Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1/* audit.h -- Auditing support
2 *
3 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
4 * All Rights Reserved.
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19 *
20 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
21 *
22 */
23#ifndef _LINUX_AUDIT_H_
24#define _LINUX_AUDIT_H_
25
26#include <linux/sched.h>
27#include <uapi/linux/audit.h>
28
29struct audit_sig_info {
30 uid_t uid;
31 pid_t pid;
32 char ctx[0];
33};
34
35struct audit_buffer;
36struct audit_context;
37struct inode;
38struct netlink_skb_parms;
39struct path;
40struct linux_binprm;
41struct mq_attr;
42struct mqstat;
43struct audit_watch;
44struct audit_tree;
45
46struct audit_krule {
47 int vers_ops;
48 u32 flags;
49 u32 listnr;
50 u32 action;
51 u32 mask[AUDIT_BITMASK_SIZE];
52 u32 buflen; /* for data alloc on list rules */
53 u32 field_count;
54 char *filterkey; /* ties events to rules */
55 struct audit_field *fields;
56 struct audit_field *arch_f; /* quick access to arch field */
57 struct audit_field *inode_f; /* quick access to an inode field */
58 struct audit_watch *watch; /* associated watch */
59 struct audit_tree *tree; /* associated watched tree */
60 struct list_head rlist; /* entry in audit_{watch,tree}.rules list */
61 struct list_head list; /* for AUDIT_LIST* purposes only */
62 u64 prio;
63};
64
65struct audit_field {
66 u32 type;
67 u32 val;
68 kuid_t uid;
69 kgid_t gid;
70 u32 op;
71 char *lsm_str;
72 void *lsm_rule;
73};
74
75extern int __init audit_register_class(int class, unsigned *list);
76extern int audit_classify_syscall(int abi, unsigned syscall);
77extern int audit_classify_arch(int arch);
78
79/* audit_names->type values */
80#define AUDIT_TYPE_UNKNOWN 0 /* we don't know yet */
81#define AUDIT_TYPE_NORMAL 1 /* a "normal" audit record */
82#define AUDIT_TYPE_PARENT 2 /* a parent audit record */
83#define AUDIT_TYPE_CHILD_DELETE 3 /* a child being deleted */
84#define AUDIT_TYPE_CHILD_CREATE 4 /* a child being created */
85
86struct filename;
87
88#ifdef CONFIG_AUDITSYSCALL
89/* These are defined in auditsc.c */
90 /* Public API */
91extern int audit_alloc(struct task_struct *task);
92extern void __audit_free(struct task_struct *task);
93extern void __audit_syscall_entry(int arch,
94 int major, unsigned long a0, unsigned long a1,
95 unsigned long a2, unsigned long a3);
96extern void __audit_syscall_exit(int ret_success, long ret_value);
97extern struct filename *__audit_reusename(const __user char *uptr);
98extern void __audit_getname(struct filename *name);
99extern void audit_putname(struct filename *name);
100extern void __audit_inode(struct filename *name, const struct dentry *dentry,
101 unsigned int parent);
102extern void __audit_inode_child(const struct inode *parent,
103 const struct dentry *dentry,
104 const unsigned char type);
105extern void __audit_seccomp(unsigned long syscall, long signr, int code);
106extern void __audit_ptrace(struct task_struct *t);
107
108static inline int audit_dummy_context(void)
109{
110 void *p = current->audit_context;
111 return !p || *(int *)p;
112}
113static inline void audit_free(struct task_struct *task)
114{
115 if (unlikely(task->audit_context))
116 __audit_free(task);
117}
118static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
119 unsigned long a1, unsigned long a2,
120 unsigned long a3)
121{
122 if (unlikely(!audit_dummy_context()))
123 __audit_syscall_entry(arch, major, a0, a1, a2, a3);
124}
125static inline void audit_syscall_exit(void *pt_regs)
126{
127 if (unlikely(current->audit_context)) {
128 int success = is_syscall_success(pt_regs);
129 int return_code = regs_return_value(pt_regs);
130
131 __audit_syscall_exit(success, return_code);
132 }
133}
134static inline struct filename *audit_reusename(const __user char *name)
135{
136 if (unlikely(!audit_dummy_context()))
137 return __audit_reusename(name);
138 return NULL;
139}
140static inline void audit_getname(struct filename *name)
141{
142 if (unlikely(!audit_dummy_context()))
143 __audit_getname(name);
144}
145static inline void audit_inode(struct filename *name, const struct dentry *dentry,
146 unsigned int parent) {
147 if (unlikely(!audit_dummy_context()))
148 __audit_inode(name, dentry, parent);
149}
150static inline void audit_inode_child(const struct inode *parent,
151 const struct dentry *dentry,
152 const unsigned char type) {
153 if (unlikely(!audit_dummy_context()))
154 __audit_inode_child(parent, dentry, type);
155}
156void audit_core_dumps(long signr);
157
158static inline void audit_seccomp(unsigned long syscall, long signr, int code)
159{
160 if (unlikely(!audit_dummy_context()))
161 __audit_seccomp(syscall, signr, code);
162}
163
164static inline void audit_ptrace(struct task_struct *t)
165{
166 if (unlikely(!audit_dummy_context()))
167 __audit_ptrace(t);
168}
169
170 /* Private API (for audit.c only) */
171extern unsigned int audit_serial(void);
172extern int auditsc_get_stamp(struct audit_context *ctx,
173 struct timespec *t, unsigned int *serial);
