1 /* SPDX-License-Identifier: GPL-2.0-or-later */ 2 /* audit.h -- Auditing support 3 * 4 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina. 5 * All Rights Reserved. 6 * 7 * Written by Rickard E. (Rik) Faith <[email protected]> 8 */ 9 #ifndef _LINUX_AUDIT_H_ 10 #define _LINUX_AUDIT_H_ 11 12 #include <linux/sched.h> 13 #include <linux/ptrace.h> 14 #include <uapi/linux/audit.h> 15 16 #define AUDIT_INO_UNSET ((unsigned long)-1) 17 #define AUDIT_DEV_UNSET ((dev_t)-1) 18 19 struct audit_sig_info { 20 uid_t uid; 21 pid_t pid; 22 char ctx[0]; 23 }; 24 25 struct audit_buffer; 26 struct audit_context; 27 struct inode; 28 struct netlink_skb_parms; 29 struct path; 30 struct linux_binprm; 31 struct mq_attr; 32 struct mqstat; 33 struct audit_watch; 34 struct audit_tree; 35 struct sk_buff; 36 37 struct audit_krule { 38 u32 pflags; 39 u32 flags; 40 u32 listnr; 41 u32 action; 42 u32 mask[AUDIT_BITMASK_SIZE]; 43 u32 buflen; /* for data alloc on list rules */ 44 u32 field_count; 45 char *filterkey; /* ties events to rules */ 46 struct audit_field *fields; 47 struct audit_field *arch_f; /* quick access to arch field */ 48 struct audit_field *inode_f; /* quick access to an inode field */ 49 struct audit_watch *watch; /* associated watch */ 50 struct audit_tree *tree; /* associated watched tree */ 51 struct audit_fsnotify_mark *exe; 52 struct list_head rlist; /* entry in audit_{watch,tree}.rules list */ 53 struct list_head list; /* for AUDIT_LIST* purposes only */ 54 u64 prio; 55 }; 56 57 /* Flag to indicate legacy AUDIT_LOGINUID unset usage */ 58 #define AUDIT_LOGINUID_LEGACY 0x1 59 60 struct audit_field { 61 u32 type; 62 union { 63 u32 val; 64 kuid_t uid; 65 kgid_t gid; 66 struct { 67 char *lsm_str; 68 void *lsm_rule; 69 }; 70 }; 71 u32 op; 72 }; 73 74 enum audit_ntp_type { 75 AUDIT_NTP_OFFSET, 76 AUDIT_NTP_FREQ, 77 AUDIT_NTP_STATUS, 78 AUDIT_NTP_TAI, 79 AUDIT_NTP_TICK, 80 AUDIT_NTP_ADJUST, 81 82 AUDIT_NTP_NVALS /* count */ 83 }; 84 85 #ifdef CONFIG_AUDITSYSCALL 86 struct audit_ntp_val { 87 long long oldval, newval; 88 }; 89 90 struct audit_ntp_data { 91 struct audit_ntp_val vals[AUDIT_NTP_NVALS]; 92 }; 93 #else 94 struct audit_ntp_data {}; 95 #endif 96 97 extern int is_audit_feature_set(int which); 98 99 extern int __init audit_register_class(int class, unsigned *list); 100 extern int audit_classify_syscall(int abi, unsigned syscall); 101 extern int audit_classify_arch(int arch); 102 /* only for compat system calls */ 103 extern unsigned compat_write_class[]; 104 extern unsigned compat_read_class[]; 105 extern unsigned compat_dir_class[]; 106 extern unsigned compat_chattr_class[]; 107 extern unsigned compat_signal_class[]; 108 109 extern int audit_classify_compat_syscall(int abi, unsigned syscall); 110 111 /* audit_names->type values */ 112 #define AUDIT_TYPE_UNKNOWN 0 /* we don't know yet */ 113 #define AUDIT_TYPE_NORMAL 1 /* a "normal" audit record */ 114 #define AUDIT_TYPE_PARENT 2 /* a parent audit record */ 115 #define AUDIT_TYPE_CHILD_DELETE 3 /* a child being deleted */ 116 #define AUDIT_TYPE_CHILD_CREATE 4 /* a child being created */ 117 118 /* maximized args number that audit_socketcall can process */ 119 #define AUDITSC_ARGS 6 120 121 /* bit values for ->signal->audit_tty */ 122 #define AUDIT_TTY_ENABLE BIT(0) 123 #define AUDIT_TTY_LOG_PASSWD BIT(1) 124 125 struct filename; 126 127 #define AUDIT_OFF 0 128 #define AUDIT_ON 1 129 #define AUDIT_LOCKED 2 130 #ifdef CONFIG_AUDIT 131 /* These are defined in audit.c */ 132 /* Public API */ 133 extern __printf(4, 5) 134 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 135 const char *fmt, ...); 136 137 extern struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type); 138 extern __printf(2, 3) 139 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...); 140 extern void audit_log_end(struct audit_buffer *ab); 141 extern bool audit_string_contains_control(const char *string, 142 size_t len); 143 extern void audit_log_n_hex(struct audit_buffer *ab, 144 const unsigned char *buf, 145 size_t len); 