~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/kernel/audit.c

Version: ~ [ linux-5.12-rc7 ] ~ [ linux-5.11.13 ] ~ [ linux-5.10.29 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.111 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.186 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.230 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.266 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.266 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0-or-later
  2 /* audit.c -- Auditing support
  3  * Gateway between the kernel (e.g., selinux) and the user-space audit daemon.
  4  * System-call specific features have moved to auditsc.c
  5  *
  6  * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina.
  7  * All Rights Reserved.
  8  *
  9  * Written by Rickard E. (Rik) Faith <faith@redhat.com>
 10  *
 11  * Goals: 1) Integrate fully with Security Modules.
 12  *        2) Minimal run-time overhead:
 13  *           a) Minimal when syscall auditing is disabled (audit_enable=0).
 14  *           b) Small when syscall auditing is enabled and no audit record
 15  *              is generated (defer as much work as possible to record
 16  *              generation time):
 17  *              i) context is allocated,
 18  *              ii) names from getname are stored without a copy, and
 19  *              iii) inode information stored from path_lookup.
 20  *        3) Ability to disable syscall auditing at boot time (audit=0).
 21  *        4) Usable by other parts of the kernel (if audit_log* is called,
 22  *           then a syscall record will be generated automatically for the
 23  *           current syscall).
 24  *        5) Netlink interface to user-space.
 25  *        6) Support low-overhead kernel-based filtering to minimize the
 26  *           information that must be passed to user-space.
 27  *
 28  * Audit userspace, documentation, tests, and bug/issue trackers:
 29  *      https://github.com/linux-audit
 30  */
 31 
 32 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 33 
 34 #include <linux/file.h>
 35 #include <linux/init.h>
 36 #include <linux/types.h>
 37 #include <linux/atomic.h>
 38 #include <linux/mm.h>
 39 #include <linux/export.h>
 40 #include <linux/slab.h>
 41 #include <linux/err.h>
 42 #include <linux/kthread.h>
 43 #include <linux/kernel.h>
 44 #include <linux/syscalls.h>
 45 #include <linux/spinlock.h>
 46 #include <linux/rcupdate.h>
 47 #include <linux/mutex.h>
 48 #include <linux/gfp.h>
 49 #include <linux/pid.h>
 50 
 51 #include <linux/audit.h>
 52 
 53 #include <net/sock.h>
 54 #include <net/netlink.h>
 55 #include <linux/skbuff.h>
 56 #ifdef CONFIG_SECURITY
 57 #include <linux/security.h>
 58 #endif
 59 #include <linux/freezer.h>
 60 #include <linux/pid_namespace.h>
 61 #include <net/netns/generic.h>
 62 
 63 #include "audit.h"
 64 
 65 /* No auditing will take place until audit_initialized == AUDIT_INITIALIZED.
 66  * (Initialization happens after skb_init is called.) */
 67 #define AUDIT_DISABLED          -1
 68 #define AUDIT_UNINITIALIZED     0
 69 #define AUDIT_INITIALIZED       1
 70 static int      audit_initialized;
 71 
 72 u32             audit_enabled = AUDIT_OFF;
 73 bool            audit_ever_enabled = !!AUDIT_OFF;
 74 
 75 EXPORT_SYMBOL_GPL(audit_enabled);
 76 
 77 /* Default state when kernel boots without any parameters. */
 78 static u32      audit_default = AUDIT_OFF;
 79 
 80 /* If auditing cannot proceed, audit_failure selects what happens. */
 81 static u32      audit_failure = AUDIT_FAIL_PRINTK;
 82 
 83 /* private audit network namespace index */
 84 static unsigned int audit_net_id;
 85 
 86 /**
 87  * struct audit_net - audit private network namespace data
 88  * @sk: communication socket
 89  */
 90 struct audit_net {
 91         struct sock *sk;
 92 };
 93 
 94 /**
 95  * struct auditd_connection - kernel/auditd connection state
 96  * @pid: auditd PID
 97  * @portid: netlink portid
 98  * @net: the associated network namespace
 99  * @rcu: RCU head
100  *
101  * Description:
102  * This struct is RCU protected; you must either hold the RCU lock for reading
103  * or the associated spinlock for writing.
104  */
105 struct auditd_connection {
106         struct pid *pid;
107         u32 portid;
108         struct net *net;
109         struct rcu_head rcu;
110 };
111 static struct auditd_connection __rcu *auditd_conn;
112 static DEFINE_SPINLOCK(auditd_conn_lock);
113 
114 /* If audit_rate_limit is non-zero, limit the rate of sending audit records
115  * to that number per second.  This prevents DoS attacks, but results in
116  * audit records being dropped. */
117 static u32      audit_rate_limit;
118 
119 /* Number of outstanding audit_buffers allowed.
120  * When set to zero, this means unlimited. */
121 static u32      audit_backlog_limit = 64;
122 #define AUDIT_BACKLOG_WAIT_TIME (60 * HZ)
123 static u32      audit_backlog_wait_time = AUDIT_BACKLOG_WAIT_TIME;
124 
125 /* The identity of the user shutting down the audit system. */
126 kuid_t          audit_sig_uid = INVALID_UID;
127 pid_t           audit_sig_pid = -1;
128 u32             audit_sig_sid = 0;
129 
130 /* Records can be lost in several ways:
131    0) [suppressed in audit_alloc]
132    1) out of memory in audit_log_start [kmalloc of struct audit_buffer]
133    2) out of memory in audit_log_move [alloc_skb]
134    3) suppressed due to audit_rate_limit
135    4) suppressed due to audit_backlog_limit
136 */
137 static atomic_t audit_lost = ATOMIC_INIT(0);
138 
139 /* Hash for inode-based rules */
140 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
141 
142 static struct kmem_cache *audit_buffer_cache;
143 
144 /* queue msgs to send via kauditd_task */
145 static struct sk_buff_head audit_queue;
146 /* queue msgs due to temporary unicast send problems */
147 static struct sk_buff_head audit_retry_queue;
148 /* queue msgs waiting for new auditd connection */
149 static struct sk_buff_head audit_hold_queue;
150 
151 /* queue servicing thread */
152 static struct task_struct *kauditd_task;
153 static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
154 
155 /* waitqueue for callers who are blocked on the audit backlog */
156 static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
157 
158 static struct audit_features af = {.vers = AUDIT_FEATURE_VERSION,
159                                    .mask = -1,
160                                    .features = 0,
161                                    .lock = 0,};
162 
163 static char *audit_feature_names[2] = {
164         "only_unset_loginuid",
165         "loginuid_immutable",
166 };
167 
168 /**
169  * struct audit_ctl_mutex - serialize requests from userspace
170  * @lock: the mutex used for locking
171  * @owner: the task which owns the lock
172  *
173  * Description:
174  * This is the lock struct used to ensure we only process userspace requests
175  * in an orderly fashion.  We can't simply use a mutex/lock here because we
176  * need to track lock ownership so we don't end up blocking the lock owner in
177  * audit_log_start() or similar.
178  */
179 static struct audit_ctl_mutex {
180         struct mutex lock;
181         void *owner;
182 } audit_cmd_mutex;
183 
184 /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
185  * audit records.  Since printk uses a 1024 byte buffer, this buffer
186  * should be at least that large. */
187 #define AUDIT_BUFSIZ 1024
188 
189 /* The audit_buffer is used when formatting an audit record.  The caller
190  * locks briefly to get the record off the freelist or to allocate the
191  * buffer, and locks briefly to send the buffer to the netlink layer or
192  * to place it on a transmit queue.  Multiple audit_buffers can be in
193  * use simultaneously. */
194 struct audit_buffer {
195         struct sk_buff       *skb;      /* formatted skb ready to send */
196         struct audit_context *ctx;      /* NULL or associated context */
197         gfp_t                gfp_mask;
198 };
199 
200 struct audit_reply {
201         __u32 portid;
202         struct net *net;
203         struct sk_buff *skb;
204 };
205 
206 /**
207  * auditd_test_task - Check to see if a given task is an audit daemon
208  * @task: the task to check
209  *
210  * Description:
211  * Return 1 if the task is a registered audit daemon, 0 otherwise.
212  */
213 int auditd_test_task(struct task_struct *task)
214 {
215         int rc;
216         struct auditd_connection *ac;
217 
218         rcu_read_lock();
219         ac = rcu_dereference(auditd_conn);
220         rc = (ac && ac->pid == task_tgid(task) ? 1 : 0);
221         rcu_read_unlock();
222 
223         return rc;
224 }
225 
226 /**
227  * audit_ctl_lock - Take the audit control lock
228  */
229 void audit_ctl_lock(void)
230 {
231         mutex_lock(&audit_cmd_mutex.lock);
232         audit_cmd_mutex.owner = current;
233 }
234 
235 /**
236  * audit_ctl_unlock - Drop the audit control lock
237  */
238 void audit_ctl_unlock(void)
239 {
240         audit_cmd_mutex.owner = NULL;
241         mutex_unlock(&audit_cmd_mutex.lock);
242 }
243 
244 /**
245  * audit_ctl_owner_current - Test to see if the current task owns the lock
246  *
247  * Description:
248  * Return true if the current task owns the audit control lock, false if it
249  * doesn't own the lock.
250  */
251 static bool audit_ctl_owner_current(void)
252 {
253         return (current == audit_cmd_mutex.owner);
254 }
255 
256 /**
257  * auditd_pid_vnr - Return the auditd PID relative to the namespace
258  *
259  * Description:
260  * Returns the PID in relation to the namespace, 0 on failure.
261  */
262 static pid_t auditd_pid_vnr(void)
263 {
264         pid_t pid;
265         const struct auditd_connection *ac;
266 
267         rcu_read_lock();
268         ac = rcu_dereference(auditd_conn);
269         if (!ac || !ac->pid)
270                 pid = 0;
271         else
272                 pid = pid_vnr(ac->pid);
273         rcu_read_unlock();
274 
275         return pid;
276 }
277 
278 /**
279  * audit_get_sk - Return the audit socket for the given network namespace
280  * @net: the destination network namespace
281  *
282  * Description:
283  * Returns the sock pointer if valid, NULL otherwise.  The caller must ensure
284  * that a reference is held for the network namespace while the sock is in use.