174extern int audit_set_loginuid(kuid_t loginuid);
175
176static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
177{
178 return tsk->loginuid;
179}
180
181static inline int audit_get_sessionid(struct task_struct *tsk)
182{
183 return tsk->sessionid;
184}
185
186extern void audit_log_task_context(struct audit_buffer *ab);
187extern void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk);
188extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);
189extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode);
190extern int __audit_bprm(struct linux_binprm *bprm);
191extern void __audit_socketcall(int nargs, unsigned long *args);
192extern int __audit_sockaddr(int len, void *addr);
193extern void __audit_fd_pair(int fd1, int fd2);
194extern void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr);
195extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout);
196extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification);
197extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat);
198extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
199 const struct cred *new,
200 const struct cred *old);
201extern void __audit_log_capset(pid_t pid, const struct cred *new, const struct cred *old);
202extern void __audit_mmap_fd(int fd, int flags);
203
204static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
205{
206 if (unlikely(!audit_dummy_context()))
207 __audit_ipc_obj(ipcp);
208}
209static inline void audit_fd_pair(int fd1, int fd2)
210{
211 if (unlikely(!audit_dummy_context()))
212 __audit_fd_pair(fd1, fd2);
213}
214static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode)
215{
216 if (unlikely(!audit_dummy_context()))
217 __audit_ipc_set_perm(qbytes, uid, gid, mode);
218}
219static inline int audit_bprm(struct linux_binprm *bprm)
220{
221 if (unlikely(!audit_dummy_context()))
222 return __audit_bprm(bprm);
223 return 0;
224}
225static inline void audit_socketcall(int nargs, unsigned long *args)
226{
227 if (unlikely(!audit_dummy_context()))
228 __audit_socketcall(nargs, args);
229}
230static inline int audit_sockaddr(int len, void *addr)
231{
232 if (unlikely(!audit_dummy_context()))
233 return __audit_sockaddr(len, addr);
234 return 0;
235}
236static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
237{
238 if (unlikely(!audit_dummy_context()))
239 __audit_mq_open(oflag, mode, attr);
240}
241static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout)
242{
243 if (unlikely(!audit_dummy_context()))
244 __audit_mq_sendrecv(mqdes, msg_len, msg_prio, abs_timeout);
245}
246static inline void audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
247{
248 if (unlikely(!audit_dummy_context()))
249 __audit_mq_notify(mqdes, notification);
250}
251static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
252{
253 if (unlikely(!audit_dummy_context()))
254 __audit_mq_getsetattr(mqdes, mqstat);
255}
256
257static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
258 const struct cred *new,
259 const struct cred *old)
260{
261 if (unlikely(!audit_dummy_context()))
262 return __audit_log_bprm_fcaps(bprm, new, old);
263 return 0;
264}
265
266static inline void audit_log_capset(pid_t pid, const struct cred *new,
267 const struct cred *old)
268{
269 if (unlikely(!audit_dummy_context()))
270 __audit_log_capset(pid, new, old);
271}
272
273static inline void audit_mmap_fd(int fd, int flags)
274{
275 if (unlikely(!audit_dummy_context()))
276 __audit_mmap_fd(fd, flags);
277}
278
279extern int audit_n_rules;
280extern int audit_signals;
281#else /* CONFIG_AUDITSYSCALL */
282static inline int audit_alloc(struct task_struct *task)
283{
284 return 0;
285}
286static inline void audit_free(struct task_struct *task)
287{ }
288static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
289 unsigned long a1, unsigned long a2,
290 unsigned long a3)
291{ }
292static inline void audit_syscall_exit(void *pt_regs)
293{ }
294static inline int audit_dummy_context(void)
295{
296 return 1;
297}
298static inline struct filename *audit_reusename(const __user char *name)
299{
300 return NULL;
301}
302static inline void audit_getname(struct filename *name)
303{ }
304static inline void audit_putname(struct filename *name)
305{ }
306static inline void __audit_inode(struct filename *name,
307 const struct dentry *dentry,
308 unsigned int parent)
309{ }
310static inline void __audit_inode_child(const struct inode *parent,
311 const struct dentry *dentry,
312 const unsigned char type)
313{ }
314static inline void audit_inode(struct filename *name,
315 const struct dentry *dentry,
316 unsigned int parent)
317{ }
318static inline void audit_inode_child(const struct inode *parent,
319 const struct dentry *dentry,
320 const unsigned char type)
321{ }
322static inline void audit_core_dumps(long signr)
323{ }
324static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
325{ }
326static inline void audit_seccomp(unsigned long syscall, long signr, int code)
327{ }
328static inline int auditsc_get_stamp(struct audit_context *ctx,
