1/* audit.c -- Auditing support
   2 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon.
   3 * System-call specific features have moved to auditsc.c
   4 *
   5 * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina.
   6 * All Rights Reserved.
   7 *
   8 * This program is free software; you can redistribute it and/or modify
   9 * it under the terms of the GNU General Public License as published by
  10 * the Free Software Foundation; either version 2 of the License, or
  11 * (at your option) any later version.
  12 *
  13 * This program is distributed in the hope that it will be useful,
  14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 * GNU General Public License for more details.
  17 *
  18 * You should have received a copy of the GNU General Public License
  19 * along with this program; if not, write to the Free Software
  20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21 *
  22 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
  23 *
  24 * Goals: 1) Integrate fully with Security Modules.
  25 *	  2) Minimal run-time overhead:
  26 *	     a) Minimal when syscall auditing is disabled (audit_enable=0).
  27 *	     b) Small when syscall auditing is enabled and no audit record
  28 *		is generated (defer as much work as possible to record
  29 *		generation time):
  30 *		i) context is allocated,
  31 *		ii) names from getname are stored without a copy, and
  32 *		iii) inode information stored from path_lookup.
  33 *	  3) Ability to disable syscall auditing at boot time (audit=0).
  34 *	  4) Usable by other parts of the kernel (if audit_log* is called,
  35 *	     then a syscall record will be generated automatically for the
  36 *	     current syscall).
  37 *	  5) Netlink interface to user-space.
  38 *	  6) Support low-overhead kernel-based filtering to minimize the
  39 *	     information that must be passed to user-space.
  40 *
  41 * Example user-space utilities: http://people.redhat.com/sgrubb/audit/
  42 */
  43
  44#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  45
  46#include <linux/init.h>
  47#include <asm/types.h>
  48#include <linux/atomic.h>
  49#include <linux/mm.h>
  50#include <linux/export.h>
  51#include <linux/slab.h>
  52#include <linux/err.h>
  53#include <linux/kthread.h>
  54#include <linux/kernel.h>
  55#include <linux/syscalls.h>
  56
  57#include <linux/audit.h>
  58
  59#include <net/sock.h>
  60#include <net/netlink.h>
  61#include <linux/skbuff.h>
  62#ifdef CONFIG_SECURITY
  63#include <linux/security.h>
  64#endif
 
  65#include <linux/freezer.h>
  66#include <linux/tty.h>
  67#include <linux/pid_namespace.h>
  68#include <net/netns/generic.h>
  69
  70#include "audit.h"
  71
  72/* No auditing will take place until audit_initialized == AUDIT_INITIALIZED.
  73 * (Initialization happens after skb_init is called.) */
  74#define AUDIT_DISABLED		-1
  75#define AUDIT_UNINITIALIZED	0
  76#define AUDIT_INITIALIZED	1
  77static int	audit_initialized;
  78
  79#define AUDIT_OFF	0
  80#define AUDIT_ON	1
  81#define AUDIT_LOCKED	2
  82u32		audit_enabled;
  83u32		audit_ever_enabled;
  84
  85EXPORT_SYMBOL_GPL(audit_enabled);
  86
  87/* Default state when kernel boots without any parameters. */
  88static u32	audit_default;
  89
  90/* If auditing cannot proceed, audit_failure selects what happens. */
  91static u32	audit_failure = AUDIT_FAIL_PRINTK;
  92
  93/*
  94 * If audit records are to be written to the netlink socket, audit_pid
  95 * contains the pid of the auditd process and audit_nlk_portid contains
  96 * the portid to use to send netlink messages to that process.
  97 */
  98int		audit_pid;
  99static __u32	audit_nlk_portid;
 100
 101/* If audit_rate_limit is non-zero, limit the rate of sending audit records
 102 * to that number per second.  This prevents DoS attacks, but results in
 103 * audit records being dropped. */
 104static u32	audit_rate_limit;
 105
 106/* Number of outstanding audit_buffers allowed.
 107 * When set to zero, this means unlimited. */
 108static u32	audit_backlog_limit = 64;
 109#define AUDIT_BACKLOG_WAIT_TIME (60 * HZ)
 110static u32	audit_backlog_wait_time = AUDIT_BACKLOG_WAIT_TIME;
 111static u32	audit_backlog_wait_overflow = 0;
 112
 113/* The identity of the user shutting down the audit system. */
 114kuid_t		audit_sig_uid = INVALID_UID;
 115pid_t		audit_sig_pid = -1;
 116u32		audit_sig_sid = 0;
 117
 118/* Records can be lost in several ways:
 119   0) [suppressed in audit_alloc]
 120   1) out of memory in audit_log_start [kmalloc of struct audit_buffer]
 121   2) out of memory in audit_log_move [alloc_skb]
 122   3) suppressed due to audit_rate_limit
 123   4) suppressed due to audit_backlog_limit
 124*/
 125static atomic_t    audit_lost = ATOMIC_INIT(0);
 126
 127/* The netlink socket. */
 128static struct sock *audit_sock;
 129int audit_net_id;
 130
 131/* Hash for inode-based rules */
 132struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
 133
 134/* The audit_freelist is a list of pre-allocated audit buffers (if more
 135 * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of
 136 * being placed on the freelist). */
 137static DEFINE_SPINLOCK(audit_freelist_lock);
 138static int	   audit_freelist_count;
 139static LIST_HEAD(audit_freelist);
 140
 141static struct sk_buff_head audit_skb_queue;
 142/* queue of skbs to send to auditd when/if it comes back */
 143static struct sk_buff_head audit_skb_hold_queue;
 144static struct task_struct *kauditd_task;
 145static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
 146static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
 147
 148static struct audit_features af = {.vers = AUDIT_FEATURE_VERSION,
 149				   .mask = -1,
 150				   .features = 0,
 151				   .lock = 0,};
 152
 153static char *audit_feature_names[2] = {
 154	"only_unset_loginuid",
 155	"loginuid_immutable",
 156};
 157
 158
 159/* Serialize requests from userspace. */
 160DEFINE_MUTEX(audit_cmd_mutex);
 161
 162/* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
 163 * audit records.  Since printk uses a 1024 byte buffer, this buffer
 164 * should be at least that large. */
 165#define AUDIT_BUFSIZ 1024
 166
 167/* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the
 168 * audit_freelist.  Doing so eliminates many kmalloc/kfree calls. */
 169#define AUDIT_MAXFREE  (2*NR_CPUS)
 170
 171/* The audit_buffer is used when formatting an audit record.  The caller
 172 * locks briefly to get the record off the freelist or to allocate the
 173 * buffer, and locks briefly to send the buffer to the netlink layer or
 174 * to place it on a transmit queue.  Multiple audit_buffers can be in
 175 * use simultaneously. */
 176struct audit_buffer {
 177	struct list_head     list;
 178	struct sk_buff       *skb;	/* formatted skb ready to send */
 179	struct audit_context *ctx;	/* NULL or associated context */
 180	gfp_t		     gfp_mask;
 181};
 182
 183struct audit_reply {
 184	__u32 portid;
 185	struct net *net;
 186	struct sk_buff *skb;
 187};
 188
 189static void audit_set_portid(struct audit_buffer *ab, __u32 portid)
 190{
 191	if (ab) {
 192		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
 193		nlh->nlmsg_pid = portid;
 194	}
 195}
 196
 197void audit_panic(const char *message)
 198{
 199	switch (audit_failure) {
 
 200	case AUDIT_FAIL_SILENT:
 201		break;
 202	case AUDIT_FAIL_PRINTK:
 203		if (printk_ratelimit())
 204			pr_err("%s\n", message);
 205		break;
 206	case AUDIT_FAIL_PANIC:
 207		/* test audit_pid since printk is always losey, why bother? */
 208		if (audit_pid)
 209			panic("audit: %s\n", message);
 210		break;
 211	}
 212}
 213
 214static inline int audit_rate_check(void)
 215{
 216	static unsigned long	last_check = 0;
 217	static int		messages   = 0;
 218	static DEFINE_SPINLOCK(lock);
 219	unsigned long		flags;
 220	unsigned long		now;
 221	unsigned long		elapsed;
 222	int			retval	   = 0;
 223
 224	if (!audit_rate_limit) return 1;
 225
 226	spin_lock_irqsave(&lock, flags);
 227	if (++messages < audit_rate_limit) {
 228		retval = 1;
 229	} else {
 230		now     = jiffies;
 231		elapsed = now - last_check;
 232		if (elapsed > HZ) {
 233			last_check = now;
 234			messages   = 0;
 235			retval     = 1;
 236		}
 237	}
 238	spin_unlock_irqrestore(&lock, flags);
 239
 240	return retval;
 241}
 242
 243/**
 244 * audit_log_lost - conditionally log lost audit message event
 245 * @message: the message stating reason for lost audit message
 246 *
 247 * Emit at least 1 message per second, even if audit_rate_check is
 248 * throttling.
 249 * Always increment the lost messages counter.
 250*/
 251void audit_log_lost(const char *message)
 252{
 253	static unsigned long	last_msg = 0;
 254	static DEFINE_SPINLOCK(lock);
 255	unsigned long		flags;
 256	unsigned long		now;
 257	int			print;
 258
 259	atomic_inc(&audit_lost);
 260
 261	print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
 262
 263	if (!print) {
 264		spin_lock_irqsave(&lock, flags);
 265		now = jiffies;
 266		if (now - last_msg > HZ) {
 267			print = 1;
 268			last_msg = now;
 269		}
 270		spin_unlock_irqrestore(&lock, flags);
 271	}
 272
 273	if (print) {
 274		if (printk_ratelimit())
 275			pr_warn("audit_lost=%u audit_rate_limit=%u audit_backlog_limit=%u\n",
 
 
 276				atomic_read(&audit_lost),
 277				audit_rate_limit,
 278				audit_backlog_limit);
 279		audit_panic(message);
 280	}
 281}
 282
 283static int audit_log_config_change(char *function_name, u32 new, u32 old,
 
 284				   int allow_changes)
 285{
 286	struct audit_buffer *ab;
 287	int rc = 0;
 288
 289	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
 290	if (unlikely(!ab))
 291		return rc;
 292	audit_log_format(ab, "%s=%u old=%u", function_name, new, old);
 293	audit_log_session_info(ab);
 294	rc = audit_log_task_context(ab);
 295	if (rc)
 296		allow_changes = 0; /* Something weird, deny request */
 
 
 
 
 
 
 
 
 297	audit_log_format(ab, " res=%d", allow_changes);
 298	audit_log_end(ab);
 299	return rc;
 300}
 301
 302static int audit_do_config_change(char *function_name, u32 *to_change, u32 new)
 
 
 303{
 304	int allow_changes, rc = 0;
 305	u32 old = *to_change;
 306
 307	/* check if we are locked */
 308	if (audit_enabled == AUDIT_LOCKED)
 309		allow_changes = 0;
 310	else
 311		allow_changes = 1;
 312
 313	if (audit_enabled != AUDIT_OFF) {
 314		rc = audit_log_config_change(function_name, new, old, allow_changes);
 
 315		if (rc)
 316			allow_changes = 0;
 317	}
 318
 319	/* If we are allowed, make the change */
 320	if (allow_changes == 1)
 321		*to_change = new;
 322	/* Not allowed, update reason */
 323	else if (rc == 0)
 324		rc = -EPERM;
 325	return rc;
 326}
 327
 328static int audit_set_rate_limit(u32 limit)
 329{
 330	return audit_do_config_change("audit_rate_limit", &audit_rate_limit, limit);
 331}
 332
 333static int audit_set_backlog_limit(u32 limit)
 334{
 335	return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit, limit);
 
 336}
 337
 338static int audit_set_backlog_wait_time(u32 timeout)
 
 339{
 340	return audit_do_config_change("audit_backlog_wait_time",
 341				      &audit_backlog_wait_time, timeout);
 342}
 343
 344static int audit_set_enabled(u32 state)
 345{
 346	int rc;
 347	if (state < AUDIT_OFF || state > AUDIT_LOCKED)
 348		return -EINVAL;
 349
 350	rc =  audit_do_config_change("audit_enabled", &audit_enabled, state);
 
 
 351	if (!rc)
 352		audit_ever_enabled |= !!state;
 353
 354	return rc;
 355}
 356
 357static int audit_set_failure(u32 state)
 358{
 359	if (state != AUDIT_FAIL_SILENT
 360	    && state != AUDIT_FAIL_PRINTK
 361	    && state != AUDIT_FAIL_PANIC)
 362		return -EINVAL;
 363
 364	return audit_do_config_change("audit_failure", &audit_failure, state);
 
 365}
 366
 367/*
 368 * Queue skbs to be sent to auditd when/if it comes back.  These skbs should
 369 * already have been sent via prink/syslog and so if these messages are dropped
 370 * it is not a huge concern since we already passed the audit_log_lost()
 371 * notification and stuff.  This is just nice to get audit messages during
 372 * boot before auditd is running or messages generated while auditd is stopped.
 373 * This only holds messages is audit_default is set, aka booting with audit=1
 374 * or building your kernel that way.
 375 */
 376static void audit_hold_skb(struct sk_buff *skb)
 377{
 378	if (audit_default &&
 379	    (!audit_backlog_limit ||
 380	     skb_queue_len(&audit_skb_hold_queue) < audit_backlog_limit))
 381		skb_queue_tail(&audit_skb_hold_queue, skb);
 382	else
 383		kfree_skb(skb);
 384}
 385
 386/*
 387 * For one reason or another this nlh isn't getting delivered to the userspace
 388 * audit daemon, just send it to printk.
 389 */
 390static void audit_printk_skb(struct sk_buff *skb)
 391{
 392	struct nlmsghdr *nlh = nlmsg_hdr(skb);
 393	char *data = nlmsg_data(nlh);
 394
 395	if (nlh->nlmsg_type != AUDIT_EOE) {
 396		if (printk_ratelimit())
 397			pr_notice("type=%d %s\n", nlh->nlmsg_type, data);
 398		else
 399			audit_log_lost("printk limit exceeded");
 400	}
 401
 402	audit_hold_skb(skb);
 403}
 404
 405static void kauditd_send_skb(struct sk_buff *skb)
 406{
 407	int err;
 408	/* take a reference in case we can't send it and we want to hold it */
 409	skb_get(skb);
 410	err = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
 411	if (err < 0) {
 412		BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
 413		if (audit_pid) {
 414			pr_err("*NO* daemon at audit_pid=%d\n", audit_pid);
 415			audit_log_lost("auditd disappeared");
 416			audit_pid = 0;
 417			audit_sock = NULL;
 418		}
 419		/* we might get lucky and get this in the next auditd */
 420		audit_hold_skb(skb);
 421	} else
 422		/* drop the extra reference if sent ok */
 423		consume_skb(skb);
 424}
 425
 426/*
 427 * flush_hold_queue - empty the hold queue if auditd appears
 428 *
 429 * If auditd just started, drain the queue of messages already
 430 * sent to syslog/printk.  Remember loss here is ok.  We already
 431 * called audit_log_lost() if it didn't go out normally.  so the
 432 * race between the skb_dequeue and the next check for audit_pid
 433 * doesn't matter.
 434 *
 435 * If you ever find kauditd to be too slow we can get a perf win
 436 * by doing our own locking and keeping better track if there
 437 * are messages in this queue.  I don't see the need now, but
 438 * in 5 years when I want to play with this again I'll see this
 439 * note and still have no friggin idea what i'm thinking today.
 440 */
 441static void flush_hold_queue(void)
 442{
 443	struct sk_buff *skb;
 444
 445	if (!audit_default || !audit_pid)
 446		return;
 447
 448	skb = skb_dequeue(&audit_skb_hold_queue);
 449	if (likely(!skb))
 450		return;
 451
 452	while (skb && audit_pid) {
 453		kauditd_send_skb(skb);
 454		skb = skb_dequeue(&audit_skb_hold_queue);
 455	}
 456
 457	/*
 458	 * if auditd just disappeared but we
 459	 * dequeued an skb we need to drop ref
 460	 */
 461	if (skb)
 462		consume_skb(skb);
 463}
 464
 465static int kauditd_thread(void *dummy)
 466{
 467	set_freezable();
 468	while (!kthread_should_stop()) {
 469		struct sk_buff *skb;
 470		DECLARE_WAITQUEUE(wait, current);
 471
 472		flush_hold_queue();
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 473
 474		skb = skb_dequeue(&audit_skb_queue);
 475
 476		if (skb) {
 477			if (skb_queue_len(&audit_skb_queue) <= audit_backlog_limit)
 478				wake_up(&audit_backlog_wait);
 479			if (audit_pid)
 480				kauditd_send_skb(skb);
 481			else
 482				audit_printk_skb(skb);
 483			continue;
 484		}
 485		set_current_state(TASK_INTERRUPTIBLE);
 486		add_wait_queue(&kauditd_wait, &wait);
 
 
 
 
 
 487
 488		if (!skb_queue_len(&audit_skb_queue)) {
 489			try_to_freeze();
 490			schedule();
 491		}
 492
 493		__set_current_state(TASK_RUNNING);
 494		remove_wait_queue(&kauditd_wait, &wait);
 495	}
 496	return 0;
 497}
 498
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 499int audit_send_list(void *_dest)
 500{
 501	struct audit_netlink_list *dest = _dest;
 
 502	struct sk_buff *skb;
 503	struct net *net = dest->net;
 504	struct audit_net *aunet = net_generic(net, audit_net_id);
 505
 506	/* wait for parent to finish and send an ACK */
 507	mutex_lock(&audit_cmd_mutex);
 508	mutex_unlock(&audit_cmd_mutex);
 509
 510	while ((skb = __skb_dequeue(&dest->q)) != NULL)
 511		netlink_unicast(aunet->nlsk, skb, dest->portid, 0);
 512
 513	put_net(net);
 514	kfree(dest);
 515
 516	return 0;
 517}
 518
 519struct sk_buff *audit_make_reply(__u32 portid, int seq, int type, int done,
 520				 int multi, const void *payload, int size)
 521{
 522	struct sk_buff	*skb;
 523	struct nlmsghdr	*nlh;
 524	void		*data;
 525	int		flags = multi ? NLM_F_MULTI : 0;
 526	int		t     = done  ? NLMSG_DONE  : type;
 527
 528	skb = nlmsg_new(size, GFP_KERNEL);
 529	if (!skb)
 530		return NULL;
 531
 532	nlh	= nlmsg_put(skb, portid, seq, t, size, flags);
 533	if (!nlh)
 534		goto out_kfree_skb;
 535	data = nlmsg_data(nlh);
 536	memcpy(data, payload, size);
 537	return skb;
 538
 539out_kfree_skb:
 540	kfree_skb(skb);
 
 541	return NULL;
 542}
 543
 544static int audit_send_reply_thread(void *arg)
 545{
 546	struct audit_reply *reply = (struct audit_reply *)arg;
 547	struct net *net = reply->net;
 548	struct audit_net *aunet = net_generic(net, audit_net_id);
 549
 550	mutex_lock(&audit_cmd_mutex);
 551	mutex_unlock(&audit_cmd_mutex);
 552
 553	/* Ignore failure. It'll only happen if the sender goes away,
 554	   because our timeout is set to infinite. */
 555	netlink_unicast(aunet->nlsk , reply->skb, reply->portid, 0);
 556	put_net(net);
 557	kfree(reply);
 558	return 0;
 559}
 560/**
 561 * audit_send_reply - send an audit reply message via netlink
 562 * @request_skb: skb of request we are replying to (used to target the reply)
 563 * @seq: sequence number
 564 * @type: audit message type
 565 * @done: done (last) flag
 566 * @multi: multi-part message flag
 567 * @payload: payload data
 568 * @size: payload size
 569 *
 570 * Allocates an skb, builds the netlink message, and sends it to the port id.
 571 * No failure notifications.
 572 */
 573static void audit_send_reply(struct sk_buff *request_skb, int seq, int type, int done,
 574			     int multi, const void *payload, int size)
 575{
 576	u32 portid = NETLINK_CB(request_skb).portid;
 577	struct net *net = sock_net(NETLINK_CB(request_skb).sk);
 578	struct sk_buff *skb;
 579	struct task_struct *tsk;
 580	struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),
 581					    GFP_KERNEL);
 582
 583	if (!reply)
 584		return;
 585
 586	skb = audit_make_reply(portid, seq, type, done, multi, payload, size);
 587	if (!skb)
 588		goto out;
 589
 590	reply->net = get_net(net);
 591	reply->portid = portid;
 592	reply->skb = skb;
 593
 594	tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
 595	if (!IS_ERR(tsk))
 596		return;
 597	kfree_skb(skb);
 598out:
 599	kfree(reply);
 600}
 601
 602/*
 603 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit
 604 * control messages.
 605 */
 606static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
 607{
 608	int err = 0;
 609
 610	/* Only support initial user namespace for now. */
 611	/*
 612	 * We return ECONNREFUSED because it tricks userspace into thinking
 613	 * that audit was not configured into the kernel.  Lots of users
 614	 * configure their PAM stack (because that's what the distro does)
 615	 * to reject login if unable to send messages to audit.  If we return
 616	 * ECONNREFUSED the PAM stack thinks the kernel does not have audit
 617	 * configured in and will let login proceed.  If we return EPERM
 618	 * userspace will reject all logins.  This should be removed when we
 619	 * support non init namespaces!!
 620	 */
 621	if (current_user_ns() != &init_user_ns)
 622		return -ECONNREFUSED;
 623
 624	switch (msg_type) {
 625	case AUDIT_LIST:
 626	case AUDIT_ADD:
 627	case AUDIT_DEL:
 628		return -EOPNOTSUPP;
 629	case AUDIT_GET:
 630	case AUDIT_SET:
 631	case AUDIT_GET_FEATURE:
 632	case AUDIT_SET_FEATURE:
 633	case AUDIT_LIST_RULES:
 
 
 634	case AUDIT_ADD_RULE:
 
 635	case AUDIT_DEL_RULE:
 636	case AUDIT_SIGNAL_INFO:
 637	case AUDIT_TTY_GET:
 638	case AUDIT_TTY_SET:
 639	case AUDIT_TRIM:
 640	case AUDIT_MAKE_EQUIV:
 641		/* Only support auditd and auditctl in initial pid namespace
 642		 * for now. */
 643		if ((task_active_pid_ns(current) != &init_pid_ns))
 644			return -EPERM;
 645
 646		if (!netlink_capable(skb, CAP_AUDIT_CONTROL))
 647			err = -EPERM;
 648		break;
 649	case AUDIT_USER:
 650	case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
 651	case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
 652		if (!netlink_capable(skb, CAP_AUDIT_WRITE))
 653			err = -EPERM;
 654		break;
 655	default:  /* bad msg */
 656		err = -EINVAL;
 657	}
 658
 659	return err;
 660}
 661
 662static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type)
 
 
 663{
 664	int rc = 0;
 665	uid_t uid = from_kuid(&init_user_ns, current_uid());
 666	pid_t pid = task_tgid_nr(current);
 667
 668	if (!audit_enabled && msg_type != AUDIT_USER_AVC) {
 669		*ab = NULL;
 670		return rc;
 671	}
 672
 673	*ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
 674	if (unlikely(!*ab))
 675		return rc;
 676	audit_log_format(*ab, "pid=%d uid=%u", pid, uid);
 677	audit_log_session_info(*ab);
 678	audit_log_task_context(*ab);
 679
 680	return rc;
 681}
 682
 683int is_audit_feature_set(int i)
 684{
 685	return af.features & AUDIT_FEATURE_TO_MASK(i);
 686}
 687
 688
 689static int audit_get_feature(struct sk_buff *skb)
 690{
 691	u32 seq;
 692
 693	seq = nlmsg_hdr(skb)->nlmsg_seq;
 694
 695	audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &af, sizeof(af));
 696
 697	return 0;
 698}
 699
 700static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature,
 701				     u32 old_lock, u32 new_lock, int res)
 702{
 703	struct audit_buffer *ab;
 704
 705	if (audit_enabled == AUDIT_OFF)
 706		return;
 707
 708	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_FEATURE_CHANGE);
 709	audit_log_task_info(ab, current);
 710	audit_log_format(ab, "feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d",
 711			 audit_feature_names[which], !!old_feature, !!new_feature,
 712			 !!old_lock, !!new_lock, res);
 713	audit_log_end(ab);
 714}
 715
 716static int audit_set_feature(struct sk_buff *skb)
 717{
 718	struct audit_features *uaf;
 719	int i;
 720
 721	BUILD_BUG_ON(AUDIT_LAST_FEATURE + 1 > sizeof(audit_feature_names)/sizeof(audit_feature_names[0]));
 722	uaf = nlmsg_data(nlmsg_hdr(skb));
 723
 724	/* if there is ever a version 2 we should handle that here */
 725
 726	for (i = 0; i <= AUDIT_LAST_FEATURE; i++) {
 727		u32 feature = AUDIT_FEATURE_TO_MASK(i);
 728		u32 old_feature, new_feature, old_lock, new_lock;
 729
 730		/* if we are not changing this feature, move along */
 731		if (!(feature & uaf->mask))
 732			continue;
 733
 734		old_feature = af.features & feature;
 735		new_feature = uaf->features & feature;
 736		new_lock = (uaf->lock | af.lock) & feature;
 737		old_lock = af.lock & feature;
 738
 739		/* are we changing a locked feature? */
 740		if (old_lock && (new_feature != old_feature)) {
 741			audit_log_feature_change(i, old_feature, new_feature,
 742						 old_lock, new_lock, 0);
 743			return -EPERM;
 744		}
 745	}
 746	/* nothing invalid, do the changes */
 747	for (i = 0; i <= AUDIT_LAST_FEATURE; i++) {
 748		u32 feature = AUDIT_FEATURE_TO_MASK(i);
 749		u32 old_feature, new_feature, old_lock, new_lock;
 750
 751		/* if we are not changing this feature, move along */
 752		if (!(feature & uaf->mask))
 753			continue;
 754
 755		old_feature = af.features & feature;
 756		new_feature = uaf->features & feature;
 757		old_lock = af.lock & feature;
 758		new_lock = (uaf->lock | af.lock) & feature;
 759
 760		if (new_feature != old_feature)
 761			audit_log_feature_change(i, old_feature, new_feature,
 762						 old_lock, new_lock, 1);
 763
 764		if (new_feature)
 765			af.features |= feature;
 766		else
 767			af.features &= ~feature;
 768		af.lock |= new_lock;
 769	}
 770
 771	return 0;
 772}
 773
 774static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 775{
 776	u32			seq;
 777	void			*data;
 