146 extern void audit_log_n_string(struct audit_buffer *ab, 147 const char *buf, 148 size_t n); 149 extern void audit_log_n_untrustedstring(struct audit_buffer *ab, 150 const char *string, 151 size_t n); 152 extern void audit_log_untrustedstring(struct audit_buffer *ab, 153 const char *string); 154 extern void audit_log_d_path(struct audit_buffer *ab, 155 const char *prefix, 156 const struct path *path); 157 extern void audit_log_key(struct audit_buffer *ab, 158 char *key); 159 extern void audit_log_link_denied(const char *operation); 160 extern void audit_log_lost(const char *message); 161 162 extern int audit_log_task_context(struct audit_buffer *ab); 163 extern void audit_log_task_info(struct audit_buffer *ab); 164 165 extern int audit_update_lsm_rules(void); 166 167 /* Private API (for audit.c only) */ 168 extern int audit_rule_change(int type, int seq, void *data, size_t datasz); 169 extern int audit_list_rules_send(struct sk_buff *request_skb, int seq); 170 171 extern int audit_set_loginuid(kuid_t loginuid); 172 173 static inline kuid_t audit_get_loginuid(struct task_struct *tsk) 174 { 175 return tsk->loginuid; 176 } 177 178 static inline unsigned int audit_get_sessionid(struct task_struct *tsk) 179 { 180 return tsk->sessionid; 181 } 182 183 extern u32 audit_enabled; 184 185 extern int audit_signal_info(int sig, struct task_struct *t); 186 187 #else /* CONFIG_AUDIT */ 188 static inline __printf(4, 5) 189 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 190 const char *fmt, ...) 191 { } 192 static inline struct audit_buffer *audit_log_start(struct audit_context *ctx, 193 gfp_t gfp_mask, int type) 194 { 195 return NULL; 196 } 197 static inline __printf(2, 3) 198 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...) 199 { } 200 static inline void audit_log_end(struct audit_buffer *ab) 201 { } 202 static inline void audit_log_n_hex(struct audit_buffer *ab, 203 const unsigned char *buf, size_t len) 204 { } 205 static inline void audit_log_n_string(struct audit_buffer *ab, 206 const char *buf, size_t n) 207 { } 208 static inline void audit_log_n_untrustedstring(struct audit_buffer *ab, 209 const char *string, size_t n) 210 { } 211 static inline void audit_log_untrustedstring(struct audit_buffer *ab, 212 const char *string) 213 { } 214 static inline void audit_log_d_path(struct audit_buffer *ab, 215 const char *prefix, 216 const struct path *path) 217 { } 218 static inline void audit_log_key(struct audit_buffer *ab, char *key) 219 { } 220 static inline void audit_log_link_denied(const char *string) 221 { } 222 static inline int audit_log_task_context(struct audit_buffer *ab) 223 { 224 return 0; 225 } 226 static inline void audit_log_task_info(struct audit_buffer *ab) 227 { } 228 229 static inline kuid_t audit_get_loginuid(struct task_struct *tsk) 230 { 231 return INVALID_UID; 232 } 233 234 static inline unsigned int audit_get_sessionid(struct task_struct *tsk) 235 { 236 return AUDIT_SID_UNSET; 237 } 238 239 #define audit_enabled AUDIT_OFF 240 241 static inline int audit_signal_info(int sig, struct task_struct *t) 242 { 243 return 0; 244 } 245 246 #endif /* CONFIG_AUDIT */ 247 248 #ifdef CONFIG_AUDIT_COMPAT_GENERIC 249 #define audit_is_compat(arch) (!((arch) & __AUDIT_ARCH_64BIT)) 250 #else 251 #define audit_is_compat(arch) false 252 #endif 253 254 #define AUDIT_INODE_PARENT 1 /* dentry represents the parent */ 255 #define AUDIT_INODE_HIDDEN 2 /* audit record should be hidden */ 256 #define AUDIT_INODE_NOEVAL 4 /* audit record incomplete */ 257 258 #ifdef CONFIG_AUDITSYSCALL 259 #include <asm/syscall.h> /* for syscall_get_arch() */ 260 261 /* These are defined in auditsc.c */ 262 /* Public API */ 263 extern int audit_alloc(struct task_struct *task); 264 extern void __audit_free(struct task_struct *task); 265 extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1, 266 unsigned long a2, unsigned long a3); 267 extern void __audit_syscall_exit(int ret_success, long ret_value); 268 extern struct filename *__audit_reusename(const __user