aboutsummaryrefslogtreecommitdiffstats
path: root/kernel/auditsc.c
diff options
context:
space:
mode:
Diffstat (limited to 'kernel/auditsc.c')
-rw-r--r--kernel/auditsc.c930
1 files changed, 484 insertions, 446 deletions
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 2a3f0afc4d2a..8cbddff6c283 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -65,6 +65,7 @@
65#include <linux/highmem.h> 65#include <linux/highmem.h>
66#include <linux/syscalls.h> 66#include <linux/syscalls.h>
67#include <linux/inotify.h> 67#include <linux/inotify.h>
68#include <linux/capability.h>
68 69
69#include "audit.h" 70#include "audit.h"
70 71
@@ -84,6 +85,15 @@ int audit_n_rules;
84/* determines whether we collect data for signals sent */ 85/* determines whether we collect data for signals sent */
85int audit_signals; 86int audit_signals;
86 87
88struct audit_cap_data {
89 kernel_cap_t permitted;
90 kernel_cap_t inheritable;
91 union {
92 unsigned int fE; /* effective bit of a file capability */
93 kernel_cap_t effective; /* effective set of a process */
94 };
95};
96
87/* When fs/namei.c:getname() is called, we store the pointer in name and 97/* When fs/namei.c:getname() is called, we store the pointer in name and
88 * we don't let putname() free it (instead we free all of the saved 98 * we don't let putname() free it (instead we free all of the saved
89 * pointers at syscall exit time). 99 * pointers at syscall exit time).
@@ -100,6 +110,8 @@ struct audit_names {
100 gid_t gid; 110 gid_t gid;
101 dev_t rdev; 111 dev_t rdev;
102 u32 osid; 112 u32 osid;
113 struct audit_cap_data fcap;
114 unsigned int fcap_ver;
103}; 115};
104 116
105struct audit_aux_data { 117struct audit_aux_data {
@@ -112,43 +124,6 @@ struct audit_aux_data {
112/* Number of target pids per aux struct. */ 124/* Number of target pids per aux struct. */
113#define AUDIT_AUX_PIDS 16 125#define AUDIT_AUX_PIDS 16
114 126
115struct audit_aux_data_mq_open {
116 struct audit_aux_data d;
117 int oflag;
118 mode_t mode;
119 struct mq_attr attr;
120};
121
122struct audit_aux_data_mq_sendrecv {
123 struct audit_aux_data d;
124 mqd_t mqdes;
125 size_t msg_len;
126 unsigned int msg_prio;
127 struct timespec abs_timeout;
128};
129
130struct audit_aux_data_mq_notify {
131 struct audit_aux_data d;
132 mqd_t mqdes;
133 struct sigevent notification;
134};
135
136struct audit_aux_data_mq_getsetattr {
137 struct audit_aux_data d;
138 mqd_t mqdes;
139 struct mq_attr mqstat;
140};
141
142struct audit_aux_data_ipcctl {
143 struct audit_aux_data d;
144 struct ipc_perm p;
145 unsigned long qbytes;
146 uid_t uid;
147 gid_t gid;
148 mode_t mode;
149 u32 osid;
150};
151
152struct audit_aux_data_execve { 127struct audit_aux_data_execve {
153 struct audit_aux_data d; 128 struct audit_aux_data d;
154 int argc; 129 int argc;
@@ -156,23 +131,6 @@ struct audit_aux_data_execve {
156 struct mm_struct *mm; 131 struct mm_struct *mm;
157}; 132};
158 133
159struct audit_aux_data_socketcall {
160 struct audit_aux_data d;
161 int nargs;
162 unsigned long args[0];
163};
164
165struct audit_aux_data_sockaddr {
166 struct audit_aux_data d;
167 int len;
168 char a[0];
169};
170
171struct audit_aux_data_fd_pair {
172 struct audit_aux_data d;
173 int fd[2];
174};
175
176struct audit_aux_data_pids { 134struct audit_aux_data_pids {
177 struct audit_aux_data d; 135 struct audit_aux_data d;
178 pid_t target_pid[AUDIT_AUX_PIDS]; 136 pid_t target_pid[AUDIT_AUX_PIDS];
@@ -184,6 +142,20 @@ struct audit_aux_data_pids {
184 int pid_count; 142 int pid_count;
185}; 143};
186 144
145struct audit_aux_data_bprm_fcaps {
146 struct audit_aux_data d;
147 struct audit_cap_data fcap;
148 unsigned int fcap_ver;
149 struct audit_cap_data old_pcap;
150 struct audit_cap_data new_pcap;
151};
152
153struct audit_aux_data_capset {
154 struct audit_aux_data d;
155 pid_t pid;
156 struct audit_cap_data cap;
157};
158
187struct audit_tree_refs { 159struct audit_tree_refs {
188 struct audit_tree_refs *next; 160 struct audit_tree_refs *next;
189 struct audit_chunk *c[31]; 161 struct audit_chunk *c[31];
@@ -193,14 +165,14 @@ struct audit_tree_refs {
193struct audit_context { 165struct audit_context {
194 int dummy; /* must be the first element */ 166 int dummy; /* must be the first element */
195 int in_syscall; /* 1 if task is in a syscall */ 167 int in_syscall; /* 1 if task is in a syscall */
196 enum audit_state state; 168 enum audit_state state, current_state;
197 unsigned int serial; /* serial number for record */ 169 unsigned int serial; /* serial number for record */
198 struct timespec ctime; /* time of syscall entry */ 170 struct timespec ctime; /* time of syscall entry */
199 int major; /* syscall number */ 171 int major; /* syscall number */
200 unsigned long argv[4]; /* syscall arguments */ 172 unsigned long argv[4]; /* syscall arguments */
201 int return_valid; /* return code is valid */ 173 int return_valid; /* return code is valid */
202 long return_code;/* syscall return code */ 174 long return_code;/* syscall return code */
203 int auditable; /* 1 if record should be written */ 175 u64 prio;
204 int name_count; 176 int name_count;
205 struct audit_names names[AUDIT_NAMES]; 177 struct audit_names names[AUDIT_NAMES];
206 char * filterkey; /* key for rule that triggered record */ 178 char * filterkey; /* key for rule that triggered record */
@@ -208,7 +180,8 @@ struct audit_context {
208 struct audit_context *previous; /* For nested syscalls */ 180 struct audit_context *previous; /* For nested syscalls */
209 struct audit_aux_data *aux; 181 struct audit_aux_data *aux;
210 struct audit_aux_data *aux_pids; 182 struct audit_aux_data *aux_pids;
211 183 struct sockaddr_storage *sockaddr;
184 size_t sockaddr_len;
212 /* Save things to print about task_struct */ 185 /* Save things to print about task_struct */
213 pid_t pid, ppid; 186 pid_t pid, ppid;
214 uid_t uid, euid, suid, fsuid; 187 uid_t uid, euid, suid, fsuid;
@@ -226,6 +199,49 @@ struct audit_context {
226 struct audit_tree_refs *trees, *first_trees; 199 struct audit_tree_refs *trees, *first_trees;
227 int tree_count; 200 int tree_count;
228 201
202 int type;
203 union {
204 struct {
205 int nargs;
206 long args[6];
207 } socketcall;
208 struct {
209 uid_t uid;
210 gid_t gid;
211 mode_t mode;
212 u32 osid;
213 int has_perm;
214 uid_t perm_uid;
215 gid_t perm_gid;
216 mode_t perm_mode;
217 unsigned long qbytes;
218 } ipc;
219 struct {
220 mqd_t mqdes;
221 struct mq_attr mqstat;
222 } mq_getsetattr;
223 struct {
224 mqd_t mqdes;
225 int sigev_signo;
226 } mq_notify;
227 struct {
228 mqd_t mqdes;
229 size_t msg_len;
230 unsigned int msg_prio;
231 struct timespec abs_timeout;
232 } mq_sendrecv;
233 struct {
234 int oflag;
235 mode_t mode;
236 struct mq_attr attr;
237 } mq_open;
238 struct {
239 pid_t pid;
240 struct audit_cap_data cap;
241 } capset;
242 };
243 int fds[2];
244
229#if AUDIT_DEBUG 245#if AUDIT_DEBUG
230 int put_count; 246 int put_count;
231 int ino_count; 247 int ino_count;
@@ -421,6 +437,7 @@ static int audit_filter_rules(struct task_struct *tsk,
421 struct audit_names *name, 437 struct audit_names *name,
422 enum audit_state *state) 438 enum audit_state *state)
423{ 439{
440 const struct cred *cred = get_task_cred(tsk);
424 int i, j, need_sid = 1; 441 int i, j, need_sid = 1;
425 u32 sid; 442 u32 sid;
426 443
@@ -440,28 +457,28 @@ static int audit_filter_rules(struct task_struct *tsk,
440 } 457 }
441 break; 458 break;
442 case AUDIT_UID: 459 case AUDIT_UID:
443 result = audit_comparator(tsk->uid, f->op, f->val); 460 result = audit_comparator(cred->uid, f->op, f->val);
444 break; 461 break;
445 case AUDIT_EUID: 462 case AUDIT_EUID:
446 result = audit_comparator(tsk->euid, f->op, f->val); 463 result = audit_comparator(cred->euid, f->op, f->val);
447 break; 464 break;
448 case AUDIT_SUID: 465 case AUDIT_SUID:
449 result = audit_comparator(tsk->suid, f->op, f->val); 466 result = audit_comparator(cred->suid, f->op, f->val);
450 break; 467 break;
451 case AUDIT_FSUID: 468 case AUDIT_FSUID:
452 result = audit_comparator(tsk->fsuid, f->op, f->val); 469 result = audit_comparator(cred->fsuid, f->op, f->val);
453 break; 470 break;
454 case AUDIT_GID: 471 case AUDIT_GID:
455 result = audit_comparator(tsk->gid, f->op, f->val); 472 result = audit_comparator(cred->gid, f->op, f->val);
456 break; 473 break;
457 case AUDIT_EGID: 474 case AUDIT_EGID:
458 result = audit_comparator(tsk->egid, f->op, f->val); 475 result = audit_comparator(cred->egid, f->op, f->val);
459 break; 476 break;
460 case AUDIT_SGID: 477 case AUDIT_SGID:
461 result = audit_comparator(tsk->sgid, f->op, f->val); 478 result = audit_comparator(cred->sgid, f->op, f->val);
462 break; 479 break;
463 case AUDIT_FSGID: 480 case AUDIT_FSGID:
464 result = audit_comparator(tsk->fsgid, f->op, f->val); 481 result = audit_comparator(cred->fsgid, f->op, f->val);
465 break; 482 break;
466 case AUDIT_PERS: 483 case AUDIT_PERS:
467 result = audit_comparator(tsk->personality, f->op, f->val); 484 result = audit_comparator(tsk->personality, f->op, f->val);
@@ -581,19 +598,12 @@ static int audit_filter_rules(struct task_struct *tsk,
581 } 598 }
582 } 599 }
583 /* Find ipc objects that match */ 600 /* Find ipc objects that match */
584 if (ctx) { 601 if (!ctx || ctx->type != AUDIT_IPC)
585 struct audit_aux_data *aux; 602 break;
586 for (aux = ctx->aux; aux; 603 if (security_audit_rule_match(ctx->ipc.osid,
587 aux = aux->next) { 604 f->type, f->op,
588 if (aux->type == AUDIT_IPC) { 605 f->lsm_rule, ctx))
589 struct audit_aux_data_ipcctl *axi = (void *)aux; 606 ++result;
590 if (security_audit_rule_match(axi->osid, f->type, f->op, f->lsm_rule, ctx)) {
591 ++result;
592 break;
593 }
594 }
595 }
596 }
597 } 607 }
598 break; 608 break;
599 case AUDIT_ARG0: 609 case AUDIT_ARG0:
@@ -615,15 +625,26 @@ static int audit_filter_rules(struct task_struct *tsk,
615 break; 625 break;
616 } 626 }
617 627
618 if (!result) 628 if (!result) {
629 put_cred(cred);
619 return 0; 630 return 0;
631 }
632 }
633
634 if (ctx) {
635 if (rule->prio <= ctx->prio)
636 return 0;
637 if (rule->filterkey) {
638 kfree(ctx->filterkey);
639 ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
640 }
641 ctx->prio = rule->prio;
620 } 642 }
621 if (rule->filterkey && ctx)
622 ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
623 switch (rule->action) { 643 switch (rule->action) {
624 case AUDIT_NEVER: *state = AUDIT_DISABLED; break; 644 case AUDIT_NEVER: *state = AUDIT_DISABLED; break;
625 case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break; 645 case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break;
626 } 646 }
647 put_cred(cred);
627 return 1; 648 return 1;
628} 649}
629 650
@@ -631,7 +652,7 @@ static int audit_filter_rules(struct task_struct *tsk,
631 * completely disabled for this task. Since we only have the task 652 * completely disabled for this task. Since we only have the task
632 * structure at this point, we can only check uid and gid. 653 * structure at this point, we can only check uid and gid.
633 */ 654 */
634static enum audit_state audit_filter_task(struct task_struct *tsk) 655static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
635{ 656{
636 struct audit_entry *e; 657 struct audit_entry *e;
637 enum audit_state state; 658 enum audit_state state;
@@ -639,6 +660,8 @@ static enum audit_state audit_filter_task(struct task_struct *tsk)
639 rcu_read_lock(); 660 rcu_read_lock();
640 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) { 661 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
641 if (audit_filter_rules(tsk, &e->rule, NULL, NULL, &state)) { 662 if (audit_filter_rules(tsk, &e->rule, NULL, NULL, &state)) {
663 if (state == AUDIT_RECORD_CONTEXT)
664 *key = kstrdup(e->rule.filterkey, GFP_ATOMIC);
642 rcu_read_unlock(); 665 rcu_read_unlock();
643 return state; 666 return state;
644 } 667 }
@@ -672,6 +695,7 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
672 audit_filter_rules(tsk, &e->rule, ctx, NULL, 695 audit_filter_rules(tsk, &e->rule, ctx, NULL,
673 &state)) { 696 &state)) {
674 rcu_read_unlock(); 697 rcu_read_unlock();
698 ctx->current_state = state;
675 return state; 699 return state;
676 } 700 }
677 } 701 }
@@ -685,15 +709,14 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
685 * buckets applicable to the inode numbers in audit_names[]. 709 * buckets applicable to the inode numbers in audit_names[].
686 * Regarding audit_state, same rules apply as for audit_filter_syscall(). 710 * Regarding audit_state, same rules apply as for audit_filter_syscall().
687 */ 711 */
688enum audit_state audit_filter_inodes(struct task_struct *tsk, 712void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx)
689 struct audit_context *ctx)
690{ 713{
691 int i; 714 int i;
692 struct audit_entry *e; 715 struct audit_entry *e;
693 enum audit_state state; 716 enum audit_state state;
694 717
695 if (audit_pid && tsk->tgid == audit_pid) 718 if (audit_pid && tsk->tgid == audit_pid)
696 return AUDIT_DISABLED; 719 return;
697 720
698 rcu_read_lock(); 721 rcu_read_lock();
699 for (i = 0; i < ctx->name_count; i++) { 722 for (i = 0; i < ctx->name_count; i++) {
@@ -710,17 +733,20 @@ enum audit_state audit_filter_inodes(struct task_struct *tsk,
710 if ((e->rule.mask[word] & bit) == bit && 733 if ((e->rule.mask[word] & bit) == bit &&
711 audit_filter_rules(tsk, &e->rule, ctx, n, &state)) { 734 audit_filter_rules(tsk, &e->rule, ctx, n, &state)) {
712 rcu_read_unlock(); 735 rcu_read_unlock();
713 return state; 736 ctx->current_state = state;
737 return;
714 } 738 }
715 } 739 }
716 } 740 }
717 rcu_read_unlock(); 741 rcu_read_unlock();
718 return AUDIT_BUILD_CONTEXT;
719} 742}
720 743
721void audit_set_auditable(struct audit_context *ctx) 744static void audit_set_auditable(struct audit_context *ctx)
722{ 745{
723 ctx->auditable = 1; 746 if (!ctx->prio) {
747 ctx->prio = 1;
748 ctx->current_state = AUDIT_RECORD_CONTEXT;
749 }
724} 750}
725 751
726static inline struct audit_context *audit_get_context(struct task_struct *tsk, 752static inline struct audit_context *audit_get_context(struct task_struct *tsk,
@@ -751,23 +777,11 @@ static inline struct audit_context *audit_get_context(struct task_struct *tsk,
751 else 777 else
752 context->return_code = return_code; 778 context->return_code = return_code;
753 779
754 if (context->in_syscall && !context->dummy && !context->auditable) { 780 if (context->in_syscall && !context->dummy) {
755 enum audit_state state; 781 audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
756 782 audit_filter_inodes(tsk, context);
757 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
758 if (state == AUDIT_RECORD_CONTEXT) {
759 context->auditable = 1;
760 goto get_context;
761 }
762
763 state = audit_filter_inodes(tsk, context);
764 if (state == AUDIT_RECORD_CONTEXT)
765 context->auditable = 1;
766
767 } 783 }
768 784
769get_context:
770
771 tsk->audit_context = NULL; 785 tsk->audit_context = NULL;
772 return context; 786 return context;
773} 787}
@@ -777,8 +791,7 @@ static inline void audit_free_names(struct audit_context *context)
777 int i; 791 int i;
778 792
779#if AUDIT_DEBUG == 2 793#if AUDIT_DEBUG == 2
780 if (context->auditable 794 if (context->put_count + context->ino_count != context->name_count) {
781 ||context->put_count + context->ino_count != context->name_count) {
782 printk(KERN_ERR "%s:%d(:%d): major=%d in_syscall=%d" 795 printk(KERN_ERR "%s:%d(:%d): major=%d in_syscall=%d"
783 " name_count=%d put_count=%d" 796 " name_count=%d put_count=%d"
784 " ino_count=%d [NOT freeing]\n", 797 " ino_count=%d [NOT freeing]\n",
@@ -829,6 +842,7 @@ static inline void audit_zero_context(struct audit_context *context,
829{ 842{
830 memset(context, 0, sizeof(*context)); 843 memset(context, 0, sizeof(*context));
831 context->state = state; 844 context->state = state;
845 context->prio = state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;
832} 846}
833 847
834static inline struct audit_context *audit_alloc_context(enum audit_state state) 848static inline struct audit_context *audit_alloc_context(enum audit_state state)
@@ -854,18 +868,21 @@ int audit_alloc(struct task_struct *tsk)
854{ 868{
855 struct audit_context *context; 869 struct audit_context *context;
856 enum audit_state state; 870 enum audit_state state;
871 char *key = NULL;
857 872
858 if (likely(!audit_ever_enabled)) 873 if (likely(!audit_ever_enabled))
859 return 0; /* Return if not auditing. */ 874 return 0; /* Return if not auditing. */
860 875
861 state = audit_filter_task(tsk); 876 state = audit_filter_task(tsk, &key);
862 if (likely(state == AUDIT_DISABLED)) 877 if (likely(state == AUDIT_DISABLED))
863 return 0; 878 return 0;
864 879
865 if (!(context = audit_alloc_context(state))) { 880 if (!(context = audit_alloc_context(state))) {
881 kfree(key);
866 audit_log_lost("out of memory in audit_alloc"); 882 audit_log_lost("out of memory in audit_alloc");
867 return -ENOMEM; 883 return -ENOMEM;
868 } 884 }
885 context->filterkey = key;
869 886
870 tsk->audit_context = context; 887 tsk->audit_context = context;
871 set_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT); 888 set_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
@@ -891,6 +908,7 @@ static inline void audit_free_context(struct audit_context *context)
891 free_tree_refs(context); 908 free_tree_refs(context);
892 audit_free_aux(context); 909 audit_free_aux(context);
893 kfree(context->filterkey); 910 kfree(context->filterkey);
911 kfree(context->sockaddr);
894 kfree(context); 912 kfree(context);
895 context = previous; 913 context = previous;
896 } while (context); 914 } while (context);
@@ -1171,8 +1189,129 @@ static void audit_log_execve_info(struct audit_context *context,
1171 kfree(buf); 1189 kfree(buf);
1172} 1190}
1173 1191
1192static void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap)
1193{
1194 int i;
1195
1196 audit_log_format(ab, " %s=", prefix);
1197 CAP_FOR_EACH_U32(i) {
1198 audit_log_format(ab, "%08x", cap->cap[(_KERNEL_CAPABILITY_U32S-1) - i]);
1199 }
1200}
1201
1202static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
1203{
1204 kernel_cap_t *perm = &name->fcap.permitted;
1205 kernel_cap_t *inh = &name->fcap.inheritable;
1206 int log = 0;
1207
1208 if (!cap_isclear(*perm)) {
1209 audit_log_cap(ab, "cap_fp", perm);
1210 log = 1;
1211 }
1212 if (!cap_isclear(*inh)) {
1213 audit_log_cap(ab, "cap_fi", inh);
1214 log = 1;
1215 }
1216
1217 if (log)
1218 audit_log_format(ab, " cap_fe=%d cap_fver=%x", name->fcap.fE, name->fcap_ver);
1219}
1220
1221static void show_special(struct audit_context *context, int *call_panic)
1222{
1223 struct audit_buffer *ab;
1224 int i;
1225
1226 ab = audit_log_start(context, GFP_KERNEL, context->type);
1227 if (!ab)
1228 return;
1229
1230 switch (context->type) {
1231 case AUDIT_SOCKETCALL: {
1232 int nargs = context->socketcall.nargs;
1233 audit_log_format(ab, "nargs=%d", nargs);
1234 for (i = 0; i < nargs; i++)
1235 audit_log_format(ab, " a%d=%lx", i,
1236 context->socketcall.args[i]);
1237 break; }
1238 case AUDIT_IPC: {
1239 u32 osid = context->ipc.osid;
1240
1241 audit_log_format(ab, "ouid=%u ogid=%u mode=%#o",
1242 context->ipc.uid, context->ipc.gid, context->ipc.mode);
1243 if (osid) {
1244 char *ctx = NULL;
1245 u32 len;
1246 if (security_secid_to_secctx(osid, &ctx, &len)) {
1247 audit_log_format(ab, " osid=%u", osid);
1248 *call_panic = 1;
1249 } else {
1250 audit_log_format(ab, " obj=%s", ctx);
1251 security_release_secctx(ctx, len);
1252 }
1253 }
1254 if (context->ipc.has_perm) {
1255 audit_log_end(ab);
1256 ab = audit_log_start(context, GFP_KERNEL,
1257 AUDIT_IPC_SET_PERM);
1258 audit_log_format(ab,
1259 "qbytes=%lx ouid=%u ogid=%u mode=%#o",
1260 context->ipc.qbytes,
1261 context->ipc.perm_uid,
1262 context->ipc.perm_gid,
1263 context->ipc.perm_mode);
1264 if (!ab)
1265 return;
1266 }
1267 break; }
1268 case AUDIT_MQ_OPEN: {
1269 audit_log_format(ab,
1270 "oflag=0x%x mode=%#o mq_flags=0x%lx mq_maxmsg=%ld "
1271 "mq_msgsize=%ld mq_curmsgs=%ld",
1272 context->mq_open.oflag, context->mq_open.mode,
1273 context->mq_open.attr.mq_flags,
1274 context->mq_open.attr.mq_maxmsg,
1275 context->mq_open.attr.mq_msgsize,
1276 context->mq_open.attr.mq_curmsgs);
1277 break; }
1278 case AUDIT_MQ_SENDRECV: {
1279 audit_log_format(ab,
1280 "mqdes=%d msg_len=%zd msg_prio=%u "
1281 "abs_timeout_sec=%ld abs_timeout_nsec=%ld",
1282 context->mq_sendrecv.mqdes,
1283 context->mq_sendrecv.msg_len,
1284 context->mq_sendrecv.msg_prio,
1285 context->mq_sendrecv.abs_timeout.tv_sec,
