1fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse/* audit -- definition of audit_context structure and supporting types 2fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * 3fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * Copyright 2003-2004 Red Hat, Inc. 4fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * Copyright 2005 Hewlett-Packard Development Company, L.P. 5fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * Copyright 2005 IBM Corporation 6fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * 7fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * This program is free software; you can redistribute it and/or modify 8fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * it under the terms of the GNU General Public License as published by 9fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * the Free Software Foundation; either version 2 of the License, or 10fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * (at your option) any later version. 11fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * 12fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * This program is distributed in the hope that it will be useful, 13fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * but WITHOUT ANY WARRANTY; without even the implied warranty of 14fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * GNU General Public License for more details. 16fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * 17fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * You should have received a copy of the GNU General Public License 18fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * along with this program; if not, write to the Free Software 19fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 20fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse */ 21fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse 22fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse#include <linux/fs.h> 23fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse#include <linux/audit.h> 249044e6bca5a4a575d3c068dfccb5651a2d6a13bcAl Viro#include <linux/skbuff.h> 25b24a30a7305418ff138ff51776fc555ec57c011aEric Paris#include <uapi/linux/mqueue.h> 26fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse 27fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse/* 0 = no checking 28fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse 1 = put_count checking 29fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse 2 = verbose put_count checking 30fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse*/ 31fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse#define AUDIT_DEBUG 0 32fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse 33b24a30a7305418ff138ff51776fc555ec57c011aEric Paris/* AUDIT_NAMES is the number of slots we reserve in the audit_context 34b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * for saving names from getname(). If we get more names we will allocate 35b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * a name dynamically and also add those to the list anchored by names_list. */ 36b24a30a7305418ff138ff51776fc555ec57c011aEric Paris#define AUDIT_NAMES 5 37b24a30a7305418ff138ff51776fc555ec57c011aEric Paris 38fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse/* At task start time, the audit_state is set in the audit_context using 39fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse a per-task filter. At syscall entry, the audit_state is augmented by 40fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse the syscall filter. */ 41fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouseenum audit_state { 42fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse AUDIT_DISABLED, /* Do not create per-task audit_context. 43fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * No syscall-specific audit records can 44fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * be generated. */ 45fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context, 46997f5b6444f4608692ec807fb802fd9767c80e76Eric Paris * and fill it in at syscall 47fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * entry time. This makes a full 48fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * syscall record available if some 49fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * other part of the kernel decides it 50fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * should be recorded. */ 51fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse AUDIT_RECORD_CONTEXT /* Create the per-task audit_context, 52fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * always fill it in at syscall entry 53fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * time, and always write out the audit 54fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse * record at syscall exit time. */ 55fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse}; 56fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse 57fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse/* Rule lists */ 58cfcad62c74abfef83762dc05a556d21bdf3980a2Eric Parisstruct audit_watch; 5974c3cbe33bc077ac1159cadfea608b501e100344Al Virostruct audit_tree; 6074c3cbe33bc077ac1159cadfea608b501e100344Al Virostruct audit_chunk; 6174c3cbe33bc077ac1159cadfea608b501e100344Al Viro 62fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhousestruct audit_entry { 6393315ed6dd12dacfc941f9eb8ca0293aadf99793Amy Griffis struct list_head list; 6493315ed6dd12dacfc941f9eb8ca0293aadf99793Amy Griffis struct rcu_head rcu; 6593315ed6dd12dacfc941f9eb8ca0293aadf99793Amy Griffis struct audit_krule rule; 66fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse}; 67fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse 68b24a30a7305418ff138ff51776fc555ec57c011aEric Parisstruct audit_cap_data { 69b24a30a7305418ff138ff51776fc555ec57c011aEric Paris kernel_cap_t permitted; 70b24a30a7305418ff138ff51776fc555ec57c011aEric Paris kernel_cap_t inheritable; 71b24a30a7305418ff138ff51776fc555ec57c011aEric Paris union { 72b24a30a7305418ff138ff51776fc555ec57c011aEric Paris unsigned int fE; /* effective bit of file cap */ 73b24a30a7305418ff138ff51776fc555ec57c011aEric Paris kernel_cap_t effective; /* effective set of process */ 74b24a30a7305418ff138ff51776fc555ec57c011aEric Paris }; 75b24a30a7305418ff138ff51776fc555ec57c011aEric Paris}; 76b24a30a7305418ff138ff51776fc555ec57c011aEric Paris 77b24a30a7305418ff138ff51776fc555ec57c011aEric Paris/* When fs/namei.c:getname() is called, we store the pointer in name and 78b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * we don't let putname() free it (instead we free all of the saved 79b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * pointers at syscall exit time). 80b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * 81b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * Further, in fs/namei.c:path_lookup() we store the inode and device. 82b24a30a7305418ff138ff51776fc555ec57c011aEric Paris */ 83b24a30a7305418ff138ff51776fc555ec57c011aEric Parisstruct audit_names { 84b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct list_head list; /* audit_context->names_list */ 85b24a30a7305418ff138ff51776fc555ec57c011aEric Paris 86b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct filename *name; 87b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int name_len; /* number of chars to log */ 8879f6530cb59e2a0af6953742a33cc29e98ca631cJeff Layton bool hidden; /* don't log this record */ 89b24a30a7305418ff138ff51776fc555ec57c011aEric Paris bool name_put; /* call __putname()? */ 90b24a30a7305418ff138ff51776fc555ec57c011aEric Paris 91b24a30a7305418ff138ff51776fc555ec57c011aEric Paris unsigned long ino; 92b24a30a7305418ff138ff51776fc555ec57c011aEric Paris dev_t dev; 93b24a30a7305418ff138ff51776fc555ec57c011aEric Paris umode_t mode; 94b24a30a7305418ff138ff51776fc555ec57c011aEric Paris kuid_t uid; 95b24a30a7305418ff138ff51776fc555ec57c011aEric Paris kgid_t gid; 96b24a30a7305418ff138ff51776fc555ec57c011aEric Paris dev_t rdev; 97b24a30a7305418ff138ff51776fc555ec57c011aEric Paris u32 osid; 98b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct audit_cap_data fcap; 99b24a30a7305418ff138ff51776fc555ec57c011aEric Paris unsigned int fcap_ver; 100b24a30a7305418ff138ff51776fc555ec57c011aEric Paris unsigned char type; /* record type */ 101b24a30a7305418ff138ff51776fc555ec57c011aEric Paris /* 102b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * This was an allocated audit_names and not from the array of 103b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * names allocated in the task audit context. Thus this name 104b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * should be freed on syscall exit. 105b24a30a7305418ff138ff51776fc555ec57c011aEric Paris */ 106b24a30a7305418ff138ff51776fc555ec57c011aEric Paris bool should_free; 107b24a30a7305418ff138ff51776fc555ec57c011aEric Paris}; 108b24a30a7305418ff138ff51776fc555ec57c011aEric Paris 1093f1c82502c299da08b7b7f08b435212e51166ed9William Robertsstruct audit_proctitle { 1103f1c82502c299da08b7b7f08b435212e51166ed9William Roberts int len; /* length of the cmdline field. */ 1113f1c82502c299da08b7b7f08b435212e51166ed9William Roberts char *value; /* the cmdline field */ 1123f1c82502c299da08b7b7f08b435212e51166ed9William Roberts}; 1133f1c82502c299da08b7b7f08b435212e51166ed9William Roberts 114b24a30a7305418ff138ff51776fc555ec57c011aEric Paris/* The per-task audit context. */ 115b24a30a7305418ff138ff51776fc555ec57c011aEric Parisstruct audit_context { 116b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int dummy; /* must be the first element */ 117b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int in_syscall; /* 1 if task is in a syscall */ 118b24a30a7305418ff138ff51776fc555ec57c011aEric Paris enum audit_state state, current_state; 119b24a30a7305418ff138ff51776fc555ec57c011aEric Paris unsigned int serial; /* serial number for record */ 120b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int major; /* syscall number */ 121b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct timespec ctime; /* time of syscall entry */ 122b24a30a7305418ff138ff51776fc555ec57c011aEric Paris unsigned long argv[4]; /* syscall arguments */ 123b24a30a7305418ff138ff51776fc555ec57c011aEric Paris long return_code;/* syscall return code */ 124b24a30a7305418ff138ff51776fc555ec57c011aEric Paris u64 prio; 125b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int return_valid; /* return code is valid */ 126b24a30a7305418ff138ff51776fc555ec57c011aEric Paris /* 127b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * The names_list is the list of all audit_names collected during this 128b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * syscall. The first AUDIT_NAMES entries in the names_list will 129b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * actually be from the preallocated_names array for performance 130b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * reasons. Except during allocation they should never be referenced 131b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * through the preallocated_names array and should only be found/used 132b24a30a7305418ff138ff51776fc555ec57c011aEric Paris * by running the names_list. 133b24a30a7305418ff138ff51776fc555ec57c011aEric Paris */ 134b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct audit_names preallocated_names[AUDIT_NAMES]; 135b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int name_count; /* total records in names_list */ 136b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct list_head names_list; /* struct audit_names->list anchor */ 137b24a30a7305418ff138ff51776fc555ec57c011aEric Paris char *filterkey; /* key for rule that triggered record */ 138b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct path pwd; 139b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct audit_aux_data *aux; 140b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct audit_aux_data *aux_pids; 141b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct sockaddr_storage *sockaddr; 142b24a30a7305418ff138ff51776fc555ec57c011aEric Paris size_t sockaddr_len; 143b24a30a7305418ff138ff51776fc555ec57c011aEric Paris /* Save things to print about task_struct */ 144b24a30a7305418ff138ff51776fc555ec57c011aEric Paris pid_t pid, ppid; 145b24a30a7305418ff138ff51776fc555ec57c011aEric Paris kuid_t uid, euid, suid, fsuid; 146b24a30a7305418ff138ff51776fc555ec57c011aEric Paris kgid_t gid, egid, sgid, fsgid; 147b24a30a7305418ff138ff51776fc555ec57c011aEric Paris unsigned long personality; 148b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int arch; 149b24a30a7305418ff138ff51776fc555ec57c011aEric Paris 150b24a30a7305418ff138ff51776fc555ec57c011aEric Paris pid_t target_pid; 151b24a30a7305418ff138ff51776fc555ec57c011aEric Paris kuid_t target_auid; 152b24a30a7305418ff138ff51776fc555ec57c011aEric Paris kuid_t target_uid; 153b24a30a7305418ff138ff51776fc555ec57c011aEric Paris unsigned int target_sessionid; 154b24a30a7305418ff138ff51776fc555ec57c011aEric Paris u32 target_sid; 155b24a30a7305418ff138ff51776fc555ec57c011aEric Paris char target_comm[TASK_COMM_LEN]; 156b24a30a7305418ff138ff51776fc555ec57c011aEric Paris 157b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct audit_tree_refs *trees, *first_trees; 158b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct list_head killed_trees; 159b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int tree_count; 160b24a30a7305418ff138ff51776fc555ec57c011aEric Paris 161b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int type; 162b24a30a7305418ff138ff51776fc555ec57c011aEric Paris union { 163b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct { 164b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int nargs; 165b24a30a7305418ff138ff51776fc555ec57c011aEric Paris long args[6]; 166b24a30a7305418ff138ff51776fc555ec57c011aEric Paris } socketcall; 167b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct { 168b24a30a7305418ff138ff51776fc555ec57c011aEric Paris kuid_t uid; 169b24a30a7305418ff138ff51776fc555ec57c011aEric Paris kgid_t gid; 170b24a30a7305418ff138ff51776fc555ec57c011aEric Paris umode_t mode; 171b24a30a7305418ff138ff51776fc555ec57c011aEric Paris u32 osid; 172b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int has_perm; 173b24a30a7305418ff138ff51776fc555ec57c011aEric Paris uid_t perm_uid; 174b24a30a7305418ff138ff51776fc555ec57c011aEric Paris gid_t perm_gid; 175b24a30a7305418ff138ff51776fc555ec57c011aEric Paris umode_t perm_mode; 176b24a30a7305418ff138ff51776fc555ec57c011aEric Paris unsigned long qbytes; 177b24a30a7305418ff138ff51776fc555ec57c011aEric Paris } ipc; 178b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct { 179b24a30a7305418ff138ff51776fc555ec57c011aEric Paris mqd_t mqdes; 180b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct mq_attr mqstat; 181b24a30a7305418ff138ff51776fc555ec57c011aEric Paris } mq_getsetattr; 182b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct { 183b24a30a7305418ff138ff51776fc555ec57c011aEric Paris mqd_t mqdes; 184b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int sigev_signo; 185b24a30a7305418ff138ff51776fc555ec57c011aEric Paris } mq_notify; 186b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct { 187b24a30a7305418ff138ff51776fc555ec57c011aEric Paris mqd_t mqdes; 188b24a30a7305418ff138ff51776fc555ec57c011aEric Paris size_t msg_len; 189b24a30a7305418ff138ff51776fc555ec57c011aEric Paris unsigned int msg_prio; 190b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct timespec abs_timeout; 191b24a30a7305418ff138ff51776fc555ec57c011aEric Paris } mq_sendrecv; 192b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct { 193b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int oflag; 194b24a30a7305418ff138ff51776fc555ec57c011aEric Paris umode_t mode; 195b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct mq_attr attr; 196b24a30a7305418ff138ff51776fc555ec57c011aEric Paris } mq_open; 197b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct { 198b24a30a7305418ff138ff51776fc555ec57c011aEric Paris pid_t pid; 199b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct audit_cap_data cap; 200b24a30a7305418ff138ff51776fc555ec57c011aEric Paris } capset; 201b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct { 202b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int fd; 203b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int flags; 204b24a30a7305418ff138ff51776fc555ec57c011aEric Paris } mmap; 205d9cfea91e97d5d19f9d69beaa844f5fe56a6adc6Richard Guy Briggs struct { 206d9cfea91e97d5d19f9d69beaa844f5fe56a6adc6Richard Guy Briggs int argc; 207d9cfea91e97d5d19f9d69beaa844f5fe56a6adc6Richard Guy Briggs } execve; 208b24a30a7305418ff138ff51776fc555ec57c011aEric Paris }; 209b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int fds[2]; 2103f1c82502c299da08b7b7f08b435212e51166ed9William Roberts struct audit_proctitle proctitle; 211b24a30a7305418ff138ff51776fc555ec57c011aEric Paris 212b24a30a7305418ff138ff51776fc555ec57c011aEric Paris#if AUDIT_DEBUG 213b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int put_count; 214b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int ino_count; 215b24a30a7305418ff138ff51776fc555ec57c011aEric Paris#endif 216b24a30a7305418ff138ff51776fc555ec57c011aEric Paris}; 217b24a30a7305418ff138ff51776fc555ec57c011aEric Paris 2183e1d0bb6224f019893d1c498cc3327559d183674Joe Perchesextern u32 audit_ever_enabled; 219c782f242f0602edf848355d41e3676753c2280c8Harvey Harrison 220b24a30a7305418ff138ff51776fc555ec57c011aEric Parisextern void audit_copy_inode(struct audit_names *name, 221b24a30a7305418ff138ff51776fc555ec57c011aEric Paris const struct dentry *dentry, 222b24a30a7305418ff138ff51776fc555ec57c011aEric Paris const struct inode *inode); 223b24a30a7305418ff138ff51776fc555ec57c011aEric Parisextern void audit_log_cap(struct audit_buffer *ab, char *prefix, 224b24a30a7305418ff138ff51776fc555ec57c011aEric Paris kernel_cap_t *cap); 225b24a30a7305418ff138ff51776fc555ec57c011aEric Parisextern void audit_log_name(struct audit_context *context, 226b24a30a7305418ff138ff51776fc555ec57c011aEric Paris struct audit_names *n, struct path *path, 227b24a30a7305418ff138ff51776fc555ec57c011aEric Paris int record_num, int *call_panic); 228c782f242f0602edf848355d41e3676753c2280c8Harvey Harrison 229fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouseextern int audit_pid; 230fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouse 231f368c07d7214a7c41dfceb76c8db473b850f0229Amy Griffis#define AUDIT_INODE_BUCKETS 32 232f368c07d7214a7c41dfceb76c8db473b850f0229Amy Griffisextern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; 233f368c07d7214a7c41dfceb76c8db473b850f0229Amy Griffis 234f368c07d7214a7c41dfceb76c8db473b850f0229Amy Griffisstatic inline int audit_hash_ino(u32 ino) 235f368c07d7214a7c41dfceb76c8db473b850f0229Amy Griffis{ 236f368c07d7214a7c41dfceb76c8db473b850f0229Amy Griffis return (ino & (AUDIT_INODE_BUCKETS-1)); 237f368c07d7214a7c41dfceb76c8db473b850f0229Amy Griffis} 238f368c07d7214a7c41dfceb76c8db473b850f0229Amy Griffis 239e3d6b07b8ba161f638b026feba0c3c97875d7f1cJeff Layton/* Indicates that audit should log the full pathname. */ 240e3d6b07b8ba161f638b026feba0c3c97875d7f1cJeff Layton#define AUDIT_NAME_FULL -1 241e3d6b07b8ba161f638b026feba0c3c97875d7f1cJeff Layton 24255669bfa141b488be865341ed12e188967d11308Al Viroextern int audit_match_class(int class, unsigned syscall); 243f368c07d7214a7c41dfceb76c8db473b850f0229Amy Griffisextern int audit_comparator(const u32 left, const u32 op, const u32 right); 244ca57ec0f00c3f139c41bf6b0a5b9bcc95bbb2ad7Eric W. Biedermanextern int audit_uid_comparator(kuid_t left, u32 op, kuid_t right); 245ca57ec0f00c3f139c41bf6b0a5b9bcc95bbb2ad7Eric W. Biedermanextern int audit_gid_comparator(kgid_t left, u32 op, kgid_t right); 246bfcec7087458812f575d9022b2d151641f34ee84Jeff Laytonextern int parent_len(const char *path); 247e3d6b07b8ba161f638b026feba0c3c97875d7f1cJeff Laytonextern int audit_compare_dname_path(const char *dname, const char *path, int plen); 248f9441639e6319f0c0e12bd63fa2f58990af0a9d2Richard Guy Briggsextern struct sk_buff *audit_make_reply(__u32 portid, int seq, int type, 249f9441639e6319f0c0e12bd63fa2f58990af0a9d2Richard Guy Briggs int done, int multi, 250f9441639e6319f0c0e12bd63fa2f58990af0a9d2Richard Guy Briggs const void *payload, int size); 251fe7752bab26a9ac0651b695ad4f55659761f68f7David Woodhouseextern void audit_panic(const char *message); 2523dc7e3153eddfcf7ba8b50628775ba516e5f759fDarrel Goeddel 2539044e6bca5a4a575d3c068dfccb5651a2d6a13bcAl Virostruct audit_netlink_list { 254f9441639e6319f0c0e12bd63fa2f58990af0a9d2Richard Guy Briggs __u32 portid; 255638a0fd2a062568c568661be0a780be8e8836d03Eric W. Biederman struct net *net; 2569044e6bca5a4a575d3c068dfccb5651a2d6a13bcAl Viro struct sk_buff_head q; 2579044e6bca5a4a575d3c068dfccb5651a2d6a13bcAl Viro}; 2589044e6bca5a4a575d3c068dfccb5651a2d6a13bcAl Viro 2599044e6bca5a4a575d3c068dfccb5651a2d6a13bcAl Viroint audit_send_list(void *); 2609044e6bca5a4a575d3c068dfccb5651a2d6a13bcAl Viro 26133faba7fa7f2288d2f8aaea95958b2c97bf9ebfbRichard Guy Briggsstruct audit_net { 26233faba7fa7f2288d2f8aaea95958b2c97bf9ebfbRichard Guy Briggs struct sock *nlsk; 26333faba7fa7f2288d2f8aaea95958b2c97bf9ebfbRichard Guy Briggs}; 26433faba7fa7f2288d2f8aaea95958b2c97bf9ebfbRichard Guy Briggs 2653dc7e3153eddfcf7ba8b50628775ba516e5f759fDarrel Goeddelextern int selinux_audit_rule_update(void); 266e1396065e0489f98b35021b97907ab4edbfb24e1Al Viro 26774c3cbe33bc077ac1159cadfea608b501e100344Al Viroextern struct mutex audit_filter_mutex; 26874c3cbe33bc077ac1159cadfea608b501e100344Al Viroextern void audit_free_rule_rcu(struct rcu_head *); 269c782f242f0602edf848355d41e3676753c2280c8Harvey Harrisonextern struct list_head audit_filter_list[]; 27074c3cbe33bc077ac1159cadfea608b501e100344Al Viro 271939a67fc4cbab8ca11c90da8a769d7e965d66a9bEric Parisextern struct audit_entry *audit_dupe_rule(struct audit_krule *old); 272939a67fc4cbab8ca11c90da8a769d7e965d66a9bEric Paris 273cfcad62c74abfef83762dc05a556d21bdf3980a2Eric Paris/* audit watch functions */ 274939a67fc4cbab8ca11c90da8a769d7e965d66a9bEric Paris#ifdef CONFIG_AUDIT_WATCH 275cfcad62c74abfef83762dc05a556d21bdf3980a2Eric Parisextern void audit_put_watch(struct audit_watch *watch); 276cfcad62c74abfef83762dc05a556d21bdf3980a2Eric Parisextern void audit_get_watch(struct audit_watch *watch); 277cfcad62c74abfef83762dc05a556d21bdf3980a2Eric Parisextern int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op); 278ae7b8f4108bcffb42173f867ce845268c7202d48Eric Parisextern int audit_add_watch(struct audit_krule *krule, struct list_head **list); 279a05fb6cc573130915380e00d182a4c6571cec6b2Eric Parisextern void audit_remove_watch_rule(struct audit_krule *krule); 280cfcad62c74abfef83762dc05a556d21bdf3980a2Eric Parisextern char *audit_watch_path(struct audit_watch *watch); 281ae7b8f4108bcffb42173f867ce845268c7202d48Eric Parisextern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev); 282939a67fc4cbab8ca11c90da8a769d7e965d66a9bEric Paris#else 283939a67fc4cbab8ca11c90da8a769d7e965d66a9bEric Paris#define audit_put_watch(w) {} 284939a67fc4cbab8ca11c90da8a769d7e965d66a9bEric Paris#define audit_get_watch(w) {} 285939a67fc4cbab8ca11c90da8a769d7e965d66a9bEric Paris#define audit_to_watch(k, p, l, o) (-EINVAL) 286939a67fc4cbab8ca11c90da8a769d7e965d66a9bEric Paris#define audit_add_watch(k, l) (-EINVAL) 287939a67fc4cbab8ca11c90da8a769d7e965d66a9bEric Paris#define audit_remove_watch_rule(k) BUG() 288939a67fc4cbab8ca11c90da8a769d7e965d66a9bEric Paris#define audit_watch_path(w) "" 289939a67fc4cbab8ca11c90da8a769d7e965d66a9bEric Paris#define audit_watch_compare(w, i, d) 0 290939a67fc4cbab8ca11c90da8a769d7e965d66a9bEric Paris 291939a67fc4cbab8ca11c90da8a769d7e965d66a9bEric Paris#endif /* CONFIG_AUDIT_WATCH */ 292cfcad62c74abfef83762dc05a556d21bdf3980a2Eric Paris 29374c3cbe33bc077ac1159cadfea608b501e100344Al Viro#ifdef CONFIG_AUDIT_TREE 29474c3cbe33bc077ac1159cadfea608b501e100344Al Viroextern struct audit_chunk *audit_tree_lookup(const struct inode *); 29574c3cbe33bc077ac1159cadfea608b501e100344Al Viroextern void audit_put_chunk(struct audit_chunk *); 29674c3cbe33bc077ac1159cadfea608b501e100344Al Viroextern int audit_tree_match(struct audit_chunk *, struct audit_tree *); 29774c3cbe33bc077ac1159cadfea608b501e100344Al Viroextern int audit_make_tree(struct audit_krule *, char *, u32); 29874c3cbe33bc077ac1159cadfea608b501e100344Al Viroextern int audit_add_tree_rule(struct audit_krule *); 29974c3cbe33bc077ac1159cadfea608b501e100344Al Viroextern int audit_remove_tree_rule(struct audit_krule *); 30074c3cbe33bc077ac1159cadfea608b501e100344Al Viroextern void audit_trim_trees(void); 30174c3cbe33bc077ac1159cadfea608b501e100344Al Viroextern int audit_tag_tree(char *old, char *new); 30274c3cbe33bc077ac1159cadfea608b501e100344Al Viroextern const char *audit_tree_path(struct audit_tree *); 30374c3cbe33bc077ac1159cadfea608b501e100344Al Viroextern void audit_put_tree(struct audit_tree *); 304916d75761c971b6e630a26bd4ba472e90ac9a4b9Al Viroextern void audit_kill_trees(struct list_head *); 30574c3cbe33bc077ac1159cadfea608b501e100344Al Viro#else 30674c3cbe33bc077ac1159cadfea608b501e100344Al Viro#define audit_remove_tree_rule(rule) BUG() 30774c3cbe33bc077ac1159cadfea608b501e100344Al Viro#define audit_add_tree_rule(rule) -EINVAL 30874c3cbe33bc077ac1159cadfea608b501e100344Al Viro#define audit_make_tree(rule, str, op) -EINVAL 30974c3cbe33bc077ac1159cadfea608b501e100344Al Viro#define audit_trim_trees() (void)0 31074c3cbe33bc077ac1159cadfea608b501e100344Al Viro#define audit_put_tree(tree) (void)0 31174c3cbe33bc077ac1159cadfea608b501e100344Al Viro#define audit_tag_tree(old, new) -EINVAL 31274c3cbe33bc077ac1159cadfea608b501e100344Al Viro#define audit_tree_path(rule) "" /* never called */ 313916d75761c971b6e630a26bd4ba472e90ac9a4b9Al Viro#define audit_kill_trees(list) BUG() 31474c3cbe33bc077ac1159cadfea608b501e100344Al Viro#endif 31574c3cbe33bc077ac1159cadfea608b501e100344Al Viro 31674c3cbe33bc077ac1159cadfea608b501e100344Al Viroextern char *audit_unpack_string(void **, size_t *, size_t); 31774c3cbe33bc077ac1159cadfea608b501e100344Al Viro 318c782f242f0602edf848355d41e3676753c2280c8Harvey Harrisonextern pid_t audit_sig_pid; 319cca080d9b622094831672a136e5ee4f702d116b1Eric W. Biedermanextern kuid_t audit_sig_uid; 320c782f242f0602edf848355d41e3676753c2280c8Harvey Harrisonextern u32 audit_sig_sid; 321c782f242f0602edf848355d41e3676753c2280c8Harvey Harrison 322e1396065e0489f98b35021b97907ab4edbfb24e1Al Viro#ifdef CONFIG_AUDITSYSCALL 323e54dc2431d740a79a6bd013babade99d71b1714fAmy Griffisextern int __audit_signal_info(int sig, struct task_struct *t); 324e54dc2431d740a79a6bd013babade99d71b1714fAmy Griffisstatic inline int audit_signal_info(int sig, struct task_struct *t) 325e1396065e0489f98b35021b97907ab4edbfb24e1Al Viro{ 326e54dc2431d740a79a6bd013babade99d71b1714fAmy Griffis if (unlikely((audit_pid && t->tgid == audit_pid) || 327e54dc2431d740a79a6bd013babade99d71b1714fAmy Griffis (audit_signals && !audit_dummy_context()))) 328e54dc2431d740a79a6bd013babade99d71b1714fAmy Griffis return __audit_signal_info(sig, t); 329e54dc2431d740a79a6bd013babade99d71b1714fAmy Griffis return 0; 330e1396065e0489f98b35021b97907ab4edbfb24e1Al Viro} 3310590b9335a1c72a3f0defcc6231287f7817e07c8Al Viroextern void audit_filter_inodes(struct task_struct *, struct audit_context *); 332916d75761c971b6e630a26bd4ba472e90ac9a4b9Al Viroextern struct list_head *audit_killed_trees(void); 333e1396065e0489f98b35021b97907ab4edbfb24e1Al Viro#else 334e54dc2431d740a79a6bd013babade99d71b1714fAmy Griffis#define audit_signal_info(s,t) AUDIT_DISABLED 335f368c07d7214a7c41dfceb76c8db473b850f0229Amy Griffis#define audit_filter_inodes(t,c) AUDIT_DISABLED 336e1396065e0489f98b35021b97907ab4edbfb24e1Al Viro#endif 337916d75761c971b6e630a26bd4ba472e90ac9a4b9Al Viro 338916d75761c971b6e630a26bd4ba472e90ac9a4b9Al Viroextern struct mutex audit_cmd_mutex; 339