1 /* auditfilter.c -- filtering of audit events
3 * Copyright 2003-2004 Red Hat, Inc.
4 * Copyright 2005 Hewlett-Packard Development Company, L.P.
5 * Copyright 2005 IBM Corporation
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 #include <linux/kernel.h>
23 #include <linux/audit.h>
24 #include <linux/kthread.h>
25 #include <linux/mutex.h>
27 #include <linux/namei.h>
28 #include <linux/netlink.h>
29 #include <linux/sched.h>
30 #include <linux/slab.h>
31 #include <linux/security.h>
38 * Synchronizes writes and blocking reads of audit's filterlist
39 * data. Rcu is used to traverse the filterlist and access
40 * contents of structs audit_entry, audit_watch and opaque
41 * LSM rules during filtering. If modified, these structures
42 * must be copied and replace their counterparts in the filterlist.
43 * An audit_parent struct is not accessed during filtering, so may
44 * be written directly provided audit_filter_mutex is held.
47 /* Audit filter lists, defined in <linux/audit.h> */
48 struct list_head audit_filter_list[AUDIT_NR_FILTERS] = {
49 LIST_HEAD_INIT(audit_filter_list[0]),
50 LIST_HEAD_INIT(audit_filter_list[1]),
51 LIST_HEAD_INIT(audit_filter_list[2]),
52 LIST_HEAD_INIT(audit_filter_list[3]),
53 LIST_HEAD_INIT(audit_filter_list[4]),
54 LIST_HEAD_INIT(audit_filter_list[5]),
55 #if AUDIT_NR_FILTERS != 6
56 #error Fix audit_filter_list initialiser
59 static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = {
60 LIST_HEAD_INIT(audit_rules_list[0]),
61 LIST_HEAD_INIT(audit_rules_list[1]),
62 LIST_HEAD_INIT(audit_rules_list[2]),
63 LIST_HEAD_INIT(audit_rules_list[3]),
64 LIST_HEAD_INIT(audit_rules_list[4]),
65 LIST_HEAD_INIT(audit_rules_list[5]),
68 DEFINE_MUTEX(audit_filter_mutex);
70 static inline void audit_free_rule(struct audit_entry *e)
73 struct audit_krule *erule = &e->rule;
75 /* some rules don't have associated watches */
77 audit_put_watch(erule->watch);
79 for (i = 0; i < erule->field_count; i++) {
80 struct audit_field *f = &erule->fields[i];
82 security_audit_rule_free(f->lsm_rule);
85 kfree(erule->filterkey);
89 void audit_free_rule_rcu(struct rcu_head *head)
91 struct audit_entry *e = container_of(head, struct audit_entry, rcu);
95 /* Initialize an audit filterlist entry. */
96 static inline struct audit_entry *audit_init_entry(u32 field_count)
98 struct audit_entry *entry;
99 struct audit_field *fields;
101 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
102 if (unlikely(!entry))
105 fields = kzalloc(sizeof(*fields) * field_count, GFP_KERNEL);
106 if (unlikely(!fields)) {
110 entry->rule.fields = fields;
115 /* Unpack a filter field's string representation from user-space
117 char *audit_unpack_string(void **bufp, size_t *remain, size_t len)
121 if (!*bufp || (len == 0) || (len > *remain))
122 return ERR_PTR(-EINVAL);
124 /* Of the currently implemented string fields, PATH_MAX
125 * defines the longest valid length.
