2019-05-27 00:55:05 -06:00
|
|
|
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
2005-12-15 11:33:52 -07:00
|
|
|
/* audit -- definition of audit_context structure and supporting types
|
|
|
|
*
|
|
|
|
* Copyright 2003-2004 Red Hat, Inc.
|
|
|
|
* Copyright 2005 Hewlett-Packard Development Company, L.P.
|
|
|
|
* Copyright 2005 IBM Corporation
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/fs.h>
|
|
|
|
#include <linux/audit.h>
|
2006-05-21 23:09:24 -06:00
|
|
|
#include <linux/skbuff.h>
|
2013-04-30 13:30:32 -06:00
|
|
|
#include <uapi/linux/mqueue.h>
|
2016-06-28 10:07:50 -06:00
|
|
|
#include <linux/tty.h>
|
2005-12-15 11:33:52 -07:00
|
|
|
|
2013-04-30 13:30:32 -06:00
|
|
|
/* AUDIT_NAMES is the number of slots we reserve in the audit_context
|
|
|
|
* for saving names from getname(). If we get more names we will allocate
|
|
|
|
* a name dynamically and also add those to the list anchored by names_list. */
|
|
|
|
#define AUDIT_NAMES 5
|
|
|
|
|
2005-12-15 11:33:52 -07:00
|
|
|
/* At task start time, the audit_state is set in the audit_context using
|
|
|
|
a per-task filter. At syscall entry, the audit_state is augmented by
|
|
|
|
the syscall filter. */
|
|
|
|
enum audit_state {
|
|
|
|
AUDIT_DISABLED, /* Do not create per-task audit_context.
|
|
|
|
* No syscall-specific audit records can
|
|
|
|
* be generated. */
|
|
|
|
AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context,
|
2012-01-03 12:23:06 -07:00
|
|
|
* and fill it in at syscall
|
2005-12-15 11:33:52 -07:00
|
|
|
* entry time. This makes a full
|
|
|
|
* syscall record available if some
|
|
|
|
* other part of the kernel decides it
|
|
|
|
* should be recorded. */
|
|
|
|
AUDIT_RECORD_CONTEXT /* Create the per-task audit_context,
|
|
|
|
* always fill it in at syscall entry
|
|
|
|
* time, and always write out the audit
|
|
|
|
* record at syscall exit time. */
|
|
|
|
};
|
|
|
|
|
|
|
|
/* Rule lists */
|
2009-06-11 12:31:36 -06:00
|
|
|
struct audit_watch;
|
2015-08-05 14:29:36 -06:00
|
|
|
struct audit_fsnotify_mark;
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 06:04:18 -06:00
|
|
|
struct audit_tree;
|
|
|
|
struct audit_chunk;
|
|
|
|
|
2005-12-15 11:33:52 -07:00
|
|
|
struct audit_entry {
|
2006-02-07 10:05:27 -07:00
|
|
|
struct list_head list;
|
|
|
|
struct rcu_head rcu;
|
|
|
|
struct audit_krule rule;
|
2005-12-15 11:33:52 -07:00
|
|
|
};
|
|
|
|
|
2013-04-30 13:30:32 -06:00
|
|
|
struct audit_cap_data {
|
|
|
|
kernel_cap_t permitted;
|
|
|
|
kernel_cap_t inheritable;
|
|
|
|
union {
|
|
|
|
unsigned int fE; /* effective bit of file cap */
|
|
|
|
kernel_cap_t effective; /* effective set of process */
|
|
|
|
};
|
audit: add ambient capabilities to CAPSET and BPRM_FCAPS records
Capabilities were augmented to include ambient capabilities in v4.3
commit 58319057b784 ("capabilities: ambient capabilities").
Add ambient capabilities to the audit BPRM_FCAPS and CAPSET records.
The record contains fields "old_pp", "old_pi", "old_pe", "new_pp",
"new_pi", "new_pe" so in keeping with the previous record
normalizations, change the "new_*" variants to simply drop the "new_"
prefix.
A sample of the replaced BPRM_FCAPS record:
RAW: type=BPRM_FCAPS msg=audit(1491468034.252:237): fver=2
fp=0000000000200000 fi=0000000000000000 fe=1 old_pp=0000000000000000
old_pi=0000000000000000 old_pe=0000000000000000 old_pa=0000000000000000
pp=0000000000200000 pi=0000000000000000 pe=0000000000200000
pa=0000000000000000
INTERPRET: type=BPRM_FCAPS msg=audit(04/06/2017 04:40:34.252:237):
fver=2 fp=sys_admin fi=none fe=chown old_pp=none old_pi=none
old_pe=none old_pa=none pp=sys_admin pi=none pe=sys_admin pa=none
A sample of the replaced CAPSET record:
RAW: type=CAPSET msg=audit(1491469502.371:242): pid=833
cap_pi=0000003fffffffff cap_pp=0000003fffffffff cap_pe=0000003fffffffff
cap_pa=0000000000000000
INTERPRET: type=CAPSET msg=audit(04/06/2017 05:05:02.371:242) : pid=833
cap_pi=chown,dac_override,dac_read_search,fowner,fsetid,kill,
setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,
net_admin,net_raw,ipc_lock,ipc_owner,sys_module,sys_rawio,sys_chroot,
sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_time,
sys_tty_config,mknod,lease,audit_write,audit_control,setfcap,
mac_override,mac_admin,syslog,wake_alarm,block_suspend,audit_read
cap_pp=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,
setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,
net_admin,net_raw,ipc_lock,ipc_owner,sys_module,sys_rawio,sys_chroot,
sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,
sys_time,sys_tty_config,mknod,lease,audit_write,audit_control,setfcap,
mac_override,mac_admin,syslog,wake_alarm,block_suspend,audit_read
cap_pe=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,
setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,
net_admin,net_raw,ipc_lock,ipc_owner,sys_module,sys_rawio,sys_chroot,
sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,
sys_time,sys_tty_config,mknod,lease,audit_write,audit_control,setfcap,
mac_override,mac_admin,syslog,wake_alarm,block_suspend,audit_read
cap_pa=none
See: https://github.com/linux-audit/audit-kernel/issues/40
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
2017-04-07 08:17:27 -06:00
|
|
|
kernel_cap_t ambient;
|
2019-01-23 19:36:25 -07:00
|
|
|
kuid_t rootid;
|
2013-04-30 13:30:32 -06:00
|
|
|
};
|
|
|
|
|
2015-01-21 22:00:23 -07:00
|
|
|
/* When fs/namei.c:getname() is called, we store the pointer in name and bump
|
|
|
|
* the refcnt in the associated filename struct.
|
2013-04-30 13:30:32 -06:00
|
|
|
*
|
|
|
|
* Further, in fs/namei.c:path_lookup() we store the inode and device.
|
|
|
|
*/
|
|
|
|
struct audit_names {
|
|
|
|
struct list_head list; /* audit_context->names_list */
|
|
|
|
|
|
|
|
struct filename *name;
|
|
|
|
int name_len; /* number of chars to log */
|
2013-07-08 16:59:36 -06:00
|
|
|
bool hidden; /* don't log this record */
|
2013-04-30 13:30:32 -06:00
|
|
|
|
|
|
|
unsigned long ino;
|
|
|
|
dev_t dev;
|
|
|
|
umode_t mode;
|
|
|
|
kuid_t uid;
|
|
|
|
kgid_t gid;
|
|
|
|
dev_t rdev;
|
|
|
|
u32 osid;
|
|
|
|
struct audit_cap_data fcap;
|
|
|
|
unsigned int fcap_ver;
|
|
|
|
unsigned char type; /* record type */
|
|
|
|
/*
|
|
|
|
* This was an allocated audit_names and not from the array of
|
|
|
|
* names allocated in the task audit context. Thus this name
|
|
|
|
* should be freed on syscall exit.
|
|
|
|
*/
|
|
|
|
bool should_free;
|
|
|
|
};
|
|
|
|
|
audit: Audit proc/<pid>/cmdline aka proctitle
During an audit event, cache and print the value of the process's
proctitle value (proc/<pid>/cmdline). This is useful in situations
where processes are started via fork'd virtual machines where the
comm field is incorrect. Often times, setting the comm field still
is insufficient as the comm width is not very wide and most
virtual machine "package names" do not fit. Also, during execution,
many threads have their comm field set as well. By tying it back to
the global cmdline value for the process, audit records will be more
complete in systems with these properties. An example of where this
is useful and applicable is in the realm of Android. With Android,
their is no fork/exec for VM instances. The bare, preloaded Dalvik
VM listens for a fork and specialize request. When this request comes
in, the VM forks, and the loads the specific application (specializing).
This was done to take advantage of COW and to not require a load of
basic packages by the VM on very app spawn. When this spawn occurs,
the package name is set via setproctitle() and shows up in procfs.
Many of these package names are longer then 16 bytes, the historical
width of task->comm. Having the cmdline in the audit records will
couple the application back to the record directly. Also, on my
Debian development box, some audit records were more useful then
what was printed under comm.
The cached proctitle is tied to the life-cycle of the audit_context
structure and is built on demand.
Proctitle is controllable by userspace, and thus should not be trusted.
It is meant as an aid to assist in debugging. The proctitle event is
emitted during syscall audits, and can be filtered with auditctl.
Example:
type=AVC msg=audit(1391217013.924:386): avc: denied { getattr } for pid=1971 comm="mkdir" name="/" dev="selinuxfs" ino=1 scontext=system_u:system_r:consolekit_t:s0-s0:c0.c255 tcontext=system_u:object_r:security_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1391217013.924:386): arch=c000003e syscall=137 success=yes exit=0 a0=7f019dfc8bd7 a1=7fffa6aed2c0 a2=fffffffffff4bd25 a3=7fffa6aed050 items=0 ppid=1967 pid=1971 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mkdir" exe="/bin/mkdir" subj=system_u:system_r:consolekit_t:s0-s0:c0.c255 key=(null)
type=UNKNOWN[1327] msg=audit(1391217013.924:386): proctitle=6D6B646972002D70002F7661722F72756E2F636F6E736F6C65
Acked-by: Steve Grubb <sgrubb@redhat.com> (wrt record formating)
Signed-off-by: William Roberts <wroberts@tresys.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
2014-02-11 11:12:01 -07:00
|
|
|
struct audit_proctitle {
|
|
|
|
int len; /* length of the cmdline field. */
|
|
|
|
char *value; /* the cmdline field */
|
|
|
|
};
|
|
|
|
|
2013-04-30 13:30:32 -06:00
|
|
|
/* The per-task audit context. */
|
|
|
|
struct audit_context {
|
|
|
|
int dummy; /* must be the first element */
|
|
|
|
int in_syscall; /* 1 if task is in a syscall */
|
|
|
|
enum audit_state state, current_state;
|
|
|
|
unsigned int serial; /* serial number for record */
|
|
|
|
int major; /* syscall number */
|
2017-05-02 08:16:05 -06:00
|
|
|
struct timespec64 ctime; /* time of syscall entry */
|
2013-04-30 13:30:32 -06:00
|
|
|
unsigned long argv[4]; /* syscall arguments */
|
|
|
|
long return_code;/* syscall return code */
|
|
|
|
u64 prio;
|
|
|
|
int return_valid; /* return code is valid */
|
|
|
|
/*
|
|
|
|
* The names_list is the list of all audit_names collected during this
|
|
|
|
* syscall. The first AUDIT_NAMES entries in the names_list will
|
|
|
|
* actually be from the preallocated_names array for performance
|
|
|
|
* reasons. Except during allocation they should never be referenced
|
|
|
|
* through the preallocated_names array and should only be found/used
|
|
|
|
* by running the names_list.
