1 /* audit.c -- Auditing support 2 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon. 3 * System-call specific features have moved to auditsc.c 4 * 5 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina. 6 * All Rights Reserved. 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 * Written by Rickard E. (Rik) Faith <faith@redhat.com> 23 * 24 * Goals: 1) Integrate fully with SELinux. 25 * 2) Minimal run-time overhead: 26 * a) Minimal when syscall auditing is disabled (audit_enable=0). 27 * b) Small when syscall auditing is enabled and no audit record 28 * is generated (defer as much work as possible to record 29 * generation time): 30 * i) context is allocated, 31 * ii) names from getname are stored without a copy, and 32 * iii) inode information stored from path_lookup. 33 * 3) Ability to disable syscall auditing at boot time (audit=0). 34 * 4) Usable by other parts of the kernel (if audit_log* is called, 35 * then a syscall record will be generated automatically for the 36 * current syscall). 37 * 5) Netlink interface to user-space. 38 * 6) Support low-overhead kernel-based filtering to minimize the 39 * information that must be passed to user-space. 40 * 41 * Example user-space utilities: http://people.redhat.com/sgrubb/audit/ 42 */ 43 44 #include <linux/init.h> 45 #include <asm/atomic.h> 46 #include <asm/types.h> 47 #include <linux/mm.h> 48 #include <linux/module.h> 49 #include <linux/err.h> 50 #include <linux/kthread.h> 51 52 #include <linux/audit.h> 53 54 #include <net/sock.h> 55 #include <linux/skbuff.h> 56 #include <linux/netlink.h> 57 58 /* No auditing will take place until audit_initialized != 0. 59 * (Initialization happens after skb_init is called.) */ 60 static int audit_initialized; 61 62 /* No syscall auditing will take place unless audit_enabled != 0. */ 63 int audit_enabled; 64 65 /* Default state when kernel boots without any parameters. */ 66 static int audit_default; 67 68 /* If auditing cannot proceed, audit_failure selects what happens. */ 69 static int audit_failure = AUDIT_FAIL_PRINTK; 70 71 /* If audit records are to be written to the netlink socket, audit_pid 72 * contains the (non-zero) pid. */ 73 int audit_pid; 74 75 /* If audit_limit is non-zero, limit the rate of sending audit records 76 * to that number per second. This prevents DoS attacks, but results in 77 * audit records being dropped. */ 78 static int audit_rate_limit; 79 80 /* Number of outstanding audit_buffers allowed. */ 81 static int audit_backlog_limit = 64; 82 static int audit_backlog_wait_time = 60 * HZ; 83 static int audit_backlog_wait_overflow = 0; 84 85 /* The identity of the user shutting down the audit system. */ 86 uid_t audit_sig_uid = -1; 87 pid_t audit_sig_pid = -1; 88 89 /* Records can be lost in several ways: 90 0) [suppressed in audit_alloc] 91 1) out of memory in audit_log_start [kmalloc of struct audit_buffer] 92 2) out of memory in audit_log_move [alloc_skb] 93 3) suppressed due to audit_rate_limit 94 4) suppressed due to audit_backlog_limit 95 */ 96 static atomic_t audit_lost = ATOMIC_INIT(0); 97 98 /* The netlink socket. */ 99 static struct sock *audit_sock; 100 101 /* The audit_freelist is a list of pre-allocated audit buffers (if more 102 * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of 103 * being placed on the freelist). */ 104 static DEFINE_SPINLOCK(audit_freelist_lock); 105 static int audit_freelist_count = 0; 106 static LIST_HEAD(audit_freelist); 107 108 static struct sk_buff_head audit_skb_queue; 109 static struct task_struct *kauditd_task; 110 static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait); 111 static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait); 112 113 /* The netlink socket is only to be read by 1 CPU, which lets us assume 114 * that list additions