xref: /openbmc/linux/kernel/auditsc.c (revision d9565bf4)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* auditsc.c -- System-call auditing support
3  * Handles all system-call specific auditing features.
4  *
5  * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
6  * Copyright 2005 Hewlett-Packard Development Company, L.P.
7  * Copyright (C) 2005, 2006 IBM Corporation
8  * All Rights Reserved.
9  *
10  * Written by Rickard E. (Rik) Faith <faith@redhat.com>
11  *
12  * Many of the ideas implemented here are from Stephen C. Tweedie,
13  * especially the idea of avoiding a copy by using getname.
14  *
15  * The method for actual interception of syscall entry and exit (not in
16  * this file -- see entry.S) is based on a GPL'd patch written by
17  * okir@suse.de and Copyright 2003 SuSE Linux AG.
18  *
19  * POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>,
20  * 2006.
21  *
22  * The support of additional filter rules compares (>, <, >=, <=) was
23  * added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005.
24  *
25  * Modified by Amy Griffis <amy.griffis@hp.com> to collect additional
26  * filesystem information.
27  *
28  * Subject and object context labeling support added by <danjones@us.ibm.com>
29  * and <dustin.kirkland@us.ibm.com> for LSPP certification compliance.
30  */
31 
32 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
33 
34 #include <linux/init.h>
35 #include <asm/types.h>
36 #include <linux/atomic.h>
37 #include <linux/fs.h>
38 #include <linux/namei.h>
39 #include <linux/mm.h>
40 #include <linux/export.h>
41 #include <linux/slab.h>
42 #include <linux/mount.h>
43 #include <linux/socket.h>
44 #include <linux/mqueue.h>
45 #include <linux/audit.h>
46 #include <linux/personality.h>
47 #include <linux/time.h>
48 #include <linux/netlink.h>
49 #include <linux/compiler.h>
50 #include <asm/unistd.h>
51 #include <linux/security.h>
52 #include <linux/list.h>
53 #include <linux/binfmts.h>
54 #include <linux/highmem.h>
55 #include <linux/syscalls.h>
56 #include <asm/syscall.h>
57 #include <linux/capability.h>
58 #include <linux/fs_struct.h>
59 #include <linux/compat.h>
60 #include <linux/ctype.h>
61 #include <linux/string.h>
62 #include <linux/uaccess.h>
63 #include <linux/fsnotify_backend.h>
64 #include <uapi/linux/limits.h>
65 #include <uapi/linux/netfilter/nf_tables.h>
66 #include <uapi/linux/openat2.h> // struct open_how
67 
68 #include "audit.h"
69 
70 /* flags stating the success for a syscall */
71 #define AUDITSC_INVALID 0
72 #define AUDITSC_SUCCESS 1
73 #define AUDITSC_FAILURE 2
74 
75 /* no execve audit message should be longer than this (userspace limits),
76  * see the note near the top of audit_log_execve_info() about this value */
77 #define MAX_EXECVE_AUDIT_LEN 7500
78 
79 /* max length to print of cmdline/proctitle value during audit */
80 #define MAX_PROCTITLE_AUDIT_LEN 128
81 
82 /* number of audit rules */
83 int audit_n_rules;
84 
85 /* determines whether we collect data for signals sent */
86 int audit_signals;
87 
88 struct audit_aux_data {
89 	struct audit_aux_data	*next;
90 	int			type;
91 };
92 
93 /* Number of target pids per aux struct. */
94 #define AUDIT_AUX_PIDS	16
95 
96 struct audit_aux_data_pids {
97 	struct audit_aux_data	d;
98 	pid_t			target_pid[AUDIT_AUX_PIDS];
99 	kuid_t			target_auid[AUDIT_AUX_PIDS];
100 	kuid_t			target_uid[AUDIT_AUX_PIDS];
101 	unsigned int		target_sessionid[AUDIT_AUX_PIDS];
102 	u32			target_sid[AUDIT_AUX_PIDS];
103 	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
104 	int			pid_count;
105 };
106 
107 struct audit_aux_data_bprm_fcaps {
108 	struct audit_aux_data	d;
109 	struct audit_cap_data	fcap;
110 	unsigned int		fcap_ver;
111 	struct audit_cap_data	old_pcap;
112 	struct audit_cap_data	new_pcap;
113 };
114 
115 struct audit_tree_refs {
116 	struct audit_tree_refs *next;
117 	struct audit_chunk *c[31];
118 };
119 
120 struct audit_nfcfgop_tab {
121 	enum audit_nfcfgop	op;
122 	const char		*s;
123 };
124 
125 static const struct audit_nfcfgop_tab audit_nfcfgs[] = {
126 	{ AUDIT_XT_OP_REGISTER,			"xt_register"		   },
127 	{ AUDIT_XT_OP_REPLACE,			"xt_replace"		   },
128 	{ AUDIT_XT_OP_UNREGISTER,		"xt_unregister"		   },
129 	{ AUDIT_NFT_OP_TABLE_REGISTER,		"nft_register_table"	   },
130 	{ AUDIT_NFT_OP_TABLE_UNREGISTER,	"nft_unregister_table"	   },
131 	{ AUDIT_NFT_OP_CHAIN_REGISTER,		"nft_register_chain"	   },
132 	{ AUDIT_NFT_OP_CHAIN_UNREGISTER,	"nft_unregister_chain"	   },
133 	{ AUDIT_NFT_OP_RULE_REGISTER,		"nft_register_rule"	   },
134 	{ AUDIT_NFT_OP_RULE_UNREGISTER,		"nft_unregister_rule"	   },
135 	{ AUDIT_NFT_OP_SET_REGISTER,		"nft_register_set"	   },
136 	{ AUDIT_NFT_OP_SET_UNREGISTER,		"nft_unregister_set"	   },
137 	{ AUDIT_NFT_OP_SETELEM_REGISTER,	"nft_register_setelem"	   },
138 	{ AUDIT_NFT_OP_SETELEM_UNREGISTER,	"nft_unregister_setelem"   },
139 	{ AUDIT_NFT_OP_GEN_REGISTER,		"nft_register_gen"	   },
140 	{ AUDIT_NFT_OP_OBJ_REGISTER,		"nft_register_obj"	   },
141 	{ AUDIT_NFT_OP_OBJ_UNREGISTER,		"nft_unregister_obj"	   },
142 	{ AUDIT_NFT_OP_OBJ_RESET,		"nft_reset_obj"		   },
143 	{ AUDIT_NFT_OP_FLOWTABLE_REGISTER,	"nft_register_flowtable"   },
144 	{ AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,	"nft_unregister_flowtable" },
145 	{ AUDIT_NFT_OP_INVALID,			"nft_invalid"		   },
146 };
147 
148 static int audit_match_perm(struct audit_context *ctx, int mask)
149 {
150 	unsigned n;
151 
152 	if (unlikely(!ctx))
153 		return 0;
154 	n = ctx->major;
155 
156 	switch (audit_classify_syscall(ctx->arch, n)) {
157 	case AUDITSC_NATIVE:
158 		if ((mask & AUDIT_PERM_WRITE) &&
159 		     audit_match_class(AUDIT_CLASS_WRITE, n))
160 			return 1;
161 		if ((mask & AUDIT_PERM_READ) &&
162 		     audit_match_class(AUDIT_CLASS_READ, n))
163 			return 1;
164 		if ((mask & AUDIT_PERM_ATTR) &&
165 		     audit_match_class(AUDIT_CLASS_CHATTR, n))
166 			return 1;
167 		return 0;
168 	case AUDITSC_COMPAT: /* 32bit on biarch */
169 		if ((mask & AUDIT_PERM_WRITE) &&
170 		     audit_match_class(AUDIT_CLASS_WRITE_32, n))
171 			return 1;
172 		if ((mask & AUDIT_PERM_READ) &&
173 		     audit_match_class(AUDIT_CLASS_READ_32, n))
174 			return 1;
175 		if ((mask & AUDIT_PERM_ATTR) &&
176 		     audit_match_class(AUDIT_CLASS_CHATTR_32, n))
177 			return 1;
178 		return 0;
179 	case AUDITSC_OPEN:
180 		return mask & ACC_MODE(ctx->argv[1]);
181 	case AUDITSC_OPENAT:
182 		return mask & ACC_MODE(ctx->argv[2]);
183 	case AUDITSC_SOCKETCALL:
184 		return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);
185 	case AUDITSC_EXECVE:
186 		return mask & AUDIT_PERM_EXEC;
187 	case AUDITSC_OPENAT2:
188 		return mask & ACC_MODE((u32)((struct open_how *)ctx->argv[2])->flags);
189 	default:
190 		return 0;
191 	}
192 }
193 
194 static int audit_match_filetype(struct audit_context *ctx, int val)
195 {
196 	struct audit_names *n;
197 	umode_t mode = (umode_t)val;
198 
199 	if (unlikely(!ctx))
200 		return 0;
201 
202 	list_for_each_entry(n, &ctx->names_list, list) {
203 		if ((n->ino != AUDIT_INO_UNSET) &&
204 		    ((n->mode & S_IFMT) == mode))
205 			return 1;
206 	}
207 
208 	return 0;
209 }
210 
211 /*
212  * We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *;
213  * ->first_trees points to its beginning, ->trees - to the current end of data.
214  * ->tree_count is the number of free entries in array pointed to by ->trees.
215  * Original condition is (NULL, NULL, 0); as soon as it grows we never revert to NULL,
216  * "empty" becomes (p, p, 31) afterwards.  We don't shrink the list (and seriously,
217  * it's going to remain 1-element for almost any setup) until we free context itself.
218  * References in it _are_ dropped - at the same time we free/drop aux stuff.
219  */
220 
221 static void audit_set_auditable(struct audit_context *ctx)
222 {
223 	if (!ctx->prio) {
224 		ctx->prio = 1;
225 		ctx->current_state = AUDIT_STATE_RECORD;
226 	}
227 }
228 
229 static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk)
230 {
231 	struct audit_tree_refs *p = ctx->trees;
232 	int left = ctx->tree_count;
233 
234 	if (likely(left)) {
235 		p->c[--left] = chunk;
236 		ctx->tree_count = left;
237 		return 1;
238 	}
239 	if (!p)
240 		return 0;
241 	p = p->next;
242 	if (p) {
243 		p->c[30] = chunk;
244 		ctx->trees = p;
245 		ctx->tree_count = 30;
246 		return 1;
247 	}
248 	return 0;
249 }
250 
251 static int grow_tree_refs(struct audit_context *ctx)
252 {
253 	struct audit_tree_refs *p = ctx->trees;
254 
255 	ctx->trees = kzalloc(sizeof(struct audit_tree_refs), GFP_KERNEL);
256 	if (!ctx->trees) {
257 		ctx->trees = p;
258 		return 0;
259 	}
260 	if (p)
261 		p->next = ctx->trees;
262 	else
263 		ctx->first_trees = ctx->trees;
264 	ctx->tree_count = 31;
265 	return 1;
266 }
267 
268 static void unroll_tree_refs(struct audit_context *ctx,
269 		      struct audit_tree_refs *p, int count)
270 {
271 	struct audit_tree_refs *q;
272 	int n;
273 
274 	if (!p) {
275 		/* we started with empty chain */
276 		p = ctx->first_trees;
277 		count = 31;
278 		/* if the very first allocation has failed, nothing to do */
279 		if (!p)
280 			return;
281 	}
282 	n = count;
283 	for (q = p; q != ctx->trees; q = q->next, n = 31) {
284 		while (n--) {
285 			audit_put_chunk(q->c[n]);
286 			q->c[n] = NULL;
287 		}
288 	}
289 	while (n-- > ctx->tree_count) {
290 		audit_put_chunk(q->c[n]);
291 		q->c[n] = NULL;
292 	}
293 	ctx->trees = p;
294 	ctx->tree_count = count;
295 }
296 
297 static void free_tree_refs(struct audit_context *ctx)
298 {
299 	struct audit_tree_refs *p, *q;
300 
301 	for (p = ctx->first_trees; p; p = q) {
302 		q = p->next;
303 		kfree(p);
304 	}
305 }
306 
307 static int match_tree_refs(struct audit_context *ctx, struct audit_tree *tree)
308 {
309 	struct audit_tree_refs *p;
310 	int n;
311 
312 	if (!tree)
313 		return 0;
314 	/* full ones */
315 	for (p = ctx->first_trees; p != ctx->trees; p = p->next) {
316 		for (n = 0; n < 31; n++)
317 			if (audit_tree_match(p->c[n], tree))
318 				return 1;
319 	}
320 	/* partial */
321 	if (p) {
322 		for (n = ctx->tree_count; n < 31; n++)
323 			if (audit_tree_match(p->c[n], tree))
324 				return 1;
325 	}
326 	return 0;
327 }
328 
329 static int audit_compare_uid(kuid_t uid,
330 			     struct audit_names *name,
331 			     struct audit_field *f,
332 			     struct audit_context *ctx)
333 {
334 	struct audit_names *n;
335 	int rc;
336 
337 	if (name) {
338 		rc = audit_uid_comparator(uid, f->op, name->uid);
339 		if (rc)
340 			return rc;
341 	}
342 
343 	if (ctx) {
344 		list_for_each_entry(n, &ctx->names_list, list) {
345 			rc = audit_uid_comparator(uid, f->op, n->uid);
346 			if (rc)
347 				return rc;
348 		}
349 	}
350 	return 0;
351 }
352 
353 static int audit_compare_gid(kgid_t gid,
354 			     struct audit_names *name,
355 			     struct audit_field *f,
356 			     struct audit_context *ctx)
357 {
358 	struct audit_names *n;
359 	int rc;
360 
361 	if (name) {
362 		rc = audit_gid_comparator(gid, f->op, name->gid);
363 		if (rc)
364 			return rc;
365 	}
366 
367 	if (ctx) {
368 		list_for_each_entry(n, &ctx->names_list, list) {
369 			rc = audit_gid_comparator(gid, f->op, n->gid);
370 			if (rc)
371 				return rc;
372 		}
373 	}
374 	return 0;
375 }
376 
377 static int audit_field_compare(struct task_struct *tsk,
378 			       const struct cred *cred,
379 			       struct audit_field *f,
380 			       struct audit_context *ctx,
381 			       struct audit_names *name)
382 {
383 	switch (f->val) {
384 	/* process to file object comparisons */
385 	case AUDIT_COMPARE_UID_TO_OBJ_UID:
386 		return audit_compare_uid(cred->uid, name, f, ctx);
387 	case AUDIT_COMPARE_GID_TO_OBJ_GID:
388 		return audit_compare_gid(cred->gid, name, f, ctx);
389 	case AUDIT_COMPARE_EUID_TO_OBJ_UID:
390 		return audit_compare_uid(cred->euid, name, f, ctx);
391 	case AUDIT_COMPARE_EGID_TO_OBJ_GID:
392 		return audit_compare_gid(cred->egid, name, f, ctx);
393 	case AUDIT_COMPARE_AUID_TO_OBJ_UID:
394 		return audit_compare_uid(audit_get_loginuid(tsk), name, f, ctx);
395 	case AUDIT_COMPARE_SUID_TO_OBJ_UID:
396 		return audit_compare_uid(cred->suid, name, f, ctx);
397 	case AUDIT_COMPARE_SGID_TO_OBJ_GID:
398 		return audit_compare_gid(cred->sgid, name, f, ctx);
