/* audit.c -- Auditing support * Gateway between the kernel (e.g., selinux) and the user-space audit daemon. * System-call specific features have moved to auditsc.c * * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina. * All Rights Reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA * * Written by Rickard E. (Rik) Faith <faith@redhat.com> * * Goals: 1) Integrate fully with Security Modules. *	  2) Minimal run-time overhead: *	     a) Minimal when syscall auditing is disabled (audit_enable=0). *	     b) Small when syscall auditing is enabled and no audit record *		is generated (defer as much work as possible to record *		generation time): *		i) context is allocated, *		ii) names from getname are stored without a copy, and *		iii) inode information stored from path_lookup. *	  3) Ability to disable syscall auditing at boot time (audit=0). *	  4) Usable by other parts of the kernel (if audit_log* is called, *	     then a syscall record will be generated automatically for the *	     current syscall). *	  5) Netlink interface to user-space. *	  6) Support low-overhead kernel-based filtering to minimize the *	     information that must be passed to user-space. * * Example user-space utilities: http://people.redhat.com/sgrubb/audit/ */ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include <linux/file.h>#include <linux/init.h>#include <linux/types.h>#include <linux/atomic.h>#include <linux/mm.h>#include <linux/export.h>#include <linux/slab.h>#include <linux/err.h>#include <linux/kthread.h>#include <linux/kernel.h>#include <linux/syscalls.h>#include <linux/spinlock.h>#include <linux/rcupdate.h>#include <linux/mutex.h>#include <linux/gfp.h> #include <linux/audit.h> #include <net/sock.h>#include <net/netlink.h>#include <linux/skbuff.h>#ifdef CONFIG_SECURITY#include <linux/security.h>#endif#include <linux/freezer.h>#include <linux/pid_namespace.h>#include <net/netns/generic.h> #include "audit.h" /* No auditing will take place until audit_initialized == AUDIT_INITIALIZED. * (Initialization happens after skb_init is called.) */#define AUDIT_DISABLED		-1#define AUDIT_UNINITIALIZED	0#define AUDIT_INITIALIZED	1static int	audit_initialized; #define AUDIT_OFF	0#define AUDIT_ON	1#define AUDIT_LOCKED	2u32		audit_enabled;u32		audit_ever_enabled; EXPORT_SYMBOL_GPL(audit_enabled); /* Default state when kernel boots without any parameters. */static u32	audit_default; /* If auditing cannot proceed, audit_failure selects what happens. */static u32	audit_failure = AUDIT_FAIL_PRINTK; /* private audit network namespace index */static unsigned int audit_net_id; /** * struct audit_net - audit private network namespace data * @sk: communication socket */struct audit_net {	struct sock *sk;}; /** * struct auditd_connection - kernel/auditd connection state * @pid: auditd PID * @portid: netlink portid * @net: the associated network namespace * @lock: spinlock to protect write access * * Description: * This struct is RCU protected; you must either hold the RCU lock for reading * or the included spinlock for writing. */static struct auditd_connection {	int pid;	u32 portid;	struct net *net;	spinlock_t lock;} auditd_conn; /* If audit_rate_limit is non-zero, limit the rate of sending audit records * to that number per second.  This prevents DoS attacks, but results in * audit records being dropped. */static u32	audit_rate_limit; /* Number of outstanding audit_buffers allowed. * When set to zero, this means unlimited. */static u32	audit_backlog_limit = 64;#define AUDIT_BACKLOG_WAIT_TIME (60 * HZ)static u32	audit_backlog_wait_time = AUDIT_BACKLOG_WAIT_TIME; /* The identity of the user shutting down the audit system. */kuid_t		audit_sig_uid = INVALID_UID;pid_t		audit_sig_pid = -1;u32		audit_sig_sid = 0; /* Records can be lost in several ways:   0) [suppressed in audit_alloc]   1) out of memory in audit_log_start [kmalloc of struct audit_buffer]   2) out of memory in audit_log_move [alloc_skb]   3) suppressed due to audit_rate_limit   4) suppressed due to audit_backlog_limit*/static atomic_t	audit_lost = ATOMIC_INIT(0); /* Hash for inode-based rules */struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; /* The audit_freelist is a list of pre-allocated audit buffers (if more * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of * being placed on the freelist). */static DEFINE_SPINLOCK(audit_freelist_lock);static int	   audit_freelist_count;static LIST_HEAD(audit_freelist); /* queue msgs to send via kauditd_task */static struct sk_buff_head audit_queue;/* queue msgs due to temporary unicast send problems */static struct sk_buff_head audit_retry_queue;/* queue msgs waiting for new auditd connection */static struct sk_buff_head audit_hold_queue; /* queue servicing thread */static struct task_struct *kauditd_task;static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait); /* waitqueue for callers who are blocked on the audit backlog */static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait); static struct audit_features af = {.vers = AUDIT_FEATURE_VERSION,				   .mask = -1,				   .features = 0,				   .lock = 0,}; static char *audit_feature_names[2] = {	"only_unset_loginuid",	"loginuid_immutable",};  /* Serialize requests from userspace. */DEFINE_MUTEX(audit_cmd_mutex); /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting * audit records.  Since printk uses a 1024 byte buffer, this buffer * should be at least that large. */#define AUDIT_BUFSIZ 1024 /* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the * audit_freelist.  Doing so eliminates many kmalloc/kfree calls. */#define AUDIT_MAXFREE  (2*NR_CPUS) /* The audit_buffer is used when formatting an audit record.  The caller * locks briefly to get the record off the freelist or to allocate the * buffer, and locks briefly to send the buffer to the netlink layer or * to place it on a transmit queue.  Multiple audit_buffers can be in * use simultaneously. */struct audit_buffer {	struct list_head     list;	struct sk_buff       *skb;	/* formatted skb ready to send */	struct audit_context *ctx;	/* NULL or associated context */	gfp_t		     gfp_mask;}; struct audit_reply {	__u32 portid;	struct net *net;	struct sk_buff *skb;}; /** * auditd_test_task - Check to see if a given task is an audit daemon * @task: the task to check * * Description: * Return 1 if the task is a registered audit daemon, 0 otherwise. */int auditd_test_task(const struct task_struct *task){	int rc; 	rcu_read_lock();	rc = (auditd_conn.pid && task->tgid == auditd_conn.pid ? 1 : 0);	rcu_read_unlock(); 	return rc;} /** * audit_get_sk - Return the audit socket for the given network namespace * @net: the destination network namespace * * Description: * Returns the sock pointer if valid, NULL otherwise.  The caller must ensure * that a reference is held for the network namespace while the sock is in use. */static struct sock *audit_get_sk(const struct net *net){	struct audit_net *aunet; 	if (!net)		return NULL; 	aunet = net_generic(net, audit_net_id);	return aunet->sk;} static void audit_set_portid(struct audit_buffer *ab, __u32 portid){	if (ab) {		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);		nlh->nlmsg_pid = portid;	}} void audit_panic(const char *message){	switch (audit_failure) {	case AUDIT_FAIL_SILENT:		break;	case AUDIT_FAIL_PRINTK:		if (printk_ratelimit())			pr_err("%s\n", message);		break;	case AUDIT_FAIL_PANIC:		panic("audit: %s\n", message);		break;	}} static inline int audit_rate_check(void){	static unsigned long	last_check = 0;	static int		messages   = 0;	static DEFINE_SPINLOCK(lock);	unsigned long		flags;	unsigned long		now;	unsigned long		elapsed;	int			retval	   = 0; 	if (!audit_rate_limit) return 1; 	spin_lock_irqsave(&lock, flags);	if (++messages < audit_rate_limit) {		retval = 1;	} else {		now     = jiffies;		elapsed = now - last_check;		if (elapsed > HZ) {			last_check = now;			messages   = 0;			retval     = 1;		}	}	spin_unlock_irqrestore(&lock, flags); 	return retval;} /** * audit_log_lost - conditionally log lost audit message event * @message: the message stating reason for lost audit message * * Emit at least 1 message per second, even if audit_rate_check is * throttling. * Always increment the lost messages counter.