auditsc.c 63.6 KB
Newer Older
1
/* auditsc.c -- System-call auditing support
Linus Torvalds's avatar
Linus Torvalds committed
2 3 4
 * Handles all system-call specific auditing features.
 *
 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
5
 * Copyright 2005 Hewlett-Packard Development Company, L.P.
6
 * Copyright (C) 2005, 2006 IBM Corporation
Linus Torvalds's avatar
Linus Torvalds committed
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
 * All Rights Reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
 *
 * Many of the ideas implemented here are from Stephen C. Tweedie,
 * especially the idea of avoiding a copy by using getname.
 *
 * The method for actual interception of syscall entry and exit (not in
 * this file -- see entry.S) is based on a GPL'd patch written by
 * okir@suse.de and Copyright 2003 SuSE Linux AG.
 *
32 33 34
 * POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>,
 * 2006.
 *
35 36 37
 * The support of additional filter rules compares (>, <, >=, <=) was
 * added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005.
 *
38 39
 * Modified by Amy Griffis <amy.griffis@hp.com> to collect additional
 * filesystem information.
40 41 42
 *
 * Subject and object context labeling support added by <danjones@us.ibm.com>
 * and <dustin.kirkland@us.ibm.com> for LSPP certification compliance.
Linus Torvalds's avatar
Linus Torvalds committed
43 44 45 46
 */

#include <linux/init.h>
#include <asm/types.h>
47
#include <linux/atomic.h>
48 49
#include <linux/fs.h>
#include <linux/namei.h>
Linus Torvalds's avatar
Linus Torvalds committed
50
#include <linux/mm.h>
51
#include <linux/export.h>
52
#include <linux/slab.h>
53
#include <linux/mount.h>
54
#include <linux/socket.h>
55
#include <linux/mqueue.h>
Linus Torvalds's avatar
Linus Torvalds committed
56 57 58
#include <linux/audit.h>
#include <linux/personality.h>
#include <linux/time.h>
59
#include <linux/netlink.h>
60
#include <linux/compiler.h>
Linus Torvalds's avatar
Linus Torvalds committed
61
#include <asm/unistd.h>
62
#include <linux/security.h>
63
#include <linux/list.h>
64
#include <linux/tty.h>
65
#include <linux/binfmts.h>
66
#include <linux/highmem.h>
Al Viro's avatar
Al Viro committed
67
#include <linux/syscalls.h>
68
#include <linux/capability.h>
69
#include <linux/fs_struct.h>
70
#include <linux/compat.h>
Linus Torvalds's avatar
Linus Torvalds committed
71

72
#include "audit.h"
Linus Torvalds's avatar
Linus Torvalds committed
73

74 75 76 77 78
/* flags stating the success for a syscall */
#define AUDITSC_INVALID 0
#define AUDITSC_SUCCESS 1
#define AUDITSC_FAILURE 2

79 80 81
/* no execve audit message should be longer than this (userspace limits) */
#define MAX_EXECVE_AUDIT_LEN 7500

82 83 84
/* number of audit rules */
int audit_n_rules;

85 86 87
/* determines whether we collect data for signals sent */
int audit_signals;

Linus Torvalds's avatar
Linus Torvalds committed
88 89 90 91 92 93 94
struct audit_aux_data {
	struct audit_aux_data	*next;
	int			type;
};

#define AUDIT_AUX_IPCPERM	0

95 96 97
/* Number of target pids per aux struct. */
#define AUDIT_AUX_PIDS	16

98 99 100 101
struct audit_aux_data_execve {
	struct audit_aux_data	d;
	int argc;
	int envc;
102
	struct mm_struct *mm;
103 104
};

105 106 107
struct audit_aux_data_pids {
	struct audit_aux_data	d;
	pid_t			target_pid[AUDIT_AUX_PIDS];
108
	kuid_t			target_auid[AUDIT_AUX_PIDS];
109
	kuid_t			target_uid[AUDIT_AUX_PIDS];
110
	unsigned int		target_sessionid[AUDIT_AUX_PIDS];
111
	u32			target_sid[AUDIT_AUX_PIDS];
112
	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
113 114 115
	int			pid_count;
};

116 117 118 119 120 121 122 123
struct audit_aux_data_bprm_fcaps {
	struct audit_aux_data	d;
	struct audit_cap_data	fcap;
	unsigned int		fcap_ver;
	struct audit_cap_data	old_pcap;
	struct audit_cap_data	new_pcap;
};

124 125 126 127 128 129
struct audit_aux_data_capset {
	struct audit_aux_data	d;
	pid_t			pid;
	struct audit_cap_data	cap;
};

130 131 132 133 134
struct audit_tree_refs {
	struct audit_tree_refs *next;
	struct audit_chunk *c[31];
};

135 136 137 138 139 140 141 142 143 144
static inline int open_arg(int flags, int mask)
{
	int n = ACC_MODE(flags);
	if (flags & (O_TRUNC | O_CREAT))
		n |= AUDIT_PERM_WRITE;
	return n & mask;
}

static int audit_match_perm(struct audit_context *ctx, int mask)
{
145
	unsigned n;
146 147
	if (unlikely(!ctx))
		return 0;
148
	n = ctx->major;
149

150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185
	switch (audit_classify_syscall(ctx->arch, n)) {
	case 0:	/* native */
		if ((mask & AUDIT_PERM_WRITE) &&
		     audit_match_class(AUDIT_CLASS_WRITE, n))
			return 1;
		if ((mask & AUDIT_PERM_READ) &&
		     audit_match_class(AUDIT_CLASS_READ, n))
			return 1;
		if ((mask & AUDIT_PERM_ATTR) &&
		     audit_match_class(AUDIT_CLASS_CHATTR, n))
			return 1;
		return 0;
	case 1: /* 32bit on biarch */
		if ((mask & AUDIT_PERM_WRITE) &&
		     audit_match_class(AUDIT_CLASS_WRITE_32, n))
			return 1;
		if ((mask & AUDIT_PERM_READ) &&
		     audit_match_class(AUDIT_CLASS_READ_32, n))
			return 1;
		if ((mask & AUDIT_PERM_ATTR) &&
		     audit_match_class(AUDIT_CLASS_CHATTR_32, n))
			return 1;
		return 0;
	case 2: /* open */
		return mask & ACC_MODE(ctx->argv[1]);
	case 3: /* openat */
		return mask & ACC_MODE(ctx->argv[2]);
	case 4: /* socketcall */
		return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);
	case 5: /* execve */
		return mask & AUDIT_PERM_EXEC;
	default:
		return 0;
	}
}

186
static int audit_match_filetype(struct audit_context *ctx, int val)
187
{
188
	struct audit_names *n;
189
	umode_t mode = (umode_t)val;
190 191 192 193

	if (unlikely(!ctx))
		return 0;

194 195 196
	list_for_each_entry(n, &ctx->names_list, list) {
		if ((n->ino != -1) &&
		    ((n->mode & S_IFMT) == mode))
197 198
			return 1;
	}
199

200
	return 0;
201 202
}

203 204 205 206 207 208 209 210 211 212 213
/*
 * We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *;
 * ->first_trees points to its beginning, ->trees - to the current end of data.
 * ->tree_count is the number of free entries in array pointed to by ->trees.
 * Original condition is (NULL, NULL, 0); as soon as it grows we never revert to NULL,
 * "empty" becomes (p, p, 31) afterwards.  We don't shrink the list (and seriously,
 * it's going to remain 1-element for almost any setup) until we free context itself.
 * References in it _are_ dropped - at the same time we free/drop aux stuff.
 */

#ifdef CONFIG_AUDIT_TREE
214 215 216 217 218 219 220 221
static void audit_set_auditable(struct audit_context *ctx)
{
	if (!ctx->prio) {
		ctx->prio = 1;
		ctx->current_state = AUDIT_RECORD_CONTEXT;
	}
}

222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321
static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk)
{
	struct audit_tree_refs *p = ctx->trees;
	int left = ctx->tree_count;
	if (likely(left)) {
		p->c[--left] = chunk;
		ctx->tree_count = left;
		return 1;
	}
	if (!p)
		return 0;
	p = p->next;
	if (p) {
		p->c[30] = chunk;
		ctx->trees = p;
		ctx->tree_count = 30;
		return 1;
	}
	return 0;
}

static int grow_tree_refs(struct audit_context *ctx)
{
	struct audit_tree_refs *p = ctx->trees;
	ctx->trees = kzalloc(sizeof(struct audit_tree_refs), GFP_KERNEL);
	if (!ctx->trees) {
		ctx->trees = p;
		return 0;
	}
	if (p)
		p->next = ctx->trees;
	else
		ctx->first_trees = ctx->trees;
	ctx->tree_count = 31;
	return 1;
}
#endif

static void unroll_tree_refs(struct audit_context *ctx,
		      struct audit_tree_refs *p, int count)
{
#ifdef CONFIG_AUDIT_TREE
	struct audit_tree_refs *q;
	int n;
	if (!p) {
		/* we started with empty chain */
		p = ctx->first_trees;
		count = 31;
		/* if the very first allocation has failed, nothing to do */
		if (!p)
			return;
	}
	n = count;
	for (q = p; q != ctx->trees; q = q->next, n = 31) {
		while (n--) {
			audit_put_chunk(q->c[n]);
			q->c[n] = NULL;
		}
	}
	while (n-- > ctx->tree_count) {
		audit_put_chunk(q->c[n]);
		q->c[n] = NULL;
	}
	ctx->trees = p;
	ctx->tree_count = count;
#endif
}

static void free_tree_refs(struct audit_context *ctx)
{
	struct audit_tree_refs *p, *q;
	for (p = ctx->first_trees; p; p = q) {
		q = p->next;
		kfree(p);
	}
}

static int match_tree_refs(struct audit_context *ctx, struct audit_tree *tree)
{
#ifdef CONFIG_AUDIT_TREE
	struct audit_tree_refs *p;
	int n;
	if (!tree)
		return 0;
	/* full ones */
	for (p = ctx->first_trees; p != ctx->trees; p = p->next) {
		for (n = 0; n < 31; n++)
			if (audit_tree_match(p->c[n], tree))
				return 1;
	}
	/* partial */
	if (p) {
		for (n = ctx->tree_count; n < 31; n++)
			if (audit_tree_match(p->c[n], tree))
				return 1;
	}
#endif
	return 0;
}

322 323 324 325
static int audit_compare_uid(kuid_t uid,
			     struct audit_names *name,
			     struct audit_field *f,
			     struct audit_context *ctx)
326 327 328
{
	struct audit_names *n;
	int rc;
329
 
330
	if (name) {
331
		rc = audit_uid_comparator(uid, f->op, name->uid);
332 333 334
		if (rc)
			return rc;
	}
335
 
336 337
	if (ctx) {
		list_for_each_entry(n, &ctx->names_list, list) {
338 339 340 341 342 343 344
			rc = audit_uid_comparator(uid, f->op, n->uid);
			if (rc)
				return rc;
		}
	}
	return 0;
}
345

346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362
static int audit_compare_gid(kgid_t gid,
			     struct audit_names *name,
			     struct audit_field *f,
			     struct audit_context *ctx)
{
	struct audit_names *n;
	int rc;
 
	if (name) {
		rc = audit_gid_comparator(gid, f->op, name->gid);
		if (rc)
			return rc;
	}
 
	if (ctx) {
		list_for_each_entry(n, &ctx->names_list, list) {
			rc = audit_gid_comparator(gid, f->op, n->gid);
363 364 365 366 367 368 369
			if (rc)
				return rc;
		}
	}
	return 0;
}

370 371 372 373 374 375 376
static int audit_field_compare(struct task_struct *tsk,
			       const struct cred *cred,
			       struct audit_field *f,
			       struct audit_context *ctx,
			       struct audit_names *name)
{
	switch (f->val) {
377
	/* process to file object comparisons */
378
	case AUDIT_COMPARE_UID_TO_OBJ_UID:
379
		return audit_compare_uid(cred->uid, name, f, ctx);
380
	case AUDIT_COMPARE_GID_TO_OBJ_GID:
381
		return audit_compare_gid(cred->gid, name, f, ctx);
382
	case AUDIT_COMPARE_EUID_TO_OBJ_UID:
383
		return audit_compare_uid(cred->euid, name, f, ctx);
384
	case AUDIT_COMPARE_EGID_TO_OBJ_GID:
385
		return audit_compare_gid(cred->egid, name, f, ctx);
386
	case AUDIT_COMPARE_AUID_TO_OBJ_UID:
387
		return audit_compare_uid(tsk->loginuid, name, f, ctx);
388
	case AUDIT_COMPARE_SUID_TO_OBJ_UID:
389
		return audit_compare_uid(cred->suid, name, f, ctx);
390
	case AUDIT_COMPARE_SGID_TO_OBJ_GID:
391
		return audit_compare_gid(cred->sgid, name, f, ctx);
392
	case AUDIT_COMPARE_FSUID_TO_OBJ_UID:
393
		return audit_compare_uid(cred->fsuid, name, f, ctx);
394
	case AUDIT_COMPARE_FSGID_TO_OBJ_GID:
395
		return audit_compare_gid(cred->fsgid, name, f, ctx);
396 397
	/* uid comparisons */
	case AUDIT_COMPARE_UID_TO_AUID:
398
		return audit_uid_comparator(cred->uid, f->op, tsk->loginuid);
399
	case AUDIT_COMPARE_UID_TO_EUID:
400
		return audit_uid_comparator(cred->uid, f->op, cred->euid);
401
	case AUDIT_COMPARE_UID_TO_SUID:
402
		return audit_uid_comparator(cred->uid, f->op, cred->suid);
403
	case AUDIT_COMPARE_UID_TO_FSUID:
404
		return audit_uid_comparator(cred->uid, f->op, cred->fsuid);
405 406
	/* auid comparisons */
	case AUDIT_COMPARE_AUID_TO_EUID:
407
		return audit_uid_comparator(tsk->loginuid, f->op, cred->euid);
408
	case AUDIT_COMPARE_AUID_TO_SUID:
409
		return audit_uid_comparator(tsk->loginuid, f->op, cred->suid);
410
	case AUDIT_COMPARE_AUID_TO_FSUID:
411
		return audit_uid_comparator(tsk->loginuid, f->op, cred->fsuid);
412 413
	/* euid comparisons */
	case AUDIT_COMPARE_EUID_TO_SUID:
414
		return audit_uid_comparator(cred->euid, f->op, cred->suid);
415
	case AUDIT_COMPARE_EUID_TO_FSUID:
416
		return audit_uid_comparator(cred->euid, f->op, cred->fsuid);
417 418
	/* suid comparisons */
	case AUDIT_COMPARE_SUID_TO_FSUID:
419
		return audit_uid_comparator(cred->suid, f->op, cred->fsuid);
420 421
	/* gid comparisons */
	case AUDIT_COMPARE_GID_TO_EGID:
422
		return audit_gid_comparator(cred->gid, f->op, cred->egid);
423
	case AUDIT_COMPARE_GID_TO_SGID:
424
		return audit_gid_comparator(cred->gid, f->op, cred->sgid);
425
	case AUDIT_COMPARE_GID_TO_FSGID:
426
		return audit_gid_comparator(cred->gid, f->op, cred->fsgid);
427 428
	/* egid comparisons */
	case AUDIT_COMPARE_EGID_TO_SGID:
429
		return audit_gid_comparator(cred->egid, f->op, cred->sgid);
430
	case AUDIT_COMPARE_EGID_TO_FSGID:
431
		return audit_gid_comparator(cred->egid, f->op, cred->fsgid);
432 433
	/* sgid comparison */
	case AUDIT_COMPARE_SGID_TO_FSGID:
434
		return audit_gid_comparator(cred->sgid, f->op, cred->fsgid);
435 436 437 438 439 440 441
	default:
		WARN(1, "Missing AUDIT_COMPARE define.  Report as a bug\n");
		return 0;
	}
	return 0;
}

