/* auditsc.c -- System-call auditing support * Handles all system-call specific auditing features. * * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina. * Copyright 2005 Hewlett-Packard Development Company, L.P. * Copyright (C) 2005, 2006 IBM Corporation * All Rights Reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA * * Written by Rickard E. (Rik) Faith <faith@redhat.com> * * Many of the ideas implemented here are from Stephen C. Tweedie, * especially the idea of avoiding a copy by using getname. * * The method for actual interception of syscall entry and exit (not in * this file -- see entry.S) is based on a GPL'd patch written by * okir@suse.de and Copyright 2003 SuSE Linux AG. * * POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>, * 2006. * * The support of additional filter rules compares (>, <, >=, <=) was * added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005. * * Modified by Amy Griffis <amy.griffis@hp.com> to collect additional * filesystem information. * * Subject and object context labeling support added by <danjones@us.ibm.com> * and <dustin.kirkland@us.ibm.com> for LSPP certification compliance. */ #include <linux/init.h>#include <asm/types.h>#include <linux/atomic.h>#include <linux/fs.h>#include <linux/namei.h>#include <linux/mm.h>#include <linux/export.h>#include <linux/slab.h>#include <linux/mount.h>#include <linux/socket.h>#include <linux/mqueue.h>#include <linux/audit.h>#include <linux/personality.h>#include <linux/time.h>#include <linux/netlink.h>#include <linux/compiler.h>#include <asm/unistd.h>#include <linux/security.h>#include <linux/list.h>#include <linux/tty.h>#include <linux/binfmts.h>#include <linux/highmem.h>#include <linux/syscalls.h>#include <linux/capability.h>#include <linux/fs_struct.h> #include "audit.h" /* AUDIT_NAMES is the number of slots we reserve in the audit_context * for saving names from getname(). */#define AUDIT_NAMES    20 /* Indicates that audit should log the full pathname. */#define AUDIT_NAME_FULL -1 /* no execve audit message should be longer than this (userspace limits) */#define MAX_EXECVE_AUDIT_LEN 7500 /* number of audit rules */int audit_n_rules; /* determines whether we collect data for signals sent */int audit_signals; struct audit_cap_data {	kernel_cap_t		permitted;	kernel_cap_t		inheritable;	union {		unsigned int	fE;		/* effective bit of a file capability */		kernel_cap_t	effective;	/* effective set of a process */	};}; /* When fs/namei.c:getname() is called, we store the pointer in name and * we don't let putname() free it (instead we free all of the saved * pointers at syscall exit time). * * Further, in fs/namei.c:path_lookup() we store the inode and device. */struct audit_names {	const char	*name;	int		name_len;	/* number of name's characters to log */	unsigned	name_put;	/* call __putname() for this name */	unsigned long	ino;	dev_t		dev;	umode_t		mode;	uid_t		uid;	gid_t		gid;	dev_t		rdev;	u32		osid;	struct audit_cap_data fcap;	unsigned int	fcap_ver;}; struct audit_aux_data {	struct audit_aux_data	*next;	int			type;}; #define AUDIT_AUX_IPCPERM	0 /* Number of target pids per aux struct. */#define AUDIT_AUX_PIDS	16 struct audit_aux_data_execve {	struct audit_aux_data	d;	int argc;	int envc;	struct mm_struct *mm;}; struct audit_aux_data_pids {	struct audit_aux_data	d;	pid_t			target_pid[AUDIT_AUX_PIDS];	uid_t			target_auid[AUDIT_AUX_PIDS];	uid_t			target_uid[AUDIT_AUX_PIDS];	unsigned int		target_sessionid[AUDIT_AUX_PIDS];	u32			target_sid[AUDIT_AUX_PIDS];	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];	int			pid_count;}; struct audit_aux_data_bprm_fcaps {	struct audit_aux_data	d;	struct audit_cap_data	fcap;	unsigned int		fcap_ver;	struct audit_cap_data	old_pcap;	struct audit_cap_data	new_pcap;}; struct audit_aux_data_capset {	struct audit_aux_data	d;	pid_t			pid;	struct audit_cap_data	cap;}; struct audit_tree_refs {	struct audit_tree_refs *next;	struct audit_chunk *c[31];}; /* The per-task audit context. */struct audit_context {	int		    dummy;	/* must be the first element */	int		    in_syscall;	/* 1 if task is in a syscall */	enum audit_state    state, current_state;	unsigned int	    serial;     /* serial number for record */	int		    major;      /* syscall number */	struct timespec	    ctime;      /* time of syscall entry */	unsigned long	    argv[4];    /* syscall arguments */	long		    return_code;/* syscall return code */	u64		    prio;	int		    return_valid; /* return code is valid */	int		    name_count;	struct audit_names  names[AUDIT_NAMES];	char *		    filterkey;	/* key for rule that triggered record */	struct path	    pwd;	struct audit_context *previous; /* For nested syscalls */	struct audit_aux_data *aux;	struct audit_aux_data *aux_pids;	struct sockaddr_storage *sockaddr;	size_t sockaddr_len;				/* Save things to print about task_struct */	pid_t		    pid, ppid;	uid_t		    uid, euid, suid, fsuid;	gid_t		    gid, egid, sgid, fsgid;	unsigned long	    personality;	int		    arch; 	pid_t		    target_pid;	uid_t		    target_auid;	uid_t		    target_uid;	unsigned int	    target_sessionid;	u32		    target_sid;	char		    target_comm[TASK_COMM_LEN]; 	struct audit_tree_refs *trees, *first_trees;	struct list_head killed_trees;	int tree_count; 	int type;	union {		struct {			int nargs;			long args[6];		} socketcall;		struct {			uid_t			uid;			gid_t			gid;			mode_t			mode;			u32			osid;			int			has_perm;			uid_t			perm_uid;			gid_t			perm_gid;			mode_t			perm_mode;			unsigned long		qbytes;		} ipc;		struct {			mqd_t			mqdes;			struct mq_attr 		mqstat;		} mq_getsetattr;		struct {			mqd_t			mqdes;			int			sigev_signo;		} mq_notify;		struct {			mqd_t			mqdes;			size_t			msg_len;			unsigned int		msg_prio;			struct timespec		abs_timeout;		} mq_sendrecv;		struct {			int			oflag;			mode_t			mode;			struct mq_attr		attr;		} mq_open;		struct {			pid_t			pid;			struct audit_cap_data	cap;		} capset;		struct {			int			fd;			int			flags;		} mmap;	};	int fds[2]; #if AUDIT_DEBUG	int		    put_count;	int		    ino_count;#endif}; static inline int open_arg(int flags, int mask){	int n = ACC_MODE(flags);	if (flags & (O_TRUNC | O_CREAT))		n |= AUDIT_PERM_WRITE;	return n & mask;} static int audit_match_perm(struct audit_context *ctx, int mask){	unsigned n;	if (unlikely(!ctx))		return 0;	n = ctx->major; 	switch (audit_classify_syscall(ctx->arch, n)) {	case 0:	/* native */		if ((mask & AUDIT_PERM_WRITE) &&		     audit_match_class(AUDIT_CLASS_WRITE, n))			return 1;		if ((mask & AUDIT_PERM_READ) &&		     audit_match_class(AUDIT_CLASS_READ, n))			return 1;		if ((mask & AUDIT_PERM_ATTR) &&		     audit_match_class(AUDIT_CLASS_CHATTR, n))			return 1;		return 0;	case 1: /* 32bit on biarch */		if ((mask & AUDIT_PERM_WRITE) &&		     audit_match_class(AUDIT_CLASS_WRITE_32, n))			return 1;		if ((mask & AUDIT_PERM_READ) &&		     audit_match_class(AUDIT_CLASS_READ_32, n))			return 1;		if ((mask & AUDIT_PERM_ATTR) &&		     audit_match_class(AUDIT_CLASS_CHATTR_32, n))			return 1;		return 0;	case 2: /* open */		return mask & ACC_MODE(ctx->argv[1]);	case 3: /* openat */		return mask & ACC_MODE(ctx->argv[2]);	case 4: /* socketcall */		return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);	case 5: /* execve */		return mask & AUDIT_PERM_EXEC;	default:		return 0;	}} static int audit_match_filetype(struct audit_context *ctx, int which){	unsigned index = which & ~S_IFMT;	mode_t mode = which & S_IFMT; 	if (unlikely(!ctx))		return 0; 	if (index >= ctx->name_count)		return 0;	if (ctx->names[index].ino == -1)		return 0;	if ((ctx->names[index].mode ^ mode) & S_IFMT)		return 0;	return 1;} /* * We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *; * ->first_trees points to its beginning, ->trees - to the current end of data. * ->tree_count is the number of free entries in array pointed to by ->trees. * Original condition is (NULL, NULL, 0); as soon as it grows we never revert to NULL, * "empty" becomes (p, p, 31) afterwards.  