1 /* SPDX-License-Identifier: GPL-2.0-or-later */ 2 /* audit.h -- Auditing support 3 * 4 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina. 5 * All Rights Reserved. 6 * 7 * Written by Rickard E. (Rik) Faith <faith@redhat.com> 8 */ 9 #ifndef _LINUX_AUDIT_H_ 10 #define _LINUX_AUDIT_H_ 11 12 #include <linux/sched.h> 13 #include <linux/ptrace.h> 14 #include <uapi/linux/audit.h> 15 16 #define AUDIT_INO_UNSET ((unsigned long)-1) 17 #define AUDIT_DEV_UNSET ((dev_t)-1) 18 19 struct audit_sig_info { 20 uid_t uid; 21 pid_t pid; 22 char ctx[0]; 23 }; 24 25 struct audit_buffer; 26 struct audit_context; 27 struct inode; 28 struct netlink_skb_parms; 29 struct path; 30 struct linux_binprm; 31 struct mq_attr; 32 struct mqstat; 33 struct audit_watch; 34 struct audit_tree; 35 struct sk_buff; 36 37 struct audit_krule { 38 u32 pflags; 39 u32 flags; 40 u32 listnr; 41 u32 action; 42 u32 mask[AUDIT_BITMASK_SIZE]; 43 u32 buflen; /* for data alloc on list rules */ 44 u32 field_count; 45 char *filterkey; /* ties events to rules */ 46 struct audit_field *fields; 47 struct audit_field *arch_f; /* quick access to arch field */ 48 struct audit_field *inode_f; /* quick access to an inode field */ 49 struct audit_watch *watch; /* associated watch */ 50 struct audit_tree *tree; /* associated watched tree */ 51 struct audit_fsnotify_mark *exe; 52 struct list_head rlist; /* entry in audit_{watch,tree}.rules list */ 53 struct list_head list; /* for AUDIT_LIST* purposes only */ 54 u64 prio; 55 }; 56 57 /* Flag to indicate legacy AUDIT_LOGINUID unset usage */ 58 #define AUDIT_LOGINUID_LEGACY 0x1 59 60 struct audit_field { 61 u32 type; 62 union { 63 u32 val; 64 kuid_t uid; 65 kgid_t gid; 66 struct { 67 char *lsm_str; 68 void *lsm_rule; 69 }; 70 }; 71 u32 op; 72 }; 73 74 enum audit_ntp_type { 75 AUDIT_NTP_OFFSET, 76 AUDIT_NTP_FREQ, 77 AUDIT_NTP_STATUS, 78 AUDIT_NTP_TAI, 79 AUDIT_NTP_TICK, 80 AUDIT_NTP_ADJUST, 81 82 AUDIT_NTP_NVALS /* count */ 83 }; 84 85 #ifdef CONFIG_AUDITSYSCALL 86 struct audit_ntp_val { 87 long long oldval, newval; 88 }; 89 90 struct audit_ntp_data { 91 struct audit_ntp_val vals[AUDIT_NTP_NVALS]; 92 }; 93 #else 94 struct audit_ntp_data {}; 95 #endif 96 97 extern int is_audit_feature_set(int which); 98 99 extern int __init audit_register_class(int class, unsigned *list); 100 extern int audit_classify_syscall(int abi, unsigned syscall); 101 extern int audit_classify_arch(int arch); 102 /* only for compat system calls */ 103 extern unsigned compat_write_class[]; 104 extern unsigned compat_read_class[]; 105 extern unsigned compat_dir_class[]; 106 extern unsigned compat_chattr_class[]; 107 extern unsigned compat_signal_class[]; 108 109 extern int audit_classify_compat_syscall(int abi, unsigned syscall); 110 111 /* audit_names->type values */ 112 #define AUDIT_TYPE_UNKNOWN 0 /* we don't know yet */ 113 #define AUDIT_TYPE_NORMAL 1 /* a "normal" audit record */ 114 #define AUDIT_TYPE_PARENT 2 /* a parent audit record */ 115 #define AUDIT_TYPE_CHILD_DELETE 3 /* a child being deleted */ 116 #define AUDIT_TYPE_CHILD_CREATE 4 /* a child being created */ 117 118 /* maximized args number that audit_socketcall can process */ 119 #define AUDITSC_ARGS 6 120 121 /* bit values for ->signal->audit_tty */ 122 #define AUDIT_TTY_ENABLE BIT(0) 123 #define AUDIT_TTY_LOG_PASSWD BIT(1) 124 125 struct filename; 126 127 #define AUDIT_OFF 0 128 #define AUDIT_ON 1 129 #define AUDIT_LOCKED 2 130 #ifdef CONFIG_AUDIT 131 /* These are defined in audit.c */ 132 /* Public API */ 133 extern __printf(4, 5) 134 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 135 const char *fmt, ...); 136 137 extern struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type); 138 extern __printf(2, 3) 139 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...); 140 extern void audit_log_end(struct audit_buffer *ab); 141 extern bool audit_string_contains_control(const char *string, 142 size_t len); 143 extern void audit_log_n_hex(struct audit_buffer *ab, 144 const unsigned