auditsc.c 71.9 KB
Newer Older
1
/* auditsc.c -- System-call auditing support
Linus Torvalds's avatar
Linus Torvalds committed
2 3 4
 * Handles all system-call specific auditing features.
 *
 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
5
 * Copyright 2005 Hewlett-Packard Development Company, L.P.
6
 * Copyright (C) 2005, 2006 IBM Corporation
Linus Torvalds's avatar
Linus Torvalds committed
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
 * All Rights Reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
 *
 * Many of the ideas implemented here are from Stephen C. Tweedie,
 * especially the idea of avoiding a copy by using getname.
 *
 * The method for actual interception of syscall entry and exit (not in
 * this file -- see entry.S) is based on a GPL'd patch written by
 * okir@suse.de and Copyright 2003 SuSE Linux AG.
 *
32 33 34
 * POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>,
 * 2006.
 *
35 36 37
 * The support of additional filter rules compares (>, <, >=, <=) was
 * added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005.
 *
38 39
 * Modified by Amy Griffis <amy.griffis@hp.com> to collect additional
 * filesystem information.
40 41 42
 *
 * Subject and object context labeling support added by <danjones@us.ibm.com>
 * and <dustin.kirkland@us.ibm.com> for LSPP certification compliance.
Linus Torvalds's avatar
Linus Torvalds committed
43 44 45 46
 */

#include <linux/init.h>
#include <asm/types.h>
Arun Sharma's avatar
Arun Sharma committed
47
#include <linux/atomic.h>
48 49
#include <linux/fs.h>
#include <linux/namei.h>
Linus Torvalds's avatar
Linus Torvalds committed
50
#include <linux/mm.h>
51
#include <linux/export.h>
52
#include <linux/slab.h>
53
#include <linux/mount.h>
54
#include <linux/socket.h>
55
#include <linux/mqueue.h>
Linus Torvalds's avatar
Linus Torvalds committed
56 57 58
#include <linux/audit.h>
#include <linux/personality.h>
#include <linux/time.h>
59
#include <linux/netlink.h>
60
#include <linux/compiler.h>
Linus Torvalds's avatar
Linus Torvalds committed
61
#include <asm/unistd.h>
62
#include <linux/security.h>
63
#include <linux/list.h>
64
#include <linux/tty.h>
Al Viro's avatar
Al Viro committed
65
#include <linux/binfmts.h>
66
#include <linux/highmem.h>
Al Viro's avatar
Al Viro committed
67
#include <linux/syscalls.h>
68
#include <linux/capability.h>
69
#include <linux/fs_struct.h>
70
#include <linux/compat.h>
Linus Torvalds's avatar
Linus Torvalds committed
71

72
#include "audit.h"
Linus Torvalds's avatar
Linus Torvalds committed
73

74 75 76 77 78
/* flags stating the success for a syscall */
#define AUDITSC_INVALID 0
#define AUDITSC_SUCCESS 1
#define AUDITSC_FAILURE 2

Linus Torvalds's avatar
Linus Torvalds committed
79
/* AUDIT_NAMES is the number of slots we reserve in the audit_context
80 81 82
 * for saving names from getname().  If we get more names we will allocate
 * a name dynamically and also add those to the list anchored by names_list. */
#define AUDIT_NAMES	5
Linus Torvalds's avatar
Linus Torvalds committed
83

84 85 86
/* no execve audit message should be longer than this (userspace limits) */
#define MAX_EXECVE_AUDIT_LEN 7500

87 88 89
/* number of audit rules */
int audit_n_rules;

Amy Griffis's avatar
Amy Griffis committed
90 91 92
/* determines whether we collect data for signals sent */
int audit_signals;

93 94 95 96 97 98 99 100 101
struct audit_cap_data {
	kernel_cap_t		permitted;
	kernel_cap_t		inheritable;
	union {
		unsigned int	fE;		/* effective bit of a file capability */
		kernel_cap_t	effective;	/* effective set of a process */
	};
};

Linus Torvalds's avatar
Linus Torvalds committed
102 103 104 105
/* When fs/namei.c:getname() is called, we store the pointer in name and
 * we don't let putname() free it (instead we free all of the saved
 * pointers at syscall exit time).
 *
106 107
 * Further, in fs/namei.c:path_lookup() we store the inode and device.
 */
Linus Torvalds's avatar
Linus Torvalds committed
108
struct audit_names {
109 110 111 112 113 114 115 116 117 118 119 120 121 122
	struct list_head	list;		/* audit_context->names_list */
	struct filename	*name;
	unsigned long		ino;
	dev_t			dev;
	umode_t			mode;
	kuid_t			uid;
	kgid_t			gid;
	dev_t			rdev;
	u32			osid;
	struct audit_cap_data	 fcap;
	unsigned int		fcap_ver;
	int			name_len;	/* number of name's characters to log */
	unsigned char		type;		/* record type */
	bool			name_put;	/* call __putname() for this name */
123 124 125 126 127
	/*
	 * This was an allocated audit_names and not from the array of
	 * names allocated in the task audit context.  Thus this name
	 * should be freed on syscall exit
	 */
128
	bool			should_free;
Linus Torvalds's avatar
Linus Torvalds committed
129 130 131 132 133 134 135 136 137
};

struct audit_aux_data {
	struct audit_aux_data	*next;
	int			type;
};

#define AUDIT_AUX_IPCPERM	0

Amy Griffis's avatar
Amy Griffis committed
138 139 140
/* Number of target pids per aux struct. */
#define AUDIT_AUX_PIDS	16

Al Viro's avatar
Al Viro committed
141 142 143 144
struct audit_aux_data_execve {
	struct audit_aux_data	d;
	int argc;
	int envc;
Peter Zijlstra's avatar
Peter Zijlstra committed
145
	struct mm_struct *mm;
Al Viro's avatar
Al Viro committed
146 147
};

Amy Griffis's avatar
Amy Griffis committed
148 149 150
struct audit_aux_data_pids {
	struct audit_aux_data	d;
	pid_t			target_pid[AUDIT_AUX_PIDS];
151
	kuid_t			target_auid[AUDIT_AUX_PIDS];
152
	kuid_t			target_uid[AUDIT_AUX_PIDS];
153
	unsigned int		target_sessionid[AUDIT_AUX_PIDS];
Amy Griffis's avatar
Amy Griffis committed
154
	u32			target_sid[AUDIT_AUX_PIDS];
155
	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
Amy Griffis's avatar
Amy Griffis committed
156 157 158
	int			pid_count;
};