We don't shrink the list (and seriously, * it's going to remain 1-element for almost any setup) until we free context itself. * References in it _are_ dropped - at the same time we free/drop aux stuff. */ #ifdef CONFIG_AUDIT_TREEstatic void audit_set_auditable(struct audit_context *ctx){	if (!ctx->prio) {		ctx->prio = 1;		ctx->current_state = AUDIT_RECORD_CONTEXT;	}} static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk){	struct audit_tree_refs *p = ctx->trees;	int left = ctx->tree_count;	if (likely(left)) {		p->c[--left] = chunk;		ctx->tree_count = left;		return 1;	}	if (!p)		return 0;	p = p->next;	if (p) {		p->c[30] = chunk;		ctx->trees = p;		ctx->tree_count = 30;		return 1;	}	return 0;} static int grow_tree_refs(struct audit_context *ctx){	struct audit_tree_refs *p = ctx->trees;	ctx->trees = kzalloc(sizeof(struct audit_tree_refs), GFP_KERNEL);	if (!ctx->trees) {		ctx->trees = p;		return 0;	}	if (p)		p->next = ctx->trees;	else		ctx->first_trees = ctx->trees;	ctx->tree_count = 31;	return 1;}#endif static void unroll_tree_refs(struct audit_context *ctx,		      struct audit_tree_refs *p, int count){#ifdef CONFIG_AUDIT_TREE	struct audit_tree_refs *q;	int n;	if (!p) {		/* we started with empty chain */		p = ctx->first_trees;		count = 31;		/* if the very first allocation has failed, nothing to do */		if (!p)			return;	}	n = count;	for (q = p; q != ctx->trees; q = q->next, n = 31) {		while (n--) {			audit_put_chunk(q->c[n]);			q->c[n] = NULL;		}	}	while (n-- > ctx->tree_count) {		audit_put_chunk(q->c[n]);		q->c[n] = NULL;	}	ctx->trees = p;	ctx->tree_count = count;#endif} static void free_tree_refs(struct audit_context *ctx){	struct audit_tree_refs *p, *q;	for (p = ctx->first_trees; p; p = q) {		q = p->next;		kfree(p);	}} static int match_tree_refs(struct audit_context *ctx, struct audit_tree *tree){#ifdef CONFIG_AUDIT_TREE	struct audit_tree_refs *p;	int n;	if (!tree)		return 0;	/* full ones */	for (p = ctx->first_trees; p != ctx->trees; p = p->next) {		for (n = 0; n < 31; n++)			if (audit_tree_match(p->c[n], tree))				return 1;	}	/* partial */	if (p) {		for (n = ctx->tree_count; n < 31; n++)			if (audit_tree_match(p->c[n], tree))				return 1;	}#endif	return 0;} /* Determine if any context name data matches a rule's watch data *//* Compare a task_struct with an audit_rule.  Return 1 on match, 0 * otherwise. * * If task_creation is true, this is an explicit indication that we are * filtering a task rule at task creation time.  This and tsk == current are * the only situations where tsk->cred may be accessed without an rcu read lock. */static int audit_filter_rules(struct task_struct *tsk,			      struct audit_krule *rule,			      struct audit_context *ctx,			      struct audit_names *name,			      enum audit_state *state,			      bool task_creation){	const struct cred *cred;	int i, j, need_sid = 1;	u32 sid; 	cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation); 	for (i = 0; i < rule->field_count; i++) {		struct audit_field *f = &rule->fields[i];		int result = 0; 		switch (f->type) {		case AUDIT_PID:			result = audit_comparator(tsk->pid, f->op, f->val);			break;		case AUDIT_PPID:			if (ctx) {				if (!ctx->ppid)					ctx->ppid = sys_getppid();				result = audit_comparator(ctx->ppid, f->op, f->val);			}			break;		case AUDIT_UID:			result = audit_comparator(cred->uid, f->op, f->val);			break;		case AUDIT_EUID:			result = audit_comparator(cred->euid, f->op, f->val);			break;		case AUDIT_SUID:			result = audit_comparator(cred->suid, f->op, f->val);			break;		case AUDIT_FSUID:			result = audit_comparator(cred->fsuid, f->op, f->val);			break;		case AUDIT_GID:			result = audit_comparator(cred->gid, f->op, f->val);			break;		case AUDIT_EGID:			result = audit_comparator(cred->egid, f->op, f->val);			break;		case AUDIT_SGID:			result = audit_comparator(cred->sgid, f->op, f->val);			break;

Lines 1–500 of 2551. Load more