aboutsummaryrefslogtreecommitdiffstats
path: root/kernel/auditsc.c
diff options
context:
space:
mode:
Diffstat (limited to 'kernel/auditsc.c')
-rw-r--r--kernel/auditsc.c950
1 files changed, 503 insertions, 447 deletions
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index cf5bc2f5f9c3..8cbddff6c283 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -65,6 +65,7 @@
65#include <linux/highmem.h> 65#include <linux/highmem.h>
66#include <linux/syscalls.h> 66#include <linux/syscalls.h>
67#include <linux/inotify.h> 67#include <linux/inotify.h>
68#include <linux/capability.h>
68 69
69#include "audit.h" 70#include "audit.h"
70 71
@@ -84,6 +85,15 @@ int audit_n_rules;
84/* determines whether we collect data for signals sent */ 85/* determines whether we collect data for signals sent */
85int audit_signals; 86int audit_signals;
86 87
88struct audit_cap_data {
89 kernel_cap_t permitted;
90 kernel_cap_t inheritable;
91 union {
92 unsigned int fE; /* effective bit of a file capability */
93 kernel_cap_t effective; /* effective set of a process */
94 };
95};
96
87/* When fs/namei.c:getname() is called, we store the pointer in name and 97/* When fs/namei.c:getname() is called, we store the pointer in name and
88 * we don't let putname() free it (instead we free all of the saved 98 * we don't let putname() free it (instead we free all of the saved
89 * pointers at syscall exit time). 99 * pointers at syscall exit time).
@@ -100,6 +110,8 @@ struct audit_names {
100 gid_t gid; 110 gid_t gid;
101 dev_t rdev; 111 dev_t rdev;
102 u32 osid; 112 u32 osid;
113 struct audit_cap_data fcap;
114 unsigned int fcap_ver;
103}; 115};
104 116
105struct audit_aux_data { 117struct audit_aux_data {
@@ -112,43 +124,6 @@ struct audit_aux_data {
112/* Number of target pids per aux struct. */ 124/* Number of target pids per aux struct. */
113#define AUDIT_AUX_PIDS 16 125#define AUDIT_AUX_PIDS 16
114 126
115struct audit_aux_data_mq_open {
116 struct audit_aux_data d;
117 int oflag;
118 mode_t mode;
119 struct mq_attr attr;
120};
121
122struct audit_aux_data_mq_sendrecv {
123 struct audit_aux_data d;
124 mqd_t mqdes;
125 size_t msg_len;
126 unsigned int msg_prio;
127 struct timespec abs_timeout;
128};
129
130struct audit_aux_data_mq_notify {
131 struct audit_aux_data d;
132 mqd_t mqdes;
133 struct sigevent notification;
134};
135
136struct audit_aux_data_mq_getsetattr {
137 struct audit_aux_data d;
138 mqd_t mqdes;
139 struct mq_attr mqstat;
140};
141
142struct audit_aux_data_ipcctl {
143 struct audit_aux_data d;
144 struct ipc_perm p;
145 unsigned long qbytes;
146 uid_t uid;
147 gid_t gid;
148 mode_t mode;
149 u32 osid;
150};
151
152struct audit_aux_data_execve { 127struct audit_aux_data_execve {
153 struct audit_aux_data d; 128 struct audit_aux_data d;
154 int argc; 129 int argc;
@@ -156,23 +131,6 @@ struct audit_aux_data_execve {
156 struct mm_struct *mm; 131 struct mm_struct *mm;
157}; 132};
158 133
159struct audit_aux_data_socketcall {
160 struct audit_aux_data d;
161 int nargs;
162 unsigned long args[0];
163};
164
165struct audit_aux_data_sockaddr {
166 struct audit_aux_data d;
167 int len;
168 char a[0];
169};
170
171struct audit_aux_data_fd_pair {
172 struct audit_aux_data d;
173 int fd[2];
174};
175
176struct audit_aux_data_pids { 134struct audit_aux_data_pids {
177 struct audit_aux_data d; 135 struct audit_aux_data d;
178 pid_t target_pid[AUDIT_AUX_PIDS]; 136 pid_t target_pid[AUDIT_AUX_PIDS];
@@ -184,6 +142,20 @@ struct audit_aux_data_pids {
184 int pid_count; 142 int pid_count;
185}; 143};
186 144
145struct audit_aux_data_bprm_fcaps {
146 struct audit_aux_data d;
147 struct audit_cap_data fcap;
148 unsigned int fcap_ver;
149 struct audit_cap_data old_pcap;
150 struct audit_cap_data new_pcap;
151};
152
153struct audit_aux_data_capset {
154 struct audit_aux_data d;
155 pid_t pid;
156 struct audit_cap_data cap;
157};
158
187struct audit_tree_refs { 159struct audit_tree_refs {
188 struct audit_tree_refs *next; 160 struct audit_tree_refs *next;
189 struct audit_chunk *c[31]; 161 struct audit_chunk *c[31];
@@ -193,14 +165,14 @@ struct audit_tree_refs {
193struct audit_context { 165struct audit_context {
194 int dummy; /* must be the first element */ 166 int dummy; /* must be the first element */
195 int in_syscall; /* 1 if task is in a syscall */ 167 int in_syscall; /* 1 if task is in a syscall */
196 enum audit_state state; 168 enum audit_state state, current_state;
197 unsigned int serial; /* serial number for record */ 169 unsigned int serial; /* serial number for record */
198 struct timespec ctime; /* time of syscall entry */ 170 struct timespec ctime; /* time of syscall entry */
199 int major; /* syscall number */ 171 int major; /* syscall number */
200 unsigned long argv[4]; /* syscall arguments */ 172 unsigned long argv[4]; /* syscall arguments */
201 int return_valid; /* return code is valid */ 173 int return_valid; /* return code is valid */
202 long return_code;/* syscall return code */ 174 long return_code;/* syscall return code */
203 int auditable; /* 1 if record should be written */ 175 u64 prio;
204 int name_count; 176 int name_count;
205 struct audit_names names[AUDIT_NAMES]; 177 struct audit_names names[AUDIT_NAMES];
206 char * filterkey; /* key for rule that triggered record */ 178 char * filterkey; /* key for rule that triggered record */
@@ -208,7 +180,8 @@ struct audit_context {
208 struct audit_context *previous; /* For nested syscalls */ 180 struct audit_context *previous; /* For nested syscalls */
209 struct audit_aux_data *aux; 181 struct audit_aux_data *aux;
210 struct audit_aux_data *aux_pids; 182 struct audit_aux_data *aux_pids;
211 183 struct sockaddr_storage *sockaddr;
184 size_t sockaddr_len;
212 /* Save things to print about task_struct */ 185 /* Save things to print about task_struct */
213 pid_t pid, ppid; 186 pid_t pid, ppid;
214 uid_t uid, euid, suid, fsuid; 187 uid_t uid, euid, suid, fsuid;
@@ -226,6 +199,49 @@ struct audit_context {
226 struct audit_tree_refs *trees, *first_trees; 199 struct audit_tree_refs *trees, *first_trees;
227 int tree_count; 200 int tree_count;
228 201
202 int type;
203 union {
204 struct {
205 int nargs;
206 long args[6];
207 } socketcall;
208 struct {
209 uid_t uid;
210 gid_t gid;
211 mode_t mode;