char *buf, 145 size_t len); 146 extern void audit_log_n_string(struct audit_buffer *ab, 147 const char *buf, 148 size_t n); 149 extern void audit_log_n_untrustedstring(struct audit_buffer *ab, 150 const char *string, 151 size_t n); 152 extern void audit_log_untrustedstring(struct audit_buffer *ab, 153 const char *string); 154 extern void audit_log_d_path(struct audit_buffer *ab, 155 const char *prefix, 156 const struct path *path); 157 extern void audit_log_key(struct audit_buffer *ab, 158 char *key); 159 extern void audit_log_link_denied(const char *operation); 160 extern void audit_log_lost(const char *message); 161 162 extern int audit_log_task_context(struct audit_buffer *ab); 163 extern void audit_log_task_info(struct audit_buffer *ab); 164 165 extern int audit_update_lsm_rules(void); 166 167 /* Private API (for audit.c only) */ 168 extern int audit_rule_change(int type, int seq, void *data, size_t datasz); 169 extern int audit_list_rules_send(struct sk_buff *request_skb, int seq); 170 171 extern int audit_set_loginuid(kuid_t loginuid); 172 173 static inline kuid_t audit_get_loginuid(struct task_struct *tsk) 174 { 175 return tsk->loginuid; 176 } 177 178 static inline unsigned int audit_get_sessionid(struct task_struct *tsk) 179 { 180 return tsk->sessionid; 181 } 182 183 extern u32 audit_enabled; 184 185 extern int audit_signal_info(int sig, struct task_struct *t); 186 187 #else /* CONFIG_AUDIT */ 188 static inline __printf(4, 5) 189 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 190 const char *fmt, ...) 191 { } 192 static inline struct audit_buffer *audit_log_start(struct audit_context *ctx, 193 gfp_t gfp_mask, int type) 194 { 195 return NULL; 196 } 197 static inline __printf(2, 3) 198 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...) 199 { } 200 static inline void audit_log_end(struct audit_buffer *ab) 201 { } 202 static inline void audit_log_n_hex(struct audit_buffer *ab, 203 const unsigned char *buf, size_t len) 204 { } 205 static inline void audit_log_n_string(struct audit_buffer *ab, 206 const char *buf, size_t n) 207 { } 208 static inline void audit_log_n_untrustedstring(struct audit_buffer *ab, 209 const char *string, size_t n) 210 { } 211 static inline void audit_log_untrustedstring(struct audit_buffer *ab, 212 const char *string) 213 { } 214 static inline void audit_log_d_path(struct audit_buffer *ab, 215 const char *prefix, 216 const struct path *path) 217 { } 218 static inline void audit_log_key(struct audit_buffer *ab, char *key) 219 { } 220 static inline void audit_log_link_denied(const char *string) 221 { } 222 static inline int audit_log_task_context(struct audit_buffer *ab) 223 { 224 return 0; 225 } 226 static inline void audit_log_task_info(struct audit_buffer *ab) 227 { } 228 229 static inline kuid_t audit_get_loginuid(struct task_struct *tsk) 230 { 231 return INVALID_UID; 232 } 233 234 static inline unsigned int audit_get_sessionid(struct task_struct *tsk) 235 { 236 return AUDIT_SID_UNSET; 237 } 238 239 #define audit_enabled AUDIT_OFF 240 241 static inline int audit_signal_info(int sig, struct task_struct *t) 242 { 243 return 0; 244 } 245 246 #endif /* CONFIG_AUDIT */ 247 248 #ifdef CONFIG_AUDIT_COMPAT_GENERIC 249 #define audit_is_compat(arch) (!((arch) & __AUDIT_ARCH_64BIT)) 250 #else 251 #define audit_is_compat(arch) false 252 #endif 253 254 #define AUDIT_INODE_PARENT 1 /* dentry represents the parent */ 255 #define AUDIT_INODE_HIDDEN 2 /* audit record should be hidden */ 256 #define AUDIT_INODE_NOEVAL 4 /* audit record incomplete */ 257 258 #ifdef CONFIG_AUDITSYSCALL 259 #include <asm/syscall.h> /* for syscall_get_arch() */ 260 261 /* These are defined in auditsc.c */ 262 /* Public API */ 263 extern int audit_alloc(struct task_struct *task); 264 extern void __audit_free(struct task_struct *task); 265 extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1, 266 unsigned long a2, unsigned long a3); 267 extern void __audit_syscall_exit(int ret_success, long ret_value); 268 