128 return ERR_PTR(-ENAMETOOLONG);
130 str = kmalloc(len + 1, GFP_KERNEL);
132 return ERR_PTR(-ENOMEM);
134 memcpy(str, *bufp, len);
142 /* Translate an inode field to kernel respresentation. */
143 static inline int audit_to_inode(struct audit_krule *krule,
144 struct audit_field *f)
146 if (krule->listnr != AUDIT_FILTER_EXIT ||
147 krule->watch || krule->inode_f || krule->tree ||
148 (f->op != Audit_equal && f->op != Audit_not_equal))
155 static __u32 *classes[AUDIT_SYSCALL_CLASSES];
157 int __init audit_register_class(int class, unsigned *list)
159 __u32 *p = kzalloc(AUDIT_BITMASK_SIZE * sizeof(__u32), GFP_KERNEL);
162 while (*list != ~0U) {
163 unsigned n = *list++;
164 if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) {
168 p[AUDIT_WORD(n)] |= AUDIT_BIT(n);
170 if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) {
178 int audit_match_class(int class, unsigned syscall)
180 if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32))
182 if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class]))
184 return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall);
187 #ifdef CONFIG_AUDITSYSCALL
188 static inline int audit_match_class_bits(int class, u32 *mask)
192 if (classes[class]) {
193 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
194 if (mask[i] & classes[class][i])
200 static int audit_match_signal(struct audit_entry *entry)
202 struct audit_field *arch = entry->rule.arch_f;
205 /* When arch is unspecified, we must check both masks on biarch
206 * as syscall number alone is ambiguous. */
207 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
209 audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
213 switch(audit_classify_arch(arch->val)) {
215 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
217 case 1: /* 32bit on biarch */
218 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
226 /* Common user-space to kernel rule translation. */
227 static inline struct audit_entry *audit_to_entry_common(struct audit_rule *rule)
230 struct audit_entry *entry;
234 listnr = rule->flags & ~AUDIT_FILTER_PREPEND;
238 #ifdef CONFIG_AUDITSYSCALL
239 case AUDIT_FILTER_ENTRY:
240 if (rule->action == AUDIT_ALWAYS)
242 case AUDIT_FILTER_EXIT:
243 case AUDIT_FILTER_TASK:
245 case AUDIT_FILTER_USER:
246 case AUDIT_FILTER_TYPE:
249 if (unlikely(rule->action == AUDIT_POSSIBLE)) {
250 printk(KERN_ERR "AUDIT_POSSIBLE is deprecated\n");
253 if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS)
255 if (rule->field_count > AUDIT_MAX_FIELDS)
259 entry = audit_init_entry(rule->field_count);
263 entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;
264 entry->rule.listnr = listnr;
265 entry->rule.action = rule->action;
266 entry->rule.field_count = rule->field_count;
268 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
269 entry->rule.mask[i] = rule->mask[i];
271 for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) {
272 int bit = AUDIT_BITMASK_SIZE * 32 - i - 1;
273 __u32 *p = &entry->rule.mask[AUDIT_WORD(bit)];
276 if (!(*p & AUDIT_BIT(bit)))
278 *p &= ~AUDIT_BIT(bit);
282 for (j = 0; j < AUDIT_BITMASK_SIZE; j++)
283 entry->rule.mask[j] |= class[j];
293 static u32 audit_ops[] =
295 [Audit_equal] = AUDIT_EQUAL,
296 [Audit_not_equal] = AUDIT_NOT_EQUAL,
297 [Audit_bitmask] = AUDIT_BIT_MASK,
298 [Audit_bittest] = AUDIT_BIT_TEST,
299 [Audit_lt] = AUDIT_LESS_THAN,
300 [Audit_gt] = AUDIT_GREATER_THAN,
301 [Audit_le] = AUDIT_LESS_THAN_OR_EQUAL,
302 [Audit_ge] = AUDIT_GREATER_THAN_OR_EQUAL,
305 static u32 audit_to_op(u32 op)
308 for (n = Audit_equal; n < Audit_bad && audit_ops[n] != op; n++)
314 /* Translate struct audit_rule to kernel's rule respresentation.
315 * Exists for backward compatibility with userspace. */
316 static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
318 struct audit_entry *entry;
322 entry = audit_to_entry_common(rule);
326 for (i = 0; i < rule->field_count; i++) {
327 struct audit_field *f = &entry->rule.fields[i];
330 n = rule->fields[i] & (AUDIT_NEGATE|AUDIT_OPERATORS);
332 /* Support for legacy operators where
333 * AUDIT_NEGATE bit signifies != and otherwise assumes == */
334 if (n & AUDIT_NEGATE)
335 f->op = Audit_not_equal;
339 f->op = audit_to_op(n);
341 entry->rule.vers_ops = (n & AUDIT_OPERATORS) ? 2 : 1;
343 f->type = rule->fields[i] & ~(AUDIT_NEGATE|AUDIT_OPERATORS);
344 f->val = rule->values[i];
347 if (f->op == Audit_bad)
370 /* bit ops are only useful on syscall args */
371 if (f->op == Audit_bitmask || f->op == Audit_bittest)
379 /* arch is only allowed to be = or != */
381 if (f->op != Audit_not_equal && f->op != Audit_equal)
383 entry->rule.arch_f = f;
390 if (f->val & ~S_IFMT)
394 err = audit_to_inode(&entry->rule, f);
401 if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)
402 entry->rule.inode_f = NULL;
408 audit_free_rule(entry);
412 /* Translate struct audit_rule_data to kernel's rule respresentation. */
413 static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
417 struct audit_entry *entry;
419 size_t remain = datasz - sizeof(struct audit_rule_data);
423 entry = audit_to_entry_common((struct audit_rule *)data);
428 entry->rule.vers_ops = 2;
429 for (i = 0; i < data->field_count; i++) {
430 struct audit_field *f = &entry->rule.fields[i];
434 f->op = audit_to_op(data->fieldflags[i]);
435 if (f->op == Audit_bad)
438 f->type = data->fields[i];
439 f->val = data->values[i];
468 entry->rule.arch_f = f;
470 case AUDIT_SUBJ_USER:
471 case AUDIT_SUBJ_ROLE:
472 case AUDIT_SUBJ_TYPE:
478 case AUDIT_OBJ_LEV_LOW:
479 case AUDIT_OBJ_LEV_HIGH:
480 str = audit_unpack_string(&bufp, &remain, f->val);
483 entry->rule.buflen += f->val;
485 err = security_audit_rule_init(f->type, f->op, str,
486 (void **)&f->lsm_rule);
487 /* Keep currently invalid fields around in case they
488 * become valid after a policy reload. */
489 if (err == -EINVAL) {
490 printk(KERN_WARNING "audit rule for LSM "
491 "\'%s\' is invalid\n", str);
501 str = audit_unpack_string(&bufp, &remain, f->val);
504 entry->rule.buflen += f->val;
506 err = audit_to_watch(&entry->rule, str, f->val, f->op);
513 str = audit_unpack_string(&bufp, &remain, f->val);
516 entry->rule.buflen += f->val;
518 err = audit_make_tree(&entry->rule, str, f->op);
524 err = audit_to_inode(&entry->rule, f);
528 case AUDIT_FILTERKEY:
530 if (entry->rule.filterkey || f->val > AUDIT_MAX_KEY_LEN)
532 str = audit_unpack_string(&bufp, &remain, f->val);
535 entry->rule.buflen += f->val;
536 entry->rule.filterkey = str;
543 if (f->val & ~S_IFMT)
551 if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)
552 entry->rule.inode_f = NULL;
558 audit_free_rule(entry);
562 /* Pack a filter field's string representation into data block. */
563 static inline size_t audit_pack_string(void **bufp, const char *str)
565 size_t len = strlen(str);
567 memcpy(*bufp, str, len);
573 /* Translate kernel rule respresentation to struct audit_rule.