442
/* Determine if any context name data matches a rule's watch data */
Linus Torvalds's avatar
Linus Torvalds committed
443
/* Compare a task_struct with an audit_rule.  Return 1 on match, 0
444 445 446 447 448 449
 * otherwise.
 *
 * If task_creation is true, this is an explicit indication that we are
 * filtering a task rule at task creation time.  This and tsk == current are
 * the only situations where tsk->cred may be accessed without an rcu read lock.
 */
Linus Torvalds's avatar
Linus Torvalds committed
450
static int audit_filter_rules(struct task_struct *tsk,
451
			      struct audit_krule *rule,
Linus Torvalds's avatar
Linus Torvalds committed
452
			      struct audit_context *ctx,
453
			      struct audit_names *name,
454 455
			      enum audit_state *state,
			      bool task_creation)
Linus Torvalds's avatar
Linus Torvalds committed
456
{
457
	const struct cred *cred;
458
	int i, need_sid = 1;
459 460
	u32 sid;

461 462
	cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation);

Linus Torvalds's avatar
Linus Torvalds committed
463
	for (i = 0; i < rule->field_count; i++) {
464
		struct audit_field *f = &rule->fields[i];
465
		struct audit_names *n;
Linus Torvalds's avatar
Linus Torvalds committed
466 467
		int result = 0;

468
		switch (f->type) {
Linus Torvalds's avatar
Linus Torvalds committed
469
		case AUDIT_PID:
470
			result = audit_comparator(tsk->pid, f->op, f->val);
Linus Torvalds's avatar
Linus Torvalds committed
471
			break;
Al Viro's avatar
Al Viro committed
472
		case AUDIT_PPID:
473 474 475
			if (ctx) {
				if (!ctx->ppid)
					ctx->ppid = sys_getppid();
Al Viro's avatar
Al Viro committed
476
				result = audit_comparator(ctx->ppid, f->op, f->val);
477
			}
Al Viro's avatar
Al Viro committed
478
			break;
Linus Torvalds's avatar
Linus Torvalds committed
479
		case AUDIT_UID:
480
			result = audit_uid_comparator(cred->uid, f->op, f->uid);
Linus Torvalds's avatar
Linus Torvalds committed
481 482
			break;
		case AUDIT_EUID:
483
			result = audit_uid_comparator(cred->euid, f->op, f->uid);
Linus Torvalds's avatar
Linus Torvalds committed
484 485
			break;
		case AUDIT_SUID:
486
			result = audit_uid_comparator(cred->suid, f->op, f->uid);
Linus Torvalds's avatar
Linus Torvalds committed
487 488
			break;
		case AUDIT_FSUID:
489
			result = audit_uid_comparator(cred->fsuid, f->op, f->uid);
Linus Torvalds's avatar
Linus Torvalds committed
490 491
			break;
		case AUDIT_GID:
492
			result = audit_gid_comparator(cred->gid, f->op, f->gid);
493 494 495 496 497 498 499
			if (f->op == Audit_equal) {
				if (!result)
					result = in_group_p(f->gid);
			} else if (f->op == Audit_not_equal) {
				if (result)
					result = !in_group_p(f->gid);
			}
Linus Torvalds's avatar
Linus Torvalds committed
500 501
			break;
		case AUDIT_EGID:
502
			result = audit_gid_comparator(cred->egid, f->op, f->gid);
503 504 505 506 507 508 509
			if (f->op == Audit_equal) {
				if (!result)
					result = in_egroup_p(f->gid);
			} else if (f->op == Audit_not_equal) {
				if (result)
					result = !in_egroup_p(f->gid);
			}
Linus Torvalds's avatar
Linus Torvalds committed
510 511
			break;
		case AUDIT_SGID:
512
			result = audit_gid_comparator(cred->sgid, f->op, f->gid);
Linus Torvalds's avatar
Linus Torvalds committed
513 514
			break;
		case AUDIT_FSGID:
515
			result = audit_gid_comparator(cred->fsgid, f->op, f->gid);
Linus Torvalds's avatar
Linus Torvalds committed
516 517
			break;
		case AUDIT_PERS:
518
			result = audit_comparator(tsk->personality, f->op, f->val);
Linus Torvalds's avatar
Linus Torvalds committed
519
			break;
520
		case AUDIT_ARCH:
521
			if (ctx)
522
				result = audit_comparator(ctx->arch, f->op, f->val);
523
			break;
Linus Torvalds's avatar
Linus Torvalds committed
524 525 526

		case AUDIT_EXIT:
			if (ctx && ctx->return_valid)
527
				result = audit_comparator(ctx->return_code, f->op, f->val);
Linus Torvalds's avatar
Linus Torvalds committed
528 529
			break;
		case AUDIT_SUCCESS:
530
			if (ctx && ctx->return_valid) {
531 532
				if (f->val)
					result = audit_comparator(ctx->return_valid, f->op, AUDITSC_SUCCESS);
533
				else
534
					result = audit_comparator(ctx->return_valid, f->op, AUDITSC_FAILURE);
535
			}
Linus Torvalds's avatar
Linus Torvalds committed
536 537
			break;
		case AUDIT_DEVMAJOR:
538 539 540 541 542
			if (name) {
				if (audit_comparator(MAJOR(name->dev), f->op, f->val) ||
				    audit_comparator(MAJOR(name->rdev), f->op, f->val))
					++result;
			} else if (ctx) {
543
				list_for_each_entry(n, &ctx->names_list, list) {
544 545
					if (audit_comparator(MAJOR(n->dev), f->op, f->val) ||
					    audit_comparator(MAJOR(n->rdev), f->op, f->val)) {
Linus Torvalds's avatar
Linus Torvalds committed
546 547 548 549 550 551 552
						++result;
						break;
					}
				}
			}
			break;
		case AUDIT_DEVMINOR:
553 554 555 556 557
			if (name) {
				if (audit_comparator(MINOR(name->dev), f->op, f->val) ||
				    audit_comparator(MINOR(name->rdev), f->op, f->val))
					++result;
			} else if (ctx) {
558
				list_for_each_entry(n, &ctx->names_list, list) {
559 560
					if (audit_comparator(MINOR(n->dev), f->op, f->val) ||
					    audit_comparator(MINOR(n->rdev), f->op, f->val)) {
Linus Torvalds's avatar
Linus Torvalds committed
561 562 563 564 565 566 567
						++result;
						break;
					}
				}
			}
			break;
		case AUDIT_INODE:
568
			if (name)
569
				result = (name->ino == f->val);
570
			else if (ctx) {
571 572
				list_for_each_entry(n, &ctx->names_list, list) {
					if (audit_comparator(n->ino, f->op, f->val)) {
Linus Torvalds's avatar
Linus Torvalds committed
573 574 575 576 577 578
						++result;
						break;
					}
				}
			}
			break;
579 580
		case AUDIT_OBJ_UID:
			if (name) {
581
				result = audit_uid_comparator(name->uid, f->op, f->uid);
582 583
			} else if (ctx) {
				list_for_each_entry(n, &ctx->names_list, list) {
584
					if (audit_uid_comparator(n->uid, f->op, f->uid)) {
585 586 587 588 589 590
						++result;
						break;
					}
				}
			}
			break;
591 592
		case AUDIT_OBJ_GID:
			if (name) {
593
				result = audit_gid_comparator(name->gid, f->op, f->gid);
594 595
			} else if (ctx) {
				list_for_each_entry(n, &ctx->names_list, list) {
596
					if (audit_gid_comparator(n->gid, f->op, f->gid)) {
597 598 599 600 601 602
						++result;
						break;
					}
				}
			}
			break;
603
		case AUDIT_WATCH:
604 605
			if (name)
				result = audit_watch_compare(rule->watch, name->ino, name->dev);
606
			break;
607 608 609 610
		case AUDIT_DIR:
			if (ctx)
				result = match_tree_refs(ctx, rule->tree);
			break;
Linus Torvalds's avatar
Linus Torvalds committed
611 612 613
		case AUDIT_LOGINUID:
			result = 0;
			if (ctx)
614
				result = audit_uid_comparator(tsk->loginuid, f->op, f->uid);
Linus Torvalds's avatar
Linus Torvalds committed
615
			break;
616 617 618 619 620
		case AUDIT_SUBJ_USER:
		case AUDIT_SUBJ_ROLE:
		case AUDIT_SUBJ_TYPE:
		case AUDIT_SUBJ_SEN:
		case AUDIT_SUBJ_CLR:
621 622 623 624 625
			/* NOTE: this may return negative values indicating
			   a temporary error.  We simply treat this as a
			   match for now to avoid losing information that
			   may be wanted.   An error message will also be
			   logged upon error */
626
			if (f->lsm_rule) {
627
				if (need_sid) {
628
					security_task_getsecid(tsk, &sid);
629 630
					need_sid = 0;
				}
631
				result = security_audit_rule_match(sid, f->type,
632
				                                  f->op,
633
				                                  f->lsm_rule,
634
				                                  ctx);
635
			}
636
			break;
637 638 639 640 641 642 643
		case AUDIT_OBJ_USER:
		case AUDIT_OBJ_ROLE:
		case AUDIT_OBJ_TYPE:
		case AUDIT_OBJ_LEV_LOW:
		case AUDIT_OBJ_LEV_HIGH:
			/* The above note for AUDIT_SUBJ_USER...AUDIT_SUBJ_CLR
			   also applies here */
644
			if (f->lsm_rule) {
645 646
				/* Find files that match */
				if (name) {
647
					result = security_audit_rule_match(
648
					           name->osid, f->type, f->op,
649
					           f->lsm_rule, ctx);
650
				} else if (ctx) {
651 652 653 654
					list_for_each_entry(n, &ctx->names_list, list) {
						if (security_audit_rule_match(n->osid, f->type,
									      f->op, f->lsm_rule,
									      ctx)) {
655 656 657 658 659 660
							++result;
							break;
						}
					}
				}
				/* Find ipc objects that match */
Al Viro's avatar
Al Viro committed
661 662 663 664 665 666
				if (!ctx || ctx->type != AUDIT_IPC)
					break;
				if (security_audit_rule_match(ctx->ipc.osid,
							      f->type, f->op,
							      f->lsm_rule, ctx))
					++result;
667 668
			}
			break;
Linus Torvalds's avatar
Linus Torvalds committed
669 670 671 672 673
		case AUDIT_ARG0:
		case AUDIT_ARG1:
		case AUDIT_ARG2:
		case AUDIT_ARG3:
			if (ctx)
674
				result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
Linus Torvalds's avatar
Linus Torvalds committed
675
			break;
Amy Griffis's avatar
Amy Griffis committed
676 677 678 679
		case AUDIT_FILTERKEY:
			/* ignore this field for filtering */
			result = 1;
			break;
680 681 682
		case AUDIT_PERM:
			result = audit_match_perm(ctx, f->val);
			break;
683 684 685
		case AUDIT_FILETYPE:
			result = audit_match_filetype(ctx, f->val);
			break;
686 687 688
		case AUDIT_FIELD_COMPARE:
			result = audit_field_compare(tsk, cred, f, ctx, name);
			break;
Linus Torvalds's avatar
Linus Torvalds committed
689
		}
690
		if (!result)
Linus Torvalds's avatar
Linus Torvalds committed
691 692
			return 0;
	}
693 694 695 696 697 698 699 700 701 702

	if (ctx) {
		if (rule->prio <= ctx->prio)
			return 0;
		if (rule->filterkey) {
			kfree(ctx->filterkey);
			ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
		}
		ctx->prio = rule->prio;
	}
Linus Torvalds's avatar
Linus Torvalds committed
703 704 705 706 707 708 709 710 711 712 713
	switch (rule->action) {
	case AUDIT_NEVER:    *state = AUDIT_DISABLED;	    break;
	case AUDIT_ALWAYS:   *state = AUDIT_RECORD_CONTEXT; break;
	}
	return 1;
}