|
|
|
|
*/
|
|
|
|
struct audit_names preallocated_names[AUDIT_NAMES];
|
|
|
|
int name_count; /* total records in names_list */
|
|
|
|
struct list_head names_list; /* struct audit_names->list anchor */
|
|
|
|
char *filterkey; /* key for rule that triggered record */
|
|
|
|
struct path pwd;
|
|
|
|
struct audit_aux_data *aux;
|
|
|
|
struct audit_aux_data *aux_pids;
|
|
|
|
struct sockaddr_storage *sockaddr;
|
|
|
|
size_t sockaddr_len;
|
|
|
|
/* Save things to print about task_struct */
|
|
|
|
pid_t pid, ppid;
|
|
|
|
kuid_t uid, euid, suid, fsuid;
|
|
|
|
kgid_t gid, egid, sgid, fsgid;
|
|
|
|
unsigned long personality;
|
|
|
|
int arch;
|
|
|
|
|
|
|
|
pid_t target_pid;
|
|
|
|
kuid_t target_auid;
|
|
|
|
kuid_t target_uid;
|
|
|
|
unsigned int target_sessionid;
|
|
|
|
u32 target_sid;
|
|
|
|
char target_comm[TASK_COMM_LEN];
|
|
|
|
|
|
|
|
struct audit_tree_refs *trees, *first_trees;
|
|
|
|
struct list_head killed_trees;
|
|
|
|
int tree_count;
|
|
|
|
|
|
|
|
int type;
|
|
|
|
union {
|
|
|
|
struct {
|
|
|
|
int nargs;
|
|
|
|
long args[6];
|
|
|
|
} socketcall;
|
|
|
|
struct {
|
|
|
|
kuid_t uid;
|
|
|
|
kgid_t gid;
|
|
|
|
umode_t mode;
|
|
|
|
u32 osid;
|
|
|
|
int has_perm;
|
|
|
|
uid_t perm_uid;
|
|
|
|
gid_t perm_gid;
|
|
|
|
umode_t perm_mode;
|
|
|
|
unsigned long qbytes;
|
|
|
|
} ipc;
|
|
|
|
struct {
|
|
|
|
mqd_t mqdes;
|
|
|
|
struct mq_attr mqstat;
|
|
|
|
} mq_getsetattr;
|
|
|
|
struct {
|
|
|
|
mqd_t mqdes;
|
|
|
|
int sigev_signo;
|
|
|
|
} mq_notify;
|
|
|
|
struct {
|
|
|
|
mqd_t mqdes;
|
|
|
|
size_t msg_len;
|
|
|
|
unsigned int msg_prio;
|
2017-08-02 20:51:11 -06:00
|
|
|
struct timespec64 abs_timeout;
|
2013-04-30 13:30:32 -06:00
|
|
|
} mq_sendrecv;
|
|
|
|
struct {
|
|
|
|
int oflag;
|
|
|
|
umode_t mode;
|
|
|
|
struct mq_attr attr;
|
|
|
|
} mq_open;
|
|
|
|
struct {
|
|
|
|
pid_t pid;
|
|
|
|
struct audit_cap_data cap;
|
|
|
|
} capset;
|
|
|
|
struct {
|
|
|
|
int fd;
|
|
|
|
int flags;
|
|
|
|
} mmap;
|
2013-10-30 15:56:13 -06:00
|
|
|
struct {
|
|
|
|
int argc;
|
|
|
|
} execve;
|
2017-02-04 11:10:38 -07:00
|
|
|
struct {
|
|
|
|
char *name;
|
|
|
|
} module;
|
2013-04-30 13:30:32 -06:00
|
|
|
};
|
|
|
|
int fds[2];
|
audit: Audit proc/<pid>/cmdline aka proctitle
During an audit event, cache and print the value of the process's
proctitle value (proc/<pid>/cmdline). This is useful in situations
where processes are started via fork'd virtual machines where the
comm field is incorrect. Often times, setting the comm field still
is insufficient as the comm width is not very wide and most
virtual machine "package names" do not fit. Also, during execution,
many threads have their comm field set as well. By tying it back to
the global cmdline value for the process, audit records will be more
complete in systems with these properties. An example of where this
is useful and applicable is in the realm of Android. With Android,
their is no fork/exec for VM instances. The bare, preloaded Dalvik
VM listens for a fork and specialize request. When this request comes
in, the VM forks, and the loads the specific application (specializing).
