1 /* audit.h -- Auditing support 2 * 3 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina. 4 * All Rights Reserved. 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 2 of the License, or 9 * (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, write to the Free Software 18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19 * 20 * Written by Rickard E. (Rik) Faith <faith@redhat.com> 21 * 22 */ 23 #ifndef _LINUX_AUDIT_H_ 24 #define _LINUX_AUDIT_H_ 25 26 #include <linux/sched.h> 27 #include <linux/ptrace.h> 28 #include <uapi/linux/audit.h> 29 30 struct audit_sig_info { 31 uid_t uid; 32 pid_t pid; 33 char ctx[0]; 34 }; 35 36 struct audit_buffer; 37 struct audit_context; 38 struct inode; 39 struct netlink_skb_parms; 40 struct path; 41 struct linux_binprm; 42 struct mq_attr; 43 struct mqstat; 44 struct audit_watch; 45 struct audit_tree; 46 struct sk_buff; 47 48 struct audit_krule { 49 int vers_ops; 50 u32 flags; 51 u32 listnr; 52 u32 action; 53 u32 mask[AUDIT_BITMASK_SIZE]; 54 u32 buflen; /* for data alloc on list rules */ 55 u32 field_count; 56 char *filterkey; /* ties events to rules */ 57 struct audit_field *fields; 58 struct audit_field *arch_f; /* quick access to arch field */ 59 struct audit_field *inode_f; /* quick access to an inode field */ 60 struct audit_watch *watch; /* associated watch */ 61 struct audit_tree *tree; /* associated watched tree */ 62 struct list_head rlist; /* entry in audit_{watch,tree}.rules list */ 63 struct list_head list; /* for AUDIT_LIST* purposes only */ 64 u64 prio; 65 }; 66 67 struct audit_field { 68 u32 type; 69 u32 val; 70 kuid_t uid; 71 kgid_t gid; 72 u32 op; 73 char *lsm_str; 74 void *lsm_rule; 75 }; 76 77 extern int is_audit_feature_set(int which); 78 79 extern int __init audit_register_class(int class, unsigned *list); 80 extern int audit_classify_syscall(int abi, unsigned syscall); 81 extern int audit_classify_arch(int arch); 82 /* only for compat system calls */ 83 extern unsigned compat_write_class[]; 84 extern unsigned compat_read_class[]; 85 extern unsigned compat_dir_class[]; 86 extern unsigned compat_chattr_class[]; 87 extern unsigned compat_signal_class[]; 88 89 extern int __weak audit_classify_compat_syscall(int abi, unsigned syscall); 90 91 /* audit_names->type values */ 92 #define AUDIT_TYPE_UNKNOWN 0 /* we don't know yet */ 93 #define AUDIT_TYPE_NORMAL 1 /* a "normal" audit record */ 94 #define AUDIT_TYPE_PARENT 2 /* a parent audit record */ 95 #define AUDIT_TYPE_CHILD_DELETE 3 /* a child being deleted */ 96 #define AUDIT_TYPE_CHILD_CREATE 4 /* a child being created */ 97 98 /* maximized args number that audit_socketcall can process */ 99 #define AUDITSC_ARGS 6 100 101 struct filename; 102 103 extern void audit_log_session_info(struct audit_buffer *ab); 104 105 #ifdef CONFIG_AUDIT_COMPAT_GENERIC 106 #define audit_is_compat(arch) (!((arch) & __AUDIT_ARCH_64BIT)) 107 #else 108 #define audit_is_compat(arch) false 109 #endif 110 111 #ifdef CONFIG_AUDITSYSCALL 112 /* These are defined in auditsc.c */ 113 /* Public API */ 114 extern int audit_alloc(struct task_struct *task); 115 extern void __audit_free(struct task_struct *task); 116 extern void __audit_syscall_entry(int arch, 117 int major, unsigned long a0, unsigned long a1, 118 unsigned long a2, unsigned long a3); 119 extern void __audit_syscall_exit(int ret_success, long ret_value); 120 extern struct filename *__audit_reusename(const __user char *uptr); 121 extern void __audit_getname(struct filename *name); 122 extern void audit_putname(struct filename *name); 123 124 #define AUDIT_INODE_PARENT 1 /* dentry represents the parent */ 125 #define AUDIT_INODE_HIDDEN 2 /* audit record should be hidden */ 126 extern void __audit_inode(struct filename *name, const struct dentry *dentry, 127 unsigned int flags); 128 extern void __audit_inode_child(const struct inode *parent, 129 const struct dentry *dentry, 130 const unsigned char type); 131 extern void __audit_seccomp(unsigned long syscall, long signr, int code); 132 extern void __audit_ptrace(struct task_struct *t); 133 134 static inline int audit_dummy_context(void) 135 { 136 void *p = current->audit_context; 137 return !p || *(int *)p; 138 } 139 static inline void audit_free(struct task_struct *task) 140 { 141 if (unlikely(task->audit_context)) 142 __audit_free(task); 143 } 144 static inline void audit_syscall_entry(int arch, int major, unsigned long a0, 145 unsigned long a1, unsigned long a2, 146 unsigned long a3) 147 { 148 if (unlikely(current->audit_context)) 149 __audit_syscall_entry(arch, major, a0, a1, a2, a3); 150 } 151 static inline void audit_syscall_exit(void *pt_regs) 152 { 153 if (unlikely(current->audit_context)) { 154 int success = is_syscall_success(pt_regs); 155 long return_code = regs_return_value(pt_regs); 156 157 __audit_syscall_exit(success, return_code); 158 } 159 } 160 static inline struct filename *audit_reusename(const __user char *name) 161 { 162 if (unlikely(!audit_dummy_context())) 163 return __audit_reusename(name); 164 return NULL; 165 } 166 static inline void audit_getname(struct filename *name) 167 { 168 if (unlikely(!audit_dummy_context())) 169 __audit_getname(name); 170 } 171 static inline void audit_inode(struct filename *name, 172 const struct dentry *dentry, 173 unsigned int parent) { 174 if (unlikely(!audit_dummy_context())) { 175 unsigned int flags = 0; 176 if (parent) 177 flags |= AUDIT_INODE_PARENT; 178 __audit_inode(name, dentry, flags); 179 } 180 } 181 static inline void audit_inode_parent_hidden(struct filename *name, 182 const struct dentry *dentry) 183 { 184 if (unlikely(!audit_dummy_context())) 185 __audit_inode(name, dentry, 186 AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN); 187 } 188 static inline void audit_inode_child(const struct inode *parent, 189 const struct dentry *dentry, 190 const unsigned char type) { 191 if (unlikely(!audit_dummy_context())) 192 __audit_inode_child(parent, dentry, type); 193 } 194 void audit_core_dumps(long signr); 195 196 static inline void audit_seccomp(unsigned long syscall, long signr, int code) 197 { 198 /* Force a record to be reported if a signal was delivered. */ 199 if (signr || unlikely(!audit_dummy_context())) 200 __audit_seccomp(syscall, signr, code); 201 } 202 203 static inline void audit_ptrace(struct task_struct *t) 204 { 205 if (unlikely(!audit_dummy_context())) 206 __audit_ptrace(t); 207 } 208 209 /* Private API (for audit.c only) */ 210 extern unsigned int audit_serial(void); 211 extern int auditsc_get_stamp(struct audit_context *ctx, 212 struct timespec *t, unsigned int *serial); 213 extern int audit_set_loginuid(kuid_t loginuid); 214 215 static inline kuid_t audit_get_loginuid(struct task_struct *tsk) 216 { 217 return tsk->loginuid; 218 } 219 220 static inline unsigned int audit_get_sessionid(struct task_struct *tsk) 221 { 222 return tsk->sessionid; 223 } 224 225 extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp); 226 extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode); 227 extern void __audit_bprm(struct linux_binprm *bprm); 228 extern int __audit_socketcall(int nargs, unsigned long *args); 229 extern int __audit_sockaddr(int len, void *addr); 230 extern void __audit_fd_pair(int fd1, int fd2); 231 extern void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr); 232 extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout); 233 extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification); 234 extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat); 235 extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm, 236 const struct cred *new, 237 const struct cred *old); 238 extern void __audit_log_capset(const struct cred *new, const struct cred *old); 239 extern void __audit_mmap_fd(int fd, int flags); 240 241 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) 242 { 243 if (unlikely(!audit_dummy_context())) 244 __audit_ipc_obj(ipcp); 245 } 246 static inline void audit_fd_pair(int fd1, int fd2) 247 { 248 if (unlikely(!audit_dummy_context())) 249 __audit_fd_pair(fd1, fd2); 250 } 251 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode) 252 { 253 if (unlikely(!audit_dummy_context())) 254 __audit_ipc_set_perm(qbytes, uid, gid, mode); 255 } 256 static inline void audit_bprm(struct linux_binprm *bprm) 257 { 258 if (unlikely(!audit_dummy_context())) 259 __audit_bprm(bprm); 260 } 261 static inline int audit_socketcall(int nargs, unsigned long *args) 262 { 263 if (unlikely(!audit_dummy_context())) 264 return __audit_socketcall(nargs, args); 265 return 0; 266 } 267 static inline int audit_sockaddr(int len, void *addr) 268 { 269 if (unlikely(!audit_dummy_context())) 270 return __audit_sockaddr(len, addr); 271 return 0; 272 } 273 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr) 274 { 275 if (unlikely(!audit_dummy_context())) 276 __audit_mq_open(oflag, mode, attr); 277 } 278 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout) 279 { 280 if (unlikely(!audit_dummy_context())) 281 __audit_mq_sendrecv(mqdes, msg_len, msg_prio, abs_timeout); 282 } 283 static inline void audit_mq_notify(mqd_t mqdes, const struct sigevent *notification) 284 { 285 if (unlikely(!audit_dummy_context())) 286 __audit_mq_notify(mqdes, notification); 287 } 288 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) 289 { 290 if (unlikely(!audit_dummy_context())) 291 __audit_mq_getsetattr(mqdes, mqstat); 292 } 293 294 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm, 295 const struct cred *new, 296 const struct cred *old) 297 { 298 if (unlikely(!audit_dummy_context())) 299 return __audit_log_bprm_fcaps(bprm, new, old); 300 return 0; 301 } 302 303 static inline void audit_log_capset(const struct cred *new, 304 const struct cred *old) 305 { 306 if (unlikely(!audit_dummy_context())) 307 __audit_log_capset(new, old); 308 } 309 310 static inline void audit_mmap_fd(int fd, int flags) 311 { 312 if (unlikely(!audit_dummy_context())) 313 __audit_mmap_fd(fd, flags); 314 } 315 316 extern int audit_n_rules; 317 extern int audit_signals; 318 #else /* CONFIG_AUDITSYSCALL */ 319 static inline int audit_alloc(struct task_struct *task) 320 { 321 return 0; 322 } 323 static inline void audit_free(struct task_struct *task) 324 { } 325 static inline void audit_syscall_entry(int arch, int major, unsigned long a0, 326 unsigned long a1, unsigned long a2, 327 unsigned long a3) 328 { } 329 static inline void audit_syscall_exit(void *pt_regs) 330 { } 331 static inline int audit_dummy_context(void) 332 { 333 return 1; 334 } 335 static inline struct filename *audit_reusename(const __user char *name) 336 { 337 return NULL; 338 } 339 static inline void audit_getname(struct filename *name) 340 { } 341 static inline void audit_putname(struct filename *name) 342 { } 343 static inline void __audit_inode(struct filename *name, 344 const struct dentry *dentry, 345 unsigned int flags) 346 { } 347 static inline void __audit_inode_child(const struct inode *parent, 348 const struct dentry *dentry, 349 const unsigned char type) 350 { } 351 static inline void audit_inode(struct filename *name, 352 const struct dentry *dentry, 353 unsigned int parent) 354 { } 355 static inline void audit_inode_parent_hidden(struct filename *name, 356 const struct dentry *dentry) 357 { } 358 static inline void audit_inode_child(const struct inode *parent, 359 const struct dentry *dentry, 360 const unsigned char type) 361 { } 362 static inline void audit_core_dumps(long signr) 363 { } 364 static inline void __audit_seccomp(unsigned long syscall, long signr, int code) 365 { } 366 static inline void audit_seccomp(unsigned long syscall, long signr, int code) 367 { } 368 static inline int auditsc_get_stamp(struct audit_context *ctx, 369 struct timespec *t, unsigned int *serial) 370 { 371 return 0; 372 } 373 static inline kuid_t audit_get_loginuid(struct task_struct *tsk) 374 { 375 return INVALID_UID; 376 } 377 static inline unsigned int audit_get_sessionid(struct task_struct *tsk) 378 { 379 return -1; 380 } 381 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) 382 { } 383 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, 384 gid_t gid, umode_t mode) 385 { } 386 static inline void audit_bprm(struct linux_binprm *bprm) 387 { } 388 static inline int audit_socketcall(int nargs, unsigned long *args) 389 { 390 return 0; 391 } 392 static inline void audit_fd_pair(int fd1, int fd2) 393 { } 394 static inline int audit_sockaddr(int len, void *addr) 395 { 396 return 0; 397 } 398 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr) 399 { } 400 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, 401 unsigned int msg_prio, 402 const struct timespec *abs_timeout) 403 { } 404 static inline void audit_mq_notify(mqd_t mqdes, 405 const struct sigevent *notification) 406 { } 407 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) 408 { } 409 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm, 410 const struct cred *new, 411 const struct cred *old) 412 { 413 return 0; 414 } 415 static inline void audit_log_capset(const struct cred *new, 416 const struct cred *old) 417 { } 418 static inline void audit_mmap_fd(int fd, int flags) 419 { } 420 static inline void audit_ptrace(struct task_struct *t) 421 { } 422 #define audit_n_rules 0 423 #define audit_signals 0 424 #endif /* CONFIG_AUDITSYSCALL */ 425 426 static inline bool audit_loginuid_set(struct task_struct *tsk) 427 { 428 return uid_valid(audit_get_loginuid(tsk)); 429 } 430 431 #ifdef CONFIG_AUDIT 432 /* These are defined in audit.c */ 433 /* Public API */ 434 extern __printf(4, 5) 435 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 436 const char *fmt, ...); 437 438 extern struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type); 439 extern __printf(2, 3) 440 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...); 441 extern void audit_log_end(struct audit_buffer *ab); 442 extern int audit_string_contains_control(const char *string, 443 size_t len); 444 extern void audit_log_n_hex(struct audit_buffer *ab, 445 const unsigned char *buf, 446 size_t len); 447 extern void audit_log_n_string(struct audit_buffer *ab, 448 const char *buf, 449 size_t n); 450 extern void audit_log_n_untrustedstring(struct audit_buffer *ab, 451 const char *string, 452 size_t n); 453 extern void audit_log_untrustedstring(struct audit_buffer *ab, 454 const char *string); 455 extern void audit_log_d_path(struct audit_buffer *ab, 456 const char *prefix, 457 const struct path *path); 458 extern void audit_log_key(struct audit_buffer *ab, 459 char *key); 460 extern void audit_log_link_denied(const char *operation, 461 struct path *link); 462 extern void audit_log_lost(const char *message); 463 #ifdef CONFIG_SECURITY 464 extern void audit_log_secctx(struct audit_buffer *ab, u32 secid); 465 #else 466 static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid) 467 { } 468 #endif 469 470 extern int audit_log_task_context(struct audit_buffer *ab); 471 extern void audit_log_task_info(struct audit_buffer *ab, 472 struct task_struct *tsk); 473 474 extern int audit_update_lsm_rules(void); 475 476 /* Private API (for audit.c only) */ 477 extern int audit_filter_user(int type); 478 extern int audit_filter_type(int type); 479 extern int audit_rule_change(int type, __u32 portid, int seq, 480 void *data, size_t datasz); 481 extern int audit_list_rules_send(struct sk_buff *request_skb, int seq); 482 483 extern u32 audit_enabled; 484 #else /* CONFIG_AUDIT */ 485 static inline __printf(4, 5) 486 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 487 const char *fmt, ...) 488 { } 489 static inline struct audit_buffer *audit_log_start(struct audit_context *ctx, 490 gfp_t gfp_mask, int type) 491 { 492 return NULL; 493 } 494 static inline __printf(2, 3) 495 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...) 496 { } 497 static inline void audit_log_end(struct audit_buffer *ab) 498 { } 499 static inline void audit_log_n_hex(struct audit_buffer *ab, 500 const unsigned char *buf, size_t len) 501 { } 502 static inline void audit_log_n_string(struct audit_buffer *ab, 503 const char *buf, size_t n) 504 { } 505 static inline void audit_log_n_untrustedstring(struct audit_buffer *ab, 506 const char *string, size_t n) 507 { } 508 static inline void audit_log_untrustedstring(struct audit_buffer *ab, 509 const char *string) 510 { } 511 static inline void audit_log_d_path(struct audit_buffer *ab, 512 const char *prefix, 513 const struct path *path) 514 { } 515 static inline void audit_log_key(struct audit_buffer *ab, char *key) 516 { } 517 static inline void audit_log_link_denied(const char *string, 518 const struct path *link) 519 { } 520 static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid) 521 { } 522 static inline int audit_log_task_context(struct audit_buffer *ab) 523 { 524 return 0; 525 } 526 static inline void audit_log_task_info(struct audit_buffer *ab, 527 struct task_struct *tsk) 528 { } 529 #define audit_enabled 0 530 #endif /* CONFIG_AUDIT */ 531 static inline void audit_log_string(struct audit_buffer *ab, const char *buf) 532 { 533 audit_log_n_string(ab, buf, strlen(buf)); 534 } 535 536 #endif 537