1 /* audit.h -- Auditing support 2 * 3 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina. 4 * All Rights Reserved. 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 2 of the License, or 9 * (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, write to the Free Software 18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19 * 20 * Written by Rickard E. (Rik) Faith <[email protected]> 21 * 22 */ 23 24 #ifndef _LINUX_AUDIT_H_ 25 #define _LINUX_AUDIT_H_ 26 27 #include <linux/sched.h> 28 #include <linux/elf.h> 29 30 /* Request and reply types */ 31 #define AUDIT_GET 1000 /* Get status */ 32 #define AUDIT_SET 1001 /* Set status (enable/disable/auditd) */ 33 #define AUDIT_LIST 1002 /* List filtering rules */ 34 #define AUDIT_ADD 1003 /* Add filtering rule */ 35 #define AUDIT_DEL 1004 /* Delete filtering rule */ 36 #define AUDIT_USER 1005 /* Send a message from user-space */ 37 #define AUDIT_LOGIN 1006 /* Define the login id and informaiton */ 38 #define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A REQUEST. */ 39 40 /* Rule flags */ 41 #define AUDIT_PER_TASK 0x01 /* Apply rule at task creation (not syscall) */ 42 #define AUDIT_AT_ENTRY 0x02 /* Apply rule at syscall entry */ 43 #define AUDIT_AT_EXIT 0x04 /* Apply rule at syscall exit */ 44 #define AUDIT_PREPEND 0x10 /* Prepend to front of list */ 45 46 /* Rule actions */ 47 #define AUDIT_NEVER 0 /* Do not build context if rule matches */ 48 #define AUDIT_POSSIBLE 1 /* Build context if rule matches */ 49 #define AUDIT_ALWAYS 2 /* Generate audit record if rule matches */ 50 51 /* Rule structure sizes -- if these change, different AUDIT_ADD and 52 * AUDIT_LIST commands must be implemented. */ 53 #define AUDIT_MAX_FIELDS 64 54 #define AUDIT_BITMASK_SIZE 64 55 #define AUDIT_WORD(nr) ((__u32)((nr)/32)) 56 #define AUDIT_BIT(nr) (1 << ((nr) - AUDIT_WORD(nr)*32)) 57 58 /* Rule fields */ 59 /* These are useful when checking the 60 * task structure at task creation time 61 * (AUDIT_PER_TASK). */ 62 #define AUDIT_PID 0 63 #define AUDIT_UID 1 64 #define AUDIT_EUID 2 65 #define AUDIT_SUID 3 66 #define AUDIT_FSUID 4 67 #define AUDIT_GID 5 68 #define AUDIT_EGID 6 69 #define AUDIT_SGID 7 70 #define AUDIT_FSGID 8 71 #define AUDIT_LOGINUID 9 72 #define AUDIT_PERS 10 73 #define AUDIT_ARCH 11 74 75 /* These are ONLY useful when checking 76 * at syscall exit time (AUDIT_AT_EXIT). */ 77 #define AUDIT_DEVMAJOR 100 78 #define AUDIT_DEVMINOR 101 79 #define AUDIT_INODE 102 80 #define AUDIT_EXIT 103 81 #define AUDIT_SUCCESS 104 /* exit >= 0; value ignored */ 82 83 #define AUDIT_ARG0 200 84 #define AUDIT_ARG1 (AUDIT_ARG0+1) 85 #define AUDIT_ARG2 (AUDIT_ARG0+2) 86 #define AUDIT_ARG3 (AUDIT_ARG0+3) 87 88 #define AUDIT_NEGATE 0x80000000 89 90 91 /* Status symbols */ 92 /* Mask values */ 93 #define AUDIT_STATUS_ENABLED 0x0001 94 #define AUDIT_STATUS_FAILURE 0x0002 95 #define AUDIT_STATUS_PID 0x0004 96 #define AUDIT_STATUS_RATE_LIMIT 0x0008 97 #define AUDIT_STATUS_BACKLOG_LIMIT 0x0010 98 /* Failure-to-log actions */ 99 #define AUDIT_FAIL_SILENT 0 100 #define AUDIT_FAIL_PRINTK 1 101 #define AUDIT_FAIL_PANIC 2 102 103 /* distinguish syscall tables */ 104 #define __AUDIT_ARCH_64BIT 0x80000000 105 #define __AUDIT_ARCH_LE 0x40000000 106 #define AUDIT_ARCH_ALPHA (EM_ALPHA|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) 107 #define AUDIT_ARCH_ARM (EM_ARM|__AUDIT_ARCH_LE) 108 #define AUDIT_ARCH_ARMEB (EM_ARM) 109 #define AUDIT_ARCH_CRIS (EM_CRIS|__AUDIT_ARCH_LE) 110 #define AUDIT_ARCH_FRV (EM_FRV) 111 #define AUDIT_ARCH_H8300 (EM_H8_300) 112 #define AUDIT_ARCH_I386 (EM_386|__AUDIT_ARCH_LE) 113 #define AUDIT_ARCH_IA64 (EM_IA_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) 114 #define AUDIT_ARCH_M32R (EM_M32R) 115 #define AUDIT_ARCH_M68K (EM_68K) 116 #define AUDIT_ARCH_MIPS (EM_MIPS) 117 #define AUDIT_ARCH_MIPSEL (EM_MIPS|__AUDIT_ARCH_LE) 118 #define AUDIT_ARCH_MIPS64 (EM_MIPS|__AUDIT_ARCH_64BIT) 119 #define AUDIT_ARCH_MIPSEL64 (EM_MIPS|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) 120 #define AUDIT_ARCH_PARISC (EM_PARISC) 121 #define AUDIT_ARCH_PARISC64 (EM_PARISC|__AUDIT_ARCH_64BIT) 122 #define AUDIT_ARCH_PPC (EM_PPC) 123 #define AUDIT_ARCH_PPC64 (EM_PPC64|__AUDIT_ARCH_64BIT) 124 #define AUDIT_ARCH_S390 (EM_S390) 125 #define AUDIT_ARCH_S390X (EM_S390|__AUDIT_ARCH_64BIT) 126 #define AUDIT_ARCH_SH (EM_SH) 127 #define AUDIT_ARCH_SHEL (EM_SH|__AUDIT_ARCH_LE) 128 #define AUDIT_ARCH_SH64 (EM_SH|__AUDIT_ARCH_64BIT) 129 #define AUDIT_ARCH_SHEL64 (EM_SH|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) 130 #define AUDIT_ARCH_SPARC (EM_SPARC) 131 #define AUDIT_ARCH_SPARC64 (EM_SPARC64|__AUDIT_ARCH_64BIT) 132 #define AUDIT_ARCH_V850 (EM_V850|__AUDIT_ARCH_LE) 133 #define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) 134 135 #ifndef __KERNEL__ 136 struct audit_message { 137 struct nlmsghdr nlh; 138 char data[1200]; 139 }; 140 #endif 141 142 struct audit_status { 143 __u32 mask; /* Bit mask for valid entries */ 144 __u32 enabled; /* 1 = enabled, 0 = disbaled */ 145 __u32 failure; /* Failure-to-log action */ 146 __u32 pid; /* pid of auditd process */ 147 __u32 rate_limit; /* messages rate limit (per second) */ 148 __u32 backlog_limit; /* waiting messages limit */ 149 __u32 lost; /* messages lost */ 150 __u32 backlog; /* messages waiting in queue */ 151 }; 152 153 struct audit_rule { /* for AUDIT_LIST, AUDIT_ADD, and AUDIT_DEL */ 154 __u32 flags; /* AUDIT_PER_{TASK,CALL}, AUDIT_PREPEND */ 155 __u32 action; /* AUDIT_NEVER, AUDIT_POSSIBLE, AUDIT_ALWAYS */ 156 __u32 field_count; 157 __u32 mask[AUDIT_BITMASK_SIZE]; 158 __u32 fields[AUDIT_MAX_FIELDS]; 159 __u32 values[AUDIT_MAX_FIELDS]; 160 }; 161 162 #ifdef __KERNEL__ 163 164 struct audit_buffer; 165 struct audit_context; 166 struct inode; 167 168 #define AUDITSC_INVALID 0 169 #define AUDITSC_SUCCESS 1 170 #define AUDITSC_FAILURE 2 171 #define AUDITSC_RESULT(x) ( ((long)(x))<0?AUDITSC_FAILURE:AUDITSC_SUCCESS ) 172 #ifdef CONFIG_AUDITSYSCALL 173 /* These are defined in auditsc.c */ 174 /* Public API */ 175 extern int audit_alloc(struct task_struct *task); 176 extern void audit_free(struct task_struct *task); 177 extern void audit_syscall_entry(struct task_struct *task, int arch, 178 int major, unsigned long a0, unsigned long a1, 179 unsigned long a2, unsigned long a3); 180 extern void audit_syscall_exit(struct task_struct *task, int failed, long return_code); 181 extern void audit_getname(const char *name); 182 extern void audit_putname(const char *name); 183 extern void audit_inode(const char *name, const struct inode *inode); 184 185 /* Private API (for audit.c only) */ 186 extern int audit_receive_filter(int type, int pid, int uid, int seq, 187 void *data, uid_t loginuid); 188 extern void audit_get_stamp(struct audit_context *ctx, 189 struct timespec *t, unsigned int *serial); 190 extern int audit_set_loginuid(struct task_struct *task, uid_t loginuid); 191 extern uid_t audit_get_loginuid(struct audit_context *ctx); 192 extern int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode); 193 #else 194 #define audit_alloc(t) ({ 0; }) 195 #define audit_free(t) do { ; } while (0) 196 #define audit_syscall_entry(t,ta,a,b,c,d,e) do { ; } while (0) 197 #define audit_syscall_exit(t,f,r) do { ; } while (0) 198 #define audit_getname(n) do { ; } while (0) 199 #define audit_putname(n) do { ; } while (0) 200 #define audit_inode(n,i) do { ; } while (0) 201 #define audit_get_loginuid(c) ({ -1; }) 202 #define audit_ipc_perms(q,u,g,m) ({ 0; }) 203 #endif 204 205 #ifdef CONFIG_AUDIT 206 /* These are defined in audit.c */ 207 /* Public API */ 208 extern void audit_log(struct audit_context *ctx, 209 const char *fmt, ...) 210 __attribute__((format(printf,2,3))); 211 212 extern struct audit_buffer *audit_log_start(struct audit_context *ctx); 213 extern void audit_log_format(struct audit_buffer *ab, 214 const char *fmt, ...) 215 __attribute__((format(printf,2,3))); 216 extern void audit_log_end(struct audit_buffer *ab); 217 extern void audit_log_hex(struct audit_buffer *ab, 218 const unsigned char *buf, 219 size_t len); 220 extern void audit_log_untrustedstring(struct audit_buffer *ab, 221 const char *string); 222 extern void audit_log_d_path(struct audit_buffer *ab, 223 const char *prefix, 224 struct dentry *dentry, 225 struct vfsmount *vfsmnt); 226 /* Private API (for auditsc.c only) */ 227 extern void audit_send_reply(int pid, int seq, int type, 228 int done, int multi, 229 void *payload, int size); 230 extern void audit_log_lost(const char *message); 231 #else 232 #define audit_log(t,f,...) do { ; } while (0) 233 #define audit_log_start(t) ({ NULL; }) 234 #define audit_log_vformat(b,f,a) do { ; } while (0) 235 #define audit_log_format(b,f,...) do { ; } while (0) 236 #define audit_log_end(b) do { ; } while (0) 237 #define audit_log_hex(a,b,l) do { ; } while (0) 238 #define audit_log_untrustedstring(a,s) do { ; } while (0) 239 #define audit_log_d_path(b,p,d,v) do { ; } while (0) 240 #endif 241 #endif 242 #endif 243