Eric Lee / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit ef00be0554f1af9f2b685e0e3bb9e2ec0181937e

Authored by Andrew Morton
Committed by Al Viro
1 parent b593d384ef
Exists in master and in 39 other branches 8mp-imx_5.4.70_2.3.0, 8qm-imx_5.4.70_2.3.0, emb_imx_lf-5.15.y, emb_lf-6.1.y, imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, imx_4.1.15_1.0.0_ga, pitx_8mp_lf-5.10.y, rt-smarc-imx_4.1.15_1.0.0_ga, rt_linux_5.15.71, smarc-8m-android-11.0.0_2.0.0, smarc-imx6_4.14.98_2.0.0_ga, smarc-imx6_4.9.88_2.0.0_ga, smarc-imx7_4.14.98_2.0.0_ga, smarc-imx7_4.9.11_1.0.0_ga, smarc-imx7_4.9.88_2.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-imx_4.1.15_1.0.0_ga, smarc-imx_4.9.11_1.0.0_ga, smarc-imx_4.9.51_imx8m_ga, smarc-imx_4.9.88_2.0.0_ga, smarc-m6.0.1_2.1.0-ga, smarc-n7.1.2_2.0.0-ga, smarc-rel_imx_4.1.15_1.2.0_ga, smarc_8m_00d0_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.14.78_1.0.0_ga, smarc_8m_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.19.35_1.1.0, smarc_8mm_imx_4.14.78_1.0.0_ga, smarc_8mm_imx_4.14.98_2.0.0_ga, smarc_8mm_imx_4.19.35_1.1.0, smarc_8mm_imx_5.4.24_2.1.0, smarc_8mp_lf-5.10.y, smarc_8mq_imx_5.4.24_2.1.0, smarc_8mq_lf-5.10.y, smarc_imx_lf-5.15.y

[patch 1/2] kernel/audit.c: warning fix 

kernel/audit.c: In function 'audit_log_start':
kernel/audit.c:1133: warning: 'serial' may be used uninitialized in this function

Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

Showing 1 changed file with 1 additions and 1 deletions Inline Diff

1 /* audit.c -- Auditing support 1 /* audit.c -- Auditing support
2 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon. 2 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon.
3 * System-call specific features have moved to auditsc.c 3 * System-call specific features have moved to auditsc.c
4 * 4 *
5 * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina. 5 * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina.
6 * All Rights Reserved. 6 * All Rights Reserved.
7 * 7 *
8 * This program is free software; you can redistribute it and/or modify 8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by 9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or 10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version. 11 * (at your option) any later version.
12 * 12 *
13 * This program is distributed in the hope that it will be useful, 13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details. 16 * GNU General Public License for more details.
17 * 17 *
18 * You should have received a copy of the GNU General Public License 18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software 19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 * 21 *
22 * Written by Rickard E. (Rik) Faith <faith@redhat.com> 22 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
23 * 23 *
24 * Goals: 1) Integrate fully with SELinux. 24 * Goals: 1) Integrate fully with SELinux.
25 * 2) Minimal run-time overhead: 25 * 2) Minimal run-time overhead:
26 * a) Minimal when syscall auditing is disabled (audit_enable=0). 26 * a) Minimal when syscall auditing is disabled (audit_enable=0).
27 * b) Small when syscall auditing is enabled and no audit record 27 * b) Small when syscall auditing is enabled and no audit record
28 * is generated (defer as much work as possible to record 28 * is generated (defer as much work as possible to record
29 * generation time): 29 * generation time):
30 * i) context is allocated, 30 * i) context is allocated,
31 * ii) names from getname are stored without a copy, and 31 * ii) names from getname are stored without a copy, and
32 * iii) inode information stored from path_lookup. 32 * iii) inode information stored from path_lookup.
33 * 3) Ability to disable syscall auditing at boot time (audit=0). 33 * 3) Ability to disable syscall auditing at boot time (audit=0).
34 * 4) Usable by other parts of the kernel (if audit_log* is called, 34 * 4) Usable by other parts of the kernel (if audit_log* is called,
35 * then a syscall record will be generated automatically for the 35 * then a syscall record will be generated automatically for the
36 * current syscall). 36 * current syscall).
37 * 5) Netlink interface to user-space. 37 * 5) Netlink interface to user-space.
38 * 6) Support low-overhead kernel-based filtering to minimize the 38 * 6) Support low-overhead kernel-based filtering to minimize the
39 * information that must be passed to user-space. 39 * information that must be passed to user-space.
40 * 40 *
41 * Example user-space utilities: http://people.redhat.com/sgrubb/audit/ 41 * Example user-space utilities: http://people.redhat.com/sgrubb/audit/
42 */ 42 */
43 43
44 #include <linux/init.h> 44 #include <linux/init.h>
45 #include <asm/types.h> 45 #include <asm/types.h>
46 #include <asm/atomic.h> 46 #include <asm/atomic.h>
47 #include <linux/mm.h> 47 #include <linux/mm.h>
48 #include <linux/module.h> 48 #include <linux/module.h>
49 #include <linux/err.h> 49 #include <linux/err.h>
50 #include <linux/kthread.h> 50 #include <linux/kthread.h>
51 51
52 #include <linux/audit.h> 52 #include <linux/audit.h>
53 53
54 #include <net/sock.h> 54 #include <net/sock.h>
55 #include <net/netlink.h> 55 #include <net/netlink.h>
56 #include <linux/skbuff.h> 56 #include <linux/skbuff.h>
57 #include <linux/netlink.h> 57 #include <linux/netlink.h>
58 #include <linux/selinux.h> 58 #include <linux/selinux.h>
59 #include <linux/inotify.h> 59 #include <linux/inotify.h>
60 #include <linux/freezer.h> 60 #include <linux/freezer.h>
61 #include <linux/tty.h> 61 #include <linux/tty.h>
62 62
63 #include "audit.h" 63 #include "audit.h"
64 64
65 /* No auditing will take place until audit_initialized != 0. 65 /* No auditing will take place until audit_initialized != 0.
66 * (Initialization happens after skb_init is called.) */ 66 * (Initialization happens after skb_init is called.) */
67 static int audit_initialized; 67 static int audit_initialized;
68 68
69 #define AUDIT_OFF 0 69 #define AUDIT_OFF 0
70 #define AUDIT_ON 1 70 #define AUDIT_ON 1
71 #define AUDIT_LOCKED 2 71 #define AUDIT_LOCKED 2
72 int audit_enabled; 72 int audit_enabled;
73 int audit_ever_enabled; 73 int audit_ever_enabled;
74 74
75 /* Default state when kernel boots without any parameters. */ 75 /* Default state when kernel boots without any parameters. */
76 static int audit_default; 76 static int audit_default;
77 77
78 /* If auditing cannot proceed, audit_failure selects what happens. */ 78 /* If auditing cannot proceed, audit_failure selects what happens. */
79 static int audit_failure = AUDIT_FAIL_PRINTK; 79 static int audit_failure = AUDIT_FAIL_PRINTK;
80 80
81 /* If audit records are to be written to the netlink socket, audit_pid 81 /* If audit records are to be written to the netlink socket, audit_pid
82 * contains the (non-zero) pid. */ 82 * contains the (non-zero) pid. */
83 int audit_pid; 83 int audit_pid;
84 84
85 /* If audit_rate_limit is non-zero, limit the rate of sending audit records 85 /* If audit_rate_limit is non-zero, limit the rate of sending audit records
86 * to that number per second. This prevents DoS attacks, but results in 86 * to that number per second. This prevents DoS attacks, but results in
87 * audit records being dropped. */ 87 * audit records being dropped. */
88 static int audit_rate_limit; 88 static int audit_rate_limit;
89 89
90 /* Number of outstanding audit_buffers allowed. */ 90 /* Number of outstanding audit_buffers allowed. */
91 static int audit_backlog_limit = 64; 91 static int audit_backlog_limit = 64;
92 static int audit_backlog_wait_time = 60 * HZ; 92 static int audit_backlog_wait_time = 60 * HZ;
93 static int audit_backlog_wait_overflow = 0; 93 static int audit_backlog_wait_overflow = 0;
94 94
95 /* The identity of the user shutting down the audit system. */ 95 /* The identity of the user shutting down the audit system. */
96 uid_t audit_sig_uid = -1; 96 uid_t audit_sig_uid = -1;
97 pid_t audit_sig_pid = -1; 97 pid_t audit_sig_pid = -1;
98 u32 audit_sig_sid = 0; 98 u32 audit_sig_sid = 0;
99 99
100 /* Records can be lost in several ways: 100 /* Records can be lost in several ways:
101 0) [suppressed in audit_alloc] 101 0) [suppressed in audit_alloc]
102 1) out of memory in audit_log_start [kmalloc of struct audit_buffer] 102 1) out of memory in audit_log_start [kmalloc of struct audit_buffer]
103 2) out of memory in audit_log_move [alloc_skb] 103 2) out of memory in audit_log_move [alloc_skb]
104 3) suppressed due to audit_rate_limit 104 3) suppressed due to audit_rate_limit
105 4) suppressed due to audit_backlog_limit 105 4) suppressed due to audit_backlog_limit
106 */ 106 */
107 static atomic_t audit_lost = ATOMIC_INIT(0); 107 static atomic_t audit_lost = ATOMIC_INIT(0);
108 108
109 /* The netlink socket. */ 109 /* The netlink socket. */
110 static struct sock *audit_sock; 110 static struct sock *audit_sock;
111 111
112 /* Inotify handle. */ 112 /* Inotify handle. */
113 struct inotify_handle *audit_ih; 113 struct inotify_handle *audit_ih;
114 114
115 /* Hash for inode-based rules */ 115 /* Hash for inode-based rules */
116 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; 116 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
117 117
118 /* The audit_freelist is a list of pre-allocated audit buffers (if more 118 /* The audit_freelist is a list of pre-allocated audit buffers (if more
119 * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of 119 * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of
120 * being placed on the freelist). */ 120 * being placed on the freelist). */
121 static DEFINE_SPINLOCK(audit_freelist_lock); 121 static DEFINE_SPINLOCK(audit_freelist_lock);