159 160 161 162 163 164 165 166
struct audit_aux_data_bprm_fcaps {
	struct audit_aux_data	d;
	struct audit_cap_data	fcap;
	unsigned int		fcap_ver;
	struct audit_cap_data	old_pcap;
	struct audit_cap_data	new_pcap;
};

167 168 169 170 171 172
struct audit_aux_data_capset {
	struct audit_aux_data	d;
	pid_t			pid;
	struct audit_cap_data	cap;
};

Al Viro's avatar
Al Viro committed
173 174 175 176 177
struct audit_tree_refs {
	struct audit_tree_refs *next;
	struct audit_chunk *c[31];
};

Linus Torvalds's avatar
Linus Torvalds committed
178 179
/* The per-task audit context. */
struct audit_context {
180
	int		    dummy;	/* must be the first element */
Linus Torvalds's avatar
Linus Torvalds committed
181
	int		    in_syscall;	/* 1 if task is in a syscall */
182
	enum audit_state    state, current_state;
Linus Torvalds's avatar
Linus Torvalds committed
183 184
	unsigned int	    serial;     /* serial number for record */
	int		    major;      /* syscall number */
185
	struct timespec	    ctime;      /* time of syscall entry */
Linus Torvalds's avatar
Linus Torvalds committed
186
	unsigned long	    argv[4];    /* syscall arguments */
187
	long		    return_code;/* syscall return code */
188
	u64		    prio;
189
	int		    return_valid; /* return code is valid */
190 191 192 193 194 195 196 197 198 199 200
	/*
	 * The names_list is the list of all audit_names collected during this
	 * syscall.  The first AUDIT_NAMES entries in the names_list will
	 * actually be from the preallocated_names array for performance
	 * reasons.  Except during allocation they should never be referenced
	 * through the preallocated_names array and should only be found/used
	 * by running the names_list.
	 */
	struct audit_names  preallocated_names[AUDIT_NAMES];
	int		    name_count; /* total records in names_list */
	struct list_head    names_list;	/* anchor for struct audit_names->list */
Amy Griffis's avatar
Amy Griffis committed
201
	char *		    filterkey;	/* key for rule that triggered record */
202
	struct path	    pwd;
Linus Torvalds's avatar
Linus Torvalds committed
203
	struct audit_aux_data *aux;
Amy Griffis's avatar
Amy Griffis committed
204
	struct audit_aux_data *aux_pids;
205 206
	struct sockaddr_storage *sockaddr;
	size_t sockaddr_len;
Linus Torvalds's avatar
Linus Torvalds committed
207
				/* Save things to print about task_struct */
Al Viro's avatar
Al Viro committed
208
	pid_t		    pid, ppid;
209 210
	kuid_t		    uid, euid, suid, fsuid;
	kgid_t		    gid, egid, sgid, fsgid;
Linus Torvalds's avatar
Linus Torvalds committed
211
	unsigned long	    personality;
212
	int		    arch;
Linus Torvalds's avatar
Linus Torvalds committed
213

Al Viro's avatar
Al Viro committed
214
	pid_t		    target_pid;
215
	kuid_t		    target_auid;
216
	kuid_t		    target_uid;
217
	unsigned int	    target_sessionid;
Al Viro's avatar
Al Viro committed
218
	u32		    target_sid;
219
	char		    target_comm[TASK_COMM_LEN];
Al Viro's avatar
Al Viro committed
220

Al Viro's avatar
Al Viro committed
221
	struct audit_tree_refs *trees, *first_trees;
222
	struct list_head killed_trees;
223
	int tree_count;
Al Viro's avatar
Al Viro committed
224

Al Viro's avatar
Al Viro committed
225 226 227 228 229 230
	int type;
	union {
		struct {
			int nargs;
			long args[6];
		} socketcall;
Al Viro's avatar
Al Viro committed
231
		struct {
232 233
			kuid_t			uid;
			kgid_t			gid;
Al Viro's avatar
Al Viro committed
234
			umode_t			mode;
Al Viro's avatar
Al Viro committed
235
			u32			osid;
Al Viro's avatar
Al Viro committed
236 237 238
			int			has_perm;
			uid_t			perm_uid;
			gid_t			perm_gid;
Al Viro's avatar
Al Viro committed
239
			umode_t			perm_mode;
Al Viro's avatar
Al Viro committed
240
			unsigned long		qbytes;
Al Viro's avatar
Al Viro committed
241
		} ipc;
Al Viro's avatar
Al Viro committed
242 243 244 245
		struct {
			mqd_t			mqdes;
			struct mq_attr 		mqstat;
		} mq_getsetattr;
Al Viro's avatar
Al Viro committed
246 247 248 249
		struct {
			mqd_t			mqdes;
			int			sigev_signo;
		} mq_notify;
Al Viro's avatar
Al Viro committed
250 251 252 253 254 255
		struct {
			mqd_t			mqdes;
			size_t			msg_len;
			unsigned int		msg_prio;
			struct timespec		abs_timeout;
		} mq_sendrecv;
Al Viro's avatar
Al Viro committed
256 257
		struct {
			int			oflag;
Al Viro's avatar
Al Viro committed
258
			umode_t			mode;
Al Viro's avatar
Al Viro committed
259 260
			struct mq_attr		attr;
		} mq_open;
Al Viro's avatar
Al Viro committed
261 262 263 264
		struct {
			pid_t			pid;
			struct audit_cap_data	cap;
		} capset;
Al Viro's avatar
Al Viro committed
265 266 267 268
		struct {
			int			fd;
			int			flags;
		} mmap;
Al Viro's avatar
Al Viro committed
269
	};
Al Viro's avatar
Al Viro committed
270
	int fds[2];
Al Viro's avatar
Al Viro committed
271

Linus Torvalds's avatar
Linus Torvalds committed
272 273 274 275 276 277
#if AUDIT_DEBUG
	int		    put_count;
	int		    ino_count;
#endif
};

Al Viro's avatar
Al Viro committed
278 279 280 281 282 283 284 285 286 287
static inline int open_arg(int flags, int mask)
{
	int n = ACC_MODE(flags);
	if (flags & (O_TRUNC | O_CREAT))
		n |= AUDIT_PERM_WRITE;
	return n & mask;
}

static int audit_match_perm(struct audit_context *ctx, int mask)
{
288
	unsigned n;
289 290
	if (unlikely(!ctx))
		return 0;
291
	n = ctx->major;
292