 778	int			err;
 779	struct audit_buffer	*ab;
 780	u16			msg_type = nlh->nlmsg_type;
 
 
 781	struct audit_sig_info   *sig_data;
 782	char			*ctx = NULL;
 783	u32			len;
 784
 785	err = audit_netlink_ok(skb, msg_type);
 786	if (err)
 787		return err;
 788
 789	/* As soon as there's any sign of userspace auditd,
 790	 * start kauditd to talk to it */
 791	if (!kauditd_task) {
 792		kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
 793		if (IS_ERR(kauditd_task)) {
 794			err = PTR_ERR(kauditd_task);
 795			kauditd_task = NULL;
 796			return err;
 797		}
 798	}
 
 
 
 
 
 
 799	seq  = nlh->nlmsg_seq;
 800	data = nlmsg_data(nlh);
 801
 802	switch (msg_type) {
 803	case AUDIT_GET: {
 804		struct audit_status	s;
 805		memset(&s, 0, sizeof(s));
 806		s.enabled		= audit_enabled;
 807		s.failure		= audit_failure;
 808		s.pid			= audit_pid;
 809		s.rate_limit		= audit_rate_limit;
 810		s.backlog_limit		= audit_backlog_limit;
 811		s.lost			= atomic_read(&audit_lost);
 812		s.backlog		= skb_queue_len(&audit_skb_queue);
 813		s.version		= AUDIT_VERSION_LATEST;
 814		s.backlog_wait_time	= audit_backlog_wait_time;
 815		audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &s, sizeof(s));
 816		break;
 817	}
 818	case AUDIT_SET: {
 819		struct audit_status	s;
 820		memset(&s, 0, sizeof(s));
 821		/* guard against past and future API changes */
 822		memcpy(&s, data, min_t(size_t, sizeof(s), nlmsg_len(nlh)));
 823		if (s.mask & AUDIT_STATUS_ENABLED) {
 824			err = audit_set_enabled(s.enabled);
 825			if (err < 0)
 826				return err;
 827		}
 828		if (s.mask & AUDIT_STATUS_FAILURE) {
 829			err = audit_set_failure(s.failure);
 
 830			if (err < 0)
 831				return err;
 832		}
 833		if (s.mask & AUDIT_STATUS_PID) {
 834			int new_pid = s.pid;
 835
 836			if ((!new_pid) && (task_tgid_vnr(current) != audit_pid))
 837				return -EACCES;
 838			if (audit_enabled != AUDIT_OFF)
 839				audit_log_config_change("audit_pid", new_pid, audit_pid, 1);
 
 
 
 840			audit_pid = new_pid;
 841			audit_nlk_portid = NETLINK_CB(skb).portid;
 842			audit_sock = skb->sk;
 843		}
 844		if (s.mask & AUDIT_STATUS_RATE_LIMIT) {
 845			err = audit_set_rate_limit(s.rate_limit);
 846			if (err < 0)
 847				return err;
 848		}
 849		if (s.mask & AUDIT_STATUS_BACKLOG_LIMIT) {
 850			err = audit_set_backlog_limit(s.backlog_limit);
 851			if (err < 0)
 852				return err;
 853		}
 854		if (s.mask & AUDIT_STATUS_BACKLOG_WAIT_TIME) {
 855			if (sizeof(s) > (size_t)nlh->nlmsg_len)
 856				return -EINVAL;
 857			if (s.backlog_wait_time < 0 ||
 858			    s.backlog_wait_time > 10*AUDIT_BACKLOG_WAIT_TIME)
 859				return -EINVAL;
 860			err = audit_set_backlog_wait_time(s.backlog_wait_time);
 861			if (err < 0)
 862				return err;
 863		}
 864		break;
 865	}
 866	case AUDIT_GET_FEATURE:
 867		err = audit_get_feature(skb);
 868		if (err)
 869			return err;
 870		break;
 871	case AUDIT_SET_FEATURE:
 872		err = audit_set_feature(skb);
 873		if (err)
 874			return err;
 875		break;
 876	case AUDIT_USER:
 877	case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
 878	case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
 879		if (!audit_enabled && msg_type != AUDIT_USER_AVC)
 880			return 0;
 881
 882		err = audit_filter_user(msg_type);
 883		if (err == 1) { /* match or error */
 884			err = 0;
 885			if (msg_type == AUDIT_USER_TTY) {
 886				err = tty_audit_push_current();
 
 887				if (err)
 888					break;
 889			}
 890			mutex_unlock(&audit_cmd_mutex);
 891			audit_log_common_recv_msg(&ab, msg_type);
 
 892			if (msg_type != AUDIT_USER_TTY)
 893				audit_log_format(ab, " msg='%.*s'",
 894						 AUDIT_MESSAGE_TEXT_MAX,
 895						 (char *)data);
 896			else {
 897				int size;
 898
 899				audit_log_format(ab, " data=");
 900				size = nlmsg_len(nlh);
 901				if (size > 0 &&
 902				    ((unsigned char *)data)[size - 1] == '\0')
 903					size--;
 904				audit_log_n_untrustedstring(ab, data, size);
 905			}
 906			audit_set_portid(ab, NETLINK_CB(skb).portid);
 
 
 
 
 
 
 
 
 
 
 
 
 
 907			audit_log_end(ab);
 908			mutex_lock(&audit_cmd_mutex);
 909		}
 
 
 
 
 
 910		break;
 911	case AUDIT_ADD_RULE:
 912	case AUDIT_DEL_RULE:
 913		if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
 914			return -EINVAL;
 915		if (audit_enabled == AUDIT_LOCKED) {
 916			audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
 917			audit_log_format(ab, " audit_enabled=%d res=0", audit_enabled);
 
 
 
 918			audit_log_end(ab);
 919			return -EPERM;
 920		}
 921		err = audit_rule_change(msg_type, NETLINK_CB(skb).portid,
 922					   seq, data, nlmsg_len(nlh));
 923		break;
 924	case AUDIT_LIST_RULES:
 925		err = audit_list_rules_send(skb, seq);
 
 
 926		break;
 927	case AUDIT_TRIM:
 928		audit_trim_trees();
 929		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
 
 
 
 930		audit_log_format(ab, " op=trim res=1");
 931		audit_log_end(ab);
 932		break;
 933	case AUDIT_MAKE_EQUIV: {
 934		void *bufp = data;
 935		u32 sizes[2];
 936		size_t msglen = nlmsg_len(nlh);
 937		char *old, *new;
 938
 939		err = -EINVAL;
 940		if (msglen < 2 * sizeof(u32))
 941			break;
 942		memcpy(sizes, bufp, 2 * sizeof(u32));
 943		bufp += 2 * sizeof(u32);
 944		msglen -= 2 * sizeof(u32);
 945		old = audit_unpack_string(&bufp, &msglen, sizes[0]);
 946		if (IS_ERR(old)) {
 947			err = PTR_ERR(old);
 948			break;
 949		}
 950		new = audit_unpack_string(&bufp, &msglen, sizes[1]);
 951		if (IS_ERR(new)) {
 952			err = PTR_ERR(new);
 953			kfree(old);
 954			break;
 955		}
 956		/* OK, here comes... */
 957		err = audit_tag_tree(old, new);
 958
 959		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
 
