~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/include/linux/audit.h

Version: ~ [ linux-5.13-rc2 ] ~ [ linux-5.12.4 ] ~ [ linux-5.11.21 ] ~ [ linux-5.10.37 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.119 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.190 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.232 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.268 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.268 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* audit.h -- Auditing support
  2  *
  3  * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
  4  * All Rights Reserved.
  5  *
  6  * This program is free software; you can redistribute it and/or modify
  7  * it under the terms of the GNU General Public License as published by
  8  * the Free Software Foundation; either version 2 of the License, or
  9  * (at your option) any later version.
 10  *
 11  * This program is distributed in the hope that it will be useful,
 12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 14  * GNU General Public License for more details.
 15  *
 16  * You should have received a copy of the GNU General Public License
 17  * along with this program; if not, write to the Free Software
 18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 19  *
 20  * Written by Rickard E. (Rik) Faith <faith@redhat.com>
 21  *
 22  */
 23 #ifndef _LINUX_AUDIT_H_
 24 #define _LINUX_AUDIT_H_
 25 
 26 #include <linux/sched.h>
 27 #include <linux/ptrace.h>
 28 #include <uapi/linux/audit.h>
 29 
 30 #define AUDIT_INO_UNSET ((unsigned long)-1)
 31 #define AUDIT_DEV_UNSET ((dev_t)-1)
 32 
 33 struct audit_sig_info {
 34         uid_t           uid;
 35         pid_t           pid;
 36         char            ctx[0];
 37 };
 38 
 39 struct audit_buffer;
 40 struct audit_context;
 41 struct inode;
 42 struct netlink_skb_parms;
 43 struct path;
 44 struct linux_binprm;
 45 struct mq_attr;
 46 struct mqstat;
 47 struct audit_watch;
 48 struct audit_tree;
 49 struct sk_buff;
 50 
 51 struct audit_krule {
 52         u32                     pflags;
 53         u32                     flags;
 54         u32                     listnr;
 55         u32                     action;
 56         u32                     mask[AUDIT_BITMASK_SIZE];
 57         u32                     buflen; /* for data alloc on list rules */
 58         u32                     field_count;
 59         char                    *filterkey; /* ties events to rules */
 60         struct audit_field      *fields;
 61         struct audit_field      *arch_f; /* quick access to arch field */
 62         struct audit_field      *inode_f; /* quick access to an inode field */
 63         struct audit_watch      *watch; /* associated watch */
 64         struct audit_tree       *tree;  /* associated watched tree */
 65         struct audit_fsnotify_mark      *exe;
 66         struct list_head        rlist;  /* entry in audit_{watch,tree}.rules list */
 67         struct list_head        list;   /* for AUDIT_LIST* purposes only */
 68         u64                     prio;
 69 };
 70 
 71 /* Flag to indicate legacy AUDIT_LOGINUID unset usage */
 72 #define AUDIT_LOGINUID_LEGACY           0x1
 73 
 74 struct audit_field {
 75         u32                             type;
 76         union {
 77                 u32                     val;
 78                 kuid_t                  uid;
 79                 kgid_t                  gid;
 80                 struct {
 81                         char            *lsm_str;
 82                         void            *lsm_rule;
 83                 };
 84         };
 85         u32                             op;
 86 };
 87 
 88 extern int is_audit_feature_set(int which);
 89 
 90 extern int __init audit_register_class(int class, unsigned *list);
 91 extern int audit_classify_syscall(int abi, unsigned syscall);
 92 extern int audit_classify_arch(int arch);
 93 /* only for compat system calls */
 94 extern unsigned compat_write_class[];
 95 extern unsigned compat_read_class[];
 96 extern unsigned compat_dir_class[];
 97 extern unsigned compat_chattr_class[];
 98 extern unsigned compat_signal_class[];
 99 
100 extern int audit_classify_compat_syscall(int abi, unsigned syscall);
101 
102 /* audit_names->type values */
103 #define AUDIT_TYPE_UNKNOWN      0       /* we don't know yet */
104 #define AUDIT_TYPE_NORMAL       1       /* a "normal" audit record */
105 #define AUDIT_TYPE_PARENT       2       /* a parent audit record */
106 #define AUDIT_TYPE_CHILD_DELETE 3       /* a child being deleted */
107 #define AUDIT_TYPE_CHILD_CREATE 4       /* a child being created */
108 
109 /* maximized args number that audit_socketcall can process */
110 #define AUDITSC_ARGS            6
111 
112 /* bit values for ->signal->audit_tty */
113 #define AUDIT_TTY_ENABLE        BIT(0)
114 #define AUDIT_TTY_LOG_PASSWD    BIT(1)
115 
116 struct filename;
117 
118 extern void audit_log_session_info(struct audit_buffer *ab);
119 
120 #ifdef CONFIG_AUDIT
121 /* These are defined in audit.c */
122                                 /* Public API */
123 extern __printf(4, 5)
124 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
125                const char *fmt, ...);
126 
127 extern struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type);
128 extern __printf(2, 3)
129 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...);
130 extern void                 audit_log_end(struct audit_buffer *ab);
131 extern bool                 audit_string_contains_control(const char *string,
132                                                           size_t len);
133 extern void                 audit_log_n_hex(struct audit_buffer *ab,
134                                           const unsigned char *buf,
135                                           size_t len);
136 extern void                 audit_log_n_string(struct audit_buffer *ab,
137                                                const char *buf,
138                                                size_t n);
139 extern void                 audit_log_n_untrustedstring(struct audit_buffer *ab,
140                                                         const char *string,
141                                                         size_t n);
142 extern void                 audit_log_untrustedstring(struct audit_buffer *ab,
143                                                       const char *string);
144 extern void                 audit_log_d_path(struct audit_buffer *ab,
145                                              const char *prefix,
146                                              const struct path *path);
147 extern void                 audit_log_key(struct audit_buffer *ab,
148                                           char *key);
149 extern void                 audit_log_link_denied(const char *operation,
150                                                   struct path *link);
151 extern void                 audit_log_lost(const char *message);
152 #ifdef CONFIG_SECURITY
153 extern void                 audit_log_secctx(struct audit_buffer *ab, u32 secid);
154 #else
155 static inline void          audit_log_secctx(struct audit_buffer *ab, u32 secid)
156 { }
157 #endif
158 
159 extern int audit_log_task_context(struct audit_buffer *ab);
160 extern void audit_log_task_info(struct audit_buffer *ab,
161                                 struct task_struct *tsk);
162 
163 extern int                  audit_update_lsm_rules(void);
164 
165                                 /* Private API (for audit.c only) */
166 extern int audit_filter_user(int type);
167 extern int audit_filter_type(int type);
168 extern int audit_rule_change(int type, __u32 portid, int seq,
169                                 void *data, size_t datasz);
170 extern int audit_list_rules_send(struct sk_buff *request_skb, int seq);
171 
172 extern u32 audit_enabled;
173 #else /* CONFIG_AUDIT */
174 static inline __printf(4, 5)
175 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
176                const char *fmt, ...)
177 { }
178 static inline struct audit_buffer *audit_log_start(struct audit_context *ctx,
179                                                    gfp_t gfp_mask, int type)
180 {
181         return NULL;
182 }
183 static inline __printf(2, 3)
184 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
185 { }
186 static inline void audit_log_end(struct audit_buffer *ab)
187 { }
188 static inline void audit_log_n_hex(struct audit_buffer *ab,
189                                    const unsigned char *buf, size_t len)
190 { }
191 static inline void audit_log_n_string(struct audit_buffer *ab,
192                                       const char *buf, size_t n)
193 { }
194 static inline void  audit_log_n_untrustedstring(struct audit_buffer *ab,
195                                                 const char *string, size_t n)
196 { }
197 static inline void audit_log_untrustedstring(struct audit_buffer *ab,
198                                              const char *string)
199 { }
200 static inline void audit_log_d_path(struct audit_buffer *ab,
201                                     const char *prefix,
202                                     const struct path *path)
203 { }
204 static inline void audit_log_key(struct audit_buffer *ab, char *key)
205 { }
206 static inline void audit_log_link_denied(const char *string,
207                                          const struct path *link)
208 { }
209 static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid)
210 { }
211 static inline int audit_log_task_context(struct audit_buffer *ab)
212 {
213         return 0;
214 }
215 static inline void audit_log_task_info(struct audit_buffer *ab,
216                                        struct task_struct *tsk)
217 { }
218 #define audit_enabled 0
219 #endif /* CONFIG_AUDIT */
220 
221 #ifdef CONFIG_AUDIT_COMPAT_GENERIC
222 #define audit_is_compat(arch)  (!((arch) & __AUDIT_ARCH_64BIT))
223 #else
224 #define audit_is_compat(arch)  false
225 #endif
226 
227 #ifdef CONFIG_AUDITSYSCALL
228 #include <asm/syscall.h> /* for syscall_get_arch() */
229 
230 /* These are defined in auditsc.c */
231                                 /* Public API */
232 extern int  audit_alloc(struct task_struct *task);
233 extern void __audit_free(struct task_struct *task);
234 extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
235                                   unsigned long a2, unsigned long a3);
236 extern void __audit_syscall_exit(int ret_success, long ret_value);
237 extern struct filename *__audit_reusename(const __user char *uptr);
238 extern void __audit_getname(struct filename *name);
239 
240 #define AUDIT_INODE_PARENT      1       /* dentry represents the parent */
241 #define AUDIT_INODE_HIDDEN      2       /* audit record should be hidden */
242 extern void __audit_inode(struct filename *name, const struct dentry *dentry,
243                                 unsigned int flags);
244 extern void __audit_file(const struct file *);
245 extern void __audit_inode_child(struct inode *parent,
246                                 const struct dentry *dentry,
247                                 const unsigned char type);
248 extern void __audit_seccomp(unsigned long syscall, long signr, int code);
249 extern void __audit_ptrace(struct task_struct *t);
250 
251 static inline bool audit_dummy_context(void)
252 {
253         void *p = current->audit_context;
254         return !p || *(int *)p;
255 }
256 static inline void audit_free(struct task_struct *task)
257 {
258         if (unlikely(task->audit_context))
259                 __audit_free(task);
260 }
261 static inline void audit_syscall_entry(int major, unsigned long a0,
262                                        unsigned long a1, unsigned long a2,
263                                        unsigned long a3)
264 {
265         if (unlikely(current->audit_context))
266                 __audit_syscall_entry(major, a0, a1, a2, a3);
267 }
268 static inline void audit_syscall_exit(void *pt_regs)
269 {
270         if (unlikely(current->audit_context)) {
271                 int success = is_syscall_success(pt_regs);
272                 long return_code = regs_return_value(pt_regs);
273 
274                 __audit_syscall_exit(success, return_code);
275         }
276 }
277 static inline struct filename *audit_reusename(const __user char *name)
278 {
279         if (unlikely(!audit_dummy_context()))
280                 return __audit_reusename(name);
281         return NULL;
282 }
283 static inline void audit_getname(struct filename *name)
284 {
285         if (unlikely(!audit_dummy_context()))
286                 __audit_getname(name);
287 }
288 static inline void audit_inode(struct filename *name,
289                                 const struct dentry *dentry,
290                                 unsigned int parent) {
291         if (unlikely(!audit_dummy_context())) {
292                 unsigned int flags = 0;
293                 if (parent)
294                         flags |= AUDIT_INODE_PARENT;