This was done to take advantage of COW and to not require a load of
basic packages by the VM on very app spawn. When this spawn occurs,
the package name is set via setproctitle() and shows up in procfs.
Many of these package names are longer then 16 bytes, the historical
width of task->comm. Having the cmdline in the audit records will
couple the application back to the record directly. Also, on my
Debian development box, some audit records were more useful then
what was printed under comm.
The cached proctitle is tied to the life-cycle of the audit_context
structure and is built on demand.
Proctitle is controllable by userspace, and thus should not be trusted.
It is meant as an aid to assist in debugging. The proctitle event is
emitted during syscall audits, and can be filtered with auditctl.
Example:
type=AVC msg=audit(1391217013.924:386): avc: denied { getattr } for pid=1971 comm="mkdir" name="/" dev="selinuxfs" ino=1 scontext=system_u:system_r:consolekit_t:s0-s0:c0.c255 tcontext=system_u:object_r:security_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1391217013.924:386): arch=c000003e syscall=137 success=yes exit=0 a0=7f019dfc8bd7 a1=7fffa6aed2c0 a2=fffffffffff4bd25 a3=7fffa6aed050 items=0 ppid=1967 pid=1971 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mkdir" exe="/bin/mkdir" subj=system_u:system_r:consolekit_t:s0-s0:c0.c255 key=(null)
type=UNKNOWN[1327] msg=audit(1391217013.924:386): proctitle=6D6B646972002D70002F7661722F72756E2F636F6E736F6C65
Acked-by: Steve Grubb <sgrubb@redhat.com> (wrt record formating)
Signed-off-by: William Roberts <wroberts@tresys.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
2014-02-11 11:12:01 -07:00
|
|
|
struct audit_proctitle proctitle;
|
2013-04-30 13:30:32 -06:00
|
|
|
};
|
|
|
|
|
2017-09-01 07:44:57 -06:00
|
|
|
extern bool audit_ever_enabled;
|
2008-04-27 03:39:17 -06:00
|
|
|
|
2018-11-16 10:16:35 -07:00
|
|
|
extern void audit_log_session_info(struct audit_buffer *ab);
|
|
|
|
|
2017-05-02 08:16:05 -06:00
|
|
|
extern int auditd_test_task(struct task_struct *task);
|
2005-12-15 11:33:52 -07:00
|
|
|
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 14:55:56 -06:00
|
|
|
#define AUDIT_INODE_BUCKETS 32
|
|
|
|
extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
|
|
|
|
|
|
|
|
static inline int audit_hash_ino(u32 ino)
|
|
|
|
{
|
|
|
|
return (ino & (AUDIT_INODE_BUCKETS-1));
|
|
|
|
}
|
|
|
|
|
2012-10-10 13:25:25 -06:00
|
|
|
/* Indicates that audit should log the full pathname. */
|
|
|
|
#define AUDIT_NAME_FULL -1
|
|
|
|
|
2006-08-31 17:26:40 -06:00
|
|
|
extern int audit_match_class(int class, unsigned syscall);
|
[PATCH] audit: path-based rules
In this implementation, audit registers inotify watches on the parent
directories of paths specified in audit rules. When audit's inotify
event handler is called, it updates any affected rules based on the
filesystem event. If the parent directory is renamed, removed, or its
filesystem is unmounted, audit removes all rules referencing that
inotify watch.