 960
 961		audit_log_format(ab, " op=make_equiv old=");
 962		audit_log_untrustedstring(ab, old);
 963		audit_log_format(ab, " new=");
 964		audit_log_untrustedstring(ab, new);
 965		audit_log_format(ab, " res=%d", !err);
 966		audit_log_end(ab);
 967		kfree(old);
 968		kfree(new);
 969		break;
 970	}
 971	case AUDIT_SIGNAL_INFO:
 972		len = 0;
 973		if (audit_sig_sid) {
 974			err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
 975			if (err)
 976				return err;
 977		}
 978		sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
 979		if (!sig_data) {
 980			if (audit_sig_sid)
 981				security_release_secctx(ctx, len);
 982			return -ENOMEM;
 983		}
 984		sig_data->uid = from_kuid(&init_user_ns, audit_sig_uid);
 985		sig_data->pid = audit_sig_pid;
 986		if (audit_sig_sid) {
 987			memcpy(sig_data->ctx, ctx, len);
 988			security_release_secctx(ctx, len);
 989		}
 990		audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0,
 991				 sig_data, sizeof(*sig_data) + len);
 992		kfree(sig_data);
 993		break;
 994	case AUDIT_TTY_GET: {
 995		struct audit_tty_status s;
 996		struct task_struct *tsk = current;
 997
 998		spin_lock(&tsk->sighand->siglock);
 999		s.enabled = tsk->signal->audit_tty;
1000		s.log_passwd = tsk->signal->audit_tty_log_passwd;
1001		spin_unlock(&tsk->sighand->siglock);
1002
1003		audit_send_reply(skb, seq, AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
 
 
 
 
 
 
 
 
 
 
 
1004		break;
1005	}
1006	case AUDIT_TTY_SET: {
1007		struct audit_tty_status s, old;
1008		struct task_struct *tsk = current;
1009		struct audit_buffer	*ab;
1010
1011		memset(&s, 0, sizeof(s));
1012		/* guard against past and future API changes */
1013		memcpy(&s, data, min_t(size_t, sizeof(s), nlmsg_len(nlh)));
1014		/* check if new data is valid */
1015		if ((s.enabled != 0 && s.enabled != 1) ||
1016		    (s.log_passwd != 0 && s.log_passwd != 1))
1017			err = -EINVAL;
1018
1019		spin_lock(&tsk->sighand->siglock);
1020		old.enabled = tsk->signal->audit_tty;
1021		old.log_passwd = tsk->signal->audit_tty_log_passwd;
1022		if (!err) {
1023			tsk->signal->audit_tty = s.enabled;
1024			tsk->signal->audit_tty_log_passwd = s.log_passwd;
1025		}
1026		spin_unlock(&tsk->sighand->siglock);
1027
1028		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
1029		audit_log_format(ab, " op=tty_set old-enabled=%d new-enabled=%d"
1030				 " old-log_passwd=%d new-log_passwd=%d res=%d",
1031				 old.enabled, s.enabled, old.log_passwd,
1032				 s.log_passwd, !err);
1033		audit_log_end(ab);
 
 
 
 
 
 
 
1034		break;
1035	}
1036	default:
1037		err = -EINVAL;
1038		break;
1039	}
1040
1041	return err < 0 ? err : 0;
1042}
1043
1044/*
1045 * Get message from skb.  Each message is processed by audit_receive_msg.
1046 * Malformed skbs with wrong length are discarded silently.
1047 */
1048static void audit_receive_skb(struct sk_buff *skb)
1049{
1050	struct nlmsghdr *nlh;
1051	/*
1052	 * len MUST be signed for nlmsg_next to be able to dec it below 0
1053	 * if the nlmsg_len was not aligned
1054	 */
1055	int len;
1056	int err;
1057
1058	nlh = nlmsg_hdr(skb);
1059	len = skb->len;
1060
1061	while (nlmsg_ok(nlh, len)) {
1062		err = audit_receive_msg(skb, nlh);
1063		/* if err or if this message says it wants a response */
1064		if (err || (nlh->nlmsg_flags & NLM_F_ACK))
1065			netlink_ack(skb, nlh, err);
1066
1067		nlh = nlmsg_next(nlh, &len);
1068	}
1069}
1070
1071/* Receive messages from netlink socket. */
1072static void audit_receive(struct sk_buff  *skb)
1073{
1074	mutex_lock(&audit_cmd_mutex);
1075	audit_receive_skb(skb);
1076	mutex_unlock(&audit_cmd_mutex);
1077}
1078
1079static int __net_init audit_net_init(struct net *net)
1080{
1081	struct netlink_kernel_cfg cfg = {
1082		.input	= audit_receive,
1083	};
1084
1085	struct audit_net *aunet = net_generic(net, audit_net_id);
1086
1087	aunet->nlsk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg);
1088	if (aunet->nlsk == NULL) {
1089		audit_panic("cannot initialize netlink socket in namespace");
1090		return -ENOMEM;
1091	}
1092	aunet->nlsk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
1093	return 0;
1094}
1095
1096static void __net_exit audit_net_exit(struct net *net)
1097{
1098	struct audit_net *aunet = net_generic(net, audit_net_id);
1099	struct sock *sock = aunet->nlsk;
1100	if (sock == audit_sock) {
1101		audit_pid = 0;
1102		audit_sock = NULL;
1103	}
1104
1105	RCU_INIT_POINTER(aunet->nlsk, NULL);
1106	synchronize_net();
1107	netlink_kernel_release(sock);
1108}
1109
1110static struct pernet_operations audit_net_ops __net_initdata = {
1111	.init = audit_net_init,
1112	.exit = audit_net_exit,
1113	.id = &audit_net_id,
1114	.size = sizeof(struct audit_net),
1115};
1116
1117/* Initialize audit support at boot time. */
1118static int __init audit_init(void)
1119{
1120	int i;
1121
1122	if (audit_initialized == AUDIT_DISABLED)
1123		return 0;
1124
1125	pr_info("initializing netlink subsys (%s)\n",
1126		audit_default ? "enabled" : "disabled");
1127	register_pernet_subsys(&audit_net_ops);
 
 
 
 
 
1128
1129	skb_queue_head_init(&audit_skb_queue);
1130	skb_queue_head_init(&audit_skb_hold_queue);
1131	audit_initialized = AUDIT_INITIALIZED;
1132	audit_enabled = audit_default;
1133	audit_ever_enabled |= !!audit_default;
1134
1135	audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
1136
1137	for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
1138		INIT_LIST_HEAD(&audit_inode_hash[i]);
1139
1140	return 0;
1141}
1142__initcall(audit_init);
1143
1144/* Process kernel command-line parameter at boot time.  audit=0 or audit=1. */
1145static int __init audit_enable(char *str)
1146{
1147	audit_default = !!simple_strtol(str, NULL, 0);
1148	if (!audit_default)
1149		audit_initialized = AUDIT_DISABLED;
1150
1151	pr_info("%s\n", audit_default ?
1152		"enabled (after initialization)" : "disabled (until reboot)");
1153
1154	return 1;
1155}
1156__setup("audit=", audit_enable);
1157
1158/* Process kernel command-line parameter at boot time.
1159 * audit_backlog_limit=<n> */
1160static int __init audit_backlog_limit_set(char *str)
1161{
1162	u32 audit_backlog_limit_arg;
1163
1164	pr_info("audit_backlog_limit: ");
1165	if (kstrtouint(str, 0, &audit_backlog_limit_arg)) {
1166		pr_cont("using default of %u, unable to parse %s\n",
1167			audit_backlog_limit, str);
1168		return 1;
1169	}
1170
1171	audit_backlog_limit = audit_backlog_limit_arg;
1172	pr_cont("%d\n", audit_backlog_limit);
1173
1174	return 1;
1175}
1176__setup("audit_backlog_limit=", audit_backlog_limit_set);
 