122 static int audit_freelist_count; 122 static int audit_freelist_count;
123 static LIST_HEAD(audit_freelist); 123 static LIST_HEAD(audit_freelist);
124 124
125 static struct sk_buff_head audit_skb_queue; 125 static struct sk_buff_head audit_skb_queue;
126 static struct task_struct *kauditd_task; 126 static struct task_struct *kauditd_task;
127 static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait); 127 static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
128 static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait); 128 static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
129 129
130 /* Serialize requests from userspace. */ 130 /* Serialize requests from userspace. */
131 static DEFINE_MUTEX(audit_cmd_mutex); 131 static DEFINE_MUTEX(audit_cmd_mutex);
132 132
133 /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting 133 /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
134 * audit records. Since printk uses a 1024 byte buffer, this buffer 134 * audit records. Since printk uses a 1024 byte buffer, this buffer
135 * should be at least that large. */ 135 * should be at least that large. */
136 #define AUDIT_BUFSIZ 1024 136 #define AUDIT_BUFSIZ 1024
137 137
138 /* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the 138 /* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the
139 * audit_freelist. Doing so eliminates many kmalloc/kfree calls. */ 139 * audit_freelist. Doing so eliminates many kmalloc/kfree calls. */
140 #define AUDIT_MAXFREE (2*NR_CPUS) 140 #define AUDIT_MAXFREE (2*NR_CPUS)
141 141
142 /* The audit_buffer is used when formatting an audit record. The caller 142 /* The audit_buffer is used when formatting an audit record. The caller
143 * locks briefly to get the record off the freelist or to allocate the 143 * locks briefly to get the record off the freelist or to allocate the
144 * buffer, and locks briefly to send the buffer to the netlink layer or 144 * buffer, and locks briefly to send the buffer to the netlink layer or
145 * to place it on a transmit queue. Multiple audit_buffers can be in 145 * to place it on a transmit queue. Multiple audit_buffers can be in
146 * use simultaneously. */ 146 * use simultaneously. */
147 struct audit_buffer { 147 struct audit_buffer {
148 struct list_head list; 148 struct list_head list;
149 struct sk_buff *skb; /* formatted skb ready to send */ 149 struct sk_buff *skb; /* formatted skb ready to send */
150 struct audit_context *ctx; /* NULL or associated context */ 150 struct audit_context *ctx; /* NULL or associated context */
151 gfp_t gfp_mask; 151 gfp_t gfp_mask;
152 }; 152 };
153 153
154 static void audit_set_pid(struct audit_buffer *ab, pid_t pid) 154 static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
155 { 155 {
156 if (ab) { 156 if (ab) {
157 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb); 157 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
158 nlh->nlmsg_pid = pid; 158 nlh->nlmsg_pid = pid;
159 } 159 }
160 } 160 }
161 161
162 void audit_panic(const char *message) 162 void audit_panic(const char *message)
163 { 163 {
164 switch (audit_failure) 164 switch (audit_failure)
165 { 165 {
166 case AUDIT_FAIL_SILENT: 166 case AUDIT_FAIL_SILENT:
167 break; 167 break;
168 case AUDIT_FAIL_PRINTK: 168 case AUDIT_FAIL_PRINTK:
169 printk(KERN_ERR "audit: %s\n", message); 169 printk(KERN_ERR "audit: %s\n", message);
170 break; 170 break;
171 case AUDIT_FAIL_PANIC: 171 case AUDIT_FAIL_PANIC:
172 panic("audit: %s\n", message); 172 panic("audit: %s\n", message);
173 break; 173 break;
174 } 174 }
175 } 175 }
176 176
177 static inline int audit_rate_check(void) 177 static inline int audit_rate_check(void)
178 { 178 {
179 static unsigned long last_check = 0; 179 static unsigned long last_check = 0;
180 static int messages = 0; 180 static int messages = 0;
181 static DEFINE_SPINLOCK(lock); 181 static DEFINE_SPINLOCK(lock);
182 unsigned long flags; 182 unsigned long flags;
183 unsigned long now; 183 unsigned long now;
184 unsigned long elapsed; 184 unsigned long elapsed;
185 int retval = 0; 185 int retval = 0;
186 186
187 if (!audit_rate_limit) return 1; 187 if (!audit_rate_limit) return 1;
188 188
189 spin_lock_irqsave(&lock, flags); 189 spin_lock_irqsave(&lock, flags);
190 if (++messages < audit_rate_limit) { 190 if (++messages < audit_rate_limit) {
191 retval = 1; 191 retval = 1;
192 } else { 192 } else {
193 now = jiffies; 193 now = jiffies;
194 elapsed = now - last_check; 194 elapsed = now - last_check;
195 if (elapsed > HZ) { 195 if (elapsed > HZ) {
196 last_check = now; 196 last_check = now;
197 messages = 0; 197 messages = 0;
198 retval = 1; 198 retval = 1;
199 } 199 }
200 } 200 }
201 spin_unlock_irqrestore(&lock, flags); 201 spin_unlock_irqrestore(&lock, flags);
202 202
203 return retval; 203 return retval;
204 } 204 }
205 205
206 /** 206 /**
207 * audit_log_lost - conditionally log lost audit message event 207 * audit_log_lost - conditionally log lost audit message event
208 * @message: the message stating reason for lost audit message 208 * @message: the message stating reason for lost audit message
209 * 209 *
210 * Emit at least 1 message per second, even if audit_rate_check is 210 * Emit at least 1 message per second, even if audit_rate_check is
211 * throttling. 211 * throttling.
212 * Always increment the lost messages counter. 212 * Always increment the lost messages counter.
213 */ 213 */
214 void audit_log_lost(const char *message) 214 void audit_log_lost(const char *message)
215 { 215 {
216 static unsigned long last_msg = 0; 216 static unsigned long last_msg = 0;
217 static DEFINE_SPINLOCK(lock); 217 static DEFINE_SPINLOCK(lock);
218 unsigned long flags; 218 unsigned long flags;
219 unsigned long now; 219 unsigned long now;
220 int print; 220 int print;
221 221
222 atomic_inc(&audit_lost); 222 atomic_inc(&audit_lost);
223 223
224 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit); 224 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
225 225
226 if (!print) { 226 if (!print) {
227 spin_lock_irqsave(&lock, flags); 227 spin_lock_irqsave(&lock, flags);
228 now = jiffies; 228 now = jiffies;
229 if (now - last_msg > HZ) { 229 if (now - last_msg > HZ) {
230 print = 1; 230 print = 1;
231 last_msg = now; 231 last_msg = now;
232 } 232 }
233 spin_unlock_irqrestore(&lock, flags); 233 spin_unlock_irqrestore(&lock, flags);
234 } 234 }
235 235
236 if (print) { 236 if (print) {
237 printk(KERN_WARNING 237 printk(KERN_WARNING
238 "audit: audit_lost=%d audit_rate_limit=%d audit_backlog_limit=%d\n", 238 "audit: audit_lost=%d audit_rate_limit=%d audit_backlog_limit=%d\n",
239 atomic_read(&audit_lost), 239 atomic_read(&audit_lost),
240 audit_rate_limit, 240 audit_rate_limit,
241 audit_backlog_limit); 241 audit_backlog_limit);
242 audit_panic(message); 242 audit_panic(message);
243 } 243 }
244 } 244 }
245 245
246 static int audit_log_config_change(char *function_name, int new, int old, 246 static int audit_log_config_change(char *function_name, int new, int old,
247 uid_t loginuid, u32 sid, int allow_changes) 247 uid_t loginuid, u32 sid, int allow_changes)
248 { 248 {
249 struct audit_buffer *ab; 249 struct audit_buffer *ab;
250 int rc = 0; 250 int rc = 0;
251 251
252 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE); 252 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
253 audit_log_format(ab, "%s=%d old=%d by auid=%u", function_name, new, 253 audit_log_format(ab, "%s=%d old=%d by auid=%u", function_name, new,
254 old, loginuid); 254 old, loginuid);
255 if (sid) { 255 if (sid) {
256 char *ctx = NULL; 256 char *ctx = NULL;
257 u32 len; 257 u32 len;
258 258
259 rc = selinux_sid_to_string(sid, &ctx, &len); 259 rc = selinux_sid_to_string(sid, &ctx, &len);
260 if (rc) { 260 if (rc) {
261 audit_log_format(ab, " sid=%u", sid); 261 audit_log_format(ab, " sid=%u", sid);
262 allow_changes = 0; /* Something weird, deny request */ 262 allow_changes = 0; /* Something weird, deny request */
263 } else { 263 } else {
264 audit_log_format(ab, " subj=%s", ctx); 264 audit_log_format(ab, " subj=%s", ctx);
265 kfree(ctx); 265 kfree(ctx);
266 } 266 }
267 } 267 }
268 audit_log_format(ab, " res=%d", allow_changes); 268 audit_log_format(ab, " res=%d", allow_changes);
269 audit_log_end(ab); 269 audit_log_end(ab);
270 return rc; 270 return rc;
271 } 271 }
272 272
273 static int audit_do_config_change(char *function_name, int *to_change, 273 static int audit_do_config_change(char *function_name, int *to_change,
274 int new, uid_t loginuid, u32 sid) 274 int new, uid_t loginuid, u32 sid)
275 { 275 {
276 int allow_changes, rc = 0, old = *to_change; 276 int allow_changes, rc = 0, old = *to_change;
277 277
278 /* check if we are locked */ 278 /* check if we are locked */
279 if (audit_enabled == AUDIT_LOCKED) 279 if (audit_enabled == AUDIT_LOCKED)
280 allow_changes = 0; 280 allow_changes = 0;
281 else 281 else
282 allow_changes = 1; 282 allow_changes = 1;
283 283
284 if (audit_enabled != AUDIT_OFF) { 284 if (audit_enabled != AUDIT_OFF) {
285 rc = audit_log_config_change(function_name, new, old, 285 rc = audit_log_config_change(function_name, new, old,
286 loginuid, sid, allow_changes); 286 loginuid, sid, allow_changes);
287 if (rc) 287 if (rc)
288 allow_changes = 0; 288 allow_changes = 0;
289 } 289 }
290 290
291 /* If we are allowed, make the change */ 291 /* If we are allowed, make the change */
292 if (allow_changes == 1) 292 if (allow_changes == 1)
293 *to_change = new; 293 *to_change = new;
294 /* Not allowed, update reason */ 294 /* Not allowed, update reason */
295 else if (rc == 0) 295 else if (rc == 0)