To keep things simple, this implementation limits location-based
auditing to the directory entries in an existing directory. Given
a path-based rule for /foo/bar/passwd, the following table applies:
passwd modified -- audit event logged
passwd replaced -- audit event logged, rules list updated
bar renamed -- rule removed
foo renamed -- untracked, meaning that the rule now applies to
the new location
Audit users typically want to have many rules referencing filesystem
objects, which can significantly impact filtering performance. This
patch also adds an inode-number-based rule hash to mitigate this
situation.
The patch is relative to the audit git tree:
http://kernel.org/git/?p=linux/kernel/git/viro/audit-current.git;a=summary
and uses the inotify kernel API:
http://lkml.org/lkml/2006/6/1/145
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2006-04-07 14:55:56 -06:00
|
|
|
extern int audit_comparator(const u32 left, const u32 op, const u32 right);
|
2012-09-11 03:18:08 -06:00
|
|
|
extern int audit_uid_comparator(kuid_t left, u32 op, kuid_t right);
|
|
|
|
extern int audit_gid_comparator(kgid_t left, u32 op, kgid_t right);
|
2012-10-10 13:25:23 -06:00
|
|
|
extern int parent_len(const char *path);
|
2019-04-26 12:11:05 -06:00
|
|
|
extern int audit_compare_dname_path(const struct qstr *dname, const char *path, int plen);
|
2017-05-02 08:16:05 -06:00
|
|
|
extern struct sk_buff *audit_make_reply(int seq, int type, int done, int multi,
|
2013-08-14 09:32:45 -06:00
|
|
|
const void *payload, int size);
|
2005-12-15 11:33:52 -07:00
|
|
|
extern void audit_panic(const char *message);
|
2006-03-10 17:14:06 -07:00
|
|
|
|
2006-05-21 23:09:24 -06:00
|
|
|
struct audit_netlink_list {
|
2013-08-14 09:32:45 -06:00
|
|
|
__u32 portid;
|
2014-02-28 11:49:05 -07:00
|
|
|
struct net *net;
|
2006-05-21 23:09:24 -06:00
|
|
|
struct sk_buff_head q;
|
|
|
|
};
|
|
|
|
|
2020-04-21 07:10:56 -06:00
|
|
|
int audit_send_list_thread(void *_dest);
|
2006-05-21 23:09:24 -06:00
|
|
|
|
2006-03-10 17:14:06 -07:00
|
|
|
extern int selinux_audit_rule_update(void);
|
2006-05-25 08:19:47 -06:00
|
|
|
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 06:04:18 -06:00
|
|
|
extern struct mutex audit_filter_mutex;
|
2017-06-11 20:33:03 -06:00
|
|
|
extern int audit_del_rule(struct audit_entry *entry);
|
|
|
|
extern void audit_free_rule_rcu(struct rcu_head *head);
|
2008-04-27 03:39:17 -06:00
|
|
|
extern struct list_head audit_filter_list[];
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 06:04:18 -06:00
|
|
|
|
2009-12-17 18:12:06 -07:00
|
|
|
extern struct audit_entry *audit_dupe_rule(struct audit_krule *old);
|
|
|
|
|
2015-02-22 19:20:00 -07:00
|
|
|
extern void audit_log_d_path_exe(struct audit_buffer *ab,
|
|
|
|
struct mm_struct *mm);
|
|
|
|
|
2018-11-26 16:40:07 -07:00
|
|
|
extern struct tty_struct *audit_get_tty(void);
|
2016-06-28 10:07:50 -06:00
|
|
|
extern void audit_put_tty(struct tty_struct *tty);
|
|
|
|
|
2019-01-22 15:07:41 -07:00
|
|
|
/* audit watch/mark/tree functions */
|
2018-11-16 10:17:35 -07:00
|
|
|
#ifdef CONFIG_AUDITSYSCALL
|
2019-02-05 14:06:30 -07:00
|
|
|
extern unsigned int audit_serial(void);
|
|
|
|
extern int auditsc_get_stamp(struct audit_context *ctx,
|
|
|
|
struct timespec64 *t, unsigned int *serial);
|
|
|
|
|
2009-06-11 12:31:36 -06:00
|
|
|
extern void audit_put_watch(struct audit_watch *watch);
|
|
|
|
extern void audit_get_watch(struct audit_watch *watch);
|
2019-01-22 15:07:41 -07:00
|
|
|
extern int audit_to_watch(struct audit_krule *krule, char *path, int len,
|
|
|
|
u32 op);
|
2009-12-17 18:12:04 -07:00
|
|
|
extern int audit_add_watch(struct audit_krule *krule, struct list_head **list);
|
2009-12-17 18:12:05 -07:00
|
|
|
extern void audit_remove_watch_rule(struct audit_krule *krule);
|
2009-06-11 12:31:36 -06:00
|
|
|
extern char *audit_watch_path(struct audit_watch *watch);
|
2019-01-22 15:07:41 -07:00
|
|
|
extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino,
|
|
|
|
dev_t dev);
|
2015-08-05 14:29:36 -06:00
|
|
|
|
2019-01-22 15:07:41 -07:00
|
|
|
extern struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule,
|
|
|
|
char *pathname, int len);
|
2015-08-05 14:29:36 -06:00
|
|
|
extern char *audit_mark_path(struct audit_fsnotify_mark *mark);
|
|
|
|
extern void audit_remove_mark(struct audit_fsnotify_mark *audit_mark);
|
|
|
|
extern void audit_remove_mark_rule(struct audit_krule *krule);
|
2019-01-22 15:07:41 -07:00
|
|
|
extern int audit_mark_compare(struct audit_fsnotify_mark *mark,
|
|
|
|
unsigned long ino, dev_t dev);
|
2015-08-05 14:29:37 -06:00
|
|
|
extern int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old);
|
2019-01-22 15:07:41 -07:00
|
|
|
extern int audit_exe_compare(struct task_struct *tsk,
|
|
|
|
struct audit_fsnotify_mark *mark);
|
2015-08-05 14:29:36 -06:00
|
|
|
|
2019-01-22 15:07:41 -07:00
|
|
|
extern struct audit_chunk *audit_tree_lookup(const struct inode *inode);
|
|
|
|
extern void audit_put_chunk(struct audit_chunk *chunk);
|
|
|
|
extern bool audit_tree_match(struct audit_chunk *chunk,
|
|
|
|
struct audit_tree *tree);
|
|
|
|
extern int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op);
|
|
|
|
extern int audit_add_tree_rule(struct audit_krule *rule);
|
|
|
|
extern int audit_remove_tree_rule(struct audit_krule *rule);
|
|
|
|
extern void audit_trim_trees(void);
|
|
|
|
extern int audit_tag_tree(char *old, char *new);
|
|
|
|
extern const char *audit_tree_path(struct audit_tree *tree);
|
|
|
|
extern void audit_put_tree(struct audit_tree *tree);
|
|
|
|
extern void audit_kill_trees(struct audit_context *context);
|
|
|
|
|
2019-05-10 10:21:49 -06:00
|
|
|
extern int audit_signal_info_syscall(struct task_struct *t);
|
2019-01-22 15:07:41 -07:00
|
|
|
extern void audit_filter_inodes(struct task_struct *tsk,
|
|
|
|
struct audit_context *ctx);
|
|
|
|
extern struct list_head *audit_killed_trees(void);
|
2020-03-10 07:20:17 -06:00
|
|
|
|
|
|
|
static inline void audit_clear_dummy(struct audit_context *ctx)
|
|
|
|
{
|
|
|
|
if (ctx)
|
|
|
|
ctx->dummy = 0;
|
|
|
|
}
|
|
|
|
|
2019-01-22 15:07:41 -07:00
|
|
|
#else /* CONFIG_AUDITSYSCALL */
|
2019-02-05 14:06:30 -07:00
|
|
|
#define auditsc_get_stamp(c, t, s) 0
|
2009-12-17 18:12:06 -07:00
|
|
|
#define audit_put_watch(w) {}
|
|
|
|
#define audit_get_watch(w) {}
|
|
|
|
#define audit_to_watch(k, p, l, o) (-EINVAL)
|
|
|
|
#define audit_add_watch(k, l) (-EINVAL)
|
|
|
|
#define audit_remove_watch_rule(k) BUG()
|
|
|
|
#define audit_watch_path(w) ""
|
|
|
|
#define audit_watch_compare(w, i, d) 0
|
|
|
|
|
2015-08-05 14:29:36 -06:00
|
|
|
#define audit_alloc_mark(k, p, l) (ERR_PTR(-EINVAL))
|
|
|
|
#define audit_mark_path(m) ""
|
|
|
|
#define audit_remove_mark(m)
|
|
|
|
#define audit_remove_mark_rule(k)
|
|
|
|
#define audit_mark_compare(m, i, d) 0
|
2015-08-05 14:29:37 -06:00
|
|
|
#define audit_exe_compare(t, m) (-EINVAL)
|
|
|
|
#define audit_dupe_exe(n, o) (-EINVAL)
|
2009-06-11 12:31:36 -06:00
|
|
|
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 06:04:18 -06:00
|
|
|
#define audit_remove_tree_rule(rule) BUG()
|
|
|
|
#define audit_add_tree_rule(rule) -EINVAL
|
|
|
|
#define audit_make_tree(rule, str, op) -EINVAL
|
|
|
|
#define audit_trim_trees() (void)0
|
|
|
|
#define audit_put_tree(tree) (void)0
|
|
|
|
#define audit_tag_tree(old, new) -EINVAL
|
|
|
|
#define audit_tree_path(rule) "" /* never called */
|
2018-12-10 15:17:50 -07:00
|
|
|
#define audit_kill_trees(context) BUG()
|
2019-01-22 15:07:41 -07:00
|
|
|
|
2019-05-10 10:21:49 -06:00
|
|
|
static inline int audit_signal_info_syscall(struct task_struct *t)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2019-01-22 15:07:41 -07:00
|
|
|
#define audit_filter_inodes(t, c) AUDIT_DISABLED
|
2020-03-10 07:20:17 -06:00
|
|
|
#define audit_clear_dummy(c) {}
|
2019-01-22 15:07:41 -07:00
|
|
|
#endif /* CONFIG_AUDITSYSCALL */
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 06:04:18 -06:00
|
|
|
|
2017-06-11 20:33:03 -06:00
|
|
|
extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);
|
[PATCH] audit: watching subtrees
New kind of audit rule predicates: "object is visible in given subtree".
The part that can be sanely implemented, that is. Limitations:
* if you have hardlink from outside of tree, you'd better watch
it too (or just watch the object itself, obviously)
* if you mount something under a watched tree, tell audit
that new chunk should be added to watched subtrees
* if you umount something in a watched tree and it's still mounted
elsewhere, you will get matches on events happening there. New command
tells audit to recalculate the trees, trimming such sources of false
positives.
Note that it's _not_ about path - if something mounted in several places
(multiple mount, bindings, different namespaces, etc.), the match does
_not_ depend on which one we are using for access.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2007-07-22 06:04:18 -06:00
|
|
|
|
2008-04-27 03:39:17 -06:00
|
|
|
extern pid_t audit_sig_pid;
|
2012-02-07 17:53:48 -07:00
|
|
|
extern kuid_t audit_sig_uid;
|
2008-04-27 03:39:17 -06:00
|
|
|
extern u32 audit_sig_sid;
|
|
|
|
|
2016-06-24 14:35:46 -06:00
|
|
|
extern int audit_filter(int msgtype, unsigned int listtype);
|
|
|
|
|
2018-02-20 07:52:38 -07:00
|
|
|
extern void audit_ctl_lock(void);
|
|
|
|
extern void audit_ctl_unlock(void);
|