285  */
286 static struct sock *audit_get_sk(const struct net *net)
287 {
288         struct audit_net *aunet;
289 
290         if (!net)
291                 return NULL;
292 
293         aunet = net_generic(net, audit_net_id);
294         return aunet->sk;
295 }
296 
297 void audit_panic(const char *message)
298 {
299         switch (audit_failure) {
300         case AUDIT_FAIL_SILENT:
301                 break;
302         case AUDIT_FAIL_PRINTK:
303                 if (printk_ratelimit())
304                         pr_err("%s\n", message);
305                 break;
306         case AUDIT_FAIL_PANIC:
307                 panic("audit: %s\n", message);
308                 break;
309         }
310 }
311 
312 static inline int audit_rate_check(void)
313 {
314         static unsigned long    last_check = 0;
315         static int              messages   = 0;
316         static DEFINE_SPINLOCK(lock);
317         unsigned long           flags;
318         unsigned long           now;
319         unsigned long           elapsed;
320         int                     retval     = 0;
321 
322         if (!audit_rate_limit) return 1;
323 
324         spin_lock_irqsave(&lock, flags);
325         if (++messages < audit_rate_limit) {
326                 retval = 1;
327         } else {
328                 now     = jiffies;
329                 elapsed = now - last_check;
330                 if (elapsed > HZ) {
331                         last_check = now;
332                         messages   = 0;
333                         retval     = 1;
334                 }
335         }
336         spin_unlock_irqrestore(&lock, flags);
337 
338         return retval;
339 }
340 
341 /**
342  * audit_log_lost - conditionally log lost audit message event
343  * @message: the message stating reason for lost audit message
344  *
345  * Emit at least 1 message per second, even if audit_rate_check is
346  * throttling.
347  * Always increment the lost messages counter.
348 */
349 void audit_log_lost(const char *message)
350 {
351         static unsigned long    last_msg = 0;
352         static DEFINE_SPINLOCK(lock);
353         unsigned long           flags;
354         unsigned long           now;
355         int                     print;
356 
357         atomic_inc(&audit_lost);
358 
359         print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
360 
361         if (!print) {
362                 spin_lock_irqsave(&lock, flags);
363                 now = jiffies;
364                 if (now - last_msg > HZ) {
365                         print = 1;
366                         last_msg = now;
367                 }
368                 spin_unlock_irqrestore(&lock, flags);
369         }
370 
371         if (print) {
372                 if (printk_ratelimit())
373                         pr_warn("audit_lost=%u audit_rate_limit=%u audit_backlog_limit=%u\n",
374                                 atomic_read(&audit_lost),
375                                 audit_rate_limit,
376                                 audit_backlog_limit);
377                 audit_panic(message);
378         }
379 }
380 
381 static int audit_log_config_change(char *function_name, u32 new, u32 old,
382                                    int allow_changes)
383 {
384         struct audit_buffer *ab;
385         int rc = 0;
386 
387         ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONFIG_CHANGE);
388         if (unlikely(!ab))
389                 return rc;
390         audit_log_format(ab, "op=set %s=%u old=%u ", function_name, new, old);
391         audit_log_session_info(ab);
392         rc = audit_log_task_context(ab);
393         if (rc)
394                 allow_changes = 0; /* Something weird, deny request */
395         audit_log_format(ab, " res=%d", allow_changes);
396         audit_log_end(ab);
397         return rc;
398 }
399 
400 static int audit_do_config_change(char *function_name, u32 *to_change, u32 new)
401 {
402         int allow_changes, rc = 0;
403         u32 old = *to_change;
404 
405         /* check if we are locked */
406         if (audit_enabled == AUDIT_LOCKED)
407                 allow_changes = 0;
408         else
409                 allow_changes = 1;
410 
411         if (audit_enabled != AUDIT_OFF) {
412                 rc = audit_log_config_change(function_name, new, old, allow_changes);
413                 if (rc)
414                         allow_changes = 0;
415         }
416 
417         /* If we are allowed, make the change */
418         if (allow_changes == 1)
419                 *to_change = new;
420         /* Not allowed, update reason */
421         else if (rc == 0)
422                 rc = -EPERM;
423         return rc;
424 }
425 
426 static int audit_set_rate_limit(u32 limit)
427 {
428         return audit_do_config_change("audit_rate_limit", &audit_rate_limit, limit);
429 }
430 
431 static int audit_set_backlog_limit(u32 limit)
432 {
433         return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit, limit);
434 }
435 
436 static int audit_set_backlog_wait_time(u32 timeout)
437 {
438         return audit_do_config_change("audit_backlog_wait_time",
439                                       &audit_backlog_wait_time, timeout);
440 }
441 
442 static int audit_set_enabled(u32 state)
443 {
444         int rc;
445         if (state > AUDIT_LOCKED)
446                 return -EINVAL;
447 
448         rc =  audit_do_config_change("audit_enabled", &audit_enabled, state);
449         if (!rc)
450                 audit_ever_enabled |= !!state;
451 
452         return rc;
453 }
454 
455 static int audit_set_failure(u32 state)
456 {
457         if (state != AUDIT_FAIL_SILENT
458             && state != AUDIT_FAIL_PRINTK
459             && state != AUDIT_FAIL_PANIC)
460                 return -EINVAL;
461 
462         return audit_do_config_change("audit_failure", &audit_failure, state);
463 }
464 
465 /**
466  * auditd_conn_free - RCU helper to release an auditd connection struct
467  * @rcu: RCU head
468  *
469  * Description:
470  * Drop any references inside the auditd connection tracking struct and free
471  * the memory.
472  */
473 static void auditd_conn_free(struct rcu_head *rcu)
474 {
475         struct auditd_connection *ac;
476 
477         ac = container_of(rcu, struct auditd_connection, rcu);
478         put_pid(ac->pid);
479         put_net(ac->net);
480         kfree(ac);
481 }
482 
483 /**
484  * auditd_set - Set/Reset the auditd connection state
485  * @pid: auditd PID
486  * @portid: auditd netlink portid
487  * @net: auditd network namespace pointer
488  *
489  * Description:
490  * This function will obtain and drop network namespace references as
491  * necessary.  Returns zero on success, negative values on failure.
492  */
493 static int auditd_set(struct pid *pid, u32 portid, struct net *net)
494 {
495         unsigned long flags;
496         struct auditd_connection *ac_old, *ac_new;
497 
498         if (!pid || !net)
499                 return -EINVAL;
500 
501         ac_new = kzalloc(sizeof(*ac_new), GFP_KERNEL);
502         if (!ac_new)
503                 return -ENOMEM;
504         ac_new->pid = get_pid(pid);
505         ac_new->portid = portid;
506         ac_new->net = get_net(net);
507 
508         spin_lock_irqsave(&auditd_conn_lock, flags);
509         ac_old = rcu_dereference_protected(auditd_conn,
510                                            lockdep_is_held(&auditd_conn_lock));
511         rcu_assign_pointer(auditd_conn, ac_new);
512         spin_unlock_irqrestore(&auditd_conn_lock, flags);
513 
514         if (ac_old)
515                 call_rcu(&ac_old->rcu, auditd_conn_free);
516 
517         return 0;
518 }
519 
520 /**
521  * kauditd_print_skb - Print the audit record to the ring buffer
522  * @skb: audit record
523  *
524  * Whatever the reason, this packet may not make it to the auditd connection
525  * so write it via printk so the information isn't completely lost.
526  */
527 static void kauditd_printk_skb(struct sk_buff *skb)
528 {
529         struct nlmsghdr *nlh = nlmsg_hdr(skb);
530         char *data = nlmsg_data(nlh);
531 
532         if (nlh->nlmsg_type != AUDIT_EOE && printk_ratelimit())
533                 pr_notice("type=%d %s\n", nlh->nlmsg_type, data);
534 }
535 
536 /**
537  * kauditd_rehold_skb - Handle a audit record send failure in the hold queue
538  * @skb: audit record
539  *
540  * Description:
541  * This should only be used by the kauditd_thread when it fails to flush the
542  * hold queue.
543  */
544 static void kauditd_rehold_skb(struct sk_buff *skb)
545 {
546         /* put the record back in the queue at the same place */
547         skb_queue_head(&audit_hold_queue, skb);
548 }
549 
550 /**
551  * kauditd_hold_skb - Queue an audit record, waiting for auditd
552  * @skb: audit record
553  *
554  * Description:
555  * Queue the audit record, waiting for an instance of auditd.  When this
556  * function is called we haven't given up yet on sending the record, but things
557  * are not looking good.  The first thing we want to do is try to write the
558  * record via printk and then see if we want to try and hold on to the record
559  * and queue it, if we have room.  If we want to hold on to the record, but we
560  * don't have room, record a record lost message.
561  */
562 static void kauditd_hold_skb(struct sk_buff *skb)
563 {
564         /* at this point it is uncertain if we will ever send this to auditd so
565          * try to send the message via printk before we go any further */
566         kauditd_printk_skb(skb);
567 
568         /* can we just silently drop the message? */
569         if (!audit_default) {
570                 kfree_skb(skb);
571                 return;
572         }
573 
574         /* if we have room, queue the message */
575         if (!audit_backlog_limit ||
576             skb_queue_len(&audit_hold_queue) < audit_backlog_limit) {
577                 skb_queue_tail(&audit_hold_queue, skb);
578                 return;
579         }
580 
581         /* we have no other options - drop the message */
582         audit_log_lost("kauditd hold queue overflow");
583         kfree_skb(skb);
584 }
585 
586 /**
587  * kauditd_retry_skb - Queue an audit record, attempt to send again to auditd
588  * @skb: audit record
589  *
590  * Description:
591  * Not as serious as kauditd_hold_skb() as we still have a connected auditd,
592  * but for some reason we are having problems sending it audit records so
593  * queue the given record and attempt to resend.
594  */
595 static void kauditd_retry_skb(struct sk_buff *skb)
596 {
597         /* NOTE: because records should only live in the retry queue for a
598          * short period of time, before either being sent or moved to the hold
599          * queue, we don't currently enforce a limit on this queue */
600         skb_queue_tail(&audit_retry_queue, skb);
601 }
602 
603 /**
604  * auditd_reset - Disconnect the auditd connection
605  * @ac: auditd connection state
606  *
607  * Description:
608  * Break the auditd/kauditd connection and move all the queued records into the
609  * hold queue in case auditd reconnects.  It is important to note that the @ac
610  * pointer should never be dereferenced inside this function as it may be NULL
611  * or invalid, you can only compare the memory address!  If @ac is NULL then
612  * the connection will always be reset.