212 u32 osid;
213 int has_perm;
214 uid_t perm_uid;
215 gid_t perm_gid;
216 mode_t perm_mode;
217 unsigned long qbytes;
218 } ipc;
219 struct {
220 mqd_t mqdes;
221 struct mq_attr mqstat;
222 } mq_getsetattr;
223 struct {
224 mqd_t mqdes;
225 int sigev_signo;
226 } mq_notify;
227 struct {
228 mqd_t mqdes;
229 size_t msg_len;
230 unsigned int msg_prio;
231 struct timespec abs_timeout;
232 } mq_sendrecv;
233 struct {
234 int oflag;
235 mode_t mode;
236 struct mq_attr attr;
237 } mq_open;
238 struct {
239 pid_t pid;
240 struct audit_cap_data cap;
241 } capset;
242 };
243 int fds[2];
244
229#if AUDIT_DEBUG 245#if AUDIT_DEBUG
230 int put_count; 246 int put_count;
231 int ino_count; 247 int ino_count;
@@ -421,6 +437,7 @@ static int audit_filter_rules(struct task_struct *tsk,
421 struct audit_names *name, 437 struct audit_names *name,
422 enum audit_state *state) 438 enum audit_state *state)
423{ 439{
440 const struct cred *cred = get_task_cred(tsk);
424 int i, j, need_sid = 1; 441 int i, j, need_sid = 1;
425 u32 sid; 442 u32 sid;
426 443
@@ -440,28 +457,28 @@ static int audit_filter_rules(struct task_struct *tsk,
440 } 457 }
441 break; 458 break;
442 case AUDIT_UID: 459 case AUDIT_UID:
443 result = audit_comparator(tsk->uid, f->op, f->val); 460 result = audit_comparator(cred->uid, f->op, f->val);
444 break; 461 break;
445 case AUDIT_EUID: 462 case AUDIT_EUID:
446 result = audit_comparator(tsk->euid, f->op, f->val); 463 result = audit_comparator(cred->euid, f->op, f->val);
447 break; 464 break;
448 case AUDIT_SUID: 465 case AUDIT_SUID:
449 result = audit_comparator(tsk->suid, f->op, f->val); 466 result = audit_comparator(cred->suid, f->op, f->val);
450 break; 467 break;
451 case AUDIT_FSUID: 468 case AUDIT_FSUID:
452 result = audit_comparator(tsk->fsuid, f->op, f->val); 469 result = audit_comparator(cred->fsuid, f->op, f->val);
453 break; 470 break;
454 case AUDIT_GID: 471 case AUDIT_GID:
455 result = audit_comparator(tsk->gid, f->op, f->val); 472 result = audit_comparator(cred->gid, f->op, f->val);
456 break; 473 break;
457 case AUDIT_EGID: 474 case AUDIT_EGID:
458 result = audit_comparator(tsk->egid, f->op, f->val); 475 result = audit_comparator(cred->egid, f->op, f->val);
459 break; 476 break;
460 case AUDIT_SGID: 477 case AUDIT_SGID:
461 result = audit_comparator(tsk->sgid, f->op, f->val); 478 result = audit_comparator(cred->sgid, f->op, f->val);
462 break; 479 break;
463 case AUDIT_FSGID: 480 case AUDIT_FSGID:
464 result = audit_comparator(tsk->fsgid, f->op, f->val); 481 result = audit_comparator(cred->fsgid, f->op, f->val);
465 break; 482 break;
466 case AUDIT_PERS: 483 case AUDIT_PERS:
467 result = audit_comparator(tsk->personality, f->op, f->val); 484 result = audit_comparator(tsk->personality, f->op, f->val);
@@ -581,19 +598,12 @@ static int audit_filter_rules(struct task_struct *tsk,
581 } 598 }
582 } 599 }
583 /* Find ipc objects that match */ 600 /* Find ipc objects that match */
584 if (ctx) { 601 if (!ctx || ctx->type != AUDIT_IPC)
585 struct audit_aux_data *aux; 602 break;
586 for (aux = ctx->aux; aux; 603 if (security_audit_rule_match(ctx->ipc.osid,
587 aux = aux->next) { 604 f->type, f->op,
588 if (aux->type == AUDIT_IPC) { 605 f->lsm_rule, ctx))
589 struct audit_aux_data_ipcctl *axi = (void *)aux; 606 ++result;
590 if (security_audit_rule_match(axi->osid, f->type, f->op, f->lsm_rule, ctx)) {
591 ++result;
592 break;
593 }
594 }
595 }
596 }
597 } 607 }
598 break; 608 break;
599 case AUDIT_ARG0: 609 case AUDIT_ARG0:
@@ -615,15 +625,26 @@ static int audit_filter_rules(struct task_struct *tsk,
615 break; 625 break;
616 } 626 }
617 627
618 if (!result) 628 if (!result) {
629 put_cred(cred);
619 return 0; 630 return 0;
631 }
632 }
633
634 if (ctx) {
635 if (rule->prio <= ctx->prio)
636 return 0;
637 if (rule->filterkey) {
638 kfree(ctx->filterkey);
639 ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
640 }
641 ctx->prio = rule->prio;
620 } 642 }
621 if (rule->filterkey && ctx)
622 ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
623 switch (rule->action) { 643 switch (rule->action) {
624 case AUDIT_NEVER: *state = AUDIT_DISABLED; break; 644 case AUDIT_NEVER: *state = AUDIT_DISABLED; break;
625 case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break; 645 case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break;
626 } 646 }
647 put_cred(cred);
627 return 1; 648 return 1;
628} 649}
629 650
@@ -631,7 +652,7 @@ static int audit_filter_rules(struct task_struct *tsk,
631 * completely disabled for this task. Since we only have the task 652 * completely disabled for this task. Since we only have the task
632 * structure at this point, we can only check uid and gid. 653 * structure at this point, we can only check uid and gid.
633 */ 654 */
634static enum audit_state audit_filter_task(struct task_struct *tsk) 655static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
635{ 656{
636 struct audit_entry *e; 657 struct audit_entry *e;
637 enum audit_state state; 658 enum audit_state state;
@@ -639,6 +660,8 @@ static enum audit_state audit_filter_task(struct task_struct *tsk)
639 rcu_read_lock(); 660 rcu_read_lock();
640 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) { 661 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
641 if (audit_filter_rules(tsk, &e->rule, NULL, NULL, &state)) { 662 if (audit_filter_rules(tsk, &e->rule, NULL, NULL, &state)) {
663 if (state == AUDIT_RECORD_CONTEXT)
664 *key = kstrdup(e->rule.filterkey, GFP_ATOMIC);
642 rcu_read_unlock(); 665 rcu_read_unlock();
643 return state; 666 return state;
644 } 667 }
@@ -672,6 +695,7 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
672 audit_filter_rules(tsk, &e->rule, ctx, NULL, 695 audit_filter_rules(tsk, &e->rule, ctx, NULL,
673 &state)) { 696 &state)) {
674 rcu_read_unlock(); 697 rcu_read_unlock();
698 ctx->current_state = state;
675 return state; 699 return state;
676 } 700 }
677 } 701 }
@@ -685,15 +709,14 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
685 * buckets applicable to the inode numbers in audit_names[]. 709 * buckets applicable to the inode numbers in audit_names[].
686 * Regarding audit_state, same rules apply as for audit_filter_syscall(). 710 * Regarding audit_state, same rules apply as for audit_filter_syscall().