399 	case AUDIT_COMPARE_FSUID_TO_OBJ_UID:
400 		return audit_compare_uid(cred->fsuid, name, f, ctx);
401 	case AUDIT_COMPARE_FSGID_TO_OBJ_GID:
402 		return audit_compare_gid(cred->fsgid, name, f, ctx);
403 	/* uid comparisons */
404 	case AUDIT_COMPARE_UID_TO_AUID:
405 		return audit_uid_comparator(cred->uid, f->op,
406 					    audit_get_loginuid(tsk));
407 	case AUDIT_COMPARE_UID_TO_EUID:
408 		return audit_uid_comparator(cred->uid, f->op, cred->euid);
409 	case AUDIT_COMPARE_UID_TO_SUID:
410 		return audit_uid_comparator(cred->uid, f->op, cred->suid);
411 	case AUDIT_COMPARE_UID_TO_FSUID:
412 		return audit_uid_comparator(cred->uid, f->op, cred->fsuid);
413 	/* auid comparisons */
414 	case AUDIT_COMPARE_AUID_TO_EUID:
415 		return audit_uid_comparator(audit_get_loginuid(tsk), f->op,
416 					    cred->euid);
417 	case AUDIT_COMPARE_AUID_TO_SUID:
418 		return audit_uid_comparator(audit_get_loginuid(tsk), f->op,
419 					    cred->suid);
420 	case AUDIT_COMPARE_AUID_TO_FSUID:
421 		return audit_uid_comparator(audit_get_loginuid(tsk), f->op,
422 					    cred->fsuid);
423 	/* euid comparisons */
424 	case AUDIT_COMPARE_EUID_TO_SUID:
425 		return audit_uid_comparator(cred->euid, f->op, cred->suid);
426 	case AUDIT_COMPARE_EUID_TO_FSUID:
427 		return audit_uid_comparator(cred->euid, f->op, cred->fsuid);
428 	/* suid comparisons */
429 	case AUDIT_COMPARE_SUID_TO_FSUID:
430 		return audit_uid_comparator(cred->suid, f->op, cred->fsuid);
431 	/* gid comparisons */
432 	case AUDIT_COMPARE_GID_TO_EGID:
433 		return audit_gid_comparator(cred->gid, f->op, cred->egid);
434 	case AUDIT_COMPARE_GID_TO_SGID:
435 		return audit_gid_comparator(cred->gid, f->op, cred->sgid);
436 	case AUDIT_COMPARE_GID_TO_FSGID:
437 		return audit_gid_comparator(cred->gid, f->op, cred->fsgid);
438 	/* egid comparisons */
439 	case AUDIT_COMPARE_EGID_TO_SGID:
440 		return audit_gid_comparator(cred->egid, f->op, cred->sgid);
441 	case AUDIT_COMPARE_EGID_TO_FSGID:
442 		return audit_gid_comparator(cred->egid, f->op, cred->fsgid);
443 	/* sgid comparison */
444 	case AUDIT_COMPARE_SGID_TO_FSGID:
445 		return audit_gid_comparator(cred->sgid, f->op, cred->fsgid);
446 	default:
447 		WARN(1, "Missing AUDIT_COMPARE define.  Report as a bug\n");
448 		return 0;
449 	}
450 	return 0;
451 }
452 
453 /* Determine if any context name data matches a rule's watch data */
454 /* Compare a task_struct with an audit_rule.  Return 1 on match, 0
455  * otherwise.
456  *
457  * If task_creation is true, this is an explicit indication that we are
458  * filtering a task rule at task creation time.  This and tsk == current are
459  * the only situations where tsk->cred may be accessed without an rcu read lock.
460  */
461 static int audit_filter_rules(struct task_struct *tsk,
462 			      struct audit_krule *rule,
463 			      struct audit_context *ctx,
464 			      struct audit_names *name,
465 			      enum audit_state *state,
466 			      bool task_creation)
467 {
468 	const struct cred *cred;
469 	int i, need_sid = 1;
470 	u32 sid;
471 	unsigned int sessionid;
472 
473 	if (ctx && rule->prio <= ctx->prio)
474 		return 0;
475 
476 	cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation);
477 
478 	for (i = 0; i < rule->field_count; i++) {
479 		struct audit_field *f = &rule->fields[i];
480 		struct audit_names *n;
481 		int result = 0;
482 		pid_t pid;
483 
484 		switch (f->type) {
485 		case AUDIT_PID:
486 			pid = task_tgid_nr(tsk);
487 			result = audit_comparator(pid, f->op, f->val);
488 			break;
489 		case AUDIT_PPID:
490 			if (ctx) {
491 				if (!ctx->ppid)
492 					ctx->ppid = task_ppid_nr(tsk);
493 				result = audit_comparator(ctx->ppid, f->op, f->val);
494 			}
495 			break;
496 		case AUDIT_EXE:
497 			result = audit_exe_compare(tsk, rule->exe);
498 			if (f->op == Audit_not_equal)
499 				result = !result;
500 			break;
501 		case AUDIT_UID:
502 			result = audit_uid_comparator(cred->uid, f->op, f->uid);
503 			break;
504 		case AUDIT_EUID:
505 			result = audit_uid_comparator(cred->euid, f->op, f->uid);
506 			break;
507 		case AUDIT_SUID:
508 			result = audit_uid_comparator(cred->suid, f->op, f->uid);
509 			break;
510 		case AUDIT_FSUID:
511 			result = audit_uid_comparator(cred->fsuid, f->op, f->uid);
512 			break;
513 		case AUDIT_GID:
514 			result = audit_gid_comparator(cred->gid, f->op, f->gid);
515 			if (f->op == Audit_equal) {
516 				if (!result)
517 					result = groups_search(cred->group_info, f->gid);
518 			} else if (f->op == Audit_not_equal) {
519 				if (result)
520 					result = !groups_search(cred->group_info, f->gid);
521 			}
522 			break;
523 		case AUDIT_EGID:
524 			result = audit_gid_comparator(cred->egid, f->op, f->gid);
525 			if (f->op == Audit_equal) {
526 				if (!result)
527 					result = groups_search(cred->group_info, f->gid);
528 			} else if (f->op == Audit_not_equal) {
529 				if (result)
530 					result = !groups_search(cred->group_info, f->gid);
531 			}
532 			break;
533 		case AUDIT_SGID:
534 			result = audit_gid_comparator(cred->sgid, f->op, f->gid);
535 			break;
536 		case AUDIT_FSGID:
537 			result = audit_gid_comparator(cred->fsgid, f->op, f->gid);
538 			break;
539 		case AUDIT_SESSIONID:
540 			sessionid = audit_get_sessionid(tsk);
541 			result = audit_comparator(sessionid, f->op, f->val);
542 			break;
543 		case AUDIT_PERS:
544 			result = audit_comparator(tsk->personality, f->op, f->val);
545 			break;
546 		case AUDIT_ARCH:
547 			if (ctx)
548 				result = audit_comparator(ctx->arch, f->op, f->val);
549 			break;
550 
551 		case AUDIT_EXIT:
552 			if (ctx && ctx->return_valid != AUDITSC_INVALID)
553 				result = audit_comparator(ctx->return_code, f->op, f->val);
554 			break;
555 		case AUDIT_SUCCESS:
556 			if (ctx && ctx->return_valid != AUDITSC_INVALID) {
557 				if (f->val)
558 					result = audit_comparator(ctx->return_valid, f->op, AUDITSC_SUCCESS);
559 				else
560 					result = audit_comparator(ctx->return_valid, f->op, AUDITSC_FAILURE);
561 			}
562 			break;
563 		case AUDIT_DEVMAJOR:
564 			if (name) {
565 				if (audit_comparator(MAJOR(name->dev), f->op, f->val) ||
566 				    audit_comparator(MAJOR(name->rdev), f->op, f->val))
567 					++result;
568 			} else if (ctx) {
569 				list_for_each_entry(n, &ctx->names_list, list) {
570 					if (audit_comparator(MAJOR(n->dev), f->op, f->val) ||
571 					    audit_comparator(MAJOR(n->rdev), f->op, f->val)) {
572 						++result;
573 						break;
574 					}
575 				}
576 			}
577 			break;
578 		case AUDIT_DEVMINOR:
579 			if (name) {
580 				if (audit_comparator(MINOR(name->dev), f->op, f->val) ||
581 				    audit_comparator(MINOR(name->rdev), f->op, f->val))
582 					++result;
583 			} else if (ctx) {
584 				list_for_each_entry(n, &ctx->names_list, list) {
585 					if (audit_comparator(MINOR(n->dev), f->op, f->val) ||
586 					    audit_comparator(MINOR(n->rdev), f->op, f->val)) {
587 						++result;
588 						break;
589 					}
590 				}
591 			}
592 			break;
593 		case AUDIT_INODE:
594 			if (name)
595 				result = audit_comparator(name->ino, f->op, f->val);
596 			else if (ctx) {
597 				list_for_each_entry(n, &ctx->names_list, list) {
598 					if (audit_comparator(n->ino, f->op, f->val)) {
599 						++result;
600 						break;
601 					}
602 				}
603 			}
604 			break;
605 		case AUDIT_OBJ_UID:
606 			if (name) {
607 				result = audit_uid_comparator(name->uid, f->op, f->uid);
608 			} else if (ctx) {
609 				list_for_each_entry(n, &ctx->names_list, list) {
610 					if (audit_uid_comparator(n->uid, f->op, f->uid)) {
611 						++result;
612 						break;
613 					}
614 				}
615 			}
616 			break;
617 		case AUDIT_OBJ_GID:
618 			if (name) {
619 				result = audit_gid_comparator(name->gid, f->op, f->gid);
620 			} else if (ctx) {
621 				list_for_each_entry(n, &ctx->names_list, list) {
622 					if (audit_gid_comparator(n->gid, f->op, f->gid)) {
623 						++result;
624 						break;
625 					}
626 				}
627 			}
628 			break;
629 		case AUDIT_WATCH:
630 			if (name) {
631 				result = audit_watch_compare(rule->watch,
632 							     name->ino,
633 							     name->dev);
634 				if (f->op == Audit_not_equal)
635 					result = !result;
636 			}
637 			break;
638 		case AUDIT_DIR:
639 			if (ctx) {
640 				result = match_tree_refs(ctx, rule->tree);
641 				if (f->op == Audit_not_equal)
642 					result = !result;
643 			}
644 			break;
645 		case AUDIT_LOGINUID:
646 			result = audit_uid_comparator(audit_get_loginuid(tsk),
647 						      f->op, f->uid);
648 			break;
649 		case AUDIT_LOGINUID_SET:
650 			result = audit_comparator(audit_loginuid_set(tsk), f->op, f->val);
651 			break;
652 		case AUDIT_SADDR_FAM:
653 			if (ctx && ctx->sockaddr)
654 				result = audit_comparator(ctx->sockaddr->ss_family,
655 							  f->op, f->val);
656 			break;
657 		case AUDIT_SUBJ_USER:
658 		case AUDIT_SUBJ_ROLE:
659 		case AUDIT_SUBJ_TYPE:
660 		case AUDIT_SUBJ_SEN:
661 		case AUDIT_SUBJ_CLR:
662 			/* NOTE: this may return negative values indicating
663 			   a temporary error.  We simply treat this as a
664 			   match for now to avoid losing information that
665 			   may be wanted.   An error message will also be
666 			   logged upon error */
667 			if (f->lsm_rule) {
668 				if (need_sid) {
669 					/* @tsk should always be equal to
670 					 * @current with the exception of
671 					 * fork()/copy_process() in which case
672 					 * the new @tsk creds are still a dup
673 					 * of @current's creds so we can still
674 					 * use security_current_getsecid_subj()
675 					 * here even though it always refs
676 					 * @current's creds
677 					 */
678 					security_current_getsecid_subj(&sid);
679 					need_sid = 0;
680 				}
681 				result = security_audit_rule_match(sid, f->type,
682 								   f->op,
683 								   f->lsm_rule);
684 			}
685 			break;
686 		case AUDIT_OBJ_USER:
687 		case AUDIT_OBJ_ROLE:
688 		case AUDIT_OBJ_TYPE:
689 		case AUDIT_OBJ_LEV_LOW:
690 		case AUDIT_OBJ_LEV_HIGH:
691 			/* The above note for AUDIT_SUBJ_USER...AUDIT_SUBJ_CLR
692 			   also applies here */
693 			if (f->lsm_rule) {
694 				/* Find files that match */
695 				if (name) {
696 					result = security_audit_rule_match(
697 								name->osid,
698 								f->type,
699 								f->op,
700 								f->lsm_rule);
701 				} else if (ctx) {
702 					list_for_each_entry(n, &ctx->names_list, list) {
703 						if (security_audit_rule_match(
704 								n->osid,
705 								f->type,
706 								f->op,
707 								f->lsm_rule)) {
708 							++result;
709 							break;
710 						}
711 					}
712 				}
713 				/* Find ipc objects that match */
714 				if (!ctx || ctx->type != AUDIT_IPC)
715 					break;
716 				if (security_audit_rule_match(ctx->ipc.osid,
717 							      f->type, f->op,
718 							      f->lsm_rule))
719 					++result;
720 			}
721 			break;
722 		case AUDIT_ARG0:
723 		case AUDIT_ARG1:
724 		case AUDIT_ARG2:
725 		case AUDIT_ARG3:
726 			if (ctx)
727 				result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
728 			break;
729 		case AUDIT_FILTERKEY:
730 			/* ignore this field for filtering */
731 			result = 1;
732 			break;
733 		case AUDIT_PERM:
734 			result = audit_match_perm(ctx, f->val);
735 			if (f->op == Audit_not_equal)
736 				result = !result;
737 			break;
738 		case AUDIT_FILETYPE:
739 			result = audit_match_filetype(ctx, f->val);
740 			if (f->op == Audit_not_equal)
741 				result = !result;
742 			break;
743 		case AUDIT_FIELD_COMPARE:
744 			result = audit_field_compare(tsk, cred, f, ctx, name);
745 			break;
746 		}
747 		if (!result)
748 			return 0;
749 	}
750 
751 	if (ctx) {
752 		if (rule->filterkey) {
753 			kfree(ctx->filterkey);
754 			ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
755 		}
756 		ctx->prio = rule->prio;
757 	}
758 	switch (rule->action) {
759 	case AUDIT_NEVER:
760 		*state = AUDIT_STATE_DISABLED;
761 		break;
762 	case AUDIT_ALWAYS:
763 		*state = AUDIT_STATE_RECORD;
764 		break;
765 	}
766 	return 1;
767 }
768 
769 /* At process creation time, we can determine if system-call auditing is
770  * completely disabled for this task.  Since we only have the task
771  * structure at this point, we can only check uid and gid.
772  */
773 static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
774 {
775 	struct audit_entry *e;
776 	enum audit_state   state;
777 
778 	rcu_read_lock();
779 	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
780 		if (audit_filter_rules(tsk, &e->rule, NULL, NULL,
781 				       &state, true)) {
782 			if (state == AUDIT_STATE_RECORD)
783 				*key = kstrdup(e->rule.filterkey, GFP_ATOMIC);
784 			rcu_read_unlock();
785 			return state;
786 		}
787 	}
788 	rcu_read_unlock();
789 	return AUDIT_STATE_BUILD;
790 }
791 
792 static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
793 {
794 	int word, bit;
795 
796 	if (val > 0xffffffff)
797 		return false;
798 
799 	word = AUDIT_WORD(val);
800 	if (word >= AUDIT_BITMASK_SIZE)
801 		return false;
802 
803 	bit = AUDIT_BIT(val);
804 
805 	return rule->mask[word] & bit;
806 }
807 
808 /**
809  * audit_filter_uring - apply filters to an io_uring operation
810  * @tsk: associated task
811  * @ctx: audit context
812  */
813 static void audit_filter_uring(struct task_struct *tsk,
814 			       struct audit_context *ctx)
815 {
816 	struct audit_entry *e;
817 	enum audit_state state;
818 
819 	if (auditd_test_task(tsk))
820 		return;
821 
822 	rcu_read_lock();
823 	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_URING_EXIT],
824 				list) {
825 		if (audit_in_mask(&e->rule, ctx->uring_op) &&
826 		    audit_filter_rules(tsk, &e->rule, ctx, NULL, &state,
827 				       false)) {
828 			rcu_read_unlock();
829 			ctx->current_state = state;
830 			return;
831 		}
832 	}
833 	rcu_read_unlock();
834 }
835 
836 /* At syscall exit time, this filter is called if the audit_state is
837  * not low enough that auditing cannot take place, but is also not
838  * high enough that we already know we have to write an audit record
839  * (i.e., the state is AUDIT_STATE_BUILD).
840  */
841 static void audit_filter_syscall(struct task_struct *tsk,
842 				 struct audit_context *ctx)
843 {
844 	struct audit_entry *e;
845 	enum audit_state state;
846 
847 	if (auditd_test_task(tsk))
848 		return;
849 
850 	rcu_read_lock();
851 	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_EXIT], list) {
852 		if (audit_in_mask(&e->rule, ctx->major) &&
853 		    audit_filter_rules(tsk, &e->rule, ctx, NULL,
854 				       &state, false)) {
855 			rcu_read_unlock();
856 			ctx->current_state = state;
857 			return;
858 		}
859 	}
860 	rcu_read_unlock();
861 	return;
862 }
863 
864 /*
865  * Given an audit_name check the inode hash table to see if they match.
866  * Called holding the rcu read lock to protect the use of audit_inode_hash
867  */
868 static int audit_filter_inode_name(struct task_struct *tsk,
869 				   struct audit_names *n,
870 				   struct audit_context *ctx) {
871 	int h = audit_hash_ino((u32)n->ino);
872 	struct list_head *list = &audit_inode_hash[h];
873 	struct audit_entry *e;
874 	enum audit_state state;
875 
876 	list_for_each_entry_rcu(e, list, list) {
877 		if (audit_in_mask(&e->rule, ctx->major) &&
878 		    audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
879 			ctx->current_state = state;
880 			return 1;
881 		}
882 	}
883 	return 0;
884 }
885 
886 /* At syscall exit time, this filter is called if any audit_names have been
887  * collected during syscall processing.  We only check rules in sublists at hash
888  * buckets applicable to the inode numbers in audit_names.
889  * Regarding audit_state, same rules apply as for audit_filter_syscall().
890  */
891 void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx)
892 {
893 	struct audit_names *n;
894 
895 	if (auditd_test_task(tsk))
896 		return;
897 
898 	rcu_read_lock();
899 
900 	list_for_each_entry(n, &ctx->names_list, list) {
901 		if (audit_filter_inode_name(tsk, n, ctx))
902 			break;
903 	}
904 	rcu_read_unlock();
905 }
906 
907 static inline void audit_proctitle_free(struct audit_context *context)
908 {
909 	kfree(context->proctitle.value);
910 	context->proctitle.value = NULL;
911 	context->proctitle.len = 0;
912 }
913 
914 static inline void audit_free_module(struct audit_context *context)
915 {
916 	if (context->type == AUDIT_KERN_MODULE) {
917 		kfree(context->module.name);
918 		context->module.name = NULL;
919 	}
920 }
921 static inline void audit_free_names(struct audit_context *context)
922 {
923 	struct audit_names *n, *next;
924 
925 	list_for_each_entry_safe(n, next, &context->names_list, list) {
926 		list_del(&n->list);
927 		if (n->name)
928 			putname(n->name);
929 		if (n->should_free)
930 			kfree(n);
931 	}
932 	context->name_count = 0;
933 	path_put(&context->pwd);
934 	context->pwd.dentry = NULL;
935 	context->pwd.mnt = NULL;
936 }
937 
938 static inline void audit_free_aux(struct audit_context *context)
939 {
940 	struct audit_aux_data *aux;
941 
942 	while ((aux = context->aux)) {
943 		context->aux = aux->next;
944 		kfree(aux);
945 	}
946 	context->aux = NULL;
947 	while ((aux = context->aux_pids)) {
948 		context->aux_pids = aux->next;
949 		kfree(aux);
950 	}
951 	context->aux_pids = NULL;
952 }
953 
954 /**
955  * audit_reset_context - reset a audit_context structure
956  * @ctx: the audit_context to reset
957  *
958  * All fields in the audit_context will be reset to an initial state, all
959  * references held by fields will be dropped, and private memory will be
960  * released.  When this function returns the audit_context will be suitable
961  * for reuse, so long as the passed context is not NULL or a dummy context.
962  */
963 static void audit_reset_context(struct audit_context *ctx)
964 {
965 	if (!ctx)
966 		return;
967 
968 	/* if ctx is non-null, reset the "ctx->state" regardless */
969 	ctx->context = AUDIT_CTX_UNUSED;
970 	if (ctx->dummy)
971 		return;
972 
973 	/*
974 	 * NOTE: It shouldn't matter in what order we release the fields, so
975 	 *       release them in the order in which they appear in the struct;
976 	 *       this gives us some hope of quickly making sure we are
977 	 *       resetting the audit_context properly.
978 	 *
979 	 *       Other things worth mentioning:
980 	 *       - we don't reset "dummy"
981 	 *       - we don't reset "state", we do reset "current_state"
982 	 *       - we preserve "filterkey" if "state" is AUDIT_STATE_RECORD
983 	 *       - much of this is likely overkill, but play it safe for now
984 	 *       - we really need to work on improving the audit_context struct
985 	 */
986 
987 	ctx->current_state = ctx->state;
988 	ctx->serial = 0;
989 	ctx->major = 0;
990 	ctx->uring_op = 0;
991 	ctx->ctime = (struct timespec64){ .tv_sec = 0, .tv_nsec = 0 };
992 	memset(ctx->argv, 0, sizeof(ctx->argv));
993 	ctx->return_code = 0;
994 	ctx->prio = (ctx->state == AUDIT_STATE_RECORD ? ~0ULL : 0);
995 	ctx->return_valid = AUDITSC_INVALID;
996 	audit_free_names(ctx);
997 	if (ctx->state != AUDIT_STATE_RECORD) {
998 		kfree(ctx->filterkey);
999 		ctx->filterkey = NULL;
1000 	}
1001 	audit_free_aux(ctx);
1002 	kfree(ctx->sockaddr);
1003 	ctx->sockaddr = NULL;
1004 	ctx->sockaddr_len = 0;
1005 	ctx->pid = ctx->ppid = 0;
1006 	ctx->uid = ctx->euid = ctx->suid = ctx->fsuid = KUIDT_INIT(0);
1007 	ctx->gid = ctx->egid = ctx->sgid = ctx->fsgid = KGIDT_INIT(0);
1008 	ctx->personality = 0;
1009 	ctx->arch = 0;
1010 	ctx->target_pid = 0;
1011 	ctx->target_auid = ctx->target_uid = KUIDT_INIT(0);
1012 	ctx->target_sessionid = 0;
1013 	ctx->target_sid = 0;
1014 	ctx->target_comm[0] = '\0';
1015 	unroll_tree_refs(ctx, NULL, 0);
1016 	WARN_ON(!list_empty(&ctx->killed_trees));
1017 	ctx->type = 0;
1018 	audit_free_module(ctx);
1019 	ctx->fds[0] = -1;
1020 	audit_proctitle_free(ctx);
1021 }
1022 
1023 static inline struct audit_context *audit_alloc_context(enum audit_state state)
1024 {
1025 	struct audit_context *context;
1026 
1027 	context = kzalloc(sizeof(*context), GFP_KERNEL);
1028 	if (!context)
1029 		return NULL;
1030 	context->context = AUDIT_CTX_UNUSED;
1031 	context->state = state;
1032 	context->prio = state == AUDIT_STATE_RECORD ? ~0ULL : 0;
1033 	INIT_LIST_HEAD(&context->killed_trees);
1034 	INIT_LIST_HEAD(&context->names_list);
1035 	context->fds[0] = -1;
1036 	context->return_valid = AUDITSC_INVALID;
1037 	return context;
1038 }
1039 
1040 /**
1041  * audit_alloc - allocate an audit context block for a task
1042  * @tsk: task
1043  *
1044  * Filter on the task information and allocate a per-task audit context
1045  * if necessary.  Doing so turns on system call auditing for the
1046  * specified task.  This is called from copy_process, so no lock is
1047  * needed.
1048  */
1049 int audit_alloc(struct task_struct *tsk)
1050 {
1051 	struct audit_context *context;
1052 	enum audit_state     state;
1053 	char *key = NULL;
1054 
1055 	if (likely(!audit_ever_enabled))
1056 		return 0;
1057 
1058 	state = audit_filter_task(tsk, &key);
1059 	if (state == AUDIT_STATE_DISABLED) {
1060 		clear_task_syscall_work(tsk, SYSCALL_AUDIT);
1061 		return 0;
1062 	}
1063 
1064 	if (!(context = audit_alloc_context(state))) {
1065 		kfree(key);
1066 		audit_log_lost("out of memory in audit_alloc");
1067 		return -ENOMEM;
1068 	}
1069 	context->filterkey = key;
1070 
1071 	audit_set_context(tsk, context);
1072 	set_task_syscall_work(tsk, SYSCALL_AUDIT);
1073 	return 0;
1074 }
1075 
1076 /**
1077  * audit_alloc_kernel - allocate an audit_context for a kernel task
1078  * @tsk: the kernel task
1079  *
1080  * Similar to the audit_alloc() function, but intended for kernel private
1081  * threads.  Returns zero on success, negative values on failure.
1082  */
1083 int audit_alloc_kernel(struct task_struct *tsk)
1084 {
1085 	/*
1086 	 * At the moment we are just going to call into audit_alloc() to
1087 	 * simplify the code, but there two things to keep in mind with this
1088 	 * approach:
1089 	 *
1090 	 * 1. Filtering internal kernel tasks is a bit laughable in almost all
1091 	 * cases, but there is at least one case where there is a benefit:
1092 	 * the '-a task,never' case allows the admin to effectively disable
1093 	 * task auditing at runtime.
1094 	 *
1095 	 * 2. The {set,clear}_task_syscall_work() ops likely have zero effect
1096 	 * on these internal kernel tasks, but they probably don't hurt either.
1097 	 */
1098 	return audit_alloc(tsk);
1099 }
1100 
1101 static inline void audit_free_context(struct audit_context *context)
1102 {
1103 	/* resetting is extra work, but it is likely just noise */
1104 	audit_reset_context(context);
1105 	free_tree_refs(context);
1106 	kfree(context->filterkey);
1107 	kfree(context);
1108 }
1109 
1110 static int audit_log_pid_context(struct audit_context *context, pid_t pid,
1111 				 kuid_t auid, kuid_t uid, unsigned int sessionid,
1112 				 u32 sid, char *comm)
1113 {
1114 	struct audit_buffer *ab;
1115 	char *ctx = NULL;
1116 	u32 len;
1117 	int rc = 0;
1118 
1119 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
1120 	if (!ab)
1121 		return rc;
1122 
1123 	audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid,
1124 			 from_kuid(&init_user_ns, auid),
1125 			 from_kuid(&init_user_ns, uid), sessionid);
1126 	if (sid) {
1127 		if (security_secid_to_secctx(sid, &ctx, &len)) {
1128 			audit_log_format(ab, " obj=(none)");
1129 			rc = 1;
1130 		} else {
1131 			audit_log_format(ab, " obj=%s", ctx);
1132 			security_release_secctx(ctx, len);
1133 		}
1134 	}
1135 	audit_log_format(ab, " ocomm=");
1136 	audit_log_untrustedstring(ab, comm);
1137 	audit_log_end(ab);
1138 
1139 	return rc;
1140 }
1141 
1142 static void audit_log_execve_info(struct audit_context *context,
1143 				  struct audit_buffer **ab)
1144 {
1145 	long len_max;
1146 	long len_rem;
1147 	long len_full;
1148 	long len_buf;
1149 	long len_abuf = 0;
1150 	long len_tmp;
1151 	bool require_data;
1152 	bool encode;
1153 	unsigned int iter;
1154 	unsigned int arg;
1155 	char *buf_head;
1156 	char *buf;
1157 	const char __user *p = (const char __user *)current->mm->arg_start;
1158 
1159 	/* NOTE: this buffer needs to be large enough to hold all the non-arg
1160 	 *       data we put in the audit record for this argument (see the
1161 	 *       code below) ... at this point in time 96 is plenty */
1162 	char abuf[96];
1163 
1164 	/* NOTE: we set MAX_EXECVE_AUDIT_LEN to a rather arbitrary limit, the
1165 	 *       current value of 7500 is not as important as the fact that it
1166 	 *       is less than 8k, a setting of 7500 gives us plenty of wiggle
1167 	 *       room if we go over a little bit in the logging below */
1168 	WARN_ON_ONCE(MAX_EXECVE_AUDIT_LEN > 7500);
1169 	len_max = MAX_EXECVE_AUDIT_LEN;
1170 
1171 	/* scratch buffer to hold the userspace args */
1172 	buf_head = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
1173 	if (!buf_head) {
1174 		audit_panic("out of memory for argv string");
1175 		return;
1176 	}
1177 	buf = buf_head;
1178 
1179 	audit_log_format(*ab, "argc=%d", context->execve.argc);
1180 
1181 	len_rem = len_max;
1182 	len_buf = 0;
1183 	len_full = 0;
1184 	require_data = true;
1185 	encode = false;
1186 	iter = 0;
1187 	arg = 0;
1188 	do {
1189 		/* NOTE: we don't ever want to trust this value for anything
1190 		 *       serious, but the audit record format insists we
1191 		 *       provide an argument length for really long arguments,
1192 		 *       e.g. > MAX_EXECVE_AUDIT_LEN, so we have no choice but
1193 		 *       to use strncpy_from_user() to obtain this value for
1194 		 *       recording in the log, although we don't use it
1195 		 *       anywhere here to avoid a double-fetch problem */
1196 		if (len_full == 0)
1197 			len_full = strnlen_user(p, MAX_ARG_STRLEN) - 1;
1198 
1199 		/* read more data from userspace */
1200 		if (require_data) {
1201 			/* can we make more room in the buffer? */
1202 			if (buf != buf_head) {
1203 				memmove(buf_head, buf, len_buf);
1204 				buf = buf_head;
1205 			}
1206 
1207 			/* fetch as much as we can of the argument */
1208 			len_tmp = strncpy_from_user(&buf_head[len_buf], p,
1209 						    len_max - len_buf);
1210 			if (len_tmp == -EFAULT) {
1211 				/* unable to copy from userspace */
1212 				send_sig(SIGKILL, current, 0);
1213 				goto out;
1214 			} else if (len_tmp == (len_max - len_buf)) {
1215 				/* buffer is not large enough */
1216 				require_data = true;
1217 				/* NOTE: if we are going to span multiple
1218 				 *       buffers force the encoding so we stand
1219 				 *       a chance at a sane len_full value and
1220 				 *       consistent record encoding */
1221 				encode = true;
1222 				len_full = len_full * 2;
1223 				p += len_tmp;
1224 			} else {
1225 				require_data = false;
1226 				if (!encode)
1227 					encode = audit_string_contains_control(
1228 								buf, len_tmp);
1229 				/* try to use a trusted value for len_full */
1230 				if (len_full < len_max)
1231 					len_full = (encode ?
1232 						    len_tmp * 2 : len_tmp);
1233 				p += len_tmp + 1;
1234 			}
1235 			len_buf += len_tmp;
1236 			buf_head[len_buf] = '\0';
1237 
1238 			/* length of the buffer in the audit record? */
1239 			len_abuf = (encode ? len_buf * 2 : len_buf + 2);
1240 		}
1241 
1242 		/* write as much as we can to the audit log */
1243 		if (len_buf >= 0) {
1244 			/* NOTE: some magic numbers here - basically if we
1245 			 *       can't fit a reasonable amount of data into the
1246 			 *       existing audit buffer, flush it and start with
1247 			 *       a new buffer */
1248 			if ((sizeof(abuf) + 8) > len_rem) {
1249 				len_rem = len_max;
1250 				audit_log_end(*ab);
1251 				*ab = audit_log_start(context,
1252 						      GFP_KERNEL, AUDIT_EXECVE);
1253 				if (!*ab)
1254 					goto out;
1255 			}
1256 
1257 			/* create the non-arg portion of the arg record */
1258 			len_tmp = 0;
1259 			if (require_data || (iter > 0) ||
1260 			    ((len_abuf + sizeof(abuf)) > len_rem)) {
1261 				if (iter == 0) {
1262 					len_tmp += snprintf(&abuf[len_tmp],
1263 							sizeof(abuf) - len_tmp,
1264 							" a%d_len=%lu",
1265 							arg, len_full);
1266 				}
1267 				len_tmp += snprintf(&abuf[len_tmp],
1268 						    sizeof(abuf) - len_tmp,
1269 						    " a%d[%d]=", arg, iter++);
1270 			} else
1271 				len_tmp += snprintf(&abuf[len_tmp],
1272 						    sizeof(abuf) - len_tmp,
1273 						    " a%d=", arg);
1274 			WARN_ON(len_tmp >= sizeof(abuf));
1275 			abuf[sizeof(abuf) - 1] = '\0';
1276 
1277 			/* log the arg in the audit record */
1278 			audit_log_format(*ab, "%s", abuf);
1279 			len_rem -= len_tmp;
1280 			len_tmp = len_buf;
1281 			if (encode) {
1282 				if (len_abuf > len_rem)
1283 					len_tmp = len_rem / 2; /* encoding */
1284 				audit_log_n_hex(*ab, buf, len_tmp);
1285 				len_rem -= len_tmp * 2;
1286 				len_abuf -= len_tmp * 2;
1287 			} else {
1288 				if (len_abuf > len_rem)
1289 					len_tmp = len_rem - 2; /* quotes */
1290 				audit_log_n_string(*ab, buf, len_tmp);
1291 				len_rem -= len_tmp + 2;
1292 				/* don't subtract the "2" because we still need
1293 				 * to add quotes to the remaining string */
1294 				len_abuf -= len_tmp;
1295 			}
1296 			len_buf -= len_tmp;
1297 			buf += len_tmp;
1298 		}
1299 
1300 		/* ready to move to the next argument? */
1301 		if ((len_buf == 0) && !require_data) {
1302 			arg++;
1303 			iter = 0;
1304 			len_full = 0;
1305 			require_data = true;
1306 			encode = false;
1307 		}
1308 	} while (arg < context->execve.argc);
1309 
1310 	/* NOTE: the caller handles the final audit_log_end() call */
1311 
1312 out:
1313 	kfree(buf_head);
1314 }
1315 
1316 static void audit_log_cap(struct audit_buffer *ab, char *prefix,
1317 			  kernel_cap_t *cap)
1318 {
1319 	int i;
1320 
1321 	if (cap_isclear(*cap)) {
1322 		audit_log_format(ab, " %s=0", prefix);
1323 		return;
1324 	}
1325 	audit_log_format(ab, " %s=", prefix);
1326 	CAP_FOR_EACH_U32(i)
1327 		audit_log_format(ab, "%08x", cap->cap[CAP_LAST_U32 - i]);
1328 }
1329 
1330 static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
1331 {
1332 	if (name->fcap_ver == -1) {
1333 		audit_log_format(ab, " cap_fe=? cap_fver=? cap_fp=? cap_fi=?");
1334 		return;
1335 	}
1336 	audit_log_cap(ab, "cap_fp", &name->fcap.permitted);
1337 	audit_log_cap(ab, "cap_fi", &name->fcap.inheritable);
1338 	audit_log_format(ab, " cap_fe=%d cap_fver=%x cap_frootid=%d",
1339 			 name->fcap.fE, name->fcap_ver,
1340 			 from_kuid(&init_user_ns, name->fcap.rootid));
1341 }
1342 
1343 static void show_special(struct audit_context *context, int *call_panic)
1344 {
1345 	struct audit_buffer *ab;
1346 	int i;
1347 
1348 	ab = audit_log_start(context, GFP_KERNEL, context->type);
1349 	if (!ab)
1350 		return;
1351 
1352 	switch (context->type) {
1353 	case AUDIT_SOCKETCALL: {
1354 		int nargs = context->socketcall.nargs;
1355 
1356 		audit_log_format(ab, "nargs=%d", nargs);
1357 		for (i = 0; i < nargs; i++)
1358 			audit_log_format(ab, " a%d=%lx", i,
1359 				context->socketcall.args[i]);
1360 		break; }
1361 	case AUDIT_IPC: {
1362 		u32 osid = context->ipc.osid;
1363 
1364 		audit_log_format(ab, "ouid=%u ogid=%u mode=%#ho",
1365 				 from_kuid(&init_user_ns, context->ipc.uid),
1366 				 from_kgid(&init_user_ns, context->ipc.gid),
1367 				 context->ipc.mode);
1368 		if (osid) {
1369 			char *ctx = NULL;
1370 			u32 len;
1371 
1372 			if (security_secid_to_secctx(osid, &ctx, &len)) {
1373 				audit_log_format(ab, " osid=%u", osid);
1374 				*call_panic = 1;
1375 			} else {
1376 				audit_log_format(ab, " obj=%s", ctx);
1377 				security_release_secctx(ctx, len);
1378 			}
1379 		}
1380 		if (context->ipc.has_perm) {
1381 			audit_log_end(ab);
1382 			ab = audit_log_start(context, GFP_KERNEL,
1383 					     AUDIT_IPC_SET_PERM);
1384 			if (unlikely(!ab))
1385 				return;
1386 			audit_log_format(ab,
1387 				"qbytes=%lx ouid=%u ogid=%u mode=%#ho",
1388 				context->ipc.qbytes,
1389 				context->ipc.perm_uid,
1390 				context->ipc.perm_gid,
1391 				context->ipc.perm_mode);
1392 		}
1393 		break; }
1394 	case AUDIT_MQ_OPEN:
1395 		audit_log_format(ab,
1396 			"oflag=0x%x mode=%#ho mq_flags=0x%lx mq_maxmsg=%ld "
1397 			"mq_msgsize=%ld mq_curmsgs=%ld",
1398 			context->mq_open.oflag, context->mq_open.mode,
1399 			context->mq_open.attr.mq_flags,
1400 			context->mq_open.attr.mq_maxmsg,
1401 			context->mq_open.attr.mq_msgsize,
1402 			context->mq_open.attr.mq_curmsgs);
1403 		break;
1404 	case AUDIT_MQ_SENDRECV:
1405 		audit_log_format(ab,
1406 			"mqdes=%d msg_len=%zd msg_prio=%u "
1407 			"abs_timeout_sec=%lld abs_timeout_nsec=%ld",
1408 			context->mq_sendrecv.mqdes,
1409 			context->mq_sendrecv.msg_len,
1410 			context->mq_sendrecv.msg_prio,
1411 			(long long) context->mq_sendrecv.abs_timeout.tv_sec,
1412 			context->mq_sendrecv.abs_timeout.tv_nsec);
1413 		break;
1414 	case AUDIT_MQ_NOTIFY:
1415 		audit_log_format(ab, "mqdes=%d sigev_signo=%d",
1416 				context->mq_notify.mqdes,
1417 				context->mq_notify.sigev_signo);
1418 		break;
1419 	case AUDIT_MQ_GETSETATTR: {
1420 		struct mq_attr *attr = &context->mq_getsetattr.mqstat;
1421 
1422 		audit_log_format(ab,
1423 			"mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
1424 			"mq_curmsgs=%ld ",
1425 			context->mq_getsetattr.mqdes,
1426 			attr->mq_flags, attr->mq_maxmsg,
1427 			attr->mq_msgsize, attr->mq_curmsgs);
1428 		break; }
1429 	case AUDIT_CAPSET:
1430 		audit_log_format(ab, "pid=%d", context->capset.pid);
1431 		audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable);
1432 		audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted);
1433 		audit_log_cap(ab, "cap_pe", &context->capset.cap.effective);
1434 		audit_log_cap(ab, "cap_pa", &context->capset.cap.ambient);
1435 		break;
1436 	case AUDIT_MMAP:
1437 		audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd,
1438 				 context->mmap.flags);
1439 		break;
1440 	case AUDIT_OPENAT2:
1441 		audit_log_format(ab, "oflag=0%llo mode=0%llo resolve=0x%llx",
1442 				 context->openat2.flags,
1443 				 context->openat2.mode,
1444 				 context->openat2.resolve);
1445 		break;
1446 	case AUDIT_EXECVE:
1447 		audit_log_execve_info(context, &ab);
1448 		break;
1449 	case AUDIT_KERN_MODULE:
1450 		audit_log_format(ab, "name=");
1451 		if (context->module.name) {
1452 			audit_log_untrustedstring(ab, context->module.name);
1453 		} else
1454 			audit_log_format(ab, "(null)");
1455 
1456 		break;
1457 	}
1458 	audit_log_end(ab);
1459 }
1460 
1461 static inline int audit_proctitle_rtrim(char *proctitle, int len)
1462 {
1463 	char *end = proctitle + len - 1;
1464 
1465 	while (end > proctitle && !isprint(*end))
1466 		end--;
1467 
1468 	/* catch the case where proctitle is only 1 non-print character */
1469 	len = end - proctitle + 1;
1470 	len -= isprint(proctitle[len-1]) == 0;
1471 	return len;
1472 }
1473 
1474 /*
1475  * audit_log_name - produce AUDIT_PATH record from struct audit_names
1476  * @context: audit_context for the task
1477  * @n: audit_names structure with reportable details
1478  * @path: optional path to report instead of audit_names->name
1479  * @record_num: record number to report when handling a list of names
1480  * @call_panic: optional pointer to int that will be updated if secid fails
1481  */
1482 static void audit_log_name(struct audit_context *context, struct audit_names *n,
1483 		    const struct path *path, int record_num, int *call_panic)
1484 {
1485 	struct audit_buffer *ab;
1486 
1487 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
1488 	if (!ab)
1489 		return;
1490 
1491 	audit_log_format(ab, "item=%d", record_num);
1492 
1493 	if (path)
1494 		audit_log_d_path(ab, " name=", path);
1495 	else if (n->name) {
1496 		switch (n->name_len) {
1497 		case AUDIT_NAME_FULL:
1498 			/* log the full path */
1499 			audit_log_format(ab, " name=");
1500 			audit_log_untrustedstring(ab, n->name->name);
1501 			break;
1502 		case 0:
1503 			/* name was specified as a relative path and the
1504 			 * directory component is the cwd
1505 			 */
1506 			if (context->pwd.dentry && context->pwd.mnt)
1507 				audit_log_d_path(ab, " name=", &context->pwd);
1508 			else
1509 				audit_log_format(ab, " name=(null)");
1510 			break;
1511 		default:
1512 			/* log the name's directory component */
1513 			audit_log_format(ab, " name=");
1514 			audit_log_n_untrustedstring(ab, n->name->name,
1515 						    n->name_len);
1516 		}
1517 	} else
1518 		audit_log_format(ab, " name=(null)");
1519 
1520 	if (n->ino != AUDIT_INO_UNSET)
1521 		audit_log_format(ab, " inode=%lu dev=%02x:%02x mode=%#ho ouid=%u ogid=%u rdev=%02x:%02x",
1522 				 n->ino,
1523 				 MAJOR(n->dev),
1524 				 MINOR(n->dev),
1525 				 n->mode,
1526 				 from_kuid(&init_user_ns, n->uid),
1527 				 from_kgid(&init_user_ns, n->gid),
1528 				 MAJOR(n->rdev),
1529 				 MINOR(n->rdev));
1530 	if (n->osid != 0) {
1531 		char *ctx = NULL;
1532 		u32 len;
1533 
1534 		if (security_secid_to_secctx(
1535 			n->osid, &ctx, &len)) {
1536 			audit_log_format(ab, " osid=%u", n->osid);
1537 			if (call_panic)
1538 				*call_panic = 2;
1539 		} else {
1540 			audit_log_format(ab, " obj=%s", ctx);
1541 			security_release_secctx(ctx, len);
1542 		}
1543 	}
1544 
1545 	/* log the audit_names record type */
1546 	switch (n->type) {
1547 	case AUDIT_TYPE_NORMAL:
1548 		audit_log_format(ab, " nametype=NORMAL");
1549 		break;
1550 	case AUDIT_TYPE_PARENT:
1551 		audit_log_format(ab, " nametype=PARENT");
1552 		break;
1553 	case AUDIT_TYPE_CHILD_DELETE:
1554 		audit_log_format(ab, " nametype=DELETE");
1555 		break;
1556 	case AUDIT_TYPE_CHILD_CREATE:
1557 		audit_log_format(ab, " nametype=CREATE");
1558 		break;
1559 	default:
1560 		audit_log_format(ab, " nametype=UNKNOWN");
1561 		break;
1562 	}
1563 
1564 	audit_log_fcaps(ab, n);
1565 	audit_log_end(ab);
1566 }
1567 
1568 static void audit_log_proctitle(void)
1569 {
1570 	int res;
1571 	char *buf;
1572 	char *msg = "(null)";
1573 	int len = strlen(msg);
1574 	struct audit_context *context = audit_context();
1575 	struct audit_buffer *ab;
1576 
1577 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE);
1578 	if (!ab)
1579 		return;	/* audit_panic or being filtered */
1580 
1581 	audit_log_format(ab, "proctitle=");
1582 
1583 	/* Not  cached */
1584 	if (!context->proctitle.value) {
1585 		buf = kmalloc(MAX_PROCTITLE_AUDIT_LEN, GFP_KERNEL);
1586 		if (!buf)
1587 			goto out;
1588 		/* Historically called this from procfs naming */
1589 		res = get_cmdline(current, buf, MAX_PROCTITLE_AUDIT_LEN);
1590 		if (res == 0) {
1591 			kfree(buf);
1592 			goto out;
1593 		}
1594 		res = audit_proctitle_rtrim(buf, res);
1595 		if (res == 0) {
1596 			kfree(buf);
1597 			goto out;
1598 		}
1599 		context->proctitle.value = buf;
1600 		context->proctitle.len = res;
1601 	}
1602 	msg = context->proctitle.value;
1603 	len = context->proctitle.len;
1604 out:
1605 	audit_log_n_untrustedstring(ab, msg, len);
1606 	audit_log_end(ab);
1607 }
1608 
1609 /**
1610  * audit_log_uring - generate a AUDIT_URINGOP record
1611  * @ctx: the audit context
1612  */
1613 static void audit_log_uring(struct audit_context *ctx)
1614 {
1615 	struct audit_buffer *ab;
1616 	const struct cred *cred;
1617 
1618 	ab = audit_log_start(ctx, GFP_ATOMIC, AUDIT_URINGOP);
1619 	if (!ab)
1620 		return;
1621 	cred = current_cred();
1622 	audit_log_format(ab, "uring_op=%d", ctx->uring_op);
1623 	if (ctx->return_valid != AUDITSC_INVALID)
1624 		audit_log_format(ab, " success=%s exit=%ld",
1625 				 (ctx->return_valid == AUDITSC_SUCCESS ?
1626 				  "yes" : "no"),
1627 				 ctx->return_code);
1628 	audit_log_format(ab,
1629 			 " items=%d"
1630 			 " ppid=%d pid=%d uid=%u gid=%u euid=%u suid=%u"
1631 			 " fsuid=%u egid=%u sgid=%u fsgid=%u",
1632 			 ctx->name_count,
1633 			 task_ppid_nr(current), task_tgid_nr(current),
1634 			 from_kuid(&init_user_ns, cred->uid),
1635 			 from_kgid(&init_user_ns, cred->gid),
1636 			 from_kuid(&init_user_ns, cred->euid),
1637 			 from_kuid(&init_user_ns, cred->suid),
1638 			 from_kuid(&init_user_ns, cred->fsuid),
1639 			 from_kgid(&init_user_ns, cred->egid),
1640 			 from_kgid(&init_user_ns, cred->sgid),
1641 			 from_kgid(&init_user_ns, cred->fsgid));
1642 	audit_log_task_context(ab);
1643 	audit_log_key(ab, ctx->filterkey);
1644 	audit_log_end(ab);
1645 }
1646 
1647 static void audit_log_exit(void)
1648 {
1649 	int i, call_panic = 0;
1650 	struct audit_context *context = audit_context();
1651 	struct audit_buffer *ab;
1652 	struct audit_aux_data *aux;
1653 	struct audit_names *n;
1654 
1655 	context->personality = current->personality;
1656 
1657 	switch (context->context) {
1658 	case AUDIT_CTX_SYSCALL:
1659 		ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
1660 		if (!ab)
1661 			return;
1662 		audit_log_format(ab, "arch=%x syscall=%d",
1663 				 context->arch, context->major);
1664 		if (context->personality != PER_LINUX)
1665 			audit_log_format(ab, " per=%lx", context->personality);
1666 		if (context->return_valid != AUDITSC_INVALID)
1667 			audit_log_format(ab, " success=%s exit=%ld",
1668 					 (context->return_valid == AUDITSC_SUCCESS ?
1669 					  "yes" : "no"),
1670 					 context->return_code);
1671 		audit_log_format(ab,
1672 				 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d",
1673 				 context->argv[0],
1674 				 context->argv[1],
1675 				 context->argv[2],
1676 				 context->argv[3],
1677 				 context->name_count);
1678 		audit_log_task_info(ab);
1679 		audit_log_key(ab, context->filterkey);
1680 		audit_log_end(ab);
1681 		break;
1682 	case AUDIT_CTX_URING:
1683 		audit_log_uring(context);
1684 		break;
1685 	default:
1686 		BUG();
1687 		break;
1688 	}
1689 
1690 	for (aux = context->aux; aux; aux = aux->next) {
1691 
1692 		ab = audit_log_start(context, GFP_KERNEL, aux->type);
1693 		if (!ab)
1694 			continue; /* audit_panic has been called */
1695 
1696 		switch (aux->type) {
1697 
1698 		case AUDIT_BPRM_FCAPS: {
1699 			struct audit_aux_data_bprm_fcaps *axs = (void *)aux;
1700 
1701 			audit_log_format(ab, "fver=%x", axs->fcap_ver);
1702 			audit_log_cap(ab, "fp", &axs->fcap.permitted);
1703 			audit_log_cap(ab, "fi", &axs->fcap.inheritable);
1704 			audit_log_format(ab, " fe=%d", axs->fcap.fE);
1705 			audit_log_cap(ab, "old_pp", &axs->old_pcap.permitted);
1706 			audit_log_cap(ab, "old_pi", &axs->old_pcap.inheritable);
1707 			audit_log_cap(ab, "old_pe", &axs->old_pcap.effective);
1708 			audit_log_cap(ab, "old_pa", &axs->old_pcap.ambient);
1709 			audit_log_cap(ab, "pp", &axs->new_pcap.permitted);
1710 			audit_log_cap(ab, "pi", &axs->new_pcap.inheritable);
1711 			audit_log_cap(ab, "pe", &axs->new_pcap.effective);
1712 			audit_log_cap(ab, "pa", &axs->new_pcap.ambient);
1713 			audit_log_format(ab, " frootid=%d",
1714 					 from_kuid(&init_user_ns,
1715 						   axs->fcap.rootid));
1716 			break; }
1717 
1718 		}
1719 		audit_log_end(ab);
1720 	}
1721 
1722 	if (context->type)
1723 		show_special(context, &call_panic);
1724 
1725 	if (context->fds[0] >= 0) {
1726 		ab = audit_log_start(context, GFP_KERNEL, AUDIT_FD_PAIR);
1727 		if (ab) {
1728 			audit_log_format(ab, "fd0=%d fd1=%d",
1729 					context->fds[0], context->fds[1]);
1730 			audit_log_end(ab);
1731 		}
1732 	}
1733 
1734 	if (context->sockaddr_len) {
1735 		ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR);
1736 		if (ab) {
1737 			audit_log_format(ab, "saddr=");
1738 			audit_log_n_hex(ab, (void *)context->sockaddr,
1739 					context->sockaddr_len);
1740 			audit_log_end(ab);
1741 		}
1742 	}
1743 
1744 	for (aux = context->aux_pids; aux; aux = aux->next) {
1745 		struct audit_aux_data_pids *axs = (void *)aux;
1746 
1747 		for (i = 0; i < axs->pid_count; i++)
1748 			if (audit_log_pid_context(context, axs->target_pid[i],
1749 						  axs->target_auid[i],
1750 						  axs->target_uid[i],
1751 						  axs->target_sessionid[i],
1752 						  axs->target_sid[i],
1753 						  axs->target_comm[i]))
1754 				call_panic = 1;
1755 	}
1756 
1757 	if (context->target_pid &&
1758 	    audit_log_pid_context(context, context->target_pid,
1759 				  context->target_auid, context->target_uid,
1760 				  context->target_sessionid,
1761 				  context->target_sid, context->target_comm))
1762 			call_panic = 1;
1763 
1764 	if (context->pwd.dentry && context->pwd.mnt) {
1765 		ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
1766 		if (ab) {
1767 			audit_log_d_path(ab, "cwd=", &context->pwd);
1768 			audit_log_end(ab);
1769 		}
1770 	}
1771 
1772 	i = 0;
1773 	list_for_each_entry(n, &context->names_list, list) {
1774 		if (n->hidden)
1775 			continue;
1776 		audit_log_name(context, n, NULL, i++, &call_panic);
1777 	}
1778 
1779 	if (context->context == AUDIT_CTX_SYSCALL)
1780 		audit_log_proctitle();
1781 
1782 	/* Send end of event record to help user space know we are finished */
1783 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
1784 	if (ab)
1785 		audit_log_end(ab);
1786 	if (call_panic)
1787 		audit_panic("error in audit_log_exit()");
1788 }
1789 
1790 /**
1791  * __audit_free - free a per-task audit context
1792  * @tsk: task whose audit context block to free
1793  *
1794  * Called from copy_process, do_exit, and the io_uring code
1795  */
1796 void __audit_free(struct task_struct *tsk)
1797 {
1798 	struct audit_context *context = tsk->audit_context;
1799 
1800 	if (!context)
1801 		return;
1802 
1803 	/* this may generate CONFIG_CHANGE records */
1804 	if (!list_empty(&context->killed_trees))
1805 		audit_kill_trees(context);
1806 
1807 	/* We are called either by do_exit() or the fork() error handling code;
1808 	 * in the former case tsk == current and in the latter tsk is a
1809 	 * random task_struct that doesn't doesn't have any meaningful data we
1810 	 * need to log via audit_log_exit().
1811 	 */
1812 	if (tsk == current && !context->dummy) {
1813 		context->return_valid = AUDITSC_INVALID;
1814 		context->return_code = 0;
1815 		if (context->context == AUDIT_CTX_SYSCALL) {
1816 			audit_filter_syscall(tsk, context);
1817 			audit_filter_inodes(tsk, context);
1818 			if (context->current_state == AUDIT_STATE_RECORD)
1819 				audit_log_exit();
1820 		} else if (context->context == AUDIT_CTX_URING) {
1821 			/* TODO: verify this case is real and valid */
1822 			audit_filter_uring(tsk, context);
1823 			audit_filter_inodes(tsk, context);
1824 			if (context->current_state == AUDIT_STATE_RECORD)
1825 				audit_log_uring(context);
1826 		}
1827 	}
1828 
1829 	audit_set_context(tsk, NULL);
1830 	audit_free_context(context);
1831 }
1832 
1833 /**
1834  * audit_return_fixup - fixup the return codes in the audit_context
1835  * @ctx: the audit_context
1836  * @success: true/false value to indicate if the operation succeeded or not
1837  * @code: operation return code
1838  *
1839  * We need to fixup the return code in the audit logs if the actual return
1840  * codes are later going to be fixed by the arch specific signal handlers.
1841  */
1842 static void audit_return_fixup(struct audit_context *ctx,
1843 			       int success, long code)
1844 {
1845 	/*
1846 	 * This is actually a test for:
1847 	 * (rc == ERESTARTSYS ) || (rc == ERESTARTNOINTR) ||
1848 	 * (rc == ERESTARTNOHAND) || (rc == ERESTART_RESTARTBLOCK)
1849 	 *
1850 	 * but is faster than a bunch of ||
1851 	 */
1852 	if (unlikely(code <= -ERESTARTSYS) &&
1853 	    (code >= -ERESTART_RESTARTBLOCK) &&
1854 	    (code != -ENOIOCTLCMD))
1855 		ctx->return_code = -EINTR;
1856 	else
1857 		ctx->return_code  = code;
1858 	ctx->return_valid = (success ? AUDITSC_SUCCESS : AUDITSC_FAILURE);
1859 }
1860 
1861 /**
1862  * __audit_uring_entry - prepare the kernel task's audit context for io_uring
1863  * @op: the io_uring opcode
1864  *
1865  * This is similar to audit_syscall_entry() but is intended for use by io_uring
1866  * operations.  This function should only ever be called from
1867  * audit_uring_entry() as we rely on the audit context checking present in that
1868  * function.
1869  */
1870 void __audit_uring_entry(u8 op)
1871 {
1872 	struct audit_context *ctx = audit_context();
1873 
1874 	if (ctx->state == AUDIT_STATE_DISABLED)
1875 		return;
1876 
1877 	/*
1878 	 * NOTE: It's possible that we can be called from the process' context
1879 	 *       before it returns to userspace, and before audit_syscall_exit()
1880 	 *       is called.  In this case there is not much to do, just record
1881 	 *       the io_uring details and return.
1882 	 */
1883 	ctx->uring_op = op;
1884 	if (ctx->context == AUDIT_CTX_SYSCALL)
1885 		return;
1886 
1887 	ctx->dummy = !audit_n_rules;
1888 	if (!ctx->dummy && ctx->state == AUDIT_STATE_BUILD)
1889 		ctx->prio = 0;
1890 
1891 	ctx->context = AUDIT_CTX_URING;
1892 	ctx->current_state = ctx->state;
1893 	ktime_get_coarse_real_ts64(&ctx->ctime);
1894 }
1895 
1896 /**
1897  * __audit_uring_exit - wrap up the kernel task's audit context after io_uring
1898  * @success: true/false value to indicate if the operation succeeded or not
1899  * @code: operation return code
1900  *
1901  * This is similar to audit_syscall_exit() but is intended for use by io_uring
1902  * operations.  This function should only ever be called from
1903  * audit_uring_exit() as we rely on the audit context checking present in that
1904  * function.
1905  */
1906 void __audit_uring_exit(int success, long code)
1907 {
1908 	struct audit_context *ctx = audit_context();
1909 
1910 	if (ctx->context == AUDIT_CTX_SYSCALL) {
1911 		/*
1912 		 * NOTE: See the note in __audit_uring_entry() about the case
1913 		 *       where we may be called from process context before we
1914 		 *       return to userspace via audit_syscall_exit().  In this
1915 		 *       case we simply emit a URINGOP record and bail, the
1916 		 *       normal syscall exit handling will take care of
1917 		 *       everything else.
1918 		 *       It is also worth mentioning that when we are called,
1919 		 *       the current process creds may differ from the creds
1920 		 *       used during the normal syscall processing; keep that
1921 		 *       in mind if/when we move the record generation code.
1922 		 */
1923 
1924 		/*
1925 		 * We need to filter on the syscall info here to decide if we
1926 		 * should emit a URINGOP record.  I know it seems odd but this
1927 		 * solves the problem where users have a filter to block *all*
1928 		 * syscall records in the "exit" filter; we want to preserve
1929 		 * the behavior here.
1930 		 */
1931 		audit_filter_syscall(current, ctx);
1932 		if (ctx->current_state != AUDIT_STATE_RECORD)
1933 			audit_filter_uring(current, ctx);
1934 		audit_filter_inodes(current, ctx);
1935 		if (ctx->current_state != AUDIT_STATE_RECORD)
1936 			return;
1937 
1938 		audit_log_uring(ctx);
1939 		return;
1940 	}
1941 
1942 	/* this may generate CONFIG_CHANGE records */
1943 	if (!list_empty(&ctx->killed_trees))
1944 		audit_kill_trees(ctx);
1945 
1946 	/* run through both filters to ensure we set the filterkey properly */
1947 	audit_filter_uring(current, ctx);
1948 	audit_filter_inodes(current, ctx);
1949 	if (ctx->current_state != AUDIT_STATE_RECORD)
1950 		goto out;
1951 	audit_return_fixup(ctx, success, code);
1952 	audit_log_exit();
1953 
1954 out:
1955 	audit_reset_context(ctx);
1956 }
1957 
1958 /**
1959  * __audit_syscall_entry - fill in an audit record at syscall entry
1960  * @major: major syscall type (function)
1961  * @a1: additional syscall register 1
1962  * @a2: additional syscall register 2
1963  * @a3: additional syscall register 3
1964  * @a4: additional syscall register 4
1965  *
1966  * Fill in audit context at syscall entry.  This only happens if the
1967  * audit context was created when the task was created and the state or
1968  * filters demand the audit context be built.  If the state from the
1969  * per-task filter or from the per-syscall filter is AUDIT_STATE_RECORD,
1970  * then the record will be written at syscall exit time (otherwise, it
1971  * will only be written if another part of the kernel requests that it
1972  * be written).
1973  */
1974 void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
1975 			   unsigned long a3, unsigned long a4)
1976 {
1977 	struct audit_context *context = audit_context();
1978 	enum audit_state     state;
1979 
1980 	if (!audit_enabled || !context)
1981 		return;
1982 
1983 	WARN_ON(context->context != AUDIT_CTX_UNUSED);
1984 	WARN_ON(context->name_count);
1985 	if (context->context != AUDIT_CTX_UNUSED || context->name_count) {
1986 		audit_panic("unrecoverable error in audit_syscall_entry()");
1987 		return;
1988 	}
1989 
1990 	state = context->state;
1991 	if (state == AUDIT_STATE_DISABLED)
1992 		return;
1993 
1994 	context->dummy = !audit_n_rules;
1995 	if (!context->dummy && state == AUDIT_STATE_BUILD) {
1996 		context->prio = 0;
1997 		if (auditd_test_task(current))
1998 			return;
1999 	}
2000 
2001 	context->arch	    = syscall_get_arch(current);
2002 	context->major      = major;
2003 	context->argv[0]    = a1;
2004 	context->argv[1]    = a2;
2005 	context->argv[2]    = a3;
2006 	context->argv[3]    = a4;
2007 	context->context = AUDIT_CTX_SYSCALL;
2008 	context->current_state  = state;
2009 	ktime_get_coarse_real_ts64(&context->ctime);
2010 }
2011 
2012 /**
2013  * __audit_syscall_exit - deallocate audit context after a system call
2014  * @success: success value of the syscall
2015  * @return_code: return value of the syscall
2016  *
2017  * Tear down after system call.  If the audit context has been marked as
2018  * auditable (either because of the AUDIT_STATE_RECORD state from
2019  * filtering, or because some other part of the kernel wrote an audit
2020  * message), then write out the syscall information.  In call cases,
2021  * free the names stored from getname().
2022  */
2023 void __audit_syscall_exit(int success, long return_code)
2024 {
2025 	struct audit_context *context = audit_context();
2026 
2027 	if (!context || context->dummy ||
2028 	    context->context != AUDIT_CTX_SYSCALL)
2029 		goto out;
2030 
2031 	/* this may generate CONFIG_CHANGE records */
2032 	if (!list_empty(&context->killed_trees))
2033 		audit_kill_trees(context);
2034 
2035 	/* run through both filters to ensure we set the filterkey properly */
2036 	audit_filter_syscall(current, context);
2037 	audit_filter_inodes(current, context);
2038 	if (context->current_state < AUDIT_STATE_RECORD)
2039 		goto out;
2040 
2041 	audit_return_fixup(context, success, return_code);
2042 	audit_log_exit();
2043 
2044 out:
2045 	audit_reset_context(context);
2046 }
2047 
2048 static inline void handle_one(const struct inode *inode)
2049 {
2050 	struct audit_context *context;
2051 	struct audit_tree_refs *p;
2052 	struct audit_chunk *chunk;
2053 	int count;
2054 
2055 	if (likely(!inode->i_fsnotify_marks))
2056 		return;
2057 	context = audit_context();
2058 	p = context->trees;
2059 	count = context->tree_count;
2060 	rcu_read_lock();
2061 	chunk = audit_tree_lookup(inode);
2062 	rcu_read_unlock();
2063 	if (!chunk)
2064 		return;
2065 	if (likely(put_tree_ref(context, chunk)))
2066 		return;
2067 	if (unlikely(!grow_tree_refs(context))) {
2068 		pr_warn("out of memory, audit has lost a tree reference\n");
2069 		audit_set_auditable(context);
2070 		audit_put_chunk(chunk);
2071 		unroll_tree_refs(context, p, count);
2072 		return;
2073 	}
2074 	put_tree_ref(context, chunk);
2075 }
2076 
2077 static void handle_path(const struct dentry *dentry)
2078 {
2079 	struct audit_context *context;
2080 	struct audit_tree_refs *p;
2081 	const struct dentry *d, *parent;
2082 	struct audit_chunk *drop;
2083 	unsigned long seq;
2084 	int count;
2085 
2086 	context = audit_context();
2087 	p = context->trees;
2088 	count = context->tree_count;
2089 retry:
2090 	drop = NULL;
2091 	d = dentry;
2092 	rcu_read_lock();
2093 	seq = read_seqbegin(&rename_lock);
2094 	for(;;) {
2095 		struct inode *inode = d_backing_inode(d);
2096 
2097 		if (inode && unlikely(inode->i_fsnotify_marks)) {
2098 			struct audit_chunk *chunk;
2099 
2100 			chunk = audit_tree_lookup(inode);
2101 			if (chunk) {
2102 				if (unlikely(!put_tree_ref(context, chunk))) {
2103 					drop = chunk;
2104 					break;
2105 				}
2106 			}
2107 		}
2108 		parent = d->d_parent;
2109 		if (parent == d)
2110 			break;
2111 		d = parent;
2112 	}
2113 	if (unlikely(read_seqretry(&rename_lock, seq) || drop)) {  /* in this order */
2114 		rcu_read_unlock();
2115 		if (!drop) {
2116 			/* just a race with rename */
2117 			unroll_tree_refs(context, p, count);
2118 			goto retry;
2119 		}
2120 		audit_put_chunk(drop);
2121 		if (grow_tree_refs(context)) {
2122 			/* OK, got more space */
2123 			unroll_tree_refs(context, p, count);
2124 			goto retry;
2125 		}
2126 		/* too bad */
2127 		pr_warn("out of memory, audit has lost a tree reference\n");
2128 		unroll_tree_refs(context, p, count);
2129 		audit_set_auditable(context);
2130 		return;
2131 	}
2132 	rcu_read_unlock();
2133 }
2134 
2135 static struct audit_names *audit_alloc_name(struct audit_context *context,
2136 						unsigned char type)
2137 {
2138 	struct audit_names *aname;
2139 
2140 	if (context->name_count < AUDIT_NAMES) {
2141 		aname = &context->preallocated_names[context->name_count];
2142 		memset(aname, 0, sizeof(*aname));
2143 	} else {
2144 		aname = kzalloc(sizeof(*aname), GFP_NOFS);
2145 		if (!aname)
2146 			return NULL;
2147 		aname->should_free = true;
2148 	}
2149 
2150 	aname->ino = AUDIT_INO_UNSET;
2151 	aname->type = type;
2152 	list_add_tail(&aname->list, &context->names_list);
2153 
2154 	context->name_count++;
2155 	if (!context->pwd.dentry)
2156 		get_fs_pwd(current->fs, &context->pwd);
2157 	return aname;
2158 }
2159 
2160 /**
2161  * __audit_reusename - fill out filename with info from existing entry
2162  * @uptr: userland ptr to pathname
2163  *
2164  * Search the audit_names list for the current audit context. If there is an
2165  * existing entry with a matching "uptr" then return the filename
2166  * associated with that audit_name. If not, return NULL.
2167  */
2168 struct filename *
2169 __audit_reusename(const __user char *uptr)
2170 {
2171 	struct audit_context *context = audit_context();
2172 	struct audit_names *n;
2173 
2174 	list_for_each_entry(n, &context->names_list, list) {
2175 		if (!n->name)
2176 			continue;
2177 		if (n->name->uptr == uptr) {
2178 			n->name->refcnt++;
2179 			return n->name;
2180 		}
2181 	}
2182 	return NULL;
2183 }
2184 
2185 /**
2186  * __audit_getname - add a name to the list
2187  * @name: name to add
2188  *
2189  * Add a name to the list of audit names for this context.
2190  * Called from fs/namei.c:getname().
2191  */
2192 void __audit_getname(struct filename *name)
2193 {
2194 	struct audit_context *context = audit_context();
2195 	struct audit_names *n;
2196 
2197 	if (context->context == AUDIT_CTX_UNUSED)
2198 		return;
2199 
2200 	n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
2201 	if (!n)
2202 		return;
2203 
2204 	n->name = name;
2205 	n->name_len = AUDIT_NAME_FULL;
2206 	name->aname = n;
2207 	name->refcnt++;
2208 }
2209 
2210 static inline int audit_copy_fcaps(struct audit_names *name,
2211 				   const struct dentry *dentry)
2212 {
2213 	struct cpu_vfs_cap_data caps;
2214 	int rc;
2215 
2216 	if (!dentry)
2217 		return 0;
2218 
2219 	rc = get_vfs_caps_from_disk(&init_user_ns, dentry, &caps);
2220 	if (rc)
2221 		return rc;
2222 
2223 	name->fcap.permitted = caps.permitted;
2224 	name->fcap.inheritable = caps.inheritable;
2225 	name->fcap.fE = !!(caps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
2226 	name->fcap.rootid = caps.rootid;
2227 	name->fcap_ver = (caps.magic_etc & VFS_CAP_REVISION_MASK) >>
2228 				VFS_CAP_REVISION_SHIFT;
2229 
2230 	return 0;
2231 }
2232 
2233 /* Copy inode data into an audit_names. */
2234 static void audit_copy_inode(struct audit_names *name,
2235 			     const struct dentry *dentry,
2236 			     struct inode *inode, unsigned int flags)
2237 {
2238 	name->ino   = inode->i_ino;
2239 	name->dev   = inode->i_sb->s_dev;
2240 	name->mode  = inode->i_mode;
2241 	name->uid   = inode->i_uid;
2242 	name->gid   = inode->i_gid;
2243 	name->rdev  = inode->i_rdev;
2244 	security_inode_getsecid(inode, &name->osid);
2245 	if (flags & AUDIT_INODE_NOEVAL) {
2246 		name->fcap_ver = -1;
2247 		return;
2248 	}
2249 	audit_copy_fcaps(name, dentry);
2250 }
2251 
2252 /**
2253  * __audit_inode - store the inode and device from a lookup
2254  * @name: name being audited
2255  * @dentry: dentry being audited
2256  * @flags: attributes for this particular entry
2257  */
2258 void __audit_inode(struct filename *name, const struct dentry *dentry,
2259 		   unsigned int flags)
2260 {
2261 	struct audit_context *context = audit_context();
2262 	struct inode *inode = d_backing_inode(dentry);
2263 	struct audit_names *n;
2264 	bool parent = flags & AUDIT_INODE_PARENT;
2265 	struct audit_entry *e;
2266 	struct list_head *list = &audit_filter_list[AUDIT_FILTER_FS];
2267 	int i;
2268 
2269 	if (context->context == AUDIT_CTX_UNUSED)
2270 		return;
2271 
2272 	rcu_read_lock();
2273 	list_for_each_entry_rcu(e, list, list) {
2274 		for (i = 0; i < e->rule.field_count; i++) {
2275 			struct audit_field *f = &e->rule.fields[i];
2276 
2277 			if (f->type == AUDIT_FSTYPE
2278 			    && audit_comparator(inode->i_sb->s_magic,
2279 						f->op, f->val)
2280 			    && e->rule.action == AUDIT_NEVER) {
2281 				rcu_read_unlock();
2282 				return;
2283 			}
2284 		}
2285 	}
2286 	rcu_read_unlock();
2287 
2288 	if (!name)
2289 		goto out_alloc;
2290 
2291 	/*
2292 	 * If we have a pointer to an audit_names entry already, then we can
2293 	 * just use it directly if the type is correct.
2294 	 */
2295 	n = name->aname;
2296 	if (n) {
2297 		if (parent) {
2298 			if (n->type == AUDIT_TYPE_PARENT ||
2299 			    n->type == AUDIT_TYPE_UNKNOWN)
2300 				goto out;
2301 		} else {
2302 			if (n->type != AUDIT_TYPE_PARENT)
2303 				goto out;
2304 		}
2305 	}
2306 
2307 	list_for_each_entry_reverse(n, &context->names_list, list) {
2308 		if (n->ino) {
2309 			/* valid inode number, use that for the comparison */
2310 			if (n->ino != inode->i_ino ||
2311 			    n->dev != inode->i_sb->s_dev)
2312 				continue;
2313 		} else if (n->name) {
2314 			/* inode number has not been set, check the name */
2315 			if (strcmp(n->name->name, name->name))
2316 				continue;
2317 		} else
2318 			/* no inode and no name (?!) ... this is odd ... */
2319 			continue;
2320 
2321 		/* match the correct record type */
2322 		if (parent) {
2323 			if (n->type == AUDIT_TYPE_PARENT ||
2324 			    n->type == AUDIT_TYPE_UNKNOWN)
2325 				goto out;
2326 		} else {
2327 			if (n->type != AUDIT_TYPE_PARENT)
2328 				goto out;
2329 		}
2330 	}
2331 
2332 out_alloc:
2333 	/* unable to find an entry with both a matching name and type */
2334 	n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
2335 	if (!n)
2336 		return;
2337 	if (name) {
2338 		n->name = name;
2339 		name->refcnt++;
2340 	}
2341 
2342 out:
2343 	if (parent) {
2344 		n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;
2345 		n->type = AUDIT_TYPE_PARENT;
2346 		if (flags & AUDIT_INODE_HIDDEN)
2347 			n->hidden = true;
2348 	} else {
2349 		n->name_len = AUDIT_NAME_FULL;
2350 		n->type = AUDIT_TYPE_NORMAL;
2351 	}
2352 	handle_path(dentry);
2353 	audit_copy_inode(n, dentry, inode, flags & AUDIT_INODE_NOEVAL);
2354 }
2355 
2356 void __audit_file(const struct file *file)
2357 {
2358 	__audit_inode(NULL, file->f_path.dentry, 0);
2359 }
2360 
2361 /**
2362  * __audit_inode_child - collect inode info for created/removed objects
2363  * @parent: inode of dentry parent
2364  * @dentry: dentry being audited
2365  * @type:   AUDIT_TYPE_* value that we're looking for
2366  *
2367  * For syscalls that create or remove filesystem objects, audit_inode
2368  * can only collect information for the filesystem object's parent.
2369  * This call updates the audit context with the child's information.
2370  * Syscalls that create a new filesystem object must be hooked after
2371  * the object is created.  Syscalls that remove a filesystem object
2372  * must be hooked prior, in order to capture the target inode during
2373  * unsuccessful attempts.
2374  */
2375 void __audit_inode_child(struct inode *parent,
2376 			 const struct dentry *dentry,
2377 			 const unsigned char type)
2378 {
2379 	struct audit_context *context = audit_context();
2380 	struct inode *inode = d_backing_inode(dentry);
2381 	const struct qstr *dname = &dentry->d_name;
2382 	struct audit_names *n, *found_parent = NULL, *found_child = NULL;
2383 	struct audit_entry *e;
2384 	struct list_head *list = &audit_filter_list[AUDIT_FILTER_FS];
2385 	int i;
2386 
2387 	if (context->context == AUDIT_CTX_UNUSED)
2388 		return;
2389 
2390 	rcu_read_lock();
2391 	list_for_each_entry_rcu(e, list, list) {
2392 		for (i = 0; i < e->rule.field_count; i++) {
2393 			struct audit_field *f = &e->rule.fields[i];
2394 
2395 			if (f->type == AUDIT_FSTYPE
2396 			    && audit_comparator(parent->i_sb->s_magic,
2397 						f->op, f->val)
2398 			    && e->rule.action == AUDIT_NEVER) {
2399 				rcu_read_unlock();
2400 				return;
2401 			}
2402 		}
2403 	}
2404 	rcu_read_unlock();
2405 
2406 	if (inode)
2407 		handle_one(inode);
2408 
2409 	/* look for a parent entry first */
2410 	list_for_each_entry(n, &context->names_list, list) {
2411 		if (!n->name ||
2412 		    (n->type != AUDIT_TYPE_PARENT &&
2413 		     n->type != AUDIT_TYPE_UNKNOWN))
2414 			continue;
2415 
2416 		if (n->ino == parent->i_ino && n->dev == parent->i_sb->s_dev &&
2417 		    !audit_compare_dname_path(dname,
2418 					      n->name->name, n->name_len)) {
2419 			if (n->type == AUDIT_TYPE_UNKNOWN)
2420 				n->type = AUDIT_TYPE_PARENT;
2421 			found_parent = n;
2422 			break;
2423 		}
2424 	}
2425 
2426 	/* is there a matching child entry? */
2427 	list_for_each_entry(n, &context->names_list, list) {
2428 		/* can only match entries that have a name */
2429 		if (!n->name ||
2430 		    (n->type != type && n->type != AUDIT_TYPE_UNKNOWN))
2431 			continue;
2432 
2433 		if (!strcmp(dname->name, n->name->name) ||
2434 		    !audit_compare_dname_path(dname, n->name->name,
2435 						found_parent ?
2436 						found_parent->name_len :
2437 						AUDIT_NAME_FULL)) {
2438 			if (n->type == AUDIT_TYPE_UNKNOWN)
2439 				n->type = type;
2440 			found_child = n;
2441 			break;
2442 		}
2443 	}
2444 
2445 	if (!found_parent) {
2446 		/* create a new, "anonymous" parent record */
2447 		n = audit_alloc_name(context, AUDIT_TYPE_PARENT);
2448 		if (!n)
2449 			return;
2450 		audit_copy_inode(n, NULL, parent, 0);
2451 	}
2452 
2453 	if (!found_child) {
2454 		found_child = audit_alloc_name(context, type);
2455 		if (!found_child)
2456 			return;
2457 
2458 		/* Re-use the name belonging to the slot for a matching parent
2459 		 * directory. All names for this context are relinquished in
2460 		 * audit_free_names() */
2461 		if (found_parent) {
2462 			found_child->name = found_parent->name;
2463 			found_child->name_len = AUDIT_NAME_FULL;
2464 			found_child->name->refcnt++;
2465 		}
2466 	}
2467 
2468 	if (inode)
2469 		audit_copy_inode(found_child, dentry, inode, 0);
2470 	else
2471 		found_child->ino = AUDIT_INO_UNSET;
2472 }
2473 EXPORT_SYMBOL_GPL(__audit_inode_child);
2474 
2475 /**
2476  * auditsc_get_stamp - get local copies of audit_context values
2477  * @ctx: audit_context for the task
2478  * @t: timespec64 to store time recorded in the audit_context
2479  * @serial: serial value that is recorded in the audit_context
2480  *
2481  * Also sets the context as auditable.
2482  */
2483 int auditsc_get_stamp(struct audit_context *ctx,
2484 		       struct timespec64 *t, unsigned int *serial)
2485 {
2486 	if (ctx->context == AUDIT_CTX_UNUSED)
2487 		return 0;
2488 	if (!ctx->serial)
2489 		ctx->serial = audit_serial();
2490 	t->tv_sec  = ctx->ctime.tv_sec;
2491 	t->tv_nsec = ctx->ctime.tv_nsec;
2492 	*serial    = ctx->serial;
2493 	if (!ctx->prio) {
2494 		ctx->prio = 1;
2495 		ctx->current_state = AUDIT_STATE_RECORD;
2496 	}
2497 	return 1;
2498 }
2499 
2500 /**
2501  * __audit_mq_open - record audit data for a POSIX MQ open
2502  * @oflag: open flag
2503  * @mode: mode bits
2504  * @attr: queue attributes
2505  *
2506  */
2507 void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
2508 {
2509 	struct audit_context *context = audit_context();
2510 
2511 	if (attr)
2512 		memcpy(&context->mq_open.attr, attr, sizeof(struct mq_attr));
2513 	else
2514 		memset(&context->mq_open.attr, 0, sizeof(struct mq_attr));
2515 
2516 	context->mq_open.oflag = oflag;
2517 	context->mq_open.mode = mode;
2518 
2519 	context->type = AUDIT_MQ_OPEN;
2520 }
2521 
2522 /**
2523  * __audit_mq_sendrecv - record audit data for a POSIX MQ timed send/receive
2524  * @mqdes: MQ descriptor
2525  * @msg_len: Message length
2526  * @msg_prio: Message priority
2527  * @abs_timeout: Message timeout in absolute time
2528  *
2529  */
2530 void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio,
2531 			const struct timespec64 *abs_timeout)
2532 {
2533 	struct audit_context *context = audit_context();
2534 	struct timespec64 *p = &context->mq_sendrecv.abs_timeout;
2535 
2536 	if (abs_timeout)
2537 		memcpy(p, abs_timeout, sizeof(*p));
2538 	else
2539 		memset(p, 0, sizeof(*p));
2540 
2541 	context->mq_sendrecv.mqdes = mqdes;
2542 	context->mq_sendrecv.msg_len = msg_len;
2543 	context->mq_sendrecv.msg_prio = msg_prio;
2544 
2545 	context->type = AUDIT_MQ_SENDRECV;
2546 }
2547 
2548 /**
2549  * __audit_mq_notify - record audit data for a POSIX MQ notify
2550  * @mqdes: MQ descriptor
2551  * @notification: Notification event
2552  *
2553  */
2554 
2555 void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
2556 {
2557 	struct audit_context *context = audit_context();
2558 
2559 	if (notification)
2560 		context->mq_notify.sigev_signo = notification->sigev_signo;
2561 	else
2562 		context->mq_notify.sigev_signo = 0;
2563 
2564 	context->mq_notify.mqdes = mqdes;
2565 	context->type = AUDIT_MQ_NOTIFY;
2566 }
2567 
2568 /**
2569  * __audit_mq_getsetattr - record audit data for a POSIX MQ get/set attribute
2570  * @mqdes: MQ descriptor
2571  * @mqstat: MQ flags
2572  *
2573  */
2574 void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
2575 {
2576 	struct audit_context *context = audit_context();
2577 
2578 	context->mq_getsetattr.mqdes = mqdes;
2579 	context->mq_getsetattr.mqstat = *mqstat;
2580 	context->type = AUDIT_MQ_GETSETATTR;
2581 }
2582 
2583 /**
2584  * __audit_ipc_obj - record audit data for ipc object
2585  * @ipcp: ipc permissions
2586  *
2587  */
2588 void __audit_ipc_obj(struct kern_ipc_perm *ipcp)
2589 {
2590 	struct audit_context *context = audit_context();
2591 
2592 	context->ipc.uid = ipcp->uid;
2593 	context->ipc.gid = ipcp->gid;
2594 	context->ipc.mode = ipcp->mode;
2595 	context->ipc.has_perm = 0;
2596 	security_ipc_getsecid(ipcp, &context->ipc.osid);
2597 	context->type = AUDIT_IPC;
2598 }
2599 
2600 /**
2601  * __audit_ipc_set_perm - record audit data for new ipc permissions
2602  * @qbytes: msgq bytes
2603  * @uid: msgq user id
2604  * @gid: msgq group id
2605  * @mode: msgq mode (permissions)
2606  *
2607  * Called only after audit_ipc_obj().
2608  */
2609 void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode)
2610 {
2611 	struct audit_context *context = audit_context();
2612 
2613 	context->ipc.qbytes = qbytes;
2614 	context->ipc.perm_uid = uid;
2615 	context->ipc.perm_gid = gid;
2616 	context->ipc.perm_mode = mode;
2617 	context->ipc.has_perm = 1;
2618 }
2619 
2620 void __audit_bprm(struct linux_binprm *bprm)
2621 {
2622 	struct audit_context *context = audit_context();
2623 
2624 	context->type = AUDIT_EXECVE;
2625 	context->execve.argc = bprm->argc;
2626 }
2627 
2628 
2629 /**
2630  * __audit_socketcall - record audit data for sys_socketcall
2631  * @nargs: number of args, which should not be more than AUDITSC_ARGS.
