1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* audit.c -- Auditing support 3 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon. 4 * System-call specific features have moved to auditsc.c 5 * 6 * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina. 7 * All Rights Reserved. 8 * 9 * Written by Rickard E. (Rik) Faith <faith@redhat.com> 10 * 11 * Goals: 1) Integrate fully with Security Modules. 12 * 2) Minimal run-time overhead: 13 * a) Minimal when syscall auditing is disabled (audit_enable=0). 14 * b) Small when syscall auditing is enabled and no audit record 15 * is generated (defer as much work as possible to record 16 * generation time): 17 * i) context is allocated, 18 * ii) names from getname are stored without a copy, and 19 * iii) inode information stored from path_lookup. 20 * 3) Ability to disable syscall auditing at boot time (audit=0). 21 * 4) Usable by other parts of the kernel (if audit_log* is called, 22 * then a syscall record will be generated automatically for the 23 * current syscall). 24 * 5) Netlink interface to user-space. 25 * 6) Support low-overhead kernel-based filtering to minimize the 26 * information that must be passed to user-space. 27 * 28 * Audit userspace, documentation, tests, and bug/issue trackers: 29 * https://github.com/linux-audit 30 */ 31 32 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 33 34 #include <linux/file.h> 35 #include <linux/init.h> 36 #include <linux/types.h> 37 #include <linux/atomic.h> 38 #include <linux/mm.h> 39 #include <linux/export.h> 40 #include <linux/slab.h> 41 #include <linux/err.h> 42 #include <linux/kthread.h> 43 #include <linux/kernel.h> 44 #include <linux/syscalls.h> 45 #include <linux/spinlock.h> 46 #include <linux/rcupdate.h> 47 #include <linux/mutex.h> 48 #include <linux/gfp.h> 49 #include <linux/pid.h> 50 51 #include <linux/audit.h> 52 53 #include <net/sock.h> 54 #include <net/netlink.h> 55 #include <linux/skbuff.h> 56 #ifdef CONFIG_SECURITY 57 #include <linux/security.h> 58 #endif 59 #include <linux/freezer.h> 60 #include <linux/pid_namespace.h> 61 #include <net/netns/generic.h> 62 63 #include "audit.h" 64 65 /* No auditing will take place until audit_initialized == AUDIT_INITIALIZED. 66 * (Initialization happens after skb_init is called.) */ 67 #define AUDIT_DISABLED -1 68 #define AUDIT_UNINITIALIZED 0 69 #define AUDIT_INITIALIZED 1 70 static int audit_initialized = AUDIT_UNINITIALIZED; 71 72 u32 audit_enabled = AUDIT_OFF; 73 bool audit_ever_enabled = !!AUDIT_OFF; 74 75 EXPORT_SYMBOL_GPL(audit_enabled); 76 77 /* Default state when kernel boots without any parameters. */ 78 static u32 audit_default = AUDIT_OFF; 79 80 /* If auditing cannot proceed, audit_failure selects what happens. */ 81 static u32 audit_failure = AUDIT_FAIL_PRINTK; 82 83 /* private audit network namespace index */ 84 static unsigned int audit_net_id; 85 86 /** 87 * struct audit_net - audit private network namespace data 88 * @sk: communication socket 89 */ 90 struct audit_net { 91 struct sock *sk; 92 }; 93 94 /** 95 * struct auditd_connection - kernel/auditd connection state 96 * @pid: auditd PID 97 * @portid: netlink portid 98 * @net: the associated network namespace 99 * @rcu: RCU head 100 * 101 * Description: 102 * This struct is RCU protected; you must either hold the RCU lock for reading 103 * or the associated spinlock for writing. 104 */ 105 struct auditd_connection { 106 struct pid *pid; 107 u32 portid; 108 struct net *net; 109 struct rcu_head rcu; 110 }; 111 static struct auditd_connection __rcu *auditd_conn; 112 static DEFINE_SPINLOCK(auditd_conn_lock); 113 114 /* If audit_rate_limit is non-zero, limit the rate of sending audit records 115 * to that number per second. This prevents DoS attacks, but results in 116 * audit records being dropped. */ 117 static u32 audit_rate_limit; 118 119 /* Number of outstanding audit_buffers allowed. 120 * When set to zero, this means unlimited. */ 121 static u32 audit_backlog_limit = 64; 122 #define AUDIT_BACKLOG_WAIT_TIME (60 * HZ) 123 static u32 audit_backlog_wait_time = AUDIT_BACKLOG_WAIT_TIME; 124 125 /* The identity of the user shutting down the audit system. */ 126 static kuid_t audit_sig_uid = INVALID_UID; 127 static pid_t audit_sig_pid = -1; 128 static u32 audit_sig_sid; 129 130 /* Records can be lost in several ways: 131 0) [suppressed in audit_alloc] 132 1) out of memory in audit_log_start [kmalloc of struct audit_buffer] 133 2) out of memory in audit_log_move [alloc_skb] 134 3) suppressed due to audit_rate_limit 135 4) suppressed due to audit_backlog_limit 136 */ 137 static atomic_t audit_lost = ATOMIC_INIT(0); 138 139 /* Monotonically increasing sum of time the kernel has spent 140 * waiting while the backlog limit is exceeded. 141 */ 142 static atomic_t audit_backlog_wait_time_actual = ATOMIC_INIT(0); 143 144 /* Hash for inode-based rules */ 145 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; 146 147 static struct kmem_cache *audit_buffer_cache; 148 149 /* queue msgs to send via kauditd_task */ 150 static struct sk_buff_head audit_queue; 151 /* queue msgs due to temporary unicast send problems */ 152 static struct sk_buff_head audit_retry_queue; 153 /* queue msgs waiting for new auditd connection */ 154 static struct sk_buff_head audit_hold_queue; 155 156 /* queue servicing thread */ 157 static struct task_struct *kauditd_task; 158 static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait); 159 160 /* waitqueue for callers who are blocked on the audit backlog */ 161 static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait); 162 163 static struct audit_features af = {.vers = AUDIT_FEATURE_VERSION, 164 .mask = -1, 165 .features = 0, 166 .lock = 0,}; 167 168 static char *audit_feature_names[2] = { 169 "only_unset_loginuid", 170 "loginuid_immutable", 171 }; 172 173 /** 174 * struct audit_ctl_mutex - serialize requests from userspace 175 * @lock: the mutex used for locking 176 * @owner: the task which owns the lock 177 * 178 * Description: 179 * This is the lock struct used to ensure we only process userspace requests 180 * in an orderly fashion. We can't simply use a mutex/lock here because we 181 * need to track lock ownership so we don't end up blocking the lock owner in 182 * audit_log_start() or similar. 183 */ 184 static struct audit_ctl_mutex { 185 struct mutex lock; 186 void *owner; 187 } audit_cmd_mutex; 188 189 /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting 190 * audit records. Since printk uses a 1024 byte buffer, this buffer 191 * should be at least that large. */ 192 #define AUDIT_BUFSIZ 1024 193 194 /* The audit_buffer is used when formatting an audit record. The caller 195 * locks briefly to get the record off the freelist or to allocate the 196 * buffer, and locks briefly to send the buffer to the netlink layer or 197 * to place it on a transmit queue. Multiple audit_buffers can be in 198 * use simultaneously. */ 199 struct audit_buffer { 200 struct sk_buff *skb; /* formatted skb ready to send */ 201 struct audit_context *ctx; /* NULL or associated context */ 202 gfp_t gfp_mask; 203 }; 204 205 struct audit_reply { 206 __u32 portid; 207 struct net *net; 208 struct sk_buff *skb; 209 }; 210 211 /** 212 * auditd_test_task - Check to see if a given task is an audit daemon 213 * @task: the task to check 214 * 215 * Description: 216 * Return 1 if the task is a registered audit daemon, 0 otherwise. 217 */ 218 int auditd_test_task(struct task_struct *task) 219 { 220 int rc; 221 struct auditd_connection *ac; 222 223 rcu_read_lock(); 224 ac = rcu_dereference(auditd_conn); 225 rc = (ac && ac->pid == task_tgid(task) ? 1 : 0); 226 rcu_read_unlock(); 227 228 return rc; 229 } 230 231 /** 232 * audit_ctl_lock - Take the audit control lock 233 */ 234 void audit_ctl_lock(void) 235 { 236 mutex_lock(&audit_cmd_mutex.lock); 237 audit_cmd_mutex.owner = current; 238 } 239 240 /** 241 * audit_ctl_unlock - Drop the audit control lock 242 */ 243 void audit_ctl_unlock(void) 244 { 245 audit_cmd_mutex.owner = NULL; 246 mutex_unlock(&audit_cmd_mutex.lock); 247 } 248 249 /** 250 * audit_ctl_owner_current - Test to see if the current task owns the lock 251 * 252 * Description: 253 * Return true if the current task owns the audit control lock, false if it 254 * doesn't own the lock. 255 */ 256 static bool audit_ctl_owner_current(void) 257 { 258 return (current == audit_cmd_mutex.owner); 259 } 260 261 /** 262 * auditd_pid_vnr - Return the auditd PID relative to the namespace 263 * 264 * Description: 265 * Returns the PID in relation to the namespace, 0 on failure. 266 */ 267 static pid_t auditd_pid_vnr(void) 268 { 269 pid_t pid; 270 const struct auditd_connection *ac; 271 272 rcu_read_lock(); 273 ac = rcu_dereference(auditd_conn); 274 if (!ac || !ac->pid) 275 pid = 0; 276 else 277 pid = pid_vnr(ac->pid); 278 rcu_read_unlock(); 279 280 return pid; 281 } 282 283 /** 284 * audit_get_sk - Return the audit socket for the given network namespace 285 * @net: the destination network namespace 286 * 287 * Description: 288 * Returns the sock pointer if valid, NULL otherwise. The caller must ensure 289 * that a reference is held for the network namespace while the sock is in use. 290 */ 291 static struct sock *audit_get_sk(const struct net *net) 292 { 293 struct audit_net *aunet; 294 295 if (!net) 296 return NULL; 297 298 aunet = net_generic(net, audit_net_id); 299 return aunet->sk; 300 } 301 302 void audit_panic(const char *message) 303 { 304 switch (audit_failure) { 305 case AUDIT_FAIL_SILENT: 306 break; 307 case AUDIT_FAIL_PRINTK: 308 if (printk_ratelimit()) 309 pr_err("%s\n", message); 310 break; 311 case AUDIT_FAIL_PANIC: 312 panic("audit: %s\n", message); 313 break; 314 } 315 } 316 317 static inline int audit_rate_check(void) 318 { 319 static unsigned long last_check = 0; 320 static int messages = 0; 321 static DEFINE_SPINLOCK(lock); 322 unsigned long flags; 323 unsigned long now; 324 unsigned long elapsed; 325 int retval = 0; 326 327 if (!audit_rate_limit) return 1; 328 329 spin_lock_irqsave(&lock, flags); 330 if (++messages < audit_rate_limit) { 331 retval = 1; 332 } else { 333 now = jiffies; 334 elapsed = now - last_check; 335 if (elapsed > HZ) { 336 last_check = now; 337 messages = 0; 338 retval = 1; 339 } 340 } 341 spin_unlock_irqrestore(&lock, flags); 342 343 return retval; 344 } 345 346 /** 347 * audit_log_lost - conditionally log lost audit message event 348 * @message: the message stating reason for lost audit message 349 * 350 * Emit at least 1 message per second, even if audit_rate_check is 351 * throttling. 352 * Always increment the lost messages counter. 353 */ 354 void audit_log_lost(const char *message) 355 { 356 static unsigned long last_msg = 0; 357 static DEFINE_SPINLOCK(lock); 358 unsigned long flags; 359 unsigned long now; 360 int print; 361 362 atomic_inc(&audit_lost); 363 364 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit); 365 366 if (!print) { 367 spin_lock_irqsave(&lock, flags); 368 now = jiffies; 369 if (now - last_msg > HZ) { 370 print = 1; 371 last_msg = now; 372 } 373 spin_unlock_irqrestore(&lock, flags); 374 } 375 376 if (print) { 377 if (printk_ratelimit()) 378 pr_warn("audit_lost=%u audit_rate_limit=%u audit_backlog_limit=%u\n", 379 atomic_read(&audit_lost), 380 audit_rate_limit, 381 audit_backlog_limit); 382 audit_panic(message); 383 } 384 } 385 386 static int audit_log_config_change(char *function_name, u32 new, u32 old, 387 int allow_changes) 388 { 389 struct audit_buffer *ab; 390 int rc = 0; 391 392 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONFIG_CHANGE); 393 if (unlikely(!ab)) 394 return rc; 395 audit_log_format(ab, "op=set %s=%u old=%u ", function_name, new, old); 396 audit_log_session_info(ab); 397 rc = audit_log_task_context(ab); 398 if (rc) 399 allow_changes = 0; /* Something weird, deny request */ 400 audit_log_format(ab, " res=%d", allow_changes); 401 audit_log_end(ab); 402 return rc; 403 } 404 405 static int audit_do_config_change(char *function_name, u32 *to_change, u32 new) 406 { 407 int allow_changes, rc = 0; 408 u32 old = *to_change; 409 410 /* check if we are locked */ 411 if (audit_enabled == AUDIT_LOCKED) 412 allow_changes = 0; 413 else 414 allow_changes = 1; 415 416 if (audit_enabled != AUDIT_OFF) { 417 rc = audit_log_config_change(function_name, new, old, allow_changes); 418 if (rc) 419 allow_changes = 0; 420 } 421 422 /* If we are allowed, make the change */ 423 if (allow_changes == 1) 424 *to_change = new; 425 /* Not allowed, update reason */ 426 else if (rc == 0) 427 rc = -EPERM; 428 return rc; 429 } 430 431 static int audit_set_rate_limit(u32 limit) 432 { 433 return audit_do_config_change("audit_rate_limit", &audit_rate_limit, limit); 434 } 435 436 static int audit_set_backlog_limit(u32 limit) 437 { 438 return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit, limit); 439 } 440 441 static int audit_set_backlog_wait_time(u32 timeout) 442 { 443 return audit_do_config_change("audit_backlog_wait_time", 444 &audit_backlog_wait_time, timeout); 445 } 446 447 static int audit_set_enabled(u32 state) 448 { 449 int rc; 450 if (state > AUDIT_LOCKED) 451 return -EINVAL; 452 453 rc = audit_do_config_change("audit_enabled", &audit_enabled, state); 454 if (!rc) 455 audit_ever_enabled |= !!state; 456 457 return rc; 458 } 459 460 static int audit_set_failure(u32 state) 461 { 462 if (state != AUDIT_FAIL_SILENT 463 && state != AUDIT_FAIL_PRINTK 464 && state != AUDIT_FAIL_PANIC) 465 return -EINVAL; 466 467 return audit_do_config_change("audit_failure", &audit_failure, state); 468 } 469 470 /** 471 * auditd_conn_free - RCU helper to release an auditd connection struct 472 * @rcu: RCU head 473 * 474 * Description: 475 * Drop any references inside the auditd connection tracking struct and free 476 * the memory. 477 */ 478 static void auditd_conn_free(struct rcu_head *rcu) 479 { 480 struct auditd_connection *ac; 481 482 ac = container_of(rcu, struct auditd_connection, rcu); 483 put_pid(ac->pid); 484 put_net(ac->net); 485 kfree(ac); 486 } 487 488 /** 489 * auditd_set - Set/Reset the auditd connection state 490 * @pid: auditd PID 491 * @portid: auditd netlink portid 492 * @net: auditd network namespace pointer 493 * 494 * Description: 495 * This function will obtain and drop network namespace references as 496 * necessary. Returns zero on success, negative values on failure. 497 */ 498 static int auditd_set(struct pid *pid, u32 portid, struct net *net) 499 { 500 unsigned long flags; 501 struct auditd_connection *ac_old, *ac_new; 502 503 if (!pid || !net) 504 return -EINVAL; 505 506 ac_new = kzalloc(sizeof(*ac_new), GFP_KERNEL); 507 if (!ac_new) 508 return -ENOMEM; 509 ac_new->pid = get_pid(pid); 510 ac_new->portid = portid; 511 ac_new->net = get_net(net); 512 513 spin_lock_irqsave(&auditd_conn_lock, flags); 514 ac_old = rcu_dereference_protected(auditd_conn, 515 lockdep_is_held(&auditd_conn_lock)); 516 rcu_assign_pointer(auditd_conn, ac_new); 517 spin_unlock_irqrestore(&auditd_conn_lock, flags); 518 519 if (ac_old) 520 call_rcu(&ac_old->rcu, auditd_conn_free); 521 522 return 0; 523 } 524 525 /** 526 * kauditd_printk_skb - Print the audit record to the ring buffer 527 * @skb: audit record 528 * 529 * Whatever the reason, this packet may not make it to the auditd connection 530 * so write it via printk so the information isn't completely lost. 531 */ 532 static void kauditd_printk_skb(struct sk_buff *skb) 533 { 534 struct nlmsghdr *nlh = nlmsg_hdr(skb); 535 char *data = nlmsg_data(nlh); 536 537 if (nlh->nlmsg_type != AUDIT_EOE && printk_ratelimit()) 538 pr_notice("type=%d %s\n", nlh->nlmsg_type, data); 539 } 540 541 /** 542 * kauditd_rehold_skb - Handle a audit record send failure in the hold queue 543 * @skb: audit record 544 * 545 * Description: 546 * This should only be used by the kauditd_thread when it fails to flush the 547 * hold queue. 548 */ 549 static void kauditd_rehold_skb(struct sk_buff *skb) 550 { 551 /* put the record back in the queue at the same place */ 552 skb_queue_head(&audit_hold_queue, skb); 553 } 554 555 /** 556 * kauditd_hold_skb - Queue an audit record, waiting for auditd 557 * @skb: audit record 558 * 559 * Description: 560 * Queue the audit record, waiting for an instance of auditd. When this 561 * function is called we haven't given up yet on sending the record, but things 562 * are not looking good. The first thing we want to do is try to write the 563 * record via printk and then see if we want to try and hold on to the record 564 * and queue it, if we have room. If we want to hold on to the record, but we 565 * don't have room, record a record lost message. 566 */ 567 static void kauditd_hold_skb(struct sk_buff *skb) 568 { 569 /* at this point it is uncertain if we will ever send this to auditd so 570 * try to send the message via printk before we go any further */ 571 kauditd_printk_skb(skb); 572 573 /* can we just silently drop the message? */ 574 if (!audit_default) { 575 kfree_skb(skb); 576 return; 577 } 578 579 /* if we have room, queue the message */ 580 if (!audit_backlog_limit || 581 skb_queue_len(&audit_hold_queue) < audit_backlog_limit) { 582 skb_queue_tail(&audit_hold_queue, skb); 583 return; 584 } 585 586 /* we have no other options - drop the message */ 587 audit_log_lost("kauditd hold queue overflow"); 588 kfree_skb(skb); 589 } 590 591 /** 592 * kauditd_retry_skb - Queue an audit record, attempt to send again to auditd 593 * @skb: audit record 594 * 595 * Description: 596 * Not as serious as kauditd_hold_skb() as we still have a connected auditd, 597 * but for some reason we are having problems sending it audit records so 598 * queue the given record and attempt to resend. 599 */ 600 static void kauditd_retry_skb(struct sk_buff *skb) 601 { 602 /* NOTE: because records should only live in the retry queue for a 603 * short period of time, before either being sent or moved to the hold 604 * queue, we don't currently enforce a limit on this queue */ 605 skb_queue_tail(&audit_retry_queue, skb); 606 } 607 608 /** 609 * auditd_reset - Disconnect the auditd connection 610 * @ac: auditd connection state 611 * 612 * Description: 613 * Break the auditd/kauditd connection and move all the queued records into the 614 * hold queue in case auditd reconnects. It is important to note that the @ac 615 * pointer should never be dereferenced inside this function as it may be NULL 616 * or invalid, you can only compare the memory address! If @ac is NULL then 617 * the connection will always be reset. 