extern struct filename *__audit_reusename(const __user char *uptr); 269 extern void __audit_getname(struct filename *name); 270 271 extern void __audit_inode(struct filename *name, const struct dentry *dentry, 272 unsigned int flags); 273 extern void __audit_file(const struct file *); 274 extern void __audit_inode_child(struct inode *parent, 275 const struct dentry *dentry, 276 const unsigned char type); 277 extern void audit_seccomp(unsigned long syscall, long signr, int code); 278 extern void audit_seccomp_actions_logged(const char *names, 279 const char *old_names, int res); 280 extern void __audit_ptrace(struct task_struct *t); 281 282 static inline void audit_set_context(struct task_struct *task, struct audit_context *ctx) 283 { 284 task->audit_context = ctx; 285 } 286 287 static inline struct audit_context *audit_context(void) 288 { 289 return current->audit_context; 290 } 291 292 static inline bool audit_dummy_context(void) 293 { 294 void *p = audit_context(); 295 return !p || *(int *)p; 296 } 297 static inline void audit_free(struct task_struct *task) 298 { 299 if (unlikely(task->audit_context)) 300 __audit_free(task); 301 } 302 static inline void audit_syscall_entry(int major, unsigned long a0, 303 unsigned long a1, unsigned long a2, 304 unsigned long a3) 305 { 306 if (unlikely(audit_context())) 307 __audit_syscall_entry(major, a0, a1, a2, a3); 308 } 309 static inline void audit_syscall_exit(void *pt_regs) 310 { 311 if (unlikely(audit_context())) { 312 int success = is_syscall_success(pt_regs); 313 long return_code = regs_return_value(pt_regs); 314 315 __audit_syscall_exit(success, return_code); 316 } 317 } 318 static inline struct filename *audit_reusename(const __user char *name) 319 { 320 if (unlikely(!audit_dummy_context())) 321 return __audit_reusename(name); 322 return NULL; 323 } 324 static inline void audit_getname(struct filename *name) 325 { 326 if (unlikely(!audit_dummy_context())) 327 __audit_getname(name); 328 } 329 static inline void audit_inode(struct filename *name, 330 const struct dentry *dentry, 331 unsigned int aflags) { 332 if (unlikely(!audit_dummy_context())) 333 __audit_inode(name, dentry, aflags); 334 } 335 static inline void audit_file(struct file *file) 336 { 337 if (unlikely(!audit_dummy_context())) 338 __audit_file(file); 339 } 340 static inline void audit_inode_parent_hidden(struct filename *name, 341 const struct dentry *dentry) 342 { 343 if (unlikely(!audit_dummy_context())) 344 __audit_inode(name, dentry, 345 AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN); 346 } 347 static inline void audit_inode_child(struct inode *parent, 348 const struct dentry *dentry, 349 const unsigned char type) { 350 if (unlikely(!audit_dummy_context())) 351 __audit_inode_child(parent, dentry, type); 352 } 353 void audit_core_dumps(long signr); 354 355 static inline void audit_ptrace(struct task_struct *t) 356 { 357 if (unlikely(!audit_dummy_context())) 358 __audit_ptrace(t); 359 } 360 361 /* Private API (for audit.c only) */ 362 extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp); 363 extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode); 364 extern void __audit_bprm(struct linux_binprm *bprm); 365 extern int __audit_socketcall(int nargs, unsigned long *args); 366 extern int __audit_sockaddr(int len, void *addr); 367 extern void __audit_fd_pair(int fd1, int fd2); 368 extern void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr); 369 extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec64 *abs_timeout); 370 extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification); 371 extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat); 372 extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm, 373 const struct cred *new, 374 const struct cred *old); 375 extern void __audit_log_capset(const struct cred *new, const struct cred *old); 376 extern void __audit_mmap_fd(int fd, int flags); 377 extern void __audit_log_kern_module(char *name); 378 extern void __audit_fanotify(unsigned int response); 379 extern void __audit_tk_injoffset(struct timespec64 offset); 380 extern void __audit_ntp_log(const struct audit_ntp_data *ad); 381 382 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) 383 { 384 if (unlikely(!audit_dummy_context())) 385 __audit_ipc_obj(ipcp); 386 } 387 static inline void audit_fd_pair(int fd1, int fd2) 388 { 389 if (unlikely(!audit_dummy_context())) 390 __audit_fd_pair(fd1, fd2); 391 } 392 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode) 393 { 394 if (unlikely(!audit_dummy_context())) 395 __audit_ipc_set_perm(qbytes, uid, gid, mode); 396 } 397 static inline void audit_bprm(struct linux_binprm *bprm) 398 { 399 if (unlikely(!audit_dummy_context())) 400 __audit_bprm(bprm); 401 } 402 static inline int audit_socketcall(int nargs, unsigned long *args) 403 { 404 if (unlikely(!audit_dummy_context())) 405 return __audit_socketcall(nargs, args); 406 return 0; 407 } 408 409 static inline int audit_socketcall_compat(int nargs, u32 *args) 410 { 411 unsigned long a[AUDITSC_ARGS]; 412 int i; 413 414 if (audit_dummy_context()) 415 return 0; 416 417 for (i = 0; i < nargs; i++) 418 a[i] = (unsigned long)args[i]; 419 return __audit_socketcall(nargs, a); 420 } 421 422 static inline int audit_sockaddr(int len, void *addr) 423 { 424 if (unlikely(!audit_dummy_context())) 425 return __audit_sockaddr(len, addr); 426 return 0; 427 } 428 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr) 429 { 430 if (unlikely(!audit_dummy_context())) 431 __audit_mq_open(oflag, mode, attr); 432 } 433 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec64 *abs_timeout) 434 { 435 if (unlikely(!audit_dummy_context())) 436 __audit_mq_sendrecv(mqdes, msg_len, msg_prio, abs_timeout); 437 } 438 static inline void audit_mq_notify(mqd_t mqdes, const struct sigevent *notification) 439 { 440 if (unlikely(!audit_dummy_context())) 441 __audit_mq_notify(mqdes, notification); 442 } 443 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) 444 { 445 if (unlikely(!audit_dummy_context())) 446 __audit_mq_getsetattr(mqdes, mqstat); 447 } 448 449 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm, 450 const struct cred *new, 451 const struct cred *old) 452 { 453 if (unlikely(!audit_dummy_context())) 454 return __audit_log_bprm_fcaps(bprm, new, old); 455 return 0; 456 } 457 458 static inline void audit_log_capset(const struct cred *new, 459 const struct cred *old) 460 { 461 if (unlikely(!audit_dummy_context())) 462 __audit_log_capset(new, old); 463 } 464 465 static inline void audit_mmap_fd(int fd, int flags) 466 { 467 if (unlikely(!audit_dummy_context())) 468 __audit_mmap_fd(fd, flags); 469 } 470 471 static inline void audit_log_kern_module(char *name) 472 { 473 if (!audit_dummy_context()) 474 __audit_log_kern_module(name); 475 } 476 477 static inline void audit_fanotify(unsigned int response) 478 { 479 if (!audit_dummy_context()) 480 __audit_fanotify(response); 481 } 482 483 static inline void audit_tk_injoffset(struct timespec64 offset) 484 { 485 /* ignore no-op events */ 486 if (offset.tv_sec == 0 && offset.tv_nsec == 0) 487 return; 488 489 if (!audit_dummy_context()) 490 __audit_tk_injoffset(offset); 491 } 492 493 static inline void audit_ntp_init(struct audit_ntp_data *ad) 494 { 495 memset(ad, 0, sizeof(*ad)); 496 } 497 498 static inline void audit_ntp_set_old(struct audit_ntp_data *ad, 499 enum audit_ntp_type type, long long val) 500 { 501 ad->vals[type].oldval = val; 502 } 503 504 static inline void audit_ntp_set_new(struct audit_ntp_data *ad, 505 enum audit_ntp_type type, long long val) 506 { 507 ad->vals[type].newval = val; 508 } 509 510 static inline void audit_ntp_log(const struct audit_ntp_data *ad) 511 { 512 if (!audit_dummy_context()) 513 __audit_ntp_log(ad); 514 } 515 516 extern int audit_n_rules; 517 extern int audit_signals; 518 #else /* CONFIG_AUDITSYSCALL */ 519 static inline int audit_alloc(struct task_struct *task) 520 { 521 return 0; 522 } 523 static inline void audit_free(struct