1177
1178static void audit_buffer_free(struct audit_buffer *ab)
1179{
1180	unsigned long flags;
1181
1182	if (!ab)
1183		return;
1184
1185	if (ab->skb)
1186		kfree_skb(ab->skb);
1187
1188	spin_lock_irqsave(&audit_freelist_lock, flags);
1189	if (audit_freelist_count > AUDIT_MAXFREE)
1190		kfree(ab);
1191	else {
1192		audit_freelist_count++;
1193		list_add(&ab->list, &audit_freelist);
1194	}
1195	spin_unlock_irqrestore(&audit_freelist_lock, flags);
1196}
1197
1198static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
1199						gfp_t gfp_mask, int type)
1200{
1201	unsigned long flags;
1202	struct audit_buffer *ab = NULL;
1203	struct nlmsghdr *nlh;
1204
1205	spin_lock_irqsave(&audit_freelist_lock, flags);
1206	if (!list_empty(&audit_freelist)) {
1207		ab = list_entry(audit_freelist.next,
1208				struct audit_buffer, list);
1209		list_del(&ab->list);
1210		--audit_freelist_count;
1211	}
1212	spin_unlock_irqrestore(&audit_freelist_lock, flags);
1213
1214	if (!ab) {
1215		ab = kmalloc(sizeof(*ab), gfp_mask);
1216		if (!ab)
1217			goto err;
1218	}
1219
1220	ab->ctx = ctx;
1221	ab->gfp_mask = gfp_mask;
1222
1223	ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask);
1224	if (!ab->skb)
1225		goto err;
1226
1227	nlh = nlmsg_put(ab->skb, 0, 0, type, 0, 0);
1228	if (!nlh)
1229		goto out_kfree_skb;
1230
1231	return ab;
1232
1233out_kfree_skb:
1234	kfree_skb(ab->skb);
1235	ab->skb = NULL;
1236err:
1237	audit_buffer_free(ab);
1238	return NULL;
1239}
1240
1241/**
1242 * audit_serial - compute a serial number for the audit record
1243 *
1244 * Compute a serial number for the audit record.  Audit records are
1245 * written to user-space as soon as they are generated, so a complete
1246 * audit record may be written in several pieces.  The timestamp of the
1247 * record and this serial number are used by the user-space tools to
1248 * determine which pieces belong to the same audit record.  The
1249 * (timestamp,serial) tuple is unique for each syscall and is live from
1250 * syscall entry to syscall exit.
1251 *
1252 * NOTE: Another possibility is to store the formatted records off the
1253 * audit context (for those records that have a context), and emit them
1254 * all at syscall exit.  However, this could delay the reporting of
1255 * significant errors until syscall exit (or never, if the system
1256 * halts).
1257 */
1258unsigned int audit_serial(void)
1259{
1260	static DEFINE_SPINLOCK(serial_lock);
1261	static unsigned int serial = 0;
1262
1263	unsigned long flags;
1264	unsigned int ret;
1265
1266	spin_lock_irqsave(&serial_lock, flags);
1267	do {
1268		ret = ++serial;
1269	} while (unlikely(!ret));
1270	spin_unlock_irqrestore(&serial_lock, flags);
1271
1272	return ret;
1273}
1274
1275static inline void audit_get_stamp(struct audit_context *ctx,
1276				   struct timespec *t, unsigned int *serial)
1277{
1278	if (!ctx || !auditsc_get_stamp(ctx, t, serial)) {
1279		*t = CURRENT_TIME;
1280		*serial = audit_serial();
1281	}
1282}
1283
1284/*
1285 * Wait for auditd to drain the queue a little
1286 */
1287static long wait_for_auditd(long sleep_time)
1288{
1289	DECLARE_WAITQUEUE(wait, current);
1290	set_current_state(TASK_UNINTERRUPTIBLE);
1291	add_wait_queue_exclusive(&audit_backlog_wait, &wait);
1292
1293	if (audit_backlog_limit &&
1294	    skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
1295		sleep_time = schedule_timeout(sleep_time);
1296
1297	__set_current_state(TASK_RUNNING);
1298	remove_wait_queue(&audit_backlog_wait, &wait);
1299
1300	return sleep_time;
1301}
1302
1303/**
1304 * audit_log_start - obtain an audit buffer
1305 * @ctx: audit_context (may be NULL)
1306 * @gfp_mask: type of allocation
1307 * @type: audit message type
1308 *
1309 * Returns audit_buffer pointer on success or NULL on error.
1310 *
1311 * Obtain an audit buffer.  This routine does locking to obtain the
1312 * audit buffer, but then no locking is required for calls to
1313 * audit_log_*format.  If the task (ctx) is a task that is currently in a
1314 * syscall, then the syscall is marked as auditable and an audit record
1315 * will be written at syscall exit.  If there is no associated task, then
1316 * task context (ctx) should be NULL.
1317 */
1318struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
1319				     int type)
1320{
1321	struct audit_buffer	*ab	= NULL;
1322	struct timespec		t;
1323	unsigned int		uninitialized_var(serial);
1324	int reserve = 5; /* Allow atomic callers to go up to five
1325			    entries over the normal backlog limit */
1326	unsigned long timeout_start = jiffies;
1327
1328	if (audit_initialized != AUDIT_INITIALIZED)
1329		return NULL;
1330
1331	if (unlikely(audit_filter_type(type)))
1332		return NULL;
1333
1334	if (gfp_mask & __GFP_WAIT) {
1335		if (audit_pid && audit_pid == current->pid)
1336			gfp_mask &= ~__GFP_WAIT;
1337		else
1338			reserve = 0;
1339	}
1340
1341	while (audit_backlog_limit
1342	       && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
1343		if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time) {
1344			long sleep_time;
1345
1346			sleep_time = timeout_start + audit_backlog_wait_time - jiffies;
1347			if (sleep_time > 0) {
1348				sleep_time = wait_for_auditd(sleep_time);
1349				if (sleep_time > 0)
1350					continue;
1351			}
 
 
 
 
 
 
1352		}
1353		if (audit_rate_check() && printk_ratelimit())
1354			pr_warn("audit_backlog=%d > audit_backlog_limit=%d\n",
1355				skb_queue_len(&audit_skb_queue),
1356				audit_backlog_limit);
 
 
1357		audit_log_lost("backlog limit exceeded");
1358		audit_backlog_wait_time = audit_backlog_wait_overflow;
1359		wake_up(&audit_backlog_wait);
1360		return NULL;
1361	}
1362
1363	audit_backlog_wait_time = AUDIT_BACKLOG_WAIT_TIME;
1364
1365	ab = audit_buffer_alloc(ctx, gfp_mask, type);
1366	if (!ab) {
1367		audit_log_lost("out of memory in audit_log_start");
1368		return NULL;
1369	}
1370
1371	audit_get_stamp(ab->ctx, &t, &serial);
1372
1373	audit_log_format(ab, "audit(%lu.%03lu:%u): ",
1374			 t.tv_sec, t.tv_nsec/1000000, serial);
1375	return ab;
1376}
1377
1378/**
1379 * audit_expand - expand skb in the audit buffer
1380 * @ab: audit_buffer
1381 * @extra: space to add at tail of the skb
1382 *
1383 * Returns 0 (no space) on failed expansion, or available space if
1384 * successful.
1385 */
1386static inline int audit_expand(struct audit_buffer *ab, int extra)
1387{
1388	struct sk_buff *skb = ab->skb;
1389	int oldtail = skb_tailroom(skb);
1390	int ret = pskb_expand_head(skb, 0, extra, ab->gfp_mask);
1391	int newtail = skb_tailroom(skb);
1392
1393	if (ret < 0) {
1394		audit_log_lost("out of memory in audit_expand");
1395		return 0;
1396	}
1397
1398	skb->truesize += newtail - oldtail;
1399	return newtail;
1400}
1401
1402/*
1403 * Format an audit message into the audit buffer.  If there isn't enough
1404 * room in the audit buffer, more room will be allocated and vsnprint
1405 * will be called a second time.  Currently, we assume that a printk
1406 * can't format message larger than 1024 bytes, so we don't either.
1407 */
1408static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
1409			      va_list args)
1410{
1411	int len, avail;
1412	struct sk_buff *skb;
1413	va_list args2;
1414
1415	if (!ab)
1416		return;
1417
1418	BUG_ON(!ab->skb);
1419	skb = ab->skb;
1420	avail = skb_tailroom(skb);
1421	if (avail == 0) {
1422		avail = audit_expand(ab, AUDIT_BUFSIZ);
1423		if (!avail)
1424			goto out;
1425	}
1426	va_copy(args2, args);
1427	len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args);
1428	if (len >= avail) {
1429		/* The printk buffer is 1024 bytes long, so if we get
1430		 * here and AUDIT_BUFSIZ is at least 1024, then we can
1431		 * log everything that printk could have logged. */
1432		avail = audit_expand(ab,
1433			max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
1434		if (!avail)
1435			goto out_va_end;
1436		len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
1437	}
 
1438	if (len > 0)
1439		skb_put(skb, len);
1440out_va_end:
1441	va_end(args2);
1442out:
1443	return;
1444}
1445
1446/**
1447 * audit_log_format - format a message into the audit buffer.
1448 * @ab: audit_buffer
1449 * @fmt: format string
1450 * @...: optional parameters matching @fmt string
1451 *
1452 * All the work is done in audit_log_vformat.
1453 */
1454void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
1455{
1456	va_list args;
1457
1458	if (!ab)
1459		return;
1460	va_start(args, fmt);
1461	audit_log_vformat(ab, fmt, args);
1462	va_end(args);
1463}
1464
1465/**
1466 * audit_log_hex - convert a buffer to hex and append it to the audit skb
1467 * @ab: the audit_buffer
1468 * @buf: buffer to convert to hex
1469 * @len: length of @buf to be converted
1470 *
1471 * No return value; failure to expand is silently ignored.
1472 *
1473 * This function will take the passed buf and convert it into a string of
1474 * ascii hex digits. The new string is placed onto the skb.
1475 */
1476void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
1477		size_t len)
1478{
1479	int i, avail, new_len;
1480	unsigned char *ptr;
1481	struct sk_buff *skb;
 