2632  * @args: args array
2633  *
2634  */
2635 int __audit_socketcall(int nargs, unsigned long *args)
2636 {
2637 	struct audit_context *context = audit_context();
2638 
2639 	if (nargs <= 0 || nargs > AUDITSC_ARGS || !args)
2640 		return -EINVAL;
2641 	context->type = AUDIT_SOCKETCALL;
2642 	context->socketcall.nargs = nargs;
2643 	memcpy(context->socketcall.args, args, nargs * sizeof(unsigned long));
2644 	return 0;
2645 }
2646 
2647 /**
2648  * __audit_fd_pair - record audit data for pipe and socketpair
2649  * @fd1: the first file descriptor
2650  * @fd2: the second file descriptor
2651  *
2652  */
2653 void __audit_fd_pair(int fd1, int fd2)
2654 {
2655 	struct audit_context *context = audit_context();
2656 
2657 	context->fds[0] = fd1;
2658 	context->fds[1] = fd2;
2659 }
2660 
2661 /**
2662  * __audit_sockaddr - record audit data for sys_bind, sys_connect, sys_sendto
2663  * @len: data length in user space
2664  * @a: data address in kernel space
2665  *
2666  * Returns 0 for success or NULL context or < 0 on error.
2667  */
2668 int __audit_sockaddr(int len, void *a)
2669 {
2670 	struct audit_context *context = audit_context();
2671 
2672 	if (!context->sockaddr) {
2673 		void *p = kmalloc(sizeof(struct sockaddr_storage), GFP_KERNEL);
2674 
2675 		if (!p)
2676 			return -ENOMEM;
2677 		context->sockaddr = p;
2678 	}
2679 
2680 	context->sockaddr_len = len;
2681 	memcpy(context->sockaddr, a, len);
2682 	return 0;
2683 }
2684 
2685 void __audit_ptrace(struct task_struct *t)
2686 {
2687 	struct audit_context *context = audit_context();
2688 
2689 	context->target_pid = task_tgid_nr(t);
2690 	context->target_auid = audit_get_loginuid(t);
2691 	context->target_uid = task_uid(t);
2692 	context->target_sessionid = audit_get_sessionid(t);
2693 	security_task_getsecid_obj(t, &context->target_sid);
2694 	memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
2695 }
2696 
2697 /**
2698  * audit_signal_info_syscall - record signal info for syscalls
2699  * @t: task being signaled
2700  *
2701  * If the audit subsystem is being terminated, record the task (pid)
2702  * and uid that is doing that.
2703  */
2704 int audit_signal_info_syscall(struct task_struct *t)
2705 {
2706 	struct audit_aux_data_pids *axp;
2707 	struct audit_context *ctx = audit_context();
2708 	kuid_t t_uid = task_uid(t);
2709 
2710 	if (!audit_signals || audit_dummy_context())
2711 		return 0;
2712 
2713 	/* optimize the common case by putting first signal recipient directly
2714 	 * in audit_context */
2715 	if (!ctx->target_pid) {
2716 		ctx->target_pid = task_tgid_nr(t);
2717 		ctx->target_auid = audit_get_loginuid(t);
2718 		ctx->target_uid = t_uid;
2719 		ctx->target_sessionid = audit_get_sessionid(t);
2720 		security_task_getsecid_obj(t, &ctx->target_sid);
2721 		memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
2722 		return 0;
2723 	}
2724 
2725 	axp = (void *)ctx->aux_pids;
2726 	if (!axp || axp->pid_count == AUDIT_AUX_PIDS) {
2727 		axp = kzalloc(sizeof(*axp), GFP_ATOMIC);
2728 		if (!axp)
2729 			return -ENOMEM;
2730 
2731 		axp->d.type = AUDIT_OBJ_PID;
2732 		axp->d.next = ctx->aux_pids;
2733 		ctx->aux_pids = (void *)axp;
2734 	}
2735 	BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
2736 
2737 	axp->target_pid[axp->pid_count] = task_tgid_nr(t);
2738 	axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
2739 	axp->target_uid[axp->pid_count] = t_uid;
2740 	axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t);
2741 	security_task_getsecid_obj(t, &axp->target_sid[axp->pid_count]);
2742 	memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
2743 	axp->pid_count++;
2744 
2745 	return 0;
2746 }
2747 
2748 /**
2749  * __audit_log_bprm_fcaps - store information about a loading bprm and relevant fcaps
2750  * @bprm: pointer to the bprm being processed
2751  * @new: the proposed new credentials
2752  * @old: the old credentials
2753  *
2754  * Simply check if the proc already has the caps given by the file and if not
2755  * store the priv escalation info for later auditing at the end of the syscall
2756  *
2757  * -Eric
2758  */
2759 int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
2760 			   const struct cred *new, const struct cred *old)
2761 {
2762 	struct audit_aux_data_bprm_fcaps *ax;
2763 	struct audit_context *context = audit_context();
2764 	struct cpu_vfs_cap_data vcaps;
2765 
2766 	ax = kmalloc(sizeof(*ax), GFP_KERNEL);
2767 	if (!ax)
2768 		return -ENOMEM;
2769 
2770 	ax->d.type = AUDIT_BPRM_FCAPS;
2771 	ax->d.next = context->aux;
2772 	context->aux = (void *)ax;
2773 
2774 	get_vfs_caps_from_disk(&init_user_ns,
2775 			       bprm->file->f_path.dentry, &vcaps);
2776 
2777 	ax->fcap.permitted = vcaps.permitted;
2778 	ax->fcap.inheritable = vcaps.inheritable;
2779 	ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
2780 	ax->fcap.rootid = vcaps.rootid;
2781 	ax->fcap_ver = (vcaps.magic_etc & VFS_CAP_REVISION_MASK) >> VFS_CAP_REVISION_SHIFT;
2782 
2783 	ax->old_pcap.permitted   = old->cap_permitted;
2784 	ax->old_pcap.inheritable = old->cap_inheritable;
2785 	ax->old_pcap.effective   = old->cap_effective;
2786 	ax->old_pcap.ambient     = old->cap_ambient;
2787 
2788 	ax->new_pcap.permitted   = new->cap_permitted;
2789 	ax->new_pcap.inheritable = new->cap_inheritable;
2790 	ax->new_pcap.effective   = new->cap_effective;
2791 	ax->new_pcap.ambient     = new->cap_ambient;
2792 	return 0;
2793 }
2794 
2795 /**
2796  * __audit_log_capset - store information about the arguments to the capset syscall
2797  * @new: the new credentials
2798  * @old: the old (current) credentials
2799  *
2800  * Record the arguments userspace sent to sys_capset for later printing by the
2801  * audit system if applicable
2802  */
2803 void __audit_log_capset(const struct cred *new, const struct cred *old)
2804 {
2805 	struct audit_context *context = audit_context();
2806 
2807 	context->capset.pid = task_tgid_nr(current);
2808 	context->capset.cap.effective   = new->cap_effective;
2809 	context->capset.cap.inheritable = new->cap_effective;
2810 	context->capset.cap.permitted   = new->cap_permitted;
2811 	context->capset.cap.ambient     = new->cap_ambient;
2812 	context->type = AUDIT_CAPSET;
2813 }
2814 
2815 void __audit_mmap_fd(int fd, int flags)
2816 {
2817 	struct audit_context *context = audit_context();
2818 
2819 	context->mmap.fd = fd;
2820 	context->mmap.flags = flags;
2821 	context->type = AUDIT_MMAP;
2822 }
2823 
2824 void __audit_openat2_how(struct open_how *how)
2825 {
2826 	struct audit_context *context = audit_context();
2827 
2828 	context->openat2.flags = how->flags;
2829 	context->openat2.mode = how->mode;
2830 	context->openat2.resolve = how->resolve;
2831 	context->type = AUDIT_OPENAT2;
2832 }
2833 
2834 void __audit_log_kern_module(char *name)
2835 {
2836 	struct audit_context *context = audit_context();
2837 
2838 	context->module.name = kstrdup(name, GFP_KERNEL);
2839 	if (!context->module.name)
2840 		audit_log_lost("out of memory in __audit_log_kern_module");
2841 	context->type = AUDIT_KERN_MODULE;
2842 }
2843 
2844 void __audit_fanotify(unsigned int response)
2845 {
2846 	audit_log(audit_context(), GFP_KERNEL,
2847 		AUDIT_FANOTIFY,	"resp=%u", response);
2848 }
2849 
2850 void __audit_tk_injoffset(struct timespec64 offset)
2851 {
2852 	audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_INJOFFSET,
2853 		  "sec=%lli nsec=%li",
2854 		  (long long)offset.tv_sec, offset.tv_nsec);
2855 }
2856 
2857 static void audit_log_ntp_val(const struct audit_ntp_data *ad,
2858 			      const char *op, enum audit_ntp_type type)
2859 {
2860 	const struct audit_ntp_val *val = &ad->vals[type];
2861 
2862 	if (val->newval == val->oldval)
2863 		return;
2864 
2865 	audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_ADJNTPVAL,
2866 		  "op=%s old=%lli new=%lli", op, val->oldval, val->newval);
2867 }
2868 
2869 void __audit_ntp_log(const struct audit_ntp_data *ad)
2870 {
2871 	audit_log_ntp_val(ad, "offset",	AUDIT_NTP_OFFSET);
2872 	audit_log_ntp_val(ad, "freq",	AUDIT_NTP_FREQ);
2873 	audit_log_ntp_val(ad, "status",	AUDIT_NTP_STATUS);
2874 	audit_log_ntp_val(ad, "tai",	AUDIT_NTP_TAI);
2875 	audit_log_ntp_val(ad, "tick",	AUDIT_NTP_TICK);
2876 	audit_log_ntp_val(ad, "adjust",	AUDIT_NTP_ADJUST);
2877 }
2878 
2879 void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
2880 		       enum audit_nfcfgop op, gfp_t gfp)
2881 {
2882 	struct audit_buffer *ab;
2883 	char comm[sizeof(current->comm)];
2884 
2885 	ab = audit_log_start(audit_context(), gfp, AUDIT_NETFILTER_CFG);
2886 	if (!ab)
2887 		return;
2888 	audit_log_format(ab, "table=%s family=%u entries=%u op=%s",
2889 			 name, af, nentries, audit_nfcfgs[op].s);
2890 
2891 	audit_log_format(ab, " pid=%u", task_pid_nr(current));
2892 	audit_log_task_context(ab); /* subj= */
2893 	audit_log_format(ab, " comm=");
2894 	audit_log_untrustedstring(ab, get_task_comm(comm, current));
2895 	audit_log_end(ab);
2896 }
2897 EXPORT_SYMBOL_GPL(__audit_log_nfcfg);
2898 
2899 static void audit_log_task(struct audit_buffer *ab)
2900 {
2901 	kuid_t auid, uid;
2902 	kgid_t gid;
2903 	unsigned int sessionid;
2904 	char comm[sizeof(current->comm)];
2905 
2906 	auid = audit_get_loginuid(current);
2907 	sessionid = audit_get_sessionid(current);
2908 	current_uid_gid(&uid, &gid);
2909 
2910 	audit_log_format(ab, "auid=%u uid=%u gid=%u ses=%u",
2911 			 from_kuid(&init_user_ns, auid),
2912 			 from_kuid(&init_user_ns, uid),
2913 			 from_kgid(&init_user_ns, gid),
2914 			 sessionid);
2915 	audit_log_task_context(ab);
2916 	audit_log_format(ab, " pid=%d comm=", task_tgid_nr(current));
2917 	audit_log_untrustedstring(ab, get_task_comm(comm, current));
2918 	audit_log_d_path_exe(ab, current->mm);
2919 }
2920 
2921 /**
2922  * audit_core_dumps - record information about processes that end abnormally
2923  * @signr: signal value
2924  *
2925  * If a process ends with a core dump, something fishy is going on and we
2926  * should record the event for investigation.
2927  */
2928 void audit_core_dumps(long signr)
2929 {
2930 	struct audit_buffer *ab;
2931 
2932 	if (!audit_enabled)
2933 		return;
2934 
2935 	if (signr == SIGQUIT)	/* don't care for those */
2936 		return;
2937 
2938 	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_ANOM_ABEND);
2939 	if (unlikely(!ab))
2940 		return;
2941 	audit_log_task(ab);
2942 	audit_log_format(ab, " sig=%ld res=1", signr);
2943 	audit_log_end(ab);
2944 }
2945 
2946 /**
2947  * audit_seccomp - record information about a seccomp action
2948  * @syscall: syscall number
2949  * @signr: signal value
2950  * @code: the seccomp action
2951  *
2952  * Record the information associated with a seccomp action. Event filtering for
2953  * seccomp actions that are not to be logged is done in seccomp_log().
2954  * Therefore, this function forces auditing independent of the audit_enabled
2955  * and dummy context state because seccomp actions should be logged even when
2956  * audit is not in use.
2957  */
2958 void audit_seccomp(unsigned long syscall, long signr, int code)
2959 {
2960 	struct audit_buffer *ab;
2961 
2962 	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_SECCOMP);
2963 	if (unlikely(!ab))
2964 		return;
2965 	audit_log_task(ab);
2966 	audit_log_format(ab, " sig=%ld arch=%x syscall=%ld compat=%d ip=0x%lx code=0x%x",
2967 			 signr, syscall_get_arch(current), syscall,
2968 			 in_compat_syscall(), KSTK_EIP(current), code);
2969 	audit_log_end(ab);
2970 }
2971 
2972 void audit_seccomp_actions_logged(const char *names, const char *old_names,
2973 				  int res)
2974 {
2975 	struct audit_buffer *ab;
2976 
2977 	if (!audit_enabled)
2978 		return;
2979 
2980 	ab = audit_log_start(audit_context(), GFP_KERNEL,
2981 			     AUDIT_CONFIG_CHANGE);
2982 	if (unlikely(!ab))
2983 		return;
2984 
2985 	audit_log_format(ab,
2986 			 "op=seccomp-logging actions=%s old-actions=%s res=%d",
2987 			 names, old_names, res);
2988 	audit_log_end(ab);
2989 }
2990 
2991 struct list_head *audit_killed_trees(void)
2992 {
2993 	struct audit_context *ctx = audit_context();
2994 	if (likely(!ctx || ctx->context == AUDIT_CTX_UNUSED))
2995 		return NULL;
2996 	return &ctx->killed_trees;
2997 }
2998