Al Viro's avatar
Al Viro committed
293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328
	switch (audit_classify_syscall(ctx->arch, n)) {
	case 0:	/* native */
		if ((mask & AUDIT_PERM_WRITE) &&
		     audit_match_class(AUDIT_CLASS_WRITE, n))
			return 1;
		if ((mask & AUDIT_PERM_READ) &&
		     audit_match_class(AUDIT_CLASS_READ, n))
			return 1;
		if ((mask & AUDIT_PERM_ATTR) &&
		     audit_match_class(AUDIT_CLASS_CHATTR, n))
			return 1;
		return 0;
	case 1: /* 32bit on biarch */
		if ((mask & AUDIT_PERM_WRITE) &&
		     audit_match_class(AUDIT_CLASS_WRITE_32, n))
			return 1;
		if ((mask & AUDIT_PERM_READ) &&
		     audit_match_class(AUDIT_CLASS_READ_32, n))
			return 1;
		if ((mask & AUDIT_PERM_ATTR) &&
		     audit_match_class(AUDIT_CLASS_CHATTR_32, n))
			return 1;
		return 0;
	case 2: /* open */
		return mask & ACC_MODE(ctx->argv[1]);
	case 3: /* openat */
		return mask & ACC_MODE(ctx->argv[2]);
	case 4: /* socketcall */
		return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);
	case 5: /* execve */
		return mask & AUDIT_PERM_EXEC;
	default:
		return 0;
	}
}

329
static int audit_match_filetype(struct audit_context *ctx, int val)
330
{
331
	struct audit_names *n;
332
	umode_t mode = (umode_t)val;
333 334 335 336

	if (unlikely(!ctx))
		return 0;

337 338 339
	list_for_each_entry(n, &ctx->names_list, list) {
		if ((n->ino != -1) &&
		    ((n->mode & S_IFMT) == mode))
340 341
			return 1;
	}
342

343
	return 0;
344 345
}

Al Viro's avatar
Al Viro committed
346 347 348 349 350 351 352 353 354 355 356
/*
 * We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *;
 * ->first_trees points to its beginning, ->trees - to the current end of data.
 * ->tree_count is the number of free entries in array pointed to by ->trees.
 * Original condition is (NULL, NULL, 0); as soon as it grows we never revert to NULL,
 * "empty" becomes (p, p, 31) afterwards.  We don't shrink the list (and seriously,
 * it's going to remain 1-element for almost any setup) until we free context itself.
 * References in it _are_ dropped - at the same time we free/drop aux stuff.
 */

#ifdef CONFIG_AUDIT_TREE
357 358 359 360 361 362 363 364
static void audit_set_auditable(struct audit_context *ctx)
{
	if (!ctx->prio) {
		ctx->prio = 1;
		ctx->current_state = AUDIT_RECORD_CONTEXT;
	}
}

Al Viro's avatar
Al Viro committed
365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464
static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk)
{
	struct audit_tree_refs *p = ctx->trees;
	int left = ctx->tree_count;
	if (likely(left)) {
		p->c[--left] = chunk;
		ctx->tree_count = left;
		return 1;
	}
	if (!p)
		return 0;
	p = p->next;
	if (p) {
		p->c[30] = chunk;
		ctx->trees = p;
		ctx->tree_count = 30;
		return 1;
	}
	return 0;
}

static int grow_tree_refs(struct audit_context *ctx)
{
	struct audit_tree_refs *p = ctx->trees;
	ctx->trees = kzalloc(sizeof(struct audit_tree_refs), GFP_KERNEL);
	if (!ctx->trees) {
		ctx->trees = p;
		return 0;
	}
	if (p)
		p->next = ctx->trees;
	else
		ctx->first_trees = ctx->trees;
	ctx->tree_count = 31;
	return 1;
}
#endif

static void unroll_tree_refs(struct audit_context *ctx,
		      struct audit_tree_refs *p, int count)
{
#ifdef CONFIG_AUDIT_TREE
	struct audit_tree_refs *q;
	int n;
	if (!p) {
		/* we started with empty chain */
		p = ctx->first_trees;
		count = 31;
		/* if the very first allocation has failed, nothing to do */
		if (!p)
			return;
	}
	n = count;
	for (q = p; q != ctx->trees; q = q->next, n = 31) {
		while (n--) {
			audit_put_chunk(q->c[n]);
			q->c[n] = NULL;
		}
	}
	while (n-- > ctx->tree_count) {
		audit_put_chunk(q->c[n]);
		q->c[n] = NULL;
	}
	ctx->trees = p;
	ctx->tree_count = count;
#endif
}

static void free_tree_refs(struct audit_context *ctx)
{
	struct audit_tree_refs *p, *q;
	for (p = ctx->first_trees; p; p = q) {
		q = p->next;
		kfree(p);
	}
}

static int match_tree_refs(struct audit_context *ctx, struct audit_tree *tree)
{
#ifdef CONFIG_AUDIT_TREE
	struct audit_tree_refs *p;
	int n;
	if (!tree)
		return 0;
	/* full ones */
	for (p = ctx->first_trees; p != ctx->trees; p = p->next) {
		for (n = 0; n < 31; n++)
			if (audit_tree_match(p->c[n], tree))
				return 1;
	}
	/* partial */
	if (p) {
		for (n = ctx->tree_count; n < 31; n++)
			if (audit_tree_match(p->c[n], tree))
				return 1;
	}
#endif
	return 0;
}

465 466 467 468
static int audit_compare_uid(kuid_t uid,
			     struct audit_names *name,
			     struct audit_field *f,
			     struct audit_context *ctx)
469 470 471
{
	struct audit_names *n;
	int rc;
472
 
473
	if (name) {
474
		rc = audit_uid_comparator(uid, f->op, name->uid);
475 476 477
		if (rc)
			return rc;
	}
478
 
479 480
	if (ctx) {
		list_for_each_entry(n, &ctx->names_list, list) {
481 482 483 484 485 486 487
			rc = audit_uid_comparator(uid, f->op, n->uid);
			if (rc)
				return rc;
		}
	}
	return 0;
}
488

489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505
static int audit_compare_gid(kgid_t gid,
			     struct audit_names *name,
			     struct audit_field *f,
			     struct audit_context *ctx)
{
	struct audit_names *n;
	int rc;
 
	if (name) {
		rc = audit_gid_comparator(gid, f->op, name->gid);
		if (rc)
			return rc;
	}
 
	if (ctx) {
		list_for_each_entry(n, &ctx->names_list, list) {
			rc = audit_gid_comparator(gid, f->op, n->gid);
506 507 508 509 510 511 512
			if (rc)
				return rc;
		}
	}
	return 0;
}

513 514 515 516 517 518 519
static int audit_field_compare(struct task_struct *tsk,
			       const struct cred *cred,
			       struct audit_field *f,
			       struct audit_context *ctx,
			       struct audit_names *name)
{
	switch (f->val) {
520
	/* process to file object comparisons */
521
	case AUDIT_COMPARE_UID_TO_OBJ_UID:
522
		return audit_compare_uid(cred->uid, name, f, ctx);
523
	case AUDIT_COMPARE_GID_TO_OBJ_GID:
524
		return audit_compare_gid(cred->gid, name, f, ctx);
525
	case AUDIT_COMPARE_EUID_TO_OBJ_UID:
526
		return audit_compare_uid(cred->euid, name, f, ctx);
527
	case AUDIT_COMPARE_EGID_TO_OBJ_GID:
528
		return audit_compare_gid(cred->egid, name, f, ctx);
529
	case AUDIT_COMPARE_AUID_TO_OBJ_UID:
530
		return audit_compare_uid(tsk->loginuid, name, f, ctx);
531
	case AUDIT_COMPARE_SUID_TO_OBJ_UID:
532
		return audit_compare_uid(cred->suid, name, f, ctx);
533
	case AUDIT_COMPARE_SGID_TO_OBJ_GID:
534
		return audit_compare_gid(cred->sgid, name, f, ctx);
535
	case AUDIT_COMPARE_FSUID_TO_OBJ_UID:
536
		return audit_compare_uid(cred->fsuid, name, f, ctx);
537
	case AUDIT_COMPARE_FSGID_TO_OBJ_GID:
538
		return audit_compare_gid(cred->fsgid, name, f, ctx);
539 540
	/* uid comparisons */
	case AUDIT_COMPARE_UID_TO_AUID:
541
		return audit_uid_comparator(cred->uid, f->op, tsk->loginuid);
542
	case AUDIT_COMPARE_UID_TO_EUID:
543
		return audit_uid_comparator(cred->uid, f->op, cred->euid);
544
	case AUDIT_COMPARE_UID_TO_SUID:
545
		return audit_uid_comparator(cred->uid, f->op, cred->suid);
546
	case AUDIT_COMPARE_UID_TO_FSUID:
547
		return audit_uid_comparator(cred->uid, f->op, cred->fsuid);
548 549
	/* auid comparisons */
	case AUDIT_COMPARE_AUID_TO_EUID:
550
		return audit_uid_comparator(tsk->loginuid, f->op, cred->euid);
551
	case AUDIT_COMPARE_AUID_TO_SUID:
552
		return audit_uid_comparator(tsk->loginuid, f->op, cred->suid);
553
	case AUDIT_COMPARE_AUID_TO_FSUID:
554
		return audit_uid_comparator(tsk->loginuid, f->op, cred->fsuid);
555 556
	/* euid comparisons */
	case AUDIT_COMPARE_EUID_TO_SUID:
557
		return audit_uid_comparator(cred->euid, f->op, cred->suid);
558
	case AUDIT_COMPARE_EUID_TO_FSUID:
559
		return audit_uid_comparator(cred->euid, f->op, cred->fsuid);
560 561
	/* suid comparisons */
	case AUDIT_COMPARE_SUID_TO_FSUID:
562
		return audit_uid_comparator(cred->suid, f->op, cred->fsuid);
563 564
	/* gid comparisons */
	case AUDIT_COMPARE_GID_TO_EGID:
565
		return audit_gid_comparator(cred->gid, f->op, cred->egid);
566
	case AUDIT_COMPARE_GID_TO_SGID:
567
		return audit_gid_comparator(cred->gid, f->op, cred->sgid);
568
	case AUDIT_COMPARE_GID_TO_FSGID:
569
		return audit_gid_comparator(cred->gid, f->op, cred->fsgid);
570 571
	/* egid comparisons */
	case AUDIT_COMPARE_EGID_TO_SGID:
572
		return audit_gid_comparator(cred->egid, f->op, cred->sgid);
573
	case AUDIT_COMPARE_EGID_TO_FSGID:
574
		return audit_gid_comparator(cred->egid, f->op, cred->fsgid);
575 576
	/* sgid comparison */
	case AUDIT_COMPARE_SGID_TO_FSGID:
577
		return audit_gid_comparator(cred->sgid, f->op, cred->fsgid);
578 579 580 581 582 583 584
	default:
		WARN(1, "Missing AUDIT_COMPARE define.  Report as a bug\n");
		return 0;
	}
	return 0;
}

Amy Griffis's avatar
Amy Griffis committed
585
/* Determine if any context name data matches a rule's watch data */
Linus Torvalds's avatar
Linus Torvalds committed
586
/* Compare a task_struct with an audit_rule.  Return 1 on match, 0
587 588 589 590 591 592
 * otherwise.
 *
 * If task_creation is true, this is an explicit indication that we are
 * filtering a task rule at task creation time.  This and tsk == current are
 * the only situations where tsk->cred may be accessed without an rcu read lock.
 */
Linus Torvalds's avatar
Linus Torvalds committed
593
static int audit_filter_rules(struct task_struct *tsk,
594
			      struct audit_krule *rule,
Linus Torvalds's avatar
Linus Torvalds committed
595
			      struct audit_context *ctx,
Amy Griffis's avatar
Amy Griffis committed
596
			      struct audit_names *name,
597 598
			      enum audit_state *state,
			      bool task_creation)
Linus Torvalds's avatar
Linus Torvalds committed
599
{
600
	const struct cred *cred;
601
	int i, need_sid = 1;
602 603
	u32 sid;

604 605
	cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation);

Linus Torvalds's avatar
Linus Torvalds committed
606
	for (i = 0; i < rule->field_count; i++) {
607
		struct audit_field *f = &rule->fields[i];
608
		struct audit_names *n;
Linus Torvalds's avatar
Linus Torvalds committed
609 610
		int result = 0;