task_struct *task) 524 { } 525 static inline void audit_syscall_entry(int major, unsigned long a0, 526 unsigned long a1, unsigned long a2, 527 unsigned long a3) 528 { } 529 static inline void audit_syscall_exit(void *pt_regs) 530 { } 531 static inline bool audit_dummy_context(void) 532 { 533 return true; 534 } 535 static inline void audit_set_context(struct task_struct *task, struct audit_context *ctx) 536 { } 537 static inline struct audit_context *audit_context(void) 538 { 539 return NULL; 540 } 541 static inline struct filename *audit_reusename(const __user char *name) 542 { 543 return NULL; 544 } 545 static inline void audit_getname(struct filename *name) 546 { } 547 static inline void __audit_inode(struct filename *name, 548 const struct dentry *dentry, 549 unsigned int flags) 550 { } 551 static inline void __audit_inode_child(struct inode *parent, 552 const struct dentry *dentry, 553 const unsigned char type) 554 { } 555 static inline void audit_inode(struct filename *name, 556 const struct dentry *dentry, 557 unsigned int aflags) 558 { } 559 static inline void audit_file(struct file *file) 560 { 561 } 562 static inline void audit_inode_parent_hidden(struct filename *name, 563 const struct dentry *dentry) 564 { } 565 static inline void audit_inode_child(struct inode *parent, 566 const struct dentry *dentry, 567 const unsigned char type) 568 { } 569 static inline void audit_core_dumps(long signr) 570 { } 571 static inline void audit_seccomp(unsigned long syscall, long signr, int code) 572 { } 573 static inline void audit_seccomp_actions_logged(const char *names, 574 const char *old_names, int res) 575 { } 576 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) 577 { } 578 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, 579 gid_t gid, umode_t mode) 580 { } 581 static inline void audit_bprm(struct linux_binprm *bprm) 582 { } 583 static inline int audit_socketcall(int nargs, unsigned long *args) 584 { 585 return 0; 586 } 587 588 static inline int audit_socketcall_compat(int nargs, u32 *args) 589 { 590 return 0; 591 } 592 593 static inline void audit_fd_pair(int fd1, int fd2) 594 { } 595 static inline int audit_sockaddr(int len, void *addr) 596 { 597 return 0; 598 } 599 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr) 600 { } 601 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, 602 unsigned int msg_prio, 603 const struct timespec64 *abs_timeout) 604 { } 605 static inline void audit_mq_notify(mqd_t mqdes, 606 const struct sigevent *notification) 607 { } 608 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) 609 { } 610 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm, 611 const struct cred *new, 612 const struct cred *old) 613 { 614 return 0; 615 } 616 static inline void audit_log_capset(const struct cred *new, 617 const struct cred *old) 618 { } 619 static inline void audit_mmap_fd(int fd, int flags) 620 { } 621 622 static inline void audit_log_kern_module(char *name) 623 { 624 } 625 626 static inline void audit_fanotify(unsigned int response) 627 { } 628 629 static inline void audit_tk_injoffset(struct timespec64 offset) 630 { } 631 632 static inline void audit_ntp_init(struct audit_ntp_data *ad) 633 { } 634 635 static inline void audit_ntp_set_old(struct audit_ntp_data *ad, 636 enum audit_ntp_type type, long long val) 637 { } 638 639 static inline void audit_ntp_set_new(struct audit_ntp_data *ad, 640 enum audit_ntp_type type, long long val) 641 { } 642 643 static inline void audit_ntp_log(const struct audit_ntp_data *ad) 644 { } 645 646 static inline void audit_ptrace(struct task_struct *t) 647 { } 648 #define audit_n_rules 0 649 #define audit_signals 0 650 #endif /* CONFIG_AUDITSYSCALL */ 651 652 static inline bool audit_loginuid_set(struct task_struct *tsk) 653 { 654 return uid_valid(audit_get_loginuid(tsk)); 655 } 656 657 static inline void audit_log_string(struct audit_buffer *ab, const char *buf) 658 { 659 audit_log_n_string(ab, buf, strlen(buf)); 660 } 661 662 #endif 663