295                 __audit_inode(name, dentry, flags);
296         }
297 }
298 static inline void audit_file(struct file *file)
299 {
300         if (unlikely(!audit_dummy_context()))
301                 __audit_file(file);
302 }
303 static inline void audit_inode_parent_hidden(struct filename *name,
304                                                 const struct dentry *dentry)
305 {
306         if (unlikely(!audit_dummy_context()))
307                 __audit_inode(name, dentry,
308                                 AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN);
309 }
310 static inline void audit_inode_child(struct inode *parent,
311                                      const struct dentry *dentry,
312                                      const unsigned char type) {
313         if (unlikely(!audit_dummy_context()))
314                 __audit_inode_child(parent, dentry, type);
315 }
316 void audit_core_dumps(long signr);
317 
318 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
319 {
320         if (!audit_enabled)
321                 return;
322 
323         /* Force a record to be reported if a signal was delivered. */
324         if (signr || unlikely(!audit_dummy_context()))
325                 __audit_seccomp(syscall, signr, code);
326 }
327 
328 static inline void audit_ptrace(struct task_struct *t)
329 {
330         if (unlikely(!audit_dummy_context()))
331                 __audit_ptrace(t);
332 }
333 
334                                 /* Private API (for audit.c only) */
335 extern unsigned int audit_serial(void);
336 extern int auditsc_get_stamp(struct audit_context *ctx,
337                               struct timespec *t, unsigned int *serial);
338 extern int audit_set_loginuid(kuid_t loginuid);
339 
340 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
341 {
342         return tsk->loginuid;
343 }
344 
345 static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
346 {
347         return tsk->sessionid;
348 }
349 
350 extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);
351 extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode);
352 extern void __audit_bprm(struct linux_binprm *bprm);
353 extern int __audit_socketcall(int nargs, unsigned long *args);
354 extern int __audit_sockaddr(int len, void *addr);
355 extern void __audit_fd_pair(int fd1, int fd2);
356 extern void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr);
357 extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout);
358 extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification);
359 extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat);
360 extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
361                                   const struct cred *new,
362                                   const struct cred *old);
363 extern void __audit_log_capset(const struct cred *new, const struct cred *old);
364 extern void __audit_mmap_fd(int fd, int flags);
365 
366 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
367 {
368         if (unlikely(!audit_dummy_context()))
369                 __audit_ipc_obj(ipcp);
370 }
371 static inline void audit_fd_pair(int fd1, int fd2)
372 {
373         if (unlikely(!audit_dummy_context()))
374                 __audit_fd_pair(fd1, fd2);
375 }
376 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode)
377 {
378         if (unlikely(!audit_dummy_context()))
379                 __audit_ipc_set_perm(qbytes, uid, gid, mode);
380 }
381 static inline void audit_bprm(struct linux_binprm *bprm)
382 {
383         if (unlikely(!audit_dummy_context()))
384                 __audit_bprm(bprm);
385 }
386 static inline int audit_socketcall(int nargs, unsigned long *args)
387 {
388         if (unlikely(!audit_dummy_context()))
389                 return __audit_socketcall(nargs, args);
390         return 0;
391 }
392 static inline int audit_sockaddr(int len, void *addr)
393 {
394         if (unlikely(!audit_dummy_context()))
395                 return __audit_sockaddr(len, addr);
396         return 0;
397 }
398 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
399 {
400         if (unlikely(!audit_dummy_context()))
401                 __audit_mq_open(oflag, mode, attr);
402 }
403 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout)
404 {
405         if (unlikely(!audit_dummy_context()))
406                 __audit_mq_sendrecv(mqdes, msg_len, msg_prio, abs_timeout);
407 }
408 static inline void audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
409 {
410         if (unlikely(!audit_dummy_context()))
411                 __audit_mq_notify(mqdes, notification);
412 }
413 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
414 {
415         if (unlikely(!audit_dummy_context()))
416                 __audit_mq_getsetattr(mqdes, mqstat);
417 }
418 
419 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
420                                        const struct cred *new,
421                                        const struct cred *old)
422 {
423         if (unlikely(!audit_dummy_context()))
424                 return __audit_log_bprm_fcaps(bprm, new, old);
425         return 0;
426 }
427 
428 static inline void audit_log_capset(const struct cred *new,
429                                    const struct cred *old)
430 {
431         if (unlikely(!audit_dummy_context()))
432                 __audit_log_capset(new, old);
433 }
434 
435 static inline void audit_mmap_fd(int fd, int flags)
436 {
437         if (unlikely(!audit_dummy_context()))
438                 __audit_mmap_fd(fd, flags);
439 }
440 
441 extern int audit_n_rules;
442 extern int audit_signals;
443 #else /* CONFIG_AUDITSYSCALL */
444 static inline int audit_alloc(struct task_struct *task)
445 {
446         return 0;
447 }
448 static inline void audit_free(struct task_struct *task)
449 { }
450 static inline void audit_syscall_entry(int major, unsigned long a0,
451                                        unsigned long a1, unsigned long a2,
452                                        unsigned long a3)
453 { }
454 static inline void audit_syscall_exit(void *pt_regs)
455 { }
456 static inline bool audit_dummy_context(void)
457 {
458         return true;
459 }
460 static inline struct filename *audit_reusename(const __user char *name)
461 {
462         return NULL;
463 }
464 static inline void audit_getname(struct filename *name)
465 { }
466 static inline void __audit_inode(struct filename *name,
467                                         const struct dentry *dentry,
468                                         unsigned int flags)
469 { }
470 static inline void __audit_inode_child(struct inode *parent,
471                                         const struct dentry *dentry,
472                                         const unsigned char type)
473 { }
474 static inline void audit_inode(struct filename *name,
475                                 const struct dentry *dentry,
476                                 unsigned int parent)
477 { }
478 static inline void audit_file(struct file *file)
479 {
480 }
481 static inline void audit_inode_parent_hidden(struct filename *name,
482                                 const struct dentry *dentry)
483 { }
484 static inline void audit_inode_child(struct inode *parent,
485                                      const struct dentry *dentry,
486                                      const unsigned char type)
487 { }
488 static inline void audit_core_dumps(long signr)
489 { }
490 static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
491 { }
492 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
493 { }
494 static inline int auditsc_get_stamp(struct audit_context *ctx,
495                               struct timespec *t, unsigned int *serial)
496 {
497         return 0;
498 }
499 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
500 {
501         return INVALID_UID;
502 }
503 static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
504 {
505         return -1;
506 }
507 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
508 { }
509 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,
510                                         gid_t gid, umode_t mode)
511 { }
512 static inline void audit_bprm(struct linux_binprm *bprm)
513 { }
514 static inline int audit_socketcall(int nargs, unsigned long *args)
515 {
516         return 0;
517 }
518 static inline void audit_fd_pair(int fd1, int fd2)
519 { }
520 static inline int audit_sockaddr(int len, void *addr)
521 {
522         return 0;
523 }
524 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
525 { }
526 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len,
527                                      unsigned int msg_prio,
528                                      const struct timespec *abs_timeout)
529 { }
530 static inline void audit_mq_notify(mqd_t mqdes,
531                                    const struct sigevent *notification)
532 { }
533 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
534 { }
535 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
536                                        const struct cred *new,
537                                        const struct cred *old)
538 {
539         return 0;
540 }
541 static inline void audit_log_capset(const struct cred *new,
542                                     const struct cred *old)
543 { }
544 static inline void audit_mmap_fd(int fd, int flags)
545 { }
546 static inline void audit_ptrace(struct task_struct *t)
547 { }
548 #define audit_n_rules 0
549 #define audit_signals 0
550 #endif /* CONFIG_AUDITSYSCALL */
551 
552 static inline bool audit_loginuid_set(struct task_struct *tsk)
553 {
554         return uid_valid(audit_get_loginuid(tsk));
555 }
556 
557 static inline void audit_log_string(struct audit_buffer *ab, const char *buf)
558 {
559         audit_log_n_string(ab, buf, strlen(buf));
560 }
561 
562 #endif
563 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp