~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/include/linux/audit.h

Version: ~ [ linux-5.13-rc5 ] ~ [ linux-5.12.9 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.42 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.124 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.193 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.235 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.271 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.271 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* audit.h -- Auditing support
  2  *
  3  * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
  4  * All Rights Reserved.
  5  *
  6  * This program is free software; you can redistribute it and/or modify
  7  * it under the terms of the GNU General Public License as published by
  8  * the Free Software Foundation; either version 2 of the License, or
  9  * (at your option) any later version.
 10  *
 11  * This program is distributed in the hope that it will be useful,
 12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 14  * GNU General Public License for more details.
 15  *
 16  * You should have received a copy of the GNU General Public License
 17  * along with this program; if not, write to the Free Software
 18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 19  *
 20  * Written by Rickard E. (Rik) Faith <faith@redhat.com>
 21  *
 22  */
 23 #ifndef _LINUX_AUDIT_H_
 24 #define _LINUX_AUDIT_H_
 25 
 26 #include <linux/sched.h>
 27 #include <linux/ptrace.h>
 28 #include <uapi/linux/audit.h>
 29 
 30 struct audit_sig_info {
 31         uid_t           uid;
 32         pid_t           pid;
 33         char            ctx[0];
 34 };
 35 
 36 struct audit_buffer;
 37 struct audit_context;
 38 struct inode;
 39 struct netlink_skb_parms;
 40 struct path;
 41 struct linux_binprm;
 42 struct mq_attr;
 43 struct mqstat;
 44 struct audit_watch;
 45 struct audit_tree;
 46 struct sk_buff;
 47 
 48 struct audit_krule {
 49         u32                     pflags;
 50         u32                     flags;
 51         u32                     listnr;
 52         u32                     action;
 53         u32                     mask[AUDIT_BITMASK_SIZE];
 54         u32                     buflen; /* for data alloc on list rules */
 55         u32                     field_count;
 56         char                    *filterkey; /* ties events to rules */
 57         struct audit_field      *fields;
 58         struct audit_field      *arch_f; /* quick access to arch field */
 59         struct audit_field      *inode_f; /* quick access to an inode field */
 60         struct audit_watch      *watch; /* associated watch */
 61         struct audit_tree       *tree;  /* associated watched tree */
 62         struct list_head        rlist;  /* entry in audit_{watch,tree}.rules list */
 63         struct list_head        list;   /* for AUDIT_LIST* purposes only */
 64         u64                     prio;
 65 };
 66 
 67 /* Flag to indicate legacy AUDIT_LOGINUID unset usage */
 68 #define AUDIT_LOGINUID_LEGACY           0x1
 69 
 70 struct audit_field {
 71         u32                             type;
 72         union {
 73                 u32                     val;
 74                 kuid_t                  uid;
 75                 kgid_t                  gid;
 76                 struct {
 77                         char            *lsm_str;
 78                         void            *lsm_rule;
 79                 };
 80         };
 81         u32                             op;
 82 };
 83 
 84 extern int is_audit_feature_set(int which);
 85 
 86 extern int __init audit_register_class(int class, unsigned *list);
 87 extern int audit_classify_syscall(int abi, unsigned syscall);
 88 extern int audit_classify_arch(int arch);
 89 /* only for compat system calls */
 90 extern unsigned compat_write_class[];
 91 extern unsigned compat_read_class[];
 92 extern unsigned compat_dir_class[];
 93 extern unsigned compat_chattr_class[];
 94 extern unsigned compat_signal_class[];
 95 
 96 extern int audit_classify_compat_syscall(int abi, unsigned syscall);
 97 
 98 /* audit_names->type values */
 99 #define AUDIT_TYPE_UNKNOWN      0       /* we don't know yet */
100 #define AUDIT_TYPE_NORMAL       1       /* a "normal" audit record */
101 #define AUDIT_TYPE_PARENT       2       /* a parent audit record */
102 #define AUDIT_TYPE_CHILD_DELETE 3       /* a child being deleted */
103 #define AUDIT_TYPE_CHILD_CREATE 4       /* a child being created */
104 
105 /* maximized args number that audit_socketcall can process */
106 #define AUDITSC_ARGS            6
107 
108 struct filename;
109 
110 extern void audit_log_session_info(struct audit_buffer *ab);
111 
112 #ifdef CONFIG_AUDIT_COMPAT_GENERIC
113 #define audit_is_compat(arch)  (!((arch) & __AUDIT_ARCH_64BIT))
114 #else
115 #define audit_is_compat(arch)  false
116 #endif
117 
118 #ifdef CONFIG_AUDITSYSCALL
119 #include <asm/syscall.h> /* for syscall_get_arch() */
120 
121 /* These are defined in auditsc.c */
122                                 /* Public API */
123 extern int  audit_alloc(struct task_struct *task);
124 extern void __audit_free(struct task_struct *task);
125 extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
126                                   unsigned long a2, unsigned long a3);
127 extern void __audit_syscall_exit(int ret_success, long ret_value);
128 extern struct filename *__audit_reusename(const __user char *uptr);
129 extern void __audit_getname(struct filename *name);
130 
131 #define AUDIT_INODE_PARENT      1       /* dentry represents the parent */