and deletions never happen simultaneously in 115 * auditsc.c */ 116 DECLARE_MUTEX(audit_netlink_sem); 117 118 /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting 119 * audit records. Since printk uses a 1024 byte buffer, this buffer 120 * should be at least that large. */ 121 #define AUDIT_BUFSIZ 1024 122 123 /* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the 124 * audit_freelist. Doing so eliminates many kmalloc/kfree calls. */ 125 #define AUDIT_MAXFREE (2*NR_CPUS) 126 127 /* The audit_buffer is used when formatting an audit record. The caller 128 * locks briefly to get the record off the freelist or to allocate the 129 * buffer, and locks briefly to send the buffer to the netlink layer or 130 * to place it on a transmit queue. Multiple audit_buffers can be in 131 * use simultaneously. */ 132 struct audit_buffer { 133 struct list_head list; 134 struct sk_buff *skb; /* formatted skb ready to send */ 135 struct audit_context *ctx; /* NULL or associated context */ 136 gfp_t gfp_mask; 137 }; 138 139 static void audit_set_pid(struct audit_buffer *ab, pid_t pid) 140 { 141 struct nlmsghdr *nlh = (struct nlmsghdr *)ab->skb->data; 142 nlh->nlmsg_pid = pid; 143 } 144 145 static void audit_panic(const char *message) 146 { 147 switch (audit_failure) 148 { 149 case AUDIT_FAIL_SILENT: 150 break; 151 case AUDIT_FAIL_PRINTK: 152 printk(KERN_ERR "audit: %s\n", message); 153 break; 154 case AUDIT_FAIL_PANIC: 155 panic("audit: %s\n", message); 156 break; 157 } 158 } 159 160 static inline int audit_rate_check(void) 161 { 162 static unsigned long last_check = 0; 163 static int messages = 0; 164 static DEFINE_SPINLOCK(lock); 165 unsigned long flags; 166 unsigned long now; 167 unsigned long elapsed; 168 int retval = 0; 169 170 if (!audit_rate_limit) return 1; 171 172 spin_lock_irqsave(&lock, flags); 173 if (++messages < audit_rate_limit) { 174 retval = 1; 175 } else { 176 now = jiffies; 177 elapsed = now - last_check; 178 if (elapsed > HZ) { 179 last_check = now; 180 messages = 0; 181 retval = 1; 182 } 183 } 184 spin_unlock_irqrestore(&lock, flags); 185 186 return retval; 187 } 188 189 /* Emit at least 1 message per second, even if audit_rate_check is 190 * throttling. */ 191 void audit_log_lost(const char *message) 192 { 193 static unsigned long last_msg = 0; 194 static DEFINE_SPINLOCK(lock); 195 unsigned long flags; 196 unsigned long now; 197 int print; 198 199 atomic_inc(&audit_lost); 200 201 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit); 202 203 if (!print) { 204 spin_lock_irqsave(&lock, flags); 205 now = jiffies; 206 if (now - last_msg > HZ) { 207 print = 1; 208 last_msg = now; 209 } 210 spin_unlock_irqrestore(&lock, flags); 211 } 212 213 if (print) { 214 printk(KERN_WARNING 215 "audit: audit_lost=%d audit_rate_limit=%d audit_backlog_limit=%d\n", 216 atomic_read(&audit_lost), 217 audit_rate_limit, 218 audit_backlog_limit); 219 audit_panic(message); 220 } 221 222 } 223 224 static int audit_set_rate_limit(int limit, uid_t loginuid) 225 { 226 int old = audit_rate_limit; 227 audit_rate_limit = limit; 228 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 229 "audit_rate_limit=%d old=%d by auid=%u", 230 audit_rate_limit, old, loginuid); 231 return old; 232 } 233 234 static int audit_set_backlog_limit(int limit, uid_t loginuid) 235 { 236 int old = audit_backlog_limit; 237 audit_backlog_limit = limit; 238 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 239 "audit_backlog_limit=%d old=%d by auid=%u", 240 audit_backlog_limit, old, loginuid); 241 return old; 242 } 243 244 static int audit_set_enabled(int state, uid_t loginuid) 245 { 246 int old = audit_enabled; 247 if (state != 0 && state != 1) 248 return -EINVAL; 249 audit_enabled = state; 250 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 251 "audit_enabled=%d old=%d by auid=%u", 252 audit_enabled, old, loginuid); 253 return old; 254 } 255 256 static int audit_set_failure(int state, uid_t loginuid) 257 { 258 int old = audit_failure; 259 if (state != AUDIT_FAIL_SILENT 260 && state != AUDIT_FAIL_PRINTK 261 && state != AUDIT_FAIL_PANIC) 262 return -EINVAL; 263 audit_failure = state; 264 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 265 "audit_failure=%d old=%d by auid=%u", 266 audit_failure, old, loginuid); 267 return old; 268 } 269 270 int kauditd_thread(void *dummy) 271 { 272 struct sk_buff *skb; 273 274 while (1) { 275 skb = skb_dequeue(&audit_skb_queue); 276 wake_up(&audit_backlog_wait); 277 if (skb) { 278 if (audit_pid) { 279 int err = netlink_unicast(audit_sock, skb, audit_pid, 0); 280 if (err < 0) { 281 BUG_ON(err != -ECONNREFUSED); /* Shoudn't happen */ 282 printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid); 283 audit_pid = 0; 284 } 285 } else { 286 printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0)); 287 kfree_skb(skb); 288 } 289 } else { 290 DECLARE_WAITQUEUE(wait, current); 291 set_current_state(TASK_INTERRUPTIBLE); 292 add_wait_queue(&kauditd_wait, &wait); 293 294 if (!skb_queue_len(&audit_skb_queue)) 295 schedule(); 296 297 __set_current_state(TASK_RUNNING); 298 remove_wait_queue(&kauditd_wait, &wait); 299 } 300 } 301 } 302 303 void audit_send_reply(int pid, int seq, int type, int done, int multi, 304 void *payload, int size) 305 { 306 struct sk_buff *skb; 307 struct nlmsghdr *nlh; 308 int len = NLMSG_SPACE(size); 309 void *data; 310 int flags = multi ? NLM_F_MULTI : 0; 311 int t = done ? NLMSG_DONE : type; 312 313 skb = alloc_skb(len, GFP_KERNEL); 314 if (!skb) 315 return; 316 317 nlh = NLMSG_PUT(skb, pid, seq, t, size); 318 nlh->nlmsg_flags = flags; 319 data = NLMSG_DATA(nlh); 320 memcpy(data, payload, size); 321 322 /* Ignore failure. It'll only happen if the sender goes away, 323 because our timeout is set to infinite. */ 324 netlink_unicast(audit_sock, skb, pid, 0); 325 return; 326 327 nlmsg_failure: /* Used by NLMSG_PUT */ 328 if (skb) 329 kfree_skb(skb); 330 } 331 332 /* 333 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit 334 * control messages. 335 */ 336 static int audit_netlink_ok(kernel_cap_t eff_cap, u16 msg_type) 337 { 338 int err = 0; 339 340 switch (msg_type) { 341 case AUDIT_GET: 342 case AUDIT_LIST: 343 case AUDIT_SET: 344 case AUDIT_ADD: 345 case AUDIT_DEL: 346 case AUDIT_SIGNAL_INFO: 347 if (!cap_raised(eff_cap, CAP_AUDIT_CONTROL)) 348 err = -EPERM; 349 break; 350 case AUDIT_USER: 351 case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG: 352 if (!cap_raised(eff_cap, CAP_AUDIT_WRITE)) 353 err = -EPERM; 354 break; 355 default: /* bad msg */ 356 err = -EINVAL; 357 } 358 359 return err; 360 } 361 362 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 363 { 364 u32 uid, pid, seq; 365 void *data; 366 struct audit_status *status_get, status_set; 367 int err; 368 struct audit_buffer *ab; 369 u16 msg_type = nlh->nlmsg_type; 370 uid_t loginuid; /* loginuid of sender */ 371 struct audit_sig_info sig_data; 372 373 err = audit_netlink_ok(NETLINK_CB(skb).eff_cap, msg_type); 374 if (err) 375 return err; 376 377 /* As soon as there's any sign of userspace auditd, start kauditd to talk to it */ 378 if (!kauditd_task) 379 kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd"); 380 if (IS_ERR(kauditd_task)) { 381 err = PTR_ERR(kauditd_task); 382 kauditd_task = NULL; 383 return err; 384 } 385 386 pid = NETLINK_CREDS(skb)->pid; 387 uid = NETLINK_CREDS(skb)->uid; 388 loginuid = NETLINK_CB(skb).loginuid; 389 seq = nlh->nlmsg_seq; 390 data = NLMSG_DATA(nlh); 391 392 switch (msg_type) { 393 case AUDIT_GET: 394 status_set.enabled = audit_enabled; 395 status_set.failure = audit_failure; 396 status_set.pid = audit_pid; 397 status_set.rate_limit = audit_rate_limit; 398 status_set.backlog_limit = audit_backlog_limit; 399 status_set.lost = atomic_read(&audit_lost); 400 status_set.backlog = skb_queue_len(&audit_skb_queue); 401 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0, 402 &status_set, sizeof(status_set)); 403 break; 404 case AUDIT_SET: 405 if (nlh->nlmsg_len < sizeof(struct audit_status)) 406 return -EINVAL; 407 status_get = (struct audit_status *)data; 408 if (status_get->mask & AUDIT_STATUS_ENABLED) { 409 err = audit_set_enabled(status_get->enabled, loginuid); 410 if (err < 0) return err; 411 } 412 if (status_get->mask & AUDIT_STATUS_FAILURE) { 413 err = audit_set_failure(status_get->failure, loginuid); 414 if (err < 0) return err; 415 } 416 if (status_get->mask & AUDIT_STATUS_PID) { 417 int old = audit_pid; 418 audit_pid = status_get->pid; 419 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 420 "audit_pid=%d old=%d by auid=%u", 421 audit_pid, old, loginuid); 422 } 423 if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) 424 audit_set_rate_limit(status_get->rate_limit, loginuid); 425 if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT) 426 audit_set_backlog_limit(status_get->backlog_limit, 427 loginuid); 428 break; 429 case AUDIT_USER: 430 case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG: 431 if (!audit_enabled && msg_type != AUDIT_USER_AVC) 432 return 0; 433 434 err = audit_filter_user(&NETLINK_CB(skb), msg_type); 435 if (err == 1) { 436 err = 0; 437 ab = audit_log_start(NULL, GFP_KERNEL, msg_type); 438 if (ab) { 439 audit_log_format(ab, 440 "user pid=%d uid=%u auid=%u msg='%.1024s'", 441 pid, uid, loginuid, (char *)data); 442 audit_set_pid(ab, pid); 443 audit_log_end(ab); 444 } 445 } 446 break; 447 case AUDIT_ADD: 448 case AUDIT_DEL: 449 if (nlh->nlmsg_len < sizeof(struct audit_rule)) 450 return -EINVAL; 451 /* fallthrough */ 452 case AUDIT_LIST: 453 err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid, 454 uid, seq, data, loginuid); 455 break; 456 case AUDIT_SIGNAL_INFO: 457 sig_data.uid = audit_sig_uid; 458 sig_data.pid = audit_sig_pid; 459 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO, 460 0, 0, &sig_data, sizeof(sig_data)); 461 break; 462 default: 463 err = -EINVAL; 464 break; 465 } 466 467 return err < 0 ? err : 0; 468 } 469 470 /* Get message from skb (based on rtnetlink_rcv_skb). Each message is 471 * processed by audit_receive_msg. Malformed skbs with wrong length are 472 * discarded silently. */ 473 static void audit_receive_skb(struct sk_buff *skb) 474 { 475 int err; 476 struct nlmsghdr *nlh; 477 u32 rlen; 478 479 while (skb->len >= NLMSG_SPACE(0)) { 480 nlh = (struct nlmsghdr *)skb->data; 481 if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) 482 return; 483 rlen = NLMSG_ALIGN(nlh->nlmsg_len); 484 if (rlen > skb->len) 485 rlen = skb->len; 486 if ((err = audit_receive_msg(skb, nlh))) { 487 netlink_ack(skb, nlh, err); 488 } else if (nlh->nlmsg_flags & NLM_F_ACK) 489 netlink_ack(skb, nlh, 0); 490 skb_pull(skb, rlen); 491 } 492 } 493 494 /* Receive messages from netlink socket. */ 495 static void audit_receive(struct sock *sk, int length) 496 { 497 struct sk_buff *skb; 498 unsigned int qlen; 499 500 down(&audit_netlink_sem); 501 502 for (qlen = skb_queue_len(&sk->sk_receive_queue); qlen; qlen--) { 503 skb = skb_dequeue(&sk->sk_receive_queue); 504 audit_receive_skb(skb); 505 kfree_skb(skb); 506 } 507 up(&audit_netlink_sem); 508 } 509 510 511 /* Initialize audit support at boot time. */ 512 static int __init audit_init(void) 513 { 514 printk(KERN_INFO "audit: initializing netlink socket (%s)\n", 515 audit_default ? "enabled" : "disabled"); 516 audit_sock = netlink_kernel_create(NETLINK_AUDIT, 0, audit_receive, 517 THIS_MODULE); 518 if (!audit_sock) 