/* auditsc.c -- System-call auditing support * Handles all system-call specific auditing features. * * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina. * Copyright 2005 Hewlett-Packard Development Company, L.P. * Copyright (C) 2005, 2006 IBM Corporation * All Rights Reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA * * Written by Rickard E. (Rik) Faith <faith@redhat.com> * * Many of the ideas implemented here are from Stephen C. Tweedie, * especially the idea of avoiding a copy by using getname. * * The method for actual interception of syscall entry and exit (not in * this file -- see entry.S) is based on a GPL'd patch written by * okir@suse.de and Copyright 2003 SuSE Linux AG. * * POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>, * 2006. * * The support of additional filter rules compares (>, <, >=, <=) was * added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005. * * Modified by Amy Griffis <amy.griffis@hp.com> to collect additional * filesystem information. * * Subject and object context labeling support added by <danjones@us.ibm.com> * and <dustin.kirkland@us.ibm.com> for LSPP certification compliance. */ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include <linux/init.h>#include <asm/types.h>#include <linux/atomic.h>#include <linux/fs.h>#include <linux/namei.h>#include <linux/mm.h>#include <linux/export.h>#include <linux/slab.h>#include <linux/mount.h>#include <linux/socket.h>#include <linux/mqueue.h>#include <linux/audit.h>#include <linux/personality.h>#include <linux/time.h>#include <linux/netlink.h>#include <linux/compiler.h>#include <asm/unistd.h>#include <linux/security.h>#include <linux/list.h>#include <linux/tty.h>#include <linux/binfmts.h>#include <linux/highmem.h>#include <linux/syscalls.h>#include <linux/capability.h>#include <linux/fs_struct.h>#include <linux/compat.h>#include <linux/ctype.h> #include "audit.h" /* flags stating the success for a syscall */#define AUDITSC_INVALID 0#define AUDITSC_SUCCESS 1#define AUDITSC_FAILURE 2 /* no execve audit message should be longer than this (userspace limits) */#define MAX_EXECVE_AUDIT_LEN 7500 /* max length to print of cmdline/proctitle value during audit */#define MAX_PROCTITLE_AUDIT_LEN 128 /* number of audit rules */int audit_n_rules; /* determines whether we collect data for signals sent */int audit_signals; struct audit_aux_data {	struct audit_aux_data	*next;	int			type;}; #define AUDIT_AUX_IPCPERM	0 /* Number of target pids per aux struct. */#define AUDIT_AUX_PIDS	16 struct audit_aux_data_pids {	struct audit_aux_data	d;	pid_t			target_pid[AUDIT_AUX_PIDS];	kuid_t			target_auid[AUDIT_AUX_PIDS];	kuid_t			target_uid[AUDIT_AUX_PIDS];	unsigned int		target_sessionid[AUDIT_AUX_PIDS];	u32			target_sid[AUDIT_AUX_PIDS];	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];	int			pid_count;}; struct audit_aux_data_bprm_fcaps {	struct audit_aux_data	d;	struct audit_cap_data	fcap;	unsigned int		fcap_ver;	struct audit_cap_data	old_pcap;	struct audit_cap_data	new_pcap;}; struct audit_tree_refs {	struct audit_tree_refs *next;	struct audit_chunk *c[31];}; static inline int open_arg(int flags, int mask){	int n = ACC_MODE(flags);	if (flags & (O_TRUNC | O_CREAT))		n |= AUDIT_PERM_WRITE;	return n & mask;} static int audit_match_perm(struct audit_context *ctx, int mask){	unsigned n;	if (unlikely(!ctx))		return 0;	n = ctx->major; 	switch (audit_classify_syscall(ctx->arch, n)) {	case 0:	/* native */		if ((mask & AUDIT_PERM_WRITE) &&		     audit_match_class(AUDIT_CLASS_WRITE, n))			return 1;		if ((mask & AUDIT_PERM_READ) &&		     audit_match_class(AUDIT_CLASS_READ, n))			return 1;		if ((mask & AUDIT_PERM_ATTR) &&		     audit_match_class(AUDIT_CLASS_CHATTR, n))			return 1;		return 0;	case 1: /* 32bit on biarch */		if ((mask & AUDIT_PERM_WRITE) &&		     audit_match_class(AUDIT_CLASS_WRITE_32, n))			return 1;		if ((mask & AUDIT_PERM_READ) &&		     audit_match_class(AUDIT_CLASS_READ_32, n))			return 1;		if ((mask & AUDIT_PERM_ATTR) &&		     audit_match_class(AUDIT_CLASS_CHATTR_32, n))			return 1;		return 0;	case 2: /* open */		return mask & ACC_MODE(ctx->argv[1]);	case 3: /* openat */		return mask & ACC_MODE(ctx->argv[2]);	case 4: /* socketcall */		return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);	