132 #define AUDIT_INODE_HIDDEN      2       /* audit record should be hidden */
133 extern void __audit_inode(struct filename *name, const struct dentry *dentry,
134                                 unsigned int flags);
135 extern void __audit_file(const struct file *);
136 extern void __audit_inode_child(const struct inode *parent,
137                                 const struct dentry *dentry,
138                                 const unsigned char type);
139 extern void __audit_seccomp(unsigned long syscall, long signr, int code);
140 extern void __audit_ptrace(struct task_struct *t);
141 
142 static inline int audit_dummy_context(void)
143 {
144         void *p = current->audit_context;
145         return !p || *(int *)p;
146 }
147 static inline void audit_free(struct task_struct *task)
148 {
149         if (unlikely(task->audit_context))
150                 __audit_free(task);
151 }
152 static inline void audit_syscall_entry(int major, unsigned long a0,
153                                        unsigned long a1, unsigned long a2,
154                                        unsigned long a3)
155 {
156         if (unlikely(current->audit_context))
157                 __audit_syscall_entry(major, a0, a1, a2, a3);
158 }
159 static inline void audit_syscall_exit(void *pt_regs)
160 {
161         if (unlikely(current->audit_context)) {
162                 int success = is_syscall_success(pt_regs);
163                 long return_code = regs_return_value(pt_regs);
164 
165                 __audit_syscall_exit(success, return_code);
166         }
167 }
168 static inline struct filename *audit_reusename(const __user char *name)
169 {
170         if (unlikely(!audit_dummy_context()))
171                 return __audit_reusename(name);
172         return NULL;
173 }
174 static inline void audit_getname(struct filename *name)
175 {
176         if (unlikely(!audit_dummy_context()))
177                 __audit_getname(name);
178 }
179 static inline void audit_inode(struct filename *name,
180                                 const struct dentry *dentry,
181                                 unsigned int parent) {
182         if (unlikely(!audit_dummy_context())) {
183                 unsigned int flags = 0;
184                 if (parent)
185                         flags |= AUDIT_INODE_PARENT;
186                 __audit_inode(name, dentry, flags);
187         }
188 }
189 static inline void audit_file(struct file *file)
190 {
191         if (unlikely(!audit_dummy_context()))
192                 __audit_file(file);
193 }
194 static inline void audit_inode_parent_hidden(struct filename *name,
195                                                 const struct dentry *dentry)
196 {
197         if (unlikely(!audit_dummy_context()))
198                 __audit_inode(name, dentry,
199                                 AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN);
200 }
201 static inline void audit_inode_child(const struct inode *parent,
202                                      const struct dentry *dentry,
203                                      const unsigned char type) {
204         if (unlikely(!audit_dummy_context()))
205                 __audit_inode_child(parent, dentry, type);
206 }
207 void audit_core_dumps(long signr);
208 
209 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
210 {
211         /* Force a record to be reported if a signal was delivered. */
212         if (signr || unlikely(!audit_dummy_context()))
213                 __audit_seccomp(syscall, signr, code);
214 }
215 
216 static inline void audit_ptrace(struct task_struct *t)
217 {
218         if (unlikely(!audit_dummy_context()))
219                 __audit_ptrace(t);
220 }
221 
222                                 /* Private API (for audit.c only) */
223 extern unsigned int audit_serial(void);
224 extern int auditsc_get_stamp(struct audit_context *ctx,
225                               struct timespec *t, unsigned int *serial);
226 extern int audit_set_loginuid(kuid_t loginuid);
227 
228 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
229 {
230         return tsk->loginuid;
231 }
232 
233 static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
234 {
235         return tsk->sessionid;
236 }
237 
238 extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);
239 extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode);
240 extern void __audit_bprm(struct linux_binprm *bprm);
241 extern int __audit_socketcall(int nargs, unsigned long *args);
242 extern int __audit_sockaddr(int len, void *addr);
243 extern void __audit_fd_pair(int fd1, int fd2);
244 extern void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr);
245 extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout);
246 extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification);
247 extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat);
248 extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
249                                   const struct cred *new,
250                                   const struct cred *old);
251 extern void __audit_log_capset(const struct cred *new, const struct cred *old);
252 extern void __audit_mmap_fd(int fd, int flags);
253 
254 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
255 {
256         if (unlikely(!audit_dummy_context()))
257                 __audit_ipc_obj(ipcp);
258 }
259 static inline void audit_fd_pair(int fd1, int fd2)
260 {
261         if (unlikely(!audit_dummy_context()))
262                 __audit_fd_pair(fd1, fd2);
263 }
264 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode)
265 {
266         if (unlikely(!audit_dummy_context()))
267                 __audit_ipc_set_perm(qbytes, uid, gid, mode);
268 }
269 static inline void audit_bprm(struct linux_binprm *bprm)
270 {
271         if (unlikely(!audit_dummy_context()))
272                 __audit_bprm(bprm);
273 }
274 static inline int audit_socketcall(int nargs, unsigned long *args)
275 {
276         if (unlikely(!audit_dummy_context()))
277                 return __audit_socketcall(nargs, args);
278         return 0;
279 }
280 static inline int audit_sockaddr(int len, void *addr)
281 {
282         if (unlikely(!audit_dummy_context()))
283                 return __audit_sockaddr(len, addr);
284         return 0;
285 }
286 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
287 {
288         if (unlikely(!audit_dummy_context()))
289                 __audit_mq_open(oflag, mode, attr);
290 }
291 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout)
292 {
293         if (unlikely(!audit_dummy_context()))
294                 __audit_mq_sendrecv(mqdes, msg_len, msg_prio, abs_timeout);
295 }
296 static inline void audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
297 {
298         if (unlikely(!audit_dummy_context()))
299                 __audit_mq_notify(mqdes, notification);
300 }
301 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
302 {
303         if (unlikely(!audit_dummy_context()))
304                 __audit_mq_getsetattr(mqdes, mqstat);
305 }
306 
307 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
308                                        const struct cred *new,
309                                        const struct cred *old)
310 {
311         if (unlikely(!audit_dummy_context()))
312                 return __audit_log_bprm_fcaps(bprm, new, old);
313         return 0;
314 }
315 
316 static inline void audit_log_capset(const struct cred *new,
317                                    const struct cred *old)
318 {
319         if (unlikely(!audit_dummy_context()))
320                 __audit_log_capset(new, old);
321 }
322 
323 static inline void audit_mmap_fd(int fd, int flags)
324 {
325         if (unlikely(!audit_dummy_context()))
326                 __audit_mmap_fd(fd, flags);
327 }
328 
329 extern int audit_n_rules;
330 extern int audit_signals;
331 #else /* CONFIG_AUDITSYSCALL */
332 static inline int audit_alloc(struct task_struct *task)
333 {
334         return 0;
335 }
336 static inline void audit_free(struct task_struct *task)
337 { }
338 static inline void audit_syscall_entry(int major, unsigned long a0,
339                                        unsigned long a1, unsigned long a2,
340                                        unsigned long a3)
341 { }
342 static inline void audit_syscall_exit(void *pt_regs)
343 { }
344 static inline int audit_dummy_context(void)
345 {
346         return 1;
347 }
348 static inline struct filename *audit_reusename(const __user char *name)
349 {
350         return NULL;
351 }
352 static inline void audit_getname(struct filename *name)
353 { }
354 static inline void __audit_inode(struct filename *name,
355                                         const struct dentry *dentry,
356                                         unsigned int flags)
357 { }
358 static inline void __audit_inode_child(const struct inode *parent,
359                                         const struct dentry *dentry,
360                                         const unsigned char type)
361 { }
362 static inline void audit_inode(struct filename *name,
363                                 const struct dentry *dentry,
364                                 unsigned int parent)
365 { }
366 static inline void audit_file(struct file *file)
367 {
368 }
369 static inline void audit_inode_parent_hidden(struct filename *name,
370                                 const struct dentry *dentry)
371 { }
372 static inline void audit_inode_child(const struct inode *parent,
373                                      const struct dentry *dentry,
374                                      const unsigned char type)
375 { }
376 static inline void audit_core_dumps(long signr)
377 { }
378 static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
379 { }
380 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
381 { }
382 static inline int auditsc_get_stamp(struct audit_context *ctx,
383                               struct timespec *t, unsigned int *serial)
384 {
385         return 0;
386 }
387 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
388 {
389         return INVALID_UID;
390 }
391 static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
392 {
393         return -1;
394 }
395 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
396 { }
397 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,
398                                         gid_t gid, umode_t mode)
399 { }
400 static inline void audit_bprm(struct linux_binprm *bprm)
401 { }
402 static inline int audit_socketcall(int nargs, unsigned long *args)
403 {
404         return 0;
405 }
406 static inline void audit_fd_pair(int fd1, int fd2)
407 { }
408 static inline int audit_sockaddr(int len, void *addr)
409 {
410         return 0;
411 }
412 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
413 { }
414 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len,
415                                      unsigned int msg_prio,
416                                      const struct timespec *abs_timeout)
417 { }
418 static inline void audit_mq_notify(mqd_t mqdes,
419                                    const struct sigevent *notification)
420 { }
421 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
422 { }
423 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
424                                        const struct cred *new,
425                                        const struct cred *old)
426 {
427         return 0;
428 }
429 static inline void audit_log_capset(const struct cred *new,
430                                     const struct cred *old)
431 { }
432 static inline void audit_mmap_fd(int fd, int flags)
433 { }
434 static inline void audit_ptrace(struct task_struct *t)
435 { }
436 #define audit_n_rules 0
437 #define audit_signals 0
438 #endif /* CONFIG_AUDITSYSCALL */
439 
440 static inline bool audit_loginuid_set(struct task_struct *tsk)
441 {
442         return uid_valid(audit_get_loginuid(tsk));
443 }
444 
445 #ifdef CONFIG_AUDIT
446 /* These are defined in audit.c */
447                                 /* Public API */
448 extern __printf(4, 5)
449 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
450                const char *fmt, ...);
451 
452 extern struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type);
453 extern __printf(2, 3)
454 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...);
455 extern void                 audit_log_end(struct audit_buffer *ab);
456 extern int                  audit_string_contains_control(const char *string,
457                                                           size_t len);
458 extern void                 audit_log_n_hex(struct audit_buffer *ab,
459                                           const unsigned char *buf,
460                                           size_t len);
461 extern void                 audit_log_n_string(struct audit_buffer *ab,
462                                                const char *buf,
463                                                size_t n);
464 extern void                 audit_log_n_untrustedstring(struct audit_buffer *ab,
465                                                         const char *string,
466                                                         size_t n);
467 extern void                 audit_log_untrustedstring(struct audit_buffer *ab,
468                                                       const char *string);
469 extern void                 audit_log_d_path(struct audit_buffer *ab,
470                                              const char *prefix,
471                                              const struct path *path);
472 extern void                 audit_log_key(struct audit_buffer *ab,
473                                           char *key);
474 extern void                 audit_log_link_denied(const char *operation,
475                                                   struct path *link);
476 extern void                 audit_log_lost(const char *message);
477 #ifdef CONFIG_SECURITY
478 extern void                 audit_log_secctx(struct audit_buffer *ab, u32 secid);
479 #else
480 static inline void          audit_log_secctx(struct audit_buffer *ab, u32 secid)
481 { }
482 #endif
483 
484 extern int audit_log_task_context(struct audit_buffer *ab);
485 extern void audit_log_task_info(struct audit_buffer *ab,
486                                 struct task_struct *tsk);
487 
488 extern int                  audit_update_lsm_rules(void);
489 
490                                 /* Private API (for audit.c only) */
491 extern int audit_filter_user(int type);
492 extern int audit_filter_type(int type);
493 extern int audit_rule_change(int type, __u32 portid, int seq,
494                                 void *data, size_t datasz);
495 extern int audit_list_rules_send(struct sk_buff *request_skb, int seq);
496 
497 extern u32 audit_enabled;
498 #else /* CONFIG_AUDIT */
499 static inline __printf(4, 5)
500 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
501                const char *fmt, ...)
502 { }
503 static inline struct audit_buffer *audit_log_start(struct audit_context *ctx,
504                                                    gfp_t gfp_mask, int type)
505 {
506         return NULL;
507 }
508 static inline __printf(2, 3)
509 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
510 { }
511 static inline void audit_log_end(struct audit_buffer *ab)
512 { }
513 static inline void audit_log_n_hex(struct audit_buffer *ab,
514                                    const unsigned char *buf, size_t len)
515 { }
516 static inline void audit_log_n_string(struct audit_buffer *ab,
517                                       const char *buf, size_t n)
518 { }
519 static inline void  audit_log_n_untrustedstring(struct audit_buffer *ab,
520                                                 const char *string, size_t n)
521 { }
522 static inline void audit_log_untrustedstring(struct audit_buffer *ab,
523                                              const char *string)
524 { }
525 static inline void audit_log_d_path(struct audit_buffer *ab,
526                                     const char *prefix,
527                                     const struct path *path)
528 { }
529 static inline void audit_log_key(struct audit_buffer *ab, char *key)
530 { }
531 static inline void audit_log_link_denied(const char *string,
532                                          const struct path *link)
533 { }
534 static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid)
535 { }
536 static inline int audit_log_task_context(struct audit_buffer *ab)
537 {
538         return 0;
539 }
540 static inline void audit_log_task_info(struct audit_buffer *ab,
541                                        struct task_struct *tsk)
542 { }
543 #define audit_enabled 0
544 #endif /* CONFIG_AUDIT */
545 static inline void audit_log_string(struct audit_buffer *ab, const char *buf)
546 {
547         audit_log_n_string(ab, buf, strlen(buf));
548 }
549 
550 #endif
551 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp