Blame view
kernel/audit.h
10.1 KB
fe7752bab [PATCH] Fix audit... |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
/* audit -- definition of audit_context structure and supporting types * * Copyright 2003-2004 Red Hat, Inc. * Copyright 2005 Hewlett-Packard Development Company, L.P. * Copyright 2005 IBM Corporation * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ #include <linux/fs.h> #include <linux/audit.h> |
9044e6bca [PATCH] fix deadl... |
24 |
#include <linux/skbuff.h> |
b24a30a73 audit: fix event ... |
25 |
#include <uapi/linux/mqueue.h> |
fe7752bab [PATCH] Fix audit... |
26 27 28 29 30 31 |
/* 0 = no checking 1 = put_count checking 2 = verbose put_count checking */ #define AUDIT_DEBUG 0 |
b24a30a73 audit: fix event ... |
32 33 34 35 |
/* AUDIT_NAMES is the number of slots we reserve in the audit_context * for saving names from getname(). If we get more names we will allocate * a name dynamically and also add those to the list anchored by names_list. */ #define AUDIT_NAMES 5 |
fe7752bab [PATCH] Fix audit... |
36 37 38 39 40 41 42 |
/* At task start time, the audit_state is set in the audit_context using a per-task filter. At syscall entry, the audit_state is augmented by the syscall filter. */ enum audit_state { AUDIT_DISABLED, /* Do not create per-task audit_context. * No syscall-specific audit records can * be generated. */ |
fe7752bab [PATCH] Fix audit... |
43 |
AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context, |
997f5b644 audit: remove AUD... |
44 |
* and fill it in at syscall |
fe7752bab [PATCH] Fix audit... |
45 46 47 48 49 50 51 52 53 54 55 |
* entry time. This makes a full * syscall record available if some * other part of the kernel decides it * should be recorded. */ AUDIT_RECORD_CONTEXT /* Create the per-task audit_context, * always fill it in at syscall entry * time, and always write out the audit * record at syscall exit time. */ }; /* Rule lists */ |
cfcad62c7 audit: seperate a... |
56 |
struct audit_watch; |
74c3cbe33 [PATCH] audit: wa... |
57 58 |
struct audit_tree; struct audit_chunk; |
fe7752bab [PATCH] Fix audit... |
59 |
struct audit_entry { |
93315ed6d [PATCH] audit str... |
60 61 62 |
struct list_head list; struct rcu_head rcu; struct audit_krule rule; |
fe7752bab [PATCH] Fix audit... |
63 |
}; |
b24a30a73 audit: fix event ... |
64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 |
struct audit_cap_data { kernel_cap_t permitted; kernel_cap_t inheritable; union { unsigned int fE; /* effective bit of file cap */ kernel_cap_t effective; /* effective set of process */ }; }; /* When fs/namei.c:getname() is called, we store the pointer in name and * we don't let putname() free it (instead we free all of the saved * pointers at syscall exit time). * * Further, in fs/namei.c:path_lookup() we store the inode and device. */ struct audit_names { struct list_head list; /* audit_context->names_list */ struct filename *name; int name_len; /* number of chars to log */ |
79f6530cb audit: fix mq_ope... |
84 |
bool hidden; /* don't log this record */ |
b24a30a73 audit: fix event ... |
85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 |
bool name_put; /* call __putname()? */ unsigned long ino; dev_t dev; umode_t mode; kuid_t uid; kgid_t gid; dev_t rdev; u32 osid; struct audit_cap_data fcap; unsigned int fcap_ver; unsigned char type; /* record type */ /* * This was an allocated audit_names and not from the array of * names allocated in the task audit context. Thus this name * should be freed on syscall exit. */ bool should_free; }; /* The per-task audit context. */ struct audit_context { int dummy; /* must be the first element */ int in_syscall; /* 1 if task is in a syscall */ enum audit_state state, current_state; unsigned int serial; /* serial number for record */ int major; /* syscall number */ struct timespec ctime; /* time of syscall entry */ unsigned long argv[4]; /* syscall arguments */ long return_code;/* syscall return code */ u64 prio; int return_valid; /* return code is valid */ /* * The names_list is the list of all audit_names collected during this * syscall. The first AUDIT_NAMES entries in the names_list will * actually be from the preallocated_names array for performance * reasons. Except during