1482
1483	if (!ab)
1484		return;
1485
1486	BUG_ON(!ab->skb);
1487	skb = ab->skb;
1488	avail = skb_tailroom(skb);
1489	new_len = len<<1;
1490	if (new_len >= avail) {
1491		/* Round the buffer request up to the next multiple */
1492		new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
1493		avail = audit_expand(ab, new_len);
1494		if (!avail)
1495			return;
1496	}
1497
1498	ptr = skb_tail_pointer(skb);
1499	for (i = 0; i < len; i++)
1500		ptr = hex_byte_pack_upper(ptr, buf[i]);
 
 
1501	*ptr = 0;
1502	skb_put(skb, len << 1); /* new string is twice the old string */
1503}
1504
1505/*
1506 * Format a string of no more than slen characters into the audit buffer,
1507 * enclosed in quote marks.
1508 */
1509void audit_log_n_string(struct audit_buffer *ab, const char *string,
1510			size_t slen)
1511{
1512	int avail, new_len;
1513	unsigned char *ptr;
1514	struct sk_buff *skb;
1515
1516	if (!ab)
1517		return;
1518
1519	BUG_ON(!ab->skb);
1520	skb = ab->skb;
1521	avail = skb_tailroom(skb);
1522	new_len = slen + 3;	/* enclosing quotes + null terminator */
1523	if (new_len > avail) {
1524		avail = audit_expand(ab, new_len);
1525		if (!avail)
1526			return;
1527	}
1528	ptr = skb_tail_pointer(skb);
1529	*ptr++ = '"';
1530	memcpy(ptr, string, slen);
1531	ptr += slen;
1532	*ptr++ = '"';
1533	*ptr = 0;
1534	skb_put(skb, slen + 2);	/* don't include null terminator */
1535}
1536
1537/**
1538 * audit_string_contains_control - does a string need to be logged in hex
1539 * @string: string to be checked
1540 * @len: max length of the string to check
1541 */
1542int audit_string_contains_control(const char *string, size_t len)
1543{
1544	const unsigned char *p;
1545	for (p = string; p < (const unsigned char *)string + len; p++) {
1546		if (*p == '"' || *p < 0x21 || *p > 0x7e)
1547			return 1;
1548	}
1549	return 0;
1550}
1551
1552/**
1553 * audit_log_n_untrustedstring - log a string that may contain random characters
1554 * @ab: audit_buffer
1555 * @len: length of string (not including trailing null)
1556 * @string: string to be logged
1557 *
1558 * This code will escape a string that is passed to it if the string
1559 * contains a control character, unprintable character, double quote mark,
1560 * or a space. Unescaped strings will start and end with a double quote mark.
1561 * Strings that are escaped are printed in hex (2 digits per char).
1562 *
1563 * The caller specifies the number of characters in the string to log, which may
1564 * or may not be the entire string.
1565 */
1566void audit_log_n_untrustedstring(struct audit_buffer *ab, const char *string,
1567				 size_t len)
1568{
1569	if (audit_string_contains_control(string, len))
1570		audit_log_n_hex(ab, string, len);
1571	else
1572		audit_log_n_string(ab, string, len);
1573}
1574
1575/**
1576 * audit_log_untrustedstring - log a string that may contain random characters
1577 * @ab: audit_buffer
1578 * @string: string to be logged
1579 *
1580 * Same as audit_log_n_untrustedstring(), except that strlen is used to
1581 * determine string length.
1582 */
1583void audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
1584{
1585	audit_log_n_untrustedstring(ab, string, strlen(string));
1586}
1587
1588/* This is a helper-function to print the escaped d_path */
1589void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
1590		      const struct path *path)
1591{
1592	char *p, *pathname;
1593
1594	if (prefix)
1595		audit_log_format(ab, "%s", prefix);
1596
1597	/* We will allow 11 spaces for ' (deleted)' to be appended */
1598	pathname = kmalloc(PATH_MAX+11, ab->gfp_mask);
1599	if (!pathname) {
1600		audit_log_string(ab, "<no_memory>");
1601		return;
1602	}
1603	p = d_path(path, pathname, PATH_MAX+11);
1604	if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */
1605		/* FIXME: can we save some information here? */
1606		audit_log_string(ab, "<too_long>");
1607	} else
1608		audit_log_untrustedstring(ab, p);
1609	kfree(pathname);
1610}
1611
1612void audit_log_session_info(struct audit_buffer *ab)
1613{
1614	unsigned int sessionid = audit_get_sessionid(current);
1615	uid_t auid = from_kuid(&init_user_ns, audit_get_loginuid(current));
1616
1617	audit_log_format(ab, " auid=%u ses=%u", auid, sessionid);
1618}
1619
1620void audit_log_key(struct audit_buffer *ab, char *key)
1621{
1622	audit_log_format(ab, " key=");
1623	if (key)
1624		audit_log_untrustedstring(ab, key);
1625	else
1626		audit_log_format(ab, "(null)");
1627}
1628
1629void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap)
1630{
1631	int i;
1632
1633	audit_log_format(ab, " %s=", prefix);
1634	CAP_FOR_EACH_U32(i) {
1635		audit_log_format(ab, "%08x",
1636				 cap->cap[(_KERNEL_CAPABILITY_U32S-1) - i]);
1637	}
1638}
1639
1640void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
1641{
1642	kernel_cap_t *perm = &name->fcap.permitted;
1643	kernel_cap_t *inh = &name->fcap.inheritable;
1644	int log = 0;
1645
1646	if (!cap_isclear(*perm)) {
1647		audit_log_cap(ab, "cap_fp", perm);
1648		log = 1;
1649	}
1650	if (!cap_isclear(*inh)) {
1651		audit_log_cap(ab, "cap_fi", inh);
1652		log = 1;
1653	}
1654
1655	if (log)
1656		audit_log_format(ab, " cap_fe=%d cap_fver=%x",
1657				 name->fcap.fE, name->fcap_ver);
1658}
1659
1660static inline int audit_copy_fcaps(struct audit_names *name,
1661				   const struct dentry *dentry)
1662{
1663	struct cpu_vfs_cap_data caps;
1664	int rc;
1665
1666	if (!dentry)
1667		return 0;
1668
1669	rc = get_vfs_caps_from_disk(dentry, &caps);
1670	if (rc)
1671		return rc;
1672
1673	name->fcap.permitted = caps.permitted;
1674	name->fcap.inheritable = caps.inheritable;
1675	name->fcap.fE = !!(caps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
1676	name->fcap_ver = (caps.magic_etc & VFS_CAP_REVISION_MASK) >>
1677				VFS_CAP_REVISION_SHIFT;
1678
1679	return 0;
1680}
1681
1682/* Copy inode data into an audit_names. */
1683void audit_copy_inode(struct audit_names *name, const struct dentry *dentry,
1684		      const struct inode *inode)
1685{
1686	name->ino   = inode->i_ino;
1687	name->dev   = inode->i_sb->s_dev;
1688	name->mode  = inode->i_mode;
1689	name->uid   = inode->i_uid;
1690	name->gid   = inode->i_gid;
1691	name->rdev  = inode->i_rdev;
1692	security_inode_getsecid(inode, &name->osid);
1693	audit_copy_fcaps(name, dentry);
1694}
1695
1696/**
1697 * audit_log_name - produce AUDIT_PATH record from struct audit_names
1698 * @context: audit_context for the task
1699 * @n: audit_names structure with reportable details
1700 * @path: optional path to report instead of audit_names->name
1701 * @record_num: record number to report when handling a list of names
1702 * @call_panic: optional pointer to int that will be updated if secid fails
1703 */
1704void audit_log_name(struct audit_context *context, struct audit_names *n,
1705		    struct path *path, int record_num, int *call_panic)
1706{
1707	struct audit_buffer *ab;
1708	ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
1709	if (!ab)
1710		return;
1711
1712	audit_log_format(ab, "item=%d", record_num);
1713
1714	if (path)
1715		audit_log_d_path(ab, " name=", path);
1716	else if (n->name) {
1717		switch (n->name_len) {
1718		case AUDIT_NAME_FULL:
1719			/* log the full path */
1720			audit_log_format(ab, " name=");
1721			audit_log_untrustedstring(ab, n->name->name);
1722			break;
1723		case 0:
1724			/* name was specified as a relative path and the
1725			 * directory component is the cwd */
1726			audit_log_d_path(ab, " name=", &context->pwd);
