2005-04-29 17:23:29 +02:00
|
|
|
/* auditsc.c -- System-call auditing support
|
2005-04-17 00:20:36 +02:00
|
|
|
* Handles all system-call specific auditing features.
|
|
|
|
*
|
|
|
|
* Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
|
2005-11-03 17:00:25 +01:00
|
|
|
* Copyright 2005 Hewlett-Packard Development Company, L.P.
|
2006-05-24 23:09:55 +02:00
|
|
|
* Copyright (C) 2005, 2006 IBM Corporation
|
2005-04-17 00:20:36 +02:00
|
|
|
* All Rights Reserved.
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU General Public License as published by
|
|
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
|
|
* (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
|
|
*
|
|
|
|
* Written by Rickard E. (Rik) Faith <faith@redhat.com>
|
|
|
|
*
|
|
|
|
* Many of the ideas implemented here are from Stephen C. Tweedie,
|
|
|
|
* especially the idea of avoiding a copy by using getname.
|
|
|
|
*
|
|
|
|
* The method for actual interception of syscall entry and exit (not in
|
|
|
|
* this file -- see entry.S) is based on a GPL'd patch written by
|
|
|
|
* okir@suse.de and Copyright 2003 SuSE Linux AG.
|
|
|
|
*
|
2006-05-24 23:09:55 +02:00
|
|
|
* POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>,
|
|
|
|
* 2006.
|
|
|
|
*
|
[PATCH] Filter rule comparators
Currently, audit only supports the "=" and "!=" operators in the -F
filter rules.
This patch reworks the support for "=" and "!=", and adds support
for ">", ">=", "<", and "<=".
This turned out to be a pretty clean, and simply process. I ended up
using the high order bits of the "field", as suggested by Steve and Amy.
This allowed for no changes whatsoever to the netlink communications.
See the documentation within the patch in the include/linux/audit.h
area, where there is a table that explains the reasoning of the bitmask
assignments clearly.
The patch adds a new function, audit_comparator(left, op, right).
This function will perform the specified comparison (op, which defaults
to "==" for backward compatibility) between two values (left and right).
If the negate bit is on, it will negate whatever that result was. This
value is returned.
Signed-off-by: Dustin Kirkland <dustin.kirkland@us.ibm.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2005-11-03 16:41:46 +01:00
|
|
|
* The support of additional filter rules compares (>, <, >=, <=) was
|
|
|
|
* added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005.
|
|
|
|
*
|
2005-11-03 17:00:25 +01:00
|
|
|
* Modified by Amy Griffis <amy.griffis@hp.com> to collect additional
|
|
|
|
* filesystem information.
|
2005-11-03 18:15:16 +01:00
|
|
|
*
|
|
|
|
* Subject and object context labeling support added by <danjones@us.ibm.com>
|
|
|
|
* and <dustin.kirkland@us.ibm.com> for LSPP certification compliance.
|
2005-04-17 00:20:36 +02:00
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/init.h>
|
|
|
|
#include <asm/types.h>
|
2006-01-19 02:44:07 +01:00
|
|
|
#include <asm/atomic.h>
|
2005-11-03 17:00:25 +01:00
|
|
|
#include <linux/fs.h>
|
|
|
|
#include <linux/namei.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <linux/mm.h>
|
|
|
|
#include <linux/module.h>
|
2005-05-21 01:15:52 +02:00
|
|
|
#include <linux/mount.h>
|
2005-05-17 13:08:48 +02:00
|
|
|
#include <linux/socket.h>
|
2006-05-24 23:09:55 +02:00
|
|
|
#include <linux/mqueue.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <linux/audit.h>
|
|
|
|
#include <linux/personality.h>
|
|
|
|
#include <linux/time.h>
|
2005-06-24 15:14:05 +02:00
|
|
|
#include <linux/netlink.h>
|
2005-07-13 23:47:07 +02:00
|
|
|
#include <linux/compiler.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <asm/unistd.h>
|
2005-11-03 18:15:16 +01:00
|
|
|
#include <linux/security.h>
|
2005-12-15 19:33:52 +01:00
|
|
|
#include <linux/list.h>
|
2006-01-01 20:07:00 +01:00
|
|
|
#include <linux/tty.h>
|
2006-04-26 20:04:08 +02:00
|
|
|
#include <linux/binfmts.h>
|
2006-10-19 22:08:53 +02:00
|
|
|
#include <linux/highmem.h>
|
2006-05-06 14:22:52 +02:00
|
|
|
#include <linux/syscalls.h>
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 14:04:18 +02:00
|
|
|
#include <linux/inotify.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2005-12-15 19:33:52 +01:00
|
|
|
#include "audit.h"
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* AUDIT_NAMES is the number of slots we reserve in the audit_context
|
|
|
|
* for saving names from getname(). */
|
|
|
|
#define AUDIT_NAMES 20
|
|
|
|
|
2006-06-09 05:19:31 +02:00
|
|
|
/* Indicates that audit should log the full pathname. */
|
|
|
|
#define AUDIT_NAME_FULL -1
|
|
|
|
|
2008-01-07 20:31:58 +01:00
|
|
|
/* no execve audit message should be longer than this (userspace limits) */
|
|
|
|
#define MAX_EXECVE_AUDIT_LEN 7500
|
|
|
|
|
2006-07-10 14:29:24 +02:00
|
|
|
/* number of audit rules */
|
|
|
|
int audit_n_rules;
|
|
|
|
|
2007-03-30 00:01:04 +02:00
|
|
|
/* determines whether we collect data for signals sent */
|
|
|
|
int audit_signals;
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/* When fs/namei.c:getname() is called, we store the pointer in name and
|
|
|
|
* we don't let putname() free it (instead we free all of the saved
|
|
|
|
* pointers at syscall exit time).
|
|
|
|
*
|
|
|
|
* Further, in fs/namei.c:path_lookup() we store the inode and device. */
|
|
|
|
struct audit_names {
|
|
|
|
const char *name;
|
2006-06-09 05:19:31 +02:00
|
|
|
int name_len; /* number of name's characters to log */
|
|
|
|
unsigned name_put; /* call __putname() for this name */
|
2005-04-17 00:20:36 +02:00
|
|
|
unsigned long ino;
|
|
|
|
dev_t dev;
|
|
|
|
umode_t mode;
|
|
|
|
uid_t uid;
|
|
|
|
gid_t gid;
|
|
|
|
dev_t rdev;
|
2006-04-03 20:06:13 +02:00
|
|
|
u32 osid;
|
2005-04-17 00:20:36 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
struct audit_aux_data {
|
|
|
|
struct audit_aux_data *next;
|
|
|
|
int type;
|
|
|
|
};
|
|
|
|
|
|
|
|
#define AUDIT_AUX_IPCPERM 0
|
|
|
|
|
2007-03-30 00:01:04 +02:00
|
|
|
/* Number of target pids per aux struct. */
|
|
|
|
#define AUDIT_AUX_PIDS 16
|
|
|
|
|
2006-05-24 23:09:55 +02:00
|
|
|
struct audit_aux_data_mq_open {
|
|
|
|
struct audit_aux_data d;
|
|
|
|
int oflag;
|
|
|
|
mode_t mode;
|
|
|
|
struct mq_attr attr;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct audit_aux_data_mq_sendrecv {
|
|
|
|
struct audit_aux_data d;
|
|
|
|
mqd_t mqdes;
|
|
|
|
size_t msg_len;
|
|
|
|
unsigned int msg_prio;
|
|
|
|
struct timespec abs_timeout;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct audit_aux_data_mq_notify {
|
|
|
|
struct audit_aux_data d;
|
|
|
|
mqd_t mqdes;
|
|
|
|
struct sigevent notification;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct audit_aux_data_mq_getsetattr {
|
|
|
|
struct audit_aux_data d;
|
|
|
|
mqd_t mqdes;
|
|
|
|
struct mq_attr mqstat;
|
|
|
|
};
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
struct audit_aux_data_ipcctl {
|
|
|
|
struct audit_aux_data d;
|
|
|
|
struct ipc_perm p;
|
|
|
|
unsigned long qbytes;
|
|
|
|
uid_t uid;
|
|
|
|
gid_t gid;
|
|
|
|
mode_t mode;
|
2006-03-31 22:22:49 +02:00
|
|
|
u32 osid;
|
2005-04-17 00:20:36 +02:00
|
|
|
};
|
|
|
|
|
2006-04-26 20:04:08 +02:00
|
|
|
struct audit_aux_data_execve {
|
|
|
|
struct audit_aux_data d;
|
|
|
|
int argc;
|
|
|
|
int envc;
|
2007-07-19 10:48:15 +02:00
|
|
|
struct mm_struct *mm;
|
2006-04-26 20:04:08 +02:00
|
|
|
};
|
|
|
|
|
2005-05-17 13:08:48 +02:00
|
|
|
struct audit_aux_data_socketcall {
|
|
|
|
struct audit_aux_data d;
|
|
|
|
int nargs;
|
|
|
|
unsigned long args[0];
|
|
|
|
};
|
|
|
|
|
|
|
|
struct audit_aux_data_sockaddr {
|
|
|
|
struct audit_aux_data d;
|
|
|
|
int len;
|
|
|
|
char a[0];
|
|
|
|
};
|
|
|
|
|
2007-02-07 07:48:00 +01:00
|
|
|
struct audit_aux_data_fd_pair {
|
|
|
|
struct audit_aux_data d;
|
|
|
|
int fd[2];
|
|
|
|
};
|
|
|
|
|
2007-03-30 00:01:04 +02:00
|
|
|
struct audit_aux_data_pids {
|
|
|
|
struct audit_aux_data d;
|
|
|
|
pid_t target_pid[AUDIT_AUX_PIDS];
|
2008-01-07 19:40:17 +01:00
|
|
|
uid_t target_auid[AUDIT_AUX_PIDS];
|
|
|
|
uid_t target_uid[AUDIT_AUX_PIDS];
|
2008-01-08 16:06:53 +01:00
|
|
|
unsigned int target_sessionid[AUDIT_AUX_PIDS];
|
2007-03-30 00:01:04 +02:00
|
|
|
u32 target_sid[AUDIT_AUX_PIDS];
|
2008-01-07 19:40:17 +01:00
|
|
|
char target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
|
2007-03-30 00:01:04 +02:00
|
|
|
int pid_count;
|
|
|
|
};
|
|
|
|
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 14:04:18 +02:00
|
|
|
struct audit_tree_refs {
|
|
|
|
struct audit_tree_refs *next;
|
|
|
|
struct audit_chunk *c[31];
|
|
|
|
};
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/* The per-task audit context. */
|
|
|
|
struct audit_context {
|
2006-08-03 16:59:26 +02:00
|
|
|
int dummy; /* must be the first element */
|
2005-04-17 00:20:36 +02:00
|
|
|
int in_syscall; /* 1 if task is in a syscall */
|
|
|
|
enum audit_state state;
|
|
|
|
unsigned int serial; /* serial number for record */
|
|
|
|
struct timespec ctime; /* time of syscall entry */
|
|
|
|
int major; /* syscall number */
|
|
|
|
unsigned long argv[4]; /* syscall arguments */
|
|
|
|
int return_valid; /* return code is valid */
|
2005-04-29 17:08:28 +02:00
|
|
|
long return_code;/* syscall return code */
|
2005-04-17 00:20:36 +02:00
|
|
|
int auditable; /* 1 if record should be written */
|
|
|
|
int name_count;
|
|
|
|
struct audit_names names[AUDIT_NAMES];
|
2006-06-15 00:45:21 +02:00
|
|
|
char * filterkey; /* key for rule that triggered record */
|
2008-02-15 04:38:33 +01:00
|
|
|
struct path pwd;
|
2005-04-17 00:20:36 +02:00
|
|
|
struct audit_context *previous; /* For nested syscalls */
|
|
|
|
struct audit_aux_data *aux;
|
2007-03-30 00:01:04 +02:00
|
|
|
struct audit_aux_data *aux_pids;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* Save things to print about task_struct */
|
2006-05-06 14:22:52 +02:00
|
|
|
pid_t pid, ppid;
|
2005-04-17 00:20:36 +02:00
|
|
|
uid_t uid, euid, suid, fsuid;
|
|
|
|
gid_t gid, egid, sgid, fsgid;
|
|
|
|
unsigned long personality;
|
2005-04-29 17:08:28 +02:00
|
|
|
int arch;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-03-20 18:58:35 +01:00
|
|
|
pid_t target_pid;
|
2008-01-07 19:40:17 +01:00
|
|
|
uid_t target_auid;
|
|
|
|
uid_t target_uid;
|
2008-01-08 16:06:53 +01:00
|
|
|
unsigned int target_sessionid;
|
2007-03-20 18:58:35 +01:00
|
|
|
u32 target_sid;
|
2008-01-07 19:40:17 +01:00
|
|
|
char target_comm[TASK_COMM_LEN];
|
2007-03-20 18:58:35 +01:00
|
|
|
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 14:04:18 +02:00
|
|
|
struct audit_tree_refs *trees, *first_trees;
|
|
|
|
int tree_count;
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
#if AUDIT_DEBUG
|
|
|
|
int put_count;
|
|
|
|
int ino_count;
|
|
|
|
#endif
|
|
|
|
};
|
|
|
|
|
2006-09-01 01:26:40 +02:00
|
|
|
#define ACC_MODE(x) ("\004\002\006\006"[(x)&O_ACCMODE])
|
|
|
|
static inline int open_arg(int flags, int mask)
|
|
|
|
{
|
|
|
|
int n = ACC_MODE(flags);
|
|
|
|
if (flags & (O_TRUNC | O_CREAT))
|
|
|
|
n |= AUDIT_PERM_WRITE;
|
|
|
|
return n & mask;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int audit_match_perm(struct audit_context *ctx, int mask)
|
|
|
|
{
|
|
|
|
unsigned n = ctx->major;
|
|
|
|
switch (audit_classify_syscall(ctx->arch, n)) {
|
|
|
|
case 0: /* native */
|
|
|
|
if ((mask & AUDIT_PERM_WRITE) &&
|
|
|
|
audit_match_class(AUDIT_CLASS_WRITE, n))
|
|
|
|
return 1;
|
|
|
|
if ((mask & AUDIT_PERM_READ) &&
|
|
|
|
audit_match_class(AUDIT_CLASS_READ, n))
|
|
|
|
return 1;
|
|
|
|
if ((mask & AUDIT_PERM_ATTR) &&
|
|
|
|
audit_match_class(AUDIT_CLASS_CHATTR, n))
|
|
|
|
return 1;
|
|
|
|
return 0;
|
|
|
|
case 1: /* 32bit on biarch */
|
|
|
|
if ((mask & AUDIT_PERM_WRITE) &&
|
|
|
|
audit_match_class(AUDIT_CLASS_WRITE_32, n))
|
|
|
|
return 1;
|
|
|
|
if ((mask & AUDIT_PERM_READ) &&
|
|
|
|
audit_match_class(AUDIT_CLASS_READ_32, n))
|
|
|
|
return 1;
|
|
|
|
if ((mask & AUDIT_PERM_ATTR) &&
|
|
|
|
audit_match_class(AUDIT_CLASS_CHATTR_32, n))
|
|
|
|
return 1;
|
|
|
|
return 0;
|
|
|
|
case 2: /* open */
|
|
|
|
return mask & ACC_MODE(ctx->argv[1]);
|
|
|
|
case 3: /* openat */
|
|
|
|
return mask & ACC_MODE(ctx->argv[2]);
|
|
|
|
case 4: /* socketcall */
|
|
|
|
return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);
|
|
|
|
case 5: /* execve */
|
|
|
|
return mask & AUDIT_PERM_EXEC;
|
|
|
|
default:
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2008-04-28 10:15:49 +02:00
|
|
|
static int audit_match_filetype(struct audit_context *ctx, int which)
|
|
|
|
{
|
|
|
|
unsigned index = which & ~S_IFMT;
|
|
|
|
mode_t mode = which & S_IFMT;
|
|
|
|
if (index >= ctx->name_count)
|
|
|
|
return 0;
|
|
|
|
if (ctx->names[index].ino == -1)
|
|
|
|
return 0;
|
|
|
|
if ((ctx->names[index].mode ^ mode) & S_IFMT)
|
|
|
|
return 0;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 14:04:18 +02:00
|
|
|
/*
|
|
|
|
* We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *;
|
|
|
|
* ->first_trees points to its beginning, ->trees - to the current end of data.
|
|
|
|
* ->tree_count is the number of free entries in array pointed to by ->trees.
|
|
|
|
* Original condition is (NULL, NULL, 0); as soon as it grows we never revert to NULL,
|
|
|
|
* "empty" becomes (p, p, 31) afterwards. We don't shrink the list (and seriously,
|
|
|
|
* it's going to remain 1-element for almost any setup) until we free context itself.
|
|
|
|
* References in it _are_ dropped - at the same time we free/drop aux stuff.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef CONFIG_AUDIT_TREE
|
|
|
|
static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk)
|
|
|
|
{
|
|
|
|
struct audit_tree_refs *p = ctx->trees;
|
|
|
|
int left = ctx->tree_count;
|
|
|
|
if (likely(left)) {
|
|
|
|
p->c[--left] = chunk;
|
|
|
|
ctx->tree_count = left;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
if (!p)
|
|
|
|
return 0;
|
|
|
|
p = p->next;
|
|
|
|
if (p) {
|
|
|
|
p->c[30] = chunk;
|
|
|
|
ctx->trees = p;
|
|
|
|
ctx->tree_count = 30;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int grow_tree_refs(struct audit_context *ctx)
|
|
|
|
{
|
|
|
|
struct audit_tree_refs *p = ctx->trees;
|
|
|
|
ctx->trees = kzalloc(sizeof(struct audit_tree_refs), GFP_KERNEL);
|
|
|
|
if (!ctx->trees) {
|
|
|
|
ctx->trees = p;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (p)
|
|
|
|
p->next = ctx->trees;
|
|
|
|
else
|
|
|
|
ctx->first_trees = ctx->trees;
|
|
|
|
ctx->tree_count = 31;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
static void unroll_tree_refs(struct audit_context *ctx,
|
|
|
|
struct audit_tree_refs *p, int count)
|
|
|
|
{
|
|
|
|
#ifdef CONFIG_AUDIT_TREE
|
|
|
|
struct audit_tree_refs *q;
|
|
|
|
int n;
|
|
|
|
if (!p) {
|
|
|
|
/* we started with empty chain */
|
|
|
|
p = ctx->first_trees;
|
|
|
|
count = 31;
|
|
|
|
/* if the very first allocation has failed, nothing to do */
|
|
|
|
if (!p)
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
n = count;
|
|
|
|
for (q = p; q != ctx->trees; q = q->next, n = 31) {
|
|
|
|
while (n--) {
|
|
|
|
audit_put_chunk(q->c[n]);
|
|
|
|
q->c[n] = NULL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
while (n-- > ctx->tree_count) {
|
|
|
|
audit_put_chunk(q->c[n]);
|
|
|
|
q->c[n] = NULL;
|
|
|
|
}
|
|
|
|
ctx->trees = p;
|
|
|
|
ctx->tree_count = count;
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
static void free_tree_refs(struct audit_context *ctx)
|
|
|
|
{
|
|
|
|
struct audit_tree_refs *p, *q;
|
|
|
|
for (p = ctx->first_trees; p; p = q) {
|
|
|
|
q = p->next;
|
|
|
|
kfree(p);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static int match_tree_refs(struct audit_context *ctx, struct audit_tree *tree)
|
|
|
|
{
|
|
|
|
#ifdef CONFIG_AUDIT_TREE
|
|
|
|
struct audit_tree_refs *p;
|
|
|
|
int n;
|
|
|
|
if (!tree)
|
|
|
|
return 0;
|
|
|
|
/* full ones */
|
|
|
|
for (p = ctx->first_trees; p != ctx->trees; p = p->next) {
|
|
|
|
for (n = 0; n < 31; n++)
|
|
|
|
if (audit_tree_match(p->c[n], tree))
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
/* partial */
|
|
|
|
if (p) {
|
|
|
|
for (n = ctx->tree_count; n < 31; n++)
|
|
|
|
if (audit_tree_match(p->c[n], tree))
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
/* Determine if any context name data matches a rule's watch data */
|
2005-04-17 00:20:36 +02:00
|
|
|
/* Compare a task_struct with an audit_rule. Return 1 on match, 0
|
|
|
|
* otherwise. */
|
|
|
|
static int audit_filter_rules(struct task_struct *tsk,
|
2006-02-07 18:05:27 +01:00
|
|
|
struct audit_krule *rule,
|
2005-04-17 00:20:36 +02:00
|
|
|
struct audit_context *ctx,
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
struct audit_names *name,
|
2005-04-17 00:20:36 +02:00
|
|
|
enum audit_state *state)
|
|
|
|
{
|
2006-04-11 14:50:56 +02:00
|
|
|
int i, j, need_sid = 1;
|
2006-03-11 01:14:06 +01:00
|
|
|
u32 sid;
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
for (i = 0; i < rule->field_count; i++) {
|
2006-02-07 18:05:27 +01:00
|
|
|
struct audit_field *f = &rule->fields[i];
|
2005-04-17 00:20:36 +02:00
|
|
|
int result = 0;
|
|
|
|
|
2006-02-07 18:05:27 +01:00
|
|
|
switch (f->type) {
|
2005-04-17 00:20:36 +02:00
|
|
|
case AUDIT_PID:
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(tsk->pid, f->op, f->val);
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
2006-05-06 14:26:27 +02:00
|
|
|
case AUDIT_PPID:
|
2006-09-29 06:08:50 +02:00
|
|
|
if (ctx) {
|
|
|
|
if (!ctx->ppid)
|
|
|
|
ctx->ppid = sys_getppid();
|
2006-05-06 14:26:27 +02:00
|
|
|
result = audit_comparator(ctx->ppid, f->op, f->val);
|
2006-09-29 06:08:50 +02:00
|
|
|
}
|
2006-05-06 14:26:27 +02:00
|
|
|
break;
|
2005-04-17 00:20:36 +02:00
|
|
|
case AUDIT_UID:
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(tsk->uid, f->op, f->val);
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
|
|
|
case AUDIT_EUID:
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(tsk->euid, f->op, f->val);
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
|
|
|
case AUDIT_SUID:
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(tsk->suid, f->op, f->val);
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
|
|
|
case AUDIT_FSUID:
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(tsk->fsuid, f->op, f->val);
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
|
|
|
case AUDIT_GID:
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(tsk->gid, f->op, f->val);
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
|
|
|
case AUDIT_EGID:
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(tsk->egid, f->op, f->val);
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
|
|
|
case AUDIT_SGID:
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(tsk->sgid, f->op, f->val);
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
|
|
|
case AUDIT_FSGID:
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(tsk->fsgid, f->op, f->val);
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
|
|
|
case AUDIT_PERS:
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(tsk->personality, f->op, f->val);
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
2005-04-29 17:08:28 +02:00
|
|
|
case AUDIT_ARCH:
|
2007-10-18 12:06:09 +02:00
|
|
|
if (ctx)
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(ctx->arch, f->op, f->val);
|
2005-04-29 17:08:28 +02:00
|
|
|
break;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
case AUDIT_EXIT:
|
|
|
|
if (ctx && ctx->return_valid)
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(ctx->return_code, f->op, f->val);
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
|
|
|
case AUDIT_SUCCESS:
|
2005-08-27 11:25:43 +02:00
|
|
|
if (ctx && ctx->return_valid) {
|
2006-02-07 18:05:27 +01:00
|
|
|
if (f->val)
|
|
|
|
result = audit_comparator(ctx->return_valid, f->op, AUDITSC_SUCCESS);
|
2005-08-27 11:25:43 +02:00
|
|
|
else
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(ctx->return_valid, f->op, AUDITSC_FAILURE);
|
2005-08-27 11:25:43 +02:00
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
|
|
|
case AUDIT_DEVMAJOR:
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
if (name)
|
|
|
|
result = audit_comparator(MAJOR(name->dev),
|
|
|
|
f->op, f->val);
|
|
|
|
else if (ctx) {
|
2005-04-17 00:20:36 +02:00
|
|
|
for (j = 0; j < ctx->name_count; j++) {
|
2006-02-07 18:05:27 +01:00
|
|
|
if (audit_comparator(MAJOR(ctx->names[j].dev), f->op, f->val)) {
|
2005-04-17 00:20:36 +02:00
|
|
|
++result;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case AUDIT_DEVMINOR:
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
if (name)
|
|
|
|
result = audit_comparator(MINOR(name->dev),
|
|
|
|
f->op, f->val);
|
|
|
|
else if (ctx) {
|
2005-04-17 00:20:36 +02:00
|
|
|
for (j = 0; j < ctx->name_count; j++) {
|
2006-02-07 18:05:27 +01:00
|
|
|
if (audit_comparator(MINOR(ctx->names[j].dev), f->op, f->val)) {
|
2005-04-17 00:20:36 +02:00
|
|
|
++result;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case AUDIT_INODE:
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
if (name)
|
2006-06-09 05:19:31 +02:00
|
|
|
result = (name->ino == f->val);
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
else if (ctx) {
|
2005-04-17 00:20:36 +02:00
|
|
|
for (j = 0; j < ctx->name_count; j++) {
|
2006-06-09 05:19:31 +02:00
|
|
|
if (audit_comparator(ctx->names[j].ino, f->op, f->val)) {
|
2005-04-17 00:20:36 +02:00
|
|
|
++result;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
break;
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
case AUDIT_WATCH:
|
|
|
|
if (name && rule->watch->ino != (unsigned long)-1)
|
|
|
|
result = (name->dev == rule->watch->dev &&
|
2006-06-09 05:19:31 +02:00
|
|
|
name->ino == rule->watch->ino);
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
break;
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 14:04:18 +02:00
|
|
|
case AUDIT_DIR:
|
|
|
|
if (ctx)
|
|
|
|
result = match_tree_refs(ctx, rule->tree);
|
|
|
|
break;
|
2005-04-17 00:20:36 +02:00
|
|
|
case AUDIT_LOGINUID:
|
|
|
|
result = 0;
|
|
|
|
if (ctx)
|
2008-01-10 10:53:18 +01:00
|
|
|
result = audit_comparator(tsk->loginuid, f->op, f->val);
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
2006-06-29 23:56:39 +02:00
|
|
|
case AUDIT_SUBJ_USER:
|
|
|
|
case AUDIT_SUBJ_ROLE:
|
|
|
|
case AUDIT_SUBJ_TYPE:
|
|
|
|
case AUDIT_SUBJ_SEN:
|
|
|
|
case AUDIT_SUBJ_CLR:
|
2006-03-11 01:14:06 +01:00
|
|
|
/* NOTE: this may return negative values indicating
|
|
|
|
a temporary error. We simply treat this as a
|
|
|
|
match for now to avoid losing information that
|
|
|
|
may be wanted. An error message will also be
|
|
|
|
logged upon error */
|
2008-04-19 01:59:43 +02:00
|
|
|
if (f->lsm_rule) {
|
2006-04-11 14:50:56 +02:00
|
|
|
if (need_sid) {
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
security_task_getsecid(tsk, &sid);
|
2006-04-11 14:50:56 +02:00
|
|
|
need_sid = 0;
|
|
|
|
}
|
2008-03-01 21:01:11 +01:00
|
|
|
result = security_audit_rule_match(sid, f->type,
|
2006-03-11 01:14:06 +01:00
|
|
|
f->op,
|
2008-04-19 01:59:43 +02:00
|
|
|
f->lsm_rule,
|
2006-03-11 01:14:06 +01:00
|
|
|
ctx);
|
2006-04-11 14:50:56 +02:00
|
|
|
}
|
2006-03-11 01:14:06 +01:00
|
|
|
break;
|
2006-06-29 23:57:08 +02:00
|
|
|
case AUDIT_OBJ_USER:
|
|
|
|
case AUDIT_OBJ_ROLE:
|
|
|
|
case AUDIT_OBJ_TYPE:
|
|
|
|
case AUDIT_OBJ_LEV_LOW:
|
|
|
|
case AUDIT_OBJ_LEV_HIGH:
|
|
|
|
/* The above note for AUDIT_SUBJ_USER...AUDIT_SUBJ_CLR
|
|
|
|
also applies here */
|
2008-04-19 01:59:43 +02:00
|
|
|
if (f->lsm_rule) {
|
2006-06-29 23:57:08 +02:00
|
|
|
/* Find files that match */
|
|
|
|
if (name) {
|
2008-03-01 21:01:11 +01:00
|
|
|
result = security_audit_rule_match(
|
2006-06-29 23:57:08 +02:00
|
|
|
name->osid, f->type, f->op,
|
2008-04-19 01:59:43 +02:00
|
|
|
f->lsm_rule, ctx);
|
2006-06-29 23:57:08 +02:00
|
|
|
} else if (ctx) {
|
|
|
|
for (j = 0; j < ctx->name_count; j++) {
|
2008-03-01 21:01:11 +01:00
|
|
|
if (security_audit_rule_match(
|
2006-06-29 23:57:08 +02:00
|
|
|
ctx->names[j].osid,
|
|
|
|
f->type, f->op,
|
2008-04-19 01:59:43 +02:00
|
|
|
f->lsm_rule, ctx)) {
|
2006-06-29 23:57:08 +02:00
|
|
|
++result;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/* Find ipc objects that match */
|
|
|
|
if (ctx) {
|
|
|
|
struct audit_aux_data *aux;
|
|
|
|
for (aux = ctx->aux; aux;
|
|
|
|
aux = aux->next) {
|
|
|
|
if (aux->type == AUDIT_IPC) {
|
|
|
|
struct audit_aux_data_ipcctl *axi = (void *)aux;
|
2008-04-19 01:59:43 +02:00
|
|
|
if (security_audit_rule_match(axi->osid, f->type, f->op, f->lsm_rule, ctx)) {
|
2006-06-29 23:57:08 +02:00
|
|
|
++result;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
break;
|
2005-04-17 00:20:36 +02:00
|
|
|
case AUDIT_ARG0:
|
|
|
|
case AUDIT_ARG1:
|
|
|
|
case AUDIT_ARG2:
|
|
|
|
case AUDIT_ARG3:
|
|
|
|
if (ctx)
|
2006-02-07 18:05:27 +01:00
|
|
|
result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
|
2005-04-17 00:20:36 +02:00
|
|
|
break;
|
2006-06-15 00:45:21 +02:00
|
|
|
case AUDIT_FILTERKEY:
|
|
|
|
/* ignore this field for filtering */
|
|
|
|
result = 1;
|
|
|
|
break;
|
2006-09-01 01:26:40 +02:00
|
|
|
case AUDIT_PERM:
|
|
|
|
result = audit_match_perm(ctx, f->val);
|
|
|
|
break;
|
2008-04-28 10:15:49 +02:00
|
|
|
case AUDIT_FILETYPE:
|
|
|
|
result = audit_match_filetype(ctx, f->val);
|
|
|
|
break;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
if (!result)
|
|
|
|
return 0;
|
|
|
|
}
|
2006-06-15 00:45:21 +02:00
|
|
|
if (rule->filterkey)
|
|
|
|
ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
|
2005-04-17 00:20:36 +02:00
|
|
|
switch (rule->action) {
|
|
|
|
case AUDIT_NEVER: *state = AUDIT_DISABLED; break;
|
|
|
|
case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break;
|
|
|
|
}
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* At process creation time, we can determine if system-call auditing is
|
|
|
|
* completely disabled for this task. Since we only have the task
|
|
|
|
* structure at this point, we can only check uid and gid.
|
|
|
|
*/
|
|
|
|
static enum audit_state audit_filter_task(struct task_struct *tsk)
|
|
|
|
{
|
|
|
|
struct audit_entry *e;
|
|
|
|
enum audit_state state;
|
|
|
|
|
|
|
|
rcu_read_lock();
|
2005-06-19 20:35:50 +02:00
|
|
|
list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
if (audit_filter_rules(tsk, &e->rule, NULL, NULL, &state)) {
|
2005-04-17 00:20:36 +02:00
|
|
|
rcu_read_unlock();
|
|
|
|
return state;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
rcu_read_unlock();
|
|
|
|
return AUDIT_BUILD_CONTEXT;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* At syscall entry and exit time, this filter is called if the
|
|
|
|
* audit_state is not low enough that auditing cannot take place, but is
|
2005-05-13 19:35:15 +02:00
|
|
|
* also not high enough that we already know we have to write an audit
|
2005-09-13 21:47:11 +02:00
|
|
|
* record (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT).
|
2005-04-17 00:20:36 +02:00
|
|
|
*/
|
|
|
|
static enum audit_state audit_filter_syscall(struct task_struct *tsk,
|
|
|
|
struct audit_context *ctx,
|
|
|
|
struct list_head *list)
|
|
|
|
{
|
|
|
|
struct audit_entry *e;
|
2005-08-17 15:49:57 +02:00
|
|
|
enum audit_state state;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2005-07-14 15:40:06 +02:00
|
|
|
if (audit_pid && tsk->tgid == audit_pid)
|
2005-06-20 17:07:33 +02:00
|
|
|
return AUDIT_DISABLED;
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
rcu_read_lock();
|
2005-08-17 15:49:57 +02:00
|
|
|
if (!list_empty(list)) {
|
[PATCH] Filter rule comparators
Currently, audit only supports the "=" and "!=" operators in the -F
filter rules.