687 */ 711 */
688enum audit_state audit_filter_inodes(struct task_struct *tsk, 712void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx)
689 struct audit_context *ctx)
690{ 713{
691 int i; 714 int i;
692 struct audit_entry *e; 715 struct audit_entry *e;
693 enum audit_state state; 716 enum audit_state state;
694 717
695 if (audit_pid && tsk->tgid == audit_pid) 718 if (audit_pid && tsk->tgid == audit_pid)
696 return AUDIT_DISABLED; 719 return;
697 720
698 rcu_read_lock(); 721 rcu_read_lock();
699 for (i = 0; i < ctx->name_count; i++) { 722 for (i = 0; i < ctx->name_count; i++) {
@@ -710,17 +733,20 @@ enum audit_state audit_filter_inodes(struct task_struct *tsk,
710 if ((e->rule.mask[word] & bit) == bit && 733 if ((e->rule.mask[word] & bit) == bit &&
711 audit_filter_rules(tsk, &e->rule, ctx, n, &state)) { 734 audit_filter_rules(tsk, &e->rule, ctx, n, &state)) {
712 rcu_read_unlock(); 735 rcu_read_unlock();
713 return state; 736 ctx->current_state = state;
737 return;
714 } 738 }
715 } 739 }
716 } 740 }
717 rcu_read_unlock(); 741 rcu_read_unlock();
718 return AUDIT_BUILD_CONTEXT;
719} 742}
720 743
721void audit_set_auditable(struct audit_context *ctx) 744static void audit_set_auditable(struct audit_context *ctx)
722{ 745{
723 ctx->auditable = 1; 746 if (!ctx->prio) {
747 ctx->prio = 1;
748 ctx->current_state = AUDIT_RECORD_CONTEXT;
749 }
724} 750}
725 751
726static inline struct audit_context *audit_get_context(struct task_struct *tsk, 752static inline struct audit_context *audit_get_context(struct task_struct *tsk,
@@ -751,23 +777,11 @@ static inline struct audit_context *audit_get_context(struct task_struct *tsk,
751 else 777 else
752 context->return_code = return_code; 778 context->return_code = return_code;
753 779
754 if (context->in_syscall && !context->dummy && !context->auditable) { 780 if (context->in_syscall && !context->dummy) {
755 enum audit_state state; 781 audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
756 782 audit_filter_inodes(tsk, context);
757 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
758 if (state == AUDIT_RECORD_CONTEXT) {
759 context->auditable = 1;
760 goto get_context;
761 }
762
763 state = audit_filter_inodes(tsk, context);
764 if (state == AUDIT_RECORD_CONTEXT)
765 context->auditable = 1;
766
767 } 783 }
768 784
769get_context:
770
771 tsk->audit_context = NULL; 785 tsk->audit_context = NULL;
772 return context; 786 return context;
773} 787}
@@ -777,8 +791,7 @@ static inline void audit_free_names(struct audit_context *context)
777 int i; 791 int i;
778 792
779#if AUDIT_DEBUG == 2 793#if AUDIT_DEBUG == 2
780 if (context->auditable 794 if (context->put_count + context->ino_count != context->name_count) {
781 ||context->put_count + context->ino_count != context->name_count) {
782 printk(KERN_ERR "%s:%d(:%d): major=%d in_syscall=%d" 795 printk(KERN_ERR "%s:%d(:%d): major=%d in_syscall=%d"
783 " name_count=%d put_count=%d" 796 " name_count=%d put_count=%d"
784 " ino_count=%d [NOT freeing]\n", 797 " ino_count=%d [NOT freeing]\n",
@@ -829,6 +842,7 @@ static inline void audit_zero_context(struct audit_context *context,
829{ 842{
830 memset(context, 0, sizeof(*context)); 843 memset(context, 0, sizeof(*context));
831 context->state = state; 844 context->state = state;
845 context->prio = state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;
832} 846}
833 847
834static inline struct audit_context *audit_alloc_context(enum audit_state state) 848static inline struct audit_context *audit_alloc_context(enum audit_state state)
@@ -854,18 +868,21 @@ int audit_alloc(struct task_struct *tsk)
854{ 868{
855 struct audit_context *context; 869 struct audit_context *context;
856 enum audit_state state; 870 enum audit_state state;
871 char *key = NULL;
857 872
858 if (likely(!audit_ever_enabled)) 873 if (likely(!audit_ever_enabled))
859 return 0; /* Return if not auditing. */ 874 return 0; /* Return if not auditing. */
860 875
861 state = audit_filter_task(tsk); 876 state = audit_filter_task(tsk, &key);
862 if (likely(state == AUDIT_DISABLED)) 877 if (likely(state == AUDIT_DISABLED))
863 return 0; 878 return 0;
864 879
865 if (!(context = audit_alloc_context(state))) { 880 if (!(context = audit_alloc_context(state))) {
881 kfree(key);
866 audit_log_lost("out of memory in audit_alloc"); 882 audit_log_lost("out of memory in audit_alloc");
867 return -ENOMEM; 883 return -ENOMEM;
868 } 884 }
885 context->filterkey = key;
869 886
870 tsk->audit_context = context; 887 tsk->audit_context = context;
871 set_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT); 888 set_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
@@ -891,6 +908,7 @@ static inline void audit_free_context(struct audit_context *context)
891 free_tree_refs(context); 908 free_tree_refs(context);
892 audit_free_aux(context); 909 audit_free_aux(context);
893 kfree(context->filterkey); 910 kfree(context->filterkey);
911 kfree(context->sockaddr);
894 kfree(context); 912 kfree(context);
895 context = previous; 913 context = previous;
896 } while (context); 914 } while (context);
@@ -1171,8 +1189,129 @@ static void audit_log_execve_info(struct audit_context *context,
1171 kfree(buf); 1189 kfree(buf);
1172} 1190}
1173 1191
1192static void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap)
1193{
1194 int i;
1195
1196 audit_log_format(ab, " %s=", prefix);
1197 CAP_FOR_EACH_U32(i) {
1198 audit_log_format(ab, "%08x", cap->cap[(_KERNEL_CAPABILITY_U32S-1) - i]);
1199 }
1200}
1201
1202static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
1203{
1204 kernel_cap_t *perm = &name->fcap.permitted;
1205 kernel_cap_t *inh = &name->fcap.inheritable;
1206 int log = 0;
1207
1208 if (!cap_isclear(*perm)) {
1209 audit_log_cap(ab, "cap_fp", perm);
1210 log = 1;
1211 }
1212 if (!cap_isclear(*inh)) {
1213 audit_log_cap(ab, "cap_fi", inh);
1214 log = 1;
1215 }
1216
1217 if (log)
1218 audit_log_format(ab, " cap_fe=%d cap_fver=%x", name->fcap.fE, name->fcap_ver);
1219}
1220
1221static void show_special(struct audit_context *context, int *call_panic)
1222{
1223 struct audit_buffer *ab;
1224 int i;
1225
1226 ab = audit_log_start(context, GFP_KERNEL, context->type);
1227 if (!ab)
1228 return;
1229
1230 switch (context->type) {
1231 case AUDIT_SOCKETCALL: {
1232 int nargs = context->socketcall.nargs;
1233 audit_log_format(ab, "nargs=%d", nargs);
1234 for (i = 0; i < nargs; i++)
1235 audit_log_format(ab, " a%d=%lx", i,
1236 context->socketcall.args[i]);
1237 break; }
1238 case AUDIT_IPC: {
1239 u32 osid = context->ipc.osid;
1240
1241 audit_log_format(ab, "ouid=%u ogid=%u mode=%#o",
1242 context->ipc.uid, context->ipc.gid, context->ipc.mode);
1243 if (osid) {
1244 char *ctx = NULL;
1245 u32 len;
1246 if (security_secid_to_secctx(osid, &ctx, &len)) {
1247 audit_log_format(ab, " osid=%u", osid);
1248 *call_panic = 1;
1249 } else {
1250 audit_log_format(ab, " obj=%s", ctx);
1251 security_release_secctx(ctx, len);
1252 }
1253 }
1254 if (context->ipc.has_perm) {
1255 audit_log_end(ab);
1256 ab = audit_log_start(context, GFP_KERNEL,
1257 AUDIT_IPC_SET_PERM);
1258 audit_log_format(ab,
1259 "qbytes=%lx ouid=%u ogid=%u mode=%#o",
1260 context->ipc.qbytes,
1261 context->ipc.perm_uid,
1262 context->ipc.perm_gid,
1263 context->ipc.perm_mode);
1264 if (!ab)
1265 return;
1266 }
1267 break; }
1268 case AUDIT_MQ_OPEN: {
1269 audit_log_format(ab,
1270 "oflag=0x%x mode=%#o mq_flags=0x%lx mq_maxmsg=%ld "
1271 "mq_msgsize=%ld mq_curmsgs=%ld",
1272 context->mq_open.oflag, context->mq_open.mode,
1273 context->mq_open.attr.mq_flags,
1274 context->mq_open.attr.mq_maxmsg,
1275 context->mq_open.attr.mq_msgsize,
1276 context->mq_open.attr.mq_curmsgs);
1277 break; }
1278 case AUDIT_MQ_SENDRECV: {
1279 audit_log_format(ab,