611
		switch (f->type) {
Linus Torvalds's avatar
Linus Torvalds committed
612
		case AUDIT_PID:
613
			result = audit_comparator(tsk->pid, f->op, f->val);
Linus Torvalds's avatar
Linus Torvalds committed
614
			break;
Al Viro's avatar
Al Viro committed
615
		case AUDIT_PPID:
Alexander Viro's avatar
Alexander Viro committed
616 617 618
			if (ctx) {
				if (!ctx->ppid)
					ctx->ppid = sys_getppid();
Al Viro's avatar
Al Viro committed
619
				result = audit_comparator(ctx->ppid, f->op, f->val);
Alexander Viro's avatar
Alexander Viro committed
620
			}
Al Viro's avatar
Al Viro committed
621
			break;
Linus Torvalds's avatar
Linus Torvalds committed
622
		case AUDIT_UID:
623
			result = audit_uid_comparator(cred->uid, f->op, f->uid);
Linus Torvalds's avatar
Linus Torvalds committed
624 625
			break;
		case AUDIT_EUID:
626
			result = audit_uid_comparator(cred->euid, f->op, f->uid);
Linus Torvalds's avatar
Linus Torvalds committed
627 628
			break;
		case AUDIT_SUID:
629
			result = audit_uid_comparator(cred->suid, f->op, f->uid);
Linus Torvalds's avatar
Linus Torvalds committed
630 631
			break;
		case AUDIT_FSUID:
632
			result = audit_uid_comparator(cred->fsuid, f->op, f->uid);
Linus Torvalds's avatar
Linus Torvalds committed
633 634
			break;
		case AUDIT_GID:
635
			result = audit_gid_comparator(cred->gid, f->op, f->gid);
Linus Torvalds's avatar
Linus Torvalds committed
636 637
			break;
		case AUDIT_EGID:
638
			result = audit_gid_comparator(cred->egid, f->op, f->gid);
Linus Torvalds's avatar
Linus Torvalds committed
639 640
			break;
		case AUDIT_SGID:
641
			result = audit_gid_comparator(cred->sgid, f->op, f->gid);
Linus Torvalds's avatar
Linus Torvalds committed
642 643
			break;
		case AUDIT_FSGID:
644
			result = audit_gid_comparator(cred->fsgid, f->op, f->gid);
Linus Torvalds's avatar
Linus Torvalds committed
645 646
			break;
		case AUDIT_PERS:
647
			result = audit_comparator(tsk->personality, f->op, f->val);
Linus Torvalds's avatar
Linus Torvalds committed
648
			break;
649
		case AUDIT_ARCH:
650
			if (ctx)
651
				result = audit_comparator(ctx->arch, f->op, f->val);
652
			break;
Linus Torvalds's avatar
Linus Torvalds committed
653 654 655

		case AUDIT_EXIT:
			if (ctx && ctx->return_valid)
656
				result = audit_comparator(ctx->return_code, f->op, f->val);
Linus Torvalds's avatar
Linus Torvalds committed
657 658
			break;
		case AUDIT_SUCCESS:
659
			if (ctx && ctx->return_valid) {
660 661
				if (f->val)
					result = audit_comparator(ctx->return_valid, f->op, AUDITSC_SUCCESS);
662
				else
663
					result = audit_comparator(ctx->return_valid, f->op, AUDITSC_FAILURE);
664
			}
Linus Torvalds's avatar
Linus Torvalds committed
665 666
			break;
		case AUDIT_DEVMAJOR:
667 668 669 670 671
			if (name) {
				if (audit_comparator(MAJOR(name->dev), f->op, f->val) ||
				    audit_comparator(MAJOR(name->rdev), f->op, f->val))
					++result;
			} else if (ctx) {
672
				list_for_each_entry(n, &ctx->names_list, list) {
673 674
					if (audit_comparator(MAJOR(n->dev), f->op, f->val) ||
					    audit_comparator(MAJOR(n->rdev), f->op, f->val)) {
Linus Torvalds's avatar
Linus Torvalds committed
675 676 677 678 679 680 681
						++result;
						break;
					}
				}
			}
			break;
		case AUDIT_DEVMINOR:
682 683 684 685 686
			if (name) {
				if (audit_comparator(MINOR(name->dev), f->op, f->val) ||
				    audit_comparator(MINOR(name->rdev), f->op, f->val))
					++result;
			} else if (ctx) {
687
				list_for_each_entry(n, &ctx->names_list, list) {
688 689
					if (audit_comparator(MINOR(n->dev), f->op, f->val) ||
					    audit_comparator(MINOR(n->rdev), f->op, f->val)) {
Linus Torvalds's avatar
Linus Torvalds committed
690 691 692 693 694 695 696
						++result;
						break;
					}
				}
			}
			break;
		case AUDIT_INODE:
Amy Griffis's avatar
Amy Griffis committed
697
			if (name)
698
				result = (name->ino == f->val);
Amy Griffis's avatar
Amy Griffis committed
699
			else if (ctx) {
700 701
				list_for_each_entry(n, &ctx->names_list, list) {
					if (audit_comparator(n->ino, f->op, f->val)) {
Linus Torvalds's avatar
Linus Torvalds committed
702 703 704 705 706 707
						++result;
						break;
					}
				}
			}
			break;
Eric Paris's avatar
Eric Paris committed
708 709
		case AUDIT_OBJ_UID:
			if (name) {
710
				result = audit_uid_comparator(name->uid, f->op, f->uid);
Eric Paris's avatar
Eric Paris committed
711 712
			} else if (ctx) {
				list_for_each_entry(n, &ctx->names_list, list) {
713
					if (audit_uid_comparator(n->uid, f->op, f->uid)) {
Eric Paris's avatar
Eric Paris committed
714 715 716 717 718 719
						++result;
						break;
					}
				}
			}
			break;
720 721
		case AUDIT_OBJ_GID:
			if (name) {
722
				result = audit_gid_comparator(name->gid, f->op, f->gid);
723 724
			} else if (ctx) {
				list_for_each_entry(n, &ctx->names_list, list) {
725
					if (audit_gid_comparator(n->gid, f->op, f->gid)) {
726 727 728 729 730 731
						++result;
						break;
					}
				}
			}
			break;
Amy Griffis's avatar
Amy Griffis committed
732
		case AUDIT_WATCH:
733 734
			if (name)
				result = audit_watch_compare(rule->watch, name->ino, name->dev);
Amy Griffis's avatar
Amy Griffis committed
735
			break;
Al Viro's avatar
Al Viro committed
736 737 738 739
		case AUDIT_DIR:
			if (ctx)
				result = match_tree_refs(ctx, rule->tree);
			break;
Linus Torvalds's avatar
Linus Torvalds committed
740 741 742
		case AUDIT_LOGINUID:
			result = 0;
			if (ctx)
743
				result = audit_uid_comparator(tsk->loginuid, f->op, f->uid);
Linus Torvalds's avatar
Linus Torvalds committed
744
			break;
745 746 747 748 749
		case AUDIT_SUBJ_USER:
		case AUDIT_SUBJ_ROLE:
		case AUDIT_SUBJ_TYPE:
		case AUDIT_SUBJ_SEN:
		case AUDIT_SUBJ_CLR:
750 751 752 753 754
			/* NOTE: this may return negative values indicating
			   a temporary error.  We simply treat this as a
			   match for now to avoid losing information that
			   may be wanted.   An error message will also be
			   logged upon error */
755
			if (f->lsm_rule) {
Steve Grubb's avatar
Steve Grubb committed
756
				if (need_sid) {
757
					security_task_getsecid(tsk, &sid);
Steve Grubb's avatar
Steve Grubb committed
758 759
					need_sid = 0;
				}
760
				result = security_audit_rule_match(sid, f->type,
761
				                                  f->op,
762
				                                  f->lsm_rule,
763
				                                  ctx);
Steve Grubb's avatar
Steve Grubb committed
764
			}
765
			break;
766 767 768 769 770 771 772
		case AUDIT_OBJ_USER:
		case AUDIT_OBJ_ROLE:
		case AUDIT_OBJ_TYPE:
		case AUDIT_OBJ_LEV_LOW:
		case AUDIT_OBJ_LEV_HIGH:
			/* The above note for AUDIT_SUBJ_USER...AUDIT_SUBJ_CLR
			   also applies here */
773
			if (f->lsm_rule) {
774 775
				/* Find files that match */
				if (name) {
776
					result = security_audit_rule_match(
777
					           name->osid, f->type, f->op,
778
					           f->lsm_rule, ctx);
779
				} else if (ctx) {
780 781 782 783
					list_for_each_entry(n, &ctx->names_list, list) {
						if (security_audit_rule_match(n->osid, f->type,
									      f->op, f->lsm_rule,
									      ctx)) {
784 785 786 787 788 789
							++result;
							break;
						}
					}
				}
				/* Find ipc objects that match */
Al Viro's avatar
Al Viro committed
790 791 792 793 794 795
				if (!ctx || ctx->type != AUDIT_IPC)
					break;
				if (security_audit_rule_match(ctx->ipc.osid,
							      f->type, f->op,
							      f->lsm_rule, ctx))
					++result;
796 797
			}
			break;
Linus Torvalds's avatar
Linus Torvalds committed
798 799 800 801 802
		case AUDIT_ARG0:
		case AUDIT_ARG1:
		case AUDIT_ARG2:
		case AUDIT_ARG3:
			if (ctx)
803
				result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
Linus Torvalds's avatar
Linus Torvalds committed
804
			break;
Amy Griffis's avatar
Amy Griffis committed
805 806 807 808
		case AUDIT_FILTERKEY:
			/* ignore this field for filtering */
			result = 1;
			break;
Al Viro's avatar
Al Viro committed
809 810 811
		case AUDIT_PERM:
			result = audit_match_perm(ctx, f->val);
			break;
812 813 814
		case AUDIT_FILETYPE:
			result = audit_match_filetype(ctx, f->val);
			break;
815 816 817
		case AUDIT_FIELD_COMPARE:
			result = audit_field_compare(tsk, cred, f, ctx, name);
			break;
Linus Torvalds's avatar
Linus Torvalds committed
818
		}
819
		if (!result)
Linus Torvalds's avatar
Linus Torvalds committed
820 821
			return 0;
	}
822 823 824 825 826 827 828 829 830 831

	if (ctx) {
		if (rule->prio <= ctx->prio)
			return 0;
		if (rule->filterkey) {
			kfree(ctx->filterkey);
			ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
		}
		ctx->prio = rule->prio;
	}
Linus Torvalds's avatar
Linus Torvalds committed
832 833 834 835 836 837 838 839 840 841 842
	switch (rule->action) {
	case AUDIT_NEVER:    *state = AUDIT_DISABLED;	    break;
	case AUDIT_ALWAYS:   *state = AUDIT_RECORD_CONTEXT; break;
	}
	return 1;
}

/* At process creation time, we can determine if system-call auditing is
 * completely disabled for this task.  Since we only have the task
 * structure at this point, we can only check uid and gid.
 */
843
static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
Linus Torvalds's avatar
Linus Torvalds committed
844 845 846 847 848
{
	struct audit_entry *e;
	enum audit_state   state;

	rcu_read_lock();
849
	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
850 851
		if (audit_filter_rules(tsk, &e->rule, NULL, NULL,
				       &state, true)) {
852 853
			if (state == AUDIT_RECORD_CONTEXT)
				*key = kstrdup(e->rule.filterkey, GFP_ATOMIC);
Linus Torvalds's avatar
Linus Torvalds committed
854 855 856 857 858 859 860 861 862 863
			rcu_read_unlock();
			return state;
		}
	}
	rcu_read_unlock();
	return AUDIT_BUILD_CONTEXT;
}

/* At syscall entry and exit time, this filter is called if the
 * audit_state is not low enough that auditing cannot take place, but is
Steve Grubb's avatar
Steve Grubb committed
864
 * also not high enough that we already know we have to write an audit
865
 * record (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT).
Linus Torvalds's avatar
Linus Torvalds committed
866 867 868 869 870 871
 */
static enum audit_state audit_filter_syscall(struct task_struct *tsk,
					     struct audit_context *ctx,
					     struct list_head *list)
{
	struct audit_entry *e;
872
	enum audit_state state;
Linus Torvalds's avatar
Linus Torvalds committed
873

874
	if (audit_pid && tsk->tgid == audit_pid)
875 876
		return AUDIT_DISABLED;

Linus Torvalds's avatar
Linus Torvalds committed
877
	rcu_read_lock();
878
	if (!list_empty(list)) {
879 880 881 882
		int word = AUDIT_WORD(ctx->major);
		int bit  = AUDIT_BIT(ctx->major);

		list_for_each_entry_rcu(e, list, list) {
Amy Griffis's avatar
Amy Griffis committed
883 884
			if ((e->rule.mask[word] & bit) == bit &&
			    audit_filter_rules(tsk, &e->rule, ctx, NULL,
885
					       &state, false)) {
Amy Griffis's avatar
Amy Griffis committed
886
				rcu_read_unlock();
887
				ctx->current_state = state;
Amy Griffis's avatar
Amy Griffis committed
888 889 890 891 892 893 894 895
				return state;
			}
		}
	}
	rcu_read_unlock();
	return AUDIT_BUILD_CONTEXT;
}

896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926
/*
 * Given an audit_name check the inode hash table to see if they match.
 * Called holding the rcu read lock to protect the use of audit_inode_hash
 */
static int audit_filter_inode_name(struct task_struct *tsk,
				   struct audit_names *n,
				   struct audit_context *ctx) {
	int word, bit;
	int h = audit_hash_ino((u32)n->ino);
	struct list_head *list = &audit_inode_hash[h];
	struct audit_entry *e;
	enum audit_state state;

	word = AUDIT_WORD(ctx->major);
	bit  = AUDIT_BIT(ctx->major);

	if (list_empty(list))
		return 0;

	list_for_each_entry_rcu(e, list, list) {
		if ((e->rule.mask[word] & bit) == bit &&
		    audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
			ctx->current_state = state;
			return 1;
		}
	}

	return 0;
}

/* At syscall exit time, this filter is called if any audit_names have been
Amy Griffis's avatar
Amy Griffis committed
927
 * collected during syscall processing.  We only check rules in sublists at hash
928
 * buckets applicable to the inode numbers in audit_names.
Amy Griffis's avatar
Amy Griffis committed
929 930
 * Regarding audit_state, same rules apply as for audit_filter_syscall().
 */
931
void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx)
Amy Griffis's avatar
Amy Griffis committed
932
{
933
	struct audit_names *n;
Amy Griffis's avatar
Amy Griffis committed
934 935

	if (audit_pid && tsk->tgid == audit_pid)
936
		return;
Amy Griffis's avatar
Amy Griffis committed
937 938 939

	rcu_read_lock();

940 941 942
	list_for_each_entry(n, &ctx->names_list, list) {
		if (audit_filter_inode_name(tsk, n, ctx))
			break;
943 944 945 946
	}
	rcu_read_unlock();
}

Linus Torvalds's avatar
Linus Torvalds committed
947 948
static inline struct audit_context *audit_get_context(struct task_struct *tsk,
						      int return_valid,
949
						      long return_code)
Linus Torvalds's avatar
Linus Torvalds committed
950 951 952
{
	struct audit_context *context = tsk->audit_context;

953
	if (!context)
Linus Torvalds's avatar
Linus Torvalds committed
954 955
		return NULL;
	context->return_valid = return_valid;
956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973

	/*
	 * we need to fix up the return code in the audit logs if the actual
	 * return codes are later going to be fixed up by the arch specific
	 * signal handlers
	 *
	 * This is actually a test for:
	 * (rc == ERESTARTSYS ) || (rc == ERESTARTNOINTR) ||
	 * (rc == ERESTARTNOHAND) || (rc == ERESTART_RESTARTBLOCK)
	 *
	 * but is faster than a bunch of ||
	 */
	if (unlikely(return_code <= -ERESTARTSYS) &&
	    (return_code >= -ERESTART_RESTARTBLOCK) &&
	    (return_code != -ENOIOCTLCMD))
		context->return_code = -EINTR;
	else
		context->return_code  = return_code;
Linus Torvalds's avatar
Linus Torvalds committed
974

975 976 977
	if (context->in_syscall && !context->dummy) {
		audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
		audit_filter_inodes(tsk, context);
Linus Torvalds's avatar
Linus Torvalds committed
978 979 980 981 982 983 984 985
	}

	tsk->audit_context = NULL;
	return context;
}

static inline void audit_free_names(struct audit_context *context)
{
986
	struct audit_names *n, *next;
Linus Torvalds's avatar
Linus Torvalds committed
987 988

#if AUDIT_DEBUG == 2
989
	if (context->put_count + context->ino_count != context->name_count) {
990
		printk(KERN_ERR "%s:%d(:%d): major=%d in_syscall=%d"
Linus Torvalds's avatar
Linus Torvalds committed
991 992
		       " name_count=%d put_count=%d"
		       " ino_count=%d [NOT freeing]\n",
993
		       __FILE__, __LINE__,
Linus Torvalds's avatar
Linus Torvalds committed
994 995 996
		       context->serial, context->major, context->in_syscall,
		       context->name_count, context->put_count,
		       context->ino_count);
997
		list_for_each_entry(n, &context->names_list, list) {
Linus Torvalds's avatar
Linus Torvalds committed
998
			printk(KERN_ERR "names[%d] = %p = %s\n", i,
999
			       n->name, n->name->name ?: "(null)");
1000
		}
Linus Torvalds's avatar
Linus Torvalds committed
1001 1002 1003 1004 1005 1006 1007 1008 1009
		dump_stack();
		return;
	}
#endif
#if AUDIT_DEBUG
	context->put_count  = 0;
	context->ino_count  = 0;
#endif

1010 1011 1012 1013 1014 1015
	list_for_each_entry_safe(n, next, &context->names_list, list) {
		list_del(&n->list);
		if (n->name && n->name_put)
			__putname(n->name);
		if (n->should_free)
			kfree(n);
1016
	}
Linus Torvalds's avatar
Linus Torvalds committed
1017
	context->name_count = 0;
1018 1019 1020
	path_put(&context->pwd);
	context->pwd.dentry = NULL;
	context->pwd.mnt = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
1021 1022 1023 1024 1025 1026 1027 1028 1029 1030
}

static inline void audit_free_aux(struct audit_context *context)
{
	struct audit_aux_data *aux;

	while ((aux = context->aux)) {
		context->aux = aux->next;
		kfree(aux);
	}
Amy Griffis's avatar
Amy Griffis committed
1031 1032 1033 1034
	while ((aux = context->aux_pids)) {
		context->aux_pids = aux->next;
		kfree(aux);
	}
Linus Torvalds's avatar
Linus Torvalds committed
1035 1036 1037 1038 1039 1040 1041
}

static inline void audit_zero_context(struct audit_context *context,
				      enum audit_state state)
{
	memset(context, 0, sizeof(*context));
	context->state      = state;
1042
	context->prio = state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;
Linus Torvalds's avatar
Linus Torvalds committed
1043 1044 1045 1046 1047 1048 1049 1050 1051
}

static inline struct audit_context *audit_alloc_context(enum audit_state state)
{
	struct audit_context *context;

	if (!(context = kmalloc(sizeof(*context), GFP_KERNEL)))
		return NULL;
	audit_zero_context(context, state);
1052
	INIT_LIST_HEAD(&context->killed_trees);
1053
	INIT_LIST_HEAD(&context->names_list);
Linus Torvalds's avatar
Linus Torvalds committed
1054 1055 1056
	return context;
}

1057 1058 1059 1060 1061
/**
 * audit_alloc - allocate an audit context block for a task
 * @tsk: task
 *
 * Filter on the task information and allocate a per-task audit context
Linus Torvalds's avatar
Linus Torvalds committed
1062 1063
 * if necessary.  Doing so turns on system call auditing for the
 * specified task.  This is called from copy_process, so no lock is
1064 1065
 * needed.
 */
Linus Torvalds's avatar
Linus Torvalds committed
1066 1067 1068 1069
int audit_alloc(struct task_struct *tsk)
{
	struct audit_context *context;
	enum audit_state     state;
1070
	char *key = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
1071

1072
	if (likely(!audit_ever_enabled))
Linus Torvalds's avatar
Linus Torvalds committed
1073 1074
		return 0; /* Return if not auditing. */

1075
	state = audit_filter_task(tsk, &key);
1076
	if (state == AUDIT_DISABLED)
Linus Torvalds's avatar
Linus Torvalds committed
1077 1078 1079
		return 0;

	if (!(context = audit_alloc_context(state))) {
1080
		kfree(key);
Linus Torvalds's avatar
Linus Torvalds committed
1081 1082 1083
		audit_log_lost("out of memory in audit_alloc");
		return -ENOMEM;
	}
1084
	context->filterkey = key;
Linus Torvalds's avatar
Linus Torvalds committed
1085 1086 1087 1088 1089 1090 1091 1092

	tsk->audit_context  = context;
	set_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
	return 0;
}

static inline void audit_free_context(struct audit_context *context)
{
Al Viro's avatar
Al Viro committed
1093 1094 1095 1096 1097 1098 1099
	audit_free_names(context);
	unroll_tree_refs(context, NULL, 0);
	free_tree_refs(context);
	audit_free_aux(context);
	kfree(context->filterkey);
	kfree(context->sockaddr);
	kfree(context);
Linus Torvalds's avatar
Linus Torvalds committed
1100 1101
}

Joy Latten's avatar
Joy Latten committed
1102
void audit_log_task_context(struct audit_buffer *ab)
1103 1104
{
	char *ctx = NULL;
1105 1106 1107 1108
	unsigned len;
	int error;
	u32 sid;

1109
	security_task_getsecid(current, &sid);
1110 1111
	if (!sid)
		return;
1112

1113
	error = security_secid_to_secctx(sid, &ctx, &len);
1114 1115
	if (error) {
		if (error != -EINVAL)
1116 1117 1118 1119 1120
			goto error_path;
		return;
	}

	audit_log_format(ab, " subj=%s", ctx);
1121
	security_release_secctx(ctx, len);
1122
	return;
1123 1124

error_path:
1125
	audit_panic("error in audit_log_task_context");
1126 1127 1128
	return;
}

Joy Latten's avatar
Joy Latten committed
1129 1130
EXPORT_SYMBOL(audit_log_task_context);

1131
void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
1132
{
1133
	const struct cred *cred;
1134 1135
	char name[sizeof(tsk->comm)];
	struct mm_struct *mm = tsk->mm;
1136 1137 1138 1139
	char *tty;

	if (!ab)
		return;
1140

1141
	/* tsk == current */
1142 1143 1144
	cred = current_cred();

	spin_lock_irq(&tsk->sighand->siglock);
Alan Cox's avatar
Alan Cox committed
1145
	if (tsk->signal && tsk->signal->tty)
1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157
		tty = tsk->signal->tty->name;
	else
		tty = "(none)";
	spin_unlock_irq(&tsk->sighand->siglock);


	audit_log_format(ab,
			 " ppid=%ld pid=%d auid=%u uid=%u gid=%u"
			 " euid=%u suid=%u fsuid=%u"
			 " egid=%u sgid=%u fsgid=%u ses=%u tty=%s",
			 sys_getppid(),
			 tsk->pid,
1158 1159 1160 1161 1162 1163 1164 1165 1166
			 from_kuid(&init_user_ns, tsk->loginuid),
			 from_kuid(&init_user_ns, cred->uid),
			 from_kgid(&init_user_ns, cred->gid),
			 from_kuid(&init_user_ns, cred->euid),
			 from_kuid(&init_user_ns, cred->suid),
			 from_kuid(&init_user_ns, cred->fsuid),
			 from_kgid(&init_user_ns, cred->egid),
			 from_kgid(&init_user_ns, cred->sgid),
			 from_kgid(&init_user_ns, cred->fsgid),
1167
			 tsk->sessionid, tty);
1168

1169
	get_task_comm(name, tsk);
1170 1171
	audit_log_format(ab, " comm=");
	audit_log_untrustedstring(ab, name);
1172

1173 1174
	if (mm) {
		down_read(&mm->mmap_sem);
1175 1176
		if (mm->exe_file)
			audit_log_d_path(ab, " exe=", &mm->exe_file->f_path);
1177
		up_read(&mm->mmap_sem);
1178
	}
1179
	audit_log_task_context(ab);
1180 1181
}

1182 1183
EXPORT_SYMBOL(audit_log_task_info);

Amy Griffis's avatar
Amy Griffis committed
1184
static int audit_log_pid_context(struct audit_context *context, pid_t pid,
1185
				 kuid_t auid, kuid_t uid, unsigned int sessionid,
1186
				 u32 sid, char *comm)
Amy Griffis's avatar
Amy Griffis committed
1187 1188
{
	struct audit_buffer *ab;
1189
	char *ctx = NULL;
Amy Griffis's avatar
Amy Griffis committed
1190 1191 1192 1193 1194
	u32 len;
	int rc = 0;

	ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
	if (!ab)
1195
		return rc;
Amy Griffis's avatar
Amy Griffis committed
1196

1197 1198
	audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid,
			 from_kuid(&init_user_ns, auid),
1199
			 from_kuid(&init_user_ns, uid), sessionid);
1200
	if (security_secid_to_secctx(sid, &ctx, &len)) {
1201
		audit_log_format(ab, " obj=(none)");
Amy Griffis's avatar
Amy Griffis committed
1202
		rc = 1;
1203 1204 1205 1206
	} else {
		audit_log_format(ab, " obj=%s", ctx);
		security_release_secctx(ctx, len);
	}
1207 1208
	audit_log_format(ab, " ocomm=");
	audit_log_untrustedstring(ab, comm);
Amy Griffis's avatar
Amy Griffis committed
1209 1210 1211 1212 1213
	audit_log_end(ab);

	return rc;
}

1214 1215 1216
/*
 * to_send and len_sent accounting are very loose estimates.  We aren't
 * really worried about a hard cap to MAX_EXECVE_AUDIT_LEN so much as being