/* audit.c -- Auditing support * Gateway between the kernel (e.g., selinux) and the user-space audit daemon. * System-call specific features have moved to auditsc.c * * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina. * All Rights Reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA * * Written by Rickard E. (Rik) Faith <faith@redhat.com> * * Goals: 1) Integrate fully with Security Modules. *	  2) Minimal run-time overhead: *	     a) Minimal when syscall auditing is disabled (audit_enable=0). *	     b) Small when syscall auditing is enabled and no audit record *		is generated (defer as much work as possible to record *		generation time): *		i) context is allocated, *		ii) names from getname are stored without a copy, and *		iii) inode information stored from path_lookup. *	  3) Ability to disable syscall auditing at boot time (audit=0). *	  4) Usable by other parts of the kernel (if audit_log* is called, *	     then a syscall record will be generated automatically for the *	     current syscall). *	  5) Netlink interface to user-space. *	  6) Support low-overhead kernel-based filtering to minimize the *	     information that must be passed to user-space. * * Example user-space utilities: http://people.redhat.com/sgrubb/audit/ */ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include <linux/file.h>#include <linux/init.h>#include <linux/types.h>#include <linux/atomic.h>#include <linux/mm.h>#include <linux/export.h>#include <linux/slab.h>#include <linux/err.h>#include <linux/kthread.h>#include <linux/kernel.h>#include <linux/syscalls.h> #include <linux/audit.h> #include <net/sock.h>#include <net/netlink.h>#include <linux/skbuff.h>#ifdef CONFIG_SECURITY#include <linux/security.h>#endif#include <linux/freezer.h>#include <linux/pid_namespace.h>#include <net/netns/generic.h> #include "audit.h" /* No auditing will take place until audit_initialized == AUDIT_INITIALIZED. * (Initialization happens after skb_init is called.) */#define AUDIT_DISABLED		-1#define AUDIT_UNINITIALIZED	0#define AUDIT_INITIALIZED	1static int	audit_initialized; #define AUDIT_OFF	0#define AUDIT_ON	1#define AUDIT_LOCKED	2u32		audit_enabled;u32		audit_ever_enabled; EXPORT_SYMBOL_GPL(audit_enabled); /* Default state when kernel boots without any parameters. */static u32	audit_default; /* If auditing cannot proceed, audit_failure selects what happens. */static u32	audit_failure = AUDIT_FAIL_PRINTK; /* * If audit records are to be written to the netlink socket, audit_pid * contains the pid of the auditd process and audit_nlk_portid contains * the portid to use to send netlink messages to that process. */int		audit_pid;static __u32	audit_nlk_portid; /* If audit_rate_limit is non-zero, limit the rate of sending audit records * to that number per second.  This prevents DoS attacks, but results in * audit records being dropped. */static u32	audit_rate_limit; /* Number of outstanding audit_buffers allowed. * When set to zero, this means unlimited. */static u32	audit_backlog_limit = 64;#define AUDIT_BACKLOG_WAIT_TIME (60 * HZ)static u32	audit_backlog_wait_time = AUDIT_BACKLOG_WAIT_TIME; /* The identity of the user shutting down the audit system. */kuid_t		audit_sig_uid = INVALID_UID;pid_t		audit_sig_pid = -1;u32		audit_sig_sid = 0; /* Records can be lost in several ways:   0) [suppressed in audit_alloc]   1) out of memory in audit_log_start [kmalloc of struct audit_buffer]   2) out of memory in audit_log_move [alloc_skb]   3) suppressed due to audit_rate_limit   4) suppressed due to audit_backlog_limit*/static atomic_t    audit_lost = ATOMIC_INIT(0); /* The netlink socket. */static struct sock *audit_sock;static unsigned int audit_net_id; /* Hash for inode-based rules */struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; /* The audit_freelist is a list of pre-allocated audit buffers (if more * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of * being placed on the freelist). */static DEFINE_SPINLOCK(audit_freelist_lock);static int	   audit_freelist_count;static LIST_HEAD(audit_freelist); /* queue msgs to send via kauditd_task */static struct sk_buff_head audit_queue;/* queue msgs due to temporary unicast send problems */static struct sk_buff_head audit_retry_queue;/* queue msgs waiting for new auditd connection */static struct sk_buff_head audit_hold_queue; /* queue servicing thread */static struct task_struct *kauditd_task;static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait); /* waitqueue for callers who are blocked on the audit backlog */static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait); static struct audit_features af = {.vers = AUDIT_FEATURE_VERSION,				   .mask = -1,				   .features = 0,				   .lock = 0,}; static char *audit_feature_names[2] = {	"only_unset_loginuid",	"loginuid_immutable",};  /* Serialize requests from userspace. */DEFINE_MUTEX(audit_cmd_mutex); /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting * audit records.  Since printk uses a 1024 byte buffer, this buffer * should be at least that large. */#define AUDIT_BUFSIZ 1024 /* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the * audit_freelist.  Doing so eliminates many kmalloc/kfree calls. */#define AUDIT_MAXFREE  (2*NR_CPUS) /* The audit_buffer is used when formatting an audit record.  The caller * locks briefly to get the record off the freelist or to allocate the * buffer, and locks briefly to send the buffer to the netlink layer or * to place it on a transmit queue.  Multiple audit_buffers can be in * use simultaneously. */struct audit_buffer {	struct list_head     list;	struct sk_buff       *skb;	/* formatted skb ready to send */	struct audit_context *ctx;	/* NULL or associated context */	gfp_t		     gfp_mask;}; struct audit_reply {	__u32 portid;	struct net *net;	struct sk_buff *skb;}; static void audit_set_portid(struct audit_buffer *ab, __u32 portid){	if (ab) {		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);		nlh->nlmsg_pid = portid;	}} void audit_panic(const char *message){	switch (audit_failure) {	case AUDIT_FAIL_SILENT:		break;	case AUDIT_FAIL_PRINTK:		if (printk_ratelimit())			pr_err("%s\n", message);		break;	case AUDIT_FAIL_PANIC:		/* test audit_pid since printk is always losey, why bother? */		if (audit_pid)			panic("audit: %s\n", message);		break;	}} static inline int audit_rate_check(void){	static unsigned long	last_check = 0;	static int		messages   = 0;	static DEFINE_SPINLOCK(lock);	unsigned long		flags;	unsigned long		now;	unsigned long		elapsed;	int			retval	   = 0; 	if (!audit_rate_limit) return 1; 	spin_lock_irqsave(&lock, flags);	if (++messages < audit_rate_limit) {		retval = 1;	} else {		now     = jiffies;		elapsed = now - last_check;		if (elapsed > HZ) {			last_check = now;			messages   = 0;			retval     = 1;		}	}	spin_unlock_irqrestore(&lock, flags); 	return retval;} /** * audit_log_lost - conditionally log lost audit message event * @message: the message stating reason for lost audit message * * Emit at least 1 message per second, even if audit_rate_check is * throttling. * Always increment the lost messages counter.*/void audit_log_lost(const char *message){	static unsigned long	last_msg = 0;	static DEFINE_SPINLOCK(lock);	unsigned long		flags;	unsigned long		now;	int			print; 	atomic_inc(&audit_lost); 	print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit); 	if (!print) {		spin_lock_irqsave(&lock, flags);		now = jiffies;		if (now - last_msg > HZ) {			print = 1;			last_msg = now;		}		spin_unlock_irqrestore(&lock, flags);	} 	if (print) {		if (printk_ratelimit())			pr_warn("audit_lost=%u audit_rate_limit=%u audit_backlog_limit=%u\n",				atomic_read(&audit_lost),				audit_rate_limit,				audit_backlog_limit);		audit_panic(message);	}} static int audit_log_config_change(char *function_name, u32 new, u32 old,				   int allow_changes){	struct audit_buffer *ab;	int rc = 0; 	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);	if (unlikely(!ab))		return rc;	audit_log_format(ab, "%s=%u old=%u", function_name, new, old);	audit_log_session_info(ab);	rc = audit_log_task_context(ab);	if (rc)		allow_changes = 0; /* Something weird, deny request */	audit_log_format(ab, " res=%d", allow_changes);	audit_log_end(ab);	return rc;} static int audit_do_config_change(char *function_name, u32 *to_change, u32 new){	int allow_changes, rc = 0;	u32 old = *to_change; 	/* check if we are locked */	if (audit_enabled == AUDIT_LOCKED)		allow_changes = 0;	else		allow_changes = 1; 	if (audit_enabled != AUDIT_OFF) {		rc = audit_log_config_change(function_name, new, old, allow_changes);		if (rc)			allow_changes = 0;	} 	/* If we are allowed, make the change */	if (allow_changes == 1)		*to_change = new;	/* Not allowed, update reason */	else if (rc == 0)		rc = -EPERM;	return rc;} static int audit_set_rate_limit(u32 limit){	return audit_do_config_change("audit_rate_limit", &audit_rate_limit, limit);} static int audit_set_backlog_limit(u32 limit){	return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit, limit);} static int audit_set_backlog_wait_time(u32 timeout){	return audit_do_config_change("audit_backlog_wait_time",				      &audit_backlog_wait_time, timeout);} static int audit_set_enabled(u32 state){	int rc;	if (state > AUDIT_LOCKED)		return -EINVAL; 	rc =  audit_do_config_change("audit_enabled", &audit_enabled, state);	if (!rc)		audit_ever_enabled |= !!state; 	return rc;} static int audit_set_failure(u32 state){	if (state != AUDIT_FAIL_SILENT	    && state != AUDIT_FAIL_PRINTK	    && state != AUDIT_FAIL_PANIC)		return -EINVAL; 	return audit_do_config_change("audit_failure", &audit_failure, state);} /* * For one reason or another this nlh isn't getting delivered to the userspace * audit daemon, just send it to printk. */static void kauditd_printk_skb(struct sk_buff *skb){	struct nlmsghdr *nlh = nlmsg_hdr(skb);	char *data = nlmsg_data(nlh); 	if (nlh->nlmsg_type != AUDIT_EOE) {		if (printk_ratelimit())			pr_notice("type=%d %s\n", nlh->nlmsg_type, data);		else			audit_log_lost("printk limit exceeded");	}} /** * kauditd_hold_skb - Queue an audit record, waiting for auditd * @skb: audit record * * Description: * Queue the audit record, waiting for an instance of auditd.  When this * function is called we haven't given up yet on sending the record, but things * are not looking good.  The first thing we want to do is try to write the * record via printk and then see if we want to try and hold on to the record * and queue it, if we have room.  If we want to hold on to the record, but we * don't have room, record a record lost message. */static void kauditd_hold_skb(struct sk_buff *skb){	/* at this point it is uncertain if we will ever send this to auditd so	 * try to send the message via printk before we go any further */	kauditd_printk_skb(skb); 	/* can we just silently drop the message? */	if (!audit_default) {		kfree_skb(skb);		return;	} 	/* if we have room, queue the message */	if (!audit_backlog_limit ||	    skb_queue_len(&audit_hold_queue) < audit_backlog_limit) {		skb_queue_tail(&audit_hold_queue, skb);		return;	} 	/* we have no other options - drop the message */	audit_log_lost("kauditd hold queue overflow");	kfree_skb(skb);} /** * kauditd_retry_skb - Queue an audit record, attempt to send again to auditd * @skb: audit record * * Description: * Not as serious as kauditd_hold_skb() as we still have a connected auditd, * but for some reason we are having problems sending it audit records so * queue the given record and attempt to resend. */static void kauditd_retry_skb(struct sk_buff *skb){	/* NOTE: because records should only live in the retry queue for a	 * short period of time, before either being sent or moved to the hold	 * queue, we don't currently enforce a limit on this queue */	skb_queue_tail(&audit_retry_queue, skb);} /** * auditd_reset - Disconnect the auditd connection * * Description: * Break the auditd/kauditd connection and move all the records in the retry * queue into the hold queue in case auditd reconnects.  The audit_cmd_mutex * must be held when calling this function. */static void auditd_reset(void){	struct sk_buff *skb; 	/* break the connection */	if (audit_sock) {		sock_put(audit_sock);		audit_sock = NULL;	}	audit_pid = 0;	audit_nlk_portid = 0; 	/* flush all of the retry queue to the hold queue */	while ((skb = skb_dequeue(&audit_retry_queue)))		kauditd_hold_skb(skb);} /** * kauditd_send_unicast_skb - Send a record via unicast to auditd * @skb: audit record */static int kauditd_send_unicast_skb(struct sk_buff *skb){	int rc; 	/* if we know nothing is connected, don't even try the netlink call */	if (!audit_pid)		return -ECONNREFUSED; 	/* get an extra skb reference in case we fail to send */	skb_get(skb);	rc = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);	if (rc >= 0) {		consume_skb(skb);		rc = 0;	} 	return rc;} /* * kauditd_send_multicast_skb - Send a record to any multicast listeners * @skb: audit record * * Description: * This function doesn't consume an skb as might be expected since it has to * copy it anyways. */static void kauditd_send_multicast_skb(struct sk_buff *skb){

Lines 1–500 of 2190. Load more