case 5: /* execve */		return mask & AUDIT_PERM_EXEC;	default:		return 0;	}} static int audit_match_filetype(struct audit_context *ctx, int val){	struct audit_names *n;	umode_t mode = (umode_t)val; 	if (unlikely(!ctx))		return 0; 	list_for_each_entry(n, &ctx->names_list, list) {		if ((n->ino != -1) &&		    ((n->mode & S_IFMT) == mode))			return 1;	} 	return 0;} /* * We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *; * ->first_trees points to its beginning, ->trees - to the current end of data. * ->tree_count is the number of free entries in array pointed to by ->trees. * Original condition is (NULL, NULL, 0); as soon as it grows we never revert to NULL, * "empty" becomes (p, p, 31) afterwards.  We don't shrink the list (and seriously, * it's going to remain 1-element for almost any setup) until we free context itself. * References in it _are_ dropped - at the same time we free/drop aux stuff. */ #ifdef CONFIG_AUDIT_TREEstatic void audit_set_auditable(struct audit_context *ctx){	if (!ctx->prio) {		ctx->prio = 1;		ctx->current_state = AUDIT_RECORD_CONTEXT;	}} static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk){	struct audit_tree_refs *p = ctx->trees;	int left = ctx->tree_count;	if (likely(left)) {		p->c[--left] = chunk;		ctx->tree_count = left;		return 1;	}	if (!p)		return 0;	p = p->next;	if (p) {		p->c[30] = chunk;		ctx->trees = p;		ctx->tree_count = 30;		return 1;	}	return 0;} static int grow_tree_refs(struct audit_context *ctx){	struct audit_tree_refs *p = ctx->trees;	ctx->trees = kzalloc(sizeof(struct audit_tree_refs), GFP_KERNEL);	if (!ctx->trees) {		ctx->trees = p;		return 0;	}	if (p)		p->next = ctx->trees;	else		ctx->first_trees = ctx->trees;	ctx->tree_count = 31;	return 1;}#endif static void unroll_tree_refs(struct audit_context *ctx,		      struct audit_tree_refs *p, int count){#ifdef CONFIG_AUDIT_TREE	struct audit_tree_refs *q;	int n;	if (!p) {		/* we started with empty chain */		p = ctx->first_trees;		count = 31;		/* if the very first allocation has failed, nothing to do */		if (!p)			return;	}	n = count;	for (q = p; q != ctx->trees; q = q->next, n = 31) {		while (n--) {			audit_put_chunk(q->c[n]);			q->c[n] = NULL;		}	}	while (n-- > ctx->tree_count) {		audit_put_chunk(q->c[n]);		q->c[n] = NULL;	}	ctx->trees = p;	ctx->tree_count = count;#endif} static void free_tree_refs(struct audit_context *ctx){	struct audit_tree_refs *p, *q;	for (p = ctx->first_trees; p; p = q) {		q = p->next;		kfree(p);	}} static int match_tree_refs(struct audit_context *ctx, struct audit_tree *tree){#ifdef CONFIG_AUDIT_TREE	struct audit_tree_refs *p;	int n;	if (!tree)		return 0;	/* full ones */	for (p = ctx->first_trees; p != ctx->trees; p = p->next) {		for (n = 0; n < 31; n++)			if (audit_tree_match(p->c[n], tree))				return 1;	}	/* partial */	if (p) {		for (n = ctx->tree_count; n < 31; n++)			if (audit_tree_match(p->c[n], tree))				return 1;	}#endif	return 0;} static int audit_compare_uid(kuid_t uid,			     struct audit_names *name,			     struct audit_field *f,			     struct audit_context *ctx){	struct audit_names *n;	int rc; 	if (name) {		rc = audit_uid_comparator(uid, f->op, name->uid);		if (rc)			return rc;	} 	if (ctx) {		list_for_each_entry(n, &ctx->names_list, list) {			rc = audit_uid_comparator(uid, f->op, n->uid);			if (rc)				return rc;		}	}	return 0;} static int audit_compare_gid(kgid_t gid,			     struct audit_names *name,			     struct audit_field *f,			     struct audit_context *ctx){	struct audit_names *n;	int rc; 	if (name) {		rc = audit_gid_comparator(gid, f->op, name->gid);		if (rc)			return rc;	} 	if (ctx) {		list_for_each_entry(n, &ctx->names_list, list) {			rc = audit_gid_comparator(gid, f->op, n->gid);			if (rc)				return rc;		}	}	return 0;} static int audit_field_compare(struct task_struct *tsk,			       const struct cred *cred,			       struct audit_field *f,			       struct audit_context *ctx,			       struct audit_names *name){	switch (f->val) {	/* process to file object comparisons */	case AUDIT_COMPARE_UID_TO_OBJ_UID:		return audit_compare_uid(cred->uid, name, f, ctx);	case AUDIT_COMPARE_GID_TO_OBJ_GID:		return audit_compare_gid(cred->gid, name, f, ctx);	case AUDIT_COMPARE_EUID_TO_OBJ_UID:		return audit_compare_uid(cred->euid, name, f, ctx);	