613  */
614 static void auditd_reset(const struct auditd_connection *ac)
615 {
616         unsigned long flags;
617         struct sk_buff *skb;
618         struct auditd_connection *ac_old;
619 
620         /* if it isn't already broken, break the connection */
621         spin_lock_irqsave(&auditd_conn_lock, flags);
622         ac_old = rcu_dereference_protected(auditd_conn,
623                                            lockdep_is_held(&auditd_conn_lock));
624         if (ac && ac != ac_old) {
625                 /* someone already registered a new auditd connection */
626                 spin_unlock_irqrestore(&auditd_conn_lock, flags);
627                 return;
628         }
629         rcu_assign_pointer(auditd_conn, NULL);
630         spin_unlock_irqrestore(&auditd_conn_lock, flags);
631 
632         if (ac_old)
633                 call_rcu(&ac_old->rcu, auditd_conn_free);
634 
635         /* flush the retry queue to the hold queue, but don't touch the main
636          * queue since we need to process that normally for multicast */
637         while ((skb = skb_dequeue(&audit_retry_queue)))
638                 kauditd_hold_skb(skb);
639 }
640 
641 /**
642  * auditd_send_unicast_skb - Send a record via unicast to auditd
643  * @skb: audit record
644  *
645  * Description:
646  * Send a skb to the audit daemon, returns positive/zero values on success and
647  * negative values on failure; in all cases the skb will be consumed by this
648  * function.  If the send results in -ECONNREFUSED the connection with auditd
649  * will be reset.  This function may sleep so callers should not hold any locks
650  * where this would cause a problem.
651  */
652 static int auditd_send_unicast_skb(struct sk_buff *skb)
653 {
654         int rc;
655         u32 portid;
656         struct net *net;
657         struct sock *sk;
658         struct auditd_connection *ac;
659 
660         /* NOTE: we can't call netlink_unicast while in the RCU section so
661          *       take a reference to the network namespace and grab local
662          *       copies of the namespace, the sock, and the portid; the
663          *       namespace and sock aren't going to go away while we hold a
664          *       reference and if the portid does become invalid after the RCU
665          *       section netlink_unicast() should safely return an error */
666 
667         rcu_read_lock();
668         ac = rcu_dereference(auditd_conn);
669         if (!ac) {
670                 rcu_read_unlock();
671                 kfree_skb(skb);
672                 rc = -ECONNREFUSED;
673                 goto err;
674         }
675         net = get_net(ac->net);
676         sk = audit_get_sk(net);
677         portid = ac->portid;
678         rcu_read_unlock();
679 
680         rc = netlink_unicast(sk, skb, portid, 0);
681         put_net(net);
682         if (rc < 0)
683                 goto err;
684 
685         return rc;
686 
687 err:
688         if (ac && rc == -ECONNREFUSED)
689                 auditd_reset(ac);
690         return rc;
691 }
692 
693 /**
694  * kauditd_send_queue - Helper for kauditd_thread to flush skb queues
695  * @sk: the sending sock
696  * @portid: the netlink destination
697  * @queue: the skb queue to process
698  * @retry_limit: limit on number of netlink unicast failures
699  * @skb_hook: per-skb hook for additional processing
700  * @err_hook: hook called if the skb fails the netlink unicast send
701  *
702  * Description:
703  * Run through the given queue and attempt to send the audit records to auditd,
704  * returns zero on success, negative values on failure.  It is up to the caller
705  * to ensure that the @sk is valid for the duration of this function.
706  *
707  */
708 static int kauditd_send_queue(struct sock *sk, u32 portid,
709                               struct sk_buff_head *queue,
710                               unsigned int retry_limit,
711                               void (*skb_hook)(struct sk_buff *skb),
712                               void (*err_hook)(struct sk_buff *skb))
713 {
714         int rc = 0;
715         struct sk_buff *skb;
716         static unsigned int failed = 0;
717 
718         /* NOTE: kauditd_thread takes care of all our locking, we just use
719          *       the netlink info passed to us (e.g. sk and portid) */
720 
721         while ((skb = skb_dequeue(queue))) {
722                 /* call the skb_hook for each skb we touch */
723                 if (skb_hook)
724                         (*skb_hook)(skb);
725 
726                 /* can we send to anyone via unicast? */
727                 if (!sk) {
728                         if (err_hook)
729                                 (*err_hook)(skb);
730                         continue;
731                 }
732 
733                 /* grab an extra skb reference in case of error */
734                 skb_get(skb);
735                 rc = netlink_unicast(sk, skb, portid, 0);
736                 if (rc < 0) {
737                         /* fatal failure for our queue flush attempt? */
738                         if (++failed >= retry_limit ||
739                             rc == -ECONNREFUSED || rc == -EPERM) {
740                                 /* yes - error processing for the queue */
741                                 sk = NULL;
742                                 if (err_hook)
743                                         (*err_hook)(skb);
744                                 if (!skb_hook)
745                                         goto out;
746                                 /* keep processing with the skb_hook */
747                                 continue;
748                         } else
749                                 /* no - requeue to preserve ordering */
750                                 skb_queue_head(queue, skb);
751                 } else {
752                         /* it worked - drop the extra reference and continue */
753                         consume_skb(skb);
754                         failed = 0;
755                 }
756         }
757 
758 out:
759         return (rc >= 0 ? 0 : rc);
760 }
761 
762 /*
763  * kauditd_send_multicast_skb - Send a record to any multicast listeners
764  * @skb: audit record
765  *
766  * Description:
767  * Write a multicast message to anyone listening in the initial network
768  * namespace.  This function doesn't consume an skb as might be expected since
769  * it has to copy it anyways.
770  */
771 static void kauditd_send_multicast_skb(struct sk_buff *skb)
772 {
773         struct sk_buff *copy;
774         struct sock *sock = audit_get_sk(&init_net);
775         struct nlmsghdr *nlh;
776 
777         /* NOTE: we are not taking an additional reference for init_net since
778          *       we don't have to worry about it going away */
779 
780         if (!netlink_has_listeners(sock, AUDIT_NLGRP_READLOG))
781                 return;
782 
783         /*
784          * The seemingly wasteful skb_copy() rather than bumping the refcount
785          * using skb_get() is necessary because non-standard mods are made to
786          * the skb by the original kaudit unicast socket send routine.  The
787          * existing auditd daemon assumes this breakage.  Fixing this would
788          * require co-ordinating a change in the established protocol between
789          * the kaudit kernel subsystem and the auditd userspace code.  There is
790          * no reason for new multicast clients to continue with this
791          * non-compliance.
792          */
793         copy = skb_copy(skb, GFP_KERNEL);
794         if (!copy)
795                 return;
796         nlh = nlmsg_hdr(copy);
797         nlh->nlmsg_len = skb->len;
798 
799         nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, GFP_KERNEL);
800 }
801 
802 /**
803  * kauditd_thread - Worker thread to send audit records to userspace
804  * @dummy: unused
805  */
806 static int kauditd_thread(void *dummy)
807 {
808         int rc;
809         u32 portid = 0;
810         struct net *net = NULL;
811         struct sock *sk = NULL;
812         struct auditd_connection *ac;
813 
814 #define UNICAST_RETRIES 5
815 
816         set_freezable();
817         while (!kthread_should_stop()) {
818                 /* NOTE: see the lock comments in auditd_send_unicast_skb() */
819                 rcu_read_lock();
820                 ac = rcu_dereference(auditd_conn);
821                 if (!ac) {
822                         rcu_read_unlock();
823                         goto main_queue;
824                 }
825                 net = get_net(ac->net);
826                 sk = audit_get_sk(net);
827                 portid = ac->portid;
828                 rcu_read_unlock();
829 
830                 /* attempt to flush the hold queue */
831                 rc = kauditd_send_queue(sk, portid,
832                                         &audit_hold_queue, UNICAST_RETRIES,
833                                         NULL, kauditd_rehold_skb);
834                 if (rc < 0) {
835                         sk = NULL;
836                         auditd_reset(ac);
837                         goto main_queue;
838                 }
839 
840                 /* attempt to flush the retry queue */
841                 rc = kauditd_send_queue(sk, portid,
842                                         &audit_retry_queue, UNICAST_RETRIES,
843                                         NULL, kauditd_hold_skb);
844                 if (rc < 0) {
845                         sk = NULL;
846                         auditd_reset(ac);
847                         goto main_queue;
848                 }
849 
850 main_queue:
851                 /* process the main queue - do the multicast send and attempt
852                  * unicast, dump failed record sends to the retry queue; if
853                  * sk == NULL due to previous failures we will just do the
854                  * multicast send and move the record to the hold queue */
855                 rc = kauditd_send_queue(sk, portid, &audit_queue, 1,
856                                         kauditd_send_multicast_skb,
857                                         (sk ?
858                                          kauditd_retry_skb : kauditd_hold_skb));
859                 if (ac && rc < 0)
860                         auditd_reset(ac);
861                 sk = NULL;
862 
863                 /* drop our netns reference, no auditd sends past this line */
864                 if (net) {
865                         put_net(net);
866                         net = NULL;
867                 }
868 
869                 /* we have processed all the queues so wake everyone */
870                 wake_up(&audit_backlog_wait);
871 
872                 /* NOTE: we want to wake up if there is anything on the queue,
873                  *       regardless of if an auditd is connected, as we need to
874                  *       do the multicast send and rotate records from the
875                  *       main queue to the retry/hold queues */
876                 wait_event_freezable(kauditd_wait,
877                                      (skb_queue_len(&audit_queue) ? 1 : 0));
878         }
879 
880         return 0;
881 }
882 
883 int audit_send_list(void *_dest)
884 {
885         struct audit_netlink_list *dest = _dest;
886         struct sk_buff *skb;
887         struct sock *sk = audit_get_sk(dest->net);
888 
889         /* wait for parent to finish and send an ACK */
890         audit_ctl_lock();
891         audit_ctl_unlock();
892 
893         while ((skb = __skb_dequeue(&dest->q)) != NULL)
894                 netlink_unicast(sk, skb, dest->portid, 0);
895 
896         put_net(dest->net);
897         kfree(dest);
898 
899         return 0;
900 }
901 
902 struct sk_buff *audit_make_reply(int seq, int type, int done,
903                                  int multi, const void *payload, int size)
904 {
905         struct sk_buff  *skb;
906         struct nlmsghdr *nlh;
907         void            *data;
908         int             flags = multi ? NLM_F_MULTI : 0;
909         int             t     = done  ? NLMSG_DONE  : type;
910 
911         skb = nlmsg_new(size, GFP_KERNEL);
912         if (!skb)
913                 return NULL;
914 
915         nlh     = nlmsg_put(skb, 0, seq, t, size, flags);
916         if (!nlh)
917                 goto out_kfree_skb;
918         data = nlmsg_data(nlh);
919         memcpy(data, payload, size);
920         return skb;
921 
922 out_kfree_skb:
923         kfree_skb(skb);
924         return NULL;
925 }
926 
927 static int audit_send_reply_thread(void *arg)
928 {
929         struct audit_reply *reply = (struct audit_reply *)arg;
930         struct sock *sk = audit_get_sk(reply->net);
931 
932         audit_ctl_lock();
933         audit_ctl_unlock();
934 
935         /* Ignore failure. It'll only happen if the sender goes away,
936            because our timeout is set to infinite. */
937         netlink_unicast(sk, reply->skb, reply->portid, 0);
938         put_net(reply->net);
939         kfree(reply);
940         return 0;
941 }
942 
943 /**
944  * audit_send_reply - send an audit reply message via netlink
945  * @request_skb: skb of request we are replying to (used to target the reply)
946  * @seq: sequence number
947  * @type: audit message type
948  * @done: done (last) flag
949  * @multi: multi-part message flag
950  * @payload: payload data
951  * @size: payload size
952  *
953  * Allocates an skb, builds the netlink message, and sends it to the port id.
954  * No failure notifications.
955  */
956 static void audit_send_reply(struct sk_buff *request_skb, int seq, int type, int done,
957                              int multi, const void *payload, int size)
958 {
959         struct net *net = sock_net(NETLINK_CB(request_skb).sk);
960         struct sk_buff *skb;
961         struct task_struct *tsk;
962         struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),
963                                             GFP_KERNEL);
964 
965         if (!reply)
966                 return;
967 
968         skb = audit_make_reply(seq, type, done, multi, payload, size);
969         if (!skb)
970                 goto out;
971 
972         reply->net = get_net(net);
973         reply->portid = NETLINK_CB(request_skb).portid;
974         reply->skb = skb;
975 
976         tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
977         if (!IS_ERR(tsk))
978                 return;
979         kfree_skb(skb);
980 out:
981         kfree(reply);
982 }
983 
984 /*
985  * Check for appropriate CAP_AUDIT_ capabilities on incoming audit
986  * control messages.
987  */
988 static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
989 {
990         int err = 0;
991 
992         /* Only support initial user namespace for now. */
993         /*
994          * We return ECONNREFUSED because it tricks userspace into thinking
995          * that audit was not configured into the kernel.  Lots of users
996          * configure their PAM stack (because that's what the distro does)
997          * to reject login if unable to send messages to audit.  If we return
998          * ECONNREFUSED the PAM stack thinks the kernel does not have audit
999          * configured in and will let login proceed.  If we return EPERM
1000          * userspace will reject all logins.  This should be removed when we
1001          * support non init namespaces!!
1002          */
1003         if (current_user_ns() != &init_user_ns)
1004                 return -ECONNREFUSED;
1005 
1006         switch (msg_type) {
1007         case AUDIT_LIST:
1008         case AUDIT_ADD:
1009         case AUDIT_DEL:
1010                 return -EOPNOTSUPP;
1011         case AUDIT_GET:
1012         case AUDIT_SET:
1013         case AUDIT_GET_FEATURE:
1014         case AUDIT_SET_FEATURE:
1015         case AUDIT_LIST_RULES:
1016         case AUDIT_ADD_RULE:
1017         case AUDIT_DEL_RULE:
1018         case AUDIT_SIGNAL_INFO:
1019         case AUDIT_TTY_GET:
1020         case AUDIT_TTY_SET:
1021         case AUDIT_TRIM:
1022         case AUDIT_MAKE_EQUIV:
1023                 /* Only support auditd and auditctl in initial pid namespace
1024                  * for now. */
1025                 if (task_active_pid_ns(current) != &init_pid_ns)
1026                         return -EPERM;
1027 
1028                 if (!netlink_capable(skb, CAP_AUDIT_CONTROL))
1029                         err = -EPERM;
1030                 break;
1031         case AUDIT_USER:
1032         case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
1033         case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
1034                 if (!netlink_capable(skb, CAP_AUDIT_WRITE))
1035                         err = -EPERM;
1036                 break;
1037         default:  /* bad msg */
1038                 err = -EINVAL;
1039         }
1040 
1041         return err;
1042 }
1043 
1044 static void audit_log_common_recv_msg(struct audit_context *context,
1045                                         struct audit_buffer **ab, u16 msg_type)
1046 {
1047         uid_t uid = from_kuid(&init_user_ns, current_uid());
1048         pid_t pid = task_tgid_nr(current);
1049 
1050         if (!audit_enabled && msg_type != AUDIT_USER_AVC) {
1051                 *ab = NULL;
1052                 return;
1053         }
1054 
1055         *ab = audit_log_start(context, GFP_KERNEL, msg_type);
1056         if (unlikely(!*ab))
1057                 return;
1058         audit_log_format(*ab, "pid=%d uid=%u ", pid, uid);
1059         audit_log_session_info(*ab);
1060         audit_log_task_context(*ab);
1061 }
1062 
1063 static inline void audit_log_user_recv_msg(struct audit_buffer **ab,
1064                                            u16 msg_type)
1065 {
1066         audit_log_common_recv_msg(NULL, ab, msg_type);
1067 }
1068 
1069 int is_audit_feature_set(int i)
1070 {
1071         return af.features & AUDIT_FEATURE_TO_MASK(i);
1072 }
1073 
1074 
1075 static int audit_get_feature(struct sk_buff *skb)
1076 {
1077         u32 seq;
1078 
1079         seq = nlmsg_hdr(skb)->nlmsg_seq;
1080 
1081         audit_send_reply(skb, seq, AUDIT_GET_FEATURE, 0, 0, &af, sizeof(af));
1082 
1083         return 0;
1084 }
1085 
1086 static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature,
1087                                      u32 old_lock, u32 new_lock, int res)
1088 {
1089         struct audit_buffer *ab;
1090 
1091         if (audit_enabled == AUDIT_OFF)
1092                 return;
1093 
1094         ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_FEATURE_CHANGE);
1095         if (!ab)
1096                 return;
1097         audit_log_task_info(ab);
1098         audit_log_format(ab, " feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d",
1099                          audit_feature_names[which], !!old_feature, !!new_feature,
1100                          !!old_lock, !!new_lock, res);
1101         audit_log_end(ab);
1102 }
1103 
1104 static int audit_set_feature(struct audit_features *uaf)
1105 {
1106         int i;
1107 
1108         BUILD_BUG_ON(AUDIT_LAST_FEATURE + 1 > ARRAY_SIZE(audit_feature_names));
1109 
1110         /* if there is ever a version 2 we should handle that here */
1111 
1112         for (i = 0; i <= AUDIT_LAST_FEATURE; i++) {
1113                 u32 feature = AUDIT_FEATURE_TO_MASK(i);
1114                 u32 old_feature, new_feature, old_lock, new_lock;
1115 
1116                 /* if we are not changing this feature, move along */
1117                 if (!(feature & uaf->mask))
1118                         continue;
1119 
1120                 old_feature = af.features & feature;
1121                 new_feature = uaf->features & feature;
1122                 new_lock = (uaf->lock | af.lock) & feature;
1123                 old_lock = af.lock & feature;
1124 
1125                 /* are we changing a locked feature? */
1126                 if (old_lock && (new_feature != old_feature)) {
1127                         audit_log_feature_change(i, old_feature, new_feature,
1128                                                  old_lock, new_lock, 0);
1129                         return -EPERM;
1130                 }
1131         }
1132         /* nothing invalid, do the changes */
1133         for (i = 0; i <= AUDIT_LAST_FEATURE; i++) {
1134                 u32 feature = AUDIT_FEATURE_TO_MASK(i);
1135                 u32 old_feature, new_feature, old_lock, new_lock;
1136 
1137                 /* if we are not changing this feature, move along */
1138                 if (!(feature & uaf->mask))
1139                         continue;
1140 
1141                 old_feature = af.features & feature;
1142                 new_feature = uaf->features & feature;
1143                 old_lock = af.lock & feature;
1144                 new_lock = (uaf->lock | af.lock) & feature;
1145 
1146                 if (new_feature != old_feature)
1147                         audit_log_feature_change(i, old_feature, new_feature,
1148                                                  old_lock, new_lock, 1);
1149 
1150                 if (new_feature)
1151                         af.features |= feature;
1152                 else
1153                         af.features &= ~feature;
1154                 af.lock |= new_lock;
1155         }
1156 
1157         return 0;
1158 }
1159 
1160 static int audit_replace(struct pid *pid)
1161 {
1162         pid_t pvnr;
1163         struct sk_buff *skb;
1164 
1165         pvnr = pid_vnr(pid);
1166         skb = audit_make_reply(0, AUDIT_REPLACE, 0, 0, &pvnr, sizeof(pvnr));
1167         if (!skb)
1168                 return -ENOMEM;
1169         return auditd_send_unicast_skb(skb);
1170 }
1171 
1172 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
1173 {
1174         u32                     seq;
1175         void                    *data;
1176         int                     data_len;
1177         int                     err;
1178         struct audit_buffer     *ab;
1179         u16                     msg_type = nlh->nlmsg_type;
1180         struct audit_sig_info   *sig_data;
1181         char                    *ctx = NULL;
1182         u32                     len;
1183 
1184         err = audit_netlink_ok(skb, msg_type);
1185         if (err)
1186                 return err;
1187 
1188         seq  = nlh->nlmsg_seq;
1189         data = nlmsg_data(nlh);
1190         data_len = nlmsg_len(nlh);
1191 
1192         switch (msg_type) {
1193         case AUDIT_GET: {
1194                 struct audit_status     s;
1195                 memset(&s, 0, sizeof(s));
1196                 s.enabled               = audit_enabled;
1197                 s.failure               = audit_failure;
1198                 /* NOTE: use pid_vnr() so the PID is relative to the current
1199                  *       namespace */
1200                 s.pid                   = auditd_pid_vnr();
1201                 s.rate_limit            = audit_rate_limit;
1202                 s.backlog_limit         = audit_backlog_limit;
1203                 s.lost                  = atomic_read(&audit_lost);
1204                 s.backlog               = skb_queue_len(&audit_queue);
1205                 s.feature_bitmap        = AUDIT_FEATURE_BITMAP_ALL;
1206                 s.backlog_wait_time     = audit_backlog_wait_time;
1207                 audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &s, sizeof(s));
1208                 break;
1209         }
1210         case AUDIT_SET: {
1211                 struct audit_status     s;
1212                 memset(&s, 0, sizeof(s));
1213                 /* guard against past and future API changes */
1214                 memcpy(&s, data, min_t(size_t, sizeof(s), data_len));
1215                 if (s.mask & AUDIT_STATUS_ENABLED) {
1216                         err = audit_set_enabled(s.enabled);
1217                         if (err < 0)
1218                                 return err;
1219                 }
1220                 if (s.mask & AUDIT_STATUS_FAILURE) {
1221                         err = audit_set_failure(s.failure);
1222                         if (err < 0)
1223                                 return err;
1224                 }
1225                 if (s.mask & AUDIT_STATUS_PID) {
1226                         /* NOTE: we are using the vnr PID functions below
1227                          *       because the s.pid value is relative to the
1228                          *       namespace of the caller; at present this
1229                          *       doesn't matter much since you can really only
1230                          *       run auditd from the initial pid namespace, but
1231                          *       something to keep in mind if this changes */
1232                         pid_t new_pid = s.pid;
1233                         pid_t auditd_pid;
1234                         struct pid *req_pid = task_tgid(current);
1235 
1236                         /* Sanity check - PID values must match. Setting
1237                          * pid to 0 is how auditd ends auditing. */
1238                         if (new_pid && (new_pid != pid_vnr(req_pid)))
1239                                 return -EINVAL;
1240 
1241                         /* test the auditd connection */
1242                         audit_replace(req_pid);
1243 
1244                         auditd_pid = auditd_pid_vnr();
1245                         if (auditd_pid) {
1246                                 /* replacing a healthy auditd is not allowed */
1247                                 if (new_pid) {
1248                                         audit_log_config_change("audit_pid",
1249                                                         new_pid, auditd_pid, 0);
1250                                         return -EEXIST;
1251                                 }
1252                                 /* only current auditd can unregister itself */
1253                                 if (pid_vnr(req_pid) != auditd_pid) {
1254                                         audit_log_config_change("audit_pid",
1255                                                         new_pid, auditd_pid, 0);
1256                                         return -EACCES;
1257                                 }
1258                         }
1259 
1260                         if (new_pid) {
1261                                 /* register a new auditd connection */
1262                                 err = auditd_set(req_pid,
1263                                                  NETLINK_CB(skb).portid,
1264                                                  sock_net(NETLINK_CB(skb).sk));
1265                                 if (audit_enabled != AUDIT_OFF)
1266                                         audit_log_config_change("audit_pid",
1267                                                                 new_pid,
1268                                                                 auditd_pid,
1269                                                                 err ? 0 : 1);
1270                                 if (err)
1271                                         return err;
1272 
1273                                 /* try to process any backlog */
1274                                 wake_up_interruptible(&kauditd_wait);
1275                         } else {
1276                                 if (audit_enabled != AUDIT_OFF)
1277                                         audit_log_config_change("audit_pid",
1278                                                                 new_pid,
1279                                                                 auditd_pid, 1);
1280 
1281                                 /* unregister the auditd connection */
1282                                 auditd_reset(NULL);
1283                         }
1284                 }
1285                 if (s.mask & AUDIT_STATUS_RATE_LIMIT) {
1286                         err = audit_set_rate_limit(s.rate_limit);
1287                         if (err < 0)
1288                                 return err;
1289                 }
1290                 if (s.mask & AUDIT_STATUS_BACKLOG_LIMIT) {
1291                         err = audit_set_backlog_limit(s.backlog_limit);
1292                         if (err < 0)
1293                                 return err;
1294                 }
1295                 if (s.mask & AUDIT_STATUS_BACKLOG_WAIT_TIME) {
1296                         if (sizeof(s) > (size_t)nlh->nlmsg_len)
1297                                 return -EINVAL;
1298                         if (s.backlog_wait_time > 10*AUDIT_BACKLOG_WAIT_TIME)
1299                                 return -EINVAL;
1300                         err = audit_set_backlog_wait_time(s.backlog_wait_time);
1301                         if (err < 0)
1302                                 return err;
1303                 }
1304                 if (s.mask == AUDIT_STATUS_LOST) {
1305                         u32 lost = atomic_xchg(&audit_lost, 0);
1306 
1307                         audit_log_config_change("lost", 0, lost, 1);
1308                         return lost;
1309                 }
1310                 break;
1311         }
1312         case AUDIT_GET_FEATURE:
1313                 err = audit_get_feature(skb);
1314                 if (err)
1315                         return err;
1316                 break;
1317         case AUDIT_SET_FEATURE:
1318                 if (data_len < sizeof(struct audit_features))
1319                         return -EINVAL;
1320                 err = audit_set_feature(data);
1321                 if (err)
1322                         return err;
1323                 break;
1324         case AUDIT_USER:
1325         case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
1326         case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
1327                 if (!audit_enabled && msg_type != AUDIT_USER_AVC)
1328                         return 0;
1329                 /* exit early if there isn't at least one character to print */
1330                 if (data_len < 2)
1331                         return -EINVAL;
1332 
1333                 err = audit_filter(msg_type, AUDIT_FILTER_USER);
1334                 if (err == 1) { /* match or error */
1335                         char *str = data;
1336 
1337                         err = 0;
1338                         if (msg_type == AUDIT_USER_TTY) {
1339                                 err = tty_audit_push();
1340                                 if (err)
1341                                         break;
1342                         }
1343                         audit_log_user_recv_msg(&ab, msg_type);
1344                         if (msg_type != AUDIT_USER_TTY) {
1345                                 /* ensure NULL termination */
1346                                 str[data_len - 1] = '\0';
1347                                 audit_log_format(ab, " msg='%.*s'",
1348                                                  AUDIT_MESSAGE_TEXT_MAX,
1349                                                  str);
1350                         } else {
1351                                 audit_log_format(ab, " data=");
1352                                 if (data_len > 0 && str[data_len - 1] == '\0')
1353                                         data_len--;
1354                                 audit_log_n_untrustedstring(ab, str, data_len);
1355                         }
1356                         audit_log_end(ab);
1357                 }
1358                 break;
1359         case AUDIT_ADD_RULE:
1360         case AUDIT_DEL_RULE:
1361                 if (data_len < sizeof(struct audit_rule_data))
1362                         return -EINVAL;
1363                 if (audit_enabled == AUDIT_LOCKED) {
1364                         audit_log_common_recv_msg(audit_context(), &ab,
1365                                                   AUDIT_CONFIG_CHANGE);
1366                         audit_log_format(ab, " op=%s audit_enabled=%d res=0",
1367                                          msg_type == AUDIT_ADD_RULE ?
1368                                                 "add_rule" : "remove_rule",
1369                                          audit_enabled);
1370                         audit_log_end(ab);
1371                         return -EPERM;
1372                 }
1373                 err = audit_rule_change(msg_type, seq, data, data_len);
1374                 break;
1375         case AUDIT_LIST_RULES:
1376                 err = audit_list_rules_send(skb, seq);
1377                 break;
1378         case AUDIT_TRIM:
1379                 audit_trim_trees();
1380                 audit_log_common_recv_msg(audit_context(), &ab,
1381                                           AUDIT_CONFIG_CHANGE);
1382                 audit_log_format(ab, " op=trim res=1");
1383                 audit_log_end(ab);
1384                 break;
1385         case AUDIT_MAKE_EQUIV: {
1386                 void *bufp = data;
1387                 u32 sizes[2];
1388                 size_t msglen = data_len;
1389                 char *old, *new;
1390 
1391                 err = -EINVAL;
1392                 if (msglen < 2 * sizeof(u32))
1393                         break;
1394                 memcpy(sizes, bufp, 2 * sizeof(u32));
1395                 bufp += 2 * sizeof(u32);
1396                 msglen -= 2 * sizeof(u32);
1397                 old = audit_unpack_string(&bufp, &msglen, sizes[0]);
1398                 if (IS_ERR(old)) {
1399                         err = PTR_ERR(old);
1400                         break;
1401                 }
1402                 new = audit_unpack_string(&bufp, &msglen, sizes[1]);
1403                 if (IS_ERR(new)) {
1404                         err = PTR_ERR(new);
1405                         kfree(old);
1406                         break;
1407                 }
1408                 /* OK, here comes... */
1409                 err = audit_tag_tree(old, new);
1410 
1411                 audit_log_common_recv_msg(audit_context(), &ab,
1412                                           AUDIT_CONFIG_CHANGE);
1413                 audit_log_format(ab, " op=make_equiv old=");
1414                 audit_log_untrustedstring(ab, old);
1415                 audit_log_format(ab, " new=");
1416                 audit_log_untrustedstring(ab, new);
1417                 audit_log_format(ab, " res=%d", !err);
1418                 audit_log_end(ab);
1419                 kfree(old);
1420                 kfree(new);
1421                 break;
1422         }
1423         case AUDIT_SIGNAL_INFO:
1424                 len = 0;
1425                 if (audit_sig_sid) {
1426                         err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
1427                         if (err)
1428                                 return err;
1429                 }
1430                 sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
1431                 if (!sig_data) {
1432                         if (audit_sig_sid)
1433                                 security_release_secctx(ctx, len);
1434                         return -ENOMEM;
1435                 }
1436                 sig_data->uid = from_kuid(&init_user_ns, audit_sig_uid);
1437                 sig_data->pid = audit_sig_pid;
1438                 if (audit_sig_sid) {
1439                         memcpy(sig_data->ctx, ctx, len);
1440                         security_release_secctx(ctx, len);
1441                 }
1442                 audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0,
1443                                  sig_data, sizeof(*sig_data) + len);
1444                 kfree(sig_data);
1445                 break;
1446         case AUDIT_TTY_GET: {
1447                 struct audit_tty_status s;
1448                 unsigned int t;
1449 
1450                 t = READ_ONCE(current->signal->audit_tty);
1451                 s.enabled = t & AUDIT_TTY_ENABLE;
1452                 s.log_passwd = !!(t & AUDIT_TTY_LOG_PASSWD);
1453 
1454                 audit_send_reply(skb, seq, AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
1455                 break;
1456         }
1457         case AUDIT_TTY_SET: {
1458                 struct audit_tty_status s, old;
1459                 struct audit_buffer     *ab;
1460                 unsigned int t;
1461 
1462                 memset(&s, 0, sizeof(s));
1463                 /* guard against past and future API changes */
1464                 memcpy(&s, data, min_t(size_t, sizeof(s), data_len));
1465                 /* check if new data is valid */
1466                 if ((s.enabled != 0 && s.enabled != 1) ||
1467                     (s.log_passwd != 0 && s.log_passwd != 1))
1468                         err = -EINVAL;
1469 
1470                 if (err)
1471                         t = READ_ONCE(current->signal->audit_tty);
1472                 else {
1473                         t = s.enabled | (-s.log_passwd & AUDIT_TTY_LOG_PASSWD);
1474                         t = xchg(&current->signal->audit_tty, t);
1475                 }
1476                 old.enabled = t & AUDIT_TTY_ENABLE;
1477                 old.log_passwd = !!(t & AUDIT_TTY_LOG_PASSWD);
1478 
1479                 audit_log_common_recv_msg(audit_context(), &ab,
1480                                           AUDIT_CONFIG_CHANGE);
1481                 audit_log_format(ab, " op=tty_set old-enabled=%d new-enabled=%d"
1482                                  " old-log_passwd=%d new-log_passwd=%d res=%d",
1483                                  old.enabled, s.enabled, old.log_passwd,
1484                                  s.log_passwd, !err);
1485                 audit_log_end(ab);
1486                 break;
1487         }
1488         default:
1489                 err = -EINVAL;
1490                 break;
1491         }
1492 
1493         return err < 0 ? err : 0;
1494 }
1495 
1496 /**
1497  * audit_receive - receive messages from a netlink control socket
1498  * @skb: the message buffer
1499  *
1500  * Parse the provided skb and deal with any messages that may be present,
1501  * malformed skbs are discarded.