296 rc = -EPERM; 296 rc = -EPERM;
297 return rc; 297 return rc;
298 } 298 }
299 299
300 static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sid) 300 static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sid)
301 { 301 {
302 return audit_do_config_change("audit_rate_limit", &audit_rate_limit, 302 return audit_do_config_change("audit_rate_limit", &audit_rate_limit,
303 limit, loginuid, sid); 303 limit, loginuid, sid);
304 } 304 }
305 305
306 static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid) 306 static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid)
307 { 307 {
308 return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit, 308 return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit,
309 limit, loginuid, sid); 309 limit, loginuid, sid);
310 } 310 }
311 311
312 static int audit_set_enabled(int state, uid_t loginuid, u32 sid) 312 static int audit_set_enabled(int state, uid_t loginuid, u32 sid)
313 { 313 {
314 int rc; 314 int rc;
315 if (state < AUDIT_OFF || state > AUDIT_LOCKED) 315 if (state < AUDIT_OFF || state > AUDIT_LOCKED)
316 return -EINVAL; 316 return -EINVAL;
317 317
318 rc = audit_do_config_change("audit_enabled", &audit_enabled, state, 318 rc = audit_do_config_change("audit_enabled", &audit_enabled, state,
319 loginuid, sid); 319 loginuid, sid);
320 320
321 if (!rc) 321 if (!rc)
322 audit_ever_enabled |= !!state; 322 audit_ever_enabled |= !!state;
323 323
324 return rc; 324 return rc;
325 } 325 }
326 326
327 static int audit_set_failure(int state, uid_t loginuid, u32 sid) 327 static int audit_set_failure(int state, uid_t loginuid, u32 sid)
328 { 328 {
329 if (state != AUDIT_FAIL_SILENT 329 if (state != AUDIT_FAIL_SILENT
330 && state != AUDIT_FAIL_PRINTK 330 && state != AUDIT_FAIL_PRINTK
331 && state != AUDIT_FAIL_PANIC) 331 && state != AUDIT_FAIL_PANIC)
332 return -EINVAL; 332 return -EINVAL;
333 333
334 return audit_do_config_change("audit_failure", &audit_failure, state, 334 return audit_do_config_change("audit_failure", &audit_failure, state,
335 loginuid, sid); 335 loginuid, sid);
336 } 336 }
337 337
338 static int kauditd_thread(void *dummy) 338 static int kauditd_thread(void *dummy)
339 { 339 {
340 struct sk_buff *skb; 340 struct sk_buff *skb;
341 341
342 set_freezable(); 342 set_freezable();
343 while (!kthread_should_stop()) { 343 while (!kthread_should_stop()) {
344 skb = skb_dequeue(&audit_skb_queue); 344 skb = skb_dequeue(&audit_skb_queue);
345 wake_up(&audit_backlog_wait); 345 wake_up(&audit_backlog_wait);
346 if (skb) { 346 if (skb) {
347 if (audit_pid) { 347 if (audit_pid) {
348 int err = netlink_unicast(audit_sock, skb, audit_pid, 0); 348 int err = netlink_unicast(audit_sock, skb, audit_pid, 0);
349 if (err < 0) { 349 if (err < 0) {
350 BUG_ON(err != -ECONNREFUSED); /* Shoudn't happen */ 350 BUG_ON(err != -ECONNREFUSED); /* Shoudn't happen */
351 printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid); 351 printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
352 audit_pid = 0; 352 audit_pid = 0;
353 } 353 }
354 } else { 354 } else {
355 printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0)); 355 printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0));
356 kfree_skb(skb); 356 kfree_skb(skb);
357 } 357 }
358 } else { 358 } else {
359 DECLARE_WAITQUEUE(wait, current); 359 DECLARE_WAITQUEUE(wait, current);
360 set_current_state(TASK_INTERRUPTIBLE); 360 set_current_state(TASK_INTERRUPTIBLE);
361 add_wait_queue(&kauditd_wait, &wait); 361 add_wait_queue(&kauditd_wait, &wait);
362 362
363 if (!skb_queue_len(&audit_skb_queue)) { 363 if (!skb_queue_len(&audit_skb_queue)) {
364 try_to_freeze(); 364 try_to_freeze();
365 schedule(); 365 schedule();
366 } 366 }
367 367
368 __set_current_state(TASK_RUNNING); 368 __set_current_state(TASK_RUNNING);
369 remove_wait_queue(&kauditd_wait, &wait); 369 remove_wait_queue(&kauditd_wait, &wait);
370 } 370 }
371 } 371 }
372 return 0; 372 return 0;
373 } 373 }
374 374
375 static int audit_prepare_user_tty(pid_t pid, uid_t loginuid) 375 static int audit_prepare_user_tty(pid_t pid, uid_t loginuid)
376 { 376 {
377 struct task_struct *tsk; 377 struct task_struct *tsk;
378 int err; 378 int err;
379 379
380 read_lock(&tasklist_lock); 380 read_lock(&tasklist_lock);
381 tsk = find_task_by_pid(pid); 381 tsk = find_task_by_pid(pid);
382 err = -ESRCH; 382 err = -ESRCH;
383 if (!tsk) 383 if (!tsk)
384 goto out; 384 goto out;
385 err = 0; 385 err = 0;
386 386
387 spin_lock_irq(&tsk->sighand->siglock); 387 spin_lock_irq(&tsk->sighand->siglock);
388 if (!tsk->signal->audit_tty) 388 if (!tsk->signal->audit_tty)
389 err = -EPERM; 389 err = -EPERM;
390 spin_unlock_irq(&tsk->sighand->siglock); 390 spin_unlock_irq(&tsk->sighand->siglock);
391 if (err) 391 if (err)
392 goto out; 392 goto out;
393 393
394 tty_audit_push_task(tsk, loginuid); 394 tty_audit_push_task(tsk, loginuid);
395 out: 395 out:
396 read_unlock(&tasklist_lock); 396 read_unlock(&tasklist_lock);
397 return err; 397 return err;
398 } 398 }
399 399
400 int audit_send_list(void *_dest) 400 int audit_send_list(void *_dest)
401 { 401 {
402 struct audit_netlink_list *dest = _dest; 402 struct audit_netlink_list *dest = _dest;
403 int pid = dest->pid; 403 int pid = dest->pid;
404 struct sk_buff *skb; 404 struct sk_buff *skb;
405 405
406 /* wait for parent to finish and send an ACK */ 406 /* wait for parent to finish and send an ACK */
407 mutex_lock(&audit_cmd_mutex); 407 mutex_lock(&audit_cmd_mutex);
408 mutex_unlock(&audit_cmd_mutex); 408 mutex_unlock(&audit_cmd_mutex);
409 409
410 while ((skb = __skb_dequeue(&dest->q)) != NULL) 410 while ((skb = __skb_dequeue(&dest->q)) != NULL)
411 netlink_unicast(audit_sock, skb, pid, 0); 411 netlink_unicast(audit_sock, skb, pid, 0);
412 412
413 kfree(dest); 413 kfree(dest);
414 414
415 return 0; 415 return 0;
416 } 416 }
417 417
418 #ifdef CONFIG_AUDIT_TREE 418 #ifdef CONFIG_AUDIT_TREE
419 static int prune_tree_thread(void *unused) 419 static int prune_tree_thread(void *unused)
420 { 420 {
421 mutex_lock(&audit_cmd_mutex); 421 mutex_lock(&audit_cmd_mutex);
422 audit_prune_trees(); 422 audit_prune_trees();
423 mutex_unlock(&audit_cmd_mutex); 423 mutex_unlock(&audit_cmd_mutex);
424 return 0; 424 return 0;
425 } 425 }
426 426
427 void audit_schedule_prune(void) 427 void audit_schedule_prune(void)
428 { 428 {
429 kthread_run(prune_tree_thread, NULL, "audit_prune_tree"); 429 kthread_run(prune_tree_thread, NULL, "audit_prune_tree");
430 } 430 }
431 #endif 431 #endif
432 432
433 struct sk_buff *audit_make_reply(int pid, int seq, int type, int done, 433 struct sk_buff *audit_make_reply(int pid, int seq, int type, int done,
434 int multi, void *payload, int size) 434 int multi, void *payload, int size)
435 { 435 {
436 struct sk_buff *skb; 436 struct sk_buff *skb;
437 struct nlmsghdr *nlh; 437 struct nlmsghdr *nlh;
438 int len = NLMSG_SPACE(size); 438 int len = NLMSG_SPACE(size);
439 void *data; 439 void *data;
440 int flags = multi ? NLM_F_MULTI : 0; 440 int flags = multi ? NLM_F_MULTI : 0;
441 int t = done ? NLMSG_DONE : type; 441 int t = done ? NLMSG_DONE : type;
442 442
443 skb = alloc_skb(len, GFP_KERNEL); 443 skb = alloc_skb(len, GFP_KERNEL);
444 if (!skb) 444 if (!skb)
445 return NULL; 445 return NULL;
446 446
447 nlh = NLMSG_PUT(skb, pid, seq, t, size); 447 nlh = NLMSG_PUT(skb, pid, seq, t, size);
448 nlh->nlmsg_flags = flags; 448 nlh->nlmsg_flags = flags;
449 data = NLMSG_DATA(nlh); 449 data = NLMSG_DATA(nlh);
450 memcpy(data, payload, size); 450 memcpy(data, payload, size);
451 return skb; 451 return skb;
452 452
453 nlmsg_failure: /* Used by NLMSG_PUT */ 453 nlmsg_failure: /* Used by NLMSG_PUT */
454 if (skb) 454 if (skb)
455 kfree_skb(skb); 455 kfree_skb(skb);
456 return NULL; 456 return NULL;
457 } 457 }
458 458
459 /** 459 /**
460 * audit_send_reply - send an audit reply message via netlink 460 * audit_send_reply - send an audit reply message via netlink
461 * @pid: process id to send reply to 461 * @pid: process id to send reply to
462 * @seq: sequence number 462 * @seq: sequence number
463 * @type: audit message type 463 * @type: audit message type
464 * @done: done (last) flag 464 * @done: done (last) flag
465 * @multi: multi-part message flag 465 * @multi: multi-part message flag
466 * @payload: payload data 466 * @payload: payload data
467 * @size: payload size 467 * @size: payload size
468 * 468 *
469 * Allocates an skb, builds the netlink message, and sends it to the pid. 469 * Allocates an skb, builds the netlink message, and sends it to the pid.
470 * No failure notifications. 470 * No failure notifications.
471 */ 471 */
472 void audit_send_reply(int pid, int seq, int type, int done, int multi, 472 void audit_send_reply(int pid, int seq, int type, int done, int multi,
473 void *payload, int size) 473 void *payload, int size)
474 { 474 {
475 struct sk_buff *skb; 475 struct sk_buff *skb;
476 skb = audit_make_reply(pid, seq, type, done, multi, payload, size); 476 skb = audit_make_reply(pid, seq, type, done, multi, payload, size);
477 if (!skb) 477 if (!skb)
478 return; 478 return;
479 /* Ignore failure. It'll only happen if the sender goes away, 479 /* Ignore failure. It'll only happen if the sender goes away,
480 because our timeout is set to infinite. */ 480 because our timeout is set to infinite. */
481 netlink_unicast(audit_sock, skb, pid, 0); 481 netlink_unicast(audit_sock, skb, pid, 0);
482 return; 482 return;
483 } 483 }
484 484
485 /* 485 /*
486 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit 486 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit
487 * control messages. 487 * control messages.
488 */ 488 */
489 static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type) 489 static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
490 { 490 {
491 int err = 0; 491 int err = 0;
492 492
493 switch (msg_type) { 493 switch (msg_type) {
494 case AUDIT_GET: 494 case AUDIT_GET:
495 case AUDIT_LIST: 495 case AUDIT_LIST:
496 case AUDIT_LIST_RULES: 496 case AUDIT_LIST_RULES:
497 case AUDIT_SET: 497 case AUDIT_SET:
498 case AUDIT_ADD: 498 case AUDIT_ADD:
499 case AUDIT_ADD_RULE: 499 case AUDIT_ADD_RULE:
500 case AUDIT_DEL: 500 case AUDIT_DEL:
501 case AUDIT_DEL_RULE: 501 case AUDIT_DEL_RULE:
502 case AUDIT_SIGNAL_INFO: 502 case AUDIT_SIGNAL_INFO:
503 case AUDIT_TTY_GET: 503 case AUDIT_TTY_GET:
504 case AUDIT_TTY_SET: 504 case AUDIT_TTY_SET:
505 case AUDIT_TRIM: 505 case AUDIT_TRIM:
506 case AUDIT_MAKE_EQUIV: 506 case AUDIT_MAKE_EQUIV:
507 if (security_netlink_recv(skb, CAP_AUDIT_CONTROL)) 507 if (security_netlink_recv(skb, CAP_AUDIT_CONTROL))
508 err = -EPERM; 508 err = -EPERM;
509 break; 509 break;
510 case AUDIT_USER: 510 case AUDIT_USER:
511 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: 511 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
512 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: 512 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
513 if (security_netlink_recv(skb, CAP_AUDIT_WRITE)) 513 if (security_netlink_recv(skb, CAP_AUDIT_WRITE))
514 err = -EPERM; 514 err = -EPERM;
515 break; 515 break;
516 default: /* bad msg */ 516 default: /* bad msg */
517 err = -EINVAL; 517 err = -EINVAL;
518 } 518 }
519 519
520 return err; 520 return err;
521 } 521 }
522 522
523 static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type, 523 static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
524 u32 pid, u32 uid, uid_t auid, u32 sid) 524 u32 pid, u32 uid, uid_t auid, u32 sid)
525 { 525 {
526 int rc = 0; 526 int rc = 0;
527 char *ctx = NULL; 527 char *ctx = NULL;
528 u32 len; 528 u32 len;
529 529
530 if (!audit_enabled) { 530 if (!audit_enabled) {
531 *ab = NULL; 531 *ab = NULL;
532 return rc; 532 return rc;
533 } 533 }
534 534
535 *ab = audit_log_start(NULL, GFP_KERNEL, msg_type); 535 *ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
536 audit_log_format(*ab, "user pid=%d uid=%u auid=%u", 536 audit_log_format(*ab, "user pid=%d uid=%u auid=%u",
537 pid, uid, auid); 537 pid, uid, auid);
538 if (sid) { 538 if (sid) {
539 rc = selinux_sid_to_string(sid, &ctx, &len); 539 rc = selinux_sid_to_string(sid, &ctx, &len);
540 if (rc) 540 if (rc)
541 audit_log_format(*ab, " ssid=%u", sid); 541 audit_log_format(*ab, " ssid=%u", sid);
542 else 542 else
543 audit_log_format(*ab, " subj=%s", ctx); 543 audit_log_format(*ab, " subj=%s", ctx);
544 kfree(ctx); 544 kfree(ctx);
545 } 545 }
546 546
547 return rc; 547 return rc;
548 } 548 }
549 549
550 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 550 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
551 { 551 {
552 u32 uid, pid, seq, sid; 552 u32 uid, pid, seq, sid;
553 void *data; 553 void *data;
554 struct audit_status *status_get, status_set; 554 struct audit_status *status_get, status_set;
555 int err; 555 int err;
556 struct audit_buffer *ab; 556 struct audit_buffer *ab;
557 u16 msg_type = nlh->nlmsg_type; 557 u16 msg_type = nlh->nlmsg_type;
558 uid_t loginuid; /* loginuid of sender */ 558 uid_t loginuid; /* loginuid of sender */
559 struct audit_sig_info *sig_data; 559 struct audit_sig_info *sig_data;
560 char *ctx = NULL; 560 char *ctx = NULL;
561 u32 len; 561 u32 len;
562 562
563 err = audit_netlink_ok(skb, msg_type); 563 err = audit_netlink_ok(skb, msg_type);
564 if (err) 564 if (err)
565 return err; 565 return err;
566 566
567 /* As soon as there's any sign of userspace auditd, 567 /* As soon as there's any sign of userspace auditd,
568 * start kauditd to talk to it */ 568 * start kauditd to talk to it */
569 if (!kauditd_task) 569 if (!kauditd_task)
570 kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd"); 570 kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
571 if (IS_ERR(kauditd_task)) { 571 if (IS_ERR(kauditd_task)) {
572 err = PTR_ERR(kauditd_task); 572 err = PTR_ERR(kauditd_task);
573 kauditd_task = NULL; 573 kauditd_task = NULL;
574 return err; 574 return err;
575 } 575 }
576 576
577 pid = NETLINK_CREDS(skb)->pid; 577 pid = NETLINK_CREDS(skb)->pid;
578 uid = NETLINK_CREDS(skb)->uid; 578 uid = NETLINK_CREDS(skb)->uid;
579 loginuid = NETLINK_CB(skb).loginuid; 579 loginuid = NETLINK_CB(skb).loginuid;
580 sid = NETLINK_CB(skb).sid; 580 sid = NETLINK_CB(skb).sid;
581 seq = nlh->nlmsg_seq; 581 seq = nlh->nlmsg_seq;
582 data = NLMSG_DATA(nlh); 582 data = NLMSG_DATA(nlh);
583 583
584 switch (msg_type) { 584 switch (msg_type) {
585 case AUDIT_GET: 585 case AUDIT_GET:
586 status_set.enabled = audit_enabled; 586 status_set.enabled = audit_enabled;
587 status_set.failure = audit_failure; 587 status_set.failure = audit_failure;
588 status_set.pid = audit_pid; 588 status_set.pid = audit_pid;
589 status_set.rate_limit = audit_rate_limit; 589 status_set.rate_limit = audit_rate_limit;
590 status_set.backlog_limit = audit_backlog_limit; 590 status_set.backlog_limit = audit_backlog_limit;
591 status_set.lost = atomic_read(&audit_lost); 591 status_set.lost = atomic_read(&audit_lost);
592 status_set.backlog = skb_queue_len(&audit_skb_queue); 592 status_set.backlog = skb_queue_len(&audit_skb_queue);
593 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0, 593 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
594 &status_set, sizeof(status_set)); 594 &status_set, sizeof(status_set));
595 break; 595 break;
596 case AUDIT_SET: 596 case AUDIT_SET:
597 if (nlh->nlmsg_len < sizeof(struct audit_status)) 597 if (nlh->nlmsg_len < sizeof(struct audit_status))
598 return -EINVAL; 598 return -EINVAL;
599 status_get = (struct audit_status *)data; 599 status_get = (struct audit_status *)data;
600 if (status_get->mask & AUDIT_STATUS_ENABLED) { 600 if (status_get->mask & AUDIT_STATUS_ENABLED) {
601 err = audit_set_enabled(status_get->enabled, 601 err = audit_set_enabled(status_get->enabled,
602 loginuid, sid); 602 loginuid, sid);
603 if (err < 0) return err; 603 if (err < 0) return err;
604 } 604 }
605 if (status_get->mask & AUDIT_STATUS_FAILURE) { 605 if (status_get->mask & AUDIT_STATUS_FAILURE) {
606 err = audit_set_failure(status_get->failure, 606 err = audit_set_failure(status_get->failure,
607 loginuid, sid); 607 loginuid, sid);
608 if (err < 0) return err; 608 if (err < 0) return err;
609 } 609 }
610 if (status_get->mask & AUDIT_STATUS_PID) { 610 if (status_get->mask & AUDIT_STATUS_PID) {
611 int new_pid = status_get->pid; 611 int new_pid = status_get->pid;
612 612
613 if (audit_enabled != AUDIT_OFF) 613 if (audit_enabled != AUDIT_OFF)
614 audit_log_config_change("audit_pid", new_pid, 614 audit_log_config_change("audit_pid", new_pid,
615 audit_pid, loginuid, 615 audit_pid, loginuid,
616 sid, 1); 616 sid, 1);
617 617
618 audit_pid = new_pid; 618 audit_pid = new_pid;
619 } 619 }
620 if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) 620 if (status_get->mask & AUDIT_STATUS_RATE_LIMIT)
621 err = audit_set_rate_limit(status_get->rate_limit, 621 err = audit_set_rate_limit(status_get->rate_limit,
622 loginuid, sid); 622 loginuid, sid);
623 if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT) 623 if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT)
624 err = audit_set_backlog_limit(status_get->backlog_limit, 624 err = audit_set_backlog_limit(status_get->backlog_limit,
625 loginuid, sid); 625 loginuid, sid);
626 break; 626 break;
627 case AUDIT_USER: 627 case AUDIT_USER:
628 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: 628 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
629 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: 629 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
630 if (!audit_enabled && msg_type != AUDIT_USER_AVC) 630 if (!audit_enabled && msg_type != AUDIT_USER_AVC)
631 return 0; 631 return 0;
632 632
633 err = audit_filter_user(&NETLINK_CB(skb), msg_type); 633 err = audit_filter_user(&NETLINK_CB(skb), msg_type);
634 if (err == 1) { 634 if (err == 1) {
635 err = 0; 635 err = 0;
636 if (msg_type == AUDIT_USER_TTY) { 636 if (msg_type == AUDIT_USER_TTY) {
637 err = audit_prepare_user_tty(pid, loginuid); 637 err = audit_prepare_user_tty(pid, loginuid);
638 if (err) 638 if (err)
639 break; 639 break;
640 } 640 }
641 audit_log_common_recv_msg(&ab, msg_type, pid, uid, 641 audit_log_common_recv_msg(&ab, msg_type, pid, uid,
642 loginuid, sid); 642 loginuid, sid);
643 643
644 if (msg_type != AUDIT_USER_TTY) 644 if (msg_type != AUDIT_USER_TTY)
645 audit_log_format(ab, " msg='%.1024s'", 645 audit_log_format(ab, " msg='%.1024s'",
646 (char *)data); 646 (char *)data);
647 else { 647 else {
648 int size; 648 int size;
649 649
650 audit_log_format(ab, " msg="); 650 audit_log_format(ab, " msg=");
651 size = nlmsg_len(nlh); 651 size = nlmsg_len(nlh);
652 audit_log_n_untrustedstring(ab, size, 652 audit_log_n_untrustedstring(ab, size,
653 data); 653 data);
654 } 654 }
655 audit_set_pid(ab, pid); 655 audit_set_pid(ab, pid);
656 audit_log_end(ab); 656 audit_log_end(ab);
657 } 657 }
658 break; 658 break;
659 case AUDIT_ADD: 659 case AUDIT_ADD:
660 case AUDIT_DEL: 660 case AUDIT_DEL:
661 if (nlmsg_len(nlh) < sizeof(struct audit_rule)) 661 if (nlmsg_len(nlh) < sizeof(struct audit_rule))
662 return -EINVAL; 662 return -EINVAL;
663 if (audit_enabled == AUDIT_LOCKED) { 663 if (audit_enabled == AUDIT_LOCKED) {
664 audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid, 664 audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
665 uid, loginuid, sid); 665 uid, loginuid, sid);
666 666
667 audit_log_format(ab, " audit_enabled=%d res=0", 667 audit_log_format(ab, " audit_enabled=%d res=0",
668 audit_enabled); 668 audit_enabled);
669 audit_log_end(ab); 669 audit_log_end(ab);
670 return -EPERM; 670 return -EPERM;
671 } 671 }
672 /* fallthrough */ 672 /* fallthrough */
673 case AUDIT_LIST: 673 case AUDIT_LIST:
674 err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid, 674 err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
675 uid, seq, data, nlmsg_len(nlh), 675 uid, seq, data, nlmsg_len(nlh),
676 loginuid, sid); 676 loginuid, sid);
677 break; 677 break;
678 case AUDIT_ADD_RULE: 678 case AUDIT_ADD_RULE:
679 case AUDIT_DEL_RULE: 679 case AUDIT_DEL_RULE:
680 if (nlmsg_len(nlh) < sizeof(struct audit_rule_data)) 680 if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
681 return -EINVAL; 681 return -EINVAL;
682 if (audit_enabled == AUDIT_LOCKED) { 682 if (audit_enabled == AUDIT_LOCKED) {
683 audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid, 683 audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
684 uid, loginuid, sid); 684 uid, loginuid, sid);
685 685
686 audit_log_format(ab, " audit_enabled=%d res=0", 686 audit_log_format(ab, " audit_enabled=%d res=0",
687 audit_enabled); 687 audit_enabled);
688 audit_log_end(ab); 688 audit_log_end(ab);
689 return -EPERM; 689 return -EPERM;
690 } 690 }
691 /* fallthrough */ 691 /* fallthrough */
692 case AUDIT_LIST_RULES: 692 case AUDIT_LIST_RULES:
693 err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid, 693 err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
694 uid, seq, data, nlmsg_len(nlh), 694 uid, seq, data, nlmsg_len(nlh),
695 loginuid, sid); 695 loginuid, sid);
696 break; 696 break;
697 case AUDIT_TRIM: 697 case AUDIT_TRIM:
698 audit_trim_trees(); 698 audit_trim_trees();
699 699
700 audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid, 700 audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
701 uid, loginuid, sid); 701 uid, loginuid, sid);
702 702
703 audit_log_format(ab, " op=trim res=1"); 703 audit_log_format(ab, " op=trim res=1");
704 audit_log_end(ab); 704 audit_log_end(ab);
705 break; 705 break;
706 case AUDIT_MAKE_EQUIV: { 706 case AUDIT_MAKE_EQUIV: {
707 void *bufp = data; 707 void *bufp = data;
708 u32 sizes[2]; 708 u32 sizes[2];
709 size_t len = nlmsg_len(nlh); 709 size_t len = nlmsg_len(nlh);
710 char *old, *new; 710 char *old, *new;
711 711
712 err = -EINVAL; 712 err = -EINVAL;
713 if (len < 2 * sizeof(u32)) 713 if (len < 2 * sizeof(u32))
714 break; 714 break;
715 memcpy(sizes, bufp, 2 * sizeof(u32)); 715 memcpy(sizes, bufp, 2 * sizeof(u32));
716 bufp += 2 * sizeof(u32); 716 bufp += 2 * sizeof(u32);
717 len -= 2 * sizeof(u32); 717 len -= 2 * sizeof(u32);
718 old = audit_unpack_string(&bufp, &len, sizes[0]); 718 old = audit_unpack_string(&bufp, &len, sizes[0]);
719 if (IS_ERR(old)) { 719 if (IS_ERR(old)) {
720 err = PTR_ERR(old); 720 err = PTR_ERR(old);
721 break; 721 break;
722 } 722 }
723 new = audit_unpack_string(&bufp, &len, sizes[1]); 723 new = audit_unpack_string(&bufp, &len, sizes[1]);
724 if (IS_ERR(new)) { 724 if (IS_ERR(new)) {
725 err = PTR_ERR(new); 725 err = PTR_ERR(new);
726 kfree(old); 726 kfree(old);
727 break; 727 break;
728 } 728 }
729 /* OK, here comes... */ 729 /* OK, here comes... */
730 err = audit_tag_tree(old, new); 730 err = audit_tag_tree(old, new);
731 731
732 audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid, 732 audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
733 uid, loginuid, sid); 733 uid, loginuid, sid);
734 734
735 audit_log_format(ab, " op=make_equiv old="); 735 audit_log_format(ab, " op=make_equiv old=");
736 audit_log_untrustedstring(ab, old); 736 audit_log_untrustedstring(ab, old);
737 audit_log_format(ab, " new="); 737 audit_log_format(ab, " new=");
738 audit_log_untrustedstring(ab, new); 738 audit_log_untrustedstring(ab, new);
739 audit_log_format(ab, " res=%d", !err); 739 audit_log_format(ab, " res=%d", !err);
740 audit_log_end(ab); 740 audit_log_end(ab);
741 kfree(old); 741 kfree(old);
742 kfree(new); 742 kfree(new);
743 break; 743 break;
744 } 744 }
745 case AUDIT_SIGNAL_INFO: 745 case AUDIT_SIGNAL_INFO:
746 err = selinux_sid_to_string(audit_sig_sid, &ctx, &len); 746 err = selinux_sid_to_string(audit_sig_sid, &ctx, &len);
747 if (err) 747 if (err)
748 return err; 748 return err;
749 sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL); 749 sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
750 if (!sig_data) { 750 if (!sig_data) {
751 kfree(ctx); 751 kfree(ctx);
752 return -ENOMEM; 752 return -ENOMEM;
753 } 753 }
754 sig_data->uid = audit_sig_uid; 754 sig_data->uid = audit_sig_uid;
755 sig_data->pid = audit_sig_pid; 755 sig_data->pid = audit_sig_pid;
756 memcpy(sig_data->ctx, ctx, len); 756 memcpy(sig_data->ctx, ctx, len);
757 kfree(ctx); 757 kfree(ctx);
758 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO, 758 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO,
759 0, 0, sig_data, sizeof(*sig_data) + len); 759 0, 0, sig_data, sizeof(*sig_data) + len);
760 kfree(sig_data); 760 kfree(sig_data);
761 break; 761 break;
762 case AUDIT_TTY_GET: { 762 case AUDIT_TTY_GET: {
763 struct audit_tty_status s; 763 struct audit_tty_status s;
764 struct task_struct *tsk; 764 struct task_struct *tsk;
765 765
766 read_lock(&tasklist_lock); 766 read_lock(&tasklist_lock);
767 tsk = find_task_by_pid(pid); 767 tsk = find_task_by_pid(pid);
768 if (!tsk) 768 if (!tsk)
769 err = -ESRCH; 769 err = -ESRCH;
770 else { 770 else {
771 spin_lock_irq(&tsk->sighand->siglock); 771 spin_lock_irq(&tsk->sighand->siglock);
772 s.enabled = tsk->signal->audit_tty != 0; 772 s.enabled = tsk->signal->audit_tty != 0;
773 spin_unlock_irq(&tsk->sighand->siglock); 773 spin_unlock_irq(&tsk->sighand->siglock);
774 } 774 }
775 read_unlock(&tasklist_lock); 775 read_unlock(&tasklist_lock);
776 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0, 776 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
777 &s, sizeof(s)); 777 &s, sizeof(s));
778 break; 778 break;
779 } 779 }
780 case AUDIT_TTY_SET: { 780 case AUDIT_TTY_SET: {
781 struct audit_tty_status *s; 781 struct audit_tty_status *s;
782 struct task_struct *tsk; 782 struct task_struct *tsk;
783 783
784 if (nlh->nlmsg_len < sizeof(struct audit_tty_status)) 784 if (nlh->nlmsg_len < sizeof(struct audit_tty_status))
785 return -EINVAL; 785 return -EINVAL;
786 s = data; 786 s = data;
787 if (s->enabled != 0 && s->enabled != 1) 787 if (s->enabled != 0 && s->enabled != 1)
788 return -EINVAL; 788 return -EINVAL;
789 read_lock(&tasklist_lock); 789 read_lock(&tasklist_lock);
790 tsk = find_task_by_pid(pid); 790 tsk = find_task_by_pid(pid);
791 if (!tsk) 791 if (!tsk)
792 err = -ESRCH; 792 err = -ESRCH;
793 else { 793 else {
794 spin_lock_irq(&tsk->sighand->siglock); 794 spin_lock_irq(&tsk->sighand->siglock);
795 tsk->signal->audit_tty = s->enabled != 0; 795 tsk->signal->audit_tty = s->enabled != 0;
796 spin_unlock_irq(&tsk->sighand->siglock); 796 spin_unlock_irq(&tsk->sighand->siglock);
797 } 797 }
798 read_unlock(&tasklist_lock); 798 read_unlock(&tasklist_lock);
799 break; 799 break;
800 } 800 }
801 default: 801 default:
802 err = -EINVAL; 802 err = -EINVAL;
803 break; 803 break;
804 } 804 }
805 805
806 return err < 0 ? err : 0; 806 return err < 0 ? err : 0;
807 } 807 }
808 808
809 /* 809 /*
810 * Get message from skb (based on rtnetlink_rcv_skb). Each message is 810 * Get message from skb (based on rtnetlink_rcv_skb). Each message is
811 * processed by audit_receive_msg. Malformed skbs with wrong length are 811 * processed by audit_receive_msg. Malformed skbs with wrong length are
812 * discarded silently. 812 * discarded silently.
813 */ 813 */
814 static void audit_receive_skb(struct sk_buff *skb) 814 static void audit_receive_skb(struct sk_buff *skb)
815 { 815 {
816 int err; 816 int err;
817 struct nlmsghdr *nlh; 817 struct nlmsghdr *nlh;
818 u32 rlen; 818 u32 rlen;
819 819
820 while (skb->len >= NLMSG_SPACE(0)) { 820 while (skb->len >= NLMSG_SPACE(0)) {
821 nlh = nlmsg_hdr(skb); 821 nlh = nlmsg_hdr(skb);
822 if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) 822 if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
823 return; 823 return;
824 rlen = NLMSG_ALIGN(nlh->nlmsg_len); 824 rlen = NLMSG_ALIGN(nlh->nlmsg_len);
825 if (rlen > skb->len) 825 if (rlen > skb->len)
826 rlen = skb->len; 826 rlen = skb->len;
827 if ((err = audit_receive_msg(skb, nlh))) { 827 if ((err = audit_receive_msg(skb, nlh))) {
828 netlink_ack(skb, nlh, err); 828 netlink_ack(skb, nlh, err);
829 } else if (nlh->nlmsg_flags & NLM_F_ACK) 829 } else if (nlh->nlmsg_flags & NLM_F_ACK)
830 netlink_ack(skb, nlh, 0); 830 netlink_ack(skb, nlh, 0);
831 skb_pull(skb, rlen); 831 skb_pull(skb, rlen);
832 } 832 }
833 } 833 }
834 834
835 /* Receive messages from netlink socket. */ 835 /* Receive messages from netlink socket. */
836 static void audit_receive(struct sk_buff *skb) 836 static void audit_receive(struct sk_buff *skb)
837 { 837 {
838 mutex_lock(&audit_cmd_mutex); 838 mutex_lock(&audit_cmd_mutex);
839 audit_receive_skb(skb); 839 audit_receive_skb(skb);
840 mutex_unlock(&audit_cmd_mutex); 840 mutex_unlock(&audit_cmd_mutex);
841 } 841 }
842 842
843 #ifdef CONFIG_AUDITSYSCALL 843 #ifdef CONFIG_AUDITSYSCALL
844 static const struct inotify_operations audit_inotify_ops = { 844 static const struct inotify_operations audit_inotify_ops = {
845 .handle_event = audit_handle_ievent, 845 .handle_event = audit_handle_ievent,
846 .destroy_watch = audit_free_parent, 846 .destroy_watch = audit_free_parent,
847 }; 847 };
848 #endif 848 #endif
849 849
850 /* Initialize audit support at boot time. */ 850 /* Initialize audit support at boot time. */
851 static int __init audit_init(void) 851 static int __init audit_init(void)
852 { 852 {
853 int i; 853 int i;
854 854
855 printk(KERN_INFO "audit: initializing netlink socket (%s)\n", 855 printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
856 audit_default ? "enabled" : "disabled"); 856 audit_default ? "enabled" : "disabled");
857 audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, 0, 857 audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, 0,
858 audit_receive, NULL, THIS_MODULE); 858 audit_receive, NULL, THIS_MODULE);
859 if (!audit_sock) 859 if (!audit_sock)
860 audit_panic("cannot initialize netlink socket"); 860 audit_panic("cannot initialize netlink socket");
861 else 861 else
862 audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; 862 audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
863 863
864 skb_queue_head_init(&audit_skb_queue); 864 skb_queue_head_init(&audit_skb_queue);
865 audit_initialized = 1; 865 audit_initialized = 1;
866 audit_enabled = audit_default; 866 audit_enabled = audit_default;
867 audit_ever_enabled |= !!audit_default; 867 audit_ever_enabled |= !!audit_default;
868 868
869 /* Register the callback with selinux. This callback will be invoked 869 /* Register the callback with selinux. This callback will be invoked
870 * when a new policy is loaded. */ 870 * when a new policy is loaded. */
871 selinux_audit_set_callback(&selinux_audit_rule_update); 871 selinux_audit_set_callback(&selinux_audit_rule_update);
872 872
873 audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized"); 873 audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
874 874
875 #ifdef CONFIG_AUDITSYSCALL 875 #ifdef CONFIG_AUDITSYSCALL
876 audit_ih = inotify_init(&audit_inotify_ops); 876 audit_ih = inotify_init(&audit_inotify_ops);
877 if (IS_ERR(audit_ih)) 877 if (IS_ERR(audit_ih))
878 audit_panic("cannot initialize inotify handle"); 878 audit_panic("cannot initialize inotify handle");
879 #endif 879 #endif
880 880
881 for (i = 0; i < AUDIT_INODE_BUCKETS; i++) 881 for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
882 INIT_LIST_HEAD(&audit_inode_hash[i]); 882 INIT_LIST_HEAD(&audit_inode_hash[i]);
883 883
884 return 0; 884 return 0;
885 } 885 }
886 __initcall(audit_init); 886 __initcall(audit_init);
887 887
888 /* Process kernel command-line parameter at boot time. audit=0 or audit=1. */ 888 /* Process kernel command-line parameter at boot time. audit=0 or audit=1. */
889 static int __init audit_enable(char *str) 889 static int __init audit_enable(char *str)
890 { 890 {
891 audit_default = !!simple_strtol(str, NULL, 0); 891 audit_default = !!simple_strtol(str, NULL, 0);
892 printk(KERN_INFO "audit: %s%s\n", 892 printk(KERN_INFO "audit: %s%s\n",
893 audit_default ? "enabled" : "disabled", 893 audit_default ? "enabled" : "disabled",
894 audit_initialized ? "" : " (after initialization)"); 894 audit_initialized ? "" : " (after initialization)");
895 if (audit_initialized) { 895 if (audit_initialized) {
896 audit_enabled = audit_default; 896 audit_enabled = audit_default;
897 audit_ever_enabled |= !!audit_default; 897 audit_ever_enabled |= !!audit_default;
898 } 898 }
899 return 1; 899 return 1;
900 } 900 }
901 901
902 __setup("audit=", audit_enable); 902 __setup("audit=", audit_enable);
903 903
904 static void audit_buffer_free(struct audit_buffer *ab) 904 static void audit_buffer_free(struct audit_buffer *ab)
905 { 905 {
906 unsigned long flags; 906 unsigned long flags;
907 907
908 if (!ab) 908 if (!ab)
909 return; 909 return;
910 910
911 if (ab->skb) 911 if (ab->skb)
912 kfree_skb(ab->skb); 912 kfree_skb(ab->skb);
913 913
914 spin_lock_irqsave(&audit_freelist_lock, flags); 914 spin_lock_irqsave(&audit_freelist_lock, flags);
915 if (audit_freelist_count > AUDIT_MAXFREE) 915 if (audit_freelist_count > AUDIT_MAXFREE)
916 kfree(ab); 916 kfree(ab);
917 else { 917 else {
918 audit_freelist_count++; 918 audit_freelist_count++;
919 list_add(&ab->list, &audit_freelist); 919 list_add(&ab->list, &audit_freelist);
920 } 920 }
921 spin_unlock_irqrestore(&audit_freelist_lock, flags); 921 spin_unlock_irqrestore(&audit_freelist_lock, flags);
922 } 922 }
923 923
924 static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx, 924 static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
925 gfp_t gfp_mask, int type) 925 gfp_t gfp_mask, int type)
926 { 926 {
927 unsigned long flags; 927 unsigned long flags;
928 struct audit_buffer *ab = NULL; 928 struct audit_buffer *ab = NULL;
929 struct nlmsghdr *nlh; 929 struct nlmsghdr *nlh;
930 930
931 spin_lock_irqsave(&audit_freelist_lock, flags); 931 spin_lock_irqsave(&audit_freelist_lock, flags);
932 if (!list_empty(&audit_freelist)) { 932 if (!list_empty(&audit_freelist)) {
933 ab = list_entry(audit_freelist.next, 933 ab = list_entry(audit_freelist.next,
934 struct audit_buffer, list); 934 struct audit_buffer, list);
935 list_del(&ab->list); 935 list_del(&ab->list);
936 --audit_freelist_count; 936 --audit_freelist_count;
937 } 937 }
938 spin_unlock_irqrestore(&audit_freelist_lock, flags); 938 spin_unlock_irqrestore(&audit_freelist_lock, flags);
939 939
940 if (!ab) { 940 if (!ab) {
941 ab = kmalloc(sizeof(*ab), gfp_mask); 941 ab = kmalloc(sizeof(*ab), gfp_mask);
942 if (!ab) 942 if (!ab)
943 goto err; 943 goto err;
944 } 944 }
945 945
946 ab->skb = alloc_skb(AUDIT_BUFSIZ, gfp_mask); 946 ab->skb = alloc_skb(AUDIT_BUFSIZ, gfp_mask);
947 if (!ab->skb) 947 if (!ab->skb)
948 goto err; 948 goto err;
949 949
950 ab->ctx = ctx; 950 ab->ctx = ctx;
951 ab->gfp_mask = gfp_mask; 951 ab->gfp_mask = gfp_mask;
952 nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0)); 952 nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0));
953 nlh->nlmsg_type = type; 953 nlh->nlmsg_type = type;
954 nlh->nlmsg_flags = 0; 954 nlh->nlmsg_flags = 0;
955 nlh->nlmsg_pid = 0; 955 nlh->nlmsg_pid = 0;
956 nlh->nlmsg_seq = 0; 956 nlh->nlmsg_seq = 0;
957 return ab; 957 return ab;
958 err: 958 err:
959 audit_buffer_free(ab); 959 audit_buffer_free(ab);
960 return NULL; 960 return NULL;
961 } 961 }
962 962
963 /** 963 /**
964 * audit_serial - compute a serial number for the audit record 964 * audit_serial - compute a serial number for the audit record
965 * 965 *
966 * Compute a serial number for the audit record. Audit records are 966 * Compute a serial number for the audit record. Audit records are
967 * written to user-space as soon as they are generated, so a complete 967 * written to user-space as soon as they are generated, so a complete
968 * audit record may be written in several pieces. The timestamp of the 968 * audit record may be written in several pieces. The timestamp of the
969 * record and this serial number are used by the user-space tools to 969 * record and this serial number are used by the user-space tools to
970 * determine which pieces belong to the same audit record. The 970 * determine which pieces belong to the same audit record. The
971 * (timestamp,serial) tuple is unique for each syscall and is live from 971 * (timestamp,serial) tuple is unique for each syscall and is live from
972 * syscall entry to syscall exit. 972 * syscall entry to syscall exit.
973 * 973 *
974 * NOTE: Another possibility is to store the formatted records off the 974 * NOTE: Another possibility is to store the formatted records off the
975 * audit context (for those records that have a context), and emit them 975 * audit context (for those records that have a context), and emit them
976 * all at syscall exit. However, this could delay the reporting of 976 * all at syscall exit. However, this could delay the reporting of
977 * significant errors until syscall exit (or never, if the system 977 * significant errors until syscall exit (or never, if the system
978 * halts). 978 * halts).
979 */ 979 */
980 unsigned int audit_serial(void) 980 unsigned int audit_serial(void)
981 { 981 {
982 static DEFINE_SPINLOCK(serial_lock); 982 static DEFINE_SPINLOCK(serial_lock);
983 static unsigned int serial = 0; 983 static unsigned int serial = 0;
984 984
985 unsigned long flags; 985 unsigned long flags;
986 unsigned int ret; 986 unsigned int ret;
987 987
988 spin_lock_irqsave(&serial_lock, flags); 988 spin_lock_irqsave(&serial_lock, flags);
989 do { 989 do {
990 ret = ++serial; 990 ret = ++serial;
991 } while (unlikely(!ret)); 991 } while (unlikely(!ret));
992 spin_unlock_irqrestore(&serial_lock, flags); 992 spin_unlock_irqrestore(&serial_lock, flags);
993 993
994 return ret; 994 return ret;
995 } 995 }
996 996
997 static inline void audit_get_stamp(struct audit_context *ctx, 997 static inline void audit_get_stamp(struct audit_context *ctx,
998 struct timespec *t, unsigned int *serial) 998 struct timespec *t, unsigned int *serial)
999 { 999 {
1000 if (ctx) 1000 if (ctx)
1001 auditsc_get_stamp(ctx, t, serial); 1001 auditsc_get_stamp(ctx, t, serial);
1002 else { 1002 else {
1003 *t = CURRENT_TIME; 1003 *t = CURRENT_TIME;
1004 *serial = audit_serial(); 1004 *serial = audit_serial();
1005 } 1005 }
1006 } 1006 }
1007 1007
1008 /* Obtain an audit buffer. This routine does locking to obtain the 1008 /* Obtain an audit buffer. This routine does locking to obtain the
1009 * audit buffer, but then no locking is required for calls to 1009 * audit buffer, but then no locking is required for calls to
1010 * audit_log_*format. If the tsk is a task that is currently in a 1010 * audit_log_*format. If the tsk is a task that is currently in a
1011 * syscall, then the syscall is marked as auditable and an audit record 1011 * syscall, then the syscall is marked as auditable and an audit record
1012 * will be written at syscall exit. If there is no associated task, tsk 1012 * will be written at syscall exit. If there is no associated task, tsk
1013 * should be NULL. */ 1013 * should be NULL. */
1014 1014
1015 /** 1015 /**
1016 * audit_log_start - obtain an audit buffer 1016 * audit_log_start - obtain an audit buffer
1017 * @ctx: audit_context (may be NULL) 1017 * @ctx: audit_context (may be NULL)
1018 * @gfp_mask: type of allocation 1018 * @gfp_mask: type of allocation
1019 * @type: audit message type 1019 * @type: audit message type
1020 * 1020 *
1021 * Returns audit_buffer pointer on success or NULL on error. 1021 * Returns audit_buffer pointer on success or NULL on error.
1022 * 1022 *
1023 * Obtain an audit buffer. This routine does locking to obtain the 1023 * Obtain an audit buffer. This routine does locking to obtain the
1024 * audit buffer, but then no locking is required for calls to 1024 * audit buffer, but then no locking is required for calls to
1025 * audit_log_*format. If the task (ctx) is a task that is currently in a 1025 * audit_log_*format. If the task (ctx) is a task that is currently in a
1026 * syscall, then the syscall is marked as auditable and an audit record 1026 * syscall, then the syscall is marked as auditable and an audit record
1027 * will be written at syscall exit. If there is no associated task, then 1027 * will be written at syscall exit. If there is no associated task, then
1028 * task context (ctx) should be NULL. 1028 * task context (ctx) should be NULL.
1029 */ 1029 */
1030 struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, 1030 struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
1031 int type) 1031 int type)
1032 { 1032 {
1033 struct audit_buffer *ab = NULL; 1033 struct audit_buffer *ab = NULL;
1034 struct timespec t; 1034 struct timespec t;
1035 unsigned int serial; 1035 unsigned int uninitialized_var(serial);
1036 int reserve; 1036 int reserve;
1037 unsigned long timeout_start = jiffies; 1037 unsigned long timeout_start = jiffies;
1038 1038
1039 if (!audit_initialized) 1039 if (!audit_initialized)
1040 return NULL; 1040 return NULL;
1041 1041
1042 if (unlikely(audit_filter_type(type))) 1042 if (unlikely(audit_filter_type(type)))
1043 return NULL; 1043 return NULL;
1044 1044
1045 if (gfp_mask & __GFP_WAIT) 1045 if (gfp_mask & __GFP_WAIT)
1046 reserve = 0; 1046 reserve = 0;
1047 else 1047 else
1048 reserve = 5; /* Allow atomic callers to go up to five 1048 reserve = 5; /* Allow atomic callers to go up to five
1049 entries over the normal backlog limit */ 1049 entries over the normal backlog limit */
1050 1050
1051 while (audit_backlog_limit 1051 while (audit_backlog_limit
1052 && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) { 1052 && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
1053 if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time 1053 if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time
1054 && time_before(jiffies, timeout_start + audit_backlog_wait_time)) { 1054 && time_before(jiffies, timeout_start + audit_backlog_wait_time)) {
1055 1055
1056 /* Wait for auditd to drain the queue a little */ 1056 /* Wait for auditd to drain the queue a little */
1057 DECLARE_WAITQUEUE(wait, current); 1057 DECLARE_WAITQUEUE(wait, current);
1058 set_current_state(TASK_INTERRUPTIBLE); 1058 set_current_state(TASK_INTERRUPTIBLE);
1059 add_wait_queue(&audit_backlog_wait, &wait); 1059 add_wait_queue(&audit_backlog_wait, &wait);
1060 1060
1061 if (audit_backlog_limit && 1061 if (audit_backlog_limit &&
1062 skb_queue_len(&audit_skb_queue) > audit_backlog_limit) 1062 skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
1063 schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies); 1063 schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies);
1064 1064
1065 __set_current_state(TASK_RUNNING); 1065 __set_current_state(TASK_RUNNING);
1066 remove_wait_queue(&audit_backlog_wait, &wait); 1066 remove_wait_queue(&audit_backlog_wait, &wait);
1067 continue; 1067 continue;
1068 } 1068 }
1069 if (audit_rate_check()) 1069 if (audit_rate_check())
1070 printk(KERN_WARNING 1070 printk(KERN_WARNING
1071 "audit: audit_backlog=%d > " 1071 "audit: audit_backlog=%d > "
1072 "audit_backlog_limit=%d\n", 1072 "audit_backlog_limit=%d\n",
1073 skb_queue_len(&audit_skb_queue), 1073 skb_queue_len(&audit_skb_queue),
1074 audit_backlog_limit); 1074 audit_backlog_limit);
1075 audit_log_lost("backlog limit exceeded"); 1075 audit_log_lost("backlog limit exceeded");
1076 audit_backlog_wait_time = audit_backlog_wait_overflow; 1076 audit_backlog_wait_time = audit_backlog_wait_overflow;
1077 wake_up(&audit_backlog_wait); 1077 wake_up(&audit_backlog_wait);
1078 return NULL; 1078 return NULL;
1079 } 1079 }
1080 1080
1081 ab = audit_buffer_alloc(ctx, gfp_mask, type); 1081 ab = audit_buffer_alloc(ctx, gfp_mask, type);
1082 if (!ab) { 1082 if (!ab) {
1083 audit_log_lost("out of memory in audit_log_start"); 1083 audit_log_lost("out of memory in audit_log_start");
1084 return NULL; 1084 return NULL;
1085 } 1085 }
1086 1086
1087 audit_get_stamp(ab->ctx, &t, &serial); 1087 audit_get_stamp(ab->ctx, &t, &serial);
1088 1088
1089 audit_log_format(ab, "audit(%lu.%03lu:%u): ", 1089 audit_log_format(ab, "audit(%lu.%03lu:%u): ",
1090 t.tv_sec, t.tv_nsec/1000000, serial); 1090 t.tv_sec, t.tv_nsec/1000000, serial);
1091 return ab; 1091 return ab;
1092 } 1092 }
1093 1093
1094 /** 1094 /**
1095 * audit_expand - expand skb in the audit buffer 1095 * audit_expand - expand skb in the audit buffer
1096 * @ab: audit_buffer 1096 * @ab: audit_buffer
1097 * @extra: space to add at tail of the skb 1097 * @extra: space to add at tail of the skb
1098 * 1098 *
1099 * Returns 0 (no space) on failed expansion, or available space if 1099 * Returns 0 (no space) on failed expansion, or available space if
1100 * successful. 1100 * successful.
1101 */ 1101 */
1102 static inline int audit_expand(struct audit_buffer *ab, int extra) 1102 static inline int audit_expand(struct audit_buffer *ab, int extra)
1103 { 1103 {
1104 struct sk_buff *skb = ab->skb; 1104 struct sk_buff *skb = ab->skb;
1105 int oldtail = skb_tailroom(skb); 1105 int oldtail = skb_tailroom(skb);
1106 int ret = pskb_expand_head(skb, 0, extra, ab->gfp_mask); 1106 int ret = pskb_expand_head(skb, 0, extra, ab->gfp_mask);
1107 int newtail = skb_tailroom(skb); 1107 int newtail = skb_tailroom(skb);
1108 1108
1109 if (ret < 0) { 1109 if (ret < 0) {
1110 audit_log_lost("out of memory in audit_expand"); 1110 audit_log_lost("out of memory in audit_expand");
1111 return 0; 1111 return 0;
1112 } 1112 }
1113 1113
1114 skb->truesize += newtail - oldtail; 1114 skb->truesize += newtail - oldtail;
1115 return newtail; 1115 return newtail;
1116 } 1116 }
1117 1117
1118 /* 1118 /*
1119 * Format an audit message into the audit buffer. If there isn't enough 1119 * Format an audit message into the audit buffer. If there isn't enough
1120 * room in the audit buffer, more room will be allocated and vsnprint 1120 * room in the audit buffer, more room will be allocated and vsnprint
1121 * will be called a second time. Currently, we assume that a printk 1121 * will be called a second time. Currently, we assume that a printk
1122 * can't format message larger than 1024 bytes, so we don't either. 1122 * can't format message larger than 1024 bytes, so we don't either.
1123 */ 1123 */
1124 static void audit_log_vformat(struct audit_buffer *ab, const char *fmt, 1124 static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
1125 va_list args) 1125 va_list args)
1126 { 1126 {
1127 int len, avail; 1127 int len, avail;
1128 struct sk_buff *skb; 1128 struct sk_buff *skb;
1129 va_list args2; 1129 va_list args2;
1130 1130
1131 if (!ab) 1131 if (!ab)
1132 return; 1132 return;
1133 1133
1134 BUG_ON(!ab->skb); 1134 BUG_ON(!ab->skb);
1135 skb = ab->skb; 1135 skb = ab->skb;
1136 avail = skb_tailroom(skb); 1136 avail = skb_tailroom(skb);
1137 if (avail == 0) { 1137 if (avail == 0) {
1138 avail = audit_expand(ab, AUDIT_BUFSIZ); 1138 avail = audit_expand(ab, AUDIT_BUFSIZ);
1139 if (!avail) 1139 if (!avail)
1140 goto out; 1140 goto out;
1141 } 1141 }
1142 va_copy(args2, args); 1142 va_copy(args2, args);
1143 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args); 1143 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args);
1144 if (len >= avail) { 1144 if (len >= avail) {
1145 /* The printk buffer is 1024 bytes long, so if we get 1145 /* The printk buffer is 1024 bytes long, so if we get
1146 * here and AUDIT_BUFSIZ is at least 1024, then we can 1146 * here and AUDIT_BUFSIZ is at least 1024, then we can
1147 * log everything that printk could have logged. */ 1147 * log everything that printk could have logged. */
1148 avail = audit_expand(ab, 1148 avail = audit_expand(ab,
1149 max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail)); 1149 max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
1150 if (!avail) 1150 if (!avail)
1151 goto out; 1151 goto out;
1152 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2); 1152 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
1153 } 1153 }
1154 if (len > 0) 1154 if (len > 0)
1155 skb_put(skb, len); 1155 skb_put(skb, len);
1156 out: 1156 out:
1157 return; 1157 return;
1158 } 1158 }
1159 1159
1160 /** 1160 /**
1161 * audit_log_format - format a message into the audit buffer. 1161 * audit_log_format - format a message into the audit buffer.
1162 * @ab: audit_buffer 1162 * @ab: audit_buffer
1163 * @fmt: format string 1163 * @fmt: format string
1164 * @...: optional parameters matching @fmt string 1164 * @...: optional parameters matching @fmt string
1165 * 1165 *
1166 * All the work is done in audit_log_vformat. 1166 * All the work is done in audit_log_vformat.
1167 */ 1167 */
1168 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...) 1168 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
1169 { 1169 {
1170 va_list args; 1170 va_list args;
1171 1171
1172 if (!ab) 1172 if (!ab)
1173 return; 1173 return;
1174 va_start(args, fmt); 1174 va_start(args, fmt);
1175 audit_log_vformat(ab, fmt, args); 1175 audit_log_vformat(ab, fmt, args);
1176 va_end(args); 1176 va_end(args);
1177 } 1177 }
1178 1178
1179 /** 1179 /**
1180 * audit_log_hex - convert a buffer to hex and append it to the audit skb 1180 * audit_log_hex - convert a buffer to hex and append it to the audit skb
1181 * @ab: the audit_buffer 1181 * @ab: the audit_buffer
1182 * @buf: buffer to convert to hex 1182 * @buf: buffer to convert to hex
1183 * @len: length of @buf to be converted 1183 * @len: length of @buf to be converted
1184 * 1184 *
1185 * No return value; failure to expand is silently ignored. 1185 * No return value; failure to expand is silently ignored.
1186 * 1186 *
1187 * This function will take the passed buf and convert it into a string of 1187 * This function will take the passed buf and convert it into a string of
1188 * ascii hex digits. The new string is placed onto the skb. 1188 * ascii hex digits. The new string is placed onto the skb.
1189 */ 1189 */
1190 void audit_log_hex(struct audit_buffer *ab, const unsigned char *buf, 1190 void audit_log_hex(struct audit_buffer *ab, const unsigned char *buf,
1191 size_t len) 1191 size_t len)
1192 { 1192 {
1193 int i, avail, new_len; 1193 int i, avail, new_len;
1194 unsigned char *ptr; 1194 unsigned char *ptr;
1195 struct sk_buff *skb; 1195 struct sk_buff *skb;
1196 static const unsigned char *hex = "0123456789ABCDEF"; 1196 static const unsigned char *hex = "0123456789ABCDEF";
1197 1197
1198 if (!ab) 1198 if (!ab)
1199 return; 1199 return;
1200 1200
1201 BUG_ON(!ab->skb); 1201 BUG_ON(!ab->skb);
1202 skb = ab->skb; 1202 skb = ab->skb;
1203 avail = skb_tailroom(skb); 1203 avail = skb_tailroom(skb);
1204 new_len = len<<1; 1204 new_len = len<<1;
1205 if (new_len >= avail) { 1205 if (new_len >= avail) {
1206 /* Round the buffer request up to the next multiple */ 1206 /* Round the buffer request up to the next multiple */
1207 new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1); 1207 new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
1208 avail = audit_expand(ab, new_len); 1208 avail = audit_expand(ab, new_len);
1209 if (!avail) 1209 if (!avail)
1210 return; 1210 return;
1211 } 1211 }
1212 1212
1213 ptr = skb_tail_pointer(skb); 1213 ptr = skb_tail_pointer(skb);
1214 for (i=0; i<len; i++) { 1214 for (i=0; i<len; i++) {
1215 *ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */ 1215 *ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */
1216 *ptr++ = hex[buf[i] & 0x0F]; /* Lower nibble */ 1216 *ptr++ = hex[buf[i] & 0x0F]; /* Lower nibble */
1217 } 1217 }
1218 *ptr = 0; 1218 *ptr = 0;
1219 skb_put(skb, len << 1); /* new string is twice the old string */ 1219 skb_put(skb, len << 1); /* new string is twice the old string */
1220 } 1220 }
1221 1221
1222 /* 1222 /*
1223 * Format a string of no more than slen characters into the audit buffer, 1223 * Format a string of no more than slen characters into the audit buffer,
1224 * enclosed in quote marks. 1224 * enclosed in quote marks.
1225 */ 1225 */
1226 static void audit_log_n_string(struct audit_buffer *ab, size_t slen, 1226 static void audit_log_n_string(struct audit_buffer *ab, size_t slen,
1227 const char *string) 1227 const char *string)
1228 { 1228 {
1229 int avail, new_len; 1229 int avail, new_len;
1230 unsigned char *ptr; 1230 unsigned char *ptr;
1231 struct sk_buff *skb; 1231 struct sk_buff *skb;
1232 1232
1233 if (!ab) 1233 if (!ab)
1234 return; 1234 return;
1235 1235
1236 BUG_ON(!ab->skb); 1236 BUG_ON(!ab->skb);
1237 skb = ab->skb; 1237 skb = ab->skb;
1238 avail = skb_tailroom(skb); 1238 avail = skb_tailroom(skb);
1239 new_len = slen + 3; /* enclosing quotes + null terminator */ 1239 new_len = slen + 3; /* enclosing quotes + null terminator */
1240 if (new_len > avail) { 1240 if (new_len > avail) {
1241 avail = audit_expand(ab, new_len); 1241 avail = audit_expand(ab, new_len);
1242 if (!avail) 1242 if (!avail)
1243 return; 1243 return;
1244 } 1244 }
1245 ptr = skb_tail_pointer(skb); 1245 ptr = skb_tail_pointer(skb);
1246 *ptr++ = '"'; 1246 *ptr++ = '"';
1247 memcpy(ptr, string, slen); 1247 memcpy(ptr, string, slen);
1248 ptr += slen; 1248 ptr += slen;
1249 *ptr++ = '"'; 1249 *ptr++ = '"';
1250 *ptr = 0; 1250 *ptr = 0;
1251 skb_put(skb, slen + 2); /* don't include null terminator */ 1251 skb_put(skb, slen + 2); /* don't include null terminator */
1252 } 1252 }
1253 1253
1254 /** 1254 /**
1255 * audit_string_contains_control - does a string need to be logged in hex 1255 * audit_string_contains_control - does a string need to be logged in hex
1256 * @string - string to be checked 1256 * @string - string to be checked
1257 * @len - max length of the string to check 1257 * @len - max length of the string to check
1258 */ 1258 */
1259 int audit_string_contains_control(const char *string, size_t len) 1259 int audit_string_contains_control(const char *string, size_t len)
1260 { 1260 {
1261 const unsigned char *p; 1261 const unsigned char *p;
1262 for (p = string; p < (const unsigned char *)string + len && *p; p++) { 1262 for (p = string; p < (const unsigned char *)string + len && *p; p++) {
1263 if (*p == '"' || *p < 0x21 || *p > 0x7f) 1263 if (*p == '"' || *p < 0x21 || *p > 0x7f)
1264 return 1; 1264 return 1;
1265 } 1265 }
1266 return 0; 1266 return 0;
1267 } 1267 }
1268 1268
1269 /** 1269 /**
1270 * audit_log_n_untrustedstring - log a string that may contain random characters 1270 * audit_log_n_untrustedstring - log a string that may contain random characters
1271 * @ab: audit_buffer 1271 * @ab: audit_buffer
1272 * @len: lenth of string (not including trailing null) 1272 * @len: lenth of string (not including trailing null)
1273 * @string: string to be logged 1273 * @string: string to be logged
1274 * 1274 *
1275 * This code will escape a string that is passed to it if the string 1275 * This code will escape a string that is passed to it if the string
1276 * contains a control character, unprintable character, double quote mark, 1276 * contains a control character, unprintable character, double quote mark,
1277 * or a space. Unescaped strings will start and end with a double quote mark. 1277 * or a space. Unescaped strings will start and end with a double quote mark.
1278 * Strings that are escaped are printed in hex (2 digits per char). 1278 * Strings that are escaped are printed in hex (2 digits per char).
1279 * 1279 *
1280 * The caller specifies the number of characters in the string to log, which may 1280 * The caller specifies the number of characters in the string to log, which may
1281 * or may not be the entire string. 1281 * or may not be the entire string.
1282 */ 1282 */
1283 void audit_log_n_untrustedstring(struct audit_buffer *ab, size_t len, 1283 void audit_log_n_untrustedstring(struct audit_buffer *ab, size_t len,
1284 const char *string) 1284 const char *string)
1285 { 1285 {
1286 if (audit_string_contains_control(string, len)) 1286 if (audit_string_contains_control(string, len))
1287 audit_log_hex(ab, string, len); 1287 audit_log_hex(ab, string, len);
1288 else 1288 else
1289 audit_log_n_string(ab, len, string); 1289 audit_log_n_string(ab, len, string);
1290 } 1290 }
1291 1291
1292 /** 1292 /**
1293 * audit_log_untrustedstring - log a string that may contain random characters 1293 * audit_log_untrustedstring - log a string that may contain random characters
1294 * @ab: audit_buffer 1294 * @ab: audit_buffer
1295 * @string: string to be logged 1295 * @string: string to be logged
1296 * 1296 *
1297 * Same as audit_log_n_untrustedstring(), except that strlen is used to 1297 * Same as audit_log_n_untrustedstring(), except that strlen is used to
1298 * determine string length. 1298 * determine string length.
1299 */ 1299 */
1300 void audit_log_untrustedstring(struct audit_buffer *ab, const char *string) 1300 void audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
1301 { 1301 {
1302 audit_log_n_untrustedstring(ab, strlen(string), string); 1302 audit_log_n_untrustedstring(ab, strlen(string), string);
1303 } 1303 }
1304 1304
1305 /* This is a helper-function to print the escaped d_path */ 1305 /* This is a helper-function to print the escaped d_path */
1306 void audit_log_d_path(struct audit_buffer *ab, const char *prefix, 1306 void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
1307 struct dentry *dentry, struct vfsmount *vfsmnt) 1307 struct dentry *dentry, struct vfsmount *vfsmnt)
1308 { 1308 {
1309 char *p, *path; 1309 char *p, *path;
1310 1310
1311 if (prefix) 1311 if (prefix)
1312 audit_log_format(ab, " %s", prefix); 1312 audit_log_format(ab, " %s", prefix);
1313 1313
1314 /* We will allow 11 spaces for ' (deleted)' to be appended */ 1314 /* We will allow 11 spaces for ' (deleted)' to be appended */
1315 path = kmalloc(PATH_MAX+11, ab->gfp_mask); 1315 path = kmalloc(PATH_MAX+11, ab->gfp_mask);
1316 if (!path) { 1316 if (!path) {
1317 audit_log_format(ab, "<no memory>"); 1317 audit_log_format(ab, "<no memory>");
1318 return; 1318 return;
1319 } 1319 }
1320 p = d_path(dentry, vfsmnt, path, PATH_MAX+11); 1320 p = d_path(dentry, vfsmnt, path, PATH_MAX+11);
1321 if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */ 1321 if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */
1322 /* FIXME: can we save some information here? */ 1322 /* FIXME: can we save some information here? */
1323 audit_log_format(ab, "<too long>"); 1323 audit_log_format(ab, "<too long>");
1324 } else 1324 } else
1325 audit_log_untrustedstring(ab, p); 1325 audit_log_untrustedstring(ab, p);
1326 kfree(path); 1326 kfree(path);
1327 } 1327 }
1328 1328
1329 /** 1329 /**
1330 * audit_log_end - end one audit record 1330 * audit_log_end - end one audit record
1331 * @ab: the audit_buffer 1331 * @ab: the audit_buffer
1332 * 1332 *
1333 * The netlink_* functions cannot be called inside an irq context, so 1333 * The netlink_* functions cannot be called inside an irq context, so
1334 * the audit buffer is placed on a queue and a tasklet is scheduled to 1334 * the audit buffer is placed on a queue and a tasklet is scheduled to
1335 * remove them from the queue outside the irq context. May be called in 1335 * remove them from the queue outside the irq context. May be called in
1336 * any context. 1336 * any context.
1337 */ 1337 */
1338 void audit_log_end(struct audit_buffer *ab) 1338 void audit_log_end(struct audit_buffer *ab)
1339 { 1339 {
1340 if (!ab) 1340 if (!ab)
1341 return; 1341 return;
1342 if (!audit_rate_check()) { 1342 if (!audit_rate_check()) {
1343 audit_log_lost("rate limit exceeded"); 1343 audit_log_lost("rate limit exceeded");
1344 } else { 1344 } else {
1345 if (audit_pid) { 1345 if (audit_pid) {
1346 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb); 1346 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
1347 nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0); 1347 nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0);
1348 skb_queue_tail(&audit_skb_queue, ab->skb); 1348 skb_queue_tail(&audit_skb_queue, ab->skb);
1349 ab->skb = NULL; 1349 ab->skb = NULL;
1350 wake_up_interruptible(&kauditd_wait); 1350 wake_up_interruptible(&kauditd_wait);
1351 } else { 1351 } else {
1352 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb); 1352 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
1353 printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, ab->skb->data + NLMSG_SPACE(0)); 1353 printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, ab->skb->data + NLMSG_SPACE(0));
1354 } 1354 }
1355 } 1355 }
1356 audit_buffer_free(ab); 1356 audit_buffer_free(ab);
1357 } 1357 }
1358 1358
1359 /** 1359 /**
1360 * audit_log - Log an audit record 1360 * audit_log - Log an audit record
1361 * @ctx: audit context 1361 * @ctx: audit context
1362 * @gfp_mask: type of allocation 1362 * @gfp_mask: type of allocation
1363 * @type: audit message type 1363 * @type: audit message type
1364 * @fmt: format string to use 1364 * @fmt: format string to use
1365 * @...: variable parameters matching the format string 1365 * @...: variable parameters matching the format string
1366 * 1366 *
1367 * This is a convenience function that calls audit_log_start, 1367 * This is a convenience function that calls audit_log_start,
1368 * audit_log_vformat, and audit_log_end. It may be called 1368 * audit_log_vformat, and audit_log_end. It may be called
1369 * in any context. 1369 * in any context.
1370 */ 1370 */
1371 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 1371 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
1372 const char *fmt, ...) 1372 const char *fmt, ...)
1373 { 1373 {
1374 struct audit_buffer *ab; 1374 struct audit_buffer *ab;
1375 va_list args; 1375 va_list args;
1376 1376
1377 ab = audit_log_start(ctx, gfp_mask, type); 1377 ab = audit_log_start(ctx, gfp_mask, type);
1378 if (ab) { 1378 if (ab) {
1379 va_start(args, fmt); 1379 va_start(args, fmt);
1380 audit_log_vformat(ab, fmt, args); 1380 audit_log_vformat(ab, fmt, args);
1381 va_end(args); 1381 va_end(args);
1382 audit_log_end(ab); 1382 audit_log_end(ab);
1383 } 1383 }
1384 } 1384 }
1385 1385
1386 EXPORT_SYMBOL(audit_log_start); 1386 EXPORT_SYMBOL(audit_log_start);
1387 EXPORT_SYMBOL(audit_log_end); 1387 EXPORT_SYMBOL(audit_log_end);
1388 EXPORT_SYMBOL(audit_log_format); 1388 EXPORT_SYMBOL(audit_log_format);
1389 EXPORT_SYMBOL(audit_log); 1389 EXPORT_SYMBOL(audit_log);
1390 1390