case AUDIT_COMPARE_EGID_TO_OBJ_GID:		return audit_compare_gid(cred->egid, name, f, ctx);	case AUDIT_COMPARE_AUID_TO_OBJ_UID:		return audit_compare_uid(tsk->loginuid, name, f, ctx);	case AUDIT_COMPARE_SUID_TO_OBJ_UID:		return audit_compare_uid(cred->suid, name, f, ctx);	case AUDIT_COMPARE_SGID_TO_OBJ_GID:		return audit_compare_gid(cred->sgid, name, f, ctx);	case AUDIT_COMPARE_FSUID_TO_OBJ_UID:		return audit_compare_uid(cred->fsuid, name, f, ctx);	case AUDIT_COMPARE_FSGID_TO_OBJ_GID:		return audit_compare_gid(cred->fsgid, name, f, ctx);	/* uid comparisons */	case AUDIT_COMPARE_UID_TO_AUID:		return audit_uid_comparator(cred->uid, f->op, tsk->loginuid);	case AUDIT_COMPARE_UID_TO_EUID:		return audit_uid_comparator(cred->uid, f->op, cred->euid);	case AUDIT_COMPARE_UID_TO_SUID:		return audit_uid_comparator(cred->uid, f->op, cred->suid);	case AUDIT_COMPARE_UID_TO_FSUID:		return audit_uid_comparator(cred->uid, f->op, cred->fsuid);	/* auid comparisons */	case AUDIT_COMPARE_AUID_TO_EUID:		return audit_uid_comparator(tsk->loginuid, f->op, cred->euid);	case AUDIT_COMPARE_AUID_TO_SUID:		return audit_uid_comparator(tsk->loginuid, f->op, cred->suid);	case AUDIT_COMPARE_AUID_TO_FSUID:		return audit_uid_comparator(tsk->loginuid, f->op, cred->fsuid);	/* euid comparisons */	case AUDIT_COMPARE_EUID_TO_SUID:		return audit_uid_comparator(cred->euid, f->op, cred->suid);	case AUDIT_COMPARE_EUID_TO_FSUID:		return audit_uid_comparator(cred->euid, f->op, cred->fsuid);	/* suid comparisons */	case AUDIT_COMPARE_SUID_TO_FSUID:		return audit_uid_comparator(cred->suid, f->op, cred->fsuid);	/* gid comparisons */	case AUDIT_COMPARE_GID_TO_EGID:		return audit_gid_comparator(cred->gid, f->op, cred->egid);	case AUDIT_COMPARE_GID_TO_SGID:		return audit_gid_comparator(cred->gid, f->op, cred->sgid);	case AUDIT_COMPARE_GID_TO_FSGID:		return audit_gid_comparator(cred->gid, f->op, cred->fsgid);	/* egid comparisons */	case AUDIT_COMPARE_EGID_TO_SGID:		return audit_gid_comparator(cred->egid, f->op, cred->sgid);	case AUDIT_COMPARE_EGID_TO_FSGID:		return audit_gid_comparator(cred->egid, f->op, cred->fsgid);	/* sgid comparison */	case AUDIT_COMPARE_SGID_TO_FSGID:		return audit_gid_comparator(cred->sgid, f->op, cred->fsgid);	default:		WARN(1, "Missing AUDIT_COMPARE define.  Report as a bug\n");		return 0;	}	return 0;} /* Determine if any context name data matches a rule's watch data *//* Compare a task_struct with an audit_rule.  Return 1 on match, 0 * otherwise. * * If task_creation is true, this is an explicit indication that we are * filtering a task rule at task creation time.  This and tsk == current are * the only situations where tsk->cred may be accessed without an rcu read lock. */static int audit_filter_rules(struct task_struct *tsk,			      struct audit_krule *rule,			      struct audit_context *ctx,			      struct audit_names *name,			      enum audit_state *state,			      bool task_creation){	const struct cred *cred;	int i, need_sid = 1;	u32 sid; 	cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation); 	for (i = 0; i < rule->field_count; i++) {		struct audit_field *f = &rule->fields[i];		struct audit_names *n;		int result = 0;		pid_t pid; 		switch (f->type) {		case AUDIT_PID:			pid = task_pid_nr(tsk);			result = audit_comparator(pid, f->op, f->val);			break;		case AUDIT_PPID:			if (ctx) {				if (!ctx->ppid)					ctx->ppid = task_ppid_nr(tsk);				result = audit_comparator(ctx->ppid, f->op, f->val);			}			break;		case AUDIT_UID:			result = audit_uid_comparator(cred->uid, f->op, f->uid);			break;		case AUDIT_EUID:			result = audit_uid_comparator(cred->euid, f->op, f->uid);			break;		case AUDIT_SUID:			result = audit_uid_comparator(cred->suid, f->op, f->uid);			break;		case AUDIT_FSUID:			result = audit_uid_comparator(cred->fsuid, f->op, f->uid);			break;		case AUDIT_GID:			result = audit_gid_comparator(cred->gid, f->op, f->gid);			if (f->op == Audit_equal) {				if (!result)					result = in_group_p(f->gid);			} else if (f->op == Audit_not_equal) {				if (result)					result = !in_group_p(f->gid);			}			break;		case AUDIT_EGID:			result = audit_gid_comparator(cred->egid, f->op, f->gid);			if (f->op == Audit_equal) {				if (!result)					result = in_egroup_p(f->gid);

Lines 1–500 of 2505. Load more