329 struct timespec *t, unsigned int *serial)
330{
331 return 0;
332}
333static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
334{
335 return INVALID_UID;
336}
337static inline int audit_get_sessionid(struct task_struct *tsk)
338{
339 return -1;
340}
341static inline void audit_log_task_context(struct audit_buffer *ab)
342{ }
343static inline void audit_log_task_info(struct audit_buffer *ab,
344 struct task_struct *tsk)
345{ }
346static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
347{ }
348static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,
349 gid_t gid, umode_t mode)
350{ }
351static inline int audit_bprm(struct linux_binprm *bprm)
352{
353 return 0;
354}
355static inline void audit_socketcall(int nargs, unsigned long *args)
356{ }
357static inline void audit_fd_pair(int fd1, int fd2)
358{ }
359static inline int audit_sockaddr(int len, void *addr)
360{
361 return 0;
362}
363static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
364{ }
365static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len,
366 unsigned int msg_prio,
367 const struct timespec *abs_timeout)
368{ }
369static inline void audit_mq_notify(mqd_t mqdes,
370 const struct sigevent *notification)
371{ }
372static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
373{ }
374static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
375 const struct cred *new,
376 const struct cred *old)
377{
378 return 0;
379}
380static inline void audit_log_capset(pid_t pid, const struct cred *new,
381 const struct cred *old)
382{ }
383static inline void audit_mmap_fd(int fd, int flags)
384{ }
385static inline void audit_ptrace(struct task_struct *t)
386{ }
387#define audit_n_rules 0
388#define audit_signals 0
389#endif /* CONFIG_AUDITSYSCALL */
390
391#ifdef CONFIG_AUDIT
392/* These are defined in audit.c */
393 /* Public API */
394extern __printf(4, 5)
395void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
396 const char *fmt, ...);
397
398extern struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type);
399extern __printf(2, 3)
400void audit_log_format(struct audit_buffer *ab, const char *fmt, ...);
401extern void audit_log_end(struct audit_buffer *ab);
402extern int audit_string_contains_control(const char *string,
403 size_t len);
404extern void audit_log_n_hex(struct audit_buffer *ab,
405 const unsigned char *buf,
406 size_t len);
407extern void audit_log_n_string(struct audit_buffer *ab,
408 const char *buf,
409 size_t n);
410extern void audit_log_n_untrustedstring(struct audit_buffer *ab,
411 const char *string,
412 size_t n);
413extern void audit_log_untrustedstring(struct audit_buffer *ab,
414 const char *string);
415extern void audit_log_d_path(struct audit_buffer *ab,
416 const char *prefix,
417 const struct path *path);
418extern void audit_log_key(struct audit_buffer *ab,
419 char *key);
420extern void audit_log_link_denied(const char *operation,
421 struct path *link);
422extern void audit_log_lost(const char *message);
423#ifdef CONFIG_SECURITY
424extern void audit_log_secctx(struct audit_buffer *ab, u32 secid);
425#else
426static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid)
427{ }
428#endif
429
430extern int audit_update_lsm_rules(void);
431
432 /* Private API (for audit.c only) */
433extern int audit_filter_user(void);
434extern int audit_filter_type(int type);
435extern int audit_receive_filter(int type, int pid, int seq,
436 void *data, size_t datasz, kuid_t loginuid,
437 u32 sessionid, u32 sid);
438extern int audit_enabled;
439#else /* CONFIG_AUDIT */
440static inline __printf(4, 5)
441void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
442 const char *fmt, ...)
443{ }
444static inline struct audit_buffer *audit_log_start(struct audit_context *ctx,
445 gfp_t gfp_mask, int type)
446{
447 return NULL;
448}
449static inline __printf(2, 3)
450void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
451{ }
452static inline void audit_log_end(struct audit_buffer *ab)
453{ }
454static inline void audit_log_n_hex(struct audit_buffer *ab,
455 const unsigned char *buf, size_t len)
456{ }
457static inline void audit_log_n_string(struct audit_buffer *ab,
458 const char *buf, size_t n)
459{ }
460static inline void audit_log_n_untrustedstring(struct audit_buffer *ab,
461 const char *string, size_t n)
462{ }
463static inline void audit_log_untrustedstring(struct audit_buffer *ab,
464 const char *string)
465{ }
466static inline void audit_log_d_path(struct audit_buffer *ab,
467 const char *prefix,
468 const struct path *path)
469{ }
470static inline void audit_log_key(struct audit_buffer *ab, char *key)
471{ }
472static inline void audit_log_link_denied(const char *string,
473 const struct path *link)
474{ }
475static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid)
476{ }
477#define audit_enabled 0
478#endif /* CONFIG_AUDIT */
479static inline void audit_log_string(struct audit_buffer *ab, const char *buf)
480{
481 audit_log_n_string(ab, buf, strlen(buf));
482}
483
484#endif