1280 "mqdes=%d msg_len=%zd msg_prio=%u "
1281 "abs_timeout_sec=%ld abs_timeout_nsec=%ld",
1282 context->mq_sendrecv.mqdes,
1283 context->mq_sendrecv.msg_len,
1284 context->mq_sendrecv.msg_prio,
1285 context->mq_sendrecv.abs_timeout.tv_sec,
1286 context->mq_sendrecv.abs_timeout.tv_nsec);
1287 break; }
1288 case AUDIT_MQ_NOTIFY: {
1289 audit_log_format(ab, "mqdes=%d sigev_signo=%d",
1290 context->mq_notify.mqdes,
1291 context->mq_notify.sigev_signo);
1292 break; }
1293 case AUDIT_MQ_GETSETATTR: {
1294 struct mq_attr *attr = &context->mq_getsetattr.mqstat;
1295 audit_log_format(ab,
1296 "mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
1297 "mq_curmsgs=%ld ",
1298 context->mq_getsetattr.mqdes,
1299 attr->mq_flags, attr->mq_maxmsg,
1300 attr->mq_msgsize, attr->mq_curmsgs);
1301 break; }
1302 case AUDIT_CAPSET: {
1303 audit_log_format(ab, "pid=%d", context->capset.pid);
1304 audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable);
1305 audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted);
1306 audit_log_cap(ab, "cap_pe", &context->capset.cap.effective);
1307 break; }
1308 }
1309 audit_log_end(ab);
1310}
1311
1174static void audit_log_exit(struct audit_context *context, struct task_struct *tsk) 1312static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)
1175{ 1313{
1314 const struct cred *cred;
1176 int i, call_panic = 0; 1315 int i, call_panic = 0;
1177 struct audit_buffer *ab; 1316 struct audit_buffer *ab;
1178 struct audit_aux_data *aux; 1317 struct audit_aux_data *aux;
@@ -1182,14 +1321,15 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
1182 context->pid = tsk->pid; 1321 context->pid = tsk->pid;
1183 if (!context->ppid) 1322 if (!context->ppid)
1184 context->ppid = sys_getppid(); 1323 context->ppid = sys_getppid();
1185 context->uid = tsk->uid; 1324 cred = current_cred();
1186 context->gid = tsk->gid; 1325 context->uid = cred->uid;
1187 context->euid = tsk->euid; 1326 context->gid = cred->gid;
1188 context->suid = tsk->suid; 1327 context->euid = cred->euid;
1189 context->fsuid = tsk->fsuid; 1328 context->suid = cred->suid;
1190 context->egid = tsk->egid; 1329 context->fsuid = cred->fsuid;
1191 context->sgid = tsk->sgid; 1330 context->egid = cred->egid;
1192 context->fsgid = tsk->fsgid; 1331 context->sgid = cred->sgid;
1332 context->fsgid = cred->fsgid;
1193 context->personality = tsk->personality; 1333 context->personality = tsk->personality;
1194 1334
1195 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL); 1335 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
@@ -1246,96 +1386,50 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
1246 continue; /* audit_panic has been called */ 1386 continue; /* audit_panic has been called */
1247 1387
1248 switch (aux->type) { 1388 switch (aux->type) {
1249 case AUDIT_MQ_OPEN: {
1250 struct audit_aux_data_mq_open *axi = (void *)aux;
1251 audit_log_format(ab,
1252 "oflag=0x%x mode=%#o mq_flags=0x%lx mq_maxmsg=%ld "
1253 "mq_msgsize=%ld mq_curmsgs=%ld",
1254 axi->oflag, axi->mode, axi->attr.mq_flags,
1255 axi->attr.mq_maxmsg, axi->attr.mq_msgsize,
1256 axi->attr.mq_curmsgs);
1257 break; }
1258
1259 case AUDIT_MQ_SENDRECV: {
1260 struct audit_aux_data_mq_sendrecv *axi = (void *)aux;
1261 audit_log_format(ab,
1262 "mqdes=%d msg_len=%zd msg_prio=%u "
1263 "abs_timeout_sec=%ld abs_timeout_nsec=%ld",
1264 axi->mqdes, axi->msg_len, axi->msg_prio,
1265 axi->abs_timeout.tv_sec, axi->abs_timeout.tv_nsec);
1266 break; }
1267
1268 case AUDIT_MQ_NOTIFY: {
1269 struct audit_aux_data_mq_notify *axi = (void *)aux;
1270 audit_log_format(ab,
1271 "mqdes=%d sigev_signo=%d",
1272 axi->mqdes,
1273 axi->notification.sigev_signo);
1274 break; }
1275
1276 case AUDIT_MQ_GETSETATTR: {
1277 struct audit_aux_data_mq_getsetattr *axi = (void *)aux;
1278 audit_log_format(ab,
1279 "mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
1280 "mq_curmsgs=%ld ",
1281 axi->mqdes,
1282 axi->mqstat.mq_flags, axi->mqstat.mq_maxmsg,
1283 axi->mqstat.mq_msgsize, axi->mqstat.mq_curmsgs);
1284 break; }
1285
1286 case AUDIT_IPC: {
1287 struct audit_aux_data_ipcctl *axi = (void *)aux;
1288 audit_log_format(ab,
1289 "ouid=%u ogid=%u mode=%#o",
1290 axi->uid, axi->gid, axi->mode);
1291 if (axi->osid != 0) {
1292 char *ctx = NULL;
1293 u32 len;
1294 if (security_secid_to_secctx(
1295 axi->osid, &ctx, &len)) {
1296 audit_log_format(ab, " osid=%u",
1297 axi->osid);
1298 call_panic = 1;
1299 } else {
1300 audit_log_format(ab, " obj=%s", ctx);
1301 security_release_secctx(ctx, len);
1302 }
1303 }
1304 break; }
1305
1306 case AUDIT_IPC_SET_PERM: {
1307 struct audit_aux_data_ipcctl *axi = (void *)aux;
1308 audit_log_format(ab,
1309 "qbytes=%lx ouid=%u ogid=%u mode=%#o",
1310 axi->qbytes, axi->uid, axi->gid, axi->mode);
1311 break; }
1312 1389
1313 case AUDIT_EXECVE: { 1390 case AUDIT_EXECVE: {
1314 struct audit_aux_data_execve *axi = (void *)aux; 1391 struct audit_aux_data_execve *axi = (void *)aux;
1315 audit_log_execve_info(context, &ab, axi); 1392 audit_log_execve_info(context, &ab, axi);
1316 break; } 1393 break; }
1317 1394
1318 case AUDIT_SOCKETCALL: { 1395 case AUDIT_BPRM_FCAPS: {
1319 struct audit_aux_data_socketcall *axs = (void *)aux; 1396 struct audit_aux_data_bprm_fcaps *axs = (void *)aux;
1320 audit_log_format(ab, "nargs=%d", axs->nargs); 1397 audit_log_format(ab, "fver=%x", axs->fcap_ver);
1321 for (i=0; i<axs->nargs; i++) 1398 audit_log_cap(ab, "fp", &axs->fcap.permitted);
1322 audit_log_format(ab, " a%d=%lx", i, axs->args[i]); 1399 audit_log_cap(ab, "fi", &axs->fcap.inheritable);
1400 audit_log_format(ab, " fe=%d", axs->fcap.fE);
1401 audit_log_cap(ab, "old_pp", &axs->old_pcap.permitted);
1402 audit_log_cap(ab, "old_pi", &axs->old_pcap.inheritable);
1403 audit_log_cap(ab, "old_pe", &axs->old_pcap.effective);
1404 audit_log_cap(ab, "new_pp", &axs->new_pcap.permitted);
1405 audit_log_cap(ab, "new_pi", &axs->new_pcap.inheritable);
1406 audit_log_cap(ab, "new_pe", &axs->new_pcap.effective);
1323 break; } 1407 break; }
1324 1408
1325 case AUDIT_SOCKADDR: { 1409 }
1326 struct audit_aux_data_sockaddr *axs = (void *)aux; 1410 audit_log_end(ab);
1411 }
1327 1412
1328 audit_log_format(ab, "saddr="); 1413 if (context->type)
1329 audit_log_n_hex(ab, axs->a, axs->len); 1414 show_special(context, &call_panic);
1330 break; }
1331 1415
1332 case AUDIT_FD_PAIR: { 1416 if (context->fds[0] >= 0) {
1333 struct audit_aux_data_fd_pair *axs = (void *)aux; 1417 ab = audit_log_start(context, GFP_KERNEL, AUDIT_FD_PAIR);
1334 audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]); 1418 if (ab) {
1335 break; } 1419 audit_log_format(ab, "fd0=%d fd1=%d",
1420 context->fds[0], context->fds[1]);
1421 audit_log_end(ab);
1422 }
1423 }
1336 1424
1425 if (context->sockaddr_len) {
1426 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR);
1427 if (ab) {
1428 audit_log_format(ab, "saddr=");
1429 audit_log_n_hex(ab, (void *)context->sockaddr,
1430 context->sockaddr_len);
1431 audit_log_end(ab);
1337 } 1432 }
1338 audit_log_end(ab);
1339 } 1433 }
1340 1434
1341 for (aux = context->aux_pids; aux; aux = aux->next) { 1435 for (aux = context->aux_pids; aux; aux = aux->next) {
@@ -1421,6 +1515,8 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
1421 } 1515 }
1422 } 1516 }
1423 1517
1518 audit_log_fcaps(ab, n);
1519
1424 audit_log_end(ab); 1520 audit_log_end(ab);
1425 } 1521 }
1426 1522
@@ -1451,7 +1547,7 @@ void audit_free(struct task_struct *tsk)
1451 * We use GFP_ATOMIC here because we might be doing this 1547 * We use GFP_ATOMIC here because we might be doing this
1452 * in the context of the idle thread */ 1548 * in the context of the idle thread */
1453 /* that can happen only if we are called from do_exit() */ 1549 /* that can happen only if we are called from do_exit() */
1454 if (context->in_syscall && context->auditable) 1550 if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT)
1455 audit_log_exit(context, tsk); 1551 audit_log_exit(context, tsk);
1456 1552
1457 audit_free_context(context); 1553 audit_free_context(context);
@@ -1459,7 +1555,6 @@ void audit_free(struct task_struct *tsk)
1459 1555
1460/** 1556/**
1461 * audit_syscall_entry - fill in an audit record at syscall entry 1557 * audit_syscall_entry - fill in an audit record at syscall entry
1462 * @tsk: task being audited
1463 * @arch: architecture type 1558 * @arch: architecture type
1464 * @major: major syscall type (function) 1559 * @major: major syscall type (function)
1465 * @a1: additional syscall register 1 1560 * @a1: additional syscall register 1
@@ -1536,21 +1631,42 @@ void audit_syscall_entry(int arch, int major,
1536 1631
1537 state = context->state; 1632 state = context->state;
1538 context->dummy = !audit_n_rules; 1633 context->dummy = !audit_n_rules;
1539 if (!context->dummy && (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT)) 1634 if (!context->dummy && state == AUDIT_BUILD_CONTEXT) {
1635 context->prio = 0;
1540 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]); 1636 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
1637 }
1541 if (likely(state == AUDIT_DISABLED)) 1638 if (likely(state == AUDIT_DISABLED))
1542 return; 1639 return;
1543 1640
1544 context->serial = 0; 1641 context->serial = 0;
1545 context->ctime = CURRENT_TIME; 1642 context->ctime = CURRENT_TIME;
1546 context->in_syscall = 1; 1643 context->in_syscall = 1;
1547 context->auditable = !!(state == AUDIT_RECORD_CONTEXT); 1644 context->current_state = state;
1548 context->ppid = 0; 1645 context->ppid = 0;
1549} 1646}
1550 1647
1648void audit_finish_fork(struct task_struct *child)
1649{
1650 struct audit_context *ctx = current->audit_context;
1651 struct audit_context *p = child->audit_context;
1652 if (!p || !ctx)
1653 return;
1654 if (!ctx->in_syscall || ctx->current_state != AUDIT_RECORD_CONTEXT)
1655 return;
1656 p->arch = ctx->arch;
1657 p->major = ctx->major;
1658 memcpy(p->argv, ctx->argv, sizeof(ctx->argv));
1659 p->ctime = ctx->ctime;
1660 p->dummy = ctx->dummy;
1661 p->in_syscall = ctx->in_syscall;
1662 p->filterkey = kstrdup(ctx->filterkey, GFP_KERNEL);
1663 p->ppid = current->pid;
1664 p->prio = ctx->prio;
1665 p->current_state = ctx->current_state;
1666}
1667
1551/** 1668/**
1552 * audit_syscall_exit - deallocate audit context after a system call 1669 * audit_syscall_exit - deallocate audit context after a system call
1553 * @tsk: task being audited
1554 * @valid: success/failure flag 1670 * @valid: success/failure flag
1555 * @return_code: syscall return value 1671 * @return_code: syscall return value
1556 * 1672 *
@@ -1570,11 +1686,11 @@ void audit_syscall_exit(int valid, long return_code)
1570 if (likely(!context)) 1686 if (likely(!context))
1571 return; 1687 return;
1572 1688
1573 if (context->in_syscall && context->auditable) 1689 if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT)
1574 audit_log_exit(context, tsk); 1690 audit_log_exit(context, tsk);
1575 1691
1576 context->in_syscall = 0; 1692 context->in_syscall = 0;
1577 context->auditable = 0; 1693 context->prio = context->state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;
1578 1694
1579 if (context->previous) { 1695 if (context->previous) {
1580 struct audit_context *new_context = context->previous; 1696 struct audit_context *new_context = context->previous;
@@ -1589,8 +1705,13 @@ void audit_syscall_exit(int valid, long return_code)
1589 context->aux_pids = NULL; 1705 context->aux_pids = NULL;
1590 context->target_pid = 0; 1706 context->target_pid = 0;
1591 context->target_sid = 0; 1707 context->target_sid = 0;
1592 kfree(context->filterkey); 1708 context->sockaddr_len = 0;
1593 context->filterkey = NULL; 1709 context->type = 0;
1710 context->fds[0] = -1;
1711 if (context->state != AUDIT_RECORD_CONTEXT) {
1712 kfree(context->filterkey);
1713 context->filterkey = NULL;
1714 }
1594 tsk->audit_context = context; 1715 tsk->audit_context = context;
1595 } 1716 }
1596} 1717}
@@ -1787,8 +1908,36 @@ static int audit_inc_name_count(struct audit_context *context,
1787 return 0; 1908 return 0;
1788} 1909}
1789 1910
1911
1912static inline int audit_copy_fcaps(struct audit_names *name, const struct dentry *dentry)
1913{
1914 struct cpu_vfs_cap_data caps;
1915 int rc;
1916
1917 memset(&name->fcap.permitted, 0, sizeof(kernel_cap_t));
1918 memset(&name->fcap.inheritable, 0, sizeof(kernel_cap_t));
1919 name->fcap.fE = 0;
1920 name->fcap_ver = 0;
1921
1922 if (!dentry)
1923 return 0;
1924
1925 rc = get_vfs_caps_from_disk(dentry, &caps);
1926 if (rc)
1927 return rc;
1928
1929 name->fcap.permitted = caps.permitted;
1930 name->fcap.inheritable = caps.inheritable;
1931 name->fcap.fE = !!(caps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
1932 name->fcap_ver = (caps.magic_etc & VFS_CAP_REVISION_MASK) >> VFS_CAP_REVISION_SHIFT;
1933
1934 return 0;
1935}
1936
1937
1790/* Copy inode data into an audit_names. */ 1938/* Copy inode data into an audit_names. */
1791static void audit_copy_inode(struct audit_names *name, const struct inode *inode) 1939static void audit_copy_inode(struct audit_names *name, const struct dentry *dentry,
1940 const struct inode *inode)
1792{ 1941{
1793 name->ino = inode->i_ino; 1942 name->ino = inode->i_ino;
1794 name->dev = inode->i_sb->s_dev; 1943 name->dev = inode->i_sb->s_dev;
@@ -1797,6 +1946,7 @@ static void audit_copy_inode(struct audit_names *name, const struct inode *inode
1797 name->gid = inode->i_gid; 1946 name->gid = inode->i_gid;
1798 name->rdev = inode->i_rdev; 1947 name->rdev = inode->i_rdev;
1799 security_inode_getsecid(inode, &name->osid); 1948 security_inode_getsecid(inode, &name->osid);
1949 audit_copy_fcaps(name, dentry);
1800} 1950}
1801 1951
1802/** 1952/**
@@ -1831,7 +1981,7 @@ void __audit_inode(const char *name, const struct dentry *dentry)
1831 context->names[idx].name = NULL; 1981 context->names[idx].name = NULL;
1832 } 1982 }
1833 handle_path(dentry); 1983 handle_path(dentry);
1834 audit_copy_inode(&context->names[idx], inode); 1984 audit_copy_inode(&context->names[idx], dentry, inode);
1835} 1985}
1836 1986
1837/** 1987/**
@@ -1892,7 +2042,7 @@ void __audit_inode_child(const char *dname, const struct dentry *dentry,
1892 if (!strcmp(dname, n->name) || 2042 if (!strcmp(dname, n->name) ||
1893 !audit_compare_dname_path(dname, n->name, &dirlen)) { 2043 !audit_compare_dname_path(dname, n->name, &dirlen)) {
1894 if (inode) 2044 if (inode)
1895 audit_copy_inode(n, inode); 2045 audit_copy_inode(n, NULL, inode);
1896 else 2046 else
1897 n->ino = (unsigned long)-1; 2047 n->ino = (unsigned long)-1;
1898 found_child = n->name; 2048 found_child = n->name;
@@ -1906,7 +2056,7 @@ add_names:
1906 return; 2056 return;
1907 idx = context->name_count - 1; 2057 idx = context->name_count - 1;
1908 context->names[idx].name = NULL; 2058 context->names[idx].name = NULL;
1909 audit_copy_inode(&context->names[idx], parent); 2059 audit_copy_inode(&context->names[idx], NULL, parent);
1910 } 2060 }
1911 2061
1912 if (!found_child) { 2062 if (!found_child) {
@@ -1927,7 +2077,7 @@ add_names:
1927 } 2077 }
1928 2078
1929 if (inode) 2079 if (inode)
1930 audit_copy_inode(&context->names[idx], inode); 2080 audit_copy_inode(&context->names[idx], NULL, inode);
1931 else 2081 else
1932 context->names[idx].ino = (unsigned long)-1; 2082 context->names[idx].ino = (unsigned long)-1;
1933 } 2083 }
@@ -1942,15 +2092,21 @@ EXPORT_SYMBOL_GPL(__audit_inode_child);
1942 * 2092 *
1943 * Also sets the context as auditable. 2093 * Also sets the context as auditable.
1944 */ 2094 */
1945void auditsc_get_stamp(struct audit_context *ctx, 2095int auditsc_get_stamp(struct audit_context *ctx,
1946 struct timespec *t, unsigned int *serial) 2096 struct timespec *t, unsigned int *serial)
1947{ 2097{
2098 if (!ctx->in_syscall)
2099 return 0;
1948 if (!ctx->serial) 2100 if (!ctx->serial)
1949 ctx->serial = audit_serial(); 2101 ctx->serial = audit_serial();
1950 t->tv_sec = ctx->ctime.tv_sec; 2102 t->tv_sec = ctx->ctime.tv_sec;
1951 t->tv_nsec = ctx->ctime.tv_nsec; 2103 t->tv_nsec = ctx->ctime.tv_nsec;
1952 *serial = ctx->serial; 2104 *serial = ctx->serial;
1953 ctx->auditable = 1; 2105 if (!ctx->prio) {
2106 ctx->prio = 1;
2107 ctx->current_state = AUDIT_RECORD_CONTEXT;
2108 }
2109 return 1;
1954} 2110}
1955 2111
1956/* global counter which is incremented every time something logs in */ 2112/* global counter which is incremented every time something logs in */
@@ -1978,7 +2134,7 @@ int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
1978 audit_log_format(ab, "login pid=%d uid=%u " 2134 audit_log_format(ab, "login pid=%d uid=%u "
1979 "old auid=%u new auid=%u" 2135 "old auid=%u new auid=%u"
1980 " old ses=%u new ses=%u", 2136 " old ses=%u new ses=%u",
1981 task->pid, task->uid, 2137 task->pid, task_uid(task),
1982 task->loginuid, loginuid, 2138 task->loginuid, loginuid,
1983 task->sessionid, sessionid); 2139 task->sessionid, sessionid);
1984 audit_log_end(ab); 2140 audit_log_end(ab);
@@ -1995,132 +2151,46 @@ int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
1995 * @mode: mode bits 2151 * @mode: mode bits
1996 * @u_attr: queue attributes 2152 * @u_attr: queue attributes
1997 * 2153 *
1998 * Returns 0 for success or NULL context or < 0 on error.
1999 */ 2154 */
2000int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr) 2155void __audit_mq_open(int oflag, mode_t mode, struct mq_attr *attr)
2001{ 2156{
2002 struct audit_aux_data_mq_open *ax;
2003 struct audit_context *context = current->audit_context; 2157 struct audit_context *context = current->audit_context;
2004 2158
2005 if (!audit_enabled) 2159 if (attr)
2006 return 0; 2160 memcpy(&context->mq_open.attr, attr, sizeof(struct mq_attr));
2007 2161 else
2008 if (likely(!context)) 2162 memset(&context->mq_open.attr, 0, sizeof(struct mq_attr));
2009 return 0;
2010
2011 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
2012 if (!ax)
2013 return -ENOMEM;
2014
2015 if (u_attr != NULL) {
2016 if (copy_from_user(&ax->attr, u_attr, sizeof(ax->attr))) {
2017 kfree(ax);
2018 return -EFAULT;
2019 }
2020 } else
2021 memset(&ax->attr, 0, sizeof(ax->attr));
2022 2163
2023 ax->oflag = oflag; 2164 context->mq_open.oflag = oflag;
2024 ax->mode = mode; 2165 context->mq_open.mode = mode;
2025 2166
2026 ax->d.type = AUDIT_MQ_OPEN; 2167 context->type = AUDIT_MQ_OPEN;
2027 ax->d.next = context->aux;
2028 context->aux = (void *)ax;
2029 return 0;
2030} 2168}
2031 2169
2032/** 2170/**
2033 * __audit_mq_timedsend - record audit data for a POSIX MQ timed send 2171 * __audit_mq_sendrecv - record audit data for a POSIX MQ timed send/receive
2034 * @mqdes: MQ descriptor 2172 * @mqdes: MQ descriptor
2035 * @msg_len: Message length 2173 * @msg_len: Message length
2036 * @msg_prio: Message priority 2174 * @msg_prio: Message priority
2037 * @u_abs_timeout: Message timeout in absolute time 2175 * @abs_timeout: Message timeout in absolute time
2038 * 2176 *
2039 * Returns 0 for success or NULL context or < 0 on error.
2040 */ 2177 */
2041int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, 2178void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio,
2042 const struct timespec __user *u_abs_timeout) 2179 const struct timespec *abs_timeout)
2043{ 2180{
2044 struct audit_aux_data_mq_sendrecv *ax;
2045 struct audit_context *context = current->audit_context; 2181 struct audit_context *context = current->audit_context;
2182 struct timespec *p = &context->mq_sendrecv.abs_timeout;
2046 2183
2047 if (!audit_enabled) 2184 if (abs_timeout)
2048 return 0; 2185 memcpy(p, abs_timeout, sizeof(struct timespec));
2049 2186 else
2050 if (likely(!context)) 2187 memset(p, 0, sizeof(struct timespec));
2051 return 0;
2052
2053 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
2054 if (!ax)
2055 return -ENOMEM;
2056
2057 if (u_abs_timeout != NULL) {
2058 if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) {
2059 kfree(ax);
2060 return -EFAULT;
2061 }
2062 } else
2063 memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout));
2064
2065 ax->mqdes = mqdes;
2066 ax->msg_len = msg_len;
2067 ax->msg_prio = msg_prio;
2068
2069 ax->d.type = AUDIT_MQ_SENDRECV;
2070 ax->d.next = context->aux;
2071 context->aux = (void *)ax;
2072 return 0;
2073}
2074
2075/**
2076 * __audit_mq_timedreceive - record audit data for a POSIX MQ timed receive
2077 * @mqdes: MQ descriptor
2078 * @msg_len: Message length
2079 * @u_msg_prio: Message priority
2080 * @u_abs_timeout: Message timeout in absolute time
2081 *
2082 * Returns 0 for success or NULL context or < 0 on error.
2083 */
2084int __audit_mq_timedreceive(mqd_t mqdes, size_t msg_len,
2085 unsigned int __user *u_msg_prio,
2086 const struct timespec __user *u_abs_timeout)
2087{
2088 struct audit_aux_data_mq_sendrecv *ax;
2089 struct audit_context *context = current->audit_context;
2090
2091 if (!audit_enabled)
2092 return 0;
2093
2094 if (likely(!context))
2095 return 0;
2096
2097 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
2098 if (!ax)
2099 return -ENOMEM;
2100
2101 if (u_msg_prio != NULL) {
2102 if (get_user(ax->msg_prio, u_msg_prio)) {
2103 kfree(ax);
2104 return -EFAULT;
2105 }
2106 } else
2107 ax->msg_prio = 0;
2108
2109 if (u_abs_timeout != NULL) {
2110 if (copy_from_user(&ax->abs_timeout, u_abs_timeout, sizeof(ax->abs_timeout))) {
2111 kfree(ax);
2112 return -EFAULT;
2113 }
2114 } else
2115 memset(&ax->abs_timeout, 0, sizeof(ax->abs_timeout));
2116 2188
2117 ax->mqdes = mqdes; 2189 context->mq_sendrecv.mqdes = mqdes;
2118 ax->msg_len = msg_len; 2190 context->mq_sendrecv.msg_len = msg_len;
2191 context->mq_sendrecv.msg_prio = msg_prio;
2119 2192
2120 ax->d.type = AUDIT_MQ_SENDRECV; 2193 context->type = AUDIT_MQ_SENDRECV;
2121 ax->d.next = context->aux;
2122 context->aux = (void *)ax;
2123 return 0;
2124} 2194}
2125 2195
2126/** 2196/**
@@ -2128,38 +2198,19 @@ int __audit_mq_timedreceive(mqd_t mqdes, size_t msg_len,
2128 * @mqdes: MQ descriptor 2198 * @mqdes: MQ descriptor
2129 * @u_notification: Notification event 2199 * @u_notification: Notification event
2130 * 2200 *
2131 * Returns 0 for success or NULL context or < 0 on error.