1727			break;
1728		default:
1729			/* log the name's directory component */
1730			audit_log_format(ab, " name=");
1731			audit_log_n_untrustedstring(ab, n->name->name,
1732						    n->name_len);
1733		}
1734	} else
1735		audit_log_format(ab, " name=(null)");
1736
1737	if (n->ino != (unsigned long)-1) {
1738		audit_log_format(ab, " inode=%lu"
1739				 " dev=%02x:%02x mode=%#ho"
1740				 " ouid=%u ogid=%u rdev=%02x:%02x",
1741				 n->ino,
1742				 MAJOR(n->dev),
1743				 MINOR(n->dev),
1744				 n->mode,
1745				 from_kuid(&init_user_ns, n->uid),
1746				 from_kgid(&init_user_ns, n->gid),
1747				 MAJOR(n->rdev),
1748				 MINOR(n->rdev));
1749	}
1750	if (n->osid != 0) {
1751		char *ctx = NULL;
1752		u32 len;
1753		if (security_secid_to_secctx(
1754			n->osid, &ctx, &len)) {
1755			audit_log_format(ab, " osid=%u", n->osid);
1756			if (call_panic)
1757				*call_panic = 2;
1758		} else {
1759			audit_log_format(ab, " obj=%s", ctx);
1760			security_release_secctx(ctx, len);
1761		}
1762	}
1763
1764	/* log the audit_names record type */
1765	audit_log_format(ab, " nametype=");
1766	switch(n->type) {
1767	case AUDIT_TYPE_NORMAL:
1768		audit_log_format(ab, "NORMAL");
1769		break;
1770	case AUDIT_TYPE_PARENT:
1771		audit_log_format(ab, "PARENT");
1772		break;
1773	case AUDIT_TYPE_CHILD_DELETE:
1774		audit_log_format(ab, "DELETE");
1775		break;
1776	case AUDIT_TYPE_CHILD_CREATE:
1777		audit_log_format(ab, "CREATE");
1778		break;
1779	default:
1780		audit_log_format(ab, "UNKNOWN");
1781		break;
1782	}
1783
1784	audit_log_fcaps(ab, n);
1785	audit_log_end(ab);
1786}
1787
1788int audit_log_task_context(struct audit_buffer *ab)
1789{
1790	char *ctx = NULL;
1791	unsigned len;
1792	int error;
1793	u32 sid;
1794
1795	security_task_getsecid(current, &sid);
1796	if (!sid)
1797		return 0;
1798
1799	error = security_secid_to_secctx(sid, &ctx, &len);
1800	if (error) {
1801		if (error != -EINVAL)
1802			goto error_path;
1803		return 0;
1804	}
1805
1806	audit_log_format(ab, " subj=%s", ctx);
1807	security_release_secctx(ctx, len);
1808	return 0;
1809
1810error_path:
1811	audit_panic("error in audit_log_task_context");
1812	return error;
1813}
1814EXPORT_SYMBOL(audit_log_task_context);
1815
1816void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
1817{
1818	const struct cred *cred;
1819	char name[sizeof(tsk->comm)];
1820	struct mm_struct *mm = tsk->mm;
1821	char *tty;
1822
1823	if (!ab)
1824		return;
1825
1826	/* tsk == current */
1827	cred = current_cred();
1828
1829	spin_lock_irq(&tsk->sighand->siglock);
1830	if (tsk->signal && tsk->signal->tty && tsk->signal->tty->name)
1831		tty = tsk->signal->tty->name;
1832	else
1833		tty = "(none)";
1834	spin_unlock_irq(&tsk->sighand->siglock);
1835
1836	audit_log_format(ab,
1837			 " ppid=%d pid=%d auid=%u uid=%u gid=%u"
1838			 " euid=%u suid=%u fsuid=%u"
1839			 " egid=%u sgid=%u fsgid=%u tty=%s ses=%u",
1840			 task_ppid_nr(tsk),
1841			 task_pid_nr(tsk),
1842			 from_kuid(&init_user_ns, audit_get_loginuid(tsk)),
1843			 from_kuid(&init_user_ns, cred->uid),
1844			 from_kgid(&init_user_ns, cred->gid),
1845			 from_kuid(&init_user_ns, cred->euid),
1846			 from_kuid(&init_user_ns, cred->suid),
1847			 from_kuid(&init_user_ns, cred->fsuid),
1848			 from_kgid(&init_user_ns, cred->egid),
1849			 from_kgid(&init_user_ns, cred->sgid),
1850			 from_kgid(&init_user_ns, cred->fsgid),
1851			 tty, audit_get_sessionid(tsk));
1852
1853	get_task_comm(name, tsk);
1854	audit_log_format(ab, " comm=");
1855	audit_log_untrustedstring(ab, name);
1856
1857	if (mm) {
1858		down_read(&mm->mmap_sem);
1859		if (mm->exe_file)
1860			audit_log_d_path(ab, " exe=", &mm->exe_file->f_path);
1861		up_read(&mm->mmap_sem);
1862	} else
1863		audit_log_format(ab, " exe=(null)");
1864	audit_log_task_context(ab);
1865}
1866EXPORT_SYMBOL(audit_log_task_info);
1867
1868/**
1869 * audit_log_link_denied - report a link restriction denial
1870 * @operation: specific link opreation
1871 * @link: the path that triggered the restriction
1872 */
1873void audit_log_link_denied(const char *operation, struct path *link)
1874{
1875	struct audit_buffer *ab;
1876	struct audit_names *name;
1877
1878	name = kzalloc(sizeof(*name), GFP_NOFS);
1879	if (!name)
1880		return;
1881
1882	/* Generate AUDIT_ANOM_LINK with subject, operation, outcome. */
1883	ab = audit_log_start(current->audit_context, GFP_KERNEL,
1884			     AUDIT_ANOM_LINK);
1885	if (!ab)
1886		goto out;
1887	audit_log_format(ab, "op=%s", operation);
1888	audit_log_task_info(ab, current);
1889	audit_log_format(ab, " res=0");
1890	audit_log_end(ab);
1891
1892	/* Generate AUDIT_PATH record with object. */
1893	name->type = AUDIT_TYPE_NORMAL;
1894	audit_copy_inode(name, link->dentry, link->dentry->d_inode);
1895	audit_log_name(current->audit_context, name, link, 0, NULL);
1896out:
1897	kfree(name);
1898}
1899
1900/**
1901 * audit_log_end - end one audit record
1902 * @ab: the audit_buffer
1903 *
1904 * The netlink_* functions cannot be called inside an irq context, so
1905 * the audit buffer is placed on a queue and a tasklet is scheduled to
1906 * remove them from the queue outside the irq context.  May be called in
1907 * any context.
1908 */
1909void audit_log_end(struct audit_buffer *ab)
1910{
1911	if (!ab)
1912		return;
1913	if (!audit_rate_check()) {
1914		audit_log_lost("rate limit exceeded");
1915	} else {
1916		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
1917		nlh->nlmsg_len = ab->skb->len - NLMSG_HDRLEN;
1918
1919		if (audit_pid) {
1920			skb_queue_tail(&audit_skb_queue, ab->skb);
1921			wake_up_interruptible(&kauditd_wait);
1922		} else {
1923			audit_printk_skb(ab->skb);
1924		}
1925		ab->skb = NULL;
1926	}
1927	audit_buffer_free(ab);
1928}
1929
1930/**
1931 * audit_log - Log an audit record
1932 * @ctx: audit context
1933 * @gfp_mask: type of allocation
1934 * @type: audit message type
1935 * @fmt: format string to use
1936 * @...: variable parameters matching the format string
1937 *
1938 * This is a convenience function that calls audit_log_start,
1939 * audit_log_vformat, and audit_log_end.  It may be called
1940 * in any context.
1941 */
1942void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
1943	       const char *fmt, ...)
1944{
1945	struct audit_buffer *ab;
1946	va_list args;
1947
1948	ab = audit_log_start(ctx, gfp_mask, type);
1949	if (ab) {
1950		va_start(args, fmt);
1951		audit_log_vformat(ab, fmt, args);
1952		va_end(args);
1953		audit_log_end(ab);
1954	}
1955}
1956
1957#ifdef CONFIG_SECURITY
1958/**
1959 * audit_log_secctx - Converts and logs SELinux context
1960 * @ab: audit_buffer
1961 * @secid: security number
1962 *
1963 * This is a helper function that calls security_secid_to_secctx to convert
1964 * secid to secctx and then adds the (converted) SELinux context to the audit
1965 * log by calling audit_log_format, thus also preventing leak of internal secid
1966 * to userspace. If secid cannot be converted audit_panic is called.
1967 */
1968void audit_log_secctx(struct audit_buffer *ab, u32 secid)
1969{
1970	u32 len;
1971	char *secctx;
1972
1973	if (security_secid_to_secctx(secid, &secctx, &len)) {
1974		audit_panic("Cannot convert secid to context");
1975	} else {
1976		audit_log_format(ab, " obj=%s", secctx);
1977		security_release_secctx(secctx, len);
1978	}
1979}
1980EXPORT_SYMBOL(audit_log_secctx);
1981#endif
1982
1983EXPORT_SYMBOL(audit_log_start);
1984EXPORT_SYMBOL(audit_log_end);
1985EXPORT_SYMBOL(audit_log_format);
1986EXPORT_SYMBOL(audit_log);