618 */ 619 static void auditd_reset(const struct auditd_connection *ac) 620 { 621 unsigned long flags; 622 struct sk_buff *skb; 623 struct auditd_connection *ac_old; 624 625 /* if it isn't already broken, break the connection */ 626 spin_lock_irqsave(&auditd_conn_lock, flags); 627 ac_old = rcu_dereference_protected(auditd_conn, 628 lockdep_is_held(&auditd_conn_lock)); 629 if (ac && ac != ac_old) { 630 /* someone already registered a new auditd connection */ 631 spin_unlock_irqrestore(&auditd_conn_lock, flags); 632 return; 633 } 634 rcu_assign_pointer(auditd_conn, NULL); 635 spin_unlock_irqrestore(&auditd_conn_lock, flags); 636 637 if (ac_old) 638 call_rcu(&ac_old->rcu, auditd_conn_free); 639 640 /* flush the retry queue to the hold queue, but don't touch the main 641 * queue since we need to process that normally for multicast */ 642 while ((skb = skb_dequeue(&audit_retry_queue))) 643 kauditd_hold_skb(skb); 644 } 645 646 /** 647 * auditd_send_unicast_skb - Send a record via unicast to auditd 648 * @skb: audit record 649 * 650 * Description: 651 * Send a skb to the audit daemon, returns positive/zero values on success and 652 * negative values on failure; in all cases the skb will be consumed by this 653 * function. If the send results in -ECONNREFUSED the connection with auditd 654 * will be reset. This function may sleep so callers should not hold any locks 655 * where this would cause a problem. 656 */ 657 static int auditd_send_unicast_skb(struct sk_buff *skb) 658 { 659 int rc; 660 u32 portid; 661 struct net *net; 662 struct sock *sk; 663 struct auditd_connection *ac; 664 665 /* NOTE: we can't call netlink_unicast while in the RCU section so 666 * take a reference to the network namespace and grab local 667 * copies of the namespace, the sock, and the portid; the 668 * namespace and sock aren't going to go away while we hold a 669 * reference and if the portid does become invalid after the RCU 670 * section netlink_unicast() should safely return an error */ 671 672 rcu_read_lock(); 673 ac = rcu_dereference(auditd_conn); 674 if (!ac) { 675 rcu_read_unlock(); 676 kfree_skb(skb); 677 rc = -ECONNREFUSED; 678 goto err; 679 } 680 net = get_net(ac->net); 681 sk = audit_get_sk(net); 682 portid = ac->portid; 683 rcu_read_unlock(); 684 685 rc = netlink_unicast(sk, skb, portid, 0); 686 put_net(net); 687 if (rc < 0) 688 goto err; 689 690 return rc; 691 692 err: 693 if (ac && rc == -ECONNREFUSED) 694 auditd_reset(ac); 695 return rc; 696 } 697 698 /** 699 * kauditd_send_queue - Helper for kauditd_thread to flush skb queues 700 * @sk: the sending sock 701 * @portid: the netlink destination 702 * @queue: the skb queue to process 703 * @retry_limit: limit on number of netlink unicast failures 704 * @skb_hook: per-skb hook for additional processing 705 * @err_hook: hook called if the skb fails the netlink unicast send 706 * 707 * Description: 708 * Run through the given queue and attempt to send the audit records to auditd, 709 * returns zero on success, negative values on failure. It is up to the caller 710 * to ensure that the @sk is valid for the duration of this function. 711 * 712 */ 713 static int kauditd_send_queue(struct sock *sk, u32 portid, 714 struct sk_buff_head *queue, 715 unsigned int retry_limit, 716 void (*skb_hook)(struct sk_buff *skb), 717 void (*err_hook)(struct sk_buff *skb)) 718 { 719 int rc = 0; 720 struct sk_buff *skb; 721 unsigned int failed = 0; 722 723 /* NOTE: kauditd_thread takes care of all our locking, we just use 724 * the netlink info passed to us (e.g. sk and portid) */ 725 726 while ((skb = skb_dequeue(queue))) { 727 /* call the skb_hook for each skb we touch */ 728 if (skb_hook) 729 (*skb_hook)(skb); 730 731 /* can we send to anyone via unicast? */ 732 if (!sk) { 733 if (err_hook) 734 (*err_hook)(skb); 735 continue; 736 } 737 738 retry: 739 /* grab an extra skb reference in case of error */ 740 skb_get(skb); 741 rc = netlink_unicast(sk, skb, portid, 0); 742 if (rc < 0) { 743 /* send failed - try a few times unless fatal error */ 744 if (++failed >= retry_limit || 745 rc == -ECONNREFUSED || rc == -EPERM) { 746 sk = NULL; 747 if (err_hook) 748 (*err_hook)(skb); 749 if (rc == -EAGAIN) 750 rc = 0; 751 /* continue to drain the queue */ 752 continue; 753 } else 754 goto retry; 755 } else { 756 /* skb sent - drop the extra reference and continue */ 757 consume_skb(skb); 758 failed = 0; 759 } 760 } 761 762 return (rc >= 0 ? 0 : rc); 763 } 764 765 /* 766 * kauditd_send_multicast_skb - Send a record to any multicast listeners 767 * @skb: audit record 768 * 769 * Description: 770 * Write a multicast message to anyone listening in the initial network 771 * namespace. This function doesn't consume an skb as might be expected since 772 * it has to copy it anyways. 773 */ 774 static void kauditd_send_multicast_skb(struct sk_buff *skb) 775 { 776 struct sk_buff *copy; 777 struct sock *sock = audit_get_sk(&init_net); 778 struct nlmsghdr *nlh; 779 780 /* NOTE: we are not taking an additional reference for init_net since 781 * we don't have to worry about it going away */ 782 783 if (!netlink_has_listeners(sock, AUDIT_NLGRP_READLOG)) 784 return; 785 786 /* 787 * The seemingly wasteful skb_copy() rather than bumping the refcount 788 * using skb_get() is necessary because non-standard mods are made to 789 * the skb by the original kaudit unicast socket send routine. The 790 * existing auditd daemon assumes this breakage. Fixing this would 791 * require co-ordinating a change in the established protocol between 792 * the kaudit kernel subsystem and the auditd userspace code. There is 793 * no reason for new multicast clients to continue with this 794 * non-compliance. 795 */ 796 copy = skb_copy(skb, GFP_KERNEL); 797 if (!copy) 798 return; 799 nlh = nlmsg_hdr(copy); 800 nlh->nlmsg_len = skb->len; 801 802 nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, GFP_KERNEL); 803 } 804 805 /** 806 * kauditd_thread - Worker thread to send audit records to userspace 807 * @dummy: unused 808 */ 809 static int kauditd_thread(void *dummy) 810 { 811 int rc; 812 u32 portid = 0; 813 struct net *net = NULL; 814 struct sock *sk = NULL; 815 struct auditd_connection *ac; 816 817 #define UNICAST_RETRIES 5 818 819 set_freezable(); 820 while (!kthread_should_stop()) { 821 /* NOTE: see the lock comments in auditd_send_unicast_skb() */ 822 rcu_read_lock(); 823 ac = rcu_dereference(auditd_conn); 824 if (!ac) { 825 rcu_read_unlock(); 826 goto main_queue; 827 } 828 net = get_net(ac->net); 829 sk = audit_get_sk(net); 830 portid = ac->portid; 831 rcu_read_unlock(); 832 833 /* attempt to flush the hold queue */ 834 rc = kauditd_send_queue(sk, portid, 835 &audit_hold_queue, UNICAST_RETRIES, 836 NULL, kauditd_rehold_skb); 837 if (rc < 0) { 838 sk = NULL; 839 auditd_reset(ac); 840 goto main_queue; 841 } 842 843 /* attempt to flush the retry queue */ 844 rc = kauditd_send_queue(sk, portid, 845 &audit_retry_queue, UNICAST_RETRIES, 846 NULL, kauditd_hold_skb); 847 if (rc < 0) { 848 sk = NULL; 849 auditd_reset(ac); 850 goto main_queue; 851 } 852 853 main_queue: 854 /* process the main queue - do the multicast send and attempt 855 * unicast, dump failed record sends to the retry queue; if 856 * sk == NULL due to previous failures we will just do the 857 * multicast send and move the record to the hold queue */ 858 rc = kauditd_send_queue(sk, portid, &audit_queue, 1, 859 kauditd_send_multicast_skb, 860 (sk ? 861 kauditd_retry_skb : kauditd_hold_skb)); 862 if (ac && rc < 0) 863 auditd_reset(ac); 864 sk = NULL; 865 866 /* drop our netns reference, no auditd sends past this line */ 867 if (net) { 868 put_net(net); 869 net = NULL; 870 } 871 872 /* we have processed all the queues so wake everyone */ 873 wake_up(&audit_backlog_wait); 874 875 /* NOTE: we want to wake up if there is anything on the queue, 876 * regardless of if an auditd is connected, as we need to 877 * do the multicast send and rotate records from the 878 * main queue to the retry/hold queues */ 879 wait_event_freezable(kauditd_wait, 880 (skb_queue_len(&audit_queue) ? 1 : 0)); 881 } 882 883 return 0; 884 } 885 886 int audit_send_list_thread(void *_dest) 887 { 888 struct audit_netlink_list *dest = _dest; 889 struct sk_buff *skb; 890 struct sock *sk = audit_get_sk(dest->net); 891 892 /* wait for parent to finish and send an ACK */ 893 audit_ctl_lock(); 894 audit_ctl_unlock(); 895 896 while ((skb = __skb_dequeue(&dest->q)) != NULL) 897 netlink_unicast(sk, skb, dest->portid, 0); 898 899 put_net(dest->net); 900 kfree(dest); 901 902 return 0; 903 } 904 905 struct sk_buff *audit_make_reply(int seq, int type, int done, 906 int multi, const void *payload, int size) 907 { 908 struct sk_buff *skb; 909 struct nlmsghdr *nlh; 910 void *data; 911 int flags = multi ? NLM_F_MULTI : 0; 912 int t = done ? NLMSG_DONE : type; 913 914 skb = nlmsg_new(size, GFP_KERNEL); 915 if (!skb) 916 return NULL; 917 918 nlh = nlmsg_put(skb, 0, seq, t, size, flags); 919 if (!nlh) 920 goto out_kfree_skb; 921 data = nlmsg_data(nlh); 922 memcpy(data, payload, size); 923 return skb; 924 925 out_kfree_skb: 926 kfree_skb(skb); 927 return NULL; 928 } 929 930 static void audit_free_reply(struct audit_reply *reply) 931 { 932 if (!reply) 933 return; 934 935 kfree_skb(reply->skb); 936 if (reply->net) 937 put_net(reply->net); 938 kfree(reply); 939 } 940 941 static int audit_send_reply_thread(void *arg) 942 { 943 struct audit_reply *reply = (struct audit_reply *)arg; 944 945 audit_ctl_lock(); 946 audit_ctl_unlock(); 947 948 /* Ignore failure. It'll only happen if the sender goes away, 949 because our timeout is set to infinite. */ 950 netlink_unicast(audit_get_sk(reply->net), reply->skb, reply->portid, 0); 951 reply->skb = NULL; 952 audit_free_reply(reply); 953 return 0; 954 } 955 956 /** 957 * audit_send_reply - send an audit reply message via netlink 958 * @request_skb: skb of request we are replying to (used to target the reply) 959 * @seq: sequence number 960 * @type: audit message type 961 * @done: done (last) flag 962 * @multi: multi-part message flag 963 * @payload: payload data 964 * @size: payload size 965 * 966 * Allocates a skb, builds the netlink message, and sends it to the port id. 967 */ 968 static void audit_send_reply(struct sk_buff *request_skb, int seq, int type, int done, 969 int multi, const void *payload, int size) 970 { 971 struct task_struct *tsk; 972 struct audit_reply *reply; 973 974 reply = kzalloc(sizeof(*reply), GFP_KERNEL); 975 if (!reply) 976 return; 977 978 reply->skb = audit_make_reply(seq, type, done, multi, payload, size); 979 if (!reply->skb) 980 goto err; 981 reply->net = get_net(sock_net(NETLINK_CB(request_skb).sk)); 982 reply->portid = NETLINK_CB(request_skb).portid; 983 984 tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply"); 985 if (IS_ERR(tsk)) 986 goto err; 987 988 return; 989 990 err: 991 audit_free_reply(reply); 992 } 993 994 /* 995 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit 996 * control messages. 997 */ 998 static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type) 999 { 1000 int err = 0; 1001 1002 /* Only support initial user namespace for now. */ 1003 /* 1004 * We return ECONNREFUSED because it tricks userspace into thinking 1005 * that audit was not configured into the kernel. Lots of users 1006 * configure their PAM stack (because that's what the distro does) 1007 * to reject login if unable to send messages to audit. If we return 1008 * ECONNREFUSED the PAM stack thinks the kernel does not have audit 1009 * configured in and will let login proceed. If we return EPERM 1010 * userspace will reject all logins. This should be removed when we 1011 * support non init namespaces!! 1012 */ 1013 if (current_user_ns() != &init_user_ns) 1014 return -ECONNREFUSED; 1015 1016 switch (msg_type) { 1017 case AUDIT_LIST: 1018 case AUDIT_ADD: 1019 case AUDIT_DEL: 1020 return -EOPNOTSUPP; 1021 case AUDIT_GET: 1022 case AUDIT_SET: 1023 case AUDIT_GET_FEATURE: 1024 case AUDIT_SET_FEATURE: 1025 case AUDIT_LIST_RULES: 1026 case AUDIT_ADD_RULE: 1027 case AUDIT_DEL_RULE: 1028 case AUDIT_SIGNAL_INFO: 1029 case AUDIT_TTY_GET: 1030 case AUDIT_TTY_SET: 1031 case AUDIT_TRIM: 1032 case AUDIT_MAKE_EQUIV: 1033 /* Only support auditd and auditctl in initial pid namespace 1034 * for now. */ 1035 if (task_active_pid_ns(current) != &init_pid_ns) 1036 return -EPERM; 1037 1038 if (!netlink_capable(skb, CAP_AUDIT_CONTROL)) 1039 err = -EPERM; 1040 break; 1041 case AUDIT_USER: 1042 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: 1043 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: 1044 if (!netlink_capable(skb, CAP_AUDIT_WRITE)) 1045 err = -EPERM; 1046 break; 1047 default: /* bad msg */ 1048 err = -EINVAL; 1049 } 1050 1051 return err; 1052 } 1053 1054 static void audit_log_common_recv_msg(struct audit_context *context, 1055 struct audit_buffer **ab, u16 msg_type) 1056 { 1057 uid_t uid = from_kuid(&init_user_ns, current_uid()); 1058 pid_t pid = task_tgid_nr(current); 1059 1060 if (!audit_enabled && msg_type != AUDIT_USER_AVC) { 1061 *ab = NULL; 1062 return; 1063 } 1064 1065 *ab = audit_log_start(context, GFP_KERNEL, msg_type); 1066 if (unlikely(!*ab)) 1067 return; 1068 audit_log_format(*ab, "pid=%d uid=%u ", pid, uid); 1069 audit_log_session_info(*ab); 1070 audit_log_task_context(*ab); 1071 } 1072 1073 static inline void audit_log_user_recv_msg(struct audit_buffer **ab, 1074 u16 msg_type) 1075 { 1076 audit_log_common_recv_msg(NULL, ab, msg_type); 1077 } 1078 1079 int is_audit_feature_set(int i) 1080 { 1081 return af.features & AUDIT_FEATURE_TO_MASK(i); 1082 } 1083 1084 1085 static int audit_get_feature(struct sk_buff *skb) 1086 { 1087 u32 seq; 1088 1089 seq = nlmsg_hdr(skb)->nlmsg_seq; 1090 1091 audit_send_reply(skb, seq, AUDIT_GET_FEATURE, 0, 0, &af, sizeof(af)); 1092 1093 return 0; 1094 } 1095 1096 static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature, 1097 u32 old_lock, u32 new_lock, int res) 1098 { 1099 struct audit_buffer *ab; 1100 1101 if (audit_enabled == AUDIT_OFF) 1102 return; 1103 1104 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_FEATURE_CHANGE); 1105 if (!ab) 1106 return; 1107 audit_log_task_info(ab); 1108 audit_log_format(ab, " feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d", 1109 audit_feature_names[which], !!old_feature, !!new_feature, 1110 !!old_lock, !!new_lock, res); 1111 audit_log_end(ab); 1112 } 1113 1114 static int audit_set_feature(struct audit_features *uaf) 1115 { 1116 int i; 1117 1118 BUILD_BUG_ON(AUDIT_LAST_FEATURE + 1 > ARRAY_SIZE(audit_feature_names)); 1119 1120 /* if there is ever a version 2 we should handle that here */ 1121 1122 for (i = 0; i <= AUDIT_LAST_FEATURE; i++) { 1123 u32 feature = AUDIT_FEATURE_TO_MASK(i); 1124 u32 old_feature, new_feature, old_lock, new_lock; 1125 1126 /* if we are not changing this feature, move along */ 1127 if (!(feature & uaf->mask)) 1128 continue; 1129 1130 old_feature = af.features & feature; 1131 new_feature = uaf->features & feature; 1132 new_lock = (uaf->lock | af.lock) & feature; 1133 old_lock = af.lock & feature; 1134 1135 /* are we changing a locked feature? */ 1136 if (old_lock && (new_feature != old_feature)) { 1137 audit_log_feature_change(i, old_feature, new_feature, 1138 old_lock, new_lock, 0); 1139 return -EPERM; 1140 } 1141 } 1142 /* nothing invalid, do the changes */ 1143 for (i = 0; i <= AUDIT_LAST_FEATURE; i++) { 1144 u32 feature = AUDIT_FEATURE_TO_MASK(i); 1145 u32 old_feature, new_feature, old_lock, new_lock; 1146 1147 /* if we are not changing this feature, move along */ 1148 if (!(feature & uaf->mask)) 1149 continue; 1150 1151 old_feature = af.features & feature; 1152 new_feature = uaf->features & feature; 1153 old_lock = af.lock & feature; 1154 new_lock = (uaf->lock | af.lock) & feature; 1155 1156 if (new_feature != old_feature) 1157 audit_log_feature_change(i, old_feature, new_feature, 1158 old_lock, new_lock, 1); 1159 1160 if (new_feature) 1161 af.features |= feature; 1162 else 1163 af.features &= ~feature; 1164 af.lock |= new_lock; 1165 } 1166 1167 return 0; 1168 } 1169 1170 static int audit_replace(struct pid *pid) 1171 { 1172 pid_t pvnr; 1173 struct sk_buff *skb; 1174 1175 pvnr = pid_vnr(pid); 1176 skb = audit_make_reply(0, AUDIT_REPLACE, 0, 0, &pvnr, sizeof(pvnr)); 1177 if (!skb) 1178 return -ENOMEM; 1179 return auditd_send_unicast_skb(skb); 1180 } 1181 1182 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 1183 { 1184 u32 seq; 1185 void *data; 1186 int data_len; 1187 int err; 1188 struct audit_buffer *ab; 1189 u16 msg_type = nlh->nlmsg_type; 1190 struct audit_sig_info *sig_data; 1191 char *ctx = NULL; 1192 u32 len; 1193 1194 err = audit_netlink_ok(skb, msg_type); 1195 if (err) 1196 return err; 1197 1198 seq = nlh->nlmsg_seq; 1199 data = nlmsg_data(nlh); 1200 data_len = nlmsg_len(nlh); 1201 1202 switch (msg_type) { 1203 case AUDIT_GET: { 1204 struct audit_status s; 1205 memset(&s, 0, sizeof(s)); 1206 s.enabled = audit_enabled; 1207 s.failure = audit_failure; 1208 /* NOTE: use pid_vnr() so the PID is relative to the current 1209 * namespace */ 1210 s.pid = auditd_pid_vnr(); 1211 s.rate_limit = audit_rate_limit; 1212 s.backlog_limit = audit_backlog_limit; 1213 s.lost = atomic_read(&audit_lost); 1214 s.backlog = skb_queue_len(&audit_queue); 1215 s.feature_bitmap = AUDIT_FEATURE_BITMAP_ALL; 1216 s.backlog_wait_time = audit_backlog_wait_time; 1217 s.backlog_wait_time_actual = atomic_read(&audit_backlog_wait_time_actual); 1218 audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &s, sizeof(s)); 1219 break; 1220 } 1221 case AUDIT_SET: { 1222 struct audit_status s; 1223 memset(&s, 0, sizeof(s)); 1224 /* guard against past and future API changes */ 1225 memcpy(&s, data, min_t(size_t, sizeof(s), data_len)); 1226 if (s.mask & AUDIT_STATUS_ENABLED) { 1227 err = audit_set_enabled(s.enabled); 1228 if (err < 0) 1229 return err; 1230 } 1231 if (s.mask & AUDIT_STATUS_FAILURE) { 1232 err = audit_set_failure(s.failure); 1233 if (err < 0) 1234 return err; 1235 } 1236 if (s.mask & AUDIT_STATUS_PID) { 1237 /* NOTE: we are using the vnr PID functions below 1238 * because the s.pid value is relative to the 1239 * namespace of the caller; at present this 1240 * doesn't matter much since you can really only 1241 * run auditd from the initial pid namespace, but 1242 * something to keep in mind if this changes */ 1243 pid_t new_pid = s.pid; 1244 pid_t auditd_pid; 1245 struct pid *req_pid = task_tgid(current); 1246 1247 /* Sanity check - PID values must match. Setting 1248 * pid to 0 is how auditd ends auditing. */ 1249 if (new_pid && (new_pid != pid_vnr(req_pid))) 1250 return -EINVAL; 1251 1252 /* test the auditd connection */ 1253 audit_replace(req_pid); 1254 1255 auditd_pid = auditd_pid_vnr(); 1256 if (auditd_pid) { 1257 /* replacing a healthy auditd is not allowed */ 1258 if (new_pid) { 1259 audit_log_config_change("audit_pid", 1260 new_pid, auditd_pid, 0); 1261 return -EEXIST; 1262 } 1263 /* only current auditd can unregister itself */ 1264 if (pid_vnr(req_pid) != auditd_pid) { 1265 audit_log_config_change("audit_pid", 1266 new_pid, auditd_pid, 0); 1267 return -EACCES; 1268 } 1269 } 1270 1271 if (new_pid) { 1272 /* register a new auditd connection */ 1273 err = auditd_set(req_pid, 1274 NETLINK_CB(skb).portid, 1275 sock_net(NETLINK_CB(skb).sk)); 1276 if (audit_enabled != AUDIT_OFF) 1277 audit_log_config_change("audit_pid", 1278 new_pid, 1279 auditd_pid, 1280 err ? 0 : 1); 1281 if (err) 1282 return err; 1283 1284 /* try to process any backlog */ 1285 wake_up_interruptible(&kauditd_wait); 1286 } else { 1287 if (audit_enabled != AUDIT_OFF) 1288 audit_log_config_change("audit_pid", 1289 new_pid, 1290 auditd_pid, 1); 1291 1292 /* unregister the auditd connection */ 1293 auditd_reset(NULL); 1294 } 1295 } 1296 if (s.mask & AUDIT_STATUS_RATE_LIMIT) { 1297 err = audit_set_rate_limit(s.rate_limit); 1298 if (err < 0) 1299 return err; 1300 } 1301 if (s.mask & AUDIT_STATUS_BACKLOG_LIMIT) { 1302 err = audit_set_backlog_limit(s.backlog_limit); 1303 if (err < 0) 1304 return err; 1305 } 1306 if (s.mask & AUDIT_STATUS_BACKLOG_WAIT_TIME) { 1307 if (sizeof(s) > (size_t)nlh->nlmsg_len) 1308 return -EINVAL; 1309 if (s.backlog_wait_time > 10*AUDIT_BACKLOG_WAIT_TIME) 1310 return -EINVAL; 1311 err = audit_set_backlog_wait_time(s.backlog_wait_time); 1312 if (err < 0) 1313 return err; 1314 } 1315 if (s.mask == AUDIT_STATUS_LOST) { 1316 u32 lost = atomic_xchg(&audit_lost, 0); 1317 1318 audit_log_config_change("lost", 0, lost, 1); 1319 return lost; 1320 } 1321 if (s.mask == AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL) { 1322 u32 actual = atomic_xchg(&audit_backlog_wait_time_actual, 0); 1323 1324 audit_log_config_change("backlog_wait_time_actual", 0, actual, 1); 1325 return actual; 1326 } 1327 break; 1328 } 1329 case AUDIT_GET_FEATURE: 1330 err = audit_get_feature(skb); 1331 if (err) 1332 return err; 1333 break; 1334 case AUDIT_SET_FEATURE: 1335 if (data_len < sizeof(struct audit_features)) 1336 return -EINVAL; 1337 err = audit_set_feature(data); 1338 if (err) 1339 return err; 1340 break; 1341 case AUDIT_USER: 1342 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: 1343 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: 1344 if (!audit_enabled && msg_type != AUDIT_USER_AVC) 1345 return 0; 1346 /* exit early if there isn't at least one character to print */ 1347 if (data_len < 2) 1348 return -EINVAL; 1349 1350 err = audit_filter(msg_type, AUDIT_FILTER_USER); 1351 if (err == 1) { /* match or error */ 1352 char *str = data; 1353 1354 err = 0; 1355 if (msg_type == AUDIT_USER_TTY) { 1356 err = tty_audit_push(); 1357 if (err) 1358 break; 1359 } 1360 audit_log_user_recv_msg(&ab, msg_type); 1361 if (msg_type != AUDIT_USER_TTY) { 1362 /* ensure NULL termination */ 1363 str[data_len - 1] = '\0'; 1364 audit_log_format(ab, " msg='%.*s'", 1365 AUDIT_MESSAGE_TEXT_MAX, 1366 str); 1367 } else { 1368 audit_log_format(ab, " data="); 1369 if (data_len > 0 && str[data_len - 1] == '\0') 1370 data_len--; 1371 audit_log_n_untrustedstring(ab, str, data_len); 1372 } 1373 audit_log_end(ab); 1374 } 1375 break; 1376 case AUDIT_ADD_RULE: 1377 case AUDIT_DEL_RULE: 1378 if (data_len < sizeof(struct audit_rule_data)) 1379 return -EINVAL; 1380 if (audit_enabled == AUDIT_LOCKED) { 1381 audit_log_common_recv_msg(audit_context(), &ab, 1382 AUDIT_CONFIG_CHANGE); 1383 audit_log_format(ab, " op=%s audit_enabled=%d res=0", 1384 msg_type == AUDIT_ADD_RULE ? 1385 "add_rule" : "remove_rule", 1386 audit_enabled); 1387 audit_log_end(ab); 1388 return -EPERM; 1389 } 1390 err = audit_rule_change(msg_type, seq, data, data_len); 1391 break; 1392 case AUDIT_LIST_RULES: 1393 err = audit_list_rules_send(skb, seq); 1394 break; 1395 case AUDIT_TRIM: 1396 audit_trim_trees(); 1397 audit_log_common_recv_msg(audit_context(), &ab, 1398 AUDIT_CONFIG_CHANGE); 1399 audit_log_format(ab, " op=trim res=1"); 1400 audit_log_end(ab); 1401 break; 1402 case AUDIT_MAKE_EQUIV: { 1403 void *bufp = data; 1404 u32 sizes[2]; 1405 size_t msglen = data_len; 1406 char *old, *new; 1407 1408 err = -EINVAL; 1409 if (msglen < 2 * sizeof(u32)) 1410 break; 1411 memcpy(sizes, bufp, 2 * sizeof(u32)); 1412 bufp += 2 * sizeof(u32); 1413 msglen -= 2 * sizeof(u32); 1414 old = audit_unpack_string(&bufp, &msglen, sizes[0]); 1415 if (IS_ERR(old)) { 1416 err = PTR_ERR(old); 1417 break; 1418 } 1419 new = audit_unpack_string(&bufp, &msglen, sizes[1]); 1420 if (IS_ERR(new)) { 1421 err = PTR_ERR(new); 1422 kfree(old); 1423 break; 1424 } 1425 /* OK, here comes... */ 1426 err = audit_tag_tree(old, new); 1427 1428 audit_log_common_recv_msg(audit_context(), &ab, 1429 AUDIT_CONFIG_CHANGE); 1430 audit_log_format(ab, " op=make_equiv old="); 1431 audit_log_untrustedstring(ab, old); 1432 audit_log_format(ab, " new="); 1433 audit_log_untrustedstring(ab, new); 1434 audit_log_format(ab, " res=%d", !err); 1435 audit_log_end(ab); 1436 kfree(old); 1437 kfree(new); 1438 break; 1439 } 1440 case AUDIT_SIGNAL_INFO: 1441 len = 0; 1442 if (audit_sig_sid) { 1443 err = security_secid_to_secctx(audit_sig_sid, &ctx, &len); 1444 if (err) 1445 return err; 1446 } 1447 sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL); 1448 if (!sig_data) { 1449 if (audit_sig_sid) 1450 security_release_secctx(ctx, len); 1451 return -ENOMEM; 1452 } 1453 sig_data->uid = from_kuid(&init_user_ns, audit_sig_uid); 1454 sig_data->pid = audit_sig_pid; 1455 if (audit_sig_sid) { 1456 memcpy(sig_data->ctx, ctx, len); 1457 security_release_secctx(ctx, len); 1458 } 1459 audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0, 1460 sig_data, sizeof(*sig_data) + len); 1461 kfree(sig_data); 1462 break; 1463 case AUDIT_TTY_GET: { 1464 struct audit_tty_status s; 1465 unsigned int t; 1466 1467 t = READ_ONCE(current->signal->audit_tty); 1468 s.enabled = t & AUDIT_TTY_ENABLE; 1469 s.log_passwd = !!(t & AUDIT_TTY_LOG_PASSWD); 1470 1471 audit_send_reply(skb, seq, AUDIT_TTY_GET, 0, 0, &s, sizeof(s)); 1472 break; 1473 } 1474 case AUDIT_TTY_SET: { 1475 struct audit_tty_status s, old; 1476 struct audit_buffer *ab; 1477 unsigned int t; 1478 1479 memset(&s, 0, sizeof(s)); 1480 /* guard against past and future API changes */ 1481 memcpy(&s, data, min_t(size_t, sizeof(s), data_len)); 1482 /* check if new data is valid */ 1483 if ((s.enabled != 0 && s.enabled != 1) || 1484 (s.log_passwd != 0 && s.log_passwd != 1)) 1485 err = -EINVAL; 1486 1487 if (err) 1488 t = READ_ONCE(current->signal->audit_tty); 1489 else { 1490 t = s.enabled | (-s.log_passwd & AUDIT_TTY_LOG_PASSWD); 1491 t = xchg(¤t->signal->audit_tty, t); 1492 } 1493 old.enabled = t & AUDIT_TTY_ENABLE; 1494 old.log_passwd = !!(t & AUDIT_TTY_LOG_PASSWD); 1495 1496 audit_log_common_recv_msg(audit_context(), &ab, 1497 AUDIT_CONFIG_CHANGE); 1498 audit_log_format(ab, " op=tty_set old-enabled=%d new-enabled=%d" 1499 " old-log_passwd=%d new-log_passwd=%d res=%d", 1500 old.enabled, s.enabled, old.log_passwd, 1501 s.log_passwd, !err); 1502 audit_log_end(ab); 1503 break; 1504 } 1505 default: 1506 err = -EINVAL; 1507 break; 1508 } 1509 1510 return err < 0 ? err : 0; 1511 } 1512 1513 /** 1514 * audit_receive - receive messages from a netlink control socket 1515 * @skb: the message buffer 1516 * 1517 * Parse the provided skb and deal with any messages that may be present, 1518 * malformed skbs are discarded. 1519 */ 1520 static void audit_receive(struct sk_buff *skb) 1521 { 1522 struct nlmsghdr *nlh; 1523 /* 1524 * len MUST be signed for nlmsg_next to be able to dec it below 0 1525 * if the nlmsg_len was not aligned 1526 */ 1527 int len; 1528 int err; 1529 1530 nlh = nlmsg_hdr(skb); 1531 len = skb->len; 1532 1533 audit_ctl_lock(); 1534 while (nlmsg_ok(nlh, len)) { 1535 err = audit_receive_msg(skb, nlh); 1536 /* if err or if this message says it wants a response */ 1537 if (err || (nlh->nlmsg_flags & NLM_F_ACK)) 1538 netlink_ack(skb, nlh, err, NULL); 1539 1540 nlh = nlmsg_next(nlh, &len); 1541 } 1542 audit_ctl_unlock(); 1543 } 1544 1545 /* Log information about who is connecting to the audit multicast socket */ 1546 static void audit_log_multicast(int group, const char *op, int err) 1547 { 1548 const struct cred *cred; 1549 struct tty_struct *tty; 1550 char comm[sizeof(current->comm)]; 1551 struct audit_buffer *ab; 1552 1553 if (!audit_enabled) 1554 return; 1555 1556 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_EVENT_LISTENER); 1557 if (!ab) 1558 return; 1559 1560 cred = current_cred(); 1561 tty = audit_get_tty(); 1562 audit_log_format(ab, "pid=%u uid=%u auid=%u tty=%s ses=%u", 1563 task_pid_nr(current), 1564 from_kuid(&init_user_ns, cred->uid), 1565 from_kuid(&init_user_ns, audit_get_loginuid(current)), 1566 tty ? tty_name(tty) : "(none)", 1567 audit_get_sessionid(current)); 1568 audit_put_tty(tty); 1569 audit_log_task_context(ab); /* subj= */ 1570 audit_log_format(ab, " comm="); 1571 audit_log_untrustedstring(ab, get_task_comm(comm, current)); 1572 audit_log_d_path_exe(ab, current->mm); /* exe= */ 1573 audit_log_format(ab, " nl-mcgrp=%d op=%s res=%d", group, op, !err); 1574 audit_log_end(ab); 1575 } 1576 1577 /* Run custom bind function on netlink socket group connect or bind requests. */ 1578 static int audit_multicast_bind(struct net *net, int group) 1579 { 1580 int err = 0; 1581 1582 if (!capable(CAP_AUDIT_READ)) 1583 err = -EPERM; 1584 audit_log_multicast(group, "connect", err); 1585 return err; 1586 } 1587 1588 static void audit_multicast_unbind(struct net *net, int group) 1589 { 1590 audit_log_multicast(group, "disconnect", 0); 1591 } 1592 1593 static int __net_init audit_net_init(struct net *net) 1594 { 1595 struct netlink_kernel_cfg cfg = { 1596 .input = audit_receive, 1597 .bind = audit_multicast_bind, 1598 .unbind = audit_multicast_unbind, 1599 .flags = NL_CFG_F_NONROOT_RECV, 1600 .groups = AUDIT_NLGRP_MAX, 1601 }; 1602 1603 struct audit_net *aunet = net_generic(net, audit_net_id); 1604 1605 aunet->sk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg); 1606 if (aunet->sk == NULL) { 1607 audit_panic("cannot initialize netlink socket in namespace"); 1608 return -ENOMEM; 1609 } 1610 /* limit the timeout in case auditd is blocked/stopped */ 1611 aunet->sk->sk_sndtimeo = HZ / 10; 1612 1613 return 0; 1614 } 1615 1616 static void __net_exit audit_net_exit(struct net *net) 1617 { 1618 struct audit_net *aunet = net_generic(net, audit_net_id); 1619 1620 /* NOTE: you would think that we would want to check the auditd 1621 * connection and potentially reset it here if it lives in this 1622 * namespace, but since the auditd connection tracking struct holds a 1623 * reference to this namespace (see auditd_set()) we are only ever 1624 * going to get here after that connection has been released */ 1625 1626 netlink_kernel_release(aunet->sk); 1627 } 1628 1629 static struct pernet_operations audit_net_ops __net_initdata = { 1630 .init = audit_net_init, 1631 .exit = audit_net_exit, 1632 .id = &audit_net_id, 1633 .size = sizeof(struct audit_net), 1634 }; 1635 1636 /* Initialize audit support at boot time. */ 1637 static int __init audit_init(void) 1638 { 1639 int i; 1640 1641 if (audit_initialized == AUDIT_DISABLED) 1642 return 0; 1643 1644 audit_buffer_cache = kmem_cache_create("audit_buffer", 1645 sizeof(struct audit_buffer), 1646 0, SLAB_PANIC, NULL); 1647 1648 skb_queue_head_init(&audit_queue); 1649 skb_queue_head_init(&audit_retry_queue); 1650 skb_queue_head_init(&audit_hold_queue); 1651 1652 for (i = 0; i < AUDIT_INODE_BUCKETS; i++) 1653 INIT_LIST_HEAD(&audit_inode_hash[i]); 1654 1655 mutex_init(&audit_cmd_mutex.lock); 1656 audit_cmd_mutex.owner = NULL; 1657 1658 pr_info("initializing netlink subsys (%s)\n", 1659 audit_default ? "enabled" : "disabled"); 1660 register_pernet_subsys(&audit_net_ops); 1661 1662 audit_initialized = AUDIT_INITIALIZED; 1663 1664 kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd"); 1665 if (IS_ERR(kauditd_task)) { 1666 int err = PTR_ERR(kauditd_task); 1667 panic("audit: failed to start the kauditd thread (%d)\n", err); 1668 } 1669 1670 audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, 1671 "state=initialized audit_enabled=%u res=1", 1672 audit_enabled); 1673 1674 return 0; 1675 } 1676 postcore_initcall(audit_init); 1677 1678 /* 1679 * Process kernel command-line parameter at boot time. 1680 * audit={0|off} or audit={1|on}. 1681 */ 1682 static int __init audit_enable(char *str) 1683 { 1684 if (!strcasecmp(str, "off") || !strcmp(str, "0")) 1685 audit_default = AUDIT_OFF; 1686 else if (!strcasecmp(str, "on") || !strcmp(str, "1")) 1687 audit_default = AUDIT_ON; 1688 else { 1689 pr_err("audit: invalid 'audit' parameter value (%s)\n", str); 1690 audit_default = AUDIT_ON; 1691 } 1692 1693 if (audit_default == AUDIT_OFF) 1694 audit_initialized = AUDIT_DISABLED; 1695 if (audit_set_enabled(audit_default)) 1696 pr_err("audit: error setting audit state (%d)\n", 1697 audit_default); 1698 1699 pr_info("%s\n", audit_default ? 1700 "enabled (after initialization)" : "disabled (until reboot)"); 1701 1702 return 1; 1703 } 1704 __setup("audit=", audit_enable); 1705 1706 /* Process kernel command-line parameter at boot time. 1707 * audit_backlog_limit=<n> */ 1708 static int __init audit_backlog_limit_set(char *str) 1709 { 1710 u32 audit_backlog_limit_arg; 1711 1712 pr_info("audit_backlog_limit: "); 1713 if (kstrtouint(str, 0, &audit_backlog_limit_arg)) { 1714 pr_cont("using default of %u, unable to parse %s\n", 1715 audit_backlog_limit, str); 1716 return 1; 1717 } 1718 1719 audit_backlog_limit = audit_backlog_limit_arg; 1720 pr_cont("%d\n", audit_backlog_limit); 1721 1722 return 1; 1723 } 1724 __setup("audit_backlog_limit=", audit_backlog_limit_set); 1725 1726 static void audit_buffer_free(struct audit_buffer *ab) 1727 { 1728 if (!ab) 1729 return; 1730 1731 kfree_skb(ab->skb); 1732 kmem_cache_free(audit_buffer_cache, ab); 1733 } 1734 1735 static struct audit_buffer *audit_buffer_alloc(struct audit_context *ctx, 1736 gfp_t gfp_mask, int type) 1737 { 1738 struct audit_buffer *ab; 1739 1740 ab = kmem_cache_alloc(audit_buffer_cache, gfp_mask); 1741 if (!ab) 1742 return NULL; 1743 1744 ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask); 1745 if (!ab->skb) 1746 goto err; 1747 if (!nlmsg_put(ab->skb, 0, 0, type, 0, 0)) 1748 goto err; 1749 1750 ab->ctx = ctx; 1751 ab->gfp_mask = gfp_mask; 1752 1753 return ab; 1754 1755 err: 1756 audit_buffer_free(ab); 1757 return NULL; 1758 } 1759 1760 /** 1761 * audit_serial - compute a serial number for the audit record 1762 * 1763 * Compute a serial number for the audit record. Audit records are 1764 * written to user-space as soon as they are generated, so a complete 1765 * audit record may be written in several pieces. The timestamp of the 1766 * record and this serial number are used by the user-space tools to 1767 * determine which pieces belong to the same audit record. The 1768 * (timestamp,serial) tuple is unique for each syscall and is live from 1769 * syscall entry to syscall exit. 1770 * 1771 * NOTE: Another possibility is to store the formatted records off the 1772 * audit context (for those records that have a context), and emit them 1773 * all at syscall exit. However, this could delay the reporting of 1774 * significant errors until syscall exit (or never, if the system 1775 * halts). 1776 */ 1777 unsigned int audit_serial(void) 1778 { 1779 static atomic_t serial = ATOMIC_INIT(0); 1780 1781 return atomic_inc_return(&serial); 1782 } 1783 1784 static inline void audit_get_stamp(struct audit_context *ctx, 1785 struct timespec64 *t, unsigned int *serial) 1786 { 1787 if (!ctx || !auditsc_get_stamp(ctx, t, serial)) { 1788 ktime_get_coarse_real_ts64(t); 1789 *serial = audit_serial(); 1790 } 1791 } 1792 1793 /** 1794 * audit_log_start - obtain an audit buffer 1795 * @ctx: audit_context (may be NULL) 1796 * @gfp_mask: type of allocation 1797 * @type: audit message type 1798 * 1799 * Returns audit_buffer pointer on success or NULL on error. 1800 * 1801 * Obtain an audit buffer. This routine does locking to obtain the 1802 * audit buffer, but then no locking is required for calls to 1803 * audit_log_*format. If the task (ctx) is a task that is currently in a 1804 * syscall, then the syscall is marked as auditable and an audit record 1805 * will be written at syscall exit. If there is no associated task, then 1806 * task context (ctx) should be NULL. 1807 */ 1808 struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, 1809 int type) 1810 { 1811 struct audit_buffer *ab; 1812 struct timespec64 t; 1813 unsigned int serial; 1814 1815 if (audit_initialized != AUDIT_INITIALIZED) 1816 return NULL; 1817 1818 if (unlikely(!audit_filter(type, AUDIT_FILTER_EXCLUDE))) 1819 return NULL; 1820 1821 /* NOTE: don't ever fail/sleep on these two conditions: 1822 * 1. auditd generated record - since we need auditd to drain the 1823 * queue; also, when we are checking for auditd, compare PIDs using 1824 * task_tgid_vnr() since auditd_pid is set in audit_receive_msg() 1825 * using a PID anchored in the caller's namespace 1826 * 2. generator holding the audit_cmd_mutex - we don't want to block 1827 * while holding the mutex */ 1828 if (!(auditd_test_task(current) || audit_ctl_owner_current())) { 1829 long stime = audit_backlog_wait_time; 1830 1831 while (audit_backlog_limit && 1832 (skb_queue_len(&audit_queue) > audit_backlog_limit)) { 1833 /* wake kauditd to try and flush the queue */ 1834 wake_up_interruptible(&kauditd_wait); 1835 1836 /* sleep if we are allowed and we haven't exhausted our 1837 * backlog wait limit */ 1838 if (gfpflags_allow_blocking(gfp_mask) && (stime > 0)) { 1839 long rtime = stime; 1840 1841 DECLARE_WAITQUEUE(wait, current); 1842 1843 add_wait_queue_exclusive(&audit_backlog_wait, 1844 &wait); 1845 set_current_state(TASK_UNINTERRUPTIBLE); 1846 stime = schedule_timeout(rtime); 1847 atomic_add(rtime - stime, &audit_backlog_wait_time_actual); 1848 remove_wait_queue(&audit_backlog_wait, &wait); 1849 } else { 1850 if (audit_rate_check() && printk_ratelimit()) 1851 pr_warn("audit_backlog=%d > audit_backlog_limit=%d\n", 1852 skb_queue_len(&audit_queue), 1853 audit_backlog_limit); 1854 audit_log_lost("backlog limit exceeded"); 1855 return NULL; 1856 } 1857 } 1858 } 1859 1860 ab = audit_buffer_alloc(ctx, gfp_mask, type); 1861 if (!ab) { 1862 audit_log_lost("out of memory in audit_log_start"); 1863 return NULL; 1864 } 1865 1866 audit_get_stamp(ab->ctx, &t, &serial); 1867 /* cancel dummy context to enable supporting records */ 1868 if (ctx) 1869 ctx->dummy = 0; 1870 audit_log_format(ab, "audit(%llu.%03lu:%u): ", 1871 (unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial); 1872 1873 return ab; 1874 } 1875 1876 /** 1877 * audit_expand - expand skb in the audit buffer 1878 * @ab: audit_buffer 1879 * @extra: space to add at tail of the skb 1880 * 1881 * Returns 0 (no space) on failed expansion, or available space if 1882 * successful. 1883 */ 1884 static inline int audit_expand(struct audit_buffer *ab, int extra) 1885 { 1886 struct sk_buff *skb = ab->skb; 1887 int oldtail = skb_tailroom(skb); 1888 int ret = pskb_expand_head(skb, 0, extra, ab->gfp_mask); 1889 int newtail = skb_tailroom(skb); 1890 1891 if (ret < 0) { 1892 audit_log_lost("out of memory in audit_expand"); 1893 return 0; 1894 } 1895 1896 skb->truesize += newtail - oldtail; 1897 return newtail; 1898 } 1899 1900 /* 1901 * Format an audit message into the audit buffer. If there isn't enough 1902 * room in the audit buffer, more room will be allocated and vsnprint 1903 * will be called a second time. Currently, we assume that a printk 1904 * can't format message larger than 1024 bytes, so we don't either. 1905 */ 1906 static void audit_log_vformat(struct audit_buffer *ab, const char *fmt, 1907 va_list args) 1908 { 1909 int len, avail; 1910 struct sk_buff *skb; 1911 va_list args2; 1912 1913 if (!ab) 1914 return; 1915 1916 BUG_ON(!ab->skb); 1917 skb = ab->skb; 1918 avail = skb_tailroom(skb); 1919 if (avail == 0) { 1920 avail = audit_expand(ab, AUDIT_BUFSIZ); 1921 if (!avail) 1922 goto out; 1923 } 1924 va_copy(args2, args); 1925 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args); 1926 if (len >= avail) { 1927 /* The printk buffer is 1024 bytes long, so if we get 1928 * here and AUDIT_BUFSIZ is at least 1024, then we can 1929 * log everything that printk could have logged. */ 1930 avail = audit_expand(ab, 1931 max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail)); 1932 if (!avail) 1933 goto out_va_end; 1934 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2); 1935 } 1936 if (len > 0) 1937 skb_put(skb, len); 1938 out_va_end: 1939 va_end(args2); 1940 out: 1941 return; 1942 } 1943 1944 /** 1945 * audit_log_format - format a message into the audit buffer. 1946 * @ab: audit_buffer 1947 * @fmt: format string 1948 * @...: optional parameters matching @fmt string 1949 * 1950 * All the work is done in audit_log_vformat. 1951 */ 1952 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...) 1953 { 1954 va_list args; 1955 1956 if (!ab) 1957 return; 1958 va_start(args, fmt); 1959 audit_log_vformat(ab, fmt, args); 1960 va_end(args); 1961 } 1962 1963 /** 1964 * audit_log_n_hex - convert a buffer to hex and append it to the audit skb 1965 * @ab: the audit_buffer 1966 * @buf: buffer to convert to hex 1967 * @len: length of @buf to be converted 1968 * 1969 * No return value; failure to expand is silently ignored. 1970 * 1971 * This function will take the passed buf and convert it into a string of 1972 * ascii hex digits. The new string is placed onto the skb. 1973 */ 1974 void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf, 1975 size_t len) 1976 { 1977 int i, avail, new_len; 1978 unsigned char *ptr; 1979 struct sk_buff *skb; 1980 1981 if (!ab) 1982 return; 1983 1984 BUG_ON(!ab->skb); 1985 skb = ab->skb; 1986 avail = skb_tailroom(skb); 1987 new_len = len<<1; 1988 if (new_len >= avail) { 1989 /* Round the buffer request up to the next multiple */ 1990 new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1); 1991 avail = audit_expand(ab, new_len); 1992 if (!avail) 1993 return; 1994 } 1995 1996 ptr = skb_tail_pointer(skb); 1997 for (i = 0; i < len; i++) 1998 ptr = hex_byte_pack_upper(ptr, buf[i]); 1999 *ptr = 0; 2000 skb_put(skb, len << 1); /* new string is twice the old string */ 2001 } 2002 2003 /* 2004 * Format a string of no more than slen characters into the audit buffer, 2005 * enclosed in quote marks. 2006 */ 2007 void audit_log_n_string(struct audit_buffer *ab, const char *string, 2008 size_t slen) 2009 { 2010 int avail, new_len; 2011 unsigned char *ptr; 2012 struct sk_buff *skb; 2013 2014 if (!ab) 2015 return; 2016 2017 BUG_ON(!ab->skb); 2018 skb = ab->skb; 2019 avail = skb_tailroom(skb); 2020 new_len = slen + 3; /* enclosing quotes + null terminator */ 2021 if (new_len > avail) { 2022 avail = audit_expand(ab, new_len); 2023 if (!avail) 2024 return; 2025 } 2026 ptr = skb_tail_pointer(skb); 2027 *ptr++ = '"'; 2028 memcpy(ptr, string, slen); 2029 ptr += slen; 2030 *ptr++ = '"'; 2031 *ptr = 0; 2032 skb_put(skb, slen + 2); /* don't include null terminator */ 2033 } 2034 2035 /** 2036 * audit_string_contains_control - does a string need to be logged in hex 2037 * @string: string to be checked 2038 * @len: max length of the string to check 2039 */ 2040 bool audit_string_contains_control(const char *string, size_t len) 2041 { 2042 const unsigned char *p; 2043 for (p = string; p < (const unsigned char *)string + len; p++) { 2044 if (*p == '"' || *p < 0x21 || *p > 0x7e) 2045 return true; 2046 } 2047 return false; 2048 } 2049 2050 /** 2051 * audit_log_n_untrustedstring - log a string that may contain random characters 2052 * @ab: audit_buffer 2053 * @len: length of string (not including trailing null) 2054 * @string: string to be logged 2055 * 2056 * This code will escape a string that is passed to it if the string 2057 * contains a control character, unprintable character, double quote mark, 2058 * or a space. Unescaped strings will start and end with a double quote mark. 2059 * Strings that are escaped are printed in hex (2 digits per char). 2060 * 2061 * The caller specifies the number of characters in the string to log, which may 2062 * or may not be the entire string. 2063 */ 2064 void audit_log_n_untrustedstring(struct audit_buffer *ab, const char *string, 2065 size_t len) 2066 { 2067 if (audit_string_contains_control(string, len)) 2068 audit_log_n_hex(ab, string, len); 2069 else 2070 audit_log_n_string(ab, string, len); 2071 } 2072 2073 /** 2074 * audit_log_untrustedstring - log a string that may contain random characters 2075 * @ab: audit_buffer 2076 * @string: string to be logged 2077 * 2078 * Same as audit_log_n_untrustedstring(), except that strlen is used to 2079 * determine string length. 2080 */ 2081 void audit_log_untrustedstring(struct audit_buffer *ab, const char *string) 2082 { 2083 audit_log_n_untrustedstring(ab, string, strlen(string)); 2084 } 2085 2086 /* This is a helper-function to print the escaped d_path */ 2087 void audit_log_d_path(struct audit_buffer *ab, const char *prefix, 2088 const struct path *path) 2089 { 2090 char *p, *pathname; 2091 2092 if (prefix) 2093 audit_log_format(ab, "%s", prefix); 2094 2095 /* We will allow 11 spaces for ' (deleted)' to be appended */ 2096 pathname = kmalloc(PATH_MAX+11, ab->gfp_mask); 2097 if (!pathname) { 2098 audit_log_format(ab, "\"<no_memory>\""); 2099 return; 2100 } 2101 p = d_path(path, pathname, PATH_MAX+11); 2102 if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */ 2103 /* FIXME: can we save some information here? */ 2104 audit_log_format(ab, "\"<too_long>\""); 2105 } else 2106 audit_log_untrustedstring(ab, p); 2107 kfree(pathname); 2108 } 2109 2110 void audit_log_session_info(struct audit_buffer *ab) 2111 { 2112 unsigned int sessionid = audit_get_sessionid(current); 2113 uid_t auid = from_kuid(&init_user_ns, audit_get_loginuid(current)); 2114 2115 audit_log_format(ab, "auid=%u ses=%u", auid, sessionid); 2116 } 2117 2118 void audit_log_key(struct audit_buffer *ab, char *key) 2119 { 2120 audit_log_format(ab, " key="); 2121 if (key) 2122 audit_log_untrustedstring(ab, key); 2123 else 2124 audit_log_format(ab, "(null)"); 2125 } 2126 2127 int audit_log_task_context(struct audit_buffer *ab) 2128 { 2129 char *ctx = NULL; 2130 unsigned len; 2131 int error; 2132 u32 sid; 2133 2134 security_task_getsecid_subj(current, &sid); 2135 if (!sid) 2136 return 0; 2137 2138 error = security_secid_to_secctx(sid, &ctx, &len); 2139 if (error) { 2140 if (error != -EINVAL) 2141 goto error_path; 2142 return 0; 2143 } 2144 2145 audit_log_format(ab, " subj=%s", ctx); 2146 security_release_secctx(ctx, len); 2147 return 0; 2148 2149 error_path: 2150 audit_panic("error in audit_log_task_context"); 2151 return error; 2152 } 2153 EXPORT_SYMBOL(audit_log_task_context); 2154 2155 void audit_log_d_path_exe(struct audit_buffer *ab, 2156 struct mm_struct *mm) 2157 { 2158 struct file *exe_file; 2159 2160 if (!mm) 2161 goto out_null; 2162 2163 exe_file = get_mm_exe_file(mm); 2164 if (!exe_file) 2165 goto out_null; 2166 2167 audit_log_d_path(ab, " exe=", &exe_file->f_path); 2168 fput(exe_file); 2169 return; 2170 out_null: 2171 audit_log_format(ab, " exe=(null)"); 2172 } 2173 2174 struct tty_struct *audit_get_tty(void) 2175 { 2176 struct tty_struct *tty = NULL; 2177 unsigned long flags; 2178 2179 spin_lock_irqsave(¤t->sighand->siglock, flags); 2180 if (current->signal) 2181 tty = tty_kref_get(current->signal->tty); 2182 spin_unlock_irqrestore(¤t->sighand->siglock, flags); 2183 return tty; 2184 } 2185 2186 void audit_put_tty(struct tty_struct *tty) 2187 { 2188 tty_kref_put(tty); 2189 } 2190 2191 void audit_log_task_info(struct audit_buffer *ab) 2192 { 2193 const struct cred *cred; 2194 char comm[sizeof(current->comm)]; 2195 struct tty_struct *tty; 2196 2197 if (!ab) 2198 return; 2199 2200 cred = current_cred(); 2201 tty = audit_get_tty(); 2202 audit_log_format(ab, 2203 " ppid=%d pid=%d auid=%u uid=%u gid=%u" 2204 " euid=%u suid=%u fsuid=%u" 2205 " egid=%u sgid=%u fsgid=%u tty=%s ses=%u", 2206 task_ppid_nr(current), 2207 task_tgid_nr(current), 2208 from_kuid(&init_user_ns, audit_get_loginuid(current)), 2209 from_kuid(&init_user_ns, cred->uid), 2210 from_kgid(&init_user_ns, cred->gid), 2211 from_kuid(&init_user_ns, cred->euid), 2212 from_kuid(&init_user_ns, cred->suid), 2213 from_kuid(&init_user_ns, cred->fsuid), 2214 from_kgid(&init_user_ns, cred->egid), 2215 from_kgid(&init_user_ns, cred->sgid), 2216 from_kgid(&init_user_ns, cred->fsgid), 2217 tty ? tty_name(tty) : "(none)", 2218 audit_get_sessionid(current)); 2219 audit_put_tty(tty); 2220 audit_log_format(ab, " comm="); 2221 audit_log_untrustedstring(ab, get_task_comm(comm, current)); 2222 audit_log_d_path_exe(ab, current->mm); 2223 audit_log_task_context(ab); 2224 } 2225 EXPORT_SYMBOL(audit_log_task_info); 2226 2227 /** 2228 * audit_log_path_denied - report a path restriction denial 2229 * @type: audit message type (AUDIT_ANOM_LINK, AUDIT_ANOM_CREAT, etc) 2230 * @operation: specific operation name 2231 */ 2232 void audit_log_path_denied(int type, const char *operation) 2233 { 2234 struct audit_buffer *ab; 2235 2236 if (!audit_enabled || audit_dummy_context()) 2237 return; 2238 2239 /* Generate log with subject, operation, outcome. */ 2240 ab = audit_log_start(audit_context(), GFP_KERNEL, type); 2241 if (!ab) 2242 return; 2243 audit_log_format(ab, "op=%s", operation); 2244 audit_log_task_info(ab); 2245 audit_log_format(ab, " res=0"); 2246 audit_log_end(ab); 2247 } 2248 2249 /* global counter which is incremented every time something logs in */ 2250 static atomic_t session_id = ATOMIC_INIT(0); 2251 2252 static int audit_set_loginuid_perm(kuid_t loginuid) 2253 { 2254 /* if we are unset, we don't need privs */ 2255 if (!audit_loginuid_set(current)) 2256 return 0; 2257 /* if AUDIT_FEATURE_LOGINUID_IMMUTABLE means never ever allow a change*/ 2258 if (is_audit_feature_set(AUDIT_FEATURE_LOGINUID_IMMUTABLE)) 2259 return -EPERM; 2260 /* it is set, you need permission */ 2261 if (!capable(CAP_AUDIT_CONTROL)) 2262 return -EPERM; 2263 /* reject if this is not an unset and we don't allow that */ 2264 if (is_audit_feature_set(AUDIT_FEATURE_ONLY_UNSET_LOGINUID) 2265 && uid_valid(loginuid)) 2266 return -EPERM; 2267 return 0; 2268 } 2269 2270 static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid, 2271 unsigned int oldsessionid, 2272 unsigned int sessionid, int rc) 2273 { 2274 struct audit_buffer *ab; 2275 uid_t uid, oldloginuid, loginuid; 2276 struct tty_struct *tty; 2277 2278 if (!audit_enabled) 2279 return; 2280 2281 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_LOGIN); 2282 if (!ab) 2283 return; 2284 2285 uid = from_kuid(&init_user_ns, task_uid(current)); 2286 oldloginuid = from_kuid(&init_user_ns, koldloginuid); 2287 loginuid = from_kuid(&init_user_ns, kloginuid); 2288 tty = audit_get_tty(); 2289 2290 audit_log_format(ab, "pid=%d uid=%u", task_tgid_nr(current), uid); 2291 audit_log_task_context(ab); 2292 audit_log_format(ab, " old-auid=%u auid=%u tty=%s old-ses=%u ses=%u res=%d", 2293 oldloginuid, loginuid, tty ? tty_name(tty) : "(none)", 2294 oldsessionid, sessionid, !rc); 2295 audit_put_tty(tty); 2296 audit_log_end(ab); 2297 } 2298 2299 /** 2300 * audit_set_loginuid - set current task's loginuid 2301 * @loginuid: loginuid value 2302 * 2303 * Returns 0. 2304 * 2305 * Called (set) from fs/proc/base.c::proc_loginuid_write(). 2306 */ 2307 int audit_set_loginuid(kuid_t loginuid) 2308 { 2309 unsigned int oldsessionid, sessionid = AUDIT_SID_UNSET; 2310 kuid_t oldloginuid; 2311 int rc; 2312 2313 oldloginuid = audit_get_loginuid(current); 2314 oldsessionid = audit_get_sessionid(current); 2315 2316 rc = audit_set_loginuid_perm(loginuid); 2317 if (rc) 2318 goto out; 2319 2320 /* are we setting or clearing? */ 2321 if (uid_valid(loginuid)) { 2322 sessionid = (unsigned int)atomic_inc_return(&session_id); 2323 if (unlikely(sessionid == AUDIT_SID_UNSET)) 2324 sessionid = (unsigned int)atomic_inc_return(&session_id); 2325 } 2326 2327 current->sessionid = sessionid; 2328 current->loginuid = loginuid; 2329 out: 2330 audit_log_set_loginuid(oldloginuid, loginuid, oldsessionid, sessionid, rc); 2331 return rc; 2332 } 2333 2334 /** 2335 * audit_signal_info - record signal info for shutting down audit subsystem 2336 * @sig: signal value 2337 * @t: task being signaled 2338 * 2339 * If the audit subsystem is being terminated, record the task (pid) 2340 * and uid that is doing that. 2341 */ 2342 int audit_signal_info(int sig, struct task_struct *t) 2343 { 2344 kuid_t uid = current_uid(), auid; 2345 2346 if (auditd_test_task(t) && 2347 (sig == SIGTERM || sig == SIGHUP || 2348 sig == SIGUSR1 || sig == SIGUSR2)) { 2349 audit_sig_pid = task_tgid_nr(current); 2350 auid = audit_get_loginuid(current); 2351 if (uid_valid(auid)) 2352 audit_sig_uid = auid; 2353 else 2354 audit_sig_uid = uid; 2355 security_task_getsecid_subj(current, &audit_sig_sid); 2356 } 2357 2358 return audit_signal_info_syscall(t); 2359 } 2360 2361 /** 2362 * audit_log_end - end one audit record 2363 * @ab: the audit_buffer 2364 * 2365 * We can not do a netlink send inside an irq context because it blocks (last 2366 * arg, flags, is not set to MSG_DONTWAIT), so the audit buffer is placed on a 2367 * queue and a kthread is scheduled to remove them from the queue outside the 2368 * irq context. May be called in any context. 2369 */ 2370 void audit_log_end(struct audit_buffer *ab) 2371 { 2372 struct sk_buff *skb; 2373 struct nlmsghdr *nlh; 2374 2375 if (!ab) 2376 return; 2377 2378 if (audit_rate_check()) { 2379 skb = ab->skb; 2380 ab->skb = NULL; 2381 2382 /* setup the netlink header, see the comments in 2383 * kauditd_send_multicast_skb() for length quirks */ 2384 nlh = nlmsg_hdr(skb); 2385 nlh->nlmsg_len = skb->len - NLMSG_HDRLEN; 2386 2387 /* queue the netlink packet and poke the kauditd thread */ 2388 skb_queue_tail(&audit_queue, skb); 2389 wake_up_interruptible(&kauditd_wait); 2390 } else 2391 audit_log_lost("rate limit exceeded"); 2392 2393 audit_buffer_free(ab); 2394 } 2395 2396 /** 2397 * audit_log - Log an audit record 2398 * @ctx: audit context 2399 * @gfp_mask: type of allocation 2400 * @type: audit message type 2401 * @fmt: format string to use 2402 * @...: variable parameters matching the format string 2403 * 2404 * This is a convenience function that calls audit_log_start, 2405 * audit_log_vformat, and audit_log_end. It may be called 2406 * in any context. 2407 */ 2408 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 2409 const char *fmt, ...) 2410 { 2411 struct audit_buffer *ab; 2412 va_list args; 2413 2414 ab = audit_log_start(ctx, gfp_mask, type); 2415 if (ab) { 2416 va_start(args, fmt); 2417 audit_log_vformat(ab, fmt, args); 2418 va_end(args); 2419 audit_log_end(ab); 2420 } 2421 } 2422 2423 EXPORT_SYMBOL(audit_log_start); 2424 EXPORT_SYMBOL(audit_log_end); 2425 EXPORT_SYMBOL(audit_log_format); 2426 EXPORT_SYMBOL(audit_log); 2427