1/* audit.c -- Auditing support 2 * Gateway between the kernel (e.g., selinux) and the user-space audit daemon. 3 * System-call specific features have moved to auditsc.c 4 * 5 * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina. 6 * All Rights Reserved. 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 * Written by Rickard E. (Rik) Faith <faith@redhat.com> 23 * 24 * Goals: 1) Integrate fully with SELinux. 25 * 2) Minimal run-time overhead: 26 * a) Minimal when syscall auditing is disabled (audit_enable=0). 27 * b) Small when syscall auditing is enabled and no audit record 28 * is generated (defer as much work as possible to record 29 * generation time): 30 * i) context is allocated, 31 * ii) names from getname are stored without a copy, and 32 * iii) inode information stored from path_lookup. 33 * 3) Ability to disable syscall auditing at boot time (audit=0). 34 * 4) Usable by other parts of the kernel (if audit_log* is called, 35 * then a syscall record will be generated automatically for the 36 * current syscall). 37 * 5) Netlink interface to user-space. 38 * 6) Support low-overhead kernel-based filtering to minimize the 39 * information that must be passed to user-space. 40 * 41 * Example user-space utilities: http://people.redhat.com/sgrubb/audit/ 42 */ 43 44#include <linux/init.h> 45#include <asm/types.h> 46#include <asm/atomic.h> 47#include <linux/mm.h> 48#include <linux/module.h> 49#include <linux/err.h> 50#include <linux/kthread.h> 51 52#include <linux/audit.h> 53 54#include <net/sock.h> 55#include <net/netlink.h> 56#include <linux/skbuff.h> 57#include <linux/netlink.h> 58#include <linux/selinux.h> 59#include <linux/inotify.h> 60#include <linux/freezer.h> 61 62#include "audit.h" 63 64/* No auditing will take place until audit_initialized != 0. 65 * (Initialization happens after skb_init is called.) */ 66static int audit_initialized; 67 68/* 0 - no auditing 69 * 1 - auditing enabled 70 * 2 - auditing enabled and configuration is locked/unchangeable. */ 71int audit_enabled; 72 73/* Default state when kernel boots without any parameters. */ 74static int audit_default; 75 76/* If auditing cannot proceed, audit_failure selects what happens. */ 77static int audit_failure = AUDIT_FAIL_PRINTK; 78 79/* If audit records are to be written to the netlink socket, audit_pid 80 * contains the (non-zero) pid. */ 81int audit_pid; 82 83/* If audit_rate_limit is non-zero, limit the rate of sending audit records 84 * to that number per second. This prevents DoS attacks, but results in 85 * audit records being dropped. */ 86static int audit_rate_limit; 87 88/* Number of outstanding audit_buffers allowed. */ 89static int audit_backlog_limit = 64; 90static int audit_backlog_wait_time = 60 * HZ; 91static int audit_backlog_wait_overflow = 0; 92 93/* The identity of the user shutting down the audit system. */ 94uid_t audit_sig_uid = -1; 95pid_t audit_sig_pid = -1; 96u32 audit_sig_sid = 0; 97 98/* Records can be lost in several ways: 99 0) [suppressed in audit_alloc] 100 1) out of memory in audit_log_start [kmalloc of struct audit_buffer] 101 2) out of memory in audit_log_move [alloc_skb] 102 3) suppressed due to audit_rate_limit 103 4) suppressed due to audit_backlog_limit 104*/ 105static atomic_t audit_lost = ATOMIC_INIT(0); 106 107/* The netlink socket. */ 108static struct sock *audit_sock; 109 110/* Inotify handle. */ 111struct inotify_handle *audit_ih; 112 113/* Hash for inode-based rules */ 114struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; 115 116/* The audit_freelist is a list of pre-allocated audit buffers (if more 117 * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of 118 * being placed on the freelist). */ 119static DEFINE_SPINLOCK(audit_freelist_lock); 120static int audit_freelist_count; 121static LIST_HEAD(audit_freelist); 122 123static struct sk_buff_head audit_skb_queue; 124static struct task_struct *kauditd_task; 125static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait); 126static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait); 127 128/* Serialize requests from userspace. */ 129static DEFINE_MUTEX(audit_cmd_mutex); 130 131/* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting 132 * audit records. Since printk uses a 1024 byte buffer, this buffer 133 * should be at least that large. */ 134#define AUDIT_BUFSIZ 1024 135 136/* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the 137 * audit_freelist. Doing so eliminates many kmalloc/kfree calls. */ 138#define AUDIT_MAXFREE (2*NR_CPUS) 139 140/* The audit_buffer is used when formatting an audit record. The caller 141 * locks briefly to get the record off the freelist or to allocate the 142 * buffer, and locks briefly to send the buffer to the netlink layer or 143 * to place it on a transmit queue. Multiple audit_buffers can be in 144 * use simultaneously. */ 145struct audit_buffer { 146 struct list_head list; 147 struct sk_buff *skb; /* formatted skb ready to send */ 148 struct audit_context *ctx; /* NULL or associated context */ 149 gfp_t gfp_mask; 150}; 151 152static void audit_set_pid(struct audit_buffer *ab, pid_t pid) 153{ 154 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb); 155 nlh->nlmsg_pid = pid; 156} 157 158void audit_panic(const char *message) 159{ 160 switch (audit_failure) 161 { 162 case AUDIT_FAIL_SILENT: 163 break; 164 case AUDIT_FAIL_PRINTK: 165 printk(KERN_ERR "audit: %s\n", message); 166 break; 167 case AUDIT_FAIL_PANIC: 168 panic("audit: %s\n", message); 169 break; 170 } 171} 172 173static inline int audit_rate_check(void) 174{ 175 static unsigned long last_check = 0; 176 static int messages = 0; 177 static DEFINE_SPINLOCK(lock); 178 unsigned long flags; 179 unsigned long now; 180 unsigned long elapsed; 181 int retval = 0; 182 183 if (!audit_rate_limit) return 1; 184 185 spin_lock_irqsave(&lock, flags); 186 if (++messages < audit_rate_limit) { 187 retval = 1; 188 } else { 189 now = jiffies; 190 elapsed = now - last_check; 191 if (elapsed > HZ) { 192 last_check = now; 193 messages = 0; 194 retval = 1; 195 } 196 } 197 spin_unlock_irqrestore(&lock, flags); 198 199 return retval; 200} 201 202/** 203 * audit_log_lost - conditionally log lost audit message event 204 * @message: the message stating reason for lost audit message 205 * 206 * Emit at least 1 message per second, even if audit_rate_check is 207 * throttling. 208 * Always increment the lost messages counter. 209*/ 210void audit_log_lost(const char *message) 211{ 212 static unsigned long last_msg = 0; 213 static DEFINE_SPINLOCK(lock); 214 unsigned long flags; 215 unsigned long now; 216 int print; 217 218 atomic_inc(&audit_lost); 219 220 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit); 221 222 if (!print) { 223 spin_lock_irqsave(&lock, flags); 224 now = jiffies; 225 if (now - last_msg > HZ) { 226 print = 1; 227 last_msg = now; 228 } 229 spin_unlock_irqrestore(&lock, flags); 230 } 231 232 if (print) { 233 printk(KERN_WARNING 234 "audit: audit_lost=%d audit_rate_limit=%d audit_backlog_limit=%d\n", 235 atomic_read(&audit_lost), 236 audit_rate_limit, 237 audit_backlog_limit); 238 audit_panic(message); 239 } 240} 241 242static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sid) 243{ 244 int res, rc = 0, old = audit_rate_limit; 245 246 /* check if we are locked */ 247 if (audit_enabled == 2) 248 res = 0; 249 else 250 res = 1; 251 252 if (sid) { 253 char *ctx = NULL; 254 u32 len; 255 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { 256 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 257 "audit_rate_limit=%d old=%d by auid=%u" 258 " subj=%s res=%d", 259 limit, old, loginuid, ctx, res); 260 kfree(ctx); 261 } else 262 res = 0; /* Something weird, deny request */ 263 } 264 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 265 "audit_rate_limit=%d old=%d by auid=%u res=%d", 266 limit, old, loginuid, res); 267 268 /* If we are allowed, make the change */ 269 if (res == 1) 270 audit_rate_limit = limit; 271 /* Not allowed, update reason */ 272 else if (rc == 0) 273 rc = -EPERM; 274 return rc; 275} 276 277static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid) 278{ 279 int res, rc = 0, old = audit_backlog_limit; 280 281 /* check if we are locked */ 282 if (audit_enabled == 2) 283 res = 0; 284 else 285 res = 1; 286 287 if (sid) { 288 char *ctx = NULL; 289 u32 len; 290 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { 291 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 292 "audit_backlog_limit=%d old=%d by auid=%u" 293 " subj=%s res=%d", 294 limit, old, loginuid, ctx, res); 295 kfree(ctx); 296 } else 297 res = 0; /* Something weird, deny request */ 298 } 299 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 300 "audit_backlog_limit=%d old=%d by auid=%u res=%d", 301 limit, old, loginuid, res); 302 303 /* If we are allowed, make the change */ 304 if (res == 1) 305 audit_backlog_limit = limit; 306 /* Not allowed, update reason */ 307 else if (rc == 0) 308 rc = -EPERM; 309 return rc; 310} 311 312static int audit_set_enabled(int state, uid_t loginuid, u32 sid) 313{ 314 int res, rc = 0, old = audit_enabled; 315 316 if (state < 0 || state > 2) 317 return -EINVAL; 318 319 /* check if we are locked */ 320 if (audit_enabled == 2) 321 res = 0; 322 else 323 res = 1; 324 325 if (sid) { 326 char *ctx = NULL; 327 u32 len; 328 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { 329 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 330 "audit_enabled=%d old=%d by auid=%u" 331 " subj=%s res=%d", 332 state, old, loginuid, ctx, res); 333 kfree(ctx); 334 } else 335 res = 0; /* Something weird, deny request */ 336 } 337 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 338 "audit_enabled=%d old=%d by auid=%u res=%d", 339 state, old, loginuid, res); 340 341 /* If we are allowed, make the change */ 342 if (res == 1) 343 audit_enabled = state; 344 /* Not allowed, update reason */ 345 else if (rc == 0) 346 rc = -EPERM; 347 return rc; 348} 349 350static int audit_set_failure(int state, uid_t loginuid, u32 sid) 351{ 352 int res, rc = 0, old = audit_failure; 353 354 if (state != AUDIT_FAIL_SILENT 355 && state != AUDIT_FAIL_PRINTK 356 && state != AUDIT_FAIL_PANIC) 357 return -EINVAL; 358 359 /* check if we are locked */ 360 if (audit_enabled == 2) 361 res = 0; 362 else 363 res = 1; 364 365 if (sid) { 366 char *ctx = NULL; 367 u32 len; 368 if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { 369 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 370 "audit_failure=%d old=%d by auid=%u" 371 " subj=%s res=%d", 372 state, old, loginuid, ctx, res); 373 kfree(ctx); 374 } else 375 res = 0; /* Something weird, deny request */ 376 } 377 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 378 "audit_failure=%d old=%d by auid=%u res=%d", 379 state, old, loginuid, res); 380 381 /* If we are allowed, make the change */ 382 if (res == 1) 383 audit_failure = state; 384 /* Not allowed, update reason */ 385 else if (rc == 0) 386 rc = -EPERM; 387 return rc; 388} 389 390static int kauditd_thread(void *dummy) 391{ 392 struct sk_buff *skb; 393 394 while (!kthread_should_stop()) { 395 skb = skb_dequeue(&audit_skb_queue); 396 wake_up(&audit_backlog_wait); 397 if (skb) { 398 if (audit_pid) { 399 int err = netlink_unicast(audit_sock, skb, audit_pid, 0); 400 if (err < 0) { 401 BUG_ON(err != -ECONNREFUSED); /* Shoudn't happen */ 402 printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid); 403 audit_pid = 0; 404 } 405 } else { 406 printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0)); 407 kfree_skb(skb); 408 } 409 } else { 410 DECLARE_WAITQUEUE(wait, current); 411 set_current_state(TASK_INTERRUPTIBLE); 412 add_wait_queue(&kauditd_wait, &wait); 413 414 if (!skb_queue_len(&audit_skb_queue)) { 415 try_to_freeze(); 416 schedule(); 417 } 418 419 __set_current_state(TASK_RUNNING); 420 remove_wait_queue(&kauditd_wait, &wait); 421 } 422 } 423 return 0; 424} 425 426int audit_send_list(void *_dest) 427{ 428 struct audit_netlink_list *dest = _dest; 429 int pid = dest->pid; 430 struct sk_buff *skb; 431 432 /* wait for parent to finish and send an ACK */ 433 mutex_lock(&audit_cmd_mutex); 434 mutex_unlock(&audit_cmd_mutex); 435 436 while ((skb = __skb_dequeue(&dest->q)) != NULL) 437 netlink_unicast(audit_sock, skb, pid, 0); 438 439 kfree(dest); 440 441 return 0; 442} 443 444struct sk_buff *audit_make_reply(int pid, int seq, int type, int done, 445 int multi, void *payload, int size) 446{ 447 struct sk_buff *skb; 448 struct nlmsghdr *nlh; 449 int len = NLMSG_SPACE(size); 450 void *data; 451 int flags = multi ? NLM_F_MULTI : 0; 452 int t = done ? NLMSG_DONE : type; 453 454 skb = alloc_skb(len, GFP_KERNEL); 455 if (!skb) 456 return NULL; 457 458 nlh = NLMSG_PUT(skb, pid, seq, t, size); 459 nlh->nlmsg_flags = flags; 460 data = NLMSG_DATA(nlh); 461 memcpy(data, payload, size); 462 return skb; 463 464nlmsg_failure: /* Used by NLMSG_PUT */ 465 if (skb) 466 kfree_skb(skb); 467 return NULL; 468} 469 470/** 471 * audit_send_reply - send an audit reply message via netlink 472 * @pid: process id to send reply to 473 * @seq: sequence number 474 * @type: audit message type 475 * @done: done (last) flag 476 * @multi: multi-part message flag 477 * @payload: payload data 478 * @size: payload size 479 * 480 * Allocates an skb, builds the netlink message, and sends it to the pid. 481 * No failure notifications. 482 */ 483void audit_send_reply(int pid, int seq, int type, int done, int multi, 484 void *payload, int size) 485{ 486 struct sk_buff *skb; 487 skb = audit_make_reply(pid, seq, type, done, multi, payload, size); 488 if (!skb) 489 return; 490 /* Ignore failure. It'll only happen if the sender goes away, 491 because our timeout is set to infinite. */ 492 netlink_unicast(audit_sock, skb, pid, 0); 493 return; 494} 495 496/* 497 * Check for appropriate CAP_AUDIT_ capabilities on incoming audit 498 * control messages. 499 */ 500static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type) 501{ 502 int err = 0; 503 504 switch (msg_type) { 505 case AUDIT_GET: 506 case AUDIT_LIST: 507 case AUDIT_LIST_RULES: 508 case AUDIT_SET: 509 case AUDIT_ADD: 510 case AUDIT_ADD_RULE: 511 case AUDIT_DEL: 512 case AUDIT_DEL_RULE: 513 case AUDIT_SIGNAL_INFO: 514 if (security_netlink_recv(skb, CAP_AUDIT_CONTROL)) 515 err = -EPERM; 516 break; 517 case AUDIT_USER: 518 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: 519 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: 520 if (security_netlink_recv(skb, CAP_AUDIT_WRITE)) 521 err = -EPERM; 522 break; 523 default: /* bad msg */ 524 err = -EINVAL; 525 } 526 527 return err; 528} 529 530static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 531{ 532 u32 uid, pid, seq, sid; 533 void *data; 534 struct audit_status *status_get, status_set; 535 int err; 536 struct audit_buffer *ab; 537 u16 msg_type = nlh->nlmsg_type; 538 uid_t loginuid; /* loginuid of sender */ 539 struct audit_sig_info *sig_data; 540 char *ctx; 541 u32 len; 542 543 err = audit_netlink_ok(skb, msg_type); 544 if (err) 545 return err; 546 547 /* As soon as there's any sign of userspace auditd, 548 * start kauditd to talk to it */ 549 if (!kauditd_task) 550 kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd"); 551 if (IS_ERR(kauditd_task)) { 552 err = PTR_ERR(kauditd_task); 553 kauditd_task = NULL; 554 return err; 555 } 556 557 pid = NETLINK_CREDS(skb)->pid; 558 uid = NETLINK_CREDS(skb)->uid; 559 loginuid = NETLINK_CB(skb).loginuid; 560 sid = NETLINK_CB(skb).sid; 561 seq = nlh->nlmsg_seq; 562 data = NLMSG_DATA(nlh); 563 564 switch (msg_type) { 565 case AUDIT_GET: 566 status_set.enabled = audit_enabled; 567 status_set.failure = audit_failure; 568 status_set.pid = audit_pid; 569 status_set.rate_limit = audit_rate_limit; 570 status_set.backlog_limit = audit_backlog_limit; 571 status_set.lost = atomic_read(&audit_lost); 572 status_set.backlog = skb_queue_len(&audit_skb_queue); 573 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0, 574 &status_set, sizeof(status_set)); 575 break; 576 case AUDIT_SET: 577 if (nlh->nlmsg_len < sizeof(struct audit_status)) 578 return -EINVAL; 579 status_get = (struct audit_status *)data; 580 if (status_get->mask & AUDIT_STATUS_ENABLED) { 581 err = audit_set_enabled(status_get->enabled, 582 loginuid, sid); 583 if (err < 0) return err; 584 } 585 if (status_get->mask & AUDIT_STATUS_FAILURE) { 586 err = audit_set_failure(status_get->failure, 587 loginuid, sid); 588 if (err < 0) return err; 589 } 590 if (status_get->mask & AUDIT_STATUS_PID) { 591 int old = audit_pid; 592 if (sid) { 593 if ((err = selinux_sid_to_string( 594 sid, &ctx, &len))) 595 return err; 596 else 597 audit_log(NULL, GFP_KERNEL, 598 AUDIT_CONFIG_CHANGE, 599 "audit_pid=%d old=%d by auid=%u subj=%s", 600 status_get->pid, old, 601 loginuid, ctx); 602 kfree(ctx); 603 } else 604 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 605 "audit_pid=%d old=%d by auid=%u", 606 status_get->pid, old, loginuid); 607 audit_pid = status_get->pid; 608 } 609 if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) 610 err = audit_set_rate_limit(status_get->rate_limit, 611 loginuid, sid); 612 if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT) 613 err = audit_set_backlog_limit(status_get->backlog_limit, 614 loginuid, sid); 615 break; 616 case AUDIT_USER: 617 case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: 618 case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: 619 if (!audit_enabled && msg_type != AUDIT_USER_AVC) 620 return 0; 621 622 err = audit_filter_user(&NETLINK_CB(skb), msg_type); 623 if (err == 1) { 624 err = 0; 625 ab = audit_log_start(NULL, GFP_KERNEL, msg_type); 626 if (ab) { 627 audit_log_format(ab, 628 "user pid=%d uid=%u auid=%u", 629 pid, uid, loginuid); 630 if (sid) { 631 if (selinux_sid_to_string( 632 sid, &ctx, &len)) { 633 audit_log_format(ab, 634 " ssid=%u", sid); 635 /* Maybe call audit_panic? */ 636 } else 637 audit_log_format(ab, 638 " subj=%s", ctx); 639 kfree(ctx); 640 } 641 audit_log_format(ab, " msg='%.1024s'", 642 (char *)data); 643 audit_set_pid(ab, pid); 644 audit_log_end(ab); 645 } 646 } 647 break; 648 case AUDIT_ADD: 649 case AUDIT_DEL: 650 if (nlmsg_len(nlh) < sizeof(struct audit_rule)) 651 return -EINVAL; 652 if (audit_enabled == 2) { 653 ab = audit_log_start(NULL, GFP_KERNEL, 654 AUDIT_CONFIG_CHANGE); 655 if (ab) { 656 audit_log_format(ab, 657 "pid=%d uid=%u auid=%u", 658 pid, uid, loginuid); 659 if (sid) { 660 if (selinux_sid_to_string( 661 sid, &ctx, &len)) { 662 audit_log_format(ab, 663 " ssid=%u", sid); 664 /* Maybe call audit_panic? */ 665 } else 666 audit_log_format(ab, 667 " subj=%s", ctx); 668 kfree(ctx); 669 } 670 audit_log_format(ab, " audit_enabled=%d res=0", 671 audit_enabled); 672 audit_log_end(ab); 673 } 674 return -EPERM; 675 } 676 /* fallthrough */ 677 case AUDIT_LIST: 678 err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid, 679 uid, seq, data, nlmsg_len(nlh), 680 loginuid, sid); 681 break; 682 case AUDIT_ADD_RULE: 683 case AUDIT_DEL_RULE: 684 if (nlmsg_len(nlh) < sizeof(struct audit_rule_data)) 685 return -EINVAL; 686 if (audit_enabled == 2) { 687 ab = audit_log_start(NULL, GFP_KERNEL, 688 AUDIT_CONFIG_CHANGE); 689 if (ab) { 690 audit_log_format(ab, 691 "pid=%d uid=%u auid=%u", 692 pid, uid, loginuid); 693 if (sid) { 694 if (selinux_sid_to_string( 695 sid, &ctx, &len)) { 696 audit_log_format(ab, 697 " ssid=%u", sid); 698 /* Maybe call audit_panic? */ 699 } else 700 audit_log_format(ab, 701 " subj=%s", ctx); 702 kfree(ctx); 703 } 704 audit_log_format(ab, " audit_enabled=%d res=0", 705 audit_enabled); 706 audit_log_end(ab); 707 } 708 return -EPERM; 709 } 710 /* fallthrough */ 711 case AUDIT_LIST_RULES: 712 err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid, 713 uid, seq, data, nlmsg_len(nlh), 714 loginuid, sid); 715 break; 716 case AUDIT_SIGNAL_INFO: 717 err = selinux_sid_to_string(audit_sig_sid, &ctx, &len); 718 if (err) 719 return err; 720 sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL); 721 if (!sig_data) { 722 kfree(ctx); 723 return -ENOMEM; 724 } 725 sig_data->uid = audit_sig_uid; 726 sig_data->pid = audit_sig_pid; 727 memcpy(sig_data->ctx, ctx, len); 728 kfree(ctx); 729 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO, 730 0, 0, sig_data, sizeof(*sig_data) + len); 731 kfree(sig_data); 732 break; 733 default: 734 err = -EINVAL; 735 break; 736 } 737 738 return err < 0 ? err : 0; 739} 740 741/* 742 * Get message from skb (based on rtnetlink_rcv_skb). Each message is 743 * processed by audit_receive_msg. Malformed skbs with wrong length are 744 * discarded silently. 745 */ 746static void audit_receive_skb(struct sk_buff *skb) 747{ 748 int err; 749 struct nlmsghdr *nlh; 750 u32 rlen; 751 752 while (skb->len >= NLMSG_SPACE(0)) { 753 nlh = nlmsg_hdr(skb); 754 if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) 755 return; 756 rlen = NLMSG_ALIGN(nlh->nlmsg_len); 757 if (rlen > skb->len) 758 rlen = skb->len; 759 if ((err = audit_receive_msg(skb, nlh))) { 760 netlink_ack(skb, nlh, err); 761 } else if (nlh->nlmsg_flags & NLM_F_ACK) 762 netlink_ack(skb, nlh, 0); 763 skb_pull(skb, rlen); 764 } 765} 766 767/* Receive messages from netlink socket. */ 768static void audit_receive(struct sock *sk, int length) 769{ 770 struct sk_buff *skb; 771 unsigned int qlen; 772 773 mutex_lock(&audit_cmd_mutex); 774 775 for (qlen = skb_queue_len(&sk->sk_receive_queue); qlen; qlen--) { 776 skb = skb_dequeue(&sk->sk_receive_queue); 777 audit_receive_skb(skb); 778 kfree_skb(skb); 779 } 780 mutex_unlock(&audit_cmd_mutex); 781} 782 783#ifdef CONFIG_AUDITSYSCALL 784static const struct inotify_operations audit_inotify_ops = { 785 .handle_event = audit_handle_ievent, 786 .destroy_watch = audit_free_parent, 787}; 788#endif 789 790/* Initialize audit support at boot time. */ 791static int __init audit_init(void) 792{ 793 int i; 794 795 printk(KERN_INFO "audit: initializing netlink socket (%s)\n", 796 audit_default ? "enabled" : "disabled"); 797 audit_sock = netlink_kernel_create(NETLINK_AUDIT, 0, audit_receive, 798 NULL, THIS_MODULE); 799 if (!audit_sock) 800 audit_panic("cannot initialize netlink socket"); 801 else 802 audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; 803 804 skb_queue_head_init(&audit_skb_queue); 805 audit_initialized = 1; 806 audit_enabled = audit_default; 807 808 /* Register the callback with selinux. This callback will be invoked 809 * when a new policy is loaded. */ 810 selinux_audit_set_callback(&selinux_audit_rule_update); 811 812 audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized"); 813 814#ifdef CONFIG_AUDITSYSCALL 815 audit_ih = inotify_init(&audit_inotify_ops); 816 if (IS_ERR(audit_ih)) 817 audit_panic("cannot initialize inotify handle"); 818#endif 819 820 for (i = 0; i < AUDIT_INODE_BUCKETS; i++) 821 INIT_LIST_HEAD(&audit_inode_hash[i]); 822 823 return 0; 824} 825__initcall(audit_init); 826 827/* Process kernel command-line parameter at boot time. audit=0 or audit=1. */ 828static int __init audit_enable(char *str) 829{ 830 audit_default = !!simple_strtol(str, NULL, 0); 831 printk(KERN_INFO "audit: %s%s\n", 832 audit_default ? "enabled" : "disabled", 833 audit_initialized ? "" : " (after initialization)"); 834 if (audit_initialized) 835 audit_enabled = audit_default; 836 return 1; 837} 838 839__setup("audit=", audit_enable); 840 841static void audit_buffer_free(struct audit_buffer *ab) 842{ 843 unsigned long flags; 844 845 if (!ab) 846 return; 847 848 if (ab->skb) 849 kfree_skb(ab->skb); 850 851 spin_lock_irqsave(&audit_freelist_lock, flags); 852 if (audit_freelist_count > AUDIT_MAXFREE) 853 kfree(ab); 854 else { 855 audit_freelist_count++; 856 list_add(&ab->list, &audit_freelist); 857 } 858 spin_unlock_irqrestore(&audit_freelist_lock, flags); 859} 860 861static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx, 862 gfp_t gfp_mask, int type) 863{ 864 unsigned long flags; 865 struct audit_buffer *ab = NULL; 866 struct nlmsghdr *nlh; 867 868 spin_lock_irqsave(&audit_freelist_lock, flags); 869 if (!list_empty(&audit_freelist)) { 870 ab = list_entry(audit_freelist.next, 871 struct audit_buffer, list); 872 list_del(&ab->list); 873 --audit_freelist_count; 874 } 875 spin_unlock_irqrestore(&audit_freelist_lock, flags); 876 877 if (!ab) { 878 ab = kmalloc(sizeof(*ab), gfp_mask); 879 if (!ab) 880 goto err; 881 } 882 883 ab->skb = alloc_skb(AUDIT_BUFSIZ, gfp_mask); 884 if (!ab->skb) 885 goto err; 886 887 ab->ctx = ctx; 888 ab->gfp_mask = gfp_mask; 889 nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0)); 890 nlh->nlmsg_type = type; 891 nlh->nlmsg_flags = 0; 892 nlh->nlmsg_pid = 0; 893 nlh->nlmsg_seq = 0; 894 return ab; 895err: 896 audit_buffer_free(ab); 897 return NULL; 898} 899 900/** 901 * audit_serial - compute a serial number for the audit record 902 * 903 * Compute a serial number for the audit record. Audit records are 904 * written to user-space as soon as they are generated, so a complete 905 * audit record may be written in several pieces. The timestamp of the 906 * record and this serial number are used by the user-space tools to 907 * determine which pieces belong to the same audit record. The 908 * (timestamp,serial) tuple is unique for each syscall and is live from 909 * syscall entry to syscall exit. 910 * 911 * NOTE: Another possibility is to store the formatted records off the 912 * audit context (for those records that have a context), and emit them 913 * all at syscall exit. However, this could delay the reporting of 914 * significant errors until syscall exit (or never, if the system 915 * halts). 916 */ 917unsigned int audit_serial(void) 918{ 919 static DEFINE_SPINLOCK(serial_lock); 920 static unsigned int serial = 0; 921 922 unsigned long flags; 923 unsigned int ret; 924 925 spin_lock_irqsave(&serial_lock, flags); 926 do { 927 ret = ++serial; 928 } while (unlikely(!ret)); 929 spin_unlock_irqrestore(&serial_lock, flags); 930 931 return ret; 932} 933 934static inline void audit_get_stamp(struct audit_context *ctx, 935 struct timespec *t, unsigned int *serial) 936{ 937 if (ctx) 938 auditsc_get_stamp(ctx, t, serial); 939 else { 940 *t = CURRENT_TIME; 941 *serial = audit_serial(); 942 } 943} 944 945/* Obtain an audit buffer. This routine does locking to obtain the 946 * audit buffer, but then no locking is required for calls to 947 * audit_log_*format. If the tsk is a task that is currently in a 948 * syscall, then the syscall is marked as auditable and an audit record 949 * will be written at syscall exit. If there is no associated task, tsk 950 * should be NULL. */ 951 952/** 953 * audit_log_start - obtain an audit buffer 954 * @ctx: audit_context (may be NULL) 955 * @gfp_mask: type of allocation 956 * @type: audit message type 957 * 958 * Returns audit_buffer pointer on success or NULL on error. 959 * 960 * Obtain an audit buffer. This routine does locking to obtain the 961 * audit buffer, but then no locking is required for calls to 962 * audit_log_*format. If the task (ctx) is a task that is currently in a 963 * syscall, then the syscall is marked as auditable and an audit record 964 * will be written at syscall exit. If there is no associated task, then 965 * task context (ctx) should be NULL. 966 */ 967struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, 968 int type) 969{ 970 struct audit_buffer *ab = NULL; 971 struct timespec t; 972 unsigned int serial; 973 int reserve; 974 unsigned long timeout_start = jiffies; 975 976 if (!audit_initialized) 977 return NULL; 978 979 if (unlikely(audit_filter_type(type))) 980 return NULL; 981 982 if (gfp_mask & __GFP_WAIT) 983 reserve = 0; 984 else 985 reserve = 5; /* Allow atomic callers to go up to five 986 entries over the normal backlog limit */ 987 988 while (audit_backlog_limit 989 && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) { 990 if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time 991 && time_before(jiffies, timeout_start + audit_backlog_wait_time)) { 992 993 /* Wait for auditd to drain the queue a little */ 994 DECLARE_WAITQUEUE(wait, current); 995 set_current_state(TASK_INTERRUPTIBLE); 996 add_wait_queue(&audit_backlog_wait, &wait); 997 998 if (audit_backlog_limit && 999 skb_queue_len(&audit_skb_queue) > audit_backlog_limit) 1000 schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies); 1001 1002 __set_current_state(TASK_RUNNING); 1003 remove_wait_queue(&audit_backlog_wait, &wait); 1004 continue; 1005 } 1006 if (audit_rate_check()) 1007 printk(KERN_WARNING 1008 "audit: audit_backlog=%d > " 1009 "audit_backlog_limit=%d\n", 1010 skb_queue_len(&audit_skb_queue), 1011 audit_backlog_limit); 1012 audit_log_lost("backlog limit exceeded"); 1013 audit_backlog_wait_time = audit_backlog_wait_overflow; 1014 wake_up(&audit_backlog_wait); 1015 return NULL; 1016 } 1017 1018 ab = audit_buffer_alloc(ctx, gfp_mask, type); 1019 if (!ab) { 1020 audit_log_lost("out of memory in audit_log_start"); 1021 return NULL; 1022 } 1023 1024 audit_get_stamp(ab->ctx, &t, &serial); 1025 1026 audit_log_format(ab, "audit(%lu.%03lu:%u): ", 1027 t.tv_sec, t.tv_nsec/1000000, serial); 1028 return ab; 1029} 1030 1031/** 1032 * audit_expand - expand skb in the audit buffer 1033 * @ab: audit_buffer 1034 * @extra: space to add at tail of the skb 1035 * 1036 * Returns 0 (no space) on failed expansion, or available space if 1037 * successful. 1038 */ 1039static inline int audit_expand(struct audit_buffer *ab, int extra) 1040{ 1041 struct sk_buff *skb = ab->skb; 1042 int ret = pskb_expand_head(skb, skb_headroom(skb), extra, 1043 ab->gfp_mask); 1044 if (ret < 0) { 1045 audit_log_lost("out of memory in audit_expand"); 1046 return 0; 1047 } 1048 return skb_tailroom(skb); 1049} 1050 1051/* 1052 * Format an audit message into the audit buffer. If there isn't enough 1053 * room in the audit buffer, more room will be allocated and vsnprint 1054 * will be called a second time. Currently, we assume that a printk 1055 * can't format message larger than 1024 bytes, so we don't either. 1056 */ 1057static void audit_log_vformat(struct audit_buffer *ab, const char *fmt, 1058 va_list args) 1059{ 1060 int len, avail; 1061 struct sk_buff *skb; 1062 va_list args2; 1063 1064 if (!ab) 1065 return; 1066 1067 BUG_ON(!ab->skb); 1068 skb = ab->skb; 1069 avail = skb_tailroom(skb); 1070 if (avail == 0) { 1071 avail = audit_expand(ab, AUDIT_BUFSIZ); 1072 if (!avail) 1073 goto out; 1074 } 1075 va_copy(args2, args); 1076 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args); 1077 if (len >= avail) { 1078 /* The printk buffer is 1024 bytes long, so if we get 1079 * here and AUDIT_BUFSIZ is at least 1024, then we can 1080 * log everything that printk could have logged. */ 1081 avail = audit_expand(ab, 1082 max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail)); 1083 if (!avail) 1084 goto out; 1085 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2); 1086 } 1087 if (len > 0) 1088 skb_put(skb, len); 1089out: 1090 return; 1091} 1092 1093/** 1094 * audit_log_format - format a message into the audit buffer. 1095 * @ab: audit_buffer 1096 * @fmt: format string 1097 * @...: optional parameters matching @fmt string 1098 * 1099 * All the work is done in audit_log_vformat. 1100 */ 1101void audit_log_format(struct audit_buffer *ab, const char *fmt, ...) 1102{ 1103 va_list args; 1104 1105 if (!ab) 1106 return; 1107 va_start(args, fmt); 1108 audit_log_vformat(ab, fmt, args); 1109 va_end(args); 1110} 1111 1112/** 1113 * audit_log_hex - convert a buffer to hex and append it to the audit skb 1114 * @ab: the audit_buffer 1115 * @buf: buffer to convert to hex 1116 * @len: length of @buf to be converted 1117 * 1118 * No return value; failure to expand is silently ignored. 1119 * 1120 * This function will take the passed buf and convert it into a string of 1121 * ascii hex digits. The new string is placed onto the skb. 1122 */ 1123void audit_log_hex(struct audit_buffer *ab, const unsigned char *buf, 1124 size_t len) 1125{ 1126 int i, avail, new_len; 1127 unsigned char *ptr; 1128 struct sk_buff *skb; 1129 static const unsigned char *hex = "0123456789ABCDEF"; 1130 1131 if (!ab) 1132 return; 1133 1134 BUG_ON(!ab->skb); 1135 skb = ab->skb; 1136 avail = skb_tailroom(skb); 1137 new_len = len<<1; 1138 if (new_len >= avail) { 1139 /* Round the buffer request up to the next multiple */ 1140 new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1); 1141 avail = audit_expand(ab, new_len); 1142 if (!avail) 1143 return; 1144 } 1145 1146 ptr = skb_tail_pointer(skb); 1147 for (i=0; i<len; i++) { 1148 *ptr++ = hex[(buf[i] & 0xF0)>>4]; /* Upper nibble */ 1149 *ptr++ = hex[buf[i] & 0x0F]; /* Lower nibble */ 1150 } 1151 *ptr = 0; 1152 skb_put(skb, len << 1); /* new string is twice the old string */ 1153} 1154 1155/* 1156 * Format a string of no more than slen characters into the audit buffer, 1157 * enclosed in quote marks. 1158 */ 1159static void audit_log_n_string(struct audit_buffer *ab, size_t slen, 1160 const char *string) 1161{ 1162 int avail, new_len; 1163 unsigned char *ptr; 1164 struct sk_buff *skb; 1165 1166 if (!ab) 1167 return; 1168 1169 BUG_ON(!ab->skb); 1170 skb = ab->skb; 1171 avail = skb_tailroom(skb); 1172 new_len = slen + 3; /* enclosing quotes + null terminator */ 1173 if (new_len > avail) { 1174 avail = audit_expand(ab, new_len); 1175 if (!avail) 1176 return; 1177 } 1178 ptr = skb_tail_pointer(skb); 1179 *ptr++ = '"'; 1180 memcpy(ptr, string, slen); 1181 ptr += slen; 1182 *ptr++ = '"'; 1183 *ptr = 0; 1184 skb_put(skb, slen + 2); /* don't include null terminator */ 1185} 1186 1187/** 1188 * audit_log_n_unstrustedstring - log a string that may contain random characters 1189 * @ab: audit_buffer 1190 * @len: lenth of string (not including trailing null) 1191 * @string: string to be logged 1192 * 1193 * This code will escape a string that is passed to it if the string 1194 * contains a control character, unprintable character, double quote mark, 1195 * or a space. Unescaped strings will start and end with a double quote mark. 1196 * Strings that are escaped are printed in hex (2 digits per char). 1197 * 1198 * The caller specifies the number of characters in the string to log, which may 1199 * or may not be the entire string. 1200 */ 1201const char *audit_log_n_untrustedstring(struct audit_buffer *ab, size_t len, 1202 const char *string) 1203{ 1204 const unsigned char *p = string; 1205 1206 while (*p) { 1207 if (*p == '"' || *p < 0x21 || *p > 0x7f) { 1208 audit_log_hex(ab, string, len); 1209 return string + len + 1; 1210 } 1211 p++; 1212 } 1213 audit_log_n_string(ab, len, string); 1214 return p + 1; 1215} 1216 1217/** 1218 * audit_log_unstrustedstring - log a string that may contain random characters 1219 * @ab: audit_buffer 1220 * @string: string to be logged 1221 * 1222 * Same as audit_log_n_unstrustedstring(), except that strlen is used to 1223 * determine string length. 1224 */ 1225const char *audit_log_untrustedstring(struct audit_buffer *ab, const char *string) 1226{ 1227 return audit_log_n_untrustedstring(ab, strlen(string), string); 1228} 1229 1230/* This is a helper-function to print the escaped d_path */ 1231void audit_log_d_path(struct audit_buffer *ab, const char *prefix, 1232 struct dentry *dentry, struct vfsmount *vfsmnt) 1233{ 1234 char *p, *path; 1235 1236 if (prefix) 1237 audit_log_format(ab, " %s", prefix); 1238 1239 /* We will allow 11 spaces for ' (deleted)' to be appended */ 1240 path = kmalloc(PATH_MAX+11, ab->gfp_mask); 1241 if (!path) { 1242 audit_log_format(ab, "<no memory>"); 1243 return; 1244 } 1245 p = d_path(dentry, vfsmnt, path, PATH_MAX+11); 1246 if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */ 1247 audit_log_format(ab, "<too long>"); 1248 } else 1249 audit_log_untrustedstring(ab, p); 1250 kfree(path); 1251} 1252 1253/** 1254 * audit_log_end - end one audit record 1255 * @ab: the audit_buffer 1256 * 1257 * The netlink_* functions cannot be called inside an irq context, so 1258 * the audit buffer is placed on a queue and a tasklet is scheduled to 1259 * remove them from the queue outside the irq context. May be called in 1260 * any context. 1261 */ 1262void audit_log_end(struct audit_buffer *ab) 1263{ 1264 if (!ab) 1265 return; 1266 if (!audit_rate_check()) { 1267 audit_log_lost("rate limit exceeded"); 1268 } else { 1269 if (audit_pid) { 1270 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb); 1271 nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0); 1272 skb_queue_tail(&audit_skb_queue, ab->skb); 1273 ab->skb = NULL; 1274 wake_up_interruptible(&kauditd_wait); 1275 } else { 1276 printk(KERN_NOTICE "%s\n", ab->skb->data + NLMSG_SPACE(0)); 1277 } 1278 } 1279 audit_buffer_free(ab); 1280} 1281 1282/** 1283 * audit_log - Log an audit record 1284 * @ctx: audit context 1285 * @gfp_mask: type of allocation 1286 * @type: audit message type 1287 * @fmt: format string to use 1288 * @...: variable parameters matching the format string 1289 * 1290 * This is a convenience function that calls audit_log_start, 1291 * audit_log_vformat, and audit_log_end. It may be called 1292 * in any context. 1293 */ 1294void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 1295 const char *fmt, ...) 1296{ 1297 struct audit_buffer *ab; 1298 va_list args; 1299 1300 ab = audit_log_start(ctx, gfp_mask, type); 1301 if (ab) { 1302 va_start(args, fmt); 1303 audit_log_vformat(ab, fmt, args); 1304 va_end(args); 1305 audit_log_end(ab); 1306 } 1307} 1308 1309EXPORT_SYMBOL(audit_log_start); 1310EXPORT_SYMBOL(audit_log_end); 1311EXPORT_SYMBOL(audit_log_format); 1312EXPORT_SYMBOL(audit_log); 1313