aboutsummaryrefslogtreecommitdiffstats
path: root/net/netlabel/netlabel_user.c
diff options
context:
space:
mode:
authorPaul Moore <paul.moore@hp.com>2006-09-28 17:51:47 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2006-09-28 21:03:09 -0400
commit32f50cdee666333168b5203c7864bede159f789e (patch)
treec4989cc2521551714f656d60f6b895232ffdeda6 /net/netlabel/netlabel_user.c
parent8ea333eb5da3e3219f570220c56bca09f6f4d25a (diff)
[NetLabel]: add audit support for configuration changes
This patch adds audit support to NetLabel, including six new audit message types shown below. #define AUDIT_MAC_UNLBL_ACCEPT 1406 #define AUDIT_MAC_UNLBL_DENY 1407 #define AUDIT_MAC_CIPSOV4_ADD 1408 #define AUDIT_MAC_CIPSOV4_DEL 1409 #define AUDIT_MAC_MAP_ADD 1410 #define AUDIT_MAC_MAP_DEL 1411 Signed-off-by: Paul Moore <paul.moore@hp.com> Acked-by: James Morris <jmorris@namei.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netlabel/netlabel_user.c')
-rw-r--r--net/netlabel/netlabel_user.c91
1 files changed, 91 insertions, 0 deletions
diff --git a/net/netlabel/netlabel_user.c b/net/netlabel/netlabel_user.c
index eeb7d768d2bb..c2343af584cb 100644
--- a/net/netlabel/netlabel_user.c
+++ b/net/netlabel/netlabel_user.c
@@ -32,6 +32,9 @@
32#include <linux/types.h> 32#include <linux/types.h>
33#include <linux/list.h> 33#include <linux/list.h>
34#include <linux/socket.h> 34#include <linux/socket.h>
35#include <linux/audit.h>
36#include <linux/tty.h>
37#include <linux/security.h>
35#include <net/sock.h> 38#include <net/sock.h>
36#include <net/netlink.h> 39#include <net/netlink.h>
37#include <net/genetlink.h> 40#include <net/genetlink.h>
@@ -74,3 +77,91 @@ int netlbl_netlink_init(void)
74 77
75 return 0; 78 return 0;
76} 79}
80
81/*
82 * NetLabel Audit Functions
83 */
84
85/**
86 * netlbl_audit_start_common - Start an audit message
87 * @type: audit message type
88 * @secid: LSM context ID
89 *
90 * Description:
91 * Start an audit message using the type specified in @type and fill the audit
92 * message with some fields common to all NetLabel audit messages. Returns
93 * a pointer to the audit buffer on success, NULL on failure.
94 *
95 */
96struct audit_buffer *netlbl_audit_start_common(int type, u32 secid)
97{
98 struct audit_context *audit_ctx = current->audit_context;
99 struct audit_buffer *audit_buf;
100 uid_t audit_loginuid;
101 const char *audit_tty;
102 char audit_comm[sizeof(current->comm)];
103 struct vm_area_struct *vma;
104 char *secctx;
105 u32 secctx_len;
106
107 audit_buf = audit_log_start(audit_ctx, GFP_ATOMIC, type);
108 if (audit_buf == NULL)
109 return NULL;
110
111 audit_loginuid = audit_get_loginuid(audit_ctx);
112 if (current->signal &&
113 current->signal->tty &&
114 current->signal->tty->name)
115 audit_tty = current->signal->tty->name;
116 else
117 audit_tty = "(none)";
118 get_task_comm(audit_comm, current);
119
120 audit_log_format(audit_buf,
121 "netlabel: auid=%u uid=%u tty=%s pid=%d",
122 audit_loginuid,
123 current->uid,
124 audit_tty,
125 current->pid);
126 audit_log_format(audit_buf, " comm=");
127 audit_log_untrustedstring(audit_buf, audit_comm);
128 if (current->mm) {
129 down_read(&current->mm->mmap_sem);
130 vma = current->mm->mmap;
131 while (vma) {
132 if ((vma->vm_flags & VM_EXECUTABLE) &&
133 vma->vm_file) {
134 audit_log_d_path(audit_buf,
135 " exe=",
136 vma->vm_file->f_dentry,
137 vma->vm_file->f_vfsmnt);
138 break;
139 }
140 vma = vma->vm_next;
141 }
142 up_read(&current->mm->mmap_sem);
143 }
144
145 if (secid != 0 &&
146 security_secid_to_secctx(secid, &secctx, &secctx_len) == 0)
147 audit_log_format(audit_buf, " subj=%s", secctx);
148
149 return audit_buf;
150}
151
152/**
153 * netlbl_audit_nomsg - Send an audit message without additional text
154 * @type: audit message type
155 * @secid: LSM context ID
156 *
157 * Description:
158 * Send an audit message with only the common NetLabel audit fields.
159 *
160 */
161void netlbl_audit_nomsg(int type, u32 secid)
162{
163 struct audit_buffer *audit_buf;
164
165 audit_buf = netlbl_audit_start_common(type, secid);
166 audit_log_end(audit_buf);
167}