allocation they should never be referenced * through the preallocated_names array and should only be found/used * by running the names_list. */ struct audit_names preallocated_names[AUDIT_NAMES]; int name_count; /* total records in names_list */ struct list_head names_list; /* struct audit_names->list anchor */ char *filterkey; /* key for rule that triggered record */ struct path pwd; struct audit_aux_data *aux; struct audit_aux_data *aux_pids; struct sockaddr_storage *sockaddr; size_t sockaddr_len; /* Save things to print about task_struct */ pid_t pid, ppid; kuid_t uid, euid, suid, fsuid; kgid_t gid, egid, sgid, fsgid; unsigned long personality; int arch; pid_t target_pid; kuid_t target_auid; kuid_t target_uid; unsigned int target_sessionid; u32 target_sid; char target_comm[TASK_COMM_LEN]; struct audit_tree_refs *trees, *first_trees; struct list_head killed_trees; int tree_count; int type; union { struct { int nargs; long args[6]; } socketcall; struct { kuid_t uid; kgid_t gid; umode_t mode; u32 osid; int has_perm; uid_t perm_uid; gid_t perm_gid; umode_t perm_mode; unsigned long qbytes; } ipc; struct { mqd_t mqdes; struct mq_attr mqstat; } mq_getsetattr; struct { mqd_t mqdes; int sigev_signo; } mq_notify; struct { mqd_t mqdes; size_t msg_len; unsigned int msg_prio; struct timespec abs_timeout; } mq_sendrecv; struct { int oflag; umode_t mode; struct mq_attr attr; } mq_open; struct { pid_t pid; struct audit_cap_data cap; } capset; struct { int fd; int flags; } mmap; |
d9cfea91e audit: move audit... |
196 197 |
struct { int argc; |
d9cfea91e audit: move audit... |
198 |
} execve; |
b24a30a73 audit: fix event ... |
199 200 201 202 203 204 205 206 |
}; int fds[2]; #if AUDIT_DEBUG int put_count; int ino_count; #endif }; |
3e1d0bb62 audit: Convert in... |
207 |
extern u32 audit_ever_enabled; |
c782f242f [PATCH 1/2] audit... |
208 |
|
b24a30a73 audit: fix event ... |
209 210 211 212 213 214 215 216 217 |
extern void audit_copy_inode(struct audit_names *name, const struct dentry *dentry, const struct inode *inode); extern void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap); extern void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name); extern void audit_log_name(struct audit_context *context, struct audit_names *n, struct path *path, int record_num, int *call_panic); |
c782f242f [PATCH 1/2] audit... |
218 |
|
fe7752bab [PATCH] Fix audit... |
219 |
extern int audit_pid; |
fe7752bab [PATCH] Fix audit... |
220 |
|
f368c07d7 [PATCH] audit: pa... |
221 222 223 224 225 226 227 |
#define AUDIT_INODE_BUCKETS 32 extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; static inline int audit_hash_ino(u32 ino) { return (ino & (AUDIT_INODE_BUCKETS-1)); } |
e3d6b07b8 audit: optimize a... |
228 229 |
/* Indicates that audit should log the full pathname. */ #define AUDIT_NAME_FULL -1 |
55669bfa1 [PATCH] audit: AU... |
230 |
extern int audit_match_class(int class, unsigned syscall); |
f368c07d7 [PATCH] audit: pa... |
231 |
extern int audit_comparator(const u32 left, const u32 op, const u32 right); |
ca57ec0f0 audit: Add typesp... |
232 233 |
extern int audit_uid_comparator(kuid_t left, u32 op, kuid_t right); extern int audit_gid_comparator(kgid_t left, u32 op, kgid_t right); |
bfcec7087 audit: set the na... |
234 |
extern int parent_len(const char *path); |
e3d6b07b8 audit: optimize a... |
235 |
extern int audit_compare_dname_path(const char *dname, const char *path, int plen); |
f9441639e audit: fix netlin... |
236 237 238 |
extern struct sk_buff *audit_make_reply(__u32 portid, int seq, int type, int done, int multi, const void *payload, int size); |
fe7752bab [PATCH] Fix audit... |
239 |
extern void audit_panic(const char *message); |
3dc7e3153 [PATCH] support f... |
240 |
|
9044e6bca [PATCH] fix deadl... |
241 |
struct audit_netlink_list { |
f9441639e audit: fix netlin... |
242 |
__u32 portid; |
33faba7fa audit: listen in ... |
243 |
pid_t pid; |
9044e6bca [PATCH] fix deadl... |
244 245 246 247 |
struct sk_buff_head q; }; int audit_send_list(void *); |
33faba7fa audit: listen in ... |
248 249 250 |
struct audit_net { struct sock *nlsk; }; |
3dc7e3153 [PATCH] support f... |
251 |
extern int selinux_audit_rule_update(void); |
e1396065e [PATCH] collect s... |
252 |
|
74c3cbe33 [PATCH] audit: wa... |
253 254 |
extern struct mutex audit_filter_mutex; extern void audit_free_rule_rcu(struct rcu_head *); |
c782f242f [PATCH 1/2] audit... |
255 |
extern struct list_head audit_filter_list[]; |
74c3cbe33 [PATCH] audit: wa... |
256 |
|
939a67fc4 Audit: split audi... |
257 |
extern struct audit_entry *audit_dupe_rule(struct audit_krule *old); |
cfcad62c7 audit: seperate a... |
258 |
/* audit watch functions */ |
939a67fc4 Audit: split audi... |
259 |
#ifdef CONFIG_AUDIT_WATCH |
cfcad62c7 audit: seperate a... |
260 261 262 |
extern void audit_put_watch(struct audit_watch *watch); extern void audit_get_watch(struct audit_watch *watch); extern int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op); |
ae7b8f410 Audit: clean up t... |
263 |
extern int audit_add_watch(struct audit_krule *krule, struct list_head **list); |
a05fb6cc5 audit: do not get... |
264 |
extern void audit_remove_watch_rule(struct audit_krule *krule); |
cfcad62c7 audit: seperate a... |
265 |
extern char *audit_watch_path(struct audit_watch *watch); |
ae7b8f410 Audit: clean up t... |
266 |
extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev); |
939a67fc4 Audit: split audi... |
267 268 269 270 271 272 273 274 275 276 |
#else #define audit_put_watch(w) {} #define audit_get_watch(w) {} #define audit_to_watch(k, p, l, o) (-EINVAL) #define audit_add_watch(k, l) (-EINVAL) #define audit_remove_watch_rule(k) BUG() #define audit_watch_path(w) "" #define audit_watch_compare(w, i, d) 0 #endif /* CONFIG_AUDIT_WATCH */ |
cfcad62c7 audit: seperate a... |
277 |
|
74c3cbe33 [PATCH] audit: wa... |
278 279 280 281 282 283 284 285 286 |
#ifdef CONFIG_AUDIT_TREE extern struct audit_chunk *audit_tree_lookup(const struct inode *); extern void audit_put_chunk(struct audit_chunk *); extern int audit_tree_match(struct audit_chunk *, struct audit_tree *); extern int audit_make_tree(struct audit_krule *, char *, u32); extern int audit_add_tree_rule(struct audit_krule *); extern int audit_remove_tree_rule(struct audit_krule *); extern void audit_trim_trees(void); extern int audit_tag_tree(char *old, char *new); |
74c3cbe33 [PATCH] audit: wa... |
287 288 |
extern const char *audit_tree_path(struct audit_tree *); extern void audit_put_tree(struct audit_tree *); |
916d75761 Fix rule eviction... |
289 |
extern void audit_kill_trees(struct list_head *); |
74c3cbe33 [PATCH] audit: wa... |
290 291 292 293 294 295 296 297 |
#else #define audit_remove_tree_rule(rule) BUG() #define audit_add_tree_rule(rule) -EINVAL #define audit_make_tree(rule, str, op) -EINVAL #define audit_trim_trees() (void)0 #define audit_put_tree(tree) (void)0 #define audit_tag_tree(old, new) -EINVAL #define audit_tree_path(rule) "" /* never called */ |
916d75761 Fix rule eviction... |
298 |
#define audit_kill_trees(list) BUG() |
74c3cbe33 [PATCH] audit: wa... |
299 300 301 |
#endif extern char *audit_unpack_string(void **, size_t *, size_t); |
c782f242f [PATCH 1/2] audit... |
302 |
extern pid_t audit_sig_pid; |
cca080d9b userns: Convert a... |
303 |
extern kuid_t audit_sig_uid; |
c782f242f [PATCH 1/2] audit... |
304 |
extern u32 audit_sig_sid; |
e1396065e [PATCH] collect s... |
305 |
#ifdef CONFIG_AUDITSYSCALL |
e54dc2431 [PATCH] audit sig... |
306 307 |
extern int __audit_signal_info(int sig, struct task_struct *t); static inline int audit_signal_info(int sig, struct task_struct *t) |
e1396065e [PATCH] collect s... |
308 |
{ |
e54dc2431 [PATCH] audit sig... |
309 310 311 312 |
if (unlikely((audit_pid && t->tgid == audit_pid) || (audit_signals && !audit_dummy_context()))) return __audit_signal_info(sig, t); return 0; |
e1396065e [PATCH] collect s... |
313 |
} |
0590b9335 fixing audit rule... |
314 |
extern void audit_filter_inodes(struct task_struct *, struct audit_context *); |
916d75761 Fix rule eviction... |
315 |
extern struct list_head *audit_killed_trees(void); |
e1396065e [PATCH] collect s... |
316 |
#else |
e54dc2431 [PATCH] audit sig... |
317 |
#define audit_signal_info(s,t) AUDIT_DISABLED |
f368c07d7 [PATCH] audit: pa... |
318 |
#define audit_filter_inodes(t,c) AUDIT_DISABLED |
e1396065e [PATCH] collect s... |
319 |
#endif |
916d75761 Fix rule eviction... |
320 321 |
extern struct mutex audit_cmd_mutex; |