPERM	0 struct audit_aux_data_mq_open {	struct audit_aux_data	d;	int			oflag;	mode_t			mode;	struct mq_attr		attr;}; struct audit_aux_data_mq_sendrecv {	struct audit_aux_data	d;	mqd_t			mqdes;	size_t			msg_len;	unsigned int		msg_prio;	struct timespec		abs_timeout;}; struct audit_aux_data_mq_notify {	struct audit_aux_data	d;	mqd_t			mqdes;	struct sigevent 	notification;}; struct audit_aux_data_mq_getsetattr {	struct audit_aux_data	d;	mqd_t			mqdes;	struct mq_attr 		mqstat;}; struct audit_aux_data_ipcctl {	struct audit_aux_data	d;	struct ipc_perm		p;	unsigned long		qbytes;	uid_t			uid;	gid_t			gid;	mode_t			mode;	u32			osid;}; struct audit_aux_data_execve {	struct audit_aux_data	d;	int argc;	int envc;	char mem[0];}; struct audit_aux_data_socketcall {	struct audit_aux_data	d;	int			nargs;	unsigned long		args[0];}; struct audit_aux_data_sockaddr {	struct audit_aux_data	d;	int			len;	char			a[0];}; struct audit_aux_data_path {	struct audit_aux_data	d;	struct dentry		*dentry;	struct vfsmount		*mnt;}; /* The per-task audit context. */struct audit_context {	int		    in_syscall;	/* 1 if task is in a syscall */	enum audit_state    state;	unsigned int	    serial;     /* serial number for record */	struct timespec	    ctime;      /* time of syscall entry */	uid_t		    loginuid;   /* login uid (identity) */	int		    major;      /* syscall number */	unsigned long	    argv[4];    /* syscall arguments */	int		    return_valid; /* return code is valid */	long		    return_code;/* syscall return code */	int		    auditable;  /* 1 if record should be written */	int		    name_count;	struct audit_names  names[AUDIT_NAMES];	struct dentry *	    pwd;	struct vfsmount *   pwdmnt;	struct audit_context *previous; /* For nested syscalls */	struct audit_aux_data *aux; 				/* Save things to print about task_struct */	pid_t		    pid, ppid;	uid_t		    uid, euid, suid, fsuid;	gid_t		    gid, egid, sgid, fsgid;	unsigned long	    personality;	int		    arch; #if AUDIT_DEBUG	int		    put_count;	int		    ino_count;#endif}; /* Determine if any context name data matches a rule's watch data *//* Compare a task_struct with an audit_rule.  Return 1 on match, 0 * otherwise. */static int audit_filter_rules(struct task_struct *tsk,			      struct audit_krule *rule,			      struct audit_context *ctx,			      struct audit_names *name,			      enum audit_state *state){	int i, j, need_sid = 1;	u32 sid; 	for (i = 0; i < rule->field_count; i++) {		struct audit_field *f = &rule->fields[i];		int result = 0; 		switch (f->type) {		case AUDIT_PID:			result = audit_comparator(tsk->pid, f->op, f->val);			break;		case AUDIT_PPID:			if (ctx)				result = audit_comparator(ctx->ppid, f->op, f->val);			break;		case AUDIT_UID:			result = audit_comparator(tsk->uid, f->op, f->val);			break;		case AUDIT_EUID:			result = audit_comparator(tsk->euid, f->op, f->val);			break;		case AUDIT_SUID:			result = audit_comparator(tsk->suid, f->op, f->val);			break;		case AUDIT_FSUID:			result = audit_comparator(tsk->fsuid, f->op, f->val);			break;		case AUDIT_GID:			result = audit_comparator(tsk->gid, f->op, f->val);			break;		case AUDIT_EGID:			result = audit_comparator(tsk->egid, f->op, f->val);			break;		case AUDIT_SGID:			result = audit_comparator(tsk->sgid, f->op, f->val);			break;		case AUDIT_FSGID:			result = audit_comparator(tsk->fsgid, f->op, f->val);			break;		case AUDIT_PERS:			result = audit_comparator(tsk->personality, f->op, f->val);			break;		case AUDIT_ARCH: 			if (ctx)				result = audit_comparator(ctx->arch, f->op, f->val);			break; 		case AUDIT_EXIT:			if (ctx && ctx->return_valid)				result = audit_comparator(ctx->return_code, f->op, f->val);			break;		case AUDIT_SUCCESS:			if (ctx && ctx->return_valid) {				if (f->val)					result = audit_comparator(ctx->return_valid, f->op, AUDITSC_SUCCESS);				else					result = audit_comparator(ctx->return_valid, f->op, AUDITSC_FAILURE);			}			break;		case AUDIT_DEVMAJOR:			if (name)				result = audit_comparator(MAJOR(name->dev),							  f->op, f->val);			else if (ctx) {				for (j = 0; j < ctx->name_count; j++) {					if (audit_comparator(MAJOR(ctx->names[j].dev),	f->op, f->val)) {						++result;						break;					}				}			}			break;		case AUDIT_DEVMINOR:			if (name)				result = audit_comparator(MINOR(name->dev),							  f->op, f->val);			else if (ctx) {				for (j = 0; j < ctx->name_count; j++) {					if (audit_comparator(MINOR(ctx->names[j].dev), f->op, f->val)) {						++result;						break;					}				}			}			break;		case AUDIT_INODE:			if (name)				result = (name->ino == f->val);			else if (ctx) {				for (j = 0; j < ctx->name_count; j++) {					if (audit_comparator(ctx->names[j].ino, f->op, f->val)) {						++result;						break;					}				}			}			break;		case AUDIT_WATCH:			if (name && rule->watch->ino != (unsigned long)-1)				result = (name->dev == rule->watch->dev &&					  name->ino == rule->watch->ino);			break;		case AUDIT_LOGINUID:			result = 0;			if (ctx)				result = audit_comparator(ctx->loginuid, f->op, f->val);			break;		case AUDIT_SE_USER:		case AUDIT_SE_ROLE:		case AUDIT_SE_TYPE:		case AUDIT_SE_SEN:		case AUDIT_SE_CLR:			/* NOTE: this may return negative values indicating			   a temporary error.  We simply treat this as a			   match for now to avoid losing information that			   may be wanted.   An error message will also be			   logged upon error */			if (f->se_rule) {				if (need_sid) {					selinux_task_ctxid(tsk, &sid);					need_sid = 0;				}				result = selinux_audit_rule_match(sid, f->type,				                                  f->op,				                                  f->se_rule,				                                  ctx);			}			break;		case AUDIT_ARG0:		case AUDIT_ARG1:		case AUDIT_ARG2:		case AUDIT_ARG3:			if (ctx)				result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);			break;		} 		if (!result)			return 0;	}	switch (rule->action) {	case AUDIT_NEVER:    *state = AUDIT_DISABLED;	    break;	case AUDIT_ALWAYS:   *state = AUDIT_RECORD_CONTEXT; break;	}	return 1;} /* At process creation time, we can determine if system-call auditing is * completely disabled for this task.  Since we only have the task * structure at this point, we can only check uid and gid. */static enum audit_state audit_filter_task(struct task_struct *tsk){	struct audit_entry *e;	enum audit_state   state; 	rcu_read_lock();	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {		if (audit_filter_rules(tsk, &e->rule, NULL, NULL, &state)) {			rcu_read_unlock();			return state;		}	}	rcu_read_unlock();	return AUDIT_BUILD_CONTEXT;} /* At syscall entry and exit time, this filter is called if the * audit_state is not low enough that auditing cannot take place, but is * also not high enough that we already know we have to write an audit * record (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT). */static enum audit_state audit_filter_syscall(struct task_struct *tsk,					     struct audit_context *ctx,					     struct list_head *list){	struct audit_entry *e;	enum audit_state state; 	if (audit_pid && tsk->tgid == audit_pid)		return AUDIT_DISABLED; 	rcu_read_lock();	if (!list_empty(list)) {		int word = AUDIT_WORD(ctx->major);		int bit  = AUDIT_BIT(ctx->major); 		list_for_each_entry_rcu(e, list, list) {			if ((e->rule.mask[word] & bit) == bit &&			    audit_filter_rules(tsk, &e->rule, ctx, NULL,					       &state)) {				rcu_read_unlock();				return state;			}		}	}	rcu_read_unlock();	return AUDIT_BUILD_CONTEXT;} /* At syscall exit time, this filter is called if any audit_names[] have been * collected during syscall processing.  We only check rules in sublists at hash * buckets applicable to the inode numbers in audit_names[]. * Regarding audit_state, same rules apply as for audit_filter_syscall(). */enum audit_state audit_filter_inodes(struct task_struct *tsk,				     struct audit_context *ctx){	int i;	struct audit_entry *e;	enum audit_state state; 	if (audit_pid && tsk->tgid == audit_pid)		return AUDIT_DISABLED; 	rcu_read_lock();	for (i = 0; i < ctx->name_count; i++) {		int word = AUDIT_WORD(ctx->major);		int bit  = AUDIT_BIT(ctx->major);		struct audit_names *n = &ctx->names[i];		int h = audit_hash_ino((u32)n->ino);		struct list_head *list = &audit_inode_hash[h]; 		if (list_empty(list))			continue; 		list_for_each_entry_rcu(e, list, list) {			if ((e->rule.mask[word] & bit) == bit &&			    audit_filter_rules(tsk, &e->rule, ctx, n, &state)) {				rcu_read_unlock();				return state;			}		}	}	rcu_read_unlock();	return AUDIT_BUILD_CONTEXT;} void audit_set_auditable(struct audit_context *ctx){	ctx->auditable = 1;} static inline struct audit_context *audit_get_context(struct task_struct *tsk,						      int return_valid,						      int return_code){	struct audit_context *context = tsk->audit_context; 	if (likely(!context))		return NULL;	context->return_valid = return_valid;	context->return_code  = return_code; 	if (context->in_syscall && !context->auditable) {		enum audit_state state; 		state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);		if (state == AUDIT_RECORD_CONTEXT) {			context->auditable = 1;			goto get_context;		} 		state = audit_filter_inodes(tsk, context);		if (state == AUDIT_RECORD_CONTEXT)			context->auditable = 1; 	} get_context:	context->pid = tsk->pid;	context->ppid = sys_getppid();	/* sic.  tsk == current in all cases */	context->uid = tsk->uid;	context->gid = tsk->gid;	context->euid = tsk->euid;	context->suid = tsk->suid;	context->fsuid = tsk->fsuid;	context->egid = tsk->egid;	context->sgid = tsk->sgid;	context->fsgid = tsk->fsgid;	context->personality = tsk->personality;	tsk->audit_context = NULL;	return context;} 

Lines 1–500 of 1727. Load more