574 * Exists for backward compatibility with userspace. */
575 static struct audit_rule *audit_krule_to_rule(struct audit_krule *krule)
577 struct audit_rule *rule;
580 rule = kzalloc(sizeof(*rule), GFP_KERNEL);
584 rule->flags = krule->flags | krule->listnr;
585 rule->action = krule->action;
586 rule->field_count = krule->field_count;
587 for (i = 0; i < rule->field_count; i++) {
588 rule->values[i] = krule->fields[i].val;
589 rule->fields[i] = krule->fields[i].type;
591 if (krule->vers_ops == 1) {
592 if (krule->fields[i].op == Audit_not_equal)
593 rule->fields[i] |= AUDIT_NEGATE;
595 rule->fields[i] |= audit_ops[krule->fields[i].op];
598 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) rule->mask[i] = krule->mask[i];
603 /* Translate kernel rule respresentation to struct audit_rule_data. */
604 static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
606 struct audit_rule_data *data;
610 data = kmalloc(sizeof(*data) + krule->buflen, GFP_KERNEL);
613 memset(data, 0, sizeof(*data));
615 data->flags = krule->flags | krule->listnr;
616 data->action = krule->action;
617 data->field_count = krule->field_count;
619 for (i = 0; i < data->field_count; i++) {
620 struct audit_field *f = &krule->fields[i];
622 data->fields[i] = f->type;
623 data->fieldflags[i] = audit_ops[f->op];
625 case AUDIT_SUBJ_USER:
626 case AUDIT_SUBJ_ROLE:
627 case AUDIT_SUBJ_TYPE:
633 case AUDIT_OBJ_LEV_LOW:
634 case AUDIT_OBJ_LEV_HIGH:
635 data->buflen += data->values[i] =
636 audit_pack_string(&bufp, f->lsm_str);
639 data->buflen += data->values[i] =
640 audit_pack_string(&bufp,
641 audit_watch_path(krule->watch));
644 data->buflen += data->values[i] =
645 audit_pack_string(&bufp,
646 audit_tree_path(krule->tree));
648 case AUDIT_FILTERKEY:
649 data->buflen += data->values[i] =
650 audit_pack_string(&bufp, krule->filterkey);
653 data->values[i] = f->val;
656 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i];
661 /* Compare two rules in kernel format. Considered success if rules
663 static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
667 if (a->flags != b->flags ||
668 a->listnr != b->listnr ||
669 a->action != b->action ||
670 a->field_count != b->field_count)
673 for (i = 0; i < a->field_count; i++) {
674 if (a->fields[i].type != b->fields[i].type ||
675 a->fields[i].op != b->fields[i].op)
678 switch(a->fields[i].type) {
679 case AUDIT_SUBJ_USER:
680 case AUDIT_SUBJ_ROLE:
681 case AUDIT_SUBJ_TYPE:
687 case AUDIT_OBJ_LEV_LOW:
688 case AUDIT_OBJ_LEV_HIGH:
689 if (strcmp(a->fields[i].lsm_str, b->fields[i].lsm_str))
693 if (strcmp(audit_watch_path(a->watch),
694 audit_watch_path(b->watch)))
698 if (strcmp(audit_tree_path(a->tree),
699 audit_tree_path(b->tree)))
702 case AUDIT_FILTERKEY:
703 /* both filterkeys exist based on above type compare */
704 if (strcmp(a->filterkey, b->filterkey))
708 if (a->fields[i].val != b->fields[i].val)
713 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
714 if (a->mask[i] != b->mask[i])
720 /* Duplicate LSM field information. The lsm_rule is opaque, so must be
722 static inline int audit_dupe_lsm_field(struct audit_field *df,
723 struct audit_field *sf)
728 /* our own copy of lsm_str */
729 lsm_str = kstrdup(sf->lsm_str, GFP_KERNEL);
730 if (unlikely(!lsm_str))
732 df->lsm_str = lsm_str;
734 /* our own (refreshed) copy of lsm_rule */
735 ret = security_audit_rule_init(df->type, df->op, df->lsm_str,
736 (void **)&df->lsm_rule);
737 /* Keep currently invalid fields around in case they
738 * become valid after a policy reload. */
739 if (ret == -EINVAL) {
740 printk(KERN_WARNING "audit rule for LSM \'%s\' is "
741 "invalid\n", df->lsm_str);
748 /* Duplicate an audit rule. This will be a deep copy with the exception
749 * of the watch - that pointer is carried over. The LSM specific fields
750 * will be updated in the copy. The point is to be able to replace the old
751 * rule with the new rule in the filterlist, then free the old rule.