2132 */ 2201 */
2133 2202
2134int __audit_mq_notify(mqd_t mqdes, const struct sigevent __user *u_notification) 2203void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
2135{ 2204{
2136 struct audit_aux_data_mq_notify *ax;
2137 struct audit_context *context = current->audit_context; 2205 struct audit_context *context = current->audit_context;
2138 2206
2139 if (!audit_enabled) 2207 if (notification)
2140 return 0; 2208 context->mq_notify.sigev_signo = notification->sigev_signo;
2141 2209 else
2142 if (likely(!context)) 2210 context->mq_notify.sigev_signo = 0;
2143 return 0;
2144
2145 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
2146 if (!ax)
2147 return -ENOMEM;
2148
2149 if (u_notification != NULL) {
2150 if (copy_from_user(&ax->notification, u_notification, sizeof(ax->notification))) {
2151 kfree(ax);
2152 return -EFAULT;
2153 }
2154 } else
2155 memset(&ax->notification, 0, sizeof(ax->notification));
2156
2157 ax->mqdes = mqdes;
2158 2211
2159 ax->d.type = AUDIT_MQ_NOTIFY; 2212 context->mq_notify.mqdes = mqdes;
2160 ax->d.next = context->aux; 2213 context->type = AUDIT_MQ_NOTIFY;
2161 context->aux = (void *)ax;
2162 return 0;
2163} 2214}
2164 2215
2165/** 2216/**
@@ -2167,55 +2218,29 @@ int __audit_mq_notify(mqd_t mqdes, const struct sigevent __user *u_notification)
2167 * @mqdes: MQ descriptor 2218 * @mqdes: MQ descriptor
2168 * @mqstat: MQ flags 2219 * @mqstat: MQ flags
2169 * 2220 *
2170 * Returns 0 for success or NULL context or < 0 on error.
2171 */ 2221 */
2172int __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) 2222void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
2173{ 2223{
2174 struct audit_aux_data_mq_getsetattr *ax;
2175 struct audit_context *context = current->audit_context; 2224 struct audit_context *context = current->audit_context;
2176 2225 context->mq_getsetattr.mqdes = mqdes;
2177 if (!audit_enabled) 2226 context->mq_getsetattr.mqstat = *mqstat;
2178 return 0; 2227 context->type = AUDIT_MQ_GETSETATTR;
2179
2180 if (likely(!context))
2181 return 0;
2182
2183 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
2184 if (!ax)
2185 return -ENOMEM;
2186
2187 ax->mqdes = mqdes;
2188 ax->mqstat = *mqstat;
2189
2190 ax->d.type = AUDIT_MQ_GETSETATTR;
2191 ax->d.next = context->aux;
2192 context->aux = (void *)ax;
2193 return 0;
2194} 2228}
2195 2229
2196/** 2230/**
2197 * audit_ipc_obj - record audit data for ipc object 2231 * audit_ipc_obj - record audit data for ipc object
2198 * @ipcp: ipc permissions 2232 * @ipcp: ipc permissions
2199 * 2233 *
2200 * Returns 0 for success or NULL context or < 0 on error.
2201 */ 2234 */
2202int __audit_ipc_obj(struct kern_ipc_perm *ipcp) 2235void __audit_ipc_obj(struct kern_ipc_perm *ipcp)
2203{ 2236{
2204 struct audit_aux_data_ipcctl *ax;
2205 struct audit_context *context = current->audit_context; 2237 struct audit_context *context = current->audit_context;
2206 2238 context->ipc.uid = ipcp->uid;
2207 ax = kmalloc(sizeof(*ax), GFP_ATOMIC); 2239 context->ipc.gid = ipcp->gid;
2208 if (!ax) 2240 context->ipc.mode = ipcp->mode;
2209 return -ENOMEM; 2241 context->ipc.has_perm = 0;
2210 2242 security_ipc_getsecid(ipcp, &context->ipc.osid);
2211 ax->uid = ipcp->uid; 2243 context->type = AUDIT_IPC;
2212 ax->gid = ipcp->gid;
2213 ax->mode = ipcp->mode;
2214 security_ipc_getsecid(ipcp, &ax->osid);
2215 ax->d.type = AUDIT_IPC;
2216 ax->d.next = context->aux;
2217 context->aux = (void *)ax;
2218 return 0;
2219} 2244}
2220 2245
2221/** 2246/**
@@ -2225,26 +2250,17 @@ int __audit_ipc_obj(struct kern_ipc_perm *ipcp)
2225 * @gid: msgq group id 2250 * @gid: msgq group id
2226 * @mode: msgq mode (permissions) 2251 * @mode: msgq mode (permissions)
2227 * 2252 *
2228 * Returns 0 for success or NULL context or < 0 on error. 2253 * Called only after audit_ipc_obj().
2229 */ 2254 */
2230int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode) 2255void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode)
2231{ 2256{
2232 struct audit_aux_data_ipcctl *ax;
2233 struct audit_context *context = current->audit_context; 2257 struct audit_context *context = current->audit_context;
2234 2258
2235 ax = kmalloc(sizeof(*ax), GFP_ATOMIC); 2259 context->ipc.qbytes = qbytes;
2236 if (!ax) 2260 context->ipc.perm_uid = uid;
2237 return -ENOMEM; 2261 context->ipc.perm_gid = gid;
2238 2262 context->ipc.perm_mode = mode;
2239 ax->qbytes = qbytes; 2263 context->ipc.has_perm = 1;
2240 ax->uid = uid;
2241 ax->gid = gid;
2242 ax->mode = mode;
2243
2244 ax->d.type = AUDIT_IPC_SET_PERM;
2245 ax->d.next = context->aux;
2246 context->aux = (void *)ax;
2247 return 0;
2248} 2264}
2249 2265
2250int audit_bprm(struct linux_binprm *bprm) 2266int audit_bprm(struct linux_binprm *bprm)
@@ -2274,27 +2290,17 @@ int audit_bprm(struct linux_binprm *bprm)
2274 * @nargs: number of args 2290 * @nargs: number of args
2275 * @args: args array 2291 * @args: args array
2276 * 2292 *
2277 * Returns 0 for success or NULL context or < 0 on error.
2278 */ 2293 */
2279int audit_socketcall(int nargs, unsigned long *args) 2294void audit_socketcall(int nargs, unsigned long *args)
2280{ 2295{
2281 struct audit_aux_data_socketcall *ax;
2282 struct audit_context *context = current->audit_context; 2296 struct audit_context *context = current->audit_context;
2283 2297
2284 if (likely(!context || context->dummy)) 2298 if (likely(!context || context->dummy))
2285 return 0; 2299 return;
2286
2287 ax = kmalloc(sizeof(*ax) + nargs * sizeof(unsigned long), GFP_KERNEL);
2288 if (!ax)
2289 return -ENOMEM;
2290
2291 ax->nargs = nargs;
2292 memcpy(ax->args, args, nargs * sizeof(unsigned long));
2293 2300
2294 ax->d.type = AUDIT_SOCKETCALL; 2301 context->type = AUDIT_SOCKETCALL;
2295 ax->d.next = context->aux; 2302 context->socketcall.nargs = nargs;
2296 context->aux = (void *)ax; 2303 memcpy(context->socketcall.args, args, nargs * sizeof(unsigned long));
2297 return 0;
2298} 2304}
2299 2305
2300/** 2306/**
@@ -2302,29 +2308,12 @@ int audit_socketcall(int nargs, unsigned long *args)
2302 * @fd1: the first file descriptor 2308 * @fd1: the first file descriptor
2303 * @fd2: the second file descriptor 2309 * @fd2: the second file descriptor
2304 * 2310 *
2305 * Returns 0 for success or NULL context or < 0 on error.
2306 */ 2311 */
2307int __audit_fd_pair(int fd1, int fd2) 2312void __audit_fd_pair(int fd1, int fd2)
2308{ 2313{
2309 struct audit_context *context = current->audit_context; 2314 struct audit_context *context = current->audit_context;
2310 struct audit_aux_data_fd_pair *ax; 2315 context->fds[0] = fd1;
2311 2316 context->fds[1] = fd2;
2312 if (likely(!context)) {
2313 return 0;
2314 }
2315
2316 ax = kmalloc(sizeof(*ax), GFP_KERNEL);
2317 if (!ax) {
2318 return -ENOMEM;
2319 }
2320
2321 ax->fd[0] = fd1;
2322 ax->fd[1] = fd2;
2323
2324 ax->d.type = AUDIT_FD_PAIR;
2325 ax->d.next = context->aux;
2326 context->aux = (void *)ax;
2327 return 0;
2328} 2317}
2329 2318
2330/** 2319/**
@@ -2336,22 +2325,20 @@ int __audit_fd_pair(int fd1, int fd2)
2336 */ 2325 */
2337int audit_sockaddr(int len, void *a) 2326int audit_sockaddr(int len, void *a)
2338{ 2327{
2339 struct audit_aux_data_sockaddr *ax;
2340 struct audit_context *context = current->audit_context; 2328 struct audit_context *context = current->audit_context;
2341 2329
2342 if (likely(!context || context->dummy)) 2330 if (likely(!context || context->dummy))
2343 return 0; 2331 return 0;
2344 2332
2345 ax = kmalloc(sizeof(*ax) + len, GFP_KERNEL); 2333 if (!context->sockaddr) {
2346 if (!ax) 2334 void *p = kmalloc(sizeof(struct sockaddr_storage), GFP_KERNEL);
2347 return -ENOMEM; 2335 if (!p)
2348 2336 return -ENOMEM;
2349 ax->len = len; 2337 context->sockaddr = p;
2350 memcpy(ax->a, a, len); 2338 }
2351 2339
2352 ax->d.type = AUDIT_SOCKADDR; 2340 context->sockaddr_len = len;
2353 ax->d.next = context->aux; 2341 memcpy(context->sockaddr, a, len);
2354 context->aux = (void *)ax;
2355 return 0; 2342 return 0;
2356} 2343}
2357 2344
@@ -2361,7 +2348,7 @@ void __audit_ptrace(struct task_struct *t)
2361 2348
2362 context->target_pid = t->pid; 2349 context->target_pid = t->pid;
2363 context->target_auid = audit_get_loginuid(t); 2350 context->target_auid = audit_get_loginuid(t);
2364 context->target_uid = t->uid; 2351 context->target_uid = task_uid(t);
2365 context->target_sessionid = audit_get_sessionid(t); 2352 context->target_sessionid = audit_get_sessionid(t);
2366 security_task_getsecid(t, &context->target_sid); 2353 security_task_getsecid(t, &context->target_sid);
2367 memcpy(context->target_comm, t->comm, TASK_COMM_LEN); 2354 memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
@@ -2380,6 +2367,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
2380 struct audit_aux_data_pids *axp; 2367 struct audit_aux_data_pids *axp;
2381 struct task_struct *tsk = current; 2368 struct task_struct *tsk = current;
2382 struct audit_context *ctx = tsk->audit_context; 2369 struct audit_context *ctx = tsk->audit_context;
2370 uid_t uid = current_uid(), t_uid = task_uid(t);
2383 2371
2384 if (audit_pid && t->tgid == audit_pid) { 2372 if (audit_pid && t->tgid == audit_pid) {
2385 if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1 || sig == SIGUSR2) { 2373 if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1 || sig == SIGUSR2) {
@@ -2387,7 +2375,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
2387 if (tsk->loginuid != -1) 2375 if (tsk->loginuid != -1)
2388 audit_sig_uid = tsk->loginuid; 2376 audit_sig_uid = tsk->loginuid;
2389 else 2377 else
2390 audit_sig_uid = tsk->uid; 2378 audit_sig_uid = uid;
2391 security_task_getsecid(tsk, &audit_sig_sid); 2379 security_task_getsecid(tsk, &audit_sig_sid);
2392 } 2380 }
2393 if (!audit_signals || audit_dummy_context()) 2381 if (!audit_signals || audit_dummy_context())
@@ -2399,7 +2387,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
2399 if (!ctx->target_pid) { 2387 if (!ctx->target_pid) {
2400 ctx->target_pid = t->tgid; 2388 ctx->target_pid = t->tgid;
2401 ctx->target_auid = audit_get_loginuid(t); 2389 ctx->target_auid = audit_get_loginuid(t);
2402 ctx->target_uid = t->uid; 2390 ctx->target_uid = t_uid;
2403 ctx->target_sessionid = audit_get_sessionid(t); 2391 ctx->target_sessionid = audit_get_sessionid(t);
2404 security_task_getsecid(t, &ctx->target_sid); 2392 security_task_getsecid(t, &ctx->target_sid);
2405 memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN); 2393 memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
@@ -2420,7 +2408,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
2420 2408
2421 axp->target_pid[axp->pid_count] = t->tgid; 2409 axp->target_pid[axp->pid_count] = t->tgid;
2422 axp->target_auid[axp->pid_count] = audit_get_loginuid(t); 2410 axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
2423 axp->target_uid[axp->pid_count] = t->uid; 2411 axp->target_uid[axp->pid_count] = t_uid;
2424 axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t); 2412 axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t);
2425 security_task_getsecid(t, &axp->target_sid[axp->pid_count]); 2413 security_task_getsecid(t, &axp->target_sid[axp->pid_count]);
2426 memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN); 2414 memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
@@ -2430,6 +2418,72 @@ int __audit_signal_info(int sig, struct task_struct *t)
2430} 2418}
2431 2419
2432/** 2420/**
2421 * __audit_log_bprm_fcaps - store information about a loading bprm and relevant fcaps
2422 * @bprm: pointer to the bprm being processed
2423 * @new: the proposed new credentials
2424 * @old: the old credentials
2425 *
2426 * Simply check if the proc already has the caps given by the file and if not
2427 * store the priv escalation info for later auditing at the end of the syscall
2428 *
2429 * -Eric
2430 */
2431int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
2432 const struct cred *new, const struct cred *old)
2433{
2434 struct audit_aux_data_bprm_fcaps *ax;
2435 struct audit_context *context = current->audit_context;
2436 struct cpu_vfs_cap_data vcaps;
2437 struct dentry *dentry;
2438
2439 ax = kmalloc(sizeof(*ax), GFP_KERNEL);
2440 if (!ax)
2441 return -ENOMEM;
2442
2443 ax->d.type = AUDIT_BPRM_FCAPS;
2444 ax->d.next = context->aux;
2445 context->aux = (void *)ax;
2446
2447 dentry = dget(bprm->file->f_dentry);
2448 get_vfs_caps_from_disk(dentry, &vcaps);
2449 dput(dentry);
2450
2451 ax->fcap.permitted = vcaps.permitted;
2452 ax->fcap.inheritable = vcaps.inheritable;
2453 ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
2454 ax->fcap_ver = (vcaps.magic_etc & VFS_CAP_REVISION_MASK) >> VFS_CAP_REVISION_SHIFT;
2455
2456 ax->old_pcap.permitted = old->cap_permitted;
2457 ax->old_pcap.inheritable = old->cap_inheritable;
2458 ax->old_pcap.effective = old->cap_effective;
2459
2460 ax->new_pcap.permitted = new->cap_permitted;
2461 ax->new_pcap.inheritable = new->cap_inheritable;
2462 ax->new_pcap.effective = new->cap_effective;
2463 return 0;
2464}
2465
2466/**
2467 * __audit_log_capset - store information about the arguments to the capset syscall
2468 * @pid: target pid of the capset call
2469 * @new: the new credentials
2470 * @old: the old (current) credentials
2471 *
2472 * Record the aguments userspace sent to sys_capset for later printing by the
2473 * audit system if applicable
2474 */
2475void __audit_log_capset(pid_t pid,
2476 const struct cred *new, const struct cred *old)
2477{
2478 struct audit_context *context = current->audit_context;
2479 context->capset.pid = pid;
2480 context->capset.cap.effective = new->cap_effective;
2481 context->capset.cap.inheritable = new->cap_effective;
2482 context->capset.cap.permitted = new->cap_permitted;
2483 context->type = AUDIT_CAPSET;
2484}
2485
2486/**
2433 * audit_core_dumps - record information about processes that end abnormally 2487 * audit_core_dumps - record information about processes that end abnormally
2434 * @signr: signal value 2488 * @signr: signal value
2435 * 2489 *
@@ -2440,7 +2494,8 @@ void audit_core_dumps(long signr)
2440{ 2494{
2441 struct audit_buffer *ab; 2495 struct audit_buffer *ab;
2442 u32 sid; 2496 u32 sid;
2443 uid_t auid = audit_get_loginuid(current); 2497 uid_t auid = audit_get_loginuid(current), uid;
2498 gid_t gid;
2444 unsigned int sessionid = audit_get_sessionid(current); 2499 unsigned int sessionid = audit_get_sessionid(current);
2445 2500
2446 if (!audit_enabled) 2501 if (!audit_enabled)
@@ -2450,8 +2505,9 @@ void audit_core_dumps(long signr)
2450 return; 2505 return;
2451 2506
2452 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND); 2507 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
2508 current_uid_gid(&uid, &gid);
2453 audit_log_format(ab, "auid=%u uid=%u gid=%u ses=%u", 2509 audit_log_format(ab, "auid=%u uid=%u gid=%u ses=%u",
2454 auid, current->uid, current->gid, sessionid); 2510 auid, uid, gid, sessionid);
2455 security_task_getsecid(current, &sid); 2511 security_task_getsecid(current, &sid);
2456 if (sid) { 2512 if (sid) {
2457 char *ctx = NULL; 2513 char *ctx = NULL;
generated by cgit v1.2.2 (git 2.25.0) at 2025-11-07 18:52:15 -0500