/* At process creation time, we can determine if system-call auditing is
 * completely disabled for this task.  Since we only have the task
 * structure at this point, we can only check uid and gid.
 */
714
static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
Linus Torvalds's avatar
Linus Torvalds committed
715 716 717 718 719
{
	struct audit_entry *e;
	enum audit_state   state;

	rcu_read_lock();
720
	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
721 722
		if (audit_filter_rules(tsk, &e->rule, NULL, NULL,
				       &state, true)) {
723 724
			if (state == AUDIT_RECORD_CONTEXT)
				*key = kstrdup(e->rule.filterkey, GFP_ATOMIC);
Linus Torvalds's avatar
Linus Torvalds committed
725 726 727 728 729 730 731 732 733 734
			rcu_read_unlock();
			return state;
		}
	}
	rcu_read_unlock();
	return AUDIT_BUILD_CONTEXT;
}

/* At syscall entry and exit time, this filter is called if the
 * audit_state is not low enough that auditing cannot take place, but is
735
 * also not high enough that we already know we have to write an audit
736
 * record (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT).
Linus Torvalds's avatar
Linus Torvalds committed
737 738 739 740 741 742
 */
static enum audit_state audit_filter_syscall(struct task_struct *tsk,
					     struct audit_context *ctx,
					     struct list_head *list)
{
	struct audit_entry *e;
743
	enum audit_state state;
Linus Torvalds's avatar
Linus Torvalds committed
744

745
	if (audit_pid && tsk->tgid == audit_pid)
746 747
		return AUDIT_DISABLED;

Linus Torvalds's avatar
Linus Torvalds committed
748
	rcu_read_lock();
749
	if (!list_empty(list)) {
750 751 752 753
		int word = AUDIT_WORD(ctx->major);
		int bit  = AUDIT_BIT(ctx->major);

		list_for_each_entry_rcu(e, list, list) {
754 755
			if ((e->rule.mask[word] & bit) == bit &&
			    audit_filter_rules(tsk, &e->rule, ctx, NULL,
756
					       &state, false)) {
757
				rcu_read_unlock();
758
				ctx->current_state = state;
759 760 761 762 763 764 765 766
				return state;
			}
		}
	}
	rcu_read_unlock();
	return AUDIT_BUILD_CONTEXT;
}

767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797
/*
 * Given an audit_name check the inode hash table to see if they match.
 * Called holding the rcu read lock to protect the use of audit_inode_hash
 */
static int audit_filter_inode_name(struct task_struct *tsk,
				   struct audit_names *n,
				   struct audit_context *ctx) {
	int word, bit;
	int h = audit_hash_ino((u32)n->ino);
	struct list_head *list = &audit_inode_hash[h];
	struct audit_entry *e;
	enum audit_state state;

	word = AUDIT_WORD(ctx->major);
	bit  = AUDIT_BIT(ctx->major);

	if (list_empty(list))
		return 0;

	list_for_each_entry_rcu(e, list, list) {
		if ((e->rule.mask[word] & bit) == bit &&
		    audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
			ctx->current_state = state;
			return 1;
		}
	}

	return 0;
}

/* At syscall exit time, this filter is called if any audit_names have been
798
 * collected during syscall processing.  We only check rules in sublists at hash
799
 * buckets applicable to the inode numbers in audit_names.
800 801
 * Regarding audit_state, same rules apply as for audit_filter_syscall().
 */
802
void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx)
803
{
804
	struct audit_names *n;
805 806

	if (audit_pid && tsk->tgid == audit_pid)
807
		return;
808 809 810

	rcu_read_lock();

811 812 813
	list_for_each_entry(n, &ctx->names_list, list) {
		if (audit_filter_inode_name(tsk, n, ctx))
			break;
814 815 816 817
	}
	rcu_read_unlock();
}

Linus Torvalds's avatar
Linus Torvalds committed
818 819
static inline struct audit_context *audit_get_context(struct task_struct *tsk,
						      int return_valid,
820
						      long return_code)
Linus Torvalds's avatar
Linus Torvalds committed
821 822 823
{
	struct audit_context *context = tsk->audit_context;

824
	if (!context)
Linus Torvalds's avatar
Linus Torvalds committed
825 826
		return NULL;
	context->return_valid = return_valid;
827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844

	/*
	 * we need to fix up the return code in the audit logs if the actual
	 * return codes are later going to be fixed up by the arch specific
	 * signal handlers
	 *
	 * This is actually a test for:
	 * (rc == ERESTARTSYS ) || (rc == ERESTARTNOINTR) ||
	 * (rc == ERESTARTNOHAND) || (rc == ERESTART_RESTARTBLOCK)
	 *
	 * but is faster than a bunch of ||
	 */
	if (unlikely(return_code <= -ERESTARTSYS) &&
	    (return_code >= -ERESTART_RESTARTBLOCK) &&
	    (return_code != -ENOIOCTLCMD))
		context->return_code = -EINTR;
	else
		context->return_code  = return_code;
Linus Torvalds's avatar
Linus Torvalds committed
845

846 847 848
	if (context->in_syscall && !context->dummy) {
		audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
		audit_filter_inodes(tsk, context);
Linus Torvalds's avatar
Linus Torvalds committed
849 850 851 852 853 854 855 856
	}

	tsk->audit_context = NULL;
	return context;
}

static inline void audit_free_names(struct audit_context *context)
{
857
	struct audit_names *n, *next;
Linus Torvalds's avatar
Linus Torvalds committed
858 859

#if AUDIT_DEBUG == 2
860
	if (context->put_count + context->ino_count != context->name_count) {
861 862
		int i = 0;

863
		printk(KERN_ERR "%s:%d(:%d): major=%d in_syscall=%d"
Linus Torvalds's avatar
Linus Torvalds committed
864 865
		       " name_count=%d put_count=%d"
		       " ino_count=%d [NOT freeing]\n",
866
		       __FILE__, __LINE__,
Linus Torvalds's avatar
Linus Torvalds committed
867 868 869
		       context->serial, context->major, context->in_syscall,
		       context->name_count, context->put_count,
		       context->ino_count);
870
		list_for_each_entry(n, &context->names_list, list) {
871
			printk(KERN_ERR "names[%d] = %p = %s\n", i++,
872
			       n->name, n->name->name ?: "(null)");
873
		}
Linus Torvalds's avatar
Linus Torvalds committed
874 875 876 877 878 879 880 881 882
		dump_stack();
		return;
	}
#endif
#if AUDIT_DEBUG
	context->put_count  = 0;
	context->ino_count  = 0;
#endif

883 884 885
	list_for_each_entry_safe(n, next, &context->names_list, list) {
		list_del(&n->list);
		if (n->name && n->name_put)
886
			final_putname(n->name);
887 888
		if (n->should_free)
			kfree(n);
889
	}
Linus Torvalds's avatar
Linus Torvalds committed
890
	context->name_count = 0;
891 892 893
	path_put(&context->pwd);
	context->pwd.dentry = NULL;
	context->pwd.mnt = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
894 895 896 897 898 899 900 901 902 903
}

static inline void audit_free_aux(struct audit_context *context)
{
	struct audit_aux_data *aux;

	while ((aux = context->aux)) {
		context->aux = aux->next;
		kfree(aux);
	}
904 905 906 907
	while ((aux = context->aux_pids)) {
		context->aux_pids = aux->next;
		kfree(aux);
	}
Linus Torvalds's avatar
Linus Torvalds committed
908 909 910 911 912 913
}

static inline struct audit_context *audit_alloc_context(enum audit_state state)
{
	struct audit_context *context;

914 915
	context = kzalloc(sizeof(*context), GFP_KERNEL);
	if (!context)
Linus Torvalds's avatar
Linus Torvalds committed
916
		return NULL;
917 918
	context->state = state;
	context->prio = state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;
919
	INIT_LIST_HEAD(&context->killed_trees);
920
	INIT_LIST_HEAD(&context->names_list);
Linus Torvalds's avatar
Linus Torvalds committed
921 922 923
	return context;
}

924 925 926 927 928
/**
 * audit_alloc - allocate an audit context block for a task
 * @tsk: task
 *
 * Filter on the task information and allocate a per-task audit context
Linus Torvalds's avatar
Linus Torvalds committed
929 930
 * if necessary.  Doing so turns on system call auditing for the
 * specified task.  This is called from copy_process, so no lock is
931 932
 * needed.
 */
Linus Torvalds's avatar
Linus Torvalds committed
933 934 935 936
int audit_alloc(struct task_struct *tsk)
{
	struct audit_context *context;
	enum audit_state     state;
937
	char *key = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
938

939
	if (likely(!audit_ever_enabled))
Linus Torvalds's avatar
Linus Torvalds committed
940 941
		return 0; /* Return if not auditing. */

942
	state = audit_filter_task(tsk, &key);
943
	if (state == AUDIT_DISABLED)
Linus Torvalds's avatar
Linus Torvalds committed
944 945 946
		return 0;

	if (!(context = audit_alloc_context(state))) {
947
		kfree(key);
Linus Torvalds's avatar
Linus Torvalds committed
948 949 950
		audit_log_lost("out of memory in audit_alloc");
		return -ENOMEM;
	}
951
	context->filterkey = key;
Linus Torvalds's avatar
Linus Torvalds committed
952 953 954 955 956 957 958 959

	tsk->audit_context  = context;
	set_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
	return 0;
}

static inline void audit_free_context(struct audit_context *context)
{
960 961 962 963 964 965 966
	audit_free_names(context);
	unroll_tree_refs(context, NULL, 0);
	free_tree_refs(context);
	audit_free_aux(context);
	kfree(context->filterkey);
	kfree(context->sockaddr);
	kfree(context);
Linus Torvalds's avatar
Linus Torvalds committed
967 968
}

969
static int audit_log_pid_context(struct audit_context *context, pid_t pid,
970
				 kuid_t auid, kuid_t uid, unsigned int sessionid,
971
				 u32 sid, char *comm)
972 973
{
	struct audit_buffer *ab;
974
	char *ctx = NULL;
975 976 977 978 979
	u32 len;
	int rc = 0;

	ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
	if (!ab)
980
		return rc;
981

982 983
	audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid,
			 from_kuid(&init_user_ns, auid),
984
			 from_kuid(&init_user_ns, uid), sessionid);
985 986 987 988 989 990 991 992
	if (sid) {
		if (security_secid_to_secctx(sid, &ctx, &len)) {
			audit_log_format(ab, " obj=(none)");
			rc = 1;
		} else {
			audit_log_format(ab, " obj=%s", ctx);
			security_release_secctx(ctx, len);
		}
993
	}
994 995
	audit_log_format(ab, " ocomm=");
	audit_log_untrustedstring(ab, comm);
996 997 998 999 1000
	audit_log_end(ab);

	return rc;
}

1001 1002 1003
/*
 * to_send and len_sent accounting are very loose estimates.  We aren't
 * really worried about a hard cap to MAX_EXECVE_AUDIT_LEN so much as being
1004
 * within about 500 bytes (next page boundary)
1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017
 *
 * why snprintf?  an int is up to 12 digits long.  if we just assumed when
 * logging that a[%d]= was going to be 16 characters long we would be wasting
 * space in every audit message.  In one 7500 byte message we can log up to
 * about 1000 min size arguments.  That comes down to about 50% waste of space
 * if we didn't do the snprintf to find out how long arg_num_len was.
 */
static int audit_log_single_execve_arg(struct audit_context *context,
					struct audit_buffer **ab,
					int arg_num,
					size_t *len_sent,
					const char __user *p,
					char *buf)
1018
{
1019 1020
	char arg_num_len_buf[12];
	const char __user *tmp_p = p;
1021 1022
	/* how many digits are in arg_num? 5 is the length of ' a=""' */
	size_t arg_num_len = snprintf(arg_num_len_buf, 12, "%d", arg_num) + 5;
1023 1024 1025 1026 1027 1028 1029
	size_t len, len_left, to_send;
	size_t max_execve_audit_len = MAX_EXECVE_AUDIT_LEN;
	unsigned int i, has_cntl = 0, too_long = 0;
	int ret;

	/* strnlen_user includes the null we don't want to send */
	len_left = len = strnlen_user(p, MAX_ARG_STRLEN) - 1;
1030

1031 1032 1033 1034 1035 1036
	/*
	 * We just created this mm, if we can't find the strings
	 * we just copied into it something is _very_ wrong. Similar
	 * for strings that are too long, we should not have created
	 * any.
	 */
1037
	if (unlikely((len == -1) || len > MAX_ARG_STRLEN - 1)) {
1038 1039
		WARN_ON(1);
		send_sig(SIGKILL, current, 0);
1040
		return -1;
1041
	}
1042

1043 1044 1045 1046 1047 1048 1049
	/* walk the whole argument looking for non-ascii chars */
	do {
		if (len_left > MAX_EXECVE_AUDIT_LEN)
			to_send = MAX_EXECVE_AUDIT_LEN;
		else
			to_send = len_left;
		ret = copy_from_user(buf, tmp_p, to_send);
1050
		/*
1051 1052 1053
		 * There is no reason for this copy to be short. We just
		 * copied them here, and the mm hasn't been exposed to user-
		 * space yet.
1054
		 */
1055
		if (ret) {
1056 1057
			WARN_ON(1);
			send_sig(SIGKILL, current, 0);
1058
			return -1;
1059
		}
1060 1061 1062 1063 1064 1065 1066 1067
		buf[to_send] = '\0';
		has_cntl = audit_string_contains_control(buf, to_send);
		if (has_cntl) {
			/*
			 * hex messages get logged as 2 bytes, so we can only
			 * send half as much in each message
			 */
			max_execve_audit_len = MAX_EXECVE_AUDIT_LEN / 2;
1068 1069
			break;
		}
1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100
		len_left -= to_send;
		tmp_p += to_send;
	} while (len_left > 0);

	len_left = len;

	if (len > max_execve_audit_len)
		too_long = 1;

	/* rewalk the argument actually logging the message */
	for (i = 0; len_left > 0; i++) {
		int room_left;

		if (len_left > max_execve_audit_len)
			to_send = max_execve_audit_len;
		else
			to_send = len_left;

		/* do we have space left to send this argument in this ab? */
		room_left = MAX_EXECVE_AUDIT_LEN - arg_num_len - *len_sent;
		if (has_cntl)
			room_left -= (to_send * 2);
		else
			room_left -= to_send;
		if (room_left < 0) {
			*len_sent = 0;
			audit_log_end(*ab);
			*ab = audit_log_start(context, GFP_KERNEL, AUDIT_EXECVE);
			if (!*ab)
				return 0;
		}
1101 1102

		/*
1103 1104 1105 1106
		 * first record needs to say how long the original string was
		 * so we can be sure nothing was lost.
		 */
		if ((i == 0) && (too_long))
1107
			audit_log_format(*ab, " a%d_len=%zu", arg_num,
1108 1109 1110 1111 1112 1113
					 has_cntl ? 2*len : len);

		/*
		 * normally arguments are small enough to fit and we already
		 * filled buf above when we checked for control characters
		 * so don't bother with another copy_from_user
1114
		 */
1115 1116 1117 1118
		if (len >= max_execve_audit_len)
			ret = copy_from_user(buf, p, to_send);
		else
			ret = 0;
1119
		if (ret) {
1120 1121
			WARN_ON(1);
			send_sig(SIGKILL, current, 0);
1122
			return -1;
1123
		}
1124 1125 1126
		buf[to_send] = '\0';

		/* actually log it */
1127
		audit_log_format(*ab, " a%d", arg_num);
1128 1129 1130 1131
		if (too_long)
			audit_log_format(*ab, "[%d]", i);
		audit_log_format(*ab, "=");
		if (has_cntl)
1132
			audit_log_n_hex(*ab, buf, to_send);
1133
		else
1134
			audit_log_string(*ab, buf);
1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151

		p += to_send;
		len_left -= to_send;
		*len_sent += arg_num_len;
		if (has_cntl)
			*len_sent += to_send * 2;
		else
			*len_sent += to_send;
	}
	/* include the null we didn't log */
	return len + 1;
}

static void audit_log_execve_info(struct audit_context *context,
				  struct audit_buffer **ab,
				  struct audit_aux_data_execve *axi)
{
1152 1153
	int i, len;
	size_t len_sent = 0;
1154 1155
	const char __user *p;
	char *buf;
1156

1157 1158 1159 1160
	if (axi->mm != current->mm)
		return; /* execve failed, no additional info */

	p = (const char __user *)axi->mm->arg_start;
1161

1162
	audit_log_format(*ab, "argc=%d", axi->argc);
1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173

	/*
	 * we need some kernel buffer to hold the userspace args.  Just
	 * allocate one big one rather than allocating one of the right size
	 * for every single argument inside audit_log_single_execve_arg()
	 * should be <8k allocation so should be pretty safe.
	 */
	buf = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
	if (!buf) {
		audit_panic("out of memory for argv string\n");
		return;
1174
	}
1175 1176 1177 1178 1179 1180 1181 1182 1183

	for (i = 0; i < axi->argc; i++) {
		len = audit_log_single_execve_arg(context, ab, i,
						  &len_sent, p, buf);
		if (len <= 0)
			break;
		p += len;
	}
	kfree(buf);
1184 1185
}

Al Viro's avatar
Al Viro committed
1186
static void show_special(struct audit_context *context, int *call_panic)
Al Viro's avatar
Al Viro committed
1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202
{
	struct audit_buffer *ab;
	int i;

	ab = audit_log_start(context, GFP_KERNEL, context->type);
	if (!ab)
		return;

	switch (context->type) {
	case AUDIT_SOCKETCALL: {
		int nargs = context->socketcall.nargs;
		audit_log_format(ab, "nargs=%d", nargs);
		for (i = 0; i < nargs; i++)
			audit_log_format(ab, " a%d=%lx", i,
				context->socketcall.args[i]);
		break; }
Al Viro's avatar
Al Viro committed
1203 1204 1205
	case AUDIT_IPC: {
		u32 osid = context->ipc.osid;

1206
		audit_log_format(ab, "ouid=%u ogid=%u mode=%#ho",
1207 1208 1209
				 from_kuid(&init_user_ns, context->ipc.uid),
				 from_kgid(&init_user_ns, context->ipc.gid),
				 context->ipc.mode);
Al Viro's avatar
Al Viro committed
1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220
		if (osid) {
			char *ctx = NULL;
			u32 len;
			if (security_secid_to_secctx(osid, &ctx, &len)) {
				audit_log_format(ab, " osid=%u", osid);
				*call_panic = 1;
			} else {
				audit_log_format(ab, " obj=%s", ctx);
				security_release_secctx(ctx, len);
			}
		}
Al Viro's avatar
Al Viro committed
1221 1222 1223 1224
		if (context->ipc.has_perm) {
			audit_log_end(ab);
			ab = audit_log_start(context, GFP_KERNEL,
					     AUDIT_IPC_SET_PERM);
1225 1226
			if (unlikely(!ab))
				return;
Al Viro's avatar
Al Viro committed
1227
			audit_log_format(ab,
1228
				"qbytes=%lx ouid=%u ogid=%u mode=%#ho",
Al Viro's avatar
Al Viro committed
1229 1230 1231 1232 1233
				context->ipc.qbytes,
				context->ipc.perm_uid,
				context->ipc.perm_gid,
				context->ipc.perm_mode);
		}
Al Viro's avatar
Al Viro committed
1234
		break; }
Al Viro's avatar
Al Viro committed
1235 1236
	case AUDIT_MQ_OPEN: {
		audit_log_format(ab,
Al Viro's avatar
Al Viro committed
1237
			"oflag=0x%x mode=%#ho mq_flags=0x%lx mq_maxmsg=%ld "
Al Viro's avatar
Al Viro committed
1238 1239 1240 1241 1242 1243 1244
			"mq_msgsize=%ld mq_curmsgs=%ld",
			context->mq_open.oflag, context->mq_open.mode,
			context->mq_open.attr.mq_flags,
			context->mq_open.attr.mq_maxmsg,
			context->mq_open.attr.mq_msgsize,
			context->mq_open.attr.mq_curmsgs);
		break; }
Al Viro's avatar
Al Viro committed
1245 1246 1247 1248 1249 1250 1251 1252 1253 1254
	case AUDIT_MQ_SENDRECV: {
		audit_log_format(ab,
			"mqdes=%d msg_len=%zd msg_prio=%u "
			"abs_timeout_sec=%ld abs_timeout_nsec=%ld",
			context->mq_sendrecv.mqdes,
			context->mq_sendrecv.msg_len,
			context->mq_sendrecv.msg_prio,
			context->mq_sendrecv.abs_timeout.tv_sec,
			context->mq_sendrecv.abs_timeout.tv_nsec);
		break; }
Al Viro's avatar
Al Viro committed
1255 1256 1257 1258 1259
	case AUDIT_MQ_NOTIFY: {
		audit_log_format(ab, "mqdes=%d sigev_signo=%d",
				context->mq_notify.mqdes,
				context->mq_notify.sigev_signo);
		break; }
Al Viro's avatar
Al Viro committed
1260 1261 1262 1263 1264 1265 1266 1267 1268
	case AUDIT_MQ_GETSETATTR: {
		struct mq_attr *attr = &context->mq_getsetattr.mqstat;
		audit_log_format(ab,
			"mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
			"mq_curmsgs=%ld ",
			context->mq_getsetattr.mqdes,
			attr->mq_flags, attr->mq_maxmsg,
			attr->mq_msgsize, attr->mq_curmsgs);
		break; }
Al Viro's avatar
Al Viro committed
1269 1270 1271 1272 1273 1274
	case AUDIT_CAPSET: {
		audit_log_format(ab, "pid=%d", context->capset.pid);
		audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable);
		audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted);
		audit_log_cap(ab, "cap_pe", &context->capset.cap.effective);
		break; }
Al Viro's avatar
Al Viro committed
1275 1276 1277 1278
	case AUDIT_MMAP: {
		audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd,
				 context->mmap.flags);
		break; }
Al Viro's avatar
Al Viro committed
1279 1280 1281 1282
	}
	audit_log_end(ab);
}