519 audit_panic("cannot initialize netlink socket"); 520 521 audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; 522 skb_queue_head_init(&audit_skb_queue); 523 audit_initialized = 1; 524 audit_enabled = audit_default; 525 audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized"); 526 return 0; 527 } 528 __initcall(audit_init); 529 530 /* Process kernel command-line parameter at boot time. audit=0 or audit=1. */ 531 static int __init audit_enable(char *str) 532 { 533 audit_default = !!simple_strtol(str, NULL, 0); 534 printk(KERN_INFO "audit: %s%s\n", 535 audit_default ? "enabled" : "disabled", 536 audit_initialized ? "" : " (after initialization)"); 537 if (audit_initialized) 538 audit_enabled = audit_default; 539 return 0; 540 } 541 542 __setup("audit=", audit_enable); 543 544 static void audit_buffer_free(struct audit_buffer *ab) 545 { 546 unsigned long flags; 547 548 if (!ab) 549 return; 550 551 if (ab->skb) 552 kfree_skb(ab->skb); 553 554 spin_lock_irqsave(&audit_freelist_lock, flags); 555 if (++audit_freelist_count > AUDIT_MAXFREE) 556 kfree(ab); 557 else 558 list_add(&ab->list, &audit_freelist); 559 spin_unlock_irqrestore(&audit_freelist_lock, flags); 560 } 561 562 static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx, 563 gfp_t gfp_mask, int type) 564 { 565 unsigned long flags; 566 struct audit_buffer *ab = NULL; 567 struct nlmsghdr *nlh; 568 569 spin_lock_irqsave(&audit_freelist_lock, flags); 570 if (!list_empty(&audit_freelist)) { 571 ab = list_entry(audit_freelist.next, 572 struct audit_buffer, list); 573 list_del(&ab->list); 574 --audit_freelist_count; 575 } 576 spin_unlock_irqrestore(&audit_freelist_lock, flags); 577 578 if (!ab) { 579 ab = kmalloc(sizeof(*ab), gfp_mask); 580 if (!ab) 581 goto err; 582 } 583 584 ab->skb = alloc_skb(AUDIT_BUFSIZ, gfp_mask); 585 if (!ab->skb) 586 goto err; 587 588 ab->ctx = ctx; 589 ab->gfp_mask = gfp_mask; 590 nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0)); 591 nlh->nlmsg_type = type; 592 nlh->nlmsg_flags = 0; 593 nlh->nlmsg_pid = 0; 594 nlh->nlmsg_seq = 0; 595 return ab; 596 err: 597 audit_buffer_free(ab); 598 return NULL; 599 } 600 601 /* Compute a serial number for the audit record. Audit records are 602 * written to user-space as soon as they are generated, so a complete 603 * audit record may be written in several pieces. The timestamp of the 604 * record and this serial number are used by the user-space tools to 605 * determine which pieces belong to the same audit record. The 606 * (timestamp,serial) tuple is unique for each syscall and is live from 607 * syscall entry to syscall exit. 608 * 609 * NOTE: Another possibility is to store the formatted records off the 610 * audit context (for those records that have a context), and emit them 611 * all at syscall exit. However, this could delay the reporting of 612 * significant errors until syscall exit (or never, if the system 613 * halts). */ 614 615 unsigned int audit_serial(void) 616 { 617 static spinlock_t serial_lock = SPIN_LOCK_UNLOCKED; 618 static unsigned int serial = 0; 619 620 unsigned long flags; 621 unsigned int ret; 622 623 spin_lock_irqsave(&serial_lock, flags); 624 do { 625 ret = ++serial; 626 } while (unlikely(!ret)); 627 spin_unlock_irqrestore(&serial_lock, flags); 628 629 return ret; 630 } 631 632 static inline void audit_get_stamp(struct audit_context *ctx, 633 struct timespec *t, unsigned int *serial) 634 { 635 if (ctx) 636 auditsc_get_stamp(ctx, t, serial); 637 else { 638 *t = CURRENT_TIME; 639 *serial = audit_serial(); 640 } 641 } 642 643 /* Obtain an audit buffer. This routine does locking to obtain the 644 * audit buffer, but then no locking is required for calls to 645 * audit_log_*format. If the tsk is a task that is currently in a 646 * syscall, then the syscall is marked as auditable and an audit record 647 * will be written at syscall exit. If there is no associated task, tsk 648 * should be NULL. */ 649 650 struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, 651 int type) 652 { 653 struct audit_buffer *ab = NULL; 654 struct timespec t; 655 unsigned int serial; 656 int reserve; 657 unsigned long timeout_start = jiffies; 658 659 if (!audit_initialized) 660 return NULL; 661 662 if (gfp_mask & __GFP_WAIT) 663 reserve = 0; 664 else 665 reserve = 5; /* Allow atomic callers to go up to five 666 entries over the normal backlog limit */ 667 668 while (audit_backlog_limit 669 && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) { 670 if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time 671 && time_before(jiffies, timeout_start + audit_backlog_wait_time)) { 672 673 /* Wait for auditd to drain the queue a little */ 674 DECLARE_WAITQUEUE(wait, current); 675 set_current_state(TASK_INTERRUPTIBLE); 676 add_wait_queue(&audit_backlog_wait, &wait); 677 678 if (audit_backlog_limit && 679 skb_queue_len(&audit_skb_queue) > audit_backlog_limit) 680 schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies); 681 682 __set_current_state(TASK_RUNNING); 683 remove_wait_queue(&audit_backlog_wait, &wait); 684 continue; 685 } 686 if (audit_rate_check()) 687 printk(KERN_WARNING 688 "audit: audit_backlog=%d > " 689 "audit_backlog_limit=%d\n", 690 skb_queue_len(&audit_skb_queue), 691 audit_backlog_limit); 692 audit_log_lost("backlog limit exceeded"); 693 audit_backlog_wait_time = audit_backlog_wait_overflow; 694 wake_up(&audit_backlog_wait); 695 return NULL; 696 } 697 698 ab = audit_buffer_alloc(ctx, gfp_mask, type); 699 if (!ab) { 700 audit_log_lost("out of memory in audit_log_start"); 701 return NULL; 702 } 703 704 audit_get_stamp(ab->ctx, &t, &serial); 705 706 audit_log_format(ab, "audit(%lu.%03lu:%u): ", 707 t.tv_sec, t.tv_nsec/1000000, serial); 708 return ab; 709 } 710 711 /** 712 * audit_expand - expand skb in the audit buffer 713 * @ab: audit_buffer 714 * 715 * Returns 0 (no space) on failed expansion, or available space if 716 * successful. 717 */ 718 static inline int audit_expand(struct audit_buffer *ab, int extra) 719 { 720 struct sk_buff *skb = ab->skb; 721 int ret = pskb_expand_head(skb, skb_headroom(skb), extra, 722 ab->gfp_mask); 723 if (ret < 0) { 724 audit_log_lost("out of memory in audit_expand"); 725 return 0; 726 } 727 return skb_tailroom(skb); 728 } 729 730 /* Format an audit message into the audit buffer. If there isn't enough 731 * room in the audit buffer, more room will be allocated and vsnprint 732 * will be called a second time. Currently, we assume that a printk 733 * can't format message larger than 1024 bytes, so we don't either. */ 734 static void audit_log_vformat(struct audit_buffer *ab, const char *fmt, 735 va_list args) 736 { 737 int len, avail; 738 struct sk_buff *skb; 739 va_list args2; 740 741 if (!ab) 742 return; 743 744 BUG_ON(!ab->skb); 745 skb = ab->skb; 746 avail = skb_tailroom(skb); 747 if (avail == 0) { 748 avail = audit_expand(ab, AUDIT_BUFSIZ); 749 if (!avail) 750 goto out; 751 } 752 va_copy(args2, args); 753 len = vsnprintf(skb->tail, avail, fmt, args); 754 if (len >= avail) { 755 /* The printk buffer is 1024 bytes long, so if we get 756 * here and AUDIT_BUFSIZ is at least 1024, then we can 757 * log everything that printk could have logged. */ 758 avail = audit_expand(ab, max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail)); 759 if (!avail) 760 goto out; 761 len = vsnprintf(skb->tail, avail, fmt, args2); 762 } 763 if (len > 0) 764 skb_put(skb, len); 765 out: 766 return; 767 } 768 769 /* Format a message into the audit buffer. All the work is done in 770 * audit_log_vformat. */ 771 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...) 772 { 773 va_list args; 774 775 if (!ab) 776 return; 777 va_start(args, fmt); 778 audit_log_vformat(ab, fmt, args); 779 va_end(args); 780 } 781 782 /* This function will take the passed buf and convert it into a string of 783 * ascii hex digits. The new string is placed onto the skb. */ 784 void audit_log_hex(struct audit_buffer *ab, const unsigned char *buf, 785 size_t len) 786 { 787 int i, avail, new_len; 788 unsigned char *ptr; 789 struct sk_buff *skb; 790 static const unsigned char *hex = "0123456789ABCDEF"; 791 792 BUG_ON(!ab->skb); 793 skb = ab->skb; 794 avail = skb_tailroom(skb); 795 new_len = len<<1; 796 if (new_len >= avail) { 797 /* Round the buffer request up to the next multiple */ 798 new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1); 799 avail = audit_expand(ab, new_len); 800 if (!avail) 801 return; 802 } 803 804 ptr = skb->tail; 805 for (i=0; i<len; i++) { 806 *ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */ 807 *ptr++ = hex[buf[i] & 0x0F]; /* Lower nibble */ 808 } 809 *ptr = 0; 810 skb_put(skb, len << 1); /* new string is twice the old string */ 811 } 812 813 /* This code will escape a string that is passed to it if the string 814 * contains a control character, unprintable character, double quote mark, 815 * or a space. Unescaped strings will start and end with a double quote mark. 816 * Strings that are escaped are printed in hex (2 digits per char). */ 817 void audit_log_untrustedstring(struct audit_buffer *ab, const char *string) 818 { 819 const unsigned char *p = string; 820 821 while (*p) { 822 if (*p == '"' || *p < 0x21 || *p > 0x7f) { 823 audit_log_hex(ab, string, strlen(string)); 824 return; 825 } 826 p++; 827 } 828 audit_log_format(ab, "\"%s\"", string); 829 } 830 831 /* This is a helper-function to print the escaped d_path */ 832 void audit_log_d_path(struct audit_buffer *ab, const char *prefix, 833 struct dentry *dentry, struct vfsmount *vfsmnt) 834 { 835 char *p, *path; 836 837 if (prefix) 838 audit_log_format(ab, " %s", prefix); 839 840 /* We will allow 11 spaces for ' (deleted)' to be appended */ 841 path = kmalloc(PATH_MAX+11, ab->gfp_mask); 842 if (!path) { 843 audit_log_format(ab, "<no memory>"); 844 return; 845 } 846 p = d_path(dentry, vfsmnt, path, PATH_MAX+11); 847 if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */ 848 /* FIXME: can we save some information here? */ 849 audit_log_format(ab, "<too long>"); 850 } else 851 audit_log_untrustedstring(ab, p); 852 kfree(path); 853 } 854 855 /* The netlink_* functions cannot be called inside an irq context, so 856 * the audit buffer is places on a queue and a tasklet is scheduled to 857 * remove them from the queue outside the irq context. May be called in 858 * any context. */ 859 void audit_log_end(struct audit_buffer *ab) 860 { 861 if (!ab) 862 return; 863 if (!audit_rate_check()) { 864 audit_log_lost("rate limit exceeded"); 865 } else { 866 if (audit_pid) { 867 struct nlmsghdr *nlh = (struct nlmsghdr *)ab->skb->data; 868 nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0); 869 skb_queue_tail(&audit_skb_queue, ab->skb); 870 ab->skb = NULL; 871 wake_up_interruptible(&kauditd_wait); 872 } else { 873 printk(KERN_NOTICE "%s\n", ab->skb->data + NLMSG_SPACE(0)); 874 } 875 } 876 audit_buffer_free(ab); 877 } 878 879 /* Log an audit record. This is a convenience function that calls 880 * audit_log_start, audit_log_vformat, and audit_log_end. It may be 881 * called in any context. */ 882 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 883 const char *fmt, ...) 884 { 885 struct audit_buffer *ab; 886 va_list args; 887 888 ab = audit_log_start(ctx, gfp_mask, type); 889 if (ab) { 890 va_start(args, fmt); 891 audit_log_vformat(ab, fmt, args); 892 va_end(args); 893 audit_log_end(ab); 894 } 895 } 896