1 files changed, 25 insertions, 71 deletions
diff --git a/include/linux/lsm_audit.h b/include/linux/lsm_audit.h
index eab507f2b1cb..fad48aab893b 100644
--- a/include/linux/lsm_audit.h
+++ b/include/linux/lsm_audit.h
@@ -22,6 +22,23 @@
 #include <linux/key.h>
 #include <linux/skbuff.h>
+struct lsm_network_audit {
+        int netif;
+        struct sock *sk;
+        u16 family;
+        __be16 dport;
+        __be16 sport;
+        union {
+                struct {
+                        __be32 daddr;
+                        __be32 saddr;
+                } v4;
+                struct {
+                        struct in6_addr daddr;
+                        struct in6_addr saddr;
+                } v6;
+        } fam;
+};
 /* Auxiliary data to use in generating the audit record. */
 struct common_audit_data {
@@ -41,23 +58,7 @@ struct common_audit_data {
                struct path path;
                struct dentry *dentry;
                struct inode *inode;
-                struct {
+                struct lsm_network_audit *net;
-                        int netif;
-                        struct sock *sk;
-                        u16 family;
-                        __be16 dport;
-                        __be16 sport;
-                        union {
-                                struct {
-                                        __be32 daddr;
-                                        __be32 saddr;
-                                } v4;
-                                struct {
-                                        struct in6_addr daddr;
-                                        struct in6_addr saddr;
-                                } v6;
-                        } fam;
-                } net;
                int cap;
                int ipc_id;
                struct task_struct *tsk;
@@ -72,64 +73,15 @@ struct common_audit_data {
        /* this union contains LSM specific data */
        union {
 #ifdef CONFIG_SECURITY_SMACK
-                /* SMACK data */
+                struct smack_audit_data *smack_audit_data;
-                struct smack_audit_data {
-                        const char *function;
-                        char *subject;
-                        char *object;
-                        char *request;
-                        int result;
-                } smack_audit_data;
 #endif
 #ifdef CONFIG_SECURITY_SELINUX
-                /* SELinux data */
+                struct selinux_audit_data *selinux_audit_data;
-                struct {
-                        u32 ssid;
-                        u32 tsid;
-                        u16 tclass;
-                        u32 requested;
-                        u32 audited;
-                        u32 denied;
-                        /*
-                         * auditdeny is a bit tricky and unintuitive.  See the
-                         * comments in avc.c for it's meaning and usage.
-                         */
-                        u32 auditdeny;
-                        struct av_decision *avd;
-                        int result;
-                } selinux_audit_data;
 #endif
 #ifdef CONFIG_SECURITY_APPARMOR
-                struct {
+                struct apparmor_audit_data *apparmor_audit_data;
-                        int error;
-                        int op;
-                        int type;
-                        void *profile;
-                        const char *name;
-                        const char *info;
-                        union {
-                                void *target;
-                                struct {
-                                        long pos;
-                                        void *target;
-                                } iface;
-                                struct {
-                                        int rlim;
-                                        unsigned long max;
-                                } rlim;
-                                struct {
-                                        const char *target;
-                                        u32 request;
-                                        u32 denied;
-                                        uid_t ouid;
-                                } fs;
-                        };
-                } apparmor_audit_data;
 #endif
-        };
+        }; /* per LSM data pointer union */
-        /* these callback will be implemented by a specific LSM */
-        void (*lsm_pre_audit)(struct audit_buffer *, void *);
-        void (*lsm_post_audit)(struct audit_buffer *, void *);
 };
 #define v4info fam.v4
@@ -146,6 +98,8 @@ int ipv6_skb_to_auditdata(struct sk_buff *skb,
        { memset((_d), 0, sizeof(struct common_audit_data)); \
         (_d)->type = LSM_AUDIT_DATA_##_t; }
-void common_lsm_audit(struct common_audit_data *a);
+void common_lsm_audit(struct common_audit_data *a,
+        void (*pre_audit)(struct audit_buffer *, void *),
+        void (*post_audit)(struct audit_buffer *, void *));
 #endif

diff --git a/include/linux/lsm_audit.h b/include/linux/lsm_audit.h index eab507f2b1cb..fad48aab893b 100644 --- a/include/linux/lsm_audit.h +++ b/include/linux/lsm_audit.h
@@ -22,6 +22,23 @@
22	#include <linux/key.h>	22	#include <linux/key.h>
23	#include <linux/skbuff.h>	23	#include <linux/skbuff.h>
24		24
		25	struct lsm_network_audit {
		26	int netif;
		27	struct sock *sk;
		28	u16 family;
		29	__be16 dport;
		30	__be16 sport;
		31	union {
		32	struct {
		33	__be32 daddr;
		34	__be32 saddr;
		35	} v4;
		36	struct {
		37	struct in6_addr daddr;
		38	struct in6_addr saddr;
		39	} v6;
		40	} fam;
		41	};
25		42
26	/* Auxiliary data to use in generating the audit record. */	43	/* Auxiliary data to use in generating the audit record. */
27	struct common_audit_data {	44	struct common_audit_data {
@@ -41,23 +58,7 @@ struct common_audit_data {
41	struct path path;	58	struct path path;
42	struct dentry *dentry;	59	struct dentry *dentry;
43	struct inode *inode;	60	struct inode *inode;
44	struct {	61	struct lsm_network_audit *net;
45	int netif;
46	struct sock *sk;
47	u16 family;
48	__be16 dport;
49	__be16 sport;
50	union {
51	struct {
52	__be32 daddr;
53	__be32 saddr;
54	} v4;
55	struct {
56	struct in6_addr daddr;
57	struct in6_addr saddr;
58	} v6;
59	} fam;
60	} net;
61	int cap;	62	int cap;
62	int ipc_id;	63	int ipc_id;
63	struct task_struct *tsk;	64	struct task_struct *tsk;
@@ -72,64 +73,15 @@ struct common_audit_data {
72	/* this union contains LSM specific data */	73	/* this union contains LSM specific data */
73	union {	74	union {
74	#ifdef CONFIG_SECURITY_SMACK	75	#ifdef CONFIG_SECURITY_SMACK
75	/* SMACK data */	76	struct smack_audit_data *smack_audit_data;
76	struct smack_audit_data {
77	const char *function;
78	char *subject;
79	char *object;
80	char *request;
81	int result;
82	} smack_audit_data;
83	#endif	77	#endif
84	#ifdef CONFIG_SECURITY_SELINUX	78	#ifdef CONFIG_SECURITY_SELINUX
85	/* SELinux data */	79	struct selinux_audit_data *selinux_audit_data;
86	struct {
87	u32 ssid;
88	u32 tsid;
89	u16 tclass;
90	u32 requested;
91	u32 audited;
92	u32 denied;
93	/*
94	* auditdeny is a bit tricky and unintuitive. See the
95	* comments in avc.c for it's meaning and usage.
96	*/
97	u32 auditdeny;
98	struct av_decision *avd;
99	int result;
100	} selinux_audit_data;
101	#endif	80	#endif
102	#ifdef CONFIG_SECURITY_APPARMOR	81	#ifdef CONFIG_SECURITY_APPARMOR
103	struct {	82	struct apparmor_audit_data *apparmor_audit_data;
104	int error;
105	int op;
106	int type;
107	void *profile;
108	const char *name;
109	const char *info;
110	union {
111	void *target;
112	struct {
113	long pos;
114	void *target;
115	} iface;
116	struct {
117	int rlim;
118	unsigned long max;
119	} rlim;
120	struct {
121	const char *target;
122	u32 request;
123	u32 denied;
124	uid_t ouid;
125	} fs;
126	};
127	} apparmor_audit_data;
128	#endif	83	#endif
129	};	84	}; /* per LSM data pointer union */
130	/* these callback will be implemented by a specific LSM */
131	void (lsm_pre_audit)(struct audit_buffer , void *);
132	void (lsm_post_audit)(struct audit_buffer , void *);
133	};	85	};
134		86
135	#define v4info fam.v4	87	#define v4info fam.v4
@@ -146,6 +98,8 @@ int ipv6_skb_to_auditdata(struct sk_buff *skb,
146	{ memset((_d), 0, sizeof(struct common_audit_data)); \	98	{ memset((_d), 0, sizeof(struct common_audit_data)); \
147	(_d)->type = LSM_AUDIT_DATA_##_t; }	99	(_d)->type = LSM_AUDIT_DATA_##_t; }
148		100
149	void common_lsm_audit(struct common_audit_data *a);	101	void common_lsm_audit(struct common_audit_data *a,
		102	void (pre_audit)(struct audit_buffer , void *),
		103	void (post_audit)(struct audit_buffer , void *));
150		104
151	#endif	105	#endif