char *uptr); 269 extern void __audit_getname(struct filename *name); 270 271 extern void __audit_inode(struct filename *name, const struct dentry *dentry, 272 unsigned int flags); 273 extern void __audit_file(const struct file *); 274 extern void __audit_inode_child(struct inode *parent, 275 const struct dentry *dentry, 276 const unsigned char type); 277 extern void audit_seccomp(unsigned long syscall, long signr, int code); 278 extern void audit_seccomp_actions_logged(const char *names, 279 const char *old_names, int res); 280 extern void __audit_ptrace(struct task_struct *t); 281 282 static inline void audit_set_context(struct task_struct *task, struct audit_context *ctx) 283 { 284 task->audit_context = ctx; 285 } 286 287 static inline struct audit_context *audit_context(void) 288 { 289 return current->audit_context; 290 } 291 292 static inline bool audit_dummy_context(void) 293 { 294 void *p = audit_context(); 295 return !p || *(int *)p; 296 } 297 static inline void audit_free(struct task_struct *task) 298 { 299 if (unlikely(task->audit_context)) 300 __audit_free(task); 301 } 302 static inline void audit_syscall_entry(int major, unsigned long a0, 303 unsigned long a1, unsigned long a2, 304 unsigned long a3) 305 { 306 if (unlikely(audit_context())) 307 __audit_syscall_entry(major, a0, a1, a2, a3); 308 } 309 static inline void audit_syscall_exit(void *pt_regs) 310 { 311 if (unlikely(audit_context())) { 312 int success = is_syscall_success(pt_regs); 313 long return_code = regs_return_value(pt_regs); 314 315 __audit_syscall_exit(success, return_code); 316 } 317 } 318 static inline struct filename *audit_reusename(const __user char *name) 319 { 320 if (unlikely(!audit_dummy_context())) 321 return __audit_reusename(name); 322 return NULL; 323 } 324 static inline void audit_getname(struct filename *name) 325 { 326 if (unlikely(!audit_dummy_context())) 327 __audit_getname(name); 328 } 329 static inline void audit_inode(struct filename *name, 330 const struct dentry *dentry, 331 unsigned int aflags) { 332 if (unlikely(!audit_dummy_context())) 333 __audit_inode(name, dentry, aflags); 334 } 335 static inline void audit_file(struct file *file) 336 { 337 if (unlikely(!audit_dummy_context())) 338 __audit_file(file); 339 } 340 static inline void audit_inode_parent_hidden(struct filename *name, 341 const struct dentry *dentry) 342 { 343 if (unlikely(!audit_dummy_context())) 344 __audit_inode(name, dentry, 345 AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN); 346 } 347 static inline void audit_inode_child(struct inode *parent, 348 const struct dentry *dentry, 349 const unsigned char type) { 350 if (unlikely(!audit_dummy_context())) 351 __audit_inode_child(parent, dentry, type); 352 } 353 void audit_core_dumps(long signr); 354 355 static inline void audit_ptrace(struct task_struct *t) 356 { 357 if (unlikely(!audit_dummy_context())) 358 __audit_ptrace(t); 359 } 360 361 extern void audit_log_task(struct audit_buffer *ab); 362 363 /* Private API (for audit.c only) */ 364 extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp); 365 extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode); 366 extern void __audit_bprm(struct linux_binprm *bprm); 367 extern int __audit_socketcall(int nargs, unsigned long *args); 368 extern int __audit_sockaddr(int len, void *addr); 369 extern void __audit_fd_pair(int fd1, int fd2); 370 extern void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr); 371 extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec64 *abs_timeout); 372 extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification); 373 extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat); 374 extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm, 375 const struct cred *new, 376 const struct cred *old); 377 extern void __audit_log_capset(const struct cred *new, const struct cred *old); 378 extern void __audit_mmap_fd(int fd, int flags); 379 extern void __audit_log_kern_module(char *name); 380 extern void __audit_fanotify(unsigned int response); 381 extern void __audit_tk_injoffset(struct timespec64 offset); 382 extern void __audit_ntp_log(const struct audit_ntp_data *ad); 383 384 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) 385 { 386 if (unlikely(!audit_dummy_context())) 387 __audit_ipc_obj(ipcp); 388 } 389 static inline void audit_fd_pair(int fd1, int fd2) 390 { 391 if (unlikely(!audit_dummy_context())) 392 __audit_fd_pair(fd1, fd2); 393 } 394 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode) 395 { 396 if (unlikely(!audit_dummy_context())) 397 __audit_ipc_set_perm(qbytes, uid, gid, mode); 398 } 399 static inline void audit_bprm(struct linux_binprm *bprm) 400 { 401 if (unlikely(!audit_dummy_context())) 402 __audit_bprm(bprm); 403 } 404 static inline int audit_socketcall(int nargs, unsigned long *args) 405 { 406 if (unlikely(!audit_dummy_context())) 407 return __audit_socketcall(nargs, args); 408 return 0; 409 } 410 411 static inline int audit_socketcall_compat(int nargs, u32 *args) 412 { 413 unsigned long a[AUDITSC_ARGS]; 414 int i; 415 416 if (audit_dummy_context()) 417 return 0; 418 419 for (i = 0; i < nargs; i++) 420 a[i] = (unsigned long)args[i]; 421 return __audit_socketcall(nargs, a); 422 } 423 424 static inline int audit_sockaddr(int len, void *addr) 425 { 426 if (unlikely(!audit_dummy_context())) 427 return __audit_sockaddr(len, addr); 428 return 0; 429 } 430 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr) 431 { 432 if (unlikely(!audit_dummy_context())) 433 __audit_mq_open(oflag, mode, attr); 434 } 435 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec64 *abs_timeout) 436 { 437 if (unlikely(!audit_dummy_context())) 438 __audit_mq_sendrecv(mqdes, msg_len, msg_prio, abs_timeout); 439 } 440 static inline void audit_mq_notify(mqd_t mqdes, const struct sigevent *notification) 441 { 442 if (unlikely(!audit_dummy_context())) 443 __audit_mq_notify(mqdes, notification); 444 } 445 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) 446 { 447 if (unlikely(!audit_dummy_context())) 448 __audit_mq_getsetattr(mqdes, mqstat); 449 } 450 451 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm, 452 const struct cred *new, 453 const struct cred *old) 454 { 455 if (unlikely(!audit_dummy_context())) 456 return __audit_log_bprm_fcaps(bprm, new, old); 457 return 0; 458 } 459 460 static inline void audit_log_capset(const struct cred *new, 461 const struct cred *old) 462 { 463 if (unlikely(!audit_dummy_context())) 464 __audit_log_capset(new, old); 465 } 466 467 static inline void audit_mmap_fd(int fd, int flags) 468 { 469 if (unlikely(!audit_dummy_context())) 470 __audit_mmap_fd(fd, flags); 471 } 472 473 static inline void audit_log_kern_module(char *name) 474 { 475 if (!audit_dummy_context()) 476 __audit_log_kern_module(name); 477 } 478 479 static inline void audit_fanotify(unsigned int response) 480 { 481 if (!audit_dummy_context()) 482 __audit_fanotify(response); 483 } 484 485 static inline void audit_tk_injoffset(struct timespec64 offset) 486 { 487 /* ignore no-op events */ 488 if (offset.tv_sec == 0 && offset.tv_nsec == 0) 489 return; 490 491 if (!audit_dummy_context()) 492 __audit_tk_injoffset(offset); 493 } 494 495 static inline void audit_ntp_init(struct audit_ntp_data *ad) 496 { 497 memset(ad, 0, sizeof(*ad)); 498 } 499 500 static inline void audit_ntp_set_old(struct audit_ntp_data *ad, 501 enum audit_ntp_type type, long long val) 502 { 503 ad->vals[type].oldval = val; 504 } 505 506 static inline void audit_ntp_set_new(struct audit_ntp_data *ad, 507 enum audit_ntp_type type, long long val) 508 { 509 ad->vals[type].newval = val; 510 } 511 512 static inline void audit_ntp_log(const struct audit_ntp_data *ad) 513 { 514 if (!audit_dummy_context()) 515 __audit_ntp_log(ad); 516 } 517 518 extern int audit_n_rules; 519 extern int audit_signals; 520 #else /* CONFIG_AUDITSYSCALL */ 521 static inline int audit_alloc(struct task_struct *task) 522 { 523 return 0; 524 } 525 static inline void audit_free(struct task_struct *task) 526 { } 527 static inline void audit_syscall_entry(int major, unsigned long a0, 528 unsigned long a1, unsigned long a2, 529 unsigned long a3) 530 { } 531 static inline void audit_syscall_exit(void *pt_regs) 532 { } 533 static inline bool audit_dummy_context(void) 534 { 535 return true; 536 } 537 static inline void audit_set_context(struct task_struct *task, struct audit_context *ctx) 538 { } 539 static inline struct audit_context *audit_context(void) 540 { 541 return NULL; 542 } 543 static inline struct filename *audit_reusename(const __user char *name) 544 { 545 return NULL; 546 } 547 static inline void audit_getname(struct filename *name) 548 { } 549 static inline void __audit_inode(struct filename *name, 550 const struct dentry *dentry, 551 unsigned int flags) 552 { } 553 static inline void __audit_inode_child(struct inode *parent, 554 const struct dentry *dentry, 555 const unsigned char type) 556 { } 557 static inline void audit_inode(struct filename *name, 558 const struct dentry *dentry, 559 unsigned int aflags) 560 { } 561 static inline void audit_file(struct file *file) 562 { 563 } 564 static inline void audit_inode_parent_hidden(struct filename *name, 565 const struct dentry *dentry) 566 { } 567 static inline void audit_inode_child(struct inode *parent, 568 const struct dentry *dentry, 569 const unsigned char type) 570 { } 571 static inline void audit_core_dumps(long signr) 572 { } 573 static inline void audit_seccomp(unsigned long syscall, long signr, int code) 574 { } 575 static inline void audit_seccomp_actions_logged(const char *names, 576 const char *old_names, int res) 577 { } 578 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) 579 { } 580 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, 581 gid_t gid, umode_t mode) 582 { } 583 static inline void audit_bprm(struct linux_binprm *bprm) 584 { } 585 static inline int audit_socketcall(int nargs, unsigned long *args) 586 { 587 return 0; 588 } 589 590 static inline int audit_socketcall_compat(int nargs, u32 *args) 591 { 592 return 0; 593 } 594 595 static inline void audit_fd_pair(int fd1, int fd2) 596 { } 597 static inline int audit_sockaddr(int len, void *addr) 598 { 599 return 0; 600 } 601 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr) 602 { } 603 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, 604 unsigned int msg_prio, 605 const struct timespec64 *abs_timeout) 606 { } 607 static inline void audit_mq_notify(mqd_t mqdes, 608 const struct sigevent *notification) 609 { } 610 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) 611 { } 612 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm, 613 const struct cred *new, 614 const struct cred *old) 615 { 616 return 0; 617 } 618 static inline void audit_log_capset(const struct cred *new, 619 const struct cred *old) 620 { } 621 static inline void audit_mmap_fd(int fd, int flags) 622 { } 623 624 static inline void audit_log_kern_module(char *name) 625 { 626 } 627 628 static inline void audit_fanotify(unsigned int response) 629 { } 630 631 static inline void audit_tk_injoffset(struct timespec64 offset) 632 { } 633 634 static inline void audit_ntp_init(struct audit_ntp_data *ad) 635 { } 636 637 static inline void audit_ntp_set_old(struct audit_ntp_data *ad, 638 enum audit_ntp_type type, long long val) 639 { } 640 641 static inline void audit_ntp_set_new(struct audit_ntp_data *ad, 642 enum audit_ntp_type type, long long val) 643 { } 644 645 static inline void audit_ntp_log(const struct audit_ntp_data *ad) 646 { } 647 648 static inline void audit_ptrace(struct task_struct *t) 649 { } 650 651 static inline void audit_log_task(struct audit_buffer *ab) 652 { } 653 #define audit_n_rules 0 654 #define audit_signals 0 655 #endif /* CONFIG_AUDITSYSCALL */ 656 657 static inline bool audit_loginuid_set(struct task_struct *tsk) 658 { 659 return uid_valid(audit_get_loginuid(tsk)); 660 } 661 662 static inline void audit_log_string(struct audit_buffer *ab, const char *buf) 663 { 664 audit_log_n_string(ab, buf, strlen(buf)); 665 } 666 667 #endif 668