752 * The rlist element is undefined; list manipulations are handled apart from
753 * the initial copy. */
754 struct audit_entry *audit_dupe_rule(struct audit_krule *old)
756 u32 fcount = old->field_count;
757 struct audit_entry *entry;
758 struct audit_krule *new;
762 entry = audit_init_entry(fcount);
763 if (unlikely(!entry))
764 return ERR_PTR(-ENOMEM);
767 new->vers_ops = old->vers_ops;
768 new->flags = old->flags;
769 new->listnr = old->listnr;
770 new->action = old->action;
771 for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
772 new->mask[i] = old->mask[i];
773 new->prio = old->prio;
774 new->buflen = old->buflen;
775 new->inode_f = old->inode_f;
776 new->field_count = old->field_count;
779 * note that we are OK with not refcounting here; audit_match_tree()
780 * never dereferences tree and we can't get false positives there
781 * since we'd have to have rule gone from the list *and* removed
782 * before the chunks found by lookup had been allocated, i.e. before
783 * the beginning of list scan.
785 new->tree = old->tree;
786 memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount);
788 /* deep copy this information, updating the lsm_rule fields, because
789 * the originals will all be freed when the old rule is freed. */
790 for (i = 0; i < fcount; i++) {
791 switch (new->fields[i].type) {
792 case AUDIT_SUBJ_USER:
793 case AUDIT_SUBJ_ROLE:
794 case AUDIT_SUBJ_TYPE:
800 case AUDIT_OBJ_LEV_LOW:
801 case AUDIT_OBJ_LEV_HIGH:
802 err = audit_dupe_lsm_field(&new->fields[i],
805 case AUDIT_FILTERKEY:
806 fk = kstrdup(old->filterkey, GFP_KERNEL);
813 audit_free_rule(entry);
819 audit_get_watch(old->watch);
820 new->watch = old->watch;
826 /* Find an existing audit rule.
827 * Caller must hold audit_filter_mutex to prevent stale rule data. */
828 static struct audit_entry *audit_find_rule(struct audit_entry *entry,
829 struct list_head **p)
831 struct audit_entry *e, *found = NULL;
832 struct list_head *list;
835 if (entry->rule.inode_f) {
836 h = audit_hash_ino(entry->rule.inode_f->val);
837 *p = list = &audit_inode_hash[h];
838 } else if (entry->rule.watch) {
839 /* we don't know the inode number, so must walk entire hash */
840 for (h = 0; h < AUDIT_INODE_BUCKETS; h++) {
841 list = &audit_inode_hash[h];
842 list_for_each_entry(e, list, list)
843 if (!audit_compare_rule(&entry->rule, &e->rule)) {
850 *p = list = &audit_filter_list[entry->rule.listnr];
853 list_for_each_entry(e, list, list)
854 if (!audit_compare_rule(&entry->rule, &e->rule)) {
863 static u64 prio_low = ~0ULL/2;
864 static u64 prio_high = ~0ULL/2 - 1;
866 /* Add rule to given filterlist if not a duplicate. */
867 static inline int audit_add_rule(struct audit_entry *entry)
869 struct audit_entry *e;
870 struct audit_watch *watch = entry->rule.watch;
871 struct audit_tree *tree = entry->rule.tree;
872 struct list_head *list;
874 #ifdef CONFIG_AUDITSYSCALL
877 /* If either of these, don't count towards total */
878 if (entry->rule.listnr == AUDIT_FILTER_USER ||
879 entry->rule.listnr == AUDIT_FILTER_TYPE)
883 mutex_lock(&audit_filter_mutex);
884 e = audit_find_rule(entry, &list);
886 mutex_unlock(&audit_filter_mutex);
888 /* normally audit_add_tree_rule() will free it on failure */
890 audit_put_tree(tree);
895 /* audit_filter_mutex is dropped and re-taken during this call */
896 err = audit_add_watch(&entry->rule, &list);
898 mutex_unlock(&audit_filter_mutex);
903 err = audit_add_tree_rule(&entry->rule);
905 mutex_unlock(&audit_filter_mutex);
910 entry->rule.prio = ~0ULL;
911 if (entry->rule.listnr == AUDIT_FILTER_EXIT) {
912 if (entry->rule.flags & AUDIT_FILTER_PREPEND)
913 entry->rule.prio = ++prio_high;
915 entry->rule.prio = --prio_low;
918 if (entry->rule.flags & AUDIT_FILTER_PREPEND) {
919 list_add(&entry->rule.list,
920 &audit_rules_list[entry->rule.listnr]);
921 list_add_rcu(&entry->list, list);
922 entry->rule.flags &= ~AUDIT_FILTER_PREPEND;
924 list_add_tail(&entry->rule.list,
925 &audit_rules_list[entry->rule.listnr]);
926 list_add_tail_rcu(&entry->list, list);
928 #ifdef CONFIG_AUDITSYSCALL
932 if (!audit_match_signal(entry))
935 mutex_unlock(&audit_filter_mutex);
941 audit_put_watch(watch); /* tmp watch, matches initial get */
945 /* Remove an existing rule from filterlist. */
946 static inline int audit_del_rule(struct audit_entry *entry)
948 struct audit_entry *e;
949 struct audit_watch *watch = entry->rule.watch;
950 struct audit_tree *tree = entry->rule.tree;
951 struct list_head *list;
953 #ifdef CONFIG_AUDITSYSCALL
956 /* If either of these, don't count towards total */
957 if (entry->rule.listnr == AUDIT_FILTER_USER ||
958 entry->rule.listnr == AUDIT_FILTER_TYPE)
962 mutex_lock(&audit_filter_mutex);
963 e = audit_find_rule(entry, &list);
965 mutex_unlock(&audit_filter_mutex);
971 audit_remove_watch_rule(&e->rule);
974 audit_remove_tree_rule(&e->rule);
976 list_del_rcu(&e->list);
977 list_del(&e->rule.list);
978 call_rcu(&e->rcu, audit_free_rule_rcu);
980 #ifdef CONFIG_AUDITSYSCALL
984 if (!audit_match_signal(entry))
987 mutex_unlock(&audit_filter_mutex);
991 audit_put_watch(watch); /* match initial get */
993 audit_put_tree(tree); /* that's the temporary one */
998 /* List rules using struct audit_rule. Exists for backward
999 * compatibility with userspace. */
1000 static void audit_list(int pid, int seq, struct sk_buff_head *q)
1002 struct sk_buff *skb;
1003 struct audit_krule *r;
1006 /* This is a blocking read, so use audit_filter_mutex instead of rcu
1007 * iterator to sync with list writers. */
1008 for (i=0; i<AUDIT_NR_FILTERS; i++) {
1009 list_for_each_entry(r, &audit_rules_list[i], list) {
1010 struct audit_rule *rule;
1012 rule = audit_krule_to_rule(r);
1013 if (unlikely(!rule))
1015 skb = audit_make_reply(pid, seq, AUDIT_LIST, 0, 1,
1016 rule, sizeof(*rule));
1018 skb_queue_tail(q, skb);
1022 skb = audit_make_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0);
1024 skb_queue_tail(q, skb);
1027 /* List rules using struct audit_rule_data. */
1028 static void audit_list_rules(int pid, int seq, struct sk_buff_head *q)
1030 struct sk_buff *skb;
1031 struct audit_krule *r;
1034 /* This is a blocking read, so use audit_filter_mutex instead of rcu
1035 * iterator to sync with list writers. */
1036 for (i=0; i<AUDIT_NR_FILTERS; i++) {
1037 list_for_each_entry(r, &audit_rules_list[i], list) {
1038 struct audit_rule_data *data;
1040 data = audit_krule_to_data(r);
1041 if (unlikely(!data))
1043 skb = audit_make_reply(pid, seq, AUDIT_LIST_RULES, 0, 1,
1044 data, sizeof(*data) + data->buflen);
1046 skb_queue_tail(q, skb);
1050 skb = audit_make_reply(pid, seq, AUDIT_LIST_RULES, 1, 1, NULL, 0);
1052 skb_queue_tail(q, skb);
1055 /* Log rule additions and removals */
1056 static void audit_log_rule_change(uid_t loginuid, u32 sessionid, u32 sid,
1057 char *action, struct audit_krule *rule,
1060 struct audit_buffer *ab;
1065 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
1068 audit_log_format(ab, "auid=%u ses=%u", loginuid, sessionid);
1072 if (security_secid_to_secctx(sid, &ctx, &len))
1073 audit_log_format(ab, " ssid=%u", sid);
1075 audit_log_format(ab, " subj=%s", ctx);
1076 security_release_secctx(ctx, len);
1079 audit_log_format(ab, " op=");
1080 audit_log_string(ab, action);
1081 audit_log_key(ab, rule->filterkey);
1082 audit_log_format(ab, " list=%d res=%d", rule->listnr, res);
1087 * audit_receive_filter - apply all rules to the specified message type
1088 * @type: audit message type
1089 * @pid: target pid for netlink audit messages
1090 * @uid: target uid for netlink audit messages
1091 * @seq: netlink audit message sequence (serial) number
1092 * @data: payload data
1093 * @datasz: size of payload data
1094 * @loginuid: loginuid of sender
1095 * @sessionid: sessionid for netlink audit message
1096 * @sid: SE Linux Security ID of sender
1098 int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
1099 size_t datasz, uid_t loginuid, u32 sessionid, u32 sid)
1101 struct task_struct *tsk;
1102 struct audit_netlink_list *dest;
1104 struct audit_entry *entry;
1108 case AUDIT_LIST_RULES:
1109 /* We can't just spew out the rules here because we might fill
1110 * the available socket buffer space and deadlock waiting for
1111 * auditctl to read from it... which isn't ever going to
1112 * happen if we're actually running in the context of auditctl
1113 * trying to _send_ the stuff */
1115 dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL);
1119 skb_queue_head_init(&dest->q);
1121 mutex_lock(&audit_filter_mutex);
1122 if (type == AUDIT_LIST)
1123 audit_list(pid, seq, &dest->q);
1125 audit_list_rules(pid, seq, &dest->q);
1126 mutex_unlock(&audit_filter_mutex);
1128 tsk = kthread_run(audit_send_list, dest, "audit_send_list");
1130 skb_queue_purge(&dest->q);
1136 case AUDIT_ADD_RULE:
1137 if (type == AUDIT_ADD)
1138 entry = audit_rule_to_entry(data);
1140 entry = audit_data_to_entry(data, datasz);
1142 return PTR_ERR(entry);
1144 err = audit_add_rule(entry);
1145 audit_log_rule_change(loginuid, sessionid, sid, "add rule",
1146 &entry->rule, !err);
1149 audit_free_rule(entry);
1152 case AUDIT_DEL_RULE:
1153 if (type == AUDIT_DEL)
1154 entry = audit_rule_to_entry(data);
1156 entry = audit_data_to_entry(data, datasz);
1158 return PTR_ERR(entry);
1160 err = audit_del_rule(entry);
1161 audit_log_rule_change(loginuid, sessionid, sid, "remove rule",
1162 &entry->rule, !err);
1164 audit_free_rule(entry);
1173 int audit_comparator(u32 left, u32 op, u32 right)
1177 return (left == right);
1178 case Audit_not_equal:
1179 return (left != right);
1181 return (left < right);
1183 return (left <= right);
1185 return (left > right);
1187 return (left >= right);
1189 return (left & right);
1191 return ((left & right) == right);
1198 /* Compare given dentry name with last component in given path,
1199 * return of 0 indicates a match. */
1200 int audit_compare_dname_path(const char *dname, const char *path,
1206 if (!dname || !path)
1209 dlen = strlen(dname);
1210 plen = strlen(path);
1214 /* disregard trailing slashes */
1215 p = path + plen - 1;
1216 while ((*p == '/') && (p > path))
1219 /* find last path component */
1223 else if (p > path) {
1230 /* return length of path's directory component */
1233 return strncmp(p, dname, dlen);
1236 static int audit_filter_user_rules(struct netlink_skb_parms *cb,
1237 struct audit_krule *rule,
1238 enum audit_state *state)
1242 for (i = 0; i < rule->field_count; i++) {
1243 struct audit_field *f = &rule->fields[i];
1249 result = audit_comparator(cb->creds.pid, f->op, f->val);
1252 result = audit_comparator(cb->creds.uid, f->op, f->val);
1255 result = audit_comparator(cb->creds.gid, f->op, f->val);
1257 case AUDIT_LOGINUID:
1258 result = audit_comparator(audit_get_loginuid(current),
1261 case AUDIT_SUBJ_USER:
1262 case AUDIT_SUBJ_ROLE:
1263 case AUDIT_SUBJ_TYPE:
1264 case AUDIT_SUBJ_SEN:
1265 case AUDIT_SUBJ_CLR:
1267 security_task_getsecid(current, &sid);
1268 result = security_audit_rule_match(sid,
1280 switch (rule->action) {
1281 case AUDIT_NEVER: *state = AUDIT_DISABLED; break;
1282 case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break;
1287 int audit_filter_user(struct netlink_skb_parms *cb)
1289 enum audit_state state = AUDIT_DISABLED;
1290 struct audit_entry *e;
1294 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_USER], list) {
1295 if (audit_filter_user_rules(cb, &e->rule, &state)) {
1296 if (state == AUDIT_DISABLED)
1303 return ret; /* Audit by default */
1306 int audit_filter_type(int type)
1308 struct audit_entry *e;
1312 if (list_empty(&audit_filter_list[AUDIT_FILTER_TYPE]))
1313 goto unlock_and_return;
1315 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE],
1318 for (i = 0; i < e->rule.field_count; i++) {
1319 struct audit_field *f = &e->rule.fields[i];
1320 if (f->type == AUDIT_MSGTYPE) {
1321 result = audit_comparator(type, f->op, f->val);
1327 goto unlock_and_return;
1334 static int update_lsm_rule(struct audit_krule *r)
1336 struct audit_entry *entry = container_of(r, struct audit_entry, rule);
1337 struct audit_entry *nentry;
1340 if (!security_audit_rule_known(r))
1343 nentry = audit_dupe_rule(r);
1344 if (IS_ERR(nentry)) {
1345 /* save the first error encountered for the
1347 err = PTR_ERR(nentry);
1348 audit_panic("error updating LSM filters");
1350 list_del(&r->rlist);
1351 list_del_rcu(&entry->list);
1354 if (r->watch || r->tree)
1355 list_replace_init(&r->rlist, &nentry->rule.rlist);
1356 list_replace_rcu(&entry->list, &nentry->list);
1357 list_replace(&r->list, &nentry->rule.list);
1359 call_rcu(&entry->rcu, audit_free_rule_rcu);
1364 /* This function will re-initialize the lsm_rule field of all applicable rules.
1365 * It will traverse the filter lists serarching for rules that contain LSM
1366 * specific filter fields. When such a rule is found, it is copied, the
1367 * LSM field is re-initialized, and the old rule is replaced with the
1369 int audit_update_lsm_rules(void)
1371 struct audit_krule *r, *n;
1374 /* audit_filter_mutex synchronizes the writers */
1375 mutex_lock(&audit_filter_mutex);
1377 for (i = 0; i < AUDIT_NR_FILTERS; i++) {
1378 list_for_each_entry_safe(r, n, &audit_rules_list[i], list) {
1379 int res = update_lsm_rule(r);
1384 mutex_unlock(&audit_filter_mutex);