*/void audit_log_lost(const char *message){	static unsigned long	last_msg = 0;	static DEFINE_SPINLOCK(lock);	unsigned long		flags;	unsigned long		now;	int			print; 	atomic_inc(&audit_lost); 	print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit); 	if (!print) {		spin_lock_irqsave(&lock, flags);		now = jiffies;		if (now - last_msg > HZ) {			print = 1;			last_msg = now;		}		spin_unlock_irqrestore(&lock, flags);	} 	if (print) {		if (printk_ratelimit())			pr_warn("audit_lost=%u audit_rate_limit=%u audit_backlog_limit=%u\n",				atomic_read(&audit_lost),				audit_rate_limit,				audit_backlog_limit);		audit_panic(message);	}} static int audit_log_config_change(char *function_name, u32 new, u32 old,				   int allow_changes){	struct audit_buffer *ab;	int rc = 0; 	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);	if (unlikely(!ab))		return rc;	audit_log_format(ab, "%s=%u old=%u", function_name, new, old);	audit_log_session_info(ab);	rc = audit_log_task_context(ab);	if (rc)		allow_changes = 0; /* Something weird, deny request */	audit_log_format(ab, " res=%d", allow_changes);	audit_log_end(ab);	return rc;} static int audit_do_config_change(char *function_name, u32 *to_change, u32 new){	int allow_changes, rc = 0;	u32 old = *to_change; 	/* check if we are locked */	if (audit_enabled == AUDIT_LOCKED)		allow_changes = 0;	else		allow_changes = 1; 	if (audit_enabled != AUDIT_OFF) {		rc = audit_log_config_change(function_name, new, old, allow_changes);		if (rc)			allow_changes = 0;	} 	/* If we are allowed, make the change */	if (allow_changes == 1)		*to_change = new;	/* Not allowed, update reason */	else if (rc == 0)		rc = -EPERM;	return rc;} static int audit_set_rate_limit(u32 limit){	return audit_do_config_change("audit_rate_limit", &audit_rate_limit, limit);} static int audit_set_backlog_limit(u32 limit){	return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit, limit);} static int audit_set_backlog_wait_time(u32 timeout){	return audit_do_config_change("audit_backlog_wait_time",				      &audit_backlog_wait_time, timeout);} static int audit_set_enabled(u32 state){	int rc;	if (state > AUDIT_LOCKED)		return -EINVAL; 	rc =  audit_do_config_change("audit_enabled", &audit_enabled, state);	if (!rc)		audit_ever_enabled |= !!state; 	return rc;} static int audit_set_failure(u32 state){	if (state != AUDIT_FAIL_SILENT	    && state != AUDIT_FAIL_PRINTK	    && state != AUDIT_FAIL_PANIC)		return -EINVAL; 	return audit_do_config_change("audit_failure", &audit_failure, state);} /** * auditd_set - Set/Reset the auditd connection state * @pid: auditd PID * @portid: auditd netlink portid * @net: auditd network namespace pointer * * Description: * This function will obtain and drop network namespace references as * necessary. */static void auditd_set(int pid, u32 portid, struct net *net){	unsigned long flags; 	spin_lock_irqsave(&auditd_conn.lock, flags);	auditd_conn.pid = pid;	auditd_conn.portid = portid;	if (auditd_conn.net)		put_net(auditd_conn.net);	if (net)		auditd_conn.net = get_net(net);	else		auditd_conn.net = NULL;	spin_unlock_irqrestore(&auditd_conn.lock, flags);} /** * kauditd_print_skb - Print the audit record to the ring buffer * @skb: audit record * * Whatever the reason, this packet may not make it to the auditd connection * so write it via printk so the information isn't completely lost. */static void kauditd_printk_skb(struct sk_buff *skb){	struct nlmsghdr *nlh = nlmsg_hdr(skb);	char *data = nlmsg_data(nlh); 	if (nlh->nlmsg_type != AUDIT_EOE && printk_ratelimit())		pr_notice("type=%d %s\n", nlh->nlmsg_type, data);} /** * kauditd_rehold_skb - Handle a audit record send failure in the hold queue * @skb: audit record * * Description: * This should only be used by the kauditd_thread when it fails to flush the * hold queue. */static void kauditd_rehold_skb(struct sk_buff *skb){	/* put the record back in the queue at the same place */	skb_queue_head(&audit_hold_queue, skb);} /** * kauditd_hold_skb - Queue an audit record, waiting for auditd * @skb: audit record * * Description: * Queue the audit record, waiting for an instance of auditd.  When this * function is called we haven't given up yet on sending the record, but things * are not looking good.  The first thing we want to do is try to write the * record via printk and then see if we want to try and hold on to the record * and queue it, if we have room.  If we want to hold on to the record, but we * don't have room, record a record lost message. */static void kauditd_hold_skb(struct sk_buff *skb){	/* at this point it is uncertain if we will ever send this to auditd so	 * try to send the message via printk before we go any further */

Lines 1–500 of 2344. Load more