1283
static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)
Linus Torvalds's avatar
Linus Torvalds committed
1284
{
1285
	int i, call_panic = 0;
Linus Torvalds's avatar
Linus Torvalds committed
1286
	struct audit_buffer *ab;
1287
	struct audit_aux_data *aux;
1288
	struct audit_names *n;
Linus Torvalds's avatar
Linus Torvalds committed
1289

1290
	/* tsk == current */
1291
	context->personality = tsk->personality;
1292 1293

	ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
Linus Torvalds's avatar
Linus Torvalds committed
1294 1295
	if (!ab)
		return;		/* audit_panic has been called */
1296 1297
	audit_log_format(ab, "arch=%x syscall=%d",
			 context->arch, context->major);
Linus Torvalds's avatar
Linus Torvalds committed
1298 1299 1300
	if (context->personality != PER_LINUX)
		audit_log_format(ab, " per=%lx", context->personality);
	if (context->return_valid)
1301
		audit_log_format(ab, " success=%s exit=%ld",
1302 1303
				 (context->return_valid==AUDITSC_SUCCESS)?"yes":"no",
				 context->return_code);
1304

Linus Torvalds's avatar
Linus Torvalds committed
1305
	audit_log_format(ab,
1306 1307 1308 1309 1310 1311
			 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d",
			 context->argv[0],
			 context->argv[1],
			 context->argv[2],
			 context->argv[3],
			 context->name_count);
1312

1313
	audit_log_task_info(ab, tsk);
1314
	audit_log_key(ab, context->filterkey);
Linus Torvalds's avatar
Linus Torvalds committed
1315 1316
	audit_log_end(ab);

1317
	for (aux = context->aux; aux; aux = aux->next) {
1318

1319
		ab = audit_log_start(context, GFP_KERNEL, aux->type);
Linus Torvalds's avatar
Linus Torvalds committed
1320 1321 1322 1323
		if (!ab)
			continue; /* audit_panic has been called */

		switch (aux->type) {
1324

1325 1326
		case AUDIT_EXECVE: {
			struct audit_aux_data_execve *axi = (void *)aux;
1327
			audit_log_execve_info(context, &ab, axi);
1328
			break; }
1329

1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343
		case AUDIT_BPRM_FCAPS: {
			struct audit_aux_data_bprm_fcaps *axs = (void *)aux;
			audit_log_format(ab, "fver=%x", axs->fcap_ver);
			audit_log_cap(ab, "fp", &axs->fcap.permitted);
			audit_log_cap(ab, "fi", &axs->fcap.inheritable);
			audit_log_format(ab, " fe=%d", axs->fcap.fE);
			audit_log_cap(ab, "old_pp", &axs->old_pcap.permitted);
			audit_log_cap(ab, "old_pi", &axs->old_pcap.inheritable);
			audit_log_cap(ab, "old_pe", &axs->old_pcap.effective);
			audit_log_cap(ab, "new_pp", &axs->new_pcap.permitted);
			audit_log_cap(ab, "new_pi", &axs->new_pcap.inheritable);
			audit_log_cap(ab, "new_pe", &axs->new_pcap.effective);
			break; }

Linus Torvalds's avatar
Linus Torvalds committed
1344 1345 1346 1347
		}
		audit_log_end(ab);
	}

Al Viro's avatar
Al Viro committed
1348
	if (context->type)
Al Viro's avatar
Al Viro committed
1349
		show_special(context, &call_panic);
Al Viro's avatar
Al Viro committed
1350

Al Viro's avatar
Al Viro committed
1351 1352 1353 1354 1355 1356 1357 1358 1359
	if (context->fds[0] >= 0) {
		ab = audit_log_start(context, GFP_KERNEL, AUDIT_FD_PAIR);
		if (ab) {
			audit_log_format(ab, "fd0=%d fd1=%d",
					context->fds[0], context->fds[1]);
			audit_log_end(ab);
		}
	}

1360 1361 1362 1363 1364 1365 1366 1367 1368 1369
	if (context->sockaddr_len) {
		ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR);
		if (ab) {
			audit_log_format(ab, "saddr=");
			audit_log_n_hex(ab, (void *)context->sockaddr,
					context->sockaddr_len);
			audit_log_end(ab);
		}
	}

1370 1371 1372 1373 1374
	for (aux = context->aux_pids; aux; aux = aux->next) {
		struct audit_aux_data_pids *axs = (void *)aux;

		for (i = 0; i < axs->pid_count; i++)
			if (audit_log_pid_context(context, axs->target_pid[i],
1375 1376
						  axs->target_auid[i],
						  axs->target_uid[i],
1377
						  axs->target_sessionid[i],
1378 1379
						  axs->target_sid[i],
						  axs->target_comm[i]))
1380
				call_panic = 1;
Al Viro's avatar
Al Viro committed
1381 1382
	}

1383 1384
	if (context->target_pid &&
	    audit_log_pid_context(context, context->target_pid,
1385
				  context->target_auid, context->target_uid,
1386
				  context->target_sessionid,
1387
				  context->target_sid, context->target_comm))
1388 1389
			call_panic = 1;

1390
	if (context->pwd.dentry && context->pwd.mnt) {
1391
		ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
1392
		if (ab) {
1393
			audit_log_d_path(ab, " cwd=", &context->pwd);
1394 1395 1396
			audit_log_end(ab);
		}
	}