This patch reworks the support for "=" and "!=", and adds support
for ">", ">=", "<", and "<=".
This turned out to be a pretty clean, and simply process. I ended up
using the high order bits of the "field", as suggested by Steve and Amy.
This allowed for no changes whatsoever to the netlink communications.
See the documentation within the patch in the include/linux/audit.h
area, where there is a table that explains the reasoning of the bitmask
assignments clearly.
The patch adds a new function, audit_comparator(left, op, right).
This function will perform the specified comparison (op, which defaults
to "==" for backward compatibility) between two values (left and right).
If the negate bit is on, it will negate whatever that result was. This
value is returned.
Signed-off-by: Dustin Kirkland <dustin.kirkland@us.ibm.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2005-11-03 16:41:46 +01:00
|
|
|
int word = AUDIT_WORD(ctx->major);
|
|
|
|
int bit = AUDIT_BIT(ctx->major);
|
|
|
|
|
|
|
|
list_for_each_entry_rcu(e, list, list) {
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
if ((e->rule.mask[word] & bit) == bit &&
|
|
|
|
audit_filter_rules(tsk, &e->rule, ctx, NULL,
|
|
|
|
&state)) {
|
|
|
|
rcu_read_unlock();
|
|
|
|
return state;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
rcu_read_unlock();
|
|
|
|
return AUDIT_BUILD_CONTEXT;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* At syscall exit time, this filter is called if any audit_names[] have been
|
|
|
|
* collected during syscall processing. We only check rules in sublists at hash
|
|
|
|
* buckets applicable to the inode numbers in audit_names[].
|
|
|
|
* Regarding audit_state, same rules apply as for audit_filter_syscall().
|
|
|
|
*/
|
|
|
|
enum audit_state audit_filter_inodes(struct task_struct *tsk,
|
|
|
|
struct audit_context *ctx)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
struct audit_entry *e;
|
|
|
|
enum audit_state state;
|
|
|
|
|
|
|
|
if (audit_pid && tsk->tgid == audit_pid)
|
|
|
|
return AUDIT_DISABLED;
|
|
|
|
|
|
|
|
rcu_read_lock();
|
|
|
|
for (i = 0; i < ctx->name_count; i++) {
|
|
|
|
int word = AUDIT_WORD(ctx->major);
|
|
|
|
int bit = AUDIT_BIT(ctx->major);
|
|
|
|
struct audit_names *n = &ctx->names[i];
|
|
|
|
int h = audit_hash_ino((u32)n->ino);
|
|
|
|
struct list_head *list = &audit_inode_hash[h];
|
|
|
|
|
|
|
|
if (list_empty(list))
|
|
|
|
continue;
|
|
|
|
|
|
|
|
list_for_each_entry_rcu(e, list, list) {
|
|
|
|
if ((e->rule.mask[word] & bit) == bit &&
|
|
|
|
audit_filter_rules(tsk, &e->rule, ctx, n, &state)) {
|
[PATCH] Filter rule comparators
Currently, audit only supports the "=" and "!=" operators in the -F
filter rules.
This patch reworks the support for "=" and "!=", and adds support
for ">", ">=", "<", and "<=".
This turned out to be a pretty clean, and simply process. I ended up
using the high order bits of the "field", as suggested by Steve and Amy.
This allowed for no changes whatsoever to the netlink communications.
See the documentation within the patch in the include/linux/audit.h
area, where there is a table that explains the reasoning of the bitmask
assignments clearly.
The patch adds a new function, audit_comparator(left, op, right).
This function will perform the specified comparison (op, which defaults
to "==" for backward compatibility) between two values (left and right).
If the negate bit is on, it will negate whatever that result was. This
value is returned.
Signed-off-by: Dustin Kirkland <dustin.kirkland@us.ibm.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2005-11-03 16:41:46 +01:00
|
|
|
rcu_read_unlock();
|
|
|
|
return state;
|
|
|
|
}
|
2005-06-19 20:35:50 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
rcu_read_unlock();
|
2005-04-17 00:20:36 +02:00
|
|
|
return AUDIT_BUILD_CONTEXT;
|
2005-06-19 20:35:50 +02:00
|
|
|
}
|
|
|
|
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
void audit_set_auditable(struct audit_context *ctx)
|
|
|
|
{
|
|
|
|
ctx->auditable = 1;
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
static inline struct audit_context *audit_get_context(struct task_struct *tsk,
|
|
|
|
int return_valid,
|
|
|
|
int return_code)
|
|
|
|
{
|
|
|
|
struct audit_context *context = tsk->audit_context;
|
|
|
|
|
|
|
|
if (likely(!context))
|
|
|
|
return NULL;
|
|
|
|
context->return_valid = return_valid;
|
2008-01-07 19:34:51 +01:00
|
|
|
|
|
|
|
/*
|
|
|
|
* we need to fix up the return code in the audit logs if the actual
|
|
|
|
* return codes are later going to be fixed up by the arch specific
|
|
|
|
* signal handlers
|
|
|
|
*
|
|
|
|
* This is actually a test for:
|
|
|
|
* (rc == ERESTARTSYS ) || (rc == ERESTARTNOINTR) ||
|
|
|
|
* (rc == ERESTARTNOHAND) || (rc == ERESTART_RESTARTBLOCK)
|
|
|
|
*
|
|
|
|
* but is faster than a bunch of ||
|
|
|
|
*/
|
|
|
|
if (unlikely(return_code <= -ERESTARTSYS) &&
|
|
|
|
(return_code >= -ERESTART_RESTARTBLOCK) &&
|
|
|
|
(return_code != -ENOIOCTLCMD))
|
|
|
|
context->return_code = -EINTR;
|
|
|
|
else
|
|
|
|
context->return_code = return_code;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2006-08-03 16:59:26 +02:00
|
|
|
if (context->in_syscall && !context->dummy && !context->auditable) {
|
2005-04-17 00:20:36 +02:00
|
|
|
enum audit_state state;
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
|
2005-06-19 20:35:50 +02:00
|
|
|
state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
if (state == AUDIT_RECORD_CONTEXT) {
|
|
|
|
context->auditable = 1;
|
|
|
|
goto get_context;
|
|
|
|
}
|
|
|
|
|
|
|
|
state = audit_filter_inodes(tsk, context);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (state == AUDIT_RECORD_CONTEXT)
|
|
|
|
context->auditable = 1;
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
get_context:
|
2006-07-16 12:43:48 +02:00
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
tsk->audit_context = NULL;
|
|
|
|
return context;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void audit_free_names(struct audit_context *context)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
|
|
|
|
#if AUDIT_DEBUG == 2
|
|
|
|
if (context->auditable
|
|
|
|
||context->put_count + context->ino_count != context->name_count) {
|
2005-11-03 17:00:25 +01:00
|
|
|
printk(KERN_ERR "%s:%d(:%d): major=%d in_syscall=%d"
|
2005-04-17 00:20:36 +02:00
|
|
|
" name_count=%d put_count=%d"
|
|
|
|
" ino_count=%d [NOT freeing]\n",
|
2005-11-03 17:00:25 +01:00
|
|
|
__FILE__, __LINE__,
|
2005-04-17 00:20:36 +02:00
|
|
|
context->serial, context->major, context->in_syscall,
|
|
|
|
context->name_count, context->put_count,
|
|
|
|
context->ino_count);
|
2005-11-03 18:15:16 +01:00
|
|
|
for (i = 0; i < context->name_count; i++) {
|
2005-04-17 00:20:36 +02:00
|
|
|
printk(KERN_ERR "names[%d] = %p = %s\n", i,
|
|
|
|
context->names[i].name,
|
2005-11-03 17:00:25 +01:00
|
|
|
context->names[i].name ?: "(null)");
|
2005-11-03 18:15:16 +01:00
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
dump_stack();
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
#if AUDIT_DEBUG
|
|
|
|
context->put_count = 0;
|
|
|
|
context->ino_count = 0;
|
|
|
|
#endif
|
|
|
|
|
2005-11-03 18:15:16 +01:00
|
|
|
for (i = 0; i < context->name_count; i++) {
|
2006-06-09 05:19:31 +02:00
|
|
|
if (context->names[i].name && context->names[i].name_put)
|
2005-04-17 00:20:36 +02:00
|
|
|
__putname(context->names[i].name);
|
2005-11-03 18:15:16 +01:00
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
context->name_count = 0;
|
2008-02-15 04:38:33 +01:00
|
|
|
path_put(&context->pwd);
|
|
|
|
context->pwd.dentry = NULL;
|
|
|
|
context->pwd.mnt = NULL;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline void audit_free_aux(struct audit_context *context)
|
|
|
|
{
|
|
|
|
struct audit_aux_data *aux;
|
|
|
|
|
|
|
|
while ((aux = context->aux)) {
|
|
|
|
context->aux = aux->next;
|
|
|
|
kfree(aux);
|
|
|
|
}
|
2007-03-30 00:01:04 +02:00
|
|
|
while ((aux = context->aux_pids)) {
|
|
|
|
context->aux_pids = aux->next;
|
|
|
|
kfree(aux);
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline void audit_zero_context(struct audit_context *context,
|
|
|
|
enum audit_state state)
|
|
|
|
{
|
|
|
|
memset(context, 0, sizeof(*context));
|
|
|
|
context->state = state;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline struct audit_context *audit_alloc_context(enum audit_state state)
|
|
|
|
{
|
|
|
|
struct audit_context *context;
|
|
|
|
|
|
|
|
if (!(context = kmalloc(sizeof(*context), GFP_KERNEL)))
|
|
|
|
return NULL;
|
|
|
|
audit_zero_context(context, state);
|
|
|
|
return context;
|
|
|
|
}
|
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/**
|
|
|
|
* audit_alloc - allocate an audit context block for a task
|
|
|
|
* @tsk: task
|
|
|
|
*
|
|
|
|
* Filter on the task information and allocate a per-task audit context
|
2005-04-17 00:20:36 +02:00
|
|
|
* if necessary. Doing so turns on system call auditing for the
|
|
|
|
* specified task. This is called from copy_process, so no lock is
|
2005-09-13 21:47:11 +02:00
|
|
|
* needed.
|
|
|
|
*/
|
2005-04-17 00:20:36 +02:00
|
|
|
int audit_alloc(struct task_struct *tsk)
|
|
|
|
{
|
|
|
|
struct audit_context *context;
|
|
|
|
enum audit_state state;
|
|
|
|
|
2008-01-08 23:38:31 +01:00
|
|
|
if (likely(!audit_ever_enabled))
|
2005-04-17 00:20:36 +02:00
|
|
|
return 0; /* Return if not auditing. */
|
|
|
|
|
|
|
|
state = audit_filter_task(tsk);
|
|
|
|
if (likely(state == AUDIT_DISABLED))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if (!(context = audit_alloc_context(state))) {
|
|
|
|
audit_log_lost("out of memory in audit_alloc");
|
|
|
|
return -ENOMEM;
|
|
|
|
}
|
|
|
|
|
|
|
|
tsk->audit_context = context;
|
|
|
|
set_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void audit_free_context(struct audit_context *context)
|
|
|
|
{
|
|
|
|
struct audit_context *previous;
|
|
|
|
int count = 0;
|
|
|
|
|
|
|
|
do {
|
|
|
|
previous = context->previous;
|
|
|
|
if (previous || (count && count < 10)) {
|
|
|
|
++count;
|
|
|
|
printk(KERN_ERR "audit(:%d): major=%d name_count=%d:"
|
|
|
|
" freeing multiple contexts (%d)\n",
|
|
|
|
context->serial, context->major,
|
|
|
|
context->name_count, count);
|
|
|
|
}
|
|
|
|
audit_free_names(context);
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 14:04:18 +02:00
|
|
|
unroll_tree_refs(context, NULL, 0);
|
|
|
|
free_tree_refs(context);
|
2005-04-17 00:20:36 +02:00
|
|
|
audit_free_aux(context);
|
2006-06-15 00:45:21 +02:00
|
|
|
kfree(context->filterkey);
|
2005-04-17 00:20:36 +02:00
|
|
|
kfree(context);
|
|
|
|
context = previous;
|
|
|
|
} while (context);
|
|
|
|
if (count >= 10)
|
|
|
|
printk(KERN_ERR "audit: freed %d contexts\n", count);
|
|
|
|
}
|
|
|
|
|
2006-11-27 20:11:54 +01:00
|
|
|
void audit_log_task_context(struct audit_buffer *ab)
|
2005-11-03 18:15:16 +01:00
|
|
|
{
|
|
|
|
char *ctx = NULL;
|
2007-03-12 17:17:42 +01:00
|
|
|
unsigned len;
|
|
|
|
int error;
|
|
|
|
u32 sid;
|
|
|
|
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
security_task_getsecid(current, &sid);
|
2007-03-12 17:17:42 +01:00
|
|
|
if (!sid)
|
|
|
|
return;
|
2005-11-03 18:15:16 +01:00
|
|
|
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
error = security_secid_to_secctx(sid, &ctx, &len);
|
2007-03-12 17:17:42 +01:00
|
|
|
if (error) {
|
|
|
|
if (error != -EINVAL)
|
2005-11-03 18:15:16 +01:00
|
|
|
goto error_path;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
audit_log_format(ab, " subj=%s", ctx);
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
security_release_secctx(ctx, len);
|
2005-11-16 16:53:13 +01:00
|
|
|
return;
|
2005-11-03 18:15:16 +01:00
|
|
|
|
|
|
|
error_path:
|
2005-11-16 16:53:13 +01:00
|
|
|
audit_panic("error in audit_log_task_context");
|
2005-11-03 18:15:16 +01:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2006-11-27 20:11:54 +01:00
|
|
|
EXPORT_SYMBOL(audit_log_task_context);
|
|
|
|
|
2006-03-30 03:17:10 +02:00
|
|
|
static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
|
2005-04-18 19:47:35 +02:00
|
|
|
{
|
2006-03-30 03:02:55 +02:00
|
|
|
char name[sizeof(tsk->comm)];
|
|
|
|
struct mm_struct *mm = tsk->mm;
|
2005-04-18 19:47:35 +02:00
|
|
|
struct vm_area_struct *vma;
|
|
|
|
|
2006-03-30 03:17:10 +02:00
|
|
|
/* tsk == current */
|
|
|
|
|
2006-03-30 03:02:55 +02:00
|
|
|
get_task_comm(name, tsk);
|
2005-05-23 22:57:41 +02:00
|
|
|
audit_log_format(ab, " comm=");
|
|
|
|
audit_log_untrustedstring(ab, name);
|
2005-04-18 19:47:35 +02:00
|
|
|
|
2006-03-30 03:17:10 +02:00
|
|
|
if (mm) {
|
|
|
|
down_read(&mm->mmap_sem);
|
|
|
|
vma = mm->mmap;
|
|
|
|
while (vma) {
|
|
|
|
if ((vma->vm_flags & VM_EXECUTABLE) &&
|
|
|
|
vma->vm_file) {
|
|
|
|
audit_log_d_path(ab, "exe=",
|
2008-02-15 04:38:33 +01:00
|
|
|
&vma->vm_file->f_path);
|
2006-03-30 03:17:10 +02:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
vma = vma->vm_next;
|
2005-04-18 19:47:35 +02:00
|
|
|
}
|
2006-03-30 03:17:10 +02:00
|
|
|
up_read(&mm->mmap_sem);
|
2005-04-18 19:47:35 +02:00
|
|
|
}
|
2006-03-30 03:17:10 +02:00
|
|
|
audit_log_task_context(ab);
|
2005-04-18 19:47:35 +02:00
|
|
|
}
|
|
|
|
|
2007-03-30 00:01:04 +02:00
|
|
|
static int audit_log_pid_context(struct audit_context *context, pid_t pid,
|
2008-01-08 16:06:53 +01:00
|
|
|
uid_t auid, uid_t uid, unsigned int sessionid,
|
|
|
|
u32 sid, char *comm)
|
2007-03-30 00:01:04 +02:00
|
|
|
{
|
|
|
|
struct audit_buffer *ab;
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
char *ctx = NULL;
|
2007-03-30 00:01:04 +02:00
|
|
|
u32 len;
|
|
|
|
int rc = 0;
|
|
|
|
|
|
|
|
ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
|
|
|
|
if (!ab)
|
2008-01-07 20:01:18 +01:00
|
|
|
return rc;
|
2007-03-30 00:01:04 +02:00
|
|
|
|
2008-01-08 16:06:53 +01:00
|
|
|
audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid, auid,
|
|
|
|
uid, sessionid);
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
if (security_secid_to_secctx(sid, &ctx, &len)) {
|
2008-01-07 19:40:17 +01:00
|
|
|
audit_log_format(ab, " obj=(none)");
|
2007-03-30 00:01:04 +02:00
|
|
|
rc = 1;
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
} else {
|
|
|
|
audit_log_format(ab, " obj=%s", ctx);
|
|
|
|
security_release_secctx(ctx, len);
|
|
|
|
}
|
2008-01-07 19:40:17 +01:00
|
|
|
audit_log_format(ab, " ocomm=");
|
|
|
|
audit_log_untrustedstring(ab, comm);
|
2007-03-30 00:01:04 +02:00
|
|
|
audit_log_end(ab);
|
|
|
|
|
|
|
|
return rc;
|
|
|
|
}
|
|
|
|
|
2008-01-07 20:31:58 +01:00
|
|
|
/*
|
|
|
|
* to_send and len_sent accounting are very loose estimates. We aren't
|
|
|
|
* really worried about a hard cap to MAX_EXECVE_AUDIT_LEN so much as being
|
|
|
|
* within about 500 bytes (next page boundry)
|
|
|
|
*
|
|
|
|
* why snprintf? an int is up to 12 digits long. if we just assumed when
|
|
|
|
* logging that a[%d]= was going to be 16 characters long we would be wasting
|
|
|
|
* space in every audit message. In one 7500 byte message we can log up to
|
|
|
|
* about 1000 min size arguments. That comes down to about 50% waste of space
|
|
|
|
* if we didn't do the snprintf to find out how long arg_num_len was.
|
|
|
|
*/
|
|
|
|
static int audit_log_single_execve_arg(struct audit_context *context,
|
|
|
|
struct audit_buffer **ab,
|
|
|
|
int arg_num,
|
|
|
|
size_t *len_sent,
|
|
|
|
const char __user *p,
|
|
|
|
char *buf)
|
2007-07-19 10:48:15 +02:00
|
|
|
{
|
2008-01-07 20:31:58 +01:00
|
|
|
char arg_num_len_buf[12];
|
|
|
|
const char __user *tmp_p = p;
|
|
|
|
/* how many digits are in arg_num? 3 is the length of a=\n */
|
|
|
|
size_t arg_num_len = snprintf(arg_num_len_buf, 12, "%d", arg_num) + 3;
|
|
|
|
size_t len, len_left, to_send;
|
|
|
|
size_t max_execve_audit_len = MAX_EXECVE_AUDIT_LEN;
|
|
|
|
unsigned int i, has_cntl = 0, too_long = 0;
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
/* strnlen_user includes the null we don't want to send */
|
|
|
|
len_left = len = strnlen_user(p, MAX_ARG_STRLEN) - 1;
|
2007-07-19 10:48:15 +02:00
|
|
|
|
2008-01-07 20:31:58 +01:00
|
|
|
/*
|
|
|
|
* We just created this mm, if we can't find the strings
|
|
|
|
* we just copied into it something is _very_ wrong. Similar
|
|
|
|
* for strings that are too long, we should not have created
|
|
|
|
* any.
|
|
|
|
*/
|
2008-02-19 00:23:16 +01:00
|
|
|
if (unlikely((len == -1) || len > MAX_ARG_STRLEN - 1)) {
|
2008-01-07 20:31:58 +01:00
|
|
|
WARN_ON(1);
|
|
|
|
send_sig(SIGKILL, current, 0);
|
2008-02-19 00:23:16 +01:00
|
|
|
return -1;
|
2008-01-07 20:31:58 +01:00
|
|
|
}
|
2007-07-28 00:55:18 +02:00
|
|
|
|
2008-01-07 20:31:58 +01:00
|
|
|
/* walk the whole argument looking for non-ascii chars */
|
|
|
|
do {
|
|
|
|
if (len_left > MAX_EXECVE_AUDIT_LEN)
|
|
|
|
to_send = MAX_EXECVE_AUDIT_LEN;
|
|
|
|
else
|
|
|
|
to_send = len_left;
|
|
|
|
ret = copy_from_user(buf, tmp_p, to_send);
|
2007-07-19 10:48:15 +02:00
|
|
|
/*
|
2008-01-07 20:31:58 +01:00
|
|
|
* There is no reason for this copy to be short. We just
|
|
|
|
* copied them here, and the mm hasn't been exposed to user-
|
|
|
|
* space yet.
|
2007-07-19 10:48:15 +02:00
|
|
|
*/
|
2008-01-07 20:31:58 +01:00
|
|
|
if (ret) {
|
2007-07-19 10:48:15 +02:00
|
|
|
WARN_ON(1);
|
|
|
|
send_sig(SIGKILL, current, 0);
|
2008-02-19 00:23:16 +01:00
|
|
|
return -1;
|
2007-07-19 10:48:15 +02:00
|
|
|
}
|
2008-01-07 20:31:58 +01:00
|
|
|
buf[to_send] = '\0';
|
|
|
|
has_cntl = audit_string_contains_control(buf, to_send);
|
|
|
|
if (has_cntl) {
|
|
|
|
/*
|
|
|
|
* hex messages get logged as 2 bytes, so we can only
|
|
|
|
* send half as much in each message
|
|
|
|
*/
|
|
|
|
max_execve_audit_len = MAX_EXECVE_AUDIT_LEN / 2;
|
2007-07-19 10:48:15 +02:00
|
|
|
break;
|
|
|
|
}
|
2008-01-07 20:31:58 +01:00
|
|
|
len_left -= to_send;
|
|
|
|
tmp_p += to_send;
|
|
|
|
} while (len_left > 0);
|
|
|
|
|
|
|
|
len_left = len;
|
|
|
|
|
|
|
|
if (len > max_execve_audit_len)
|
|
|
|
too_long = 1;
|
|
|
|
|
|
|
|
/* rewalk the argument actually logging the message */
|
|
|
|
for (i = 0; len_left > 0; i++) {
|
|
|
|
int room_left;
|
|
|
|
|
|
|
|
if (len_left > max_execve_audit_len)
|
|
|
|
to_send = max_execve_audit_len;
|
|
|
|
else
|
|
|
|
to_send = len_left;
|
|
|
|
|
|
|
|
/* do we have space left to send this argument in this ab? */
|
|
|
|
room_left = MAX_EXECVE_AUDIT_LEN - arg_num_len - *len_sent;
|
|
|
|
if (has_cntl)
|
|
|
|
room_left -= (to_send * 2);
|
|
|
|
else
|
|
|
|
room_left -= to_send;
|
|
|
|
if (room_left < 0) {
|
|
|
|
*len_sent = 0;
|
|
|
|
audit_log_end(*ab);
|
|
|
|
*ab = audit_log_start(context, GFP_KERNEL, AUDIT_EXECVE);
|
|
|
|
if (!*ab)
|
|
|
|
return 0;
|
|
|
|
}
|
2007-07-19 10:48:15 +02:00
|
|
|
|
|
|
|
/*
|
2008-01-07 20:31:58 +01:00
|
|
|
* first record needs to say how long the original string was
|
|
|
|
* so we can be sure nothing was lost.
|
|
|
|
*/
|
|
|
|
if ((i == 0) && (too_long))
|
2008-02-27 16:39:22 +01:00
|
|
|
audit_log_format(*ab, "a%d_len=%zu ", arg_num,
|
2008-01-07 20:31:58 +01:00
|
|
|
has_cntl ? 2*len : len);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* normally arguments are small enough to fit and we already
|
|
|
|
* filled buf above when we checked for control characters
|
|
|
|
* so don't bother with another copy_from_user
|
2007-07-19 10:48:15 +02:00
|
|
|
*/
|
2008-01-07 20:31:58 +01:00
|
|
|
if (len >= max_execve_audit_len)
|
|
|
|
ret = copy_from_user(buf, p, to_send);
|
|
|
|
else
|
|
|
|
ret = 0;
|
2007-07-28 00:55:18 +02:00
|
|
|
if (ret) {
|
2007-07-19 10:48:15 +02:00
|
|
|
WARN_ON(1);
|
|
|
|
send_sig(SIGKILL, current, 0);
|
2008-02-19 00:23:16 +01:00
|
|
|
return -1;
|
2007-07-19 10:48:15 +02:00
|
|
|
}
|
2008-01-07 20:31:58 +01:00
|
|
|
buf[to_send] = '\0';
|
|
|
|
|
|
|
|
/* actually log it */
|
|
|
|
audit_log_format(*ab, "a%d", arg_num);
|
|
|
|
if (too_long)
|
|
|
|
audit_log_format(*ab, "[%d]", i);
|
|
|
|
audit_log_format(*ab, "=");
|
|
|
|
if (has_cntl)
|
2008-04-18 16:12:59 +02:00
|
|
|
audit_log_n_hex(*ab, buf, to_send);
|
2008-01-07 20:31:58 +01:00
|
|
|
else
|
|
|
|
audit_log_format(*ab, "\"%s\"", buf);
|
|
|
|
audit_log_format(*ab, "\n");
|
|
|
|
|
|
|
|
p += to_send;
|
|
|
|
len_left -= to_send;
|
|
|
|
*len_sent += arg_num_len;
|
|
|
|
if (has_cntl)
|
|
|
|
*len_sent += to_send * 2;
|
|
|
|
else
|
|
|
|
*len_sent += to_send;
|
|
|
|
}
|
|
|
|
/* include the null we didn't log */
|
|
|
|
return len + 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void audit_log_execve_info(struct audit_context *context,
|
|
|
|
struct audit_buffer **ab,
|
|
|
|
struct audit_aux_data_execve *axi)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
size_t len, len_sent = 0;
|
|
|
|
const char __user *p;
|
|
|
|
char *buf;
|
2007-07-19 10:48:15 +02:00
|
|
|
|
2008-01-07 20:31:58 +01:00
|
|
|
if (axi->mm != current->mm)
|
|
|
|
return; /* execve failed, no additional info */
|
|
|
|
|
|
|
|
p = (const char __user *)axi->mm->arg_start;
|
2007-07-19 10:48:15 +02:00
|
|
|
|
2008-01-07 20:31:58 +01:00
|
|
|
audit_log_format(*ab, "argc=%d ", axi->argc);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* we need some kernel buffer to hold the userspace args. Just
|
|
|
|
* allocate one big one rather than allocating one of the right size
|
|
|
|
* for every single argument inside audit_log_single_execve_arg()
|
|
|
|
* should be <8k allocation so should be pretty safe.
|
|
|
|
*/
|
|
|
|
buf = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
|
|
|
|
if (!buf) {
|
|
|
|
audit_panic("out of memory for argv string\n");
|
|
|
|
return;
|
2007-07-19 10:48:15 +02:00
|
|
|
}
|
2008-01-07 20:31:58 +01:00
|
|
|
|
|
|
|
for (i = 0; i < axi->argc; i++) {
|
|
|
|
len = audit_log_single_execve_arg(context, ab, i,
|
|
|
|
&len_sent, p, buf);
|
|
|
|
if (len <= 0)
|
|
|
|
break;
|
|
|
|
p += len;
|
|
|
|
}
|
|
|
|
kfree(buf);
|
2007-07-19 10:48:15 +02:00
|
|
|
}
|
|
|
|
|
2006-03-30 03:17:10 +02:00
|
|
|
static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2006-03-31 22:22:49 +02:00
|
|
|
int i, call_panic = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
struct audit_buffer *ab;
|
2005-05-26 13:04:57 +02:00
|
|
|
struct audit_aux_data *aux;
|
2006-01-01 20:07:00 +01:00
|
|
|
const char *tty;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2006-03-30 03:17:10 +02:00
|
|
|
/* tsk == current */
|
2006-07-16 12:43:48 +02:00
|
|
|
context->pid = tsk->pid;
|
2006-09-29 06:08:50 +02:00
|
|
|
if (!context->ppid)
|
|
|
|
context->ppid = sys_getppid();
|
2006-07-16 12:43:48 +02:00
|
|
|
context->uid = tsk->uid;
|
|
|
|
context->gid = tsk->gid;
|
|
|
|
context->euid = tsk->euid;
|
|
|
|
context->suid = tsk->suid;
|
|
|
|
context->fsuid = tsk->fsuid;
|
|
|
|
context->egid = tsk->egid;
|
|
|
|
context->sgid = tsk->sgid;
|
|
|
|
context->fsgid = tsk->fsgid;
|
|
|
|
context->personality = tsk->personality;
|
2006-03-30 03:17:10 +02:00
|
|
|
|
|
|
|
ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!ab)
|
|
|
|
return; /* audit_panic has been called */
|
2005-05-23 22:35:28 +02:00
|
|
|
audit_log_format(ab, "arch=%x syscall=%d",
|
|
|
|
context->arch, context->major);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (context->personality != PER_LINUX)
|
|
|
|
audit_log_format(ab, " per=%lx", context->personality);
|
|
|
|
if (context->return_valid)
|
2007-10-18 12:06:09 +02:00
|
|
|
audit_log_format(ab, " success=%s exit=%ld",
|
2005-04-29 17:08:28 +02:00
|
|
|
(context->return_valid==AUDITSC_SUCCESS)?"yes":"no",
|
|
|
|
context->return_code);
|
2006-09-29 11:01:41 +02:00
|
|
|
|
|
|
|
mutex_lock(&tty_mutex);
|
2006-12-08 11:36:04 +01:00
|
|
|
read_lock(&tasklist_lock);
|
2006-03-30 03:02:55 +02:00
|
|
|
if (tsk->signal && tsk->signal->tty && tsk->signal->tty->name)
|
|
|
|
tty = tsk->signal->tty->name;
|
2006-01-01 20:07:00 +01:00
|
|
|
else
|
|
|
|
tty = "(none)";
|
2006-12-08 11:36:04 +01:00
|
|
|
read_unlock(&tasklist_lock);
|
2005-04-17 00:20:36 +02:00
|
|
|
audit_log_format(ab,
|
|
|
|
" a0=%lx a1=%lx a2=%lx a3=%lx items=%d"
|
2006-05-06 14:22:52 +02:00
|
|
|
" ppid=%d pid=%d auid=%u uid=%u gid=%u"
|
2005-05-21 01:22:31 +02:00
|
|
|
" euid=%u suid=%u fsuid=%u"
|
2008-01-08 16:06:53 +01:00
|
|
|
" egid=%u sgid=%u fsgid=%u tty=%s ses=%u",
|
2005-04-17 00:20:36 +02:00
|
|
|
context->argv[0],
|
|
|
|
context->argv[1],
|
|
|
|
context->argv[2],
|
|
|
|
context->argv[3],
|
|
|
|
context->name_count,
|
2006-05-06 14:22:52 +02:00
|
|
|
context->ppid,
|
2005-04-17 00:20:36 +02:00
|
|
|
context->pid,
|
2008-01-10 10:53:18 +01:00
|
|
|
tsk->loginuid,
|
2005-04-17 00:20:36 +02:00
|
|
|
context->uid,
|
|
|
|
context->gid,
|
|
|
|
context->euid, context->suid, context->fsuid,
|
2008-01-08 16:06:53 +01:00
|
|
|
context->egid, context->sgid, context->fsgid, tty,
|
|
|
|
tsk->sessionid);
|
2006-09-29 11:01:41 +02:00
|
|
|
|
|
|
|
mutex_unlock(&tty_mutex);
|
|
|
|
|
2006-03-30 03:17:10 +02:00
|
|
|
audit_log_task_info(ab, tsk);
|
2006-06-15 00:45:21 +02:00
|
|
|
if (context->filterkey) {
|
|
|
|
audit_log_format(ab, " key=");
|
|
|
|
audit_log_untrustedstring(ab, context->filterkey);
|
|
|
|
} else
|
|
|
|
audit_log_format(ab, " key=(null)");
|
2005-04-17 00:20:36 +02:00
|
|
|
audit_log_end(ab);
|
|
|
|
|
2005-05-26 13:04:57 +02:00
|
|
|
for (aux = context->aux; aux; aux = aux->next) {
|
2005-05-13 19:17:42 +02:00
|
|
|
|
2006-03-30 03:17:10 +02:00
|
|
|
ab = audit_log_start(context, GFP_KERNEL, aux->type);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!ab)
|
|
|
|
continue; /* audit_panic has been called */
|
|
|
|
|
|
|
|
switch (aux->type) {
|
2006-05-24 23:09:55 +02:00
|
|
|
case AUDIT_MQ_OPEN: {
|
|
|
|
struct audit_aux_data_mq_open *axi = (void *)aux;
|
|
|
|
audit_log_format(ab,
|
|
|
|
"oflag=0x%x mode=%#o mq_flags=0x%lx mq_maxmsg=%ld "
|
|
|
|
"mq_msgsize=%ld mq_curmsgs=%ld",
|
|
|
|
axi->oflag, axi->mode, axi->attr.mq_flags,
|
|
|
|
axi->attr.mq_maxmsg, axi->attr.mq_msgsize,
|
|
|
|
axi->attr.mq_curmsgs);
|
|
|
|
break; }
|
|
|
|
|
|
|
|
case AUDIT_MQ_SENDRECV: {
|
|
|
|
struct audit_aux_data_mq_sendrecv *axi = (void *)aux;
|
|
|
|
audit_log_format(ab,
|
|
|
|
"mqdes=%d msg_len=%zd msg_prio=%u "
|
|
|
|
"abs_timeout_sec=%ld abs_timeout_nsec=%ld",
|
|
|
|
axi->mqdes, axi->msg_len, axi->msg_prio,
|
|
|
|
axi->abs_timeout.tv_sec, axi->abs_timeout.tv_nsec);
|
|
|
|
break; }
|
|
|
|
|
|
|
|
case AUDIT_MQ_NOTIFY: {
|
|
|
|
struct audit_aux_data_mq_notify *axi = (void *)aux;
|
|
|
|
audit_log_format(ab,
|
|
|
|
"mqdes=%d sigev_signo=%d",
|
|
|
|
axi->mqdes,
|
|
|
|
axi->notification.sigev_signo);
|
|
|
|
break; }
|
|
|
|
|
|
|
|
case AUDIT_MQ_GETSETATTR: {
|
|
|
|
struct audit_aux_data_mq_getsetattr *axi = (void *)aux;
|
|
|
|
audit_log_format(ab,
|
|
|
|
"mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
|
|
|
|
"mq_curmsgs=%ld ",
|
|
|
|
axi->mqdes,
|
|
|
|
axi->mqstat.mq_flags, axi->mqstat.mq_maxmsg,
|
|
|
|
axi->mqstat.mq_msgsize, axi->mqstat.mq_curmsgs);
|
|
|
|
break; }
|
|
|
|
|
2005-05-13 19:17:42 +02:00
|
|
|
case AUDIT_IPC: {
|
2005-04-17 00:20:36 +02:00
|
|
|
struct audit_aux_data_ipcctl *axi = (void *)aux;
|
|
|
|
audit_log_format(ab,
|
2007-05-29 16:38:18 +02:00
|
|
|
"ouid=%u ogid=%u mode=%#o",
|
2006-05-17 04:03:48 +02:00
|
|
|
axi->uid, axi->gid, axi->mode);
|
2006-03-31 22:22:49 +02:00
|
|
|
if (axi->osid != 0) {
|
|
|
|
char *ctx = NULL;
|
|
|
|
u32 len;
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
if (security_secid_to_secctx(
|
2006-03-31 22:22:49 +02:00
|
|
|
axi->osid, &ctx, &len)) {
|
2006-04-02 01:29:34 +02:00
|
|
|
audit_log_format(ab, " osid=%u",
|
2006-03-31 22:22:49 +02:00
|
|
|
axi->osid);
|
|
|
|
call_panic = 1;
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
} else {
|
2006-03-31 22:22:49 +02:00
|
|
|
audit_log_format(ab, " obj=%s", ctx);
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
security_release_secctx(ctx, len);
|
|
|
|
}
|
2006-03-31 22:22:49 +02:00
|
|
|
}
|
2005-05-17 13:08:48 +02:00
|
|
|
break; }
|
|
|
|
|
2006-04-02 23:07:33 +02:00
|
|
|
case AUDIT_IPC_SET_PERM: {
|
|
|
|
struct audit_aux_data_ipcctl *axi = (void *)aux;
|
|
|
|
audit_log_format(ab,
|
2007-05-29 16:38:18 +02:00
|
|
|
"qbytes=%lx ouid=%u ogid=%u mode=%#o",
|
2006-04-02 23:07:33 +02:00
|
|
|
axi->qbytes, axi->uid, axi->gid, axi->mode);
|
|
|
|
break; }
|
2006-05-17 04:03:48 +02:00
|
|
|
|
2006-04-26 20:04:08 +02:00
|
|
|
case AUDIT_EXECVE: {
|
|
|
|
struct audit_aux_data_execve *axi = (void *)aux;
|
2008-01-07 20:31:58 +01:00
|
|
|
audit_log_execve_info(context, &ab, axi);
|
2006-04-26 20:04:08 +02:00
|
|
|
break; }
|
2006-04-02 23:07:33 +02:00
|
|
|
|
2005-05-17 13:08:48 +02:00
|
|
|
case AUDIT_SOCKETCALL: {
|
|
|
|
struct audit_aux_data_socketcall *axs = (void *)aux;
|
|
|
|
audit_log_format(ab, "nargs=%d", axs->nargs);
|
|
|
|
for (i=0; i<axs->nargs; i++)
|
|
|
|
audit_log_format(ab, " a%d=%lx", i, axs->args[i]);
|
|
|
|
break; }
|
|
|
|
|
|
|
|
case AUDIT_SOCKADDR: {
|
|
|
|
struct audit_aux_data_sockaddr *axs = (void *)aux;
|
|
|
|
|
|
|
|
audit_log_format(ab, "saddr=");
|
2008-04-18 16:12:59 +02:00
|
|
|
audit_log_n_hex(ab, axs->a, axs->len);
|
2005-05-17 13:08:48 +02:00
|
|
|
break; }
|
2005-05-21 01:15:52 +02:00
|
|
|
|
2007-02-07 07:48:00 +01:00
|
|
|
case AUDIT_FD_PAIR: {
|
|
|
|
struct audit_aux_data_fd_pair *axs = (void *)aux;
|
|
|
|
audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]);
|
|
|
|
break; }
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
audit_log_end(ab);
|
|
|
|
}
|
|
|
|
|
2007-03-30 00:01:04 +02:00
|
|
|
for (aux = context->aux_pids; aux; aux = aux->next) {
|
|
|
|
struct audit_aux_data_pids *axs = (void *)aux;
|
|
|
|
|
|
|
|
for (i = 0; i < axs->pid_count; i++)
|
|
|
|
if (audit_log_pid_context(context, axs->target_pid[i],
|
2008-01-07 19:40:17 +01:00
|
|
|
axs->target_auid[i],
|
|
|
|
axs->target_uid[i],
|
2008-01-08 16:06:53 +01:00
|
|
|
axs->target_sessionid[i],
|
2008-01-07 19:40:17 +01:00
|
|
|
axs->target_sid[i],
|
|
|
|
axs->target_comm[i]))
|
2007-03-30 00:01:04 +02:00
|
|
|
call_panic = 1;
|
2007-03-20 18:58:35 +01:00
|
|
|
}
|
|
|
|
|
2007-03-30 00:01:04 +02:00
|
|
|
if (context->target_pid &&
|
|
|
|
audit_log_pid_context(context, context->target_pid,
|
2008-01-07 19:40:17 +01:00
|
|
|
context->target_auid, context->target_uid,
|
2008-01-08 16:06:53 +01:00
|
|
|
context->target_sessionid,
|
2008-01-07 19:40:17 +01:00
|
|
|
context->target_sid, context->target_comm))
|
2007-03-30 00:01:04 +02:00
|
|
|
call_panic = 1;
|
|
|
|
|
2008-02-15 04:38:33 +01:00
|
|
|
if (context->pwd.dentry && context->pwd.mnt) {
|
2006-03-30 03:17:10 +02:00
|
|
|
ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
|
2005-05-27 13:17:28 +02:00
|
|
|
if (ab) {
|
2008-02-15 04:38:33 +01:00
|
|
|
audit_log_d_path(ab, "cwd=", &context->pwd);
|
2005-05-27 13:17:28 +02:00
|
|
|
audit_log_end(ab);
|
|
|
|
}
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
for (i = 0; i < context->name_count; i++) {
|
2006-06-09 05:19:31 +02:00
|
|
|
struct audit_names *n = &context->names[i];
|
2005-11-03 17:00:25 +01:00
|
|
|
|
2006-03-30 03:17:10 +02:00
|
|
|
ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!ab)
|
|
|
|
continue; /* audit_panic has been called */
|
2005-05-27 13:17:28 +02:00
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
audit_log_format(ab, "item=%d", i);
|
2005-11-03 17:00:25 +01:00
|
|
|
|
2006-06-09 05:19:31 +02:00
|
|
|
if (n->name) {
|
|
|
|
switch(n->name_len) {
|
|
|
|
case AUDIT_NAME_FULL:
|
|
|
|
/* log the full path */
|
|
|
|
audit_log_format(ab, " name=");
|
|
|
|
audit_log_untrustedstring(ab, n->name);
|
|
|
|
break;
|
|
|
|
case 0:
|
|
|
|
/* name was specified as a relative path and the
|
|
|
|
* directory component is the cwd */
|
2008-02-15 04:38:33 +01:00
|
|
|
audit_log_d_path(ab, " name=", &context->pwd);
|
2006-06-09 05:19:31 +02:00
|
|
|
break;
|
|
|
|
default:
|
|
|
|
/* log the name's directory component */
|
|
|
|
audit_log_format(ab, " name=");
|
2008-04-18 16:12:59 +02:00
|
|
|
audit_log_n_untrustedstring(ab, n->name,
|
|
|
|
n->name_len);
|
2006-06-09 05:19:31 +02:00
|
|
|
}
|
|
|
|
} else
|
|
|
|
audit_log_format(ab, " name=(null)");
|
|
|
|
|
|
|
|
if (n->ino != (unsigned long)-1) {
|
|
|
|
audit_log_format(ab, " inode=%lu"
|
|
|
|
" dev=%02x:%02x mode=%#o"
|
|
|
|
" ouid=%u ogid=%u rdev=%02x:%02x",
|
|
|
|
n->ino,
|
|
|
|
MAJOR(n->dev),
|
|
|
|
MINOR(n->dev),
|
|
|
|
n->mode,
|
|
|
|
n->uid,
|
|
|
|
n->gid,
|
|
|
|
MAJOR(n->rdev),
|
|
|
|
MINOR(n->rdev));
|
|
|
|
}
|
|
|
|
if (n->osid != 0) {
|
2006-04-03 20:06:13 +02:00
|
|
|
char *ctx = NULL;
|
|
|
|
u32 len;
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
if (security_secid_to_secctx(
|
2006-06-09 05:19:31 +02:00
|
|
|
n->osid, &ctx, &len)) {
|
|
|
|
audit_log_format(ab, " osid=%u", n->osid);
|
2006-03-31 22:22:49 +02:00
|
|
|
call_panic = 2;
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
} else {
|
2006-04-03 20:06:13 +02:00
|
|
|
audit_log_format(ab, " obj=%s", ctx);
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
security_release_secctx(ctx, len);
|
|
|
|
}
|
2005-11-03 18:15:16 +01:00
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
audit_log_end(ab);
|
|
|
|
}
|
2008-01-07 19:49:15 +01:00
|
|
|
|
|
|
|
/* Send end of event record to help user space know we are finished */
|
|
|
|
ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
|
|
|
|
if (ab)
|
|
|
|
audit_log_end(ab);
|
2006-03-31 22:22:49 +02:00
|
|
|
if (call_panic)
|
|
|
|
audit_panic("error converting sid to string");
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/**
|
|
|
|
* audit_free - free a per-task audit context
|
|
|
|
* @tsk: task whose audit context block to free
|
|
|
|
*
|
2006-03-30 03:30:19 +02:00
|
|
|
* Called from copy_process and do_exit
|
2005-09-13 21:47:11 +02:00
|
|
|
*/
|
2005-04-17 00:20:36 +02:00
|
|
|
void audit_free(struct task_struct *tsk)
|
|
|
|
{
|
|
|
|
struct audit_context *context;
|
|
|
|
|
|
|
|
context = audit_get_context(tsk, 0, 0);
|
|
|
|
if (likely(!context))
|
|
|
|
return;
|
|
|
|
|
|
|
|
/* Check for system calls that do not go through the exit
|
2007-10-18 12:06:09 +02:00
|
|
|
* function (e.g., exit_group), then free context block.
|
|
|
|
* We use GFP_ATOMIC here because we might be doing this
|
2005-07-13 23:47:07 +02:00
|
|
|
* in the context of the idle thread */
|
2006-03-30 03:17:10 +02:00
|
|
|
/* that can happen only if we are called from do_exit() */
|
2005-06-20 17:07:33 +02:00
|
|
|
if (context->in_syscall && context->auditable)
|
2006-03-30 03:17:10 +02:00
|
|
|
audit_log_exit(context, tsk);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
audit_free_context(context);
|
|
|
|
}
|
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/**
|
|
|
|
* audit_syscall_entry - fill in an audit record at syscall entry
|
|
|
|
* @tsk: task being audited
|
|
|
|
* @arch: architecture type
|
|
|
|
* @major: major syscall type (function)
|
|
|
|
* @a1: additional syscall register 1
|
|
|
|
* @a2: additional syscall register 2
|
|
|
|
* @a3: additional syscall register 3
|
|
|
|
* @a4: additional syscall register 4
|
|
|
|
*
|
|
|
|
* Fill in audit context at syscall entry. This only happens if the
|
2005-04-17 00:20:36 +02:00
|
|
|
* audit context was created when the task was created and the state or
|
|
|
|
* filters demand the audit context be built. If the state from the
|
|
|
|
* per-task filter or from the per-syscall filter is AUDIT_RECORD_CONTEXT,
|
|
|
|
* then the record will be written at syscall exit time (otherwise, it
|
|
|
|
* will only be written if another part of the kernel requests that it
|
2005-09-13 21:47:11 +02:00
|
|
|
* be written).
|
|
|
|
*/
|
2006-03-30 03:23:36 +02:00
|
|
|
void audit_syscall_entry(int arch, int major,
|
2005-04-17 00:20:36 +02:00
|
|
|
unsigned long a1, unsigned long a2,
|
|
|
|
unsigned long a3, unsigned long a4)
|
|
|
|
{
|
2006-03-30 03:23:36 +02:00
|
|
|
struct task_struct *tsk = current;
|
2005-04-17 00:20:36 +02:00
|
|
|
struct audit_context *context = tsk->audit_context;
|
|
|
|
enum audit_state state;
|
|
|
|
|
2008-06-24 00:37:04 +02:00
|
|
|
if (unlikely(!context))
|
|
|
|
return;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/*
|
|
|
|
* This happens only on certain architectures that make system
|
2005-04-17 00:20:36 +02:00
|
|
|
* calls in kernel_thread via the entry.S interface, instead of
|
|
|
|
* with direct calls. (If you are porting to a new
|
|
|
|
* architecture, hitting this condition can indicate that you
|
|
|
|
* got the _exit/_leave calls backward in entry.S.)
|
|
|
|
*
|
|
|
|
* i386 no
|
|
|
|
* x86_64 no
|
2006-01-23 17:58:20 +01:00
|
|
|
* ppc64 yes (see arch/powerpc/platforms/iseries/misc.S)
|
2005-04-17 00:20:36 +02:00
|
|
|
*
|
|
|
|
* This also happens with vm86 emulation in a non-nested manner
|
|
|
|
* (entries without exits), so this case must be caught.
|
|
|
|
*/
|
|
|
|
if (context->in_syscall) {
|
|
|
|
struct audit_context *newctx;
|
|
|
|
|
|
|
|
#if AUDIT_DEBUG
|
|
|
|
printk(KERN_ERR
|
|
|
|
"audit(:%d) pid=%d in syscall=%d;"
|
|
|
|
" entering syscall=%d\n",
|
|
|
|
context->serial, tsk->pid, context->major, major);
|
|
|
|
#endif
|
|
|
|
newctx = audit_alloc_context(context->state);
|
|
|
|
if (newctx) {
|
|
|
|
newctx->previous = context;
|
|
|
|
context = newctx;
|
|
|
|
tsk->audit_context = newctx;
|
|
|
|
} else {
|
|
|
|
/* If we can't alloc a new context, the best we
|
|
|
|
* can do is to leak memory (any pending putname
|
|
|
|
* will be lost). The only other alternative is
|
|
|
|
* to abandon auditing. */
|
|
|
|
audit_zero_context(context, context->state);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
BUG_ON(context->in_syscall || context->name_count);
|
|
|
|
|
|
|
|
if (!audit_enabled)
|
|
|
|
return;
|
|
|
|
|
2005-04-29 17:08:28 +02:00
|
|
|
context->arch = arch;
|
2005-04-17 00:20:36 +02:00
|
|
|
context->major = major;
|
|
|
|
context->argv[0] = a1;
|
|
|
|
context->argv[1] = a2;
|
|
|
|
context->argv[2] = a3;
|
|
|
|
context->argv[3] = a4;
|
|
|
|
|
|
|
|
state = context->state;
|
2006-08-03 16:59:26 +02:00
|
|
|
context->dummy = !audit_n_rules;
|
|
|
|
if (!context->dummy && (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT))
|
2005-06-19 20:35:50 +02:00
|
|
|
state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (likely(state == AUDIT_DISABLED))
|
|
|
|
return;
|
|
|
|
|
2005-07-18 20:24:46 +02:00
|
|
|
context->serial = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
context->ctime = CURRENT_TIME;
|
|
|
|
context->in_syscall = 1;
|
|
|
|
context->auditable = !!(state == AUDIT_RECORD_CONTEXT);
|
2006-09-29 06:08:50 +02:00
|
|
|
context->ppid = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/**
|
|
|
|
* audit_syscall_exit - deallocate audit context after a system call
|
|
|
|
* @tsk: task being audited
|
|
|
|
* @valid: success/failure flag
|
|
|
|
* @return_code: syscall return value
|
|
|
|
*
|
|
|
|
* Tear down after system call. If the audit context has been marked as
|
2005-04-17 00:20:36 +02:00
|
|
|
* auditable (either because of the AUDIT_RECORD_CONTEXT state from
|
|
|
|
* filtering, or because some other part of the kernel write an audit
|
|
|
|
* message), then write out the syscall information. In call cases,
|
2005-09-13 21:47:11 +02:00
|
|
|
* free the names stored from getname().
|
|
|
|
*/
|
2006-03-30 03:23:36 +02:00
|
|
|
void audit_syscall_exit(int valid, long return_code)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2006-03-30 03:23:36 +02:00
|
|
|
struct task_struct *tsk = current;
|
2005-04-17 00:20:36 +02:00
|
|
|
struct audit_context *context;
|
|
|
|
|
2005-04-29 17:08:28 +02:00
|
|
|
context = audit_get_context(tsk, valid, return_code);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (likely(!context))
|
2006-03-30 03:26:24 +02:00
|
|
|
return;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2005-06-20 17:07:33 +02:00
|
|
|
if (context->in_syscall && context->auditable)
|
2006-03-30 03:17:10 +02:00
|
|
|
audit_log_exit(context, tsk);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
context->in_syscall = 0;
|
|
|
|
context->auditable = 0;
|
2005-04-29 17:08:28 +02:00
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
if (context->previous) {
|
|
|
|
struct audit_context *new_context = context->previous;
|
|
|
|
context->previous = NULL;
|
|
|
|
audit_free_context(context);
|
|
|
|
tsk->audit_context = new_context;
|
|
|
|
} else {
|
|
|
|
audit_free_names(context);
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 14:04:18 +02:00
|
|
|
unroll_tree_refs(context, NULL, 0);
|
2005-04-17 00:20:36 +02:00
|
|
|
audit_free_aux(context);
|
2007-03-30 00:01:04 +02:00
|
|
|
context->aux = NULL;
|
|
|
|
context->aux_pids = NULL;
|
2007-03-20 18:58:35 +01:00
|
|
|
context->target_pid = 0;
|
2007-03-30 00:01:04 +02:00
|
|
|
context->target_sid = 0;
|
2006-06-15 00:45:21 +02:00
|
|
|
kfree(context->filterkey);
|
|
|
|
context->filterkey = NULL;
|
2005-04-17 00:20:36 +02:00
|
|
|
tsk->audit_context = context;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 14:04:18 +02:00
|
|
|
static inline void handle_one(const struct inode *inode)
|
|
|
|
{
|
|
|
|
#ifdef CONFIG_AUDIT_TREE
|
|
|
|
struct audit_context *context;
|
|
|
|
struct audit_tree_refs *p;
|
|
|
|
struct audit_chunk *chunk;
|
|
|
|
int count;
|
|
|
|
if (likely(list_empty(&inode->inotify_watches)))
|
|
|
|
return;
|
|
|
|
context = current->audit_context;
|
|
|
|
p = context->trees;
|
|
|
|
count = context->tree_count;
|
|
|
|
rcu_read_lock();
|
|
|
|
chunk = audit_tree_lookup(inode);
|
|
|
|
rcu_read_unlock();
|
|
|
|
if (!chunk)
|
|
|
|
return;
|
|
|
|
if (likely(put_tree_ref(context, chunk)))
|
|
|
|
return;
|
|
|
|
if (unlikely(!grow_tree_refs(context))) {
|
2008-04-18 16:01:04 +02:00
|
|
|
printk(KERN_WARNING "out of memory, audit has lost a tree reference\n");
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 14:04:18 +02:00
|
|
|
audit_set_auditable(context);
|
|
|
|
audit_put_chunk(chunk);
|
|
|
|
unroll_tree_refs(context, p, count);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
put_tree_ref(context, chunk);
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
static void handle_path(const struct dentry *dentry)
|
|
|
|
{
|
|
|
|
#ifdef CONFIG_AUDIT_TREE
|
|
|
|
struct audit_context *context;
|
|
|
|
struct audit_tree_refs *p;
|
|
|
|
const struct dentry *d, *parent;
|
|
|
|
struct audit_chunk *drop;
|
|
|
|
unsigned long seq;
|
|
|
|
int count;
|
|
|
|
|
|
|
|
context = current->audit_context;
|
|
|
|
p = context->trees;
|
|
|
|
count = context->tree_count;
|
|
|
|
retry:
|
|
|
|
drop = NULL;
|
|
|
|
d = dentry;
|
|
|
|
rcu_read_lock();
|
|
|
|
seq = read_seqbegin(&rename_lock);
|
|
|
|
for(;;) {
|
|
|
|
struct inode *inode = d->d_inode;
|
|
|
|
if (inode && unlikely(!list_empty(&inode->inotify_watches))) {
|
|
|
|
struct audit_chunk *chunk;
|
|
|
|
chunk = audit_tree_lookup(inode);
|
|
|
|
if (chunk) {
|
|
|
|
if (unlikely(!put_tree_ref(context, chunk))) {
|
|
|
|
drop = chunk;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
parent = d->d_parent;
|
|
|
|
if (parent == d)
|
|
|
|
break;
|
|
|
|
d = parent;
|
|
|
|
}
|
|
|
|
if (unlikely(read_seqretry(&rename_lock, seq) || drop)) { /* in this order */
|
|
|
|
rcu_read_unlock();
|
|
|
|
if (!drop) {
|
|
|
|
/* just a race with rename */
|
|
|
|
unroll_tree_refs(context, p, count);
|
|
|
|
goto retry;
|
|
|
|
}
|
|
|
|
audit_put_chunk(drop);
|
|
|
|
if (grow_tree_refs(context)) {
|
|
|
|
/* OK, got more space */
|
|
|
|
unroll_tree_refs(context, p, count);
|
|
|
|
goto retry;
|
|
|
|
}
|
|
|
|
/* too bad */
|
|
|
|
printk(KERN_WARNING
|
2008-04-18 16:01:04 +02:00
|
|
|
"out of memory, audit has lost a tree reference\n");
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 14:04:18 +02:00
|
|
|
unroll_tree_refs(context, p, count);
|
|
|
|
audit_set_auditable(context);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
rcu_read_unlock();
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/**
|
|
|
|
* audit_getname - add a name to the list
|
|
|
|
* @name: name to add
|
|
|
|
*
|
|
|
|
* Add a name to the list of audit names for this context.
|
|
|
|
* Called from fs/namei.c:getname().
|
|
|
|
*/
|
2006-05-18 22:01:30 +02:00
|
|
|
void __audit_getname(const char *name)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
|
2006-05-18 22:01:30 +02:00
|
|
|
if (IS_ERR(name) || !name)
|
2005-04-17 00:20:36 +02:00
|
|
|
return;
|
|
|
|
|
|
|
|
if (!context->in_syscall) {
|
|
|
|
#if AUDIT_DEBUG == 2
|
|
|
|
printk(KERN_ERR "%s:%d(:%d): ignoring getname(%p)\n",
|
|
|
|
__FILE__, __LINE__, context->serial, name);
|
|
|
|
dump_stack();
|
|
|
|
#endif
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
BUG_ON(context->name_count >= AUDIT_NAMES);
|
|
|
|
context->names[context->name_count].name = name;
|
2006-06-09 05:19:31 +02:00
|
|
|
context->names[context->name_count].name_len = AUDIT_NAME_FULL;
|
|
|
|
context->names[context->name_count].name_put = 1;
|
2005-04-17 00:20:36 +02:00
|
|
|
context->names[context->name_count].ino = (unsigned long)-1;
|
2007-02-13 20:14:09 +01:00
|
|
|
context->names[context->name_count].osid = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
++context->name_count;
|
2008-02-15 04:38:33 +01:00
|
|
|
if (!context->pwd.dentry) {
|
2005-05-27 13:17:28 +02:00
|
|
|
read_lock(¤t->fs->lock);
|
2008-02-15 04:38:33 +01:00
|
|
|
context->pwd = current->fs->pwd;
|
|
|
|
path_get(¤t->fs->pwd);
|
2005-05-27 13:17:28 +02:00
|
|
|
read_unlock(¤t->fs->lock);
|
|
|
|
}
|
2007-10-18 12:06:09 +02:00
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/* audit_putname - intercept a putname request
|
|
|
|
* @name: name to intercept and delay for putname
|
|
|
|
*
|
|
|
|
* If we have stored the name from getname in the audit context,
|
|
|
|
* then we delay the putname until syscall exit.
|
|
|
|
* Called from include/linux/fs.h:putname().
|
|
|
|
*/
|
2005-04-17 00:20:36 +02:00
|
|
|
void audit_putname(const char *name)
|
|
|
|
{
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
|
|
|
|
BUG_ON(!context);
|
|
|
|
if (!context->in_syscall) {
|
|
|
|
#if AUDIT_DEBUG == 2
|
|
|
|
printk(KERN_ERR "%s:%d(:%d): __putname(%p)\n",
|
|
|
|
__FILE__, __LINE__, context->serial, name);
|
|
|
|
if (context->name_count) {
|
|
|
|
int i;
|
|
|
|
for (i = 0; i < context->name_count; i++)
|
|
|
|
printk(KERN_ERR "name[%d] = %p = %s\n", i,
|
|
|
|
context->names[i].name,
|
2005-11-03 17:00:25 +01:00
|
|
|
context->names[i].name ?: "(null)");
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
#endif
|
|
|
|
__putname(name);
|
|
|
|
}
|
|
|
|
#if AUDIT_DEBUG
|
|
|
|
else {
|
|
|
|
++context->put_count;
|
|
|
|
if (context->put_count > context->name_count) {
|
|
|
|
printk(KERN_ERR "%s:%d(:%d): major=%d"
|
|
|
|
" in_syscall=%d putname(%p) name_count=%d"
|
|
|
|
" put_count=%d\n",
|
|
|
|
__FILE__, __LINE__,
|
|
|
|
context->serial, context->major,
|
|
|
|
context->in_syscall, name, context->name_count,
|
|
|
|
context->put_count);
|
|
|
|
dump_stack();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
2007-02-13 20:15:22 +01:00
|
|
|
static int audit_inc_name_count(struct audit_context *context,
|
|
|
|
const struct inode *inode)
|
|
|
|
{
|
|
|
|
if (context->name_count >= AUDIT_NAMES) {
|
|
|
|
if (inode)
|
|
|
|
printk(KERN_DEBUG "name_count maxed, losing inode data: "
|
2008-04-18 16:01:04 +02:00
|
|
|
"dev=%02x:%02x, inode=%lu\n",
|
2007-02-13 20:15:22 +01:00
|
|
|
MAJOR(inode->i_sb->s_dev),
|
|
|
|
MINOR(inode->i_sb->s_dev),
|
|
|
|
inode->i_ino);
|
|
|
|
|
|
|
|
else
|
2008-04-18 16:01:04 +02:00
|
|
|
printk(KERN_DEBUG "name_count maxed, losing inode data\n");
|
2007-02-13 20:15:22 +01:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
context->name_count++;
|
|
|
|
#if AUDIT_DEBUG
|
|
|
|
context->ino_count++;
|
|
|
|
#endif
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2006-07-13 19:16:02 +02:00
|
|
|
/* Copy inode data into an audit_names. */
|
|
|
|
static void audit_copy_inode(struct audit_names *name, const struct inode *inode)
|
2005-11-03 18:15:16 +01:00
|
|
|
{
|
2006-07-13 19:16:02 +02:00
|
|
|
name->ino = inode->i_ino;
|
|
|
|
name->dev = inode->i_sb->s_dev;
|
|
|
|
name->mode = inode->i_mode;
|
|
|
|
name->uid = inode->i_uid;
|
|
|
|
name->gid = inode->i_gid;
|
|
|
|
name->rdev = inode->i_rdev;
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
security_inode_getsecid(inode, &name->osid);
|
2005-11-03 18:15:16 +01:00
|
|
|
}
|
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/**
|
|
|
|
* audit_inode - store the inode and device from a lookup
|
|
|
|
* @name: name being audited
|
2007-10-22 05:59:53 +02:00
|
|
|
* @dentry: dentry being audited
|
2005-09-13 21:47:11 +02:00
|
|
|
*
|
|
|
|
* Called from fs/namei.c:path_lookup().
|
|
|
|
*/
|
2007-06-07 18:19:32 +02:00
|
|
|
void __audit_inode(const char *name, const struct dentry *dentry)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
int idx;
|
|
|
|
struct audit_context *context = current->audit_context;
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 14:04:18 +02:00
|
|
|
const struct inode *inode = dentry->d_inode;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (!context->in_syscall)
|
|
|
|
return;
|
|
|
|
if (context->name_count
|
|
|
|
&& context->names[context->name_count-1].name
|
|
|
|
&& context->names[context->name_count-1].name == name)
|
|
|
|
idx = context->name_count - 1;
|
|
|
|
else if (context->name_count > 1
|
|
|
|
&& context->names[context->name_count-2].name
|
|
|
|
&& context->names[context->name_count-2].name == name)
|
|
|
|
idx = context->name_count - 2;
|
|
|
|
else {
|
|
|
|
/* FIXME: how much do we care about inodes that have no
|
|
|
|
* associated name? */
|
2007-02-13 20:15:22 +01:00
|
|
|
if (audit_inc_name_count(context, inode))
|
2005-04-17 00:20:36 +02:00
|
|
|
return;
|
2007-02-13 20:15:22 +01:00
|
|
|
idx = context->name_count - 1;
|
2005-04-17 00:20:36 +02:00
|
|
|
context->names[idx].name = NULL;
|
|
|
|
}
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 14:04:18 +02:00
|
|
|
handle_path(dentry);
|
2006-07-13 19:16:02 +02:00
|
|
|
audit_copy_inode(&context->names[idx], inode);
|
2005-11-03 17:00:25 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* audit_inode_child - collect inode info for created/removed objects
|
|
|
|
* @dname: inode's dentry name
|
2007-10-22 05:59:53 +02:00
|
|
|
* @dentry: dentry being audited
|
2006-07-13 19:16:39 +02:00
|
|
|
* @parent: inode of dentry parent
|
2005-11-03 17:00:25 +01:00
|
|
|
*
|
|
|
|
* For syscalls that create or remove filesystem objects, audit_inode
|
|
|
|
* can only collect information for the filesystem object's parent.
|
|
|
|
* This call updates the audit context with the child's information.
|
|
|
|
* Syscalls that create a new filesystem object must be hooked after
|
|
|
|
* the object is created. Syscalls that remove a filesystem object
|
|
|
|
* must be hooked prior, in order to capture the target inode during
|
|
|
|
* unsuccessful attempts.
|
|
|
|
*/
|
2007-06-07 18:19:32 +02:00
|
|
|
void __audit_inode_child(const char *dname, const struct dentry *dentry,
|
2006-07-13 19:16:39 +02:00
|
|
|
const struct inode *parent)
|
2005-11-03 17:00:25 +01:00
|
|
|
{
|
|
|
|
int idx;
|
|
|
|
struct audit_context *context = current->audit_context;
|
2007-02-13 20:15:22 +01:00
|
|
|
const char *found_parent = NULL, *found_child = NULL;
|
2007-06-07 18:19:32 +02:00
|
|
|
const struct inode *inode = dentry->d_inode;
|
2006-06-09 05:19:31 +02:00
|
|
|
int dirlen = 0;
|
2005-11-03 17:00:25 +01:00
|
|
|
|
|
|
|
if (!context->in_syscall)
|
|
|
|
return;
|
|
|
|
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 14:04:18 +02:00
|
|
|
if (inode)
|
|
|
|
handle_one(inode);
|
2005-11-03 17:00:25 +01:00
|
|
|
/* determine matching parent */
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
if (!dname)
|
2007-02-13 20:15:22 +01:00
|
|
|
goto add_names;
|
2005-11-03 17:00:25 +01:00
|
|
|
|
2007-02-13 20:15:22 +01:00
|
|
|
/* parent is more likely, look for it first */
|
|
|
|
for (idx = 0; idx < context->name_count; idx++) {
|
|
|
|
struct audit_names *n = &context->names[idx];
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
|
2007-02-13 20:15:22 +01:00
|
|
|
if (!n->name)
|
|
|
|
continue;
|
|
|
|
|
|
|
|
if (n->ino == parent->i_ino &&
|
|
|
|
!audit_compare_dname_path(dname, n->name, &dirlen)) {
|
|
|
|
n->name_len = dirlen; /* update parent data in place */
|
|
|
|
found_parent = n->name;
|
|
|
|
goto add_names;
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 22:55:56 +02:00
|
|
|
}
|
2007-02-13 20:15:22 +01:00
|
|
|
}
|
2005-11-03 17:00:25 +01:00
|
|
|
|
2007-02-13 20:15:22 +01:00
|
|
|
/* no matching parent, look for matching child */
|
|
|
|
for (idx = 0; idx < context->name_count; idx++) {
|
|
|
|
struct audit_names *n = &context->names[idx];
|
|
|
|
|
|
|
|
if (!n->name)
|
|
|
|
continue;
|
|
|
|
|
|
|
|
/* strcmp() is the more likely scenario */
|
|
|
|
if (!strcmp(dname, n->name) ||
|
|
|
|
!audit_compare_dname_path(dname, n->name, &dirlen)) {
|
|
|
|
if (inode)
|
|
|
|
audit_copy_inode(n, inode);
|
|
|
|
else
|
|
|
|
n->ino = (unsigned long)-1;
|
|
|
|
found_child = n->name;
|
|
|
|
goto add_names;
|
|
|
|
}
|
2006-09-28 20:31:32 +02:00
|
|
|
}
|
2007-02-13 20:15:22 +01:00
|
|
|
|
|
|
|
add_names:
|
|
|
|
if (!found_parent) {
|
|
|
|
if (audit_inc_name_count(context, parent))
|
2006-09-28 20:31:32 +02:00
|
|
|
return;
|
2007-02-13 20:15:22 +01:00
|
|
|
idx = context->name_count - 1;
|
|
|
|
context->names[idx].name = NULL;
|
2006-07-13 19:16:39 +02:00
|
|
|
audit_copy_inode(&context->names[idx], parent);
|
|
|
|
}
|
2007-02-13 20:15:22 +01:00
|
|
|
|
|
|
|
if (!found_child) {
|
|
|
|
if (audit_inc_name_count(context, inode))
|
|
|
|
return;
|
|
|
|
idx = context->name_count - 1;
|
|
|
|
|
|
|
|
/* Re-use the name belonging to the slot for a matching parent
|
|
|
|
* directory. All names for this context are relinquished in
|
|
|
|
* audit_free_names() */
|
|
|
|
if (found_parent) {
|
|
|
|
context->names[idx].name = found_parent;
|
|
|
|
context->names[idx].name_len = AUDIT_NAME_FULL;
|
|
|
|
/* don't call __putname() */
|
|
|
|
context->names[idx].name_put = 0;
|
|
|
|
} else {
|
|
|
|
context->names[idx].name = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (inode)
|
|
|
|
audit_copy_inode(&context->names[idx], inode);
|
|
|
|
else
|
|
|
|
context->names[idx].ino = (unsigned long)-1;
|
|
|
|
}
|
2006-07-13 19:16:02 +02:00
|
|
|
}
|
2007-06-08 04:44:34 +02:00
|
|
|
EXPORT_SYMBOL_GPL(__audit_inode_child);
|
2006-07-13 19:16:02 +02:00
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/**
|
|
|
|
* auditsc_get_stamp - get local copies of audit_context values
|
|
|
|
* @ctx: audit_context for the task
|
|
|
|
* @t: timespec to store time recorded in the audit_context
|
|
|
|
* @serial: serial value that is recorded in the audit_context
|
|
|
|
*
|
|
|
|
* Also sets the context as auditable.
|
|
|
|
*/
|
2005-05-21 22:08:09 +02:00
|
|
|
void auditsc_get_stamp(struct audit_context *ctx,
|
|
|
|
struct timespec *t, unsigned int *serial)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2005-07-18 20:24:46 +02:00
|
|
|
if (!ctx->serial)
|
|
|
|
ctx->serial = audit_serial();
|
2005-05-21 22:08:09 +02:00
|
|
|
t->tv_sec = ctx->ctime.tv_sec;
|
|
|
|
t->tv_nsec = ctx->ctime.tv_nsec;
|
|
|
|
*serial = ctx->serial;
|
|
|
|
ctx->auditable = 1;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2008-01-08 16:06:53 +01:00
|
|
|
/* global counter which is incremented every time something logs in */
|
|
|
|
static atomic_t session_id = ATOMIC_INIT(0);
|
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/**
|
|
|
|
* audit_set_loginuid - set a task's audit_context loginuid
|
|
|
|
* @task: task whose audit context is being modified
|
|
|
|
* @loginuid: loginuid value
|
|
|
|
*
|
|
|
|
* Returns 0.
|
|
|
|
*
|
|
|
|
* Called (set) from fs/proc/base.c::proc_loginuid_write().
|
|
|
|
*/
|
2005-04-29 18:30:07 +02:00
|
|
|
int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2008-01-08 16:06:53 +01:00
|
|
|
unsigned int sessionid = atomic_inc_return(&session_id);
|
2006-06-12 13:48:28 +02:00
|
|
|
struct audit_context *context = task->audit_context;
|
|
|
|
|
2008-01-10 10:53:18 +01:00
|
|
|
if (context && context->in_syscall) {
|
|
|
|
struct audit_buffer *ab;
|
|
|
|
|
|
|
|
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
|
|
|
|
if (ab) {
|
|
|
|
audit_log_format(ab, "login pid=%d uid=%u "
|
2008-01-08 16:06:53 +01:00
|
|
|
"old auid=%u new auid=%u"
|
|
|
|
" old ses=%u new ses=%u",
|
2008-01-10 10:53:18 +01:00
|
|
|
task->pid, task->uid,
|
2008-01-08 16:06:53 +01:00
|
|
|
task->loginuid, loginuid,
|
|
|
|
task->sessionid, sessionid);
|
2008-01-10 10:53:18 +01:00
|
|
|
audit_log_end(ab);
|
2005-05-13 19:17:42 +02:00
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
2008-01-08 16:06:53 +01:00
|
|
|
task->sessionid = sessionid;
|
2008-01-10 10:53:18 +01:00
|
|
|
task->loginuid = loginuid;
|
2005-04-17 00:20:36 +02:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2006-05-24 23:09:55 +02:00
|
|
|
/**
|
|
|
|
* __audit_mq_open - record audit data for a POSIX MQ open
|
|
|
|
* @oflag: open flag
|
|
|
|
* @mode: mode bits
|
|
|
|
* @u_attr: queue attributes
|
|
|
|
*
|
|
|
|
* Returns 0 for success or NULL context or < 0 on error.
|
|
|
|
*/
|
|
|
|
int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr)
|
|
|
|
{
|
|
|
|
struct audit_aux_data_mq_open *ax;
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
|
|
|
|
if (!audit_enabled)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if (likely(!context))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
|
|
|
|
if (!ax)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
if (u_attr != NULL) {
|
|
|
|
if (copy_from_user(&ax->attr, u_attr, sizeof(ax->attr))) {
|
|
|
|
kfree(ax);
|
|
|
|
return -EFAULT;
|
|
|
|
}
|
|
|
|
} else
|
|
|
|
memset(&ax->attr, 0, sizeof(ax->attr));
|
|
|
|
|
|
|
|
ax->oflag = oflag;
|
|
|
|
ax->mode = mode;
|
|
|
|
|
|
|
|
ax->d.type = AUDIT_MQ_OPEN;
|
|
|
|
ax->d.next = context->aux;
|
|
|
|
context->aux = (void *)ax;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* __audit_mq_timedsend - record audit data for a POSIX MQ timed send
|
|
|
|
* @mqdes: MQ descriptor
|
|
|
|
* @msg_len: Message length
|
|
|
|
* @msg_prio: Message priority
|
2006-06-27 11:54:01 +02:00
|
|
|
* @u_abs_timeout: Message timeout in absolute time
|
2006-05-24 23:09:55 +02:00
|
|
|
*
|
|
|
|
* Returns 0 for success or NULL context or < 0 on error.
|
|
|
|
*/
|
|
|
|
int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio,
|
|
|
|
const struct timespec __user *u_abs_timeout)
|
|
|
|
{
|
|
|
|
struct audit_aux_data_mq_sendrecv *ax;
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
|
|
|
|
if (!audit_enabled)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if (likely(!context))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
|
|
|
|
if (!ax)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
if (u_abs_timeout != NULL) {
|
|
|
|
if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) {
|
|
|
|
kfree(ax);
|
|
|
|
return -EFAULT;
|
|
|
|
}
|
|
|
|
} else
|
|
|
|
memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout));
|
|
|
|
|
|
|
|
ax->mqdes = mqdes;
|
|
|
|
ax->msg_len = msg_len;
|
|
|
|
ax->msg_prio = msg_prio;
|
|
|
|
|
|
|
|
ax->d.type = AUDIT_MQ_SENDRECV;
|
|
|
|
ax->d.next = context->aux;
|
|
|
|
context->aux = (void *)ax;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* __audit_mq_timedreceive - record audit data for a POSIX MQ timed receive
|
|
|
|
* @mqdes: MQ descriptor
|
|
|
|
* @msg_len: Message length
|
2006-06-27 11:54:01 +02:00
|
|
|
* @u_msg_prio: Message priority
|
|
|
|
* @u_abs_timeout: Message timeout in absolute time
|
2006-05-24 23:09:55 +02:00
|
|
|
*
|
|
|
|
* Returns 0 for success or NULL context or < 0 on error.
|
|
|
|
*/
|
|
|
|
int __audit_mq_timedreceive(mqd_t mqdes, size_t msg_len,
|
|
|
|
unsigned int __user *u_msg_prio,
|
|
|
|
const struct timespec __user *u_abs_timeout)
|
|
|
|
{
|
|
|
|
struct audit_aux_data_mq_sendrecv *ax;
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
|
|
|
|
if (!audit_enabled)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if (likely(!context))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
|
|
|
|
if (!ax)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
if (u_msg_prio != NULL) {
|
|
|
|
if (get_user(ax->msg_prio, u_msg_prio)) {
|
|
|
|
kfree(ax);
|
|
|
|
return -EFAULT;
|
|
|
|
}
|
|
|
|
} else
|
|
|
|
ax->msg_prio = 0;
|
|
|
|
|
|
|
|
if (u_abs_timeout != NULL) {
|
|
|
|
if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) {
|
|
|
|
kfree(ax);
|
|
|
|
return -EFAULT;
|
|
|
|
}
|
|
|
|
} else
|
|
|
|
memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout));
|
|
|
|
|
|
|
|
ax->mqdes = mqdes;
|
|
|
|
ax->msg_len = msg_len;
|
|
|
|
|
|
|
|
ax->d.type = AUDIT_MQ_SENDRECV;
|
|
|
|
ax->d.next = context->aux;
|
|
|
|
context->aux = (void *)ax;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* __audit_mq_notify - record audit data for a POSIX MQ notify
|
|
|
|
* @mqdes: MQ descriptor
|
|
|
|
* @u_notification: Notification event
|
|
|
|
*
|
|
|
|
* Returns 0 for success or NULL context or < 0 on error.
|
|
|
|
*/
|
|
|
|
|
|
|
|
int __audit_mq_notify(mqd_t mqdes, const struct sigevent __user *u_notification)
|
|
|
|
{
|
|
|
|
struct audit_aux_data_mq_notify *ax;
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
|
|
|
|
if (!audit_enabled)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if (likely(!context))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
|
|
|
|
if (!ax)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
if (u_notification != NULL) {
|
|
|
|
if (copy_from_user(&ax->notification, u_notification, sizeof(ax->notification))) {
|
|
|
|
kfree(ax);
|
|
|
|
return -EFAULT;
|
|
|
|
}
|
|
|
|
} else
|
|
|
|
memset(&ax->notification, 0, sizeof(ax->notification));
|
|
|
|
|
|
|
|
ax->mqdes = mqdes;
|
|
|
|
|
|
|
|
ax->d.type = AUDIT_MQ_NOTIFY;
|
|
|
|
ax->d.next = context->aux;
|
|
|
|
context->aux = (void *)ax;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* __audit_mq_getsetattr - record audit data for a POSIX MQ get/set attribute
|
|
|
|
* @mqdes: MQ descriptor
|
|
|
|
* @mqstat: MQ flags
|
|
|
|
*
|
|
|
|
* Returns 0 for success or NULL context or < 0 on error.
|
|
|
|
*/
|
|
|
|
int __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
|
|
|
|
{
|
|
|
|
struct audit_aux_data_mq_getsetattr *ax;
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
|
|
|
|
if (!audit_enabled)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if (likely(!context))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
|
|
|
|
if (!ax)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
ax->mqdes = mqdes;
|
|
|
|
ax->mqstat = *mqstat;
|
|
|
|
|
|
|
|
ax->d.type = AUDIT_MQ_GETSETATTR;
|
|
|
|
ax->d.next = context->aux;
|
|
|
|
context->aux = (void *)ax;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/**
|
2006-04-02 23:07:33 +02:00
|
|
|
* audit_ipc_obj - record audit data for ipc object
|
|
|
|
* @ipcp: ipc permissions
|
|
|
|
*
|
|
|
|
* Returns 0 for success or NULL context or < 0 on error.
|
|
|
|
*/
|
2006-05-18 22:01:30 +02:00
|
|
|
int __audit_ipc_obj(struct kern_ipc_perm *ipcp)
|
2006-04-02 23:07:33 +02:00
|
|
|
{
|
|
|
|
struct audit_aux_data_ipcctl *ax;
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
|
|
|
|
ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
|
|
|
|
if (!ax)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
ax->uid = ipcp->uid;
|
|
|
|
ax->gid = ipcp->gid;
|
|
|
|
ax->mode = ipcp->mode;
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
security_ipc_getsecid(ipcp, &ax->osid);
|
2006-04-02 23:07:33 +02:00
|
|
|
ax->d.type = AUDIT_IPC;
|
|
|
|
ax->d.next = context->aux;
|
|
|
|
context->aux = (void *)ax;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* audit_ipc_set_perm - record audit data for new ipc permissions
|
2005-09-13 21:47:11 +02:00
|
|
|
* @qbytes: msgq bytes
|
|
|
|
* @uid: msgq user id
|
|
|
|
* @gid: msgq group id
|
|
|
|
* @mode: msgq mode (permissions)
|
|
|
|
*
|
|
|
|
* Returns 0 for success or NULL context or < 0 on error.
|
|
|
|
*/
|
2006-05-18 22:01:30 +02:00
|
|
|
int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct audit_aux_data_ipcctl *ax;
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
|
2005-11-03 18:15:16 +01:00
|
|
|
ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!ax)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
ax->qbytes = qbytes;
|
|
|
|
ax->uid = uid;
|
|
|
|
ax->gid = gid;
|
|
|
|
ax->mode = mode;
|
|
|
|
|
2006-04-02 23:07:33 +02:00
|
|
|
ax->d.type = AUDIT_IPC_SET_PERM;
|
2005-04-17 00:20:36 +02:00
|
|
|
ax->d.next = context->aux;
|
|
|
|
context->aux = (void *)ax;
|
|
|
|
return 0;
|
|
|
|
}
|
2005-05-06 13:38:39 +02:00
|
|
|
|
2006-04-26 20:04:08 +02:00
|
|
|
int audit_bprm(struct linux_binprm *bprm)
|
|
|
|
{
|
|
|
|
struct audit_aux_data_execve *ax;
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
|
2006-07-16 12:38:45 +02:00
|
|
|
if (likely(!audit_enabled || !context || context->dummy))
|
2006-04-26 20:04:08 +02:00
|
|
|
return 0;
|
|
|
|
|
2007-07-19 10:48:15 +02:00
|
|
|
ax = kmalloc(sizeof(*ax), GFP_KERNEL);
|
2006-04-26 20:04:08 +02:00
|
|
|
if (!ax)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
ax->argc = bprm->argc;
|
|
|
|
ax->envc = bprm->envc;
|
2007-07-19 10:48:15 +02:00
|
|
|
ax->mm = bprm->mm;
|
2006-04-26 20:04:08 +02:00
|
|
|
ax->d.type = AUDIT_EXECVE;
|
|
|
|
ax->d.next = context->aux;
|
|
|
|
context->aux = (void *)ax;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/**
|
|
|
|
* audit_socketcall - record audit data for sys_socketcall
|
|
|
|
* @nargs: number of args
|
|
|
|
* @args: args array
|
|
|
|
*
|
|
|
|
* Returns 0 for success or NULL context or < 0 on error.
|
|
|
|
*/
|
2005-05-17 13:08:48 +02:00
|
|
|
int audit_socketcall(int nargs, unsigned long *args)
|
|
|
|
{
|
|
|
|
struct audit_aux_data_socketcall *ax;
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
|
2006-07-16 12:38:45 +02:00
|
|
|
if (likely(!context || context->dummy))
|
2005-05-17 13:08:48 +02:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
ax = kmalloc(sizeof(*ax) + nargs * sizeof(unsigned long), GFP_KERNEL);
|
|
|
|
if (!ax)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
ax->nargs = nargs;
|
|
|
|
memcpy(ax->args, args, nargs * sizeof(unsigned long));
|
|
|
|
|
|
|
|
ax->d.type = AUDIT_SOCKETCALL;
|
|
|
|
ax->d.next = context->aux;
|
|
|
|
context->aux = (void *)ax;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-02-07 07:48:00 +01:00
|
|
|
/**
|
|
|
|
* __audit_fd_pair - record audit data for pipe and socketpair
|
|
|
|
* @fd1: the first file descriptor
|
|
|
|
* @fd2: the second file descriptor
|
|
|
|
*
|
|
|
|
* Returns 0 for success or NULL context or < 0 on error.
|
|
|
|
*/
|
|
|
|
int __audit_fd_pair(int fd1, int fd2)
|
|
|
|
{
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
struct audit_aux_data_fd_pair *ax;
|
|
|
|
|
|
|
|
if (likely(!context)) {
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
ax = kmalloc(sizeof(*ax), GFP_KERNEL);
|
|
|
|
if (!ax) {
|
|
|
|
return -ENOMEM;
|
|
|
|
}
|
|
|
|
|
|
|
|
ax->fd[0] = fd1;
|
|
|
|
ax->fd[1] = fd2;
|
|
|
|
|
|
|
|
ax->d.type = AUDIT_FD_PAIR;
|
|
|
|
ax->d.next = context->aux;
|
|
|
|
context->aux = (void *)ax;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/**
|
|
|
|
* audit_sockaddr - record audit data for sys_bind, sys_connect, sys_sendto
|
|
|
|
* @len: data length in user space
|
|
|
|
* @a: data address in kernel space
|
|
|
|
*
|
|
|
|
* Returns 0 for success or NULL context or < 0 on error.
|
|
|
|
*/
|
2005-05-17 13:08:48 +02:00
|
|
|
int audit_sockaddr(int len, void *a)
|
|
|
|
{
|
|
|
|
struct audit_aux_data_sockaddr *ax;
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
|
2006-07-16 12:38:45 +02:00
|
|
|
if (likely(!context || context->dummy))
|
2005-05-17 13:08:48 +02:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
ax = kmalloc(sizeof(*ax) + len, GFP_KERNEL);
|
|
|
|
if (!ax)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
ax->len = len;
|
|
|
|
memcpy(ax->a, a, len);
|
|
|
|
|
|
|
|
ax->d.type = AUDIT_SOCKADDR;
|
|
|
|
ax->d.next = context->aux;
|
|
|
|
context->aux = (void *)ax;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-03-20 18:58:35 +01:00
|
|
|
void __audit_ptrace(struct task_struct *t)
|
|
|
|
{
|
|
|
|
struct audit_context *context = current->audit_context;
|
|
|
|
|
|
|
|
context->target_pid = t->pid;
|
2008-01-07 19:40:17 +01:00
|
|
|
context->target_auid = audit_get_loginuid(t);
|
|
|
|
context->target_uid = t->uid;
|
2008-01-08 16:06:53 +01:00
|
|
|
context->target_sessionid = audit_get_sessionid(t);
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
security_task_getsecid(t, &context->target_sid);
|
2008-01-07 19:40:17 +01:00
|
|
|
memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
|
2007-03-20 18:58:35 +01:00
|
|
|
}
|
|
|
|
|
2005-09-13 21:47:11 +02:00
|
|
|
/**
|
|
|
|
* audit_signal_info - record signal info for shutting down audit subsystem
|
|
|
|
* @sig: signal value
|
|
|
|
* @t: task being signaled
|
|
|
|
*
|
|
|
|
* If the audit subsystem is being terminated, record the task (pid)
|
|
|
|
* and uid that is doing that.
|
|
|
|
*/
|
2007-03-30 00:01:04 +02:00
|
|
|
int __audit_signal_info(int sig, struct task_struct *t)
|
2005-05-06 13:38:39 +02:00
|
|
|
{
|
2007-03-30 00:01:04 +02:00
|
|
|
struct audit_aux_data_pids *axp;
|
|
|
|
struct task_struct *tsk = current;
|
|
|
|
struct audit_context *ctx = tsk->audit_context;
|
2006-05-25 16:19:47 +02:00
|
|
|
|
2007-08-08 01:01:46 +02:00
|
|
|
if (audit_pid && t->tgid == audit_pid) {
|
2008-07-07 16:49:45 +02:00
|
|
|
if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1 || sig == SIGUSR2) {
|
2007-08-08 01:01:46 +02:00
|
|
|
audit_sig_pid = tsk->pid;
|
2008-01-10 10:53:18 +01:00
|
|
|
if (tsk->loginuid != -1)
|
|
|
|
audit_sig_uid = tsk->loginuid;
|
2007-08-08 01:01:46 +02:00
|
|
|
else
|
|
|
|
audit_sig_uid = tsk->uid;
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
security_task_getsecid(tsk, &audit_sig_sid);
|
2007-08-08 01:01:46 +02:00
|
|
|
}
|
|
|
|
if (!audit_signals || audit_dummy_context())
|
|
|
|
return 0;
|
2005-05-06 13:38:39 +02:00
|
|
|
}
|
2007-03-30 00:01:04 +02:00
|
|
|
|
|
|
|
/* optimize the common case by putting first signal recipient directly
|
|
|
|
* in audit_context */
|
|
|
|
if (!ctx->target_pid) {
|
|
|
|
ctx->target_pid = t->tgid;
|
2008-01-07 19:40:17 +01:00
|
|
|
ctx->target_auid = audit_get_loginuid(t);
|
|
|
|
ctx->target_uid = t->uid;
|
2008-01-08 16:06:53 +01:00
|
|
|
ctx->target_sessionid = audit_get_sessionid(t);
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
security_task_getsecid(t, &ctx->target_sid);
|
2008-01-07 19:40:17 +01:00
|
|
|
memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
|
2007-03-30 00:01:04 +02:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
axp = (void *)ctx->aux_pids;
|
|
|
|
if (!axp || axp->pid_count == AUDIT_AUX_PIDS) {
|
|
|
|
axp = kzalloc(sizeof(*axp), GFP_ATOMIC);
|
|
|
|
if (!axp)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
axp->d.type = AUDIT_OBJ_PID;
|
|
|
|
axp->d.next = ctx->aux_pids;
|
|
|
|
ctx->aux_pids = (void *)axp;
|
|
|
|
}
|
2007-08-22 23:01:05 +02:00
|
|
|
BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
|
2007-03-30 00:01:04 +02:00
|
|
|
|
|
|
|
axp->target_pid[axp->pid_count] = t->tgid;
|
2008-01-07 19:40:17 +01:00
|
|
|
axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
|
|
|
|
axp->target_uid[axp->pid_count] = t->uid;
|
2008-01-08 16:06:53 +01:00
|
|
|
axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t);
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
security_task_getsecid(t, &axp->target_sid[axp->pid_count]);
|
2008-01-07 19:40:17 +01:00
|
|
|
memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
|
2007-03-30 00:01:04 +02:00
|
|
|
axp->pid_count++;
|
|
|
|
|
|
|
|
return 0;
|
2005-05-06 13:38:39 +02:00
|
|
|
}
|
2007-04-19 16:28:21 +02:00
|
|
|
|
|
|
|
/**
|
|
|
|
* audit_core_dumps - record information about processes that end abnormally
|
2007-07-16 08:41:10 +02:00
|
|
|
* @signr: signal value
|
2007-04-19 16:28:21 +02:00
|
|
|
*
|
|
|
|
* If a process ends with a core dump, something fishy is going on and we
|
|
|
|
* should record the event for investigation.
|
|
|
|
*/
|
|
|
|
void audit_core_dumps(long signr)
|
|
|
|
{
|
|
|
|
struct audit_buffer *ab;
|
|
|
|
u32 sid;
|
2008-01-08 16:06:53 +01:00
|
|
|
uid_t auid = audit_get_loginuid(current);
|
|
|
|
unsigned int sessionid = audit_get_sessionid(current);
|
2007-04-19 16:28:21 +02:00
|
|
|
|
|
|
|
if (!audit_enabled)
|
|
|
|
return;
|
|
|
|
|
|
|
|
if (signr == SIGQUIT) /* don't care for those */
|
|
|
|
return;
|
|
|
|
|
|
|
|
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
|
2008-01-08 16:06:53 +01:00
|
|
|
audit_log_format(ab, "auid=%u uid=%u gid=%u ses=%u",
|
|
|
|
auid, current->uid, current->gid, sessionid);
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
security_task_getsecid(current, &sid);
|
2007-04-19 16:28:21 +02:00
|
|
|
if (sid) {
|
|
|
|
char *ctx = NULL;
|
|
|
|
u32 len;
|
|
|
|
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
if (security_secid_to_secctx(sid, &ctx, &len))
|
2007-04-19 16:28:21 +02:00
|
|
|
audit_log_format(ab, " ssid=%u", sid);
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
else {
|
2007-04-19 16:28:21 +02:00
|
|
|
audit_log_format(ab, " subj=%s", ctx);
|
Audit: use new LSM hooks instead of SELinux exports
Stop using the following exported SELinux interfaces:
selinux_get_inode_sid(inode, sid)
selinux_get_ipc_sid(ipcp, sid)
selinux_get_task_sid(tsk, sid)
selinux_sid_to_string(sid, ctx, len)
kfree(ctx)
and use following generic LSM equivalents respectively:
security_inode_getsecid(inode, secid)
security_ipc_getsecid*(ipcp, secid)
security_task_getsecid(tsk, secid)
security_sid_to_secctx(sid, ctx, len)
security_release_secctx(ctx, len)
Call security_release_secctx only if security_secid_to_secctx
succeeded.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Reviewed-by: Paul Moore <paul.moore@hp.com>
2008-03-01 20:54:38 +01:00
|
|
|
security_release_secctx(ctx, len);
|
|
|
|
}
|
2007-04-19 16:28:21 +02:00
|
|
|
}
|
|
|
|
audit_log_format(ab, " pid=%d comm=", current->pid);
|
|
|
|
audit_log_untrustedstring(ab, current->comm);
|
|
|
|
audit_log_format(ab, " sig=%ld", signr);
|
|
|
|
audit_log_end(ab);
|
|
|
|
}
|