1286 context->mq_sendrecv.abs_timeout.tv_nsec);
1287 break; }
1288 case AUDIT_MQ_NOTIFY: {
1289 audit_log_format(ab, "mqdes=%d sigev_signo=%d",
1290 context->mq_notify.mqdes,
1291 context->mq_notify.sigev_signo);
1292 break; }
1293 case AUDIT_MQ_GETSETATTR: {
1294 struct mq_attr *attr = &context->mq_getsetattr.mqstat;
1295 audit_log_format(ab,
1296 "mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
1297 "mq_curmsgs=%ld ",
1298 context->mq_getsetattr.mqdes,
1299 attr->mq_flags, attr->mq_maxmsg,
1300 attr->mq_msgsize, attr->mq_curmsgs);
1301 break; }
1302 case AUDIT_CAPSET: {
1303 audit_log_format(ab, "pid=%d", context->capset.pid);
1304 audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable);
1305 audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted);
1306 audit_log_cap(ab, "cap_pe", &context->capset.cap.effective);
1307 break; }
1308 }
1309 audit_log_end(ab);
1310}
1311
1174static void audit_log_exit(struct audit_context *context, struct task_struct *tsk) 1312static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)
1175{ 1313{
1314 const struct cred *cred;
1176 int i, call_panic = 0; 1315 int i, call_panic = 0;
1177 struct audit_buffer *ab; 1316 struct audit_buffer *ab;
1178 struct audit_aux_data *aux; 1317 struct audit_aux_data *aux;
@@ -1182,14 +1321,15 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
1182 context->pid = tsk->pid; 1321 context->pid = tsk->pid;
1183 if (!context->ppid) 1322 if (!context->ppid)
1184 context->ppid = sys_getppid(); 1323 context->ppid = sys_getppid();
1185 context->uid = tsk->uid; 1324 cred = current_cred();
1186 context->gid = tsk->gid; 1325 context->uid = cred->uid;
1187 context->euid = tsk->euid; 1326 context->gid = cred->gid;
1188 context->suid = tsk->suid; 1327 context->euid = cred->euid;
1189 context->fsuid = tsk->fsuid; 1328 context->suid = cred->suid;
1190 context->egid = tsk->egid; 1329 context->fsuid = cred->fsuid;
1191 context->sgid = tsk->sgid; 1330 context->egid = cred->egid;
1192 context->fsgid = tsk->fsgid; 1331 context->sgid = cred->sgid;
1332 context->fsgid = cred->fsgid;
1193 context->personality = tsk->personality; 1333 context->personality = tsk->personality;
1194 1334
1195 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL); 1335 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
@@ -1246,96 +1386,50 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
1246 continue; /* audit_panic has been called */ 1386 continue; /* audit_panic has been called */
1247 1387
1248 switch (aux->type) { 1388 switch (aux->type) {
1249 case AUDIT_MQ_OPEN: {
1250 struct audit_aux_data_mq_open *axi = (void *)aux;
1251 audit_log_format(ab,
1252 "oflag=0x%x mode=%#o mq_flags=0x%lx mq_maxmsg=%ld "
1253 "mq_msgsize=%ld mq_curmsgs=%ld",
1254 axi->oflag, axi->mode, axi->attr.mq_flags,
1255 axi->attr.mq_maxmsg, axi->attr.mq_msgsize,
1256 axi->attr.mq_curmsgs);
1257 break; }
1258
1259 case AUDIT_MQ_SENDRECV: {
1260 struct audit_aux_data_mq_sendrecv *axi = (void *)aux;
1261 audit_log_format(ab,
1262 "mqdes=%d msg_len=%zd msg_prio=%u "
1263 "abs_timeout_sec=%ld abs_timeout_nsec=%ld",
1264 axi->mqdes, axi->msg_len, axi->msg_prio,
1265 axi->abs_timeout.tv_sec, axi->abs_timeout.tv_nsec);
1266 break; }
1267
1268 case AUDIT_MQ_NOTIFY: {
1269 struct audit_aux_data_mq_notify *axi = (void *)aux;
1270 audit_log_format(ab,
1271 "mqdes=%d sigev_signo=%d",
1272 axi->mqdes,
1273 axi->notification.sigev_signo);
1274 break; }
1275
1276 case AUDIT_MQ_GETSETATTR: {
1277 struct audit_aux_data_mq_getsetattr *axi = (void *)aux;
1278 audit_log_format(ab,
1279 "mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
1280 "mq_curmsgs=%ld ",
1281 axi->mqdes,
1282 axi->mqstat.mq_flags, axi->mqstat.mq_maxmsg,
1283 axi->mqstat.mq_msgsize, axi->mqstat.mq_curmsgs);
1284 break; }
1285
1286 case AUDIT_IPC: {
1287 struct audit_aux_data_ipcctl *axi = (void *)aux;
1288 audit_log_format(ab,
1289 "ouid=%u ogid=%u mode=%#o",
1290 axi->uid, axi->gid, axi->mode);
1291 if (axi->osid != 0) {
1292 char *ctx = NULL;
1293 u32 len;
1294 if (security_secid_to_secctx(
1295 axi->osid, &ctx, &len)) {
1296 audit_log_format(ab, " osid=%u",
1297 axi->osid);
1298 call_panic = 1;
1299 } else {
1300 audit_log_format(ab, " obj=%s", ctx);
1301 security_release_secctx(ctx, len);
1302 }
1303 }
1304 break; }
1305
1306 case AUDIT_IPC_SET_PERM: {
1307 struct audit_aux_data_ipcctl *axi = (void *)aux;
1308 audit_log_format(ab,
1309 "qbytes=%lx ouid=%u ogid=%u mode=%#o",
1310 axi->qbytes, axi->uid, axi->gid, axi->mode);
1311 break; }
1312 1389
1313 case AUDIT_EXECVE: { 1390 case AUDIT_EXECVE: {
1314 struct audit_aux_data_execve *axi = (void *)aux; 1391 struct audit_aux_data_execve *axi = (void *)aux;
1315 audit_log_execve_info(context, &ab, axi); 1392 audit_log_execve_info(context, &ab, axi);
1316 break; } 1393 break; }
1317 1394
1318 case AUDIT_SOCKETCALL: { 1395 case AUDIT_BPRM_FCAPS: {
1319 struct audit_aux_data_socketcall *axs = (void *)aux; 1396 struct audit_aux_data_bprm_fcaps *axs = (void *)aux;
1320 audit_log_format(ab, "nargs=%d", axs->nargs); 1397 audit_log_format(ab, "fver=%x", axs->fcap_ver);
1321 for (i=0; i<axs->nargs; i++) 1398 audit_log_cap(ab, "fp", &axs->fcap.permitted);
1322 audit_log_format(ab, " a%d=%lx", i, axs->args[i]); 1399 audit_log_cap(ab, "fi", &axs->fcap.inheritable);
1400 audit_log_format(ab, " fe=%d", axs->fcap.fE);
1401 audit_log_cap(ab, "old_pp", &axs->old_pcap.permitted);
1402 audit_log_cap(ab, "old_pi", &axs->old_pcap.inheritable);
1403 audit_log_cap(ab, "old_pe", &axs->old_pcap.effective);
1404 audit_log_cap(ab, "new_pp", &axs->new_pcap.permitted);
1405 audit_log_cap(ab, "new_pi", &axs->new_pcap.inheritable);
1406 audit_log_cap(ab, "new_pe", &axs->new_pcap.effective);
1323 break; } 1407 break; }
1324 1408
1325 case AUDIT_SOCKADDR: { 1409 }
1326 struct audit_aux_data_sockaddr *axs = (void *)aux; 1410 audit_log_end(ab);
1411 }
1327 1412
1328 audit_log_format(ab, "saddr="); 1413 if (context->type)
1329 audit_log_n_hex(ab, axs->a, axs->len); 1414 show_special(context, &call_panic);
1330 break; }
1331 1415
1332 case AUDIT_FD_PAIR: { 1416 if (context->fds[0] >= 0) {
1333 struct audit_aux_data_fd_pair *axs = (void *)aux; 1417 ab = audit_log_start(context, GFP_KERNEL, AUDIT_FD_PAIR);
1334 audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]); 1418 if (ab) {
1335 break; } 1419 audit_log_format(ab, "fd0=%d fd1=%d",
1420 context->fds[0], context->fds[1]);
1421 audit_log_end(ab);
1422 }
1423 }
1336 1424
1425 if (context->sockaddr_len) {
1426 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR);
1427 if (ab) {
1428 audit_log_format(ab, "saddr=");
1429 audit_log_n_hex(ab, (void *)context->sockaddr,
1430 context->sockaddr_len);
1431 audit_log_end(ab);
1337 } 1432 }
1338 audit_log_end(ab);
1339 } 1433 }
1340 1434
1341 for (aux = context->aux_pids; aux; aux = aux->next) { 1435 for (aux = context->aux_pids; aux; aux = aux->next) {
@@ -1421,6 +1515,8 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
1421 } 1515 }
1422 } 1516 }
1423 1517
1518 audit_log_fcaps(ab, n);
1519
1424 audit_log_end(ab); 1520 audit_log_end(ab);
1425 } 1521 }
1426 1522
@@ -1451,7 +1547,7 @@ void audit_free(struct task_struct *tsk)
1451 * We use GFP_ATOMIC here because we might be doing this 1547 * We use GFP_ATOMIC here because we might be doing this
1452 * in the context of the idle thread */ 1548 * in the context of the idle thread */
1453 /* that can happen only if we are called from do_exit() */ 1549 /* that can happen only if we are called from do_exit() */
1454 if (context->in_syscall && context->auditable) 1550 if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT)
1455 audit_log_exit(context, tsk); 1551 audit_log_exit(context, tsk);
1456 1552
1457 audit_free_context(context); 1553 audit_free_context(context);
@@ -1535,15 +1631,17 @@ void audit_syscall_entry(int arch, int major,
1535 1631
1536 state = context->state; 1632 state = context->state;
1537 context->dummy = !audit_n_rules; 1633 context->dummy = !audit_n_rules;
1538 if (!context->dummy && (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT)) 1634 if (!context->dummy && state == AUDIT_BUILD_CONTEXT) {
1635 context->prio = 0;
1539 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]); 1636 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
1637 }
1540 if (likely(state == AUDIT_DISABLED)) 1638 if (likely(state == AUDIT_DISABLED))
1541 return; 1639 return;
1542 1640
1543 context->serial = 0; 1641 context->serial = 0;
1544 context->ctime = CURRENT_TIME; 1642 context->ctime = CURRENT_TIME;
1545 context->in_syscall = 1; 1643 context->in_syscall = 1;
1546 context->auditable = !!(state == AUDIT_RECORD_CONTEXT); 1644 context->current_state = state;
1547 context->ppid = 0; 1645 context->ppid = 0;
1548} 1646}
1549 1647
@@ -1551,17 +1649,20 @@ void audit_finish_fork(struct task_struct *child)
1551{ 1649{
1552 struct audit_context *ctx = current->audit_context; 1650 struct audit_context *ctx = current->audit_context;
1553 struct audit_context *p = child->audit_context; 1651 struct audit_context *p = child->audit_context;
1554 if (!p || !ctx || !ctx->auditable) 1652 if (!p || !ctx)
1653 return;
1654 if (!ctx->in_syscall || ctx->current_state != AUDIT_RECORD_CONTEXT)
1555 return; 1655 return;
1556 p->arch = ctx->arch; 1656 p->arch = ctx->arch;
1557 p->major = ctx->major; 1657 p->major = ctx->major;
1558 memcpy(p->argv, ctx->argv, sizeof(ctx->argv)); 1658 memcpy(p->argv, ctx->argv, sizeof(ctx->argv));
1559 p->ctime = ctx->ctime; 1659 p->ctime = ctx->ctime;
1560 p->dummy = ctx->dummy; 1660 p->dummy = ctx->dummy;
1561 p->auditable = ctx->auditable;
1562 p->in_syscall = ctx->in_syscall; 1661 p->in_syscall = ctx->in_syscall;
1563 p->filterkey = kstrdup(ctx->filterkey, GFP_KERNEL); 1662 p->filterkey = kstrdup(ctx->filterkey, GFP_KERNEL);
1564 p->ppid = current->pid; 1663 p->ppid = current->pid;
1664 p->prio = ctx->prio;
1665 p->current_state = ctx->current_state;
1565} 1666}
1566 1667
1567/** 1668/**
@@ -1585,11 +1686,11 @@ void audit_syscall_exit(int valid, long return_code)
1585 if (likely(!context)) 1686 if (likely(!context))
1586 return; 1687 return;
1587 1688
1588 if (context->in_syscall && context->auditable) 1689 if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT)
1589 audit_log_exit(context, tsk); 1690 audit_log_exit(context, tsk);
1590 1691
1591 context->in_syscall = 0; 1692 context->in_syscall = 0;
1592 context->auditable = 0; 1693 context->prio = context->state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;
1593 1694
1594 if (context->previous) { 1695 if (context->previous) {
1595 struct audit_context *new_context = context->previous; 1696 struct audit_context *new_context = context->previous;
@@ -1604,8 +1705,13 @@ void audit_syscall_exit(int valid, long return_code)
1604 context->aux_pids = NULL; 1705 context->aux_pids = NULL;
1605 context->target_pid = 0; 1706 context->target_pid = 0;
1606 context->target_sid = 0; 1707 context->target_sid = 0;
1607 kfree(context->filterkey); 1708 context->sockaddr_len = 0;
1608 context->filterkey = NULL; 1709 context->type = 0;
1710 context->fds[0] = -1;
1711 if (context->state != AUDIT_RECORD_CONTEXT) {
1712 kfree(context->filterkey);
1713 context->filterkey = NULL;
1714 }
1609 tsk->audit_context = context; 1715 tsk->audit_context = context;
1610 } 1716 }
1611} 1717}
@@ -1802,8 +1908,36 @@ static int audit_inc_name_count(struct audit_context *context,
1802 return 0; 1908 return 0;
1803} 1909}
1804 1910
1911
1912static inline int audit_copy_fcaps(struct audit_names *name, const struct dentry *dentry)
1913{
1914 struct cpu_vfs_cap_data caps;
1915 int rc;
1916
1917 memset(&name->fcap.permitted, 0, sizeof(kernel_cap_t));
1918 memset(&name->fcap.inheritable, 0, sizeof(kernel_cap_t));
1919 name->fcap.fE = 0;
1920 name->fcap_ver = 0;
1921
1922 if (!dentry)
1923 return 0;
1924
1925 rc = get_vfs_caps_from_disk(dentry, &caps);
1926 if (rc)
1927 return rc;
1928
1929 name->fcap.permitted = caps.permitted;
1930 name->fcap.inheritable = caps.inheritable;
1931 name->fcap.fE = !!(caps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
1932 name->fcap_ver = (caps.magic_etc & VFS_CAP_REVISION_MASK) >> VFS_CAP_REVISION_SHIFT;
1933
1934 return 0;
1935}
1936
1937
1805/* Copy inode data into an audit_names. */ 1938/* Copy inode data into an audit_names. */
1806static void audit_copy_inode(struct audit_names *name, const struct inode *inode) 1939static void audit_copy_inode(struct audit_names *name, const struct dentry *dentry,
1940 const struct inode *inode)
1807{ 1941{
1808 name->ino = inode->i_ino; 1942 name->ino = inode->i_ino;
1809 name->dev = inode->i_sb->s_dev; 1943 name->dev = inode->i_sb->s_dev;
@@ -1812,6 +1946,7 @@ static void audit_copy_inode(struct audit_names *name, const struct inode *inode
1812 name->gid = inode->i_gid; 1946 name->gid = inode->i_gid;
1813 name->rdev = inode->i_rdev; 1947 name->rdev = inode->i_rdev;
1814 security_inode_getsecid(inode, &name->osid); 1948 security_inode_getsecid(inode, &name->osid);
1949 audit_copy_fcaps(name, dentry);
1815} 1950}
1816 1951
1817/** 1952/**
@@ -1846,7 +1981,7 @@ void __audit_inode(const char *name, const struct dentry *dentry)
1846 context->names[idx].name = NULL; 1981 context->names[idx].name = NULL;
1847 } 1982 }
1848 handle_path(dentry); 1983 handle_path(dentry);
1849 audit_copy_inode(&context->names[idx], inode); 1984 audit_copy_inode(&context->names[idx], dentry, inode);
1850} 1985}
1851 1986
1852/** 1987/**
@@ -1907,7 +2042,7 @@ void __audit_inode_child(const char *dname, const struct dentry *dentry,
1907 if (!strcmp(dname, n->name) || 2042 if (!strcmp(dname, n->name) ||
1908 !audit_compare_dname_path(dname, n->name, &dirlen)) { 2043 !audit_compare_dname_path(dname, n->name, &dirlen)) {
1909 if (inode) 2044 if (inode)
1910 audit_copy_inode(n, inode); 2045 audit_copy_inode(n, NULL, inode);
1911 else 2046 else
1912 n->ino = (unsigned long)-1; 2047 n->ino = (unsigned long)-1;
1913 found_child = n->name; 2048 found_child = n->name;
@@ -1921,7 +2056,7 @@ add_names:
1921 return; 2056 return;
1922 idx = context->name_count - 1; 2057 idx = context->name_count - 1;
1923 context->names[idx].name = NULL; 2058 context->names[idx].name = NULL;
1924 audit_copy_inode(&context->names[idx], parent); 2059 audit_copy_inode(&context->names[idx], NULL, parent);
1925 } 2060 }
1926 2061
1927 if (!found_child) { 2062 if (!found_child) {
@@ -1942,7 +2077,7 @@ add_names:
1942 } 2077 }
1943 2078
1944 if (inode) 2079 if (inode)
1945 audit_copy_inode(&context->names[idx], inode); 2080 audit_copy_inode(&context->names[idx], NULL, inode);
1946 else 2081 else
1947 context->names[idx].ino = (unsigned long)-1; 2082 context->names[idx].ino = (unsigned long)-1;
1948 } 2083 }
@@ -1967,7 +2102,10 @@ int auditsc_get_stamp(struct audit_context *ctx,
1967 t->tv_sec = ctx->ctime.tv_sec; 2102 t->tv_sec = ctx->ctime.tv_sec;
1968 t->tv_nsec = ctx->ctime.tv_nsec; 2103 t->tv_nsec = ctx->ctime.tv_nsec;
1969 *serial = ctx->serial; 2104 *serial = ctx->serial;
1970 ctx->auditable = 1; 2105 if (!ctx->prio) {
2106 ctx->prio = 1;
2107 ctx->current_state = AUDIT_RECORD_CONTEXT;
2108 }
1971 return 1; 2109 return 1;
1972} 2110}
1973 2111
@@ -1996,7 +2134,7 @@ int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
1996 audit_log_format(ab, "login pid=%d uid=%u " 2134 audit_log_format(ab, "login pid=%d uid=%u "
1997 "old auid=%u new auid=%u" 2135 "old auid=%u new auid=%u"
1998 " old ses=%u new ses=%u", 2136 " old ses=%u new ses=%u",
1999 task->pid, task->uid, 2137 task->pid, task_uid(task),
2000 task->loginuid, loginuid, 2138 task->loginuid, loginuid,
2001 task->sessionid, sessionid); 2139 task->sessionid, sessionid);
2002 audit_log_end(ab); 2140 audit_log_end(ab);
@@ -2013,132 +2151,46 @@ int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
2013 * @mode: mode bits 2151 * @mode: mode bits
2014 * @u_attr: queue attributes 2152 * @u_attr: queue attributes
2015 * 2153 *
2016 * Returns 0 for success or NULL context or < 0 on error.
2017 */ 2154 */
2018int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr) 2155void __audit_mq_open(int oflag, mode_t mode, struct mq_attr *attr)
2019{ 2156{
2020 struct audit_aux_data_mq_open *ax;
2021 struct audit_context *context = current->audit_context; 2157 struct audit_context *context = current->audit_context;
2022 2158
2023 if (!audit_enabled) 2159 if (attr)
2024 return 0; 2160 memcpy(&context->mq_open.attr, attr, sizeof(struct mq_attr));
2025 2161 else
2026 if (likely(!context)) 2162 memset(&context->mq_open.attr, 0, sizeof(struct mq_attr));
2027 return 0;
2028
2029 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
2030 if (!ax)
2031 return -ENOMEM;
2032
2033 if (u_attr != NULL) {
2034 if (copy_from_user(&ax->attr, u_attr, sizeof(ax->attr))) {
2035 kfree(ax);
2036 return -EFAULT;
2037 }
2038 } else
2039 memset(&ax->attr, 0, sizeof(ax->attr));
2040 2163
2041 ax->oflag = oflag; 2164 context->mq_open.oflag = oflag;
2042 ax->mode = mode; 2165 context->mq_open.mode = mode;
2043 2166
2044 ax->d.type = AUDIT_MQ_OPEN; 2167 context->type = AUDIT_MQ_OPEN;
2045 ax->d.next = context->aux;
2046 context->aux = (void *)ax;
2047 return 0;
2048} 2168}
2049 2169
2050/** 2170/**
2051 * __audit_mq_timedsend - record audit data for a POSIX MQ timed send 2171 * __audit_mq_sendrecv - record audit data for a POSIX MQ timed send/receive
2052 * @mqdes: MQ descriptor 2172 * @mqdes: MQ descriptor
2053 * @msg_len: Message length 2173 * @msg_len: Message length
2054 * @msg_prio: Message priority 2174 * @msg_prio: Message priority
2055 * @u_abs_timeout: Message timeout in absolute time 2175 * @abs_timeout: Message timeout in absolute time
2056 * 2176 *
2057 * Returns 0 for success or NULL context or < 0 on error.
2058 */ 2177 */
2059int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, 2178void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio,
2060 const struct timespec __user *u_abs_timeout) 2179 const struct timespec *abs_timeout)
2061{ 2180{
2062 struct audit_aux_data_mq_sendrecv *ax;
2063 struct audit_context *context = current->audit_context; 2181 struct audit_context *context = current->audit_context;
2182 struct timespec *p = &context->mq_sendrecv.abs_timeout;
2064 2183
2065 if (!audit_enabled) 2184 if (abs_timeout)
2066 return 0; 2185 memcpy(p, abs_timeout, sizeof(struct timespec));
2067 2186 else
2068 if (likely(!context)) 2187 memset(p, 0, sizeof(struct timespec));
2069 return 0;
2070
2071 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
2072 if (!ax)
2073 return -ENOMEM;
2074
2075 if (u_abs_timeout != NULL) {
2076 if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) {
2077 kfree(ax);
2078 return -EFAULT;
2079 }
2080 } else
2081 memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout));
2082
2083 ax->mqdes = mqdes;
2084 ax->msg_len = msg_len;
2085 ax->msg_prio = msg_prio;
2086
2087 ax->d.type = AUDIT_MQ_SENDRECV;
2088 ax->d.next = context->aux;
2089 context->aux = (void *)ax;
2090 return 0;
2091}
2092
2093/**
2094 * __audit_mq_timedreceive - record audit data for a POSIX MQ timed receive
2095 * @mqdes: MQ descriptor
2096 * @msg_len: Message length
2097 * @u_msg_prio: Message priority
2098 * @u_abs_timeout: Message timeout in absolute time
2099 *
2100 * Returns 0 for success or NULL context or < 0 on error.
2101 */
2102int __audit_mq_timedreceive(mqd_t mqdes, size_t msg_len,
2103 unsigned int __user *u_msg_prio,
2104 const struct timespec __user *u_abs_timeout)
2105{
2106 struct audit_aux_data_mq_sendrecv *ax;
2107 struct audit_context *context = current->audit_context;
2108
2109 if (!audit_enabled)
2110 return 0;
2111
2112 if (likely(!context))
2113 return 0;
2114
2115 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
2116 if (!ax)
2117 return -ENOMEM;
2118
2119 if (u_msg_prio != NULL) {
2120 if (get_user(ax->msg_prio, u_msg_prio)) {
2121 kfree(ax);
2122 return -EFAULT;
2123 }
2124 } else
2125 ax->msg_prio = 0;
2126
2127 if (u_abs_timeout != NULL) {
2128 if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) {
2129 kfree(ax);
2130 return -EFAULT;
2131 }
2132 } else
2133 memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout));
2134 2188
2135 ax->mqdes = mqdes; 2189 context->mq_sendrecv.mqdes = mqdes;
2136 ax->msg_len = msg_len; 2190 context->mq_sendrecv.msg_len = msg_len;
2191 context->mq_sendrecv.msg_prio = msg_prio;
2137 2192
2138 ax->d.type = AUDIT_MQ_SENDRECV; 2193 context->type = AUDIT_MQ_SENDRECV;
2139 ax->d.next = context->aux;
2140 context->aux = (void *)ax;
2141 return 0;
2142} 2194}
2143 2195
2144/** 2196/**
@@ -2146,38 +2198,19 @@ int __audit_mq_timedreceive(mqd_t mqdes, size_t msg_len,
2146 * @mqdes: MQ descriptor 2198 * @mqdes: MQ descriptor
2147 * @u_notification: Notification event 2199 * @u_notification: Notification event
2148 * 2200 *
2149 * Returns 0 for success or NULL context or < 0 on error.
2150 */ 2201 */
2151 2202
2152int __audit_mq_notify(mqd_t mqdes, const struct sigevent __user *u_notification) 2203void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
2153{ 2204{
2154 struct audit_aux_data_mq_notify *ax;
2155 struct audit_context *context = current->audit_context; 2205 struct audit_context *context = current->audit_context;
2156 2206
2157 if (!audit_enabled) 2207 if (notification)
2158 return 0; 2208 context->mq_notify.sigev_signo = notification->sigev_signo;
2159 2209 else
2160 if (likely(!context)) 2210 context->mq_notify.sigev_signo = 0;
2161 return 0;
2162
2163 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
2164 if (!ax)
2165 return -ENOMEM;
2166
2167 if (u_notification != NULL) {
2168 if (copy_from_user(&ax->notification, u_notification, sizeof(ax->notification))) {
2169 kfree(ax);
2170 return -EFAULT;
2171 }
2172 } else
2173 memset(&ax->notification, 0, sizeof(ax->notification));
2174
2175 ax->mqdes = mqdes;
2176 2211
2177 ax->d.type = AUDIT_MQ_NOTIFY; 2212 context->mq_notify.mqdes = mqdes;
2178 ax->d.next = context->aux; 2213 context->type = AUDIT_MQ_NOTIFY;
2179 context->aux = (void *)ax;
2180 return 0;
2181} 2214}
2182 2215
2183/** 2216/**
@@ -2185,55 +2218,29 @@ int __audit_mq_notify(mqd_t mqdes, const struct sigevent __user *u_notification)
2185 * @mqdes: MQ descriptor 2218 * @mqdes: MQ descriptor
2186 * @mqstat: MQ flags 2219 * @mqstat: MQ flags
2187 * 2220 *
2188 * Returns 0 for success or NULL context or < 0 on error.
2189 */ 2221 */
2190int __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) 2222void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
2191{ 2223{
2192 struct audit_aux_data_mq_getsetattr *ax;
2193 struct audit_context *context = current->audit_context; 2224 struct audit_context *context = current->audit_context;
2194 2225 context->mq_getsetattr.mqdes = mqdes;
2195 if (!audit_enabled) 2226 context->mq_getsetattr.mqstat = *mqstat;
2196 return 0; 2227 context->type = AUDIT_MQ_GETSETATTR;
2197
2198 if (likely(!context))
2199 return 0;
2200
2201 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
2202 if (!ax)
2203 return -ENOMEM;
2204
2205 ax->mqdes = mqdes;
2206 ax->mqstat = *mqstat;
2207
2208 ax->d.type = AUDIT_MQ_GETSETATTR;
2209 ax->d.next = context->aux;
2210 context->aux = (void *)ax;
2211 return 0;
2212} 2228}
2213 2229
2214/** 2230/**
2215 * audit_ipc_obj - record audit data for ipc object 2231 * audit_ipc_obj - record audit data for ipc object
2216 * @ipcp: ipc permissions 2232 * @ipcp: ipc permissions
2217 * 2233 *
2218 * Returns 0 for success or NULL context or < 0 on error.
2219 */ 2234 */
2220int __audit_ipc_obj(struct kern_ipc_perm *ipcp) 2235void __audit_ipc_obj(struct kern_ipc_perm *ipcp)
2221{ 2236{
2222 struct audit_aux_data_ipcctl *ax;
2223 struct audit_context *context = current->audit_context; 2237 struct audit_context *context = current->audit_context;
2224 2238 context->ipc.uid = ipcp->uid;
2225 ax = kmalloc(sizeof(*ax), GFP_ATOMIC); 2239 context->ipc.gid = ipcp->gid;
2226 if (!ax) 2240 context->ipc.mode = ipcp->mode;
2227 return -ENOMEM; 2241 context->ipc.has_perm = 0;
2228 2242 security_ipc_getsecid(ipcp, &context->ipc.osid);
2229 ax->uid = ipcp->uid; 2243 context->type = AUDIT_IPC;
2230 ax->gid = ipcp->gid;
2231 ax->mode = ipcp->mode;
2232 security_ipc_getsecid(ipcp, &ax->osid);
2233 ax->d.type = AUDIT_IPC;
2234 ax->d.next = context->aux;
2235 context->aux = (void *)ax;
2236 return 0;
2237} 2244}
2238 2245
2239/** 2246/**
@@ -2243,26 +2250,17 @@ int __audit_ipc_obj(struct kern_ipc_perm *ipcp)
2243 * @gid: msgq group id 2250 * @gid: msgq group id
2244 * @mode: msgq mode (permissions) 2251 * @mode: msgq mode (permissions)
2245 * 2252 *
2246 * Returns 0 for success or NULL context or < 0 on error. 2253 * Called only after audit_ipc_obj().
2247 */ 2254 */
2248int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode) 2255void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode)
2249{ 2256{
2250 struct audit_aux_data_ipcctl *ax;
2251 struct audit_context *context = current->audit_context; 2257 struct audit_context *context = current->audit_context;
2252 2258
2253 ax = kmalloc(sizeof(*ax), GFP_ATOMIC); 2259 context->ipc.qbytes = qbytes;
2254 if (!ax) 2260 context->ipc.perm_uid = uid;
2255 return -ENOMEM; 2261 context->ipc.perm_gid = gid;
2256 2262 context->ipc.perm_mode = mode;
2257 ax->qbytes = qbytes; 2263 context->ipc.has_perm = 1;
2258 ax->uid = uid;
2259 ax->gid = gid;
2260 ax->mode = mode;
2261
2262 ax->d.type = AUDIT_IPC_SET_PERM;
2263 ax->d.next = context->aux;
2264 context->aux = (void *)ax;
2265 return 0;
2266} 2264}
2267 2265
2268int audit_bprm(struct linux_binprm *bprm) 2266int audit_bprm(struct linux_binprm *bprm)
@@ -2292,27 +2290,17 @@ int audit_bprm(struct linux_binprm *bprm)
2292 * @nargs: number of args 2290 * @nargs: number of args
2293 * @args: args array 2291 * @args: args array
2294 * 2292 *
2295 * Returns 0 for success or NULL context or < 0 on error.
2296 */ 2293 */
2297int audit_socketcall(int nargs, unsigned long *args) 2294void audit_socketcall(int nargs, unsigned long *args)
2298{ 2295{
2299 struct audit_aux_data_socketcall *ax;
2300 struct audit_context *context = current->audit_context; 2296 struct audit_context *context = current->audit_context;
2301 2297
2302 if (likely(!context || context->dummy)) 2298 if (likely(!context || context->dummy))
2303 return 0; 2299 return;
2304
2305 ax = kmalloc(sizeof(*ax) + nargs * sizeof(unsigned long), GFP_KERNEL);
2306 if (!ax)
2307 return -ENOMEM;
2308
2309 ax->nargs = nargs;
2310 memcpy(ax->args, args, nargs * sizeof(unsigned long));
2311 2300
2312 ax->d.type = AUDIT_SOCKETCALL; 2301 context->type = AUDIT_SOCKETCALL;
2313 ax->d.next = context->aux; 2302 context->socketcall.nargs = nargs;
2314 context->aux = (void *)ax; 2303 memcpy(context->socketcall.args, args, nargs * sizeof(unsigned long));
2315 return 0;
2316} 2304}
2317 2305
2318/** 2306/**
@@ -2320,29 +2308,12 @@ int audit_socketcall(int nargs, unsigned long *args)
2320 * @fd1: the first file descriptor 2308 * @fd1: the first file descriptor
2321 * @fd2: the second file descriptor 2309 * @fd2: the second file descriptor
2322 * 2310 *
2323 * Returns 0 for success or NULL context or < 0 on error.
2324 */ 2311 */
2325int __audit_fd_pair(int fd1, int fd2) 2312void __audit_fd_pair(int fd1, int fd2)
2326{ 2313{
2327 struct audit_context *context = current->audit_context; 2314 struct audit_context *context = current->audit_context;
2328 struct audit_aux_data_fd_pair *ax; 2315 context->fds[0] = fd1;
2329 2316 context->fds[1] = fd2;
2330 if (likely(!context)) {
2331 return 0;
2332 }
2333
2334 ax = kmalloc(sizeof(*ax), GFP_KERNEL);
2335 if (!ax) {
2336 return -ENOMEM;
2337 }
2338
2339 ax->fd[0] = fd1;
2340 ax->fd[1] = fd2;
2341
2342 ax->d.type = AUDIT_FD_PAIR;
2343 ax->d.next = context->aux;
2344 context->aux = (void *)ax;
2345 return 0;
2346} 2317}
2347 2318
2348/** 2319/**
@@ -2354,22 +2325,20 @@ int __audit_fd_pair(int fd1, int fd2)
2354 */ 2325 */
2355int audit_sockaddr(int len, void *a) 2326int audit_sockaddr(int len, void *a)
2356{ 2327{
2357 struct audit_aux_data_sockaddr *ax;
2358 struct audit_context *context = current->audit_context; 2328 struct audit_context *context = current->audit_context;
2359 2329
2360 if (likely(!context || context->dummy)) 2330 if (likely(!context || context->dummy))
2361 return 0; 2331 return 0;
2362 2332
2363 ax = kmalloc(sizeof(*ax) + len, GFP_KERNEL); 2333 if (!context->sockaddr) {
2364 if (!ax) 2334 void *p = kmalloc(sizeof(struct sockaddr_storage), GFP_KERNEL);
2365 return -ENOMEM; 2335 if (!p)
2366 2336 return -ENOMEM;
2367 ax->len = len; 2337 context->sockaddr = p;
2368 memcpy(ax->a, a, len); 2338 }
2369 2339
2370 ax->d.type = AUDIT_SOCKADDR; 2340 context->sockaddr_len = len;
2371 ax->d.next = context->aux; 2341 memcpy(context->sockaddr, a, len);
2372 context->aux = (void *)ax;
2373 return 0; 2342 return 0;
2374} 2343}
2375 2344
@@ -2379,7 +2348,7 @@ void __audit_ptrace(struct task_struct *t)
2379 2348
2380 context->target_pid = t->pid; 2349 context->target_pid = t->pid;
2381 context->target_auid = audit_get_loginuid(t); 2350 context->target_auid = audit_get_loginuid(t);
2382 context->target_uid = t->uid; 2351 context->target_uid = task_uid(t);
2383 context->target_sessionid = audit_get_sessionid(t); 2352 context->target_sessionid = audit_get_sessionid(t);
2384 security_task_getsecid(t, &context->target_sid); 2353 security_task_getsecid(t, &context->target_sid);
2385 memcpy(context->target_comm, t->comm, TASK_COMM_LEN); 2354 memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
@@ -2398,6 +2367,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
2398 struct audit_aux_data_pids *axp; 2367 struct audit_aux_data_pids *axp;
2399 struct task_struct *tsk = current; 2368 struct task_struct *tsk = current;
2400 struct audit_context *ctx = tsk->audit_context; 2369 struct audit_context *ctx = tsk->audit_context;
2370 uid_t uid = current_uid(), t_uid = task_uid(t);
2401 2371
2402 if (audit_pid && t->tgid == audit_pid) { 2372 if (audit_pid && t->tgid == audit_pid) {
2403 if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1 || sig == SIGUSR2) { 2373 if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1 || sig == SIGUSR2) {
@@ -2405,7 +2375,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
2405 if (tsk->loginuid != -1) 2375 if (tsk->loginuid != -1)
2406 audit_sig_uid = tsk->loginuid; 2376 audit_sig_uid = tsk->loginuid;
2407 else 2377 else
2408 audit_sig_uid = tsk->uid; 2378 audit_sig_uid = uid;
2409 security_task_getsecid(tsk, &audit_sig_sid); 2379 security_task_getsecid(tsk, &audit_sig_sid);
2410 } 2380 }
2411 if (!audit_signals || audit_dummy_context()) 2381 if (!audit_signals || audit_dummy_context())
@@ -2417,7 +2387,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
2417 if (!ctx->target_pid) { 2387 if (!ctx->target_pid) {
2418 ctx->target_pid = t->tgid; 2388 ctx->target_pid = t->tgid;
2419 ctx->target_auid = audit_get_loginuid(t); 2389 ctx->target_auid = audit_get_loginuid(t);
2420 ctx->target_uid = t->uid; 2390 ctx->target_uid = t_uid;
2421 ctx->target_sessionid = audit_get_sessionid(t); 2391 ctx->target_sessionid = audit_get_sessionid(t);
2422 security_task_getsecid(t, &ctx->target_sid); 2392 security_task_getsecid(t, &ctx->target_sid);
2423 memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN); 2393 memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
@@ -2438,7 +2408,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
2438 2408
2439 axp->target_pid[axp->pid_count] = t->tgid; 2409 axp->target_pid[axp->pid_count] = t->tgid;
2440 axp->target_auid[axp->pid_count] = audit_get_loginuid(t); 2410 axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
2441 axp->target_uid[axp->pid_count] = t->uid; 2411 axp->target_uid[axp->pid_count] = t_uid;
2442 axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t); 2412 axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t);
2443 security_task_getsecid(t, &axp->target_sid[axp->pid_count]); 2413 security_task_getsecid(t, &axp->target_sid[axp->pid_count]);
2444 memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN); 2414 memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
@@ -2448,6 +2418,72 @@ int __audit_signal_info(int sig, struct task_struct *t)
2448} 2418}
2449 2419
2450/** 2420/**
2421 * __audit_log_bprm_fcaps - store information about a loading bprm and relevant fcaps
2422 * @bprm: pointer to the bprm being processed
2423 * @new: the proposed new credentials
2424 * @old: the old credentials
2425 *
2426 * Simply check if the proc already has the caps given by the file and if not
2427 * store the priv escalation info for later auditing at the end of the syscall
2428 *
2429 * -Eric
2430 */
2431int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
2432 const struct cred *new, const struct cred *old)
2433{
2434 struct audit_aux_data_bprm_fcaps *ax;
2435 struct audit_context *context = current->audit_context;
2436 struct cpu_vfs_cap_data vcaps;
2437 struct dentry *dentry;
2438
2439 ax = kmalloc(sizeof(*ax), GFP_KERNEL);
2440 if (!ax)
2441 return -ENOMEM;
2442
2443 ax->d.type = AUDIT_BPRM_FCAPS;
2444 ax->d.next = context->aux;
2445 context->aux = (void *)ax;
2446
2447 dentry = dget(bprm->file->f_dentry);
2448 get_vfs_caps_from_disk(dentry, &vcaps);
2449 dput(dentry);
2450
2451 ax->fcap.permitted = vcaps.permitted;
2452 ax->fcap.inheritable = vcaps.inheritable;
2453 ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
2454 ax->fcap_ver = (vcaps.magic_etc & VFS_CAP_REVISION_MASK) >> VFS_CAP_REVISION_SHIFT;
2455
2456 ax->old_pcap.permitted = old->cap_permitted;
2457 ax->old_pcap.inheritable = old->cap_inheritable;
2458 ax->old_pcap.effective = old->cap_effective;
2459
2460 ax->new_pcap.permitted = new->cap_permitted;
2461 ax->new_pcap.inheritable = new->cap_inheritable;
2462 ax->new_pcap.effective = new->cap_effective;
2463 return 0;
2464}
2465
2466/**
2467 * __audit_log_capset - store information about the arguments to the capset syscall
2468 * @pid: target pid of the capset call
2469 * @new: the new credentials
2470 * @old: the old (current) credentials
2471 *
2472 * Record the aguments userspace sent to sys_capset for later printing by the
2473 * audit system if applicable
2474 */
2475void __audit_log_capset(pid_t pid,
2476 const struct cred *new, const struct cred *old)
2477{
2478 struct audit_context *context = current->audit_context;
2479 context->capset.pid = pid;
2480 context->capset.cap.effective = new->cap_effective;
2481 context->capset.cap.inheritable = new->cap_effective;
2482 context->capset.cap.permitted = new->cap_permitted;
2483 context->type = AUDIT_CAPSET;
2484}
2485
2486/**
2451 * audit_core_dumps - record information about processes that end abnormally 2487 * audit_core_dumps - record information about processes that end abnormally
2452 * @signr: signal value 2488 * @signr: signal value
2453 * 2489 *
@@ -2458,7 +2494,8 @@ void audit_core_dumps(long signr)
2458{ 2494{
2459 struct audit_buffer *ab; 2495 struct audit_buffer *ab;
2460 u32 sid; 2496 u32 sid;
2461 uid_t auid = audit_get_loginuid(current); 2497 uid_t auid = audit_get_loginuid(current), uid;
2498 gid_t gid;
2462 unsigned int sessionid = audit_get_sessionid(current); 2499 unsigned int sessionid = audit_get_sessionid(current);
2463 2500
2464 if (!audit_enabled) 2501 if (!audit_enabled)
@@ -2468,8 +2505,9 @@ void audit_core_dumps(long signr)
2468 return; 2505 return;
2469 2506
2470 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND); 2507 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
2508 current_uid_gid(&uid, &gid);
2471 audit_log_format(ab, "auid=%u uid=%u gid=%u ses=%u", 2509 audit_log_format(ab, "auid=%u uid=%u gid=%u ses=%u",
2472 auid, current->uid, current->gid, sessionid); 2510 auid, uid, gid, sessionid);
2473 security_task_getsecid(current, &sid); 2511 security_task_getsecid(current, &sid);
2474 if (sid) { 2512 if (sid) {
2475 char *ctx = NULL; 2513 char *ctx = NULL;
generated by cgit v1.2.2 (git 2.25.0) at 2025-01-29 06:48:58 -0500