1502  */
1503 static void audit_receive(struct sk_buff  *skb)
1504 {
1505         struct nlmsghdr *nlh;
1506         /*
1507          * len MUST be signed for nlmsg_next to be able to dec it below 0
1508          * if the nlmsg_len was not aligned
1509          */
1510         int len;
1511         int err;
1512 
1513         nlh = nlmsg_hdr(skb);
1514         len = skb->len;
1515 
1516         audit_ctl_lock();
1517         while (nlmsg_ok(nlh, len)) {
1518                 err = audit_receive_msg(skb, nlh);
1519                 /* if err or if this message says it wants a response */
1520                 if (err || (nlh->nlmsg_flags & NLM_F_ACK))
1521                         netlink_ack(skb, nlh, err, NULL);
1522 
1523                 nlh = nlmsg_next(nlh, &len);
1524         }
1525         audit_ctl_unlock();
1526 }
1527 
1528 /* Run custom bind function on netlink socket group connect or bind requests. */
1529 static int audit_bind(struct net *net, int group)
1530 {
1531         if (!capable(CAP_AUDIT_READ))
1532                 return -EPERM;
1533 
1534         return 0;
1535 }
1536 
1537 static int __net_init audit_net_init(struct net *net)
1538 {
1539         struct netlink_kernel_cfg cfg = {
1540                 .input  = audit_receive,
1541                 .bind   = audit_bind,
1542                 .flags  = NL_CFG_F_NONROOT_RECV,
1543                 .groups = AUDIT_NLGRP_MAX,
1544         };
1545 
1546         struct audit_net *aunet = net_generic(net, audit_net_id);
1547 
1548         aunet->sk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg);
1549         if (aunet->sk == NULL) {
1550                 audit_panic("cannot initialize netlink socket in namespace");
1551                 return -ENOMEM;
1552         }
1553         aunet->sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
1554 
1555         return 0;
1556 }
1557 
1558 static void __net_exit audit_net_exit(struct net *net)
1559 {
1560         struct audit_net *aunet = net_generic(net, audit_net_id);
1561 
1562         /* NOTE: you would think that we would want to check the auditd
1563          * connection and potentially reset it here if it lives in this
1564          * namespace, but since the auditd connection tracking struct holds a
1565          * reference to this namespace (see auditd_set()) we are only ever
1566          * going to get here after that connection has been released */
1567 
1568         netlink_kernel_release(aunet->sk);
1569 }
1570 
1571 static struct pernet_operations audit_net_ops __net_initdata = {
1572         .init = audit_net_init,
1573         .exit = audit_net_exit,
1574         .id = &audit_net_id,
1575         .size = sizeof(struct audit_net),
1576 };
1577 
1578 /* Initialize audit support at boot time. */
1579 static int __init audit_init(void)
1580 {
1581         int i;
1582 
1583         if (audit_initialized == AUDIT_DISABLED)
1584                 return 0;
1585 
1586         audit_buffer_cache = kmem_cache_create("audit_buffer",
1587                                                sizeof(struct audit_buffer),
1588                                                0, SLAB_PANIC, NULL);
1589 
1590         skb_queue_head_init(&audit_queue);
1591         skb_queue_head_init(&audit_retry_queue);
1592         skb_queue_head_init(&audit_hold_queue);
1593 
1594         for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
1595                 INIT_LIST_HEAD(&audit_inode_hash[i]);
1596 
1597         mutex_init(&audit_cmd_mutex.lock);
1598         audit_cmd_mutex.owner = NULL;
1599 
1600         pr_info("initializing netlink subsys (%s)\n",
1601                 audit_default ? "enabled" : "disabled");
1602         register_pernet_subsys(&audit_net_ops);
1603 
1604         audit_initialized = AUDIT_INITIALIZED;
1605 
1606         kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
1607         if (IS_ERR(kauditd_task)) {
1608                 int err = PTR_ERR(kauditd_task);
1609                 panic("audit: failed to start the kauditd thread (%d)\n", err);
1610         }
1611 
1612         audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL,
1613                 "state=initialized audit_enabled=%u res=1",
1614                  audit_enabled);
1615 
1616         return 0;
1617 }
1618 postcore_initcall(audit_init);
1619 
1620 /*
1621  * Process kernel command-line parameter at boot time.
1622  * audit={0|off} or audit={1|on}.
1623  */
1624 static int __init audit_enable(char *str)
1625 {
1626         if (!strcasecmp(str, "off") || !strcmp(str, ""))
1627                 audit_default = AUDIT_OFF;
1628         else if (!strcasecmp(str, "on") || !strcmp(str, "1"))
1629                 audit_default = AUDIT_ON;
1630         else {
1631                 pr_err("audit: invalid 'audit' parameter value (%s)\n", str);
1632                 audit_default = AUDIT_ON;
1633         }
1634 
1635         if (audit_default == AUDIT_OFF)
1636                 audit_initialized = AUDIT_DISABLED;
1637         if (audit_set_enabled(audit_default))
1638                 pr_err("audit: error setting audit state (%d)\n",
1639                        audit_default);
1640 
1641         pr_info("%s\n", audit_default ?
1642                 "enabled (after initialization)" : "disabled (until reboot)");
1643 
1644         return 1;
1645 }
1646 __setup("audit=", audit_enable);
1647 
1648 /* Process kernel command-line parameter at boot time.
1649  * audit_backlog_limit=<n> */
1650 static int __init audit_backlog_limit_set(char *str)
1651 {
1652         u32 audit_backlog_limit_arg;
1653 
1654         pr_info("audit_backlog_limit: ");
1655         if (kstrtouint(str, 0, &audit_backlog_limit_arg)) {
1656                 pr_cont("using default of %u, unable to parse %s\n",
1657                         audit_backlog_limit, str);
1658                 return 1;
1659         }
1660 
1661         audit_backlog_limit = audit_backlog_limit_arg;
1662         pr_cont("%d\n", audit_backlog_limit);
1663 
1664         return 1;
1665 }
1666 __setup("audit_backlog_limit=", audit_backlog_limit_set);
1667 
1668 static void audit_buffer_free(struct audit_buffer *ab)
1669 {
1670         if (!ab)
1671                 return;
1672 
1673         kfree_skb(ab->skb);
1674         kmem_cache_free(audit_buffer_cache, ab);
1675 }
1676 
1677 static struct audit_buffer *audit_buffer_alloc(struct audit_context *ctx,
1678                                                gfp_t gfp_mask, int type)
1679 {
1680         struct audit_buffer *ab;
1681 
1682         ab = kmem_cache_alloc(audit_buffer_cache, gfp_mask);
1683         if (!ab)
1684                 return NULL;
1685 
1686         ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask);
1687         if (!ab->skb)
1688                 goto err;
1689         if (!nlmsg_put(ab->skb, 0, 0, type, 0, 0))
1690                 goto err;
1691 
1692         ab->ctx = ctx;
1693         ab->gfp_mask = gfp_mask;
1694 
1695         return ab;
1696 
1697 err:
1698         audit_buffer_free(ab);
1699         return NULL;
1700 }
1701 
1702 /**
1703  * audit_serial - compute a serial number for the audit record
1704  *
1705  * Compute a serial number for the audit record.  Audit records are
1706  * written to user-space as soon as they are generated, so a complete
1707  * audit record may be written in several pieces.  The timestamp of the
1708  * record and this serial number are used by the user-space tools to
1709  * determine which pieces belong to the same audit record.  The
1710  * (timestamp,serial) tuple is unique for each syscall and is live from
1711  * syscall entry to syscall exit.
1712  *
1713  * NOTE: Another possibility is to store the formatted records off the
1714  * audit context (for those records that have a context), and emit them
1715  * all at syscall exit.  However, this could delay the reporting of
1716  * significant errors until syscall exit (or never, if the system
1717  * halts).
1718  */
1719 unsigned int audit_serial(void)
1720 {
1721         static atomic_t serial = ATOMIC_INIT(0);
1722 
1723         return atomic_add_return(1, &serial);
1724 }
1725 
1726 static inline void audit_get_stamp(struct audit_context *ctx,
1727                                    struct timespec64 *t, unsigned int *serial)
1728 {
1729         if (!ctx || !auditsc_get_stamp(ctx, t, serial)) {
1730                 ktime_get_coarse_real_ts64(t);
1731                 *serial = audit_serial();
1732         }
1733 }
1734 
1735 /**
1736  * audit_log_start - obtain an audit buffer
1737  * @ctx: audit_context (may be NULL)
1738  * @gfp_mask: type of allocation
1739  * @type: audit message type
1740  *
1741  * Returns audit_buffer pointer on success or NULL on error.
1742  *
1743  * Obtain an audit buffer.  This routine does locking to obtain the
1744  * audit buffer, but then no locking is required for calls to
1745  * audit_log_*format.  If the task (ctx) is a task that is currently in a
1746  * syscall, then the syscall is marked as auditable and an audit record
1747  * will be written at syscall exit.  If there is no associated task, then
1748  * task context (ctx) should be NULL.
1749  */
1750 struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
1751                                      int type)
1752 {
1753         struct audit_buffer *ab;
1754         struct timespec64 t;
1755         unsigned int uninitialized_var(serial);
1756 
1757         if (audit_initialized != AUDIT_INITIALIZED)
1758                 return NULL;
1759 
1760         if (unlikely(!audit_filter(type, AUDIT_FILTER_EXCLUDE)))
1761                 return NULL;
1762 
1763         /* NOTE: don't ever fail/sleep on these two conditions:
1764          * 1. auditd generated record - since we need auditd to drain the
1765          *    queue; also, when we are checking for auditd, compare PIDs using
1766          *    task_tgid_vnr() since auditd_pid is set in audit_receive_msg()
1767          *    using a PID anchored in the caller's namespace
1768          * 2. generator holding the audit_cmd_mutex - we don't want to block
1769          *    while holding the mutex */
1770         if (!(auditd_test_task(current) || audit_ctl_owner_current())) {
1771                 long stime = audit_backlog_wait_time;
1772 
1773                 while (audit_backlog_limit &&
1774                        (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
1775                         /* wake kauditd to try and flush the queue */
1776                         wake_up_interruptible(&kauditd_wait);
1777 
1778                         /* sleep if we are allowed and we haven't exhausted our
1779                          * backlog wait limit */
1780                         if (gfpflags_allow_blocking(gfp_mask) && (stime > 0)) {
1781                                 DECLARE_WAITQUEUE(wait, current);
1782 
1783                                 add_wait_queue_exclusive(&audit_backlog_wait,
1784                                                          &wait);
1785                                 set_current_state(TASK_UNINTERRUPTIBLE);
1786                                 stime = schedule_timeout(stime);
1787                                 remove_wait_queue(&audit_backlog_wait, &wait);
1788                         } else {
1789                                 if (audit_rate_check() && printk_ratelimit())
1790                                         pr_warn("audit_backlog=%d > audit_backlog_limit=%d\n",
1791                                                 skb_queue_len(&audit_queue),
1792                                                 audit_backlog_limit);
1793                                 audit_log_lost("backlog limit exceeded");
1794                                 return NULL;
1795                         }
1796                 }
1797         }
1798 
1799         ab = audit_buffer_alloc(ctx, gfp_mask, type);
1800         if (!ab) {
1801                 audit_log_lost("out of memory in audit_log_start");
1802                 return NULL;
1803         }
1804 
1805         audit_get_stamp(ab->ctx, &t, &serial);
1806         audit_log_format(ab, "audit(%llu.%03lu:%u): ",
1807                          (unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial);
1808 
1809         return ab;
1810 }
1811 
1812 /**
1813  * audit_expand - expand skb in the audit buffer
1814  * @ab: audit_buffer
1815  * @extra: space to add at tail of the skb
1816  *
1817  * Returns 0 (no space) on failed expansion, or available space if
1818  * successful.
1819  */
1820 static inline int audit_expand(struct audit_buffer *ab, int extra)
1821 {
1822         struct sk_buff *skb = ab->skb;
1823         int oldtail = skb_tailroom(skb);
1824         int ret = pskb_expand_head(skb, 0, extra, ab->gfp_mask);
1825         int newtail = skb_tailroom(skb);
1826 
1827         if (ret < 0) {
1828                 audit_log_lost("out of memory in audit_expand");
1829                 return 0;
1830         }
1831 
1832         skb->truesize += newtail - oldtail;
1833         return newtail;
1834 }
1835 
1836 /*
1837  * Format an audit message into the audit buffer.  If there isn't enough
1838  * room in the audit buffer, more room will be allocated and vsnprint
1839  * will be called a second time.  Currently, we assume that a printk
1840  * can't format message larger than 1024 bytes, so we don't either.
1841  */
1842 static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
1843                               va_list args)
1844 {
1845         int len, avail;
1846         struct sk_buff *skb;
1847         va_list args2;
1848 
1849         if (!ab)
1850                 return;
1851 
1852         BUG_ON(!ab->skb);
1853         skb = ab->skb;
1854         avail = skb_tailroom(skb);
1855         if (avail == 0) {
1856                 avail = audit_expand(ab, AUDIT_BUFSIZ);
1857                 if (!avail)
1858                         goto out;
1859         }
1860         va_copy(args2, args);
1861         len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args);
1862         if (len >= avail) {
1863                 /* The printk buffer is 1024 bytes long, so if we get
1864                  * here and AUDIT_BUFSIZ is at least 1024, then we can
1865                  * log everything that printk could have logged. */
1866                 avail = audit_expand(ab,
1867                         max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
1868                 if (!avail)
1869                         goto out_va_end;
1870                 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
1871         }
1872         if (len > 0)
1873                 skb_put(skb, len);
1874 out_va_end:
1875         va_end(args2);
1876 out:
1877         return;
1878 }
1879 
1880 /**
1881  * audit_log_format - format a message into the audit buffer.
1882  * @ab: audit_buffer
1883  * @fmt: format string
1884  * @...: optional parameters matching @fmt string
1885  *
1886  * All the work is done in audit_log_vformat.
1887  */
1888 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
1889 {
1890         va_list args;
1891 
1892         if (!ab)
1893                 return;
1894         va_start(args, fmt);
1895         audit_log_vformat(ab, fmt, args);
1896         va_end(args);
1897 }
1898 
1899 /**
1900  * audit_log_n_hex - convert a buffer to hex and append it to the audit skb
1901  * @ab: the audit_buffer
1902  * @buf: buffer to convert to hex
1903  * @len: length of @buf to be converted
1904  *
1905  * No return value; failure to expand is silently ignored.
1906  *
1907  * This function will take the passed buf and convert it into a string of
1908  * ascii hex digits. The new string is placed onto the skb.
1909  */
1910 void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
1911                 size_t len)
1912 {
1913         int i, avail, new_len;
1914         unsigned char *ptr;
1915         struct sk_buff *skb;
1916 
1917         if (!ab)
1918                 return;
1919 
1920         BUG_ON(!ab->skb);
1921         skb = ab->skb;
1922         avail = skb_tailroom(skb);
1923         new_len = len<<1;
1924         if (new_len >= avail) {
1925                 /* Round the buffer request up to the next multiple */
1926                 new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
1927                 avail = audit_expand(ab, new_len);
1928                 if (!avail)
1929                         return;
1930         }
1931 
1932         ptr = skb_tail_pointer(skb);
1933         for (i = 0; i < len; i++)
1934                 ptr = hex_byte_pack_upper(ptr, buf[i]);
1935         *ptr = 0;
1936         skb_put(skb, len << 1); /* new string is twice the old string */
1937 }
1938 
1939 /*
1940  * Format a string of no more than slen characters into the audit buffer,
1941  * enclosed in quote marks.
1942  */
1943 void audit_log_n_string(struct audit_buffer *ab, const char *string,
1944                         size_t slen)
1945 {
1946         int avail, new_len;
1947         unsigned char *ptr;
1948         struct sk_buff *skb;
1949 
1950         if (!ab)
1951                 return;
1952 
1953         BUG_ON(!ab->skb);
1954         skb = ab->skb;
1955         avail = skb_tailroom(skb);
1956         new_len = slen + 3;     /* enclosing quotes + null terminator */
1957         if (new_len > avail) {
1958                 avail = audit_expand(ab, new_len);
1959                 if (!avail)
1960                         return;
1961         }
1962         ptr = skb_tail_pointer(skb);
1963         *ptr++ = '"';
1964         memcpy(ptr, string, slen);
1965         ptr += slen;
1966         *ptr++ = '"';
1967         *ptr = 0;
1968         skb_put(skb, slen + 2); /* don't include null terminator */
1969 }
1970 
1971 /**
1972  * audit_string_contains_control - does a string need to be logged in hex
1973  * @string: string to be checked
1974  * @len: max length of the string to check
1975  */
1976 bool audit_string_contains_control(const char *string, size_t len)
1977 {
1978         const unsigned char *p;
1979         for (p = string; p < (const unsigned char *)string + len; p++) {
1980                 if (*p == '"' || *p < 0x21 || *p > 0x7e)
1981                         return true;
1982         }
1983         return false;
1984 }
1985 
1986 /**
1987  * audit_log_n_untrustedstring - log a string that may contain random characters
1988  * @ab: audit_buffer
1989  * @len: length of string (not including trailing null)
1990  * @string: string to be logged
1991  *
1992  * This code will escape a string that is passed to it if the string
1993  * contains a control character, unprintable character, double quote mark,
1994  * or a space. Unescaped strings will start and end with a double quote mark.
1995  * Strings that are escaped are printed in hex (2 digits per char).
1996  *
1997  * The caller specifies the number of characters in the string to log, which may
1998  * or may not be the entire string.
1999  */
2000 void audit_log_n_untrustedstring(struct audit_buffer *ab, const char *string,
2001                                  size_t len)
2002 {
2003         if (audit_string_contains_control(string, len))
2004                 audit_log_n_hex(ab, string, len);
2005         else
2006                 audit_log_n_string(ab, string, len);
2007 }
2008 
2009 /**
2010  * audit_log_untrustedstring - log a string that may contain random characters
2011  * @ab: audit_buffer
2012  * @string: string to be logged
2013  *
2014  * Same as audit_log_n_untrustedstring(), except that strlen is used to
2015  * determine string length.
2016  */
2017 void audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
2018 {
2019         audit_log_n_untrustedstring(ab, string, strlen(string));
2020 }
2021 
2022 /* This is a helper-function to print the escaped d_path */
2023 void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
2024                       const struct path *path)
2025 {
2026         char *p, *pathname;
2027 
2028         if (prefix)
2029                 audit_log_format(ab, "%s", prefix);
2030 
2031         /* We will allow 11 spaces for ' (deleted)' to be appended */
2032         pathname = kmalloc(PATH_MAX+11, ab->gfp_mask);
2033         if (!pathname) {
2034                 audit_log_string(ab, "<no_memory>");
2035                 return;
2036         }
2037         p = d_path(path, pathname, PATH_MAX+11);
2038         if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */
2039                 /* FIXME: can we save some information here? */
2040                 audit_log_string(ab, "<too_long>");
2041         } else
2042                 audit_log_untrustedstring(ab, p);
2043         kfree(pathname);
2044 }
2045 
2046 void audit_log_session_info(struct audit_buffer *ab)
2047 {
2048         unsigned int sessionid = audit_get_sessionid(current);
2049         uid_t auid = from_kuid(&init_user_ns, audit_get_loginuid(current));
2050 
2051         audit_log_format(ab, "auid=%u ses=%u", auid, sessionid);
2052 }
2053 
2054 void audit_log_key(struct audit_buffer *ab, char *key)
2055 {
2056         audit_log_format(ab, " key=");
2057         if (key)
2058                 audit_log_untrustedstring(ab, key);
2059         else
2060                 audit_log_format(ab, "(null)");
2061 }
2062 
2063 int audit_log_task_context(struct audit_buffer *ab)
2064 {
2065         char *ctx = NULL;
2066         unsigned len;
2067         int error;
2068         u32 sid;
2069 
2070         security_task_getsecid(current, &sid);
2071         if (!sid)
2072                 return 0;
2073 
2074         error = security_secid_to_secctx(sid, &ctx, &len);
2075         if (error) {
2076                 if (error != -EINVAL)
2077                         goto error_path;
2078                 return 0;
2079         }
2080 
2081         audit_log_format(ab, " subj=%s", ctx);
2082         security_release_secctx(ctx, len);
2083         return 0;
2084 
2085 error_path:
2086         audit_panic("error in audit_log_task_context");
2087         return error;
2088 }
2089 EXPORT_SYMBOL(audit_log_task_context);
2090 
2091 void audit_log_d_path_exe(struct audit_buffer *ab,
2092                           struct mm_struct *mm)
2093 {
2094         struct file *exe_file;
2095 
2096         if (!mm)
2097                 goto out_null;
2098 
2099         exe_file = get_mm_exe_file(mm);
2100         if (!exe_file)
2101                 goto out_null;
2102 
2103         audit_log_d_path(ab, " exe=", &exe_file->f_path);
2104         fput(exe_file);
2105         return;
2106 out_null:
2107         audit_log_format(ab, " exe=(null)");
2108 }
2109 
2110 struct tty_struct *audit_get_tty(void)
2111 {
2112         struct tty_struct *tty = NULL;
2113         unsigned long flags;
2114 
2115         spin_lock_irqsave(&current->sighand->siglock, flags);
2116         if (current->signal)
2117                 tty = tty_kref_get(current->signal->tty);
2118         spin_unlock_irqrestore(&current->sighand->siglock, flags);
2119         return tty;
2120 }
2121 
2122 void audit_put_tty(struct tty_struct *tty)
2123 {
2124         tty_kref_put(tty);
2125 }
2126 
2127 void audit_log_task_info(struct audit_buffer *ab)
2128 {
2129         const struct cred *cred;
2130         char comm[sizeof(current->comm)];
2131         struct tty_struct *tty;
2132 
2133         if (!ab)
2134                 return;
2135 
2136         cred = current_cred();
2137         tty = audit_get_tty();
2138         audit_log_format(ab,
2139                          " ppid=%d pid=%d auid=%u uid=%u gid=%u"
2140                          " euid=%u suid=%u fsuid=%u"
2141                          " egid=%u sgid=%u fsgid=%u tty=%s ses=%u",
2142                          task_ppid_nr(current),
2143                          task_tgid_nr(current),
2144                          from_kuid(&init_user_ns, audit_get_loginuid(current)),
2145                          from_kuid(&init_user_ns, cred->uid),
2146                          from_kgid(&init_user_ns, cred->gid),
2147                          from_kuid(&init_user_ns, cred->euid),
2148                          from_kuid(&init_user_ns, cred->suid),
2149                          from_kuid(&init_user_ns, cred->fsuid),
2150                          from_kgid(&init_user_ns, cred->egid),
2151                          from_kgid(&init_user_ns, cred->sgid),
2152                          from_kgid(&init_user_ns, cred->fsgid),
2153                          tty ? tty_name(tty) : "(none)",
2154                          audit_get_sessionid(current));
2155         audit_put_tty(tty);
2156         audit_log_format(ab, " comm=");
2157         audit_log_untrustedstring(ab, get_task_comm(comm, current));
2158         audit_log_d_path_exe(ab, current->mm);
2159         audit_log_task_context(ab);
2160 }
2161 EXPORT_SYMBOL(audit_log_task_info);
2162 
2163 /**
2164  * audit_log_path_denied - report a path restriction denial
2165  * @type: audit message type (AUDIT_ANOM_LINK, AUDIT_ANOM_CREAT, etc)
2166  * @operation: specific operation name
2167  */
2168 void audit_log_path_denied(int type, const char *operation)
2169 {
2170         struct audit_buffer *ab;
2171 
2172         if (!audit_enabled || audit_dummy_context())
2173                 return;
2174 
2175         /* Generate log with subject, operation, outcome. */
2176         ab = audit_log_start(audit_context(), GFP_KERNEL, type);
2177         if (!ab)
2178                 return;
2179         audit_log_format(ab, "op=%s", operation);
2180         audit_log_task_info(ab);
2181         audit_log_format(ab, " res=0");
2182         audit_log_end(ab);
2183 }
2184 
2185 /* global counter which is incremented every time something logs in */
2186 static atomic_t session_id = ATOMIC_INIT(0);
2187 
2188 static int audit_set_loginuid_perm(kuid_t loginuid)
2189 {
2190         /* if we are unset, we don't need privs */
2191         if (!audit_loginuid_set(current))
2192                 return 0;
2193         /* if AUDIT_FEATURE_LOGINUID_IMMUTABLE means never ever allow a change*/
2194         if (is_audit_feature_set(AUDIT_FEATURE_LOGINUID_IMMUTABLE))
2195                 return -EPERM;
2196         /* it is set, you need permission */
2197         if (!capable(CAP_AUDIT_CONTROL))
2198                 return -EPERM;
2199         /* reject if this is not an unset and we don't allow that */
2200         if (is_audit_feature_set(AUDIT_FEATURE_ONLY_UNSET_LOGINUID)
2201                                  && uid_valid(loginuid))
2202                 return -EPERM;
2203         return 0;
2204 }
2205 
2206 static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid,
2207                                    unsigned int oldsessionid,
2208                                    unsigned int sessionid, int rc)
2209 {
2210         struct audit_buffer *ab;
2211         uid_t uid, oldloginuid, loginuid;
2212         struct tty_struct *tty;
2213 
2214         if (!audit_enabled)
2215                 return;
2216 
2217         ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_LOGIN);
2218         if (!ab)
2219                 return;
2220 
2221         uid = from_kuid(&init_user_ns, task_uid(current));
2222         oldloginuid = from_kuid(&init_user_ns, koldloginuid);
2223         loginuid = from_kuid(&init_user_ns, kloginuid),
2224         tty = audit_get_tty();
2225 
2226         audit_log_format(ab, "pid=%d uid=%u", task_tgid_nr(current), uid);
2227         audit_log_task_context(ab);
2228         audit_log_format(ab, " old-auid=%u auid=%u tty=%s old-ses=%u ses=%u res=%d",
2229                          oldloginuid, loginuid, tty ? tty_name(tty) : "(none)",
2230                          oldsessionid, sessionid, !rc);
2231         audit_put_tty(tty);
2232         audit_log_end(ab);
2233 }
2234 
2235 /**
2236  * audit_set_loginuid - set current task's loginuid
2237  * @loginuid: loginuid value
2238  *
2239  * Returns 0.
2240  *
2241  * Called (set) from fs/proc/base.c::proc_loginuid_write().
2242  */
2243 int audit_set_loginuid(kuid_t loginuid)
2244 {
2245         unsigned int oldsessionid, sessionid = AUDIT_SID_UNSET;
2246         kuid_t oldloginuid;
2247         int rc;
2248 
2249         oldloginuid = audit_get_loginuid(current);
2250         oldsessionid = audit_get_sessionid(current);
2251 
2252         rc = audit_set_loginuid_perm(loginuid);
2253         if (rc)
2254                 goto out;
2255 
2256         /* are we setting or clearing? */
2257         if (uid_valid(loginuid)) {
2258                 sessionid = (unsigned int)atomic_inc_return(&session_id);
2259                 if (unlikely(sessionid == AUDIT_SID_UNSET))
2260                         sessionid = (unsigned int)atomic_inc_return(&session_id);
2261         }
2262 
2263         current->sessionid = sessionid;
2264         current->loginuid = loginuid;
2265 out:
2266         audit_log_set_loginuid(oldloginuid, loginuid, oldsessionid, sessionid, rc);
2267         return rc;
2268 }
2269 
2270 /**
2271  * audit_signal_info - record signal info for shutting down audit subsystem
2272  * @sig: signal value
2273  * @t: task being signaled
2274  *
2275  * If the audit subsystem is being terminated, record the task (pid)
2276  * and uid that is doing that.
2277  */
2278 int audit_signal_info(int sig, struct task_struct *t)
2279 {
2280         kuid_t uid = current_uid(), auid;
2281 
2282         if (auditd_test_task(t) &&
2283             (sig == SIGTERM || sig == SIGHUP ||
2284              sig == SIGUSR1 || sig == SIGUSR2)) {
2285                 audit_sig_pid = task_tgid_nr(current);
2286                 auid = audit_get_loginuid(current);
2287                 if (uid_valid(auid))
2288                         audit_sig_uid = auid;
2289                 else
2290                         audit_sig_uid = uid;
2291                 security_task_getsecid(current, &audit_sig_sid);
2292         }
2293 
2294         return audit_signal_info_syscall(t);
2295 }
2296 
2297 /**
2298  * audit_log_end - end one audit record
2299  * @ab: the audit_buffer
2300  *
2301  * We can not do a netlink send inside an irq context because it blocks (last
2302  * arg, flags, is not set to MSG_DONTWAIT), so the audit buffer is placed on a
2303  * queue and a tasklet is scheduled to remove them from the queue outside the
2304  * irq context.  May be called in any context.
2305  */
2306 void audit_log_end(struct audit_buffer *ab)
2307 {
2308         struct sk_buff *skb;
2309         struct nlmsghdr *nlh;
2310 
2311         if (!ab)
2312                 return;
2313 
2314         if (audit_rate_check()) {
2315                 skb = ab->skb;
2316                 ab->skb = NULL;
2317 
2318                 /* setup the netlink header, see the comments in
2319                  * kauditd_send_multicast_skb() for length quirks */
2320                 nlh = nlmsg_hdr(skb);
2321                 nlh->nlmsg_len = skb->len - NLMSG_HDRLEN;
2322 
2323                 /* queue the netlink packet and poke the kauditd thread */
2324                 skb_queue_tail(&audit_queue, skb);
2325                 wake_up_interruptible(&kauditd_wait);
2326         } else
2327                 audit_log_lost("rate limit exceeded");
2328 
2329         audit_buffer_free(ab);
2330 }
2331 
2332 /**
2333  * audit_log - Log an audit record
2334  * @ctx: audit context
2335  * @gfp_mask: type of allocation
2336  * @type: audit message type
2337  * @fmt: format string to use
2338  * @...: variable parameters matching the format string
2339  *
2340  * This is a convenience function that calls audit_log_start,
2341  * audit_log_vformat, and audit_log_end.  It may be called
2342  * in any context.
2343  */
2344 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
2345                const char *fmt, ...)
2346 {
2347         struct audit_buffer *ab;
2348         va_list args;
2349 
2350         ab = audit_log_start(ctx, gfp_mask, type);
2351         if (ab) {
2352                 va_start(args, fmt);
2353                 audit_log_vformat(ab, fmt, args);
2354                 va_end(args);
2355                 audit_log_end(ab);
2356         }
2357 }
2358 
2359 EXPORT_SYMBOL(audit_log_start);
2360 EXPORT_SYMBOL(audit_log_end);
2361 EXPORT_SYMBOL(audit_log_format);
2362 EXPORT_SYMBOL(audit_log);
2363 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp