~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/include/linux/audit.h

Version: ~ [ linux-5.13-rc7 ] ~ [ linux-5.12.12 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.45 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.127 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.195 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.237 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.273 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.273 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* audit.h -- Auditing support
  2  *
  3  * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
  4  * All Rights Reserved.
  5  *
  6  * This program is free software; you can redistribute it and/or modify
  7  * it under the terms of the GNU General Public License as published by
  8  * the Free Software Foundation; either version 2 of the License, or
  9  * (at your option) any later version.
 10  *
 11  * This program is distributed in the hope that it will be useful,
 12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 14  * GNU General Public License for more details.
 15  *
 16  * You should have received a copy of the GNU General Public License
 17  * along with this program; if not, write to the Free Software
 18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 19  *
 20  * Written by Rickard E. (Rik) Faith <faith@redhat.com>
 21  *
 22  */
 23 #ifndef _LINUX_AUDIT_H_
 24 #define _LINUX_AUDIT_H_
 25 
 26 #include <linux/sched.h>
 27 #include <linux/ptrace.h>
 28 #include <uapi/linux/audit.h>
 29 
 30 struct audit_sig_info {
 31         uid_t           uid;
 32         pid_t           pid;
 33         char            ctx[0];
 34 };
 35 
 36 struct audit_buffer;
 37 struct audit_context;
 38 struct inode;
 39 struct netlink_skb_parms;
 40 struct path;
 41 struct linux_binprm;
 42 struct mq_attr;
 43 struct mqstat;
 44 struct audit_watch;
 45 struct audit_tree;
 46 struct sk_buff;
 47 
 48 struct audit_krule {
 49         int                     vers_ops;
 50         u32                     pflags;
 51         u32                     flags;
 52         u32                     listnr;
 53         u32                     action;
 54         u32                     mask[AUDIT_BITMASK_SIZE];
 55         u32                     buflen; /* for data alloc on list rules */
 56         u32                     field_count;
 57         char                    *filterkey; /* ties events to rules */
 58         struct audit_field      *fields;
 59         struct audit_field      *arch_f; /* quick access to arch field */
 60         struct audit_field      *inode_f; /* quick access to an inode field */
 61         struct audit_watch      *watch; /* associated watch */
 62         struct audit_tree       *tree;  /* associated watched tree */
 63         struct list_head        rlist;  /* entry in audit_{watch,tree}.rules list */
 64         struct list_head        list;   /* for AUDIT_LIST* purposes only */
 65         u64                     prio;
 66 };
 67 
 68 /* Flag to indicate legacy AUDIT_LOGINUID unset usage */
 69 #define AUDIT_LOGINUID_LEGACY           0x1
 70 
 71 struct audit_field {
 72         u32                             type;
 73         u32                             val;
 74         kuid_t                          uid;
 75         kgid_t                          gid;
 76         u32                             op;
 77         char                            *lsm_str;
 78         void                            *lsm_rule;
 79 };
 80 
 81 extern int is_audit_feature_set(int which);
 82 
 83 extern int __init audit_register_class(int class, unsigned *list);
 84 extern int audit_classify_syscall(int abi, unsigned syscall);
 85 extern int audit_classify_arch(int arch);
 86 
 87 /* audit_names->type values */
 88 #define AUDIT_TYPE_UNKNOWN      0       /* we don't know yet */
 89 #define AUDIT_TYPE_NORMAL       1       /* a "normal" audit record */
 90 #define AUDIT_TYPE_PARENT       2       /* a parent audit record */
 91 #define AUDIT_TYPE_CHILD_DELETE 3       /* a child being deleted */
 92 #define AUDIT_TYPE_CHILD_CREATE 4       /* a child being created */
 93 
 94 /* maximized args number that audit_socketcall can process */
 95 #define AUDITSC_ARGS            6
 96 
 97 struct filename;
 98 
 99 extern void audit_log_session_info(struct audit_buffer *ab);
100 
101 #ifdef CONFIG_AUDITSYSCALL
102 /* These are defined in auditsc.c */
103                                 /* Public API */
104 extern int  audit_alloc(struct task_struct *task);
105 extern void __audit_free(struct task_struct *task);
106 extern void __audit_syscall_entry(int arch,
107                                   int major, unsigned long a0, unsigned long a1,
108                                   unsigned long a2, unsigned long a3);
109 extern void __audit_syscall_exit(int ret_success, long ret_value);
110 extern struct filename *__audit_reusename(const __user char *uptr);
111 extern void __audit_getname(struct filename *name);
112 extern void audit_putname(struct filename *name);
113 
114 #define AUDIT_INODE_PARENT      1       /* dentry represents the parent */
115 #define AUDIT_INODE_HIDDEN      2       /* audit record should be hidden */
116 extern void __audit_inode(struct filename *name, const struct dentry *dentry,
117                                 unsigned int flags);
118 extern void __audit_inode_child(const struct inode *parent,
119                                 const struct dentry *dentry,
120                                 const unsigned char type);
121 extern void __audit_seccomp(unsigned long syscall, long signr, int code);
122 extern void __audit_ptrace(struct task_struct *t);
123 
124 static inline int audit_dummy_context(void)
125 {
126         void *p = current->audit_context;
127         return !p || *(int *)p;
128 }
129 static inline void audit_free(struct task_struct *task)
130 {
131         if (unlikely(task->audit_context))
132                 __audit_free(task);
133 }
134 static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
135                                        unsigned long a1, unsigned long a2,
136                                        unsigned long a3)
137 {
138         if (unlikely(current->audit_context))
139                 __audit_syscall_entry(arch, major, a0, a1, a2, a3);
140 }
141 static inline void audit_syscall_exit(void *pt_regs)
142 {
143         if (unlikely(current->audit_context)) {
144                 int success = is_syscall_success(pt_regs);
145                 long return_code = regs_return_value(pt_regs);
146 
147                 __audit_syscall_exit(success, return_code);
148         }
149 }
150 static inline struct filename *audit_reusename(const __user char *name)
151 {
152         if (unlikely(!audit_dummy_context()))
153                 return __audit_reusename(name);
154         return NULL;
155 }
156 static inline void audit_getname(struct filename *name)
157 {
158         if (unlikely(!audit_dummy_context()))
159                 __audit_getname(name);
160 }
161 static inline void audit_inode(struct filename *name,
162                                 const struct dentry *dentry,
163                                 unsigned int parent) {
164         if (unlikely(!audit_dummy_context())) {
165                 unsigned int flags = 0;
166                 if (parent)
167                         flags |= AUDIT_INODE_PARENT;
168                 __audit_inode(name, dentry, flags);
169         }
170 }
171 static inline void audit_inode_parent_hidden(struct filename *name,
172                                                 const struct dentry *dentry)
173 {
174         if (unlikely(!audit_dummy_context()))
175                 __audit_inode(name, dentry,
176                                 AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN);
177 }
178 static inline void audit_inode_child(const struct inode *parent,
179                                      const struct dentry *dentry,
180                                      const unsigned char type) {
181         if (unlikely(!audit_dummy_context()))
182                 __audit_inode_child(parent, dentry, type);
183 }
184 void audit_core_dumps(long signr);
185 
186 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
187 {
188         /* Force a record to be reported if a signal was delivered. */
189         if (signr || unlikely(!audit_dummy_context()))
190                 __audit_seccomp(syscall, signr, code);
191 }
192 
193 static inline void audit_ptrace(struct task_struct *t)
194 {
195         if (unlikely(!audit_dummy_context()))
196                 __audit_ptrace(t);
197 }
198 
199                                 /* Private API (for audit.c only) */
200 extern unsigned int audit_serial(void);
201 extern int auditsc_get_stamp(struct audit_context *ctx,
202                               struct timespec *t, unsigned int *serial);
203 extern int audit_set_loginuid(kuid_t loginuid);
204 
205 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
206 {
207         return tsk->loginuid;
208 }
209 
210 static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
211 {
212         return tsk->sessionid;
213 }
214 
215 extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);
216 extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode);
217 extern void __audit_bprm(struct linux_binprm *bprm);
218 extern int __audit_socketcall(int nargs, unsigned long *args);
219 extern int __audit_sockaddr(int len, void *addr);
220 extern void __audit_fd_pair(int fd1, int fd2);
221 extern void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr);
222 extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout);
223 extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification);
224 extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat);
225 extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
226                                   const struct cred *new,
227                                   const struct cred *old);
228 extern void __audit_log_capset(const struct cred *new, const struct cred *old);
229 extern void __audit_mmap_fd(int fd, int flags);
230 
231 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
232 {
233         if (unlikely(!audit_dummy_context()))
234                 __audit_ipc_obj(ipcp);
235 }
236 static inline void audit_fd_pair(int fd1, int fd2)
237 {
238         if (unlikely(!audit_dummy_context()))
239                 __audit_fd_pair(fd1, fd2);
240 }
241 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode)
242 {
243         if (unlikely(!audit_dummy_context()))
244                 __audit_ipc_set_perm(qbytes, uid, gid, mode);
245 }
246 static inline void audit_bprm(struct linux_binprm *bprm)
247 {
248         if (unlikely(!audit_dummy_context()))
249                 __audit_bprm(bprm);
250 }
251 static inline int audit_socketcall(int nargs, unsigned long *args)
252 {
253         if (unlikely(!audit_dummy_context()))
254                 return __audit_socketcall(nargs, args);
255         return 0;
256 }
257 static inline int audit_sockaddr(int len, void *addr)
258 {
259         if (unlikely(!audit_dummy_context()))
260                 return __audit_sockaddr(len, addr);
261         return 0;
262 }
263 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
264 {
265         if (unlikely(!audit_dummy_context()))
266                 __audit_mq_open(oflag, mode, attr);
267 }
268 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout)
269 {
270         if (unlikely(!audit_dummy_context()))
271                 __audit_mq_sendrecv(mqdes, msg_len, msg_prio, abs_timeout);
272 }
273 static inline void audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
274 {
275         if (unlikely(!audit_dummy_context()))
276                 __audit_mq_notify(mqdes, notification);
277 }
278 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
279 {
280         if (unlikely(!audit_dummy_context()))
281                 __audit_mq_getsetattr(mqdes, mqstat);
282 }
283 
284 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
285                                        const struct cred *new,
286                                        const struct cred *old)
287 {
288         if (unlikely(!audit_dummy_context()))
289                 return __audit_log_bprm_fcaps(bprm, new, old);
290         return 0;
291 }
292 
293 static inline void audit_log_capset(const struct cred *new,
294                                    const struct cred *old)
295 {
296         if (unlikely(!audit_dummy_context()))
297                 __audit_log_capset(new, old);
298 }
299 
300 static inline void audit_mmap_fd(int fd, int flags)
301 {
302         if (unlikely(!audit_dummy_context()))
303                 __audit_mmap_fd(fd, flags);
304 }
305 
306 extern int audit_n_rules;
307 extern int audit_signals;
308 #else /* CONFIG_AUDITSYSCALL */
309 static inline int audit_alloc(struct task_struct *task)
310 {
311         return 0;
312 }
313 static inline void audit_free(struct task_struct *task)
314 { }
315 static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
316                                        unsigned long a1, unsigned long a2,
317                                        unsigned long a3)
318 { }
319 static inline void audit_syscall_exit(void *pt_regs)
320 { }
321 static inline int audit_dummy_context(void)
322 {
323         return 1;
324 }
325 static inline struct filename *audit_reusename(const __user char *name)
326 {
327         return NULL;
328 }
329 static inline void audit_getname(struct filename *name)
330 { }
331 static inline void audit_putname(struct filename *name)
332 { }
333 static inline void __audit_inode(struct filename *name,
334                                         const struct dentry *dentry,
335                                         unsigned int flags)
336 { }
337 static inline void __audit_inode_child(const struct inode *parent,
338                                         const struct dentry *dentry,
339                                         const unsigned char type)
340 { }
341 static inline void audit_inode(struct filename *name,
342                                 const struct dentry *dentry,
343                                 unsigned int parent)
344 { }
345 static inline void audit_inode_parent_hidden(struct filename *name,
346                                 const struct dentry *dentry)
347 { }
348 static inline void audit_inode_child(const struct inode *parent,
349                                      const struct dentry *dentry,
350                                      const unsigned char type)
351 { }
352 static inline void audit_core_dumps(long signr)
353 { }
354 static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
355 { }
356 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
357 { }
358 static inline int auditsc_get_stamp(struct audit_context *ctx,
359                               struct timespec *t, unsigned int *serial)
360 {
361         return 0;
362 }
363 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
364 {
365         return INVALID_UID;
366 }
367 static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
368 {
369         return -1;
370 }
371 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
372 { }
373 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,
374                                         gid_t gid, umode_t mode)
375 { }
376 static inline void audit_bprm(struct linux_binprm *bprm)
377 { }
378 static inline int audit_socketcall(int nargs, unsigned long *args)
379 {
380         return 0;
381 }
382 static inline void audit_fd_pair(int fd1, int fd2)
383 { }
384 static inline int audit_sockaddr(int len, void *addr)
385 {
386         return 0;
387 }
388 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
389 { }
390 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len,
391                                      unsigned int msg_prio,
392                                      const struct timespec *abs_timeout)
393 { }
394 static inline void audit_mq_notify(mqd_t mqdes,
395                                    const struct sigevent *notification)
396 { }
397 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
398 { }
399 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
400                                        const struct cred *new,
401                                        const struct cred *old)
402 {
403         return 0;
404 }
405 static inline void audit_log_capset(const struct cred *new,
406                                     const struct cred *old)
407 { }
408 static inline void audit_mmap_fd(int fd, int flags)
409 { }
410 static inline void audit_ptrace(struct task_struct *t)
411 { }
412 #define audit_n_rules 0
413 #define audit_signals 0
414 #endif /* CONFIG_AUDITSYSCALL */
415 
416 static inline bool audit_loginuid_set(struct task_struct *tsk)
417 {
418         return uid_valid(audit_get_loginuid(tsk));
419 }
420 
421 #ifdef CONFIG_AUDIT
422 /* These are defined in audit.c */
423                                 /* Public API */
424 extern __printf(4, 5)
425 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
426                const char *fmt, ...);
427 
428 extern struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type);
429 extern __printf(2, 3)
430 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...);
431 extern void                 audit_log_end(struct audit_buffer *ab);
432 extern int                  audit_string_contains_control(const char *string,
433                                                           size_t len);
434 extern void                 audit_log_n_hex(struct audit_buffer *ab,
435                                           const unsigned char *buf,
436                                           size_t len);
437 extern void                 audit_log_n_string(struct audit_buffer *ab,
438                                                const char *buf,
439                                                size_t n);
440 extern void                 audit_log_n_untrustedstring(struct audit_buffer *ab,
441                                                         const char *string,
442                                                         size_t n);
443 extern void                 audit_log_untrustedstring(struct audit_buffer *ab,
444                                                       const char *string);
445 extern void                 audit_log_d_path(struct audit_buffer *ab,
446                                              const char *prefix,
447                                              const struct path *path);
448 extern void                 audit_log_key(struct audit_buffer *ab,
449                                           char *key);
450 extern void                 audit_log_link_denied(const char *operation,
451                                                   struct path *link);
452 extern void                 audit_log_lost(const char *message);
453 #ifdef CONFIG_SECURITY
454 extern void                 audit_log_secctx(struct audit_buffer *ab, u32 secid);
455 #else
456 static inline void          audit_log_secctx(struct audit_buffer *ab, u32 secid)
457 { }
458 #endif
459 
460 extern int audit_log_task_context(struct audit_buffer *ab);
461 extern void audit_log_task_info(struct audit_buffer *ab,
462                                 struct task_struct *tsk);
463 
464 extern int                  audit_update_lsm_rules(void);
465 
466                                 /* Private API (for audit.c only) */
467 extern int audit_filter_user(int type);
468 extern int audit_filter_type(int type);
469 extern int audit_rule_change(int type, __u32 portid, int seq,
470                                 void *data, size_t datasz);
471 extern int audit_list_rules_send(struct sk_buff *request_skb, int seq);
472 
473 extern u32 audit_enabled;
474 #else /* CONFIG_AUDIT */
475 static inline __printf(4, 5)
476 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
477                const char *fmt, ...)
478 { }
479 static inline struct audit_buffer *audit_log_start(struct audit_context *ctx,
480                                                    gfp_t gfp_mask, int type)
481 {
482         return NULL;
483 }
484 static inline __printf(2, 3)
485 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
486 { }
487 static inline void audit_log_end(struct audit_buffer *ab)
488 { }
489 static inline void audit_log_n_hex(struct audit_buffer *ab,
490                                    const unsigned char *buf, size_t len)
491 { }
492 static inline void audit_log_n_string(struct audit_buffer *ab,
493                                       const char *buf, size_t n)
494 { }
495 static inline void  audit_log_n_untrustedstring(struct audit_buffer *ab,
496                                                 const char *string, size_t n)
497 { }
498 static inline void audit_log_untrustedstring(struct audit_buffer *ab,
499                                              const char *string)
500 { }
501 static inline void audit_log_d_path(struct audit_buffer *ab,
502                                     const char *prefix,
503                                     const struct path *path)
504 { }
505 static inline void audit_log_key(struct audit_buffer *ab, char *key)
506 { }
507 static inline void audit_log_link_denied(const char *string,
508                                          const struct path *link)
509 { }
510 static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid)
511 { }
512 static inline int audit_log_task_context(struct audit_buffer *ab)
513 {
514         return 0;
515 }
516 static inline void audit_log_task_info(struct audit_buffer *ab,
517                                        struct task_struct *tsk)
518 { }
519 #define audit_enabled 0
520 #endif /* CONFIG_AUDIT */
521 static inline void audit_log_string(struct audit_buffer *ab, const char *buf)
522 {
523         audit_log_n_string(ab, buf, strlen(buf));
524 }
525 
526 #endif
527 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp