/* auditsc.c -- System-call auditing support * Handles all system-call specific auditing features. * * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina. * All Rights Reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA * * Written by Rickard E. (Rik) Faith <faith@redhat.com> * * Many of the ideas implemented here are from Stephen C. Tweedie, * especially the idea of avoiding a copy by using getname. * * The method for actual interception of syscall entry and exit (not in * this file -- see entry.S) is based on a GPL'd patch written by * okir@suse.de and Copyright 2003 SuSE Linux AG. * */ #include <linux/init.h>#include <asm/atomic.h>#include <asm/types.h>#include <linux/mm.h>#include <linux/module.h>#include <linux/mount.h>#include <linux/socket.h>#include <linux/audit.h>#include <linux/personality.h>#include <linux/time.h>#include <asm/unistd.h> /* 0 = no checking 1 = put_count checking 2 = verbose put_count checking*/#define AUDIT_DEBUG 0 /* No syscall auditing will take place unless audit_enabled != 0. */extern int audit_enabled; /* AUDIT_NAMES is the number of slots we reserve in the audit_context * for saving names from getname(). */#define AUDIT_NAMES 20 /* AUDIT_NAMES_RESERVED is the number of slots we reserve in the * audit_context from being used for nameless inodes from * path_lookup. */#define AUDIT_NAMES_RESERVED 7 /* At task start time, the audit_state is set in the audit_context using a per-task filter. At syscall entry, the audit_state is augmented by the syscall filter. */enum audit_state { AUDIT_DISABLED, /* Do not create per-task audit_context. * No syscall-specific audit records can * be generated. */ AUDIT_SETUP_CONTEXT, /* Create the per-task audit_context, * but don't necessarily fill it in at * syscall entry time (i.e., filter * instead). */ AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context, * and always fill it in at syscall * entry time. This makes a full * syscall record available if some * other part of the kernel decides it * should be recorded. */ AUDIT_RECORD_CONTEXT /* Create the per-task audit_context, * always fill it in at syscall entry * time, and always write out the audit * record at syscall exit time. */}; /* When fs/namei.c:getname() is called, we store the pointer in name and * we don't let putname() free it (instead we free all of the saved * pointers at syscall exit time). * * Further, in fs/namei.c:path_lookup() we store the inode and device. */struct audit_names { const char *name; unsigned long ino; dev_t dev; umode_t mode; uid_t uid; gid_t gid; dev_t rdev;}; struct audit_aux_data { struct audit_aux_data *next; int type;}; #define AUDIT_AUX_IPCPERM 0 struct audit_aux_data_ipcctl { struct audit_aux_data d; struct ipc_perm p; unsigned long qbytes; uid_t uid; gid_t gid; mode_t mode;}; struct audit_aux_data_socketcall { struct audit_aux_data d; int nargs; unsigned long args[0];}; struct audit_aux_data_sockaddr { struct audit_aux_data d; int len; char a[0];}; struct audit_aux_data_path { struct audit_aux_data d; struct dentry *dentry; struct vfsmount *mnt;}; /* The per-task audit context. */struct audit_context { int in_syscall; /* 1 if task is in a syscall */ enum audit_state state; unsigned int serial; /* serial number for record */ struct timespec ctime; /* time of syscall entry */ uid_t loginuid; /* login uid (identity) */ int major; /* syscall number */ unsigned long argv[4]; /* syscall arguments */ int return_valid; /* return code is valid */ long return_code;/* syscall return code */ int auditable; /* 1 if record should be written */ int name_count; struct audit_names names[AUDIT_NAMES]; struct dentry * pwd; struct vfsmount * pwdmnt; struct audit_context *previous; /* For nested syscalls */ struct audit_aux_data *aux; /* Save things to print about task_struct */ pid_t pid; uid_t uid, euid, suid, fsuid; gid_t gid, egid, sgid, fsgid; unsigned long personality; int arch; #if AUDIT_DEBUG int put_count; int ino_count;#endif}; /* Public API *//* There are three lists of rules -- one to search at task creation * time, one to search at syscall entry time, and another to search at * syscall exit time. */static LIST_HEAD(audit_tsklist);static LIST_HEAD(audit_entlist);static LIST_HEAD(audit_extlist); struct audit_entry { struct list_head list; struct rcu_head rcu; struct audit_rule rule;}; extern int audit_pid; /* Check to see if two rules are identical. It is called from * audit_del_rule during AUDIT_DEL. */static int audit_compare_rule(struct audit_rule *a, struct audit_rule *b){ int i; if (a->flags != b->flags) return 1; if (a->action != b->action) return 1; if (a->field_count != b->field_count) return 1; for (i = 0; i < a->field_count; i++) { if (a->fields[i] != b->fields[i] || a->values[i] != b->values[i]) return 1; } for (i = 0; i < AUDIT_BITMASK_SIZE; i++) if (a->mask[i] != b->mask[i]) return 1; return 0;} /* Note that audit_add_rule and audit_del_rule are called via * audit_receive() in audit.c, and are protected by * audit_netlink_sem. */static inline int audit_add_rule(struct audit_entry *entry, struct list_head *list){ if (entry->rule.flags & AUDIT_PREPEND) { entry->rule.flags &= ~AUDIT_PREPEND; list_add_rcu(&entry->list, list); } else { list_add_tail_rcu(&entry->list, list); } return 0;} static void audit_free_rule(struct rcu_head *head){ struct audit_entry *e = container_of(head, struct audit_entry, rcu); kfree(e);} /* Note that audit_add_rule and audit_del_rule are called via * audit_receive() in audit.c, and are protected by * audit_netlink_sem. */static inline int audit_del_rule(struct audit_rule *rule, struct list_head *list){ struct audit_entry *e; /* Do not use the _rcu iterator here, since this is the only * deletion routine. */ list_for_each_entry(e, list, list) { if (!audit_compare_rule(rule, &e->rule)) { list_del_rcu(&e->list); call_rcu(&e->rcu, audit_free_rule); return 0; } } return -EFAULT; /* No matching rule */} /* Copy rule from user-space to kernel-space. Called during * AUDIT_ADD. */static int audit_copy_rule(struct audit_rule *d, struct audit_rule *s){ int i; if (s->action != AUDIT_NEVER && s->action != AUDIT_POSSIBLE && s->action != AUDIT_ALWAYS) return -1; if (s->field_count < 0 || s->field_count > AUDIT_MAX_FIELDS) return -1; d->flags = s->flags; d->action = s->action; d->field_count = s->field_count; for (i = 0; i < d->field_count; i++) { d->fields[i] = s->fields[i]; d->values[i] = s->values[i]; } for (i = 0; i < AUDIT_BITMASK_SIZE; i++) d->mask[i] = s->mask[i]; return 0;} int audit_receive_filter(int type, int pid, int uid, int seq, void *data, uid_t loginuid){ u32 flags; struct audit_entry *entry; int err = 0; switch (type) { case AUDIT_LIST: /* The *_rcu iterators not needed here because we are always called with audit_netlink_sem held. */ list_for_each_entry(entry, &audit_tsklist, list) audit_send_reply(pid, seq, AUDIT_LIST, 0, 1, &entry->rule, sizeof(entry->rule)); list_for_each_entry(entry, &audit_entlist, list) audit_send_reply(pid, seq, AUDIT_LIST, 0, 1, &entry->rule, sizeof(entry->rule)); list_for_each_entry(entry, &audit_extlist, list) audit_send_reply(pid, seq, AUDIT_LIST, 0, 1, &entry->rule, sizeof(entry->rule)); audit_send_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0); break; case AUDIT_ADD: if (!(entry = kmalloc(sizeof(*entry), GFP_KERNEL))) return -ENOMEM; if (audit_copy_rule(&entry->rule, data)) { kfree(entry); return -EINVAL; } flags = entry->rule.flags; if (!err && (flags & AUDIT_PER_TASK)) err = audit_add_rule(entry, &audit_tsklist); if (!err && (flags & AUDIT_AT_ENTRY)) err = audit_add_rule(entry, &audit_entlist); if (!err && (flags & AUDIT_AT_EXIT)) err = audit_add_rule(entry, &audit_extlist); audit_log(NULL, AUDIT_CONFIG_CHANGE, "auid=%u added an audit rule\n", loginuid); break; case AUDIT_DEL: flags =((struct audit_rule *)data)->flags; if (!err && (flags & AUDIT_PER_TASK)) err = audit_del_rule(data, &audit_tsklist); if (!err && (flags & AUDIT_AT_ENTRY)) err = audit_del_rule(data, &audit_entlist); if (!err && (flags & AUDIT_AT_EXIT)) err = audit_del_rule(data, &audit_extlist); audit_log(NULL, AUDIT_CONFIG_CHANGE, "auid=%u removed an audit rule\n", loginuid); break; default: return -EINVAL; } return err;} /* Compare a task_struct with an audit_rule. Return 1 on match, 0 * otherwise. */static int audit_filter_rules(struct task_struct *tsk, struct audit_rule *rule, struct audit_context *ctx, enum audit_state *state){ int i, j; for (i = 0; i < rule->field_count; i++) { u32 field = rule->fields[i] & ~AUDIT_NEGATE; u32 value = rule->values[i]; int result = 0; switch (field) { case AUDIT_PID: result = (tsk->pid == value); break; case AUDIT_UID: result = (tsk->uid == value); break; case AUDIT_EUID: result = (tsk->euid == value); break; case AUDIT_SUID: result = (tsk->suid == value); break; case AUDIT_FSUID: result = (tsk->fsuid == value); break; case AUDIT_GID: result = (tsk->gid == value); break; case AUDIT_EGID: result = (tsk->egid == value); break; case AUDIT_SGID: result = (tsk->sgid == value); break; case AUDIT_FSGID: result = (tsk->fsgid == value); break; case AUDIT_PERS: result = (tsk->personality == value); break; case AUDIT_ARCH: if (ctx) result = (ctx->arch == value); break; case AUDIT_EXIT: if (ctx && ctx->return_valid) result = (ctx->return_code == value); break; case AUDIT_SUCCESS: if (ctx && ctx->return_valid) result = (ctx->return_valid == AUDITSC_SUCCESS); break; case AUDIT_DEVMAJOR: if (ctx) { for (j = 0; j < ctx->name_count; j++) { if (MAJOR(ctx->names[j].dev)==value) { ++result; break; } } } break; case AUDIT_DEVMINOR: if (ctx) { for (j = 0; j < ctx->name_count; j++) { if (MINOR(ctx->names[j].dev)==value) { ++result; break; } } } break; case AUDIT_INODE: if (ctx) { for (j = 0; j < ctx->name_count; j++) { if (ctx->names[j].ino == value) { ++result; break; } } } break; case AUDIT_LOGINUID: result = 0; if (ctx) result = (ctx->loginuid == value); break; case AUDIT_ARG0: case AUDIT_ARG1: case AUDIT_ARG2: case AUDIT_ARG3: if (ctx) result = (ctx->argv[field-AUDIT_ARG0]==value); break; } if (rule->fields[i] & AUDIT_NEGATE) result = !result; if (!result) return 0; } switch (rule->action) { case AUDIT_NEVER: *state = AUDIT_DISABLED; break; case AUDIT_POSSIBLE: *state = AUDIT_BUILD_CONTEXT; break; case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break; } return 1;} /* At process creation time, we can determine if system-call auditing is * completely disabled for this task. Since we only have the task * structure at this point, we can only check uid and gid. */static enum audit_state audit_filter_task(struct task_struct *tsk){ struct audit_entry *e; enum audit_state state; rcu_read_lock(); list_for_each_entry_rcu(e, &audit_tsklist, list) { if (audit_filter_rules(tsk, &e->rule, NULL, &state)) { rcu_read_unlock(); return state; } } rcu_read_unlock(); return AUDIT_BUILD_CONTEXT;} /* At syscall entry and exit time, this filter is called if the * audit_state is not low enough that auditing cannot take place, but is * also not high enough that we already know we have to write an audit * record (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT). */static enum audit_state audit_filter_syscall(struct task_struct *tsk, struct audit_context *ctx, struct list_head *list){ struct audit_entry *e; enum audit_state state; int word = AUDIT_WORD(ctx->major); int bit = AUDIT_BIT(ctx->major); rcu_read_lock(); list_for_each_entry_rcu(e, list, list) { if ((e->rule.mask[word] & bit) == bit && audit_filter_rules(tsk, &e->rule, ctx, &state)) { rcu_read_unlock(); return state; } } rcu_read_unlock(); return AUDIT_BUILD_CONTEXT;} /* This should be called with task_lock() held. */static inline struct audit_context *audit_get_context(struct task_struct *tsk, int return_valid, int return_code){ struct audit_context *context = tsk->audit_context; if (likely(!context))Lines 1–500 of 1167. Load more
/* auditsc.c -- System-call auditing support * Handles all system-call specific auditing features. * * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina. * All Rights Reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA * * Written by Rickard E. (Rik) Faith <faith@redhat.com> * * Many of the ideas implemented here are from Stephen C. Tweedie, * especially the idea of avoiding a copy by using getname. * * The method for actual interception of syscall entry and exit (not in * this file -- see entry.S) is based on a GPL'd patch written by * okir@suse.de and Copyright 2003 SuSE Linux AG. * */ #include <linux/init.h> #include <asm/atomic.h> #include <asm/types.h> #include <linux/mm.h> #include <linux/module.h> #include <linux/mount.h> #include <linux/socket.h> #include <linux/audit.h> #include <linux/personality.h> #include <linux/time.h> #include <asm/unistd.h> /* 0 = no checking 1 = put_count checking 2 = verbose put_count checking */ #define AUDIT_DEBUG 0 /* No syscall auditing will take place unless audit_enabled != 0. */ extern int audit_enabled; /* AUDIT_NAMES is the number of slots we reserve in the audit_context * for saving names from getname(). */ #define AUDIT_NAMES 20 /* AUDIT_NAMES_RESERVED is the number of slots we reserve in the * audit_context from being used for nameless inodes from * path_lookup. */ #define AUDIT_NAMES_RESERVED 7 /* At task start time, the audit_state is set in the audit_context using a per-task filter. At syscall entry, the audit_state is augmented by the syscall filter. */ enum audit_state { AUDIT_DISABLED, /* Do not create per-task audit_context. * No syscall-specific audit records can * be generated. */ AUDIT_SETUP_CONTEXT, /* Create the per-task audit_context, * but don't necessarily fill it in at * syscall entry time (i.e., filter * instead). */ AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context, * and always fill it in at syscall * entry time. This makes a full * syscall record available if some * other part of the kernel decides it * should be recorded. */ AUDIT_RECORD_CONTEXT /* Create the per-task audit_context, * always fill it in at syscall entry * time, and always write out the audit * record at syscall exit time. */ }; /* When fs/namei.c:getname() is called, we store the pointer in name and * we don't let putname() free it (instead we free all of the saved * pointers at syscall exit time). * * Further, in fs/namei.c:path_lookup() we store the inode and device. */ struct audit_names { const char *name; unsigned long ino; dev_t dev; umode_t mode; uid_t uid; gid_t gid; dev_t rdev; }; struct audit_aux_data { struct audit_aux_data *next; int type; }; #define AUDIT_AUX_IPCPERM 0 struct audit_aux_data_ipcctl { struct audit_aux_data d; struct ipc_perm p; unsigned long qbytes; uid_t uid; gid_t gid; mode_t mode; }; struct audit_aux_data_socketcall { struct audit_aux_data d; int nargs; unsigned long args[0]; }; struct audit_aux_data_sockaddr { struct audit_aux_data d; int len; char a[0]; }; struct audit_aux_data_path { struct audit_aux_data d; struct dentry *dentry; struct vfsmount *mnt; }; /* The per-task audit context. */ struct audit_context { int in_syscall; /* 1 if task is in a syscall */ enum audit_state state; unsigned int serial; /* serial number for record */ struct timespec ctime; /* time of syscall entry */ uid_t loginuid; /* login uid (identity) */ int major; /* syscall number */ unsigned long argv[4]; /* syscall arguments */ int return_valid; /* return code is valid */ long return_code;/* syscall return code */ int auditable; /* 1 if record should be written */ int name_count; struct audit_names names[AUDIT_NAMES]; struct dentry * pwd; struct vfsmount * pwdmnt; struct audit_context *previous; /* For nested syscalls */ struct audit_aux_data *aux; /* Save things to print about task_struct */ pid_t pid; uid_t uid, euid, suid, fsuid; gid_t gid, egid, sgid, fsgid; unsigned long personality; int arch; #if AUDIT_DEBUG int put_count; int ino_count; #endif }; /* Public API */ /* There are three lists of rules -- one to search at task creation * time, one to search at syscall entry time, and another to search at * syscall exit time. */ static LIST_HEAD(audit_tsklist); static LIST_HEAD(audit_entlist); static LIST_HEAD(audit_extlist); struct audit_entry { struct list_head list; struct rcu_head rcu; struct audit_rule rule; }; extern int audit_pid; /* Check to see if two rules are identical. It is called from * audit_del_rule during AUDIT_DEL. */ static int audit_compare_rule(struct audit_rule *a, struct audit_rule *b) { int i; if (a->flags != b->flags) return 1; if (a->action != b->action) return 1; if (a->field_count != b->field_count) return 1; for (i = 0; i < a->field_count; i++) { if (a->fields[i] != b->fields[i] || a->values[i] != b->values[i]) return 1; } for (i = 0; i < AUDIT_BITMASK_SIZE; i++) if (a->mask[i] != b->mask[i]) return 1; return 0; } /* Note that audit_add_rule and audit_del_rule are called via * audit_receive() in audit.c, and are protected by * audit_netlink_sem. */ static inline int audit_add_rule(struct audit_entry *entry, struct list_head *list) { if (entry->rule.flags & AUDIT_PREPEND) { entry->rule.flags &= ~AUDIT_PREPEND; list_add_rcu(&entry->list, list); } else { list_add_tail_rcu(&entry->list, list); } return 0; } static void audit_free_rule(struct rcu_head *head) { struct audit_entry *e = container_of(head, struct audit_entry, rcu); kfree(e); } /* Note that audit_add_rule and audit_del_rule are called via * audit_receive() in audit.c, and are protected by * audit_netlink_sem. */ static inline int audit_del_rule(struct audit_rule *rule, struct list_head *list) { struct audit_entry *e; /* Do not use the _rcu iterator here, since this is the only * deletion routine. */ list_for_each_entry(e, list, list) { if (!audit_compare_rule(rule, &e->rule)) { list_del_rcu(&e->list); call_rcu(&e->rcu, audit_free_rule); return 0; } } return -EFAULT; /* No matching rule */ } /* Copy rule from user-space to kernel-space. Called during * AUDIT_ADD. */ static int audit_copy_rule(struct audit_rule *d, struct audit_rule *s) { int i; if (s->action != AUDIT_NEVER && s->action != AUDIT_POSSIBLE && s->action != AUDIT_ALWAYS) return -1; if (s->field_count < 0 || s->field_count > AUDIT_MAX_FIELDS) return -1; d->flags = s->flags; d->action = s->action; d->field_count = s->field_count; for (i = 0; i < d->field_count; i++) { d->fields[i] = s->fields[i]; d->values[i] = s->values[i]; } for (i = 0; i < AUDIT_BITMASK_SIZE; i++) d->mask[i] = s->mask[i]; return 0; } int audit_receive_filter(int type, int pid, int uid, int seq, void *data, uid_t loginuid) { u32 flags; struct audit_entry *entry; int err = 0; switch (type) { case AUDIT_LIST: /* The *_rcu iterators not needed here because we are always called with audit_netlink_sem held. */ list_for_each_entry(entry, &audit_tsklist, list) audit_send_reply(pid, seq, AUDIT_LIST, 0, 1, &entry->rule, sizeof(entry->rule)); list_for_each_entry(entry, &audit_entlist, list) audit_send_reply(pid, seq, AUDIT_LIST, 0, 1, &entry->rule, sizeof(entry->rule)); list_for_each_entry(entry, &audit_extlist, list) audit_send_reply(pid, seq, AUDIT_LIST, 0, 1, &entry->rule, sizeof(entry->rule)); audit_send_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0); break; case AUDIT_ADD: if (!(entry = kmalloc(sizeof(*entry), GFP_KERNEL))) return -ENOMEM; if (audit_copy_rule(&entry->rule, data)) { kfree(entry); return -EINVAL; } flags = entry->rule.flags; if (!err && (flags & AUDIT_PER_TASK)) err = audit_add_rule(entry, &audit_tsklist); if (!err && (flags & AUDIT_AT_ENTRY)) err = audit_add_rule(entry, &audit_entlist); if (!err && (flags & AUDIT_AT_EXIT)) err = audit_add_rule(entry, &audit_extlist); audit_log(NULL, AUDIT_CONFIG_CHANGE, "auid=%u added an audit rule\n", loginuid); break; case AUDIT_DEL: flags =((struct audit_rule *)data)->flags; if (!err && (flags & AUDIT_PER_TASK)) err = audit_del_rule(data, &audit_tsklist); if (!err && (flags & AUDIT_AT_ENTRY)) err = audit_del_rule(data, &audit_entlist); if (!err && (flags & AUDIT_AT_EXIT)) err = audit_del_rule(data, &audit_extlist); audit_log(NULL, AUDIT_CONFIG_CHANGE, "auid=%u removed an audit rule\n", loginuid); break; default: return -EINVAL; } return err; } /* Compare a task_struct with an audit_rule. Return 1 on match, 0 * otherwise. */ static int audit_filter_rules(struct task_struct *tsk, struct audit_rule *rule, struct audit_context *ctx, enum audit_state *state) { int i, j; for (i = 0; i < rule->field_count; i++) { u32 field = rule->fields[i] & ~AUDIT_NEGATE; u32 value = rule->values[i]; int result = 0; switch (field) { case AUDIT_PID: result = (tsk->pid == value); break; case AUDIT_UID: result = (tsk->uid == value); break; case AUDIT_EUID: result = (tsk->euid == value); break; case AUDIT_SUID: result = (tsk->suid == value); break; case AUDIT_FSUID: result = (tsk->fsuid == value); break; case AUDIT_GID: result = (tsk->gid == value); break; case AUDIT_EGID: result = (tsk->egid == value); break; case AUDIT_SGID: result = (tsk->sgid == value); break; case AUDIT_FSGID: result = (tsk->fsgid == value); break; case AUDIT_PERS: result = (tsk->personality == value); break; case AUDIT_ARCH: if (ctx) result = (ctx->arch == value); break; case AUDIT_EXIT: if (ctx && ctx->return_valid) result = (ctx->return_code == value); break; case AUDIT_SUCCESS: if (ctx && ctx->return_valid) result = (ctx->return_valid == AUDITSC_SUCCESS); break; case AUDIT_DEVMAJOR: if (ctx) { for (j = 0; j < ctx->name_count; j++) { if (MAJOR(ctx->names[j].dev)==value) { ++result; break; } } } break; case AUDIT_DEVMINOR: if (ctx) { for (j = 0; j < ctx->name_count; j++) { if (MINOR(ctx->names[j].dev)==value) { ++result; break; } } } break; case AUDIT_INODE: if (ctx) { for (j = 0; j < ctx->name_count; j++) { if (ctx->names[j].ino == value) { ++result; break; } } } break; case AUDIT_LOGINUID: result = 0; if (ctx) result = (ctx->loginuid == value); break; case AUDIT_ARG0: case AUDIT_ARG1: case AUDIT_ARG2: case AUDIT_ARG3: if (ctx) result = (ctx->argv[field-AUDIT_ARG0]==value); break; } if (rule->fields[i] & AUDIT_NEGATE) result = !result; if (!result) return 0; } switch (rule->action) { case AUDIT_NEVER: *state = AUDIT_DISABLED; break; case AUDIT_POSSIBLE: *state = AUDIT_BUILD_CONTEXT; break; case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break; } return 1; } /* At process creation time, we can determine if system-call auditing is * completely disabled for this task. Since we only have the task * structure at this point, we can only check uid and gid. */ static enum audit_state audit_filter_task(struct task_struct *tsk) { struct audit_entry *e; enum audit_state state; rcu_read_lock(); list_for_each_entry_rcu(e, &audit_tsklist, list) { if (audit_filter_rules(tsk, &e->rule, NULL, &state)) { rcu_read_unlock(); return state; } } rcu_read_unlock(); return AUDIT_BUILD_CONTEXT; } /* At syscall entry and exit time, this filter is called if the * audit_state is not low enough that auditing cannot take place, but is * also not high enough that we already know we have to write an audit * record (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT). */ static enum audit_state audit_filter_syscall(struct task_struct *tsk, struct audit_context *ctx, struct list_head *list) { struct audit_entry *e; enum audit_state state; int word = AUDIT_WORD(ctx->major); int bit = AUDIT_BIT(ctx->major); rcu_read_lock(); list_for_each_entry_rcu(e, list, list) { if ((e->rule.mask[word] & bit) == bit && audit_filter_rules(tsk, &e->rule, ctx, &state)) { rcu_read_unlock(); return state; } } rcu_read_unlock(); return AUDIT_BUILD_CONTEXT; } /* This should be called with task_lock() held. */ static inline struct audit_context *audit_get_context(struct task_struct *tsk, int return_valid, int return_code) { struct audit_context *context = tsk->audit_context; if (likely(!context))