Commit 9781db7b authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'audit.b50' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current

* 'audit.b50' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current:
  [PATCH] new predicate - AUDIT_FILETYPE
  [patch 2/2] Use find_task_by_vpid in audit code
  [patch 1/2] audit: let userspace fully control TTY input auditing
  [PATCH 2/2] audit: fix sparse shadowed variable warnings
  [PATCH 1/2] audit: move extern declarations to audit.h
  Audit: MAINTAINERS update
  Audit: increase the maximum length of the key field
  Audit: standardize string audit interfaces
  Audit: stop deadlock from signals under load
  Audit: save audit_backlog_limit audit messages in case auditd comes back
  Audit: collect sessionid in netlink messages
  Audit: end printk with newline
parents 97094dcf 8b67dca9
...@@ -752,11 +752,13 @@ W: http://atmelwlandriver.sourceforge.net/ ...@@ -752,11 +752,13 @@ W: http://atmelwlandriver.sourceforge.net/
S: Maintained S: Maintained
AUDIT SUBSYSTEM AUDIT SUBSYSTEM
P: David Woodhouse P: Al Viro
M: dwmw2@infradead.org M: viro@zeniv.linux.org.uk
P: Eric Paris
M: eparis@redhat.com
L: linux-audit@redhat.com (subscribers-only) L: linux-audit@redhat.com (subscribers-only)
W: http://people.redhat.com/sgrubb/audit/ W: http://people.redhat.com/sgrubb/audit/
T: git kernel.org:/pub/scm/linux/kernel/git/dwmw2/audit-2.6.git T: git git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current.git
S: Maintained S: Maintained
AUXILIARY DISPLAY DRIVERS AUXILIARY DISPLAY DRIVERS
......
...@@ -92,7 +92,7 @@ static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid, ...@@ -92,7 +92,7 @@ static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid,
get_task_comm(name, tsk); get_task_comm(name, tsk);
audit_log_untrustedstring(ab, name); audit_log_untrustedstring(ab, name);
audit_log_format(ab, " data="); audit_log_format(ab, " data=");
audit_log_n_untrustedstring(ab, buf->valid, buf->data); audit_log_n_untrustedstring(ab, buf->data, buf->valid);
audit_log_end(ab); audit_log_end(ab);
} }
buf->valid = 0; buf->valid = 0;
...@@ -151,14 +151,9 @@ void tty_audit_fork(struct signal_struct *sig) ...@@ -151,14 +151,9 @@ void tty_audit_fork(struct signal_struct *sig)
/** /**
* tty_audit_push_task - Flush task's pending audit data * tty_audit_push_task - Flush task's pending audit data
*/ */
void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid) void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid)
{ {
struct tty_audit_buf *buf; struct tty_audit_buf *buf;
/* FIXME I think this is correct. Check against netlink once that is
* I really need to read this code more closely. But that's for
* another patch.
*/
unsigned int sessionid = audit_get_sessionid(tsk);
spin_lock_irq(&tsk->sighand->siglock); spin_lock_irq(&tsk->sighand->siglock);
buf = tsk->signal->tty_audit_buf; buf = tsk->signal->tty_audit_buf;
...@@ -238,6 +233,10 @@ void tty_audit_add_data(struct tty_struct *tty, unsigned char *data, ...@@ -238,6 +233,10 @@ void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
if (unlikely(size == 0)) if (unlikely(size == 0))
return; return;
if (tty->driver->type == TTY_DRIVER_TYPE_PTY
&& tty->driver->subtype == PTY_TYPE_MASTER)
return;
buf = tty_audit_buf_get(tty); buf = tty_audit_buf_get(tty);
if (!buf) if (!buf)
return; return;
...@@ -300,53 +299,3 @@ void tty_audit_push(struct tty_struct *tty) ...@@ -300,53 +299,3 @@ void tty_audit_push(struct tty_struct *tty)
tty_audit_buf_put(buf); tty_audit_buf_put(buf);
} }
} }
/**
* tty_audit_opening - A TTY is being opened.
*
* As a special hack, tasks that close all their TTYs and open new ones
* are assumed to be system daemons (e.g. getty) and auditing is
* automatically disabled for them.
*/
void tty_audit_opening(void)
{
int disable;
disable = 1;
spin_lock_irq(&current->sighand->siglock);
if (current->signal->audit_tty == 0)
disable = 0;
spin_unlock_irq(&current->sighand->siglock);
if (!disable)
return;
task_lock(current);
if (current->files) {
struct fdtable *fdt;
unsigned i;
/*
* We don't take a ref to the file, so we must hold ->file_lock
* instead.
*/
spin_lock(&current->files->file_lock);
fdt = files_fdtable(current->files);
for (i = 0; i < fdt->max_fds; i++) {
struct file *filp;
filp = fcheck_files(current->files, i);
if (filp && is_tty(filp)) {
disable = 0;
break;
}
}
spin_unlock(&current->files->file_lock);
}
task_unlock(current);
if (!disable)
return;
spin_lock_irq(&current->sighand->siglock);
current->signal->audit_tty = 0;
spin_unlock_irq(&current->sighand->siglock);
}
...@@ -2755,7 +2755,6 @@ static int tty_open(struct inode *inode, struct file *filp) ...@@ -2755,7 +2755,6 @@ static int tty_open(struct inode *inode, struct file *filp)
__proc_set_tty(current, tty); __proc_set_tty(current, tty);
spin_unlock_irq(&current->sighand->siglock); spin_unlock_irq(&current->sighand->siglock);
mutex_unlock(&tty_mutex); mutex_unlock(&tty_mutex);
tty_audit_opening();
return 0; return 0;
} }
...@@ -2818,10 +2817,8 @@ static int ptmx_open(struct inode *inode, struct file *filp) ...@@ -2818,10 +2817,8 @@ static int ptmx_open(struct inode *inode, struct file *filp)
check_tty_count(tty, "tty_open"); check_tty_count(tty, "tty_open");
retval = ptm_driver->open(tty, filp); retval = ptm_driver->open(tty, filp);
if (!retval) { if (!retval)
tty_audit_opening();
return 0; return 0;
}
out1: out1:
release_dev(filp); release_dev(filp);
return retval; return retval;
......
...@@ -146,7 +146,7 @@ ...@@ -146,7 +146,7 @@
/* Rule structure sizes -- if these change, different AUDIT_ADD and /* Rule structure sizes -- if these change, different AUDIT_ADD and
* AUDIT_LIST commands must be implemented. */ * AUDIT_LIST commands must be implemented. */
#define AUDIT_MAX_FIELDS 64 #define AUDIT_MAX_FIELDS 64
#define AUDIT_MAX_KEY_LEN 32 #define AUDIT_MAX_KEY_LEN 256
#define AUDIT_BITMASK_SIZE 64 #define AUDIT_BITMASK_SIZE 64
#define AUDIT_WORD(nr) ((__u32)((nr)/32)) #define AUDIT_WORD(nr) ((__u32)((nr)/32))
#define AUDIT_BIT(nr) (1 << ((nr) - AUDIT_WORD(nr)*32)) #define AUDIT_BIT(nr) (1 << ((nr) - AUDIT_WORD(nr)*32))
...@@ -209,6 +209,7 @@ ...@@ -209,6 +209,7 @@
#define AUDIT_WATCH 105 #define AUDIT_WATCH 105
#define AUDIT_PERM 106 #define AUDIT_PERM 106
#define AUDIT_DIR 107 #define AUDIT_DIR 107
#define AUDIT_FILETYPE 108
#define AUDIT_ARG0 200 #define AUDIT_ARG0 200
#define AUDIT_ARG1 (AUDIT_ARG0+1) #define AUDIT_ARG1 (AUDIT_ARG0+1)
...@@ -549,16 +550,20 @@ extern void audit_log_format(struct audit_buffer *ab, ...@@ -549,16 +550,20 @@ extern void audit_log_format(struct audit_buffer *ab,
const char *fmt, ...) const char *fmt, ...)
__attribute__((format(printf,2,3))); __attribute__((format(printf,2,3)));
extern void audit_log_end(struct audit_buffer *ab); extern void audit_log_end(struct audit_buffer *ab);
extern void audit_log_hex(struct audit_buffer *ab,
const unsigned char *buf,
size_t len);
extern int audit_string_contains_control(const char *string, extern int audit_string_contains_control(const char *string,
size_t len); size_t len);
extern void audit_log_n_hex(struct audit_buffer *ab,
const unsigned char *buf,
size_t len);
extern void audit_log_n_string(struct audit_buffer *ab,
const char *buf,
size_t n);
#define audit_log_string(a,b) audit_log_n_string(a, b, strlen(b));
extern void audit_log_n_untrustedstring(struct audit_buffer *ab,
const char *string,
size_t n);
extern void audit_log_untrustedstring(struct audit_buffer *ab, extern void audit_log_untrustedstring(struct audit_buffer *ab,
const char *string); const char *string);
extern void audit_log_n_untrustedstring(struct audit_buffer *ab,
size_t n,
const char *string);
extern void audit_log_d_path(struct audit_buffer *ab, extern void audit_log_d_path(struct audit_buffer *ab,
const char *prefix, const char *prefix,
struct path *path); struct path *path);
...@@ -569,7 +574,8 @@ extern int audit_update_lsm_rules(void); ...@@ -569,7 +574,8 @@ extern int audit_update_lsm_rules(void);
extern int audit_filter_user(struct netlink_skb_parms *cb, int type); extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
extern int audit_filter_type(int type); extern int audit_filter_type(int type);
extern int audit_receive_filter(int type, int pid, int uid, int seq, extern int audit_receive_filter(int type, int pid, int uid, int seq,
void *data, size_t datasz, uid_t loginuid, u32 sid); void *data, size_t datasz, uid_t loginuid,
u32 sessionid, u32 sid);
extern int audit_enabled; extern int audit_enabled;
#else #else
#define audit_log(c,g,t,f,...) do { ; } while (0) #define audit_log(c,g,t,f,...) do { ; } while (0)
...@@ -577,9 +583,11 @@ extern int audit_enabled; ...@@ -577,9 +583,11 @@ extern int audit_enabled;
#define audit_log_vformat(b,f,a) do { ; } while (0) #define audit_log_vformat(b,f,a) do { ; } while (0)
#define audit_log_format(b,f,...) do { ; } while (0) #define audit_log_format(b,f,...) do { ; } while (0)
#define audit_log_end(b) do { ; } while (0) #define audit_log_end(b) do { ; } while (0)
#define audit_log_hex(a,b,l) do { ; } while (0) #define audit_log_n_hex(a,b,l) do { ; } while (0)
#define audit_log_untrustedstring(a,s) do { ; } while (0) #define audit_log_n_string(a,c,l) do { ; } while (0)
#define audit_log_string(a,c) do { ; } while (0)
#define audit_log_n_untrustedstring(a,n,s) do { ; } while (0) #define audit_log_n_untrustedstring(a,n,s) do { ; } while (0)
#define audit_log_untrustedstring(a,s) do { ; } while (0)
#define audit_log_d_path(b, p, d) do { ; } while (0) #define audit_log_d_path(b, p, d) do { ; } while (0)
#define audit_enabled 0 #define audit_enabled 0
#endif #endif
......
...@@ -166,6 +166,7 @@ struct netlink_skb_parms ...@@ -166,6 +166,7 @@ struct netlink_skb_parms
__u32 dst_group; __u32 dst_group;
kernel_cap_t eff_cap; kernel_cap_t eff_cap;
__u32 loginuid; /* Login (audit) uid */ __u32 loginuid; /* Login (audit) uid */
__u32 sessionid; /* Session id (audit) */
__u32 sid; /* SELinux security id */ __u32 sid; /* SELinux security id */
}; };
......
...@@ -300,7 +300,6 @@ extern void tty_hangup(struct tty_struct * tty); ...@@ -300,7 +300,6 @@ extern void tty_hangup(struct tty_struct * tty);
extern void tty_vhangup(struct tty_struct * tty); extern void tty_vhangup(struct tty_struct * tty);
extern void tty_unhangup(struct file *filp); extern void tty_unhangup(struct file *filp);
extern int tty_hung_up_p(struct file * filp); extern int tty_hung_up_p(struct file * filp);
extern int is_tty(struct file *filp);
extern void do_SAK(struct tty_struct *tty); extern void do_SAK(struct tty_struct *tty);
extern void __do_SAK(struct tty_struct *tty); extern void __do_SAK(struct tty_struct *tty);
extern void disassociate_ctty(int priv); extern void disassociate_ctty(int priv);
...@@ -351,8 +350,7 @@ extern void tty_audit_add_data(struct tty_struct *tty, unsigned char *data, ...@@ -351,8 +350,7 @@ extern void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
extern void tty_audit_exit(void); extern void tty_audit_exit(void);
extern void tty_audit_fork(struct signal_struct *sig); extern void tty_audit_fork(struct signal_struct *sig);
extern void tty_audit_push(struct tty_struct *tty); extern void tty_audit_push(struct tty_struct *tty);
extern void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid); extern void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid);
extern void tty_audit_opening(void);
#else #else
static inline void tty_audit_add_data(struct tty_struct *tty, static inline void tty_audit_add_data(struct tty_struct *tty,
unsigned char *data, size_t size) unsigned char *data, size_t size)
...@@ -367,10 +365,7 @@ static inline void tty_audit_fork(struct signal_struct *sig) ...@@ -367,10 +365,7 @@ static inline void tty_audit_fork(struct signal_struct *sig)
static inline void tty_audit_push(struct tty_struct *tty) static inline void tty_audit_push(struct tty_struct *tty)
{ {
} }
static inline void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid) static inline void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid)
{
}
static inline void tty_audit_opening(void)
{ {
} }
#endif #endif
......
...@@ -103,6 +103,7 @@ struct cipso_v4_doi; ...@@ -103,6 +103,7 @@ struct cipso_v4_doi;
struct netlbl_audit { struct netlbl_audit {
u32 secid; u32 secid;
uid_t loginuid; uid_t loginuid;
u32 sessionid;
}; };
/* /*
......
...@@ -597,8 +597,9 @@ struct xfrm_spi_skb_cb { ...@@ -597,8 +597,9 @@ struct xfrm_spi_skb_cb {
/* Audit Information */ /* Audit Information */
struct xfrm_audit struct xfrm_audit
{ {
u32 loginuid;
u32 secid; u32 secid;
uid_t loginuid;
u32 sessionid;
}; };
#ifdef CONFIG_AUDITSYSCALL #ifdef CONFIG_AUDITSYSCALL
...@@ -616,13 +617,13 @@ static inline struct audit_buffer *xfrm_audit_start(const char *op) ...@@ -616,13 +617,13 @@ static inline struct audit_buffer *xfrm_audit_start(const char *op)
return audit_buf; return audit_buf;
} }
static inline void xfrm_audit_helper_usrinfo(u32 auid, u32 secid, static inline void xfrm_audit_helper_usrinfo(uid_t auid, u32 ses, u32 secid,
struct audit_buffer *audit_buf) struct audit_buffer *audit_buf)
{ {
char *secctx; char *secctx;
u32 secctx_len; u32 secctx_len;
audit_log_format(audit_buf, " auid=%u", auid); audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
if (secid != 0 && if (secid != 0 &&
security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) { security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
audit_log_format(audit_buf, " subj=%s", secctx); audit_log_format(audit_buf, " subj=%s", secctx);
...@@ -632,13 +633,13 @@ static inline void xfrm_audit_helper_usrinfo(u32 auid, u32 secid, ...@@ -632,13 +633,13 @@ static inline void xfrm_audit_helper_usrinfo(u32 auid, u32 secid,
} }
extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
u32 auid, u32 secid); u32 auid, u32 ses, u32 secid);
extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
u32 auid, u32 secid); u32 auid, u32 ses, u32 secid);
extern void xfrm_audit_state_add(struct xfrm_state *x, int result, extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
u32 auid, u32 secid); u32 auid, u32 ses, u32 secid);
extern void xfrm_audit_state_delete(struct xfrm_state *x, int result, extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
u32 auid, u32 secid); u32 auid, u32 ses, u32 secid);
extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x, extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
struct sk_buff *skb); struct sk_buff *skb);
extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family); extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
...@@ -647,10 +648,10 @@ extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, ...@@ -647,10 +648,10 @@ extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
extern void xfrm_audit_state_icvfail(struct xfrm_state *x, extern void xfrm_audit_state_icvfail(struct xfrm_state *x,
struct sk_buff *skb, u8 proto); struct sk_buff *skb, u8 proto);
#else #else
#define xfrm_audit_policy_add(x, r, a, s) do { ; } while (0) #define xfrm_audit_policy_add(x, r, a, se, s) do { ; } while (0)
#define xfrm_audit_policy_delete(x, r, a, s) do { ; } while (0) #define xfrm_audit_policy_delete(x, r, a, se, s) do { ; } while (0)
#define xfrm_audit_state_add(x, r, a, s) do { ; } while (0) #define xfrm_audit_state_add(x, r, a, se, s) do { ; } while (0)
#define xfrm_audit_state_delete(x, r, a, s) do { ; } while (0) #define xfrm_audit_state_delete(x, r, a, se, s) do { ; } while (0)
#define xfrm_audit_state_replay_overflow(x, s) do { ; } while (0) #define xfrm_audit_state_replay_overflow(x, s) do { ; } while (0)
#define xfrm_audit_state_notfound_simple(s, f) do { ; } while (0) #define xfrm_audit_state_notfound_simple(s, f) do { ; } while (0)
#define xfrm_audit_state_notfound(s, f, sp, sq) do { ; } while (0) #define xfrm_audit_state_notfound(s, f, sp, sq) do { ; } while (0)
......
This diff is collapsed.
...@@ -74,6 +74,11 @@ struct audit_entry { ...@@ -74,6 +74,11 @@ struct audit_entry {
struct audit_krule rule; struct audit_krule rule;
}; };
#ifdef CONFIG_AUDIT
extern int audit_enabled;
extern int audit_ever_enabled;
#endif
extern int audit_pid; extern int audit_pid;
#define AUDIT_INODE_BUCKETS 32 #define AUDIT_INODE_BUCKETS 32
...@@ -104,6 +109,9 @@ struct audit_netlink_list { ...@@ -104,6 +109,9 @@ struct audit_netlink_list {
int audit_send_list(void *); int audit_send_list(void *);
struct inotify_watch; struct inotify_watch;
/* Inotify handle */
extern struct inotify_handle *audit_ih;
extern void audit_free_parent(struct inotify_watch *); extern void audit_free_parent(struct inotify_watch *);
extern void audit_handle_ievent(struct inotify_watch *, u32, u32, u32, extern void audit_handle_ievent(struct inotify_watch *, u32, u32, u32,
const char *, struct inode *); const char *, struct inode *);
...@@ -111,6 +119,7 @@ extern int selinux_audit_rule_update(void); ...@@ -111,6 +119,7 @@ extern int selinux_audit_rule_update(void);
extern struct mutex audit_filter_mutex; extern struct mutex audit_filter_mutex;
extern void audit_free_rule_rcu(struct rcu_head *); extern void audit_free_rule_rcu(struct rcu_head *);
extern struct list_head audit_filter_list[];
#ifdef CONFIG_AUDIT_TREE #ifdef CONFIG_AUDIT_TREE
extern struct audit_chunk *audit_tree_lookup(const struct inode *); extern struct audit_chunk *audit_tree_lookup(const struct inode *);
...@@ -137,6 +146,10 @@ extern void audit_put_tree(struct audit_tree *); ...@@ -137,6 +146,10 @@ extern void audit_put_tree(struct audit_tree *);
extern char *audit_unpack_string(void **, size_t *, size_t); extern char *audit_unpack_string(void **, size_t *, size_t);
extern pid_t audit_sig_pid;
extern uid_t audit_sig_uid;
extern u32 audit_sig_sid;
#ifdef CONFIG_AUDITSYSCALL #ifdef CONFIG_AUDITSYSCALL
extern int __audit_signal_info(int sig, struct task_struct *t); extern int __audit_signal_info(int sig, struct task_struct *t);
static inline int audit_signal_info(int sig, struct task_struct *t) static inline int audit_signal_info(int sig, struct task_struct *t)
......
...@@ -89,14 +89,9 @@ struct list_head audit_filter_list[AUDIT_NR_FILTERS] = { ...@@ -89,14 +89,9 @@ struct list_head audit_filter_list[AUDIT_NR_FILTERS] = {
DEFINE_MUTEX(audit_filter_mutex); DEFINE_MUTEX(audit_filter_mutex);
/* Inotify handle */
extern struct inotify_handle *audit_ih;
/* Inotify events we care about. */ /* Inotify events we care about. */
#define AUDIT_IN_WATCH IN_MOVE|IN_CREATE|IN_DELETE|IN_DELETE_SELF|IN_MOVE_SELF #define AUDIT_IN_WATCH IN_MOVE|IN_CREATE|IN_DELETE|IN_DELETE_SELF|IN_MOVE_SELF
extern int audit_enabled;
void audit_free_parent(struct inotify_watch *i_watch) void audit_free_parent(struct inotify_watch *i_watch)
{ {
struct audit_parent *parent; struct audit_parent *parent;
...@@ -422,7 +417,7 @@ static inline struct audit_entry *audit_to_entry_common(struct audit_rule *rule) ...@@ -422,7 +417,7 @@ static inline struct audit_entry *audit_to_entry_common(struct audit_rule *rule)
static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule) static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
{ {
struct audit_entry *entry; struct audit_entry *entry;
struct audit_field *f; struct audit_field *ino_f;
int err = 0; int err = 0;
int i; int i;
...@@ -483,6 +478,10 @@ static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule) ...@@ -483,6 +478,10 @@ static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
if (f->val & ~15) if (f->val & ~15)
goto exit_free; goto exit_free;
break; break;
case AUDIT_FILETYPE:
if ((f->val & ~S_IFMT) > S_IFMT)
goto exit_free;
break;
case AUDIT_INODE: case AUDIT_INODE:
err = audit_to_inode(&entry->rule, f); err = audit_to_inode(&entry->rule, f);
if (err) if (err)
...@@ -504,9 +503,9 @@ static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule) ...@@ -504,9 +503,9 @@ static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
} }
} }
f = entry->rule.inode_f; ino_f = entry->rule.inode_f;
if (f) { if (ino_f) {
switch(f->op) { switch(ino_f->op) {
case AUDIT_NOT_EQUAL: case AUDIT_NOT_EQUAL:
entry->rule.inode_f = NULL; entry->rule.inode_f = NULL;
case AUDIT_EQUAL: case AUDIT_EQUAL:
...@@ -531,7 +530,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, ...@@ -531,7 +530,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
{ {
int err = 0; int err = 0;
struct audit_entry *entry; struct audit_entry *entry;
struct audit_field *f; struct audit_field *ino_f;
void *bufp; void *bufp;
size_t remain = datasz - sizeof(struct audit_rule_data); size_t remain = datasz - sizeof(struct audit_rule_data);
int i; int i;
...@@ -654,14 +653,18 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, ...@@ -654,14 +653,18 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
if (f->val & ~15) if (f->val & ~15)
goto exit_free; goto exit_free;
break; break;
case AUDIT_FILETYPE:
if ((f->val & ~S_IFMT) > S_IFMT)
goto exit_free;
break;
default: default:
goto exit_free; goto exit_free;
} }
} }
f = entry->rule.inode_f; ino_f = entry->rule.inode_f;
if (f) { if (ino_f) {
switch(f->op) { switch(ino_f->op) {
case AUDIT_NOT_EQUAL: case AUDIT_NOT_EQUAL:
entry->rule.inode_f = NULL; entry->rule.inode_f = NULL;
case AUDIT_EQUAL: case AUDIT_EQUAL:
...@@ -1500,8 +1503,9 @@ static void audit_list_rules(int pid, int seq, struct sk_buff_head *q) ...@@ -1500,8 +1503,9 @@ static void audit_list_rules(int pid, int seq, struct sk_buff_head *q)
} }
/* Log rule additions and removals */ /* Log rule additions and removals */
static void audit_log_rule_change(uid_t loginuid, u32 sid, char *action, static void audit_log_rule_change(uid_t loginuid, u32 sessionid, u32 sid,
struct audit_krule *rule, int res) char *action, struct audit_krule *rule,
int res)
{ {
struct audit_buffer *ab; struct audit_buffer *ab;
...@@ -1511,7 +1515,7 @@ static void audit_log_rule_change(uid_t loginuid, u32 sid, char *action, ...@@ -1511,7 +1515,7 @@ static void audit_log_rule_change(uid_t loginuid, u32 sid, char *action,
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE); ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
if (!ab) if (!ab)
return; return;
audit_log_format(ab, "auid=%u", loginuid); audit_log_format(ab, "auid=%u ses=%u", loginuid, sessionid);
if (sid) { if (sid) {
char *ctx = NULL; char *ctx = NULL;
u32 len; u32 len;
...@@ -1543,7 +1547,7 @@ static void audit_log_rule_change(uid_t loginuid, u32 sid, char *action, ...@@ -1543,7 +1547,7 @@ static void audit_log_rule_change(uid_t loginuid, u32 sid, char *action,
* @sid: SE Linux Security ID of sender * @sid: SE Linux Security ID of sender
*/ */
int audit_receive_filter(int type, int pid, int uid, int seq, void *data, int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
size_t datasz, uid_t loginuid, u32 sid) size_t datasz, uid_t loginuid, u32 sessionid, u32 sid)
{ {
struct task_struct *tsk; struct task_struct *tsk;
struct audit_netlink_list *dest; struct audit_netlink_list *dest;
...@@ -1590,7 +1594,8 @@ int audit_receive_filter(int type, int pid, int uid, int seq, void *data, ...@@ -1590,7 +1594,8 @@ int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
err = audit_add_rule(entry, err = audit_add_rule(entry,
&audit_filter_list[entry->rule.listnr]); &audit_filter_list[entry->rule.listnr]);
audit_log_rule_change(loginuid, sid, "add", &entry->rule, !err); audit_log_rule_change(loginuid, sessionid, sid, "add",
&entry->rule, !err);
if (err) if (err)
audit_free_rule(entry); audit_free_rule(entry);
...@@ -1606,8 +1611,8 @@ int audit_receive_filter(int type, int pid, int uid, int seq, void *data, ...@@ -1606,8 +1611,8 @@ int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
err = audit_del_rule(entry, err = audit_del_rule(entry,
&audit_filter_list[entry->rule.listnr]); &audit_filter_list[entry->rule.listnr]);
audit_log_rule_change(loginuid, sid, "remove", &entry->rule, audit_log_rule_change(loginuid, sessionid, sid, "remove",
!err); &entry->rule, !err);
audit_free_rule(entry); audit_free_rule(entry);
break; break;
......
...@@ -68,9 +68,6 @@ ...@@ -68,9 +68,6 @@
#include "audit.h" #include "audit.h"
extern struct list_head audit_filter_list[];
extern int audit_ever_enabled;
/* AUDIT_NAMES is the number of slots we reserve in the audit_context /* AUDIT_NAMES is the number of slots we reserve in the audit_context
* for saving names from getname(). */ * for saving names from getname(). */
#define AUDIT_NAMES 20 #define AUDIT_NAMES 20
...@@ -283,6 +280,19 @@ static int audit_match_perm(struct audit_context *ctx, int mask) ...@@ -283,6 +280,19 @@ static int audit_match_perm(struct audit_context *ctx, int mask)
} }
} }
static int audit_match_filetype(struct audit_context *ctx, int which)
{
unsigned index = which & ~S_IFMT;
mode_t mode = which & S_IFMT;
if (index >= ctx->name_count)
return 0;
if (ctx->names[index].ino == -1)
return 0;
if ((ctx->names[index].mode ^ mode) & S_IFMT)
return 0;
return 1;
}
/* /*
* We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *; * We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *;
* ->first_trees points to its beginning, ->trees - to the current end of data. * ->first_trees points to its beginning, ->trees - to the current end of data.
...@@ -592,6 +602,9 @@ static int audit_filter_rules(struct task_struct *tsk, ...@@ -592,6 +602,9 @@ static int audit_filter_rules(struct task_struct *tsk,
case AUDIT_PERM: case AUDIT_PERM:
result = audit_match_perm(ctx, f->val); result = audit_match_perm(ctx, f->val);
break; break;
case AUDIT_FILETYPE:
result = audit_match_filetype(ctx, f->val);
break;
} }
if (!result) if (!result)
...@@ -1095,7 +1108,7 @@ static int audit_log_single_execve_arg(struct audit_context *context, ...@@ -1095,7 +1108,7 @@ static int audit_log_single_execve_arg(struct audit_context *context,
audit_log_format(*ab, "[%d]", i); audit_log_format(*ab, "[%d]", i);
audit_log_format(*ab, "="); audit_log_format(*ab, "=");
if (has_cntl) if (has_cntl)
audit_log_hex(*ab, buf, to_send); audit_log_n_hex(*ab, buf, to_send);
else else
audit_log_format(*ab, "\"%s\"", buf); audit_log_format(*ab, "\"%s\"", buf);
audit_log_format(*ab, "\n"); audit_log_format(*ab, "\n");
...@@ -1296,7 +1309,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts ...@@ -1296,7 +1309,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
break; } break; }
case AUDIT_SOCKETCALL: { case AUDIT_SOCKETCALL: {
int i;
struct audit_aux_data_socketcall *axs = (void *)aux; struct audit_aux_data_socketcall *axs = (void *)aux;
audit_log_format(ab, "nargs=%d", axs->nargs); audit_log_format(ab, "nargs=%d", axs->nargs);
for (i=0; i<axs->nargs; i++) for (i=0; i<axs->nargs; i++)
...@@ -1307,7 +1319,7 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts ...@@ -1307,7 +1319,7 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
struct audit_aux_data_sockaddr *axs = (void *)aux; struct audit_aux_data_sockaddr *axs = (void *)aux;
audit_log_format(ab, "saddr="); audit_log_format(ab, "saddr=");
audit_log_hex(ab, axs->a, axs->len); audit_log_n_hex(ab, axs->a, axs->len);
break; } break; }
case AUDIT_FD_PAIR: { case AUDIT_FD_PAIR: {
...@@ -1321,7 +1333,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts ...@@ -1321,7 +1333,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
for (aux = context->aux_pids; aux; aux = aux->next) { for (aux = context->aux_pids; aux; aux = aux->next) {
struct audit_aux_data_pids *axs = (void *)aux; struct audit_aux_data_pids *axs = (void *)aux;
int i;
for (i = 0; i < axs->pid_count; i++) for (i = 0; i < axs->pid_count; i++)
if (audit_log_pid_context(context, axs->target_pid[i], if (audit_log_pid_context(context, axs->target_pid[i],
...@@ -1371,8 +1382,8 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts ...@@ -1371,8 +1382,8 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
default: default:
/* log the name's directory component */ /* log the name's directory component */
audit_log_format(ab, " name="); audit_log_format(ab, " name=");
audit_log_n_untrustedstring(ab, n->name_len, audit_log_n_untrustedstring(ab, n->name,
n->name); n->name_len);
} }
} else } else
audit_log_format(ab, " name=(null)"); audit_log_format(ab, " name=(null)");
...@@ -1596,7 +1607,7 @@ static inline void handle_one(const struct inode *inode) ...@@ -1596,7 +1607,7 @@ static inline void handle_one(const struct inode *inode)
if (likely(put_tree_ref(context, chunk))) if (likely(put_tree_ref(context, chunk)))
return; return;
if (unlikely(!grow_tree_refs(context))) { if (unlikely(!grow_tree_refs(context))) {
printk(KERN_WARNING "out of memory, audit has lost a tree reference"); printk(KERN_WARNING "out of memory, audit has lost a tree reference\n");
audit_set_auditable(context); audit_set_auditable(context);
audit_put_chunk(chunk); audit_put_chunk(chunk);
unroll_tree_refs(context, p, count); unroll_tree_refs(context, p, count);
...@@ -1656,7 +1667,7 @@ static void handle_path(const struct dentry *dentry) ...@@ -1656,7 +1667,7 @@ static void handle_path(const struct dentry *dentry)
} }
/* too bad */ /* too bad */
printk(KERN_WARNING printk(KERN_WARNING
"out of memory, audit has lost a tree reference"); "out of memory, audit has lost a tree reference\n");
unroll_tree_refs(context, p, count); unroll_tree_refs(context, p, count);
audit_set_auditable(context); audit_set_auditable(context);
return; return;
...@@ -1752,13 +1763,13 @@ static int audit_inc_name_count(struct audit_context *context, ...@@ -1752,13 +1763,13 @@ static int audit_inc_name_count(struct audit_context *context,
if (context->name_count >= AUDIT_NAMES) { if (context->name_count >= AUDIT_NAMES) {
if (inode) if (inode)
printk(KERN_DEBUG "name_count maxed, losing inode data: " printk(KERN_DEBUG "name_count maxed, losing inode data: "
"dev=%02x:%02x, inode=%lu", "dev=%02x:%02x, inode=%lu\n",
MAJOR(inode->i_sb->s_dev), MAJOR(inode->i_sb->s_dev),
MINOR(inode->i_sb->s_dev), MINOR(inode->i_sb->s_dev),
inode->i_ino); inode->i_ino);
else else
printk(KERN_DEBUG "name_count maxed, losing inode data"); printk(KERN_DEBUG "name_count maxed, losing inode data\n");
return 1; return 1;
} }
context->name_count++; context->name_count++;
...@@ -2361,9 +2372,6 @@ int __audit_signal_info(int sig, struct task_struct *t) ...@@ -2361,9 +2372,6 @@ int __audit_signal_info(int sig, struct task_struct *t)
struct audit_aux_data_pids *axp; struct audit_aux_data_pids *axp;
struct task_struct *tsk = current; struct task_struct *tsk = current;
struct audit_context *ctx = tsk->audit_context; struct audit_context *ctx = tsk->audit_context;
extern pid_t audit_sig_pid;
extern uid_t audit_sig_uid;
extern u32 audit_sig_sid;
if (audit_pid && t->tgid == audit_pid) { if (audit_pid && t->tgid == audit_pid) {
if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1) { if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1) {
......
...@@ -1498,7 +1498,8 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, ...@@ -1498,7 +1498,8 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
err = xfrm_state_update(x); err = xfrm_state_update(x);
xfrm_audit_state_add(x, err ? 0 : 1, xfrm_audit_state_add(x, err ? 0 : 1,
audit_get_loginuid(current), 0); audit_get_loginuid(current),
audit_get_sessionid(current), 0);
if (err < 0) { if (err < 0) {
x->km.state = XFRM_STATE_DEAD; x->km.state = XFRM_STATE_DEAD;
...@@ -1552,7 +1553,8 @@ static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h ...@@ -1552,7 +1553,8 @@ static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
km_state_notify(x, &c); km_state_notify(x, &c);
out: out:
xfrm_audit_state_delete(x, err ? 0 : 1, xfrm_audit_state_delete(x, err ? 0 : 1,
audit_get_loginuid(current), 0); audit_get_loginuid(current),
audit_get_sessionid(current), 0);
xfrm_state_put(x); xfrm_state_put(x);
return err; return err;
...@@ -1728,6 +1730,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hd ...@@ -1728,6 +1730,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hd
return -EINVAL; return -EINVAL;
audit_info.loginuid = audit_get_loginuid(current); audit_info.loginuid = audit_get_loginuid(current);
audit_info.sessionid = audit_get_sessionid(current);
audit_info.secid = 0; audit_info.secid = 0;
err = xfrm_state_flush(proto, &audit_info); err = xfrm_state_flush(proto, &audit_info);
if (err) if (err)
...@@ -2324,7 +2327,8 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h ...@@ -2324,7 +2327,8 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
hdr->sadb_msg_type != SADB_X_SPDUPDATE); hdr->sadb_msg_type != SADB_X_SPDUPDATE);
xfrm_audit_policy_add(xp, err ? 0 : 1, xfrm_audit_policy_add(xp, err ? 0 : 1,
audit_get_loginuid(current), 0); audit_get_loginuid(current),
audit_get_sessionid(current), 0);
if (err) if (err)
goto out; goto out;
...@@ -2406,7 +2410,8 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg ...@@ -2406,7 +2410,8 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
return -ENOENT; return -ENOENT;
xfrm_audit_policy_delete(xp, err ? 0 : 1, xfrm_audit_policy_delete(xp, err ? 0 : 1,
audit_get_loginuid(current), 0); audit_get_loginuid(current),
audit_get_sessionid(current), 0);
if (err) if (err)
goto out; goto out;
...@@ -2667,7 +2672,8 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h ...@@ -2667,7 +2672,8 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
if (delete) { if (delete) {
xfrm_audit_policy_delete(xp, err ? 0 : 1, xfrm_audit_policy_delete(xp, err ? 0 : 1,
audit_get_loginuid(current), 0); audit_get_loginuid(current),
audit_get_sessionid(current), 0);
if (err) if (err)
goto out; goto out;
...@@ -2767,6 +2773,7 @@ static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, struct sadb_msg ...@@ -2767,6 +2773,7 @@ static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, struct sadb_msg
int err; int err;
audit_info.loginuid = audit_get_loginuid(current); audit_info.loginuid = audit_get_loginuid(current);
audit_info.sessionid = audit_get_sessionid(current);
audit_info.secid = 0; audit_info.secid = 0;
err = xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN, &audit_info); err = xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN, &audit_info);
if (err) if (err)
......
...@@ -1780,6 +1780,7 @@ int __init netlbl_unlabel_defconf(void) ...@@ -1780,6 +1780,7 @@ int __init netlbl_unlabel_defconf(void)
* messages so don't worry to much about these values. */ * messages so don't worry to much about these values. */
security_task_getsecid(current, &audit_info.secid); security_task_getsecid(current, &audit_info.secid);
audit_info.loginuid = 0; audit_info.loginuid = 0;
audit_info.sessionid = 0;
entry = kzalloc(sizeof(*entry), GFP_KERNEL); entry = kzalloc(sizeof(*entry), GFP_KERNEL);
if (entry == NULL) if (entry == NULL)
......
...@@ -107,7 +107,9 @@ struct audit_buffer *netlbl_audit_start_common(int type, ...@@ -107,7 +107,9 @@ struct audit_buffer *netlbl_audit_start_common(int type,
if (audit_buf == NULL) if (audit_buf == NULL)
return NULL; return NULL;
audit_log_format(audit_buf, "netlabel: auid=%u", audit_info->loginuid); audit_log_format(audit_buf, "netlabel: auid=%u ses=%u",
audit_info->loginuid,
audit_info->sessionid);
if (audit_info->secid != 0 && if (audit_info->secid != 0 &&
security_secid_to_secctx(audit_info->secid, security_secid_to_secctx(audit_info->secid,
......
...@@ -51,6 +51,7 @@ static inline void netlbl_netlink_auditinfo(struct sk_buff *skb, ...@@ -51,6 +51,7 @@ static inline void netlbl_netlink_auditinfo(struct sk_buff *skb,
{ {
audit_info->secid = NETLINK_CB(skb).sid; audit_info->secid = NETLINK_CB(skb).sid;
audit_info->loginuid = NETLINK_CB(skb).loginuid; audit_info->loginuid = NETLINK_CB(skb).loginuid;
audit_info->sessionid = NETLINK_CB(skb).sessionid;
} }
/* NetLabel NETLINK I/O functions */ /* NetLabel NETLINK I/O functions */
......
...@@ -1248,6 +1248,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, ...@@ -1248,6 +1248,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
NETLINK_CB(skb).pid = nlk->pid; NETLINK_CB(skb).pid = nlk->pid;
NETLINK_CB(skb).dst_group = dst_group; NETLINK_CB(skb).dst_group = dst_group;
NETLINK_CB(skb).loginuid = audit_get_loginuid(current); NETLINK_CB(skb).loginuid = audit_get_loginuid(current);
NETLINK_CB(skb).sessionid = audit_get_sessionid(current);
security_task_getsecid(current, &(NETLINK_CB(skb).sid)); security_task_getsecid(current, &(NETLINK_CB(skb).sid));
memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred)); memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
......
...@@ -762,6 +762,7 @@ xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info) ...@@ -762,6 +762,7 @@ xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info)
if (err) { if (err) {
xfrm_audit_policy_delete(pol, 0, xfrm_audit_policy_delete(pol, 0,
audit_info->loginuid, audit_info->loginuid,
audit_info->sessionid,
audit_info->secid); audit_info->secid);
return err; return err;
} }
...@@ -777,6 +778,7 @@ xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info) ...@@ -777,6 +778,7 @@ xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info)
if (err) { if (err) {
xfrm_audit_policy_delete(pol, 0, xfrm_audit_policy_delete(pol, 0,
audit_info->loginuid, audit_info->loginuid,
audit_info->sessionid,
audit_info->secid); audit_info->secid);
return err; return err;
} }
...@@ -819,6 +821,7 @@ int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info) ...@@ -819,6 +821,7 @@ int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info)
write_unlock_bh(&xfrm_policy_lock); write_unlock_bh(&xfrm_policy_lock);
xfrm_audit_policy_delete(pol, 1, audit_info->loginuid, xfrm_audit_policy_delete(pol, 1, audit_info->loginuid,
audit_info->sessionid,
audit_info->secid); audit_info->secid);
xfrm_policy_kill(pol); xfrm_policy_kill(pol);
...@@ -841,6 +844,7 @@ int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info) ...@@ -841,6 +844,7 @@ int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info)
xfrm_audit_policy_delete(pol, 1, xfrm_audit_policy_delete(pol, 1,
audit_info->loginuid, audit_info->loginuid,
audit_info->sessionid,
audit_info->secid); audit_info->secid);
xfrm_policy_kill(pol); xfrm_policy_kill(pol);
killed++; killed++;
...@@ -2472,14 +2476,14 @@ static void xfrm_audit_common_policyinfo(struct xfrm_policy *xp, ...@@ -2472,14 +2476,14 @@ static void xfrm_audit_common_policyinfo(struct xfrm_policy *xp,
} }
void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
u32 auid, u32 secid) uid_t auid, u32 sessionid, u32 secid)
{ {
struct audit_buffer *audit_buf; struct audit_buffer *audit_buf;
audit_buf = xfrm_audit_start("SPD-add"); audit_buf = xfrm_audit_start("SPD-add");
if (audit_buf == NULL) if (audit_buf == NULL)
return; return;
xfrm_audit_helper_usrinfo(auid, secid, audit_buf); xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
audit_log_format(audit_buf, " res=%u", result); audit_log_format(audit_buf, " res=%u", result);
xfrm_audit_common_policyinfo(xp, audit_buf); xfrm_audit_common_policyinfo(xp, audit_buf);
audit_log_end(audit_buf); audit_log_end(audit_buf);
...@@ -2487,14 +2491,14 @@ void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, ...@@ -2487,14 +2491,14 @@ void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
EXPORT_SYMBOL_GPL(xfrm_audit_policy_add); EXPORT_SYMBOL_GPL(xfrm_audit_policy_add);
void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
u32 auid, u32 secid) uid_t auid, u32 sessionid, u32 secid)
{ {
struct audit_buffer *audit_buf; struct audit_buffer *audit_buf;
audit_buf = xfrm_audit_start("SPD-delete"); audit_buf = xfrm_audit_start("SPD-delete");
if (audit_buf == NULL) if (audit_buf == NULL)
return; return;
xfrm_audit_helper_usrinfo(auid, secid, audit_buf); xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
audit_log_format(audit_buf, " res=%u", result); audit_log_format(audit_buf, " res=%u", result);
xfrm_audit_common_policyinfo(xp, audit_buf); xfrm_audit_common_policyinfo(xp, audit_buf);
audit_log_end(audit_buf); audit_log_end(audit_buf);
......
...@@ -496,7 +496,8 @@ static void xfrm_timer_handler(unsigned long data) ...@@ -496,7 +496,8 @@ static void xfrm_timer_handler(unsigned long data)
km_state_expired(x, 1, 0); km_state_expired(x, 1, 0);
xfrm_audit_state_delete(x, err ? 0 : 1, xfrm_audit_state_delete(x, err ? 0 : 1,
audit_get_loginuid(current), 0); audit_get_loginuid(current),
audit_get_sessionid(current), 0);
out: out:
spin_unlock(&x->lock); spin_unlock(&x->lock);
...@@ -603,6 +604,7 @@ xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info) ...@@ -603,6 +604,7 @@ xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
(err = security_xfrm_state_delete(x)) != 0) { (err = security_xfrm_state_delete(x)) != 0) {
xfrm_audit_state_delete(x, 0, xfrm_audit_state_delete(x, 0,
audit_info->loginuid, audit_info->loginuid,
audit_info->sessionid,
audit_info->secid); audit_info->secid);
return err; return err;
} }
...@@ -641,6 +643,7 @@ int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info) ...@@ -641,6 +643,7 @@ int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
err = xfrm_state_delete(x); err = xfrm_state_delete(x);
xfrm_audit_state_delete(x, err ? 0 : 1, xfrm_audit_state_delete(x, err ? 0 : 1,
audit_info->loginuid, audit_info->loginuid,
audit_info->sessionid,
audit_info->secid); audit_info->secid);
xfrm_state_put(x); xfrm_state_put(x);
...@@ -2123,14 +2126,14 @@ static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family, ...@@ -2123,14 +2126,14 @@ static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
} }
void xfrm_audit_state_add(struct xfrm_state *x, int result, void xfrm_audit_state_add(struct xfrm_state *x, int result,
u32 auid, u32 secid) uid_t auid, u32 sessionid, u32 secid)
{ {
struct audit_buffer *audit_buf; struct audit_buffer *audit_buf;
audit_buf = xfrm_audit_start("SAD-add"); audit_buf = xfrm_audit_start("SAD-add");
if (audit_buf == NULL) if (audit_buf == NULL)
return; return;
xfrm_audit_helper_usrinfo(auid, secid, audit_buf); xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
xfrm_audit_helper_sainfo(x, audit_buf); xfrm_audit_helper_sainfo(x, audit_buf);
audit_log_format(audit_buf, " res=%u", result); audit_log_format(audit_buf, " res=%u", result);
audit_log_end(audit_buf); audit_log_end(audit_buf);
...@@ -2138,14 +2141,14 @@ void xfrm_audit_state_add(struct xfrm_state *x, int result, ...@@ -2138,14 +2141,14 @@ void xfrm_audit_state_add(struct xfrm_state *x, int result,
EXPORT_SYMBOL_GPL(xfrm_audit_state_add); EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
void xfrm_audit_state_delete(struct xfrm_state *x, int result, void xfrm_audit_state_delete(struct xfrm_state *x, int result,
u32 auid, u32 secid) uid_t auid, u32 sessionid, u32 secid)
{ {
struct audit_buffer *audit_buf; struct audit_buffer *audit_buf;
audit_buf = xfrm_audit_start("SAD-delete"); audit_buf = xfrm_audit_start("SAD-delete");
if (audit_buf == NULL) if (audit_buf == NULL)
return; return;
xfrm_audit_helper_usrinfo(auid, secid, audit_buf); xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf);
xfrm_audit_helper_sainfo(x, audit_buf); xfrm_audit_helper_sainfo(x, audit_buf);
audit_log_format(audit_buf, " res=%u", result); audit_log_format(audit_buf, " res=%u", result);
audit_log_end(audit_buf); audit_log_end(audit_buf);
......
...@@ -407,6 +407,9 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -407,6 +407,9 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
struct xfrm_state *x; struct xfrm_state *x;
int err; int err;
struct km_event c; struct km_event c;
uid_t loginuid = NETLINK_CB(skb).loginuid;
u32 sessionid = NETLINK_CB(skb).sessionid;
u32 sid = NETLINK_CB(skb).sid;
err = verify_newsa_info(p, attrs); err = verify_newsa_info(p, attrs);
if (err) if (err)
...@@ -422,8 +425,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -422,8 +425,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
else else
err = xfrm_state_update(x); err = xfrm_state_update(x);
xfrm_audit_state_add(x, err ? 0 : 1, NETLINK_CB(skb).loginuid, xfrm_audit_state_add(x, err ? 0 : 1, loginuid, sessionid, sid);
NETLINK_CB(skb).sid);
if (err < 0) { if (err < 0) {
x->km.state = XFRM_STATE_DEAD; x->km.state = XFRM_STATE_DEAD;
...@@ -478,6 +480,9 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -478,6 +480,9 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
int err = -ESRCH; int err = -ESRCH;
struct km_event c; struct km_event c;
struct xfrm_usersa_id *p = nlmsg_data(nlh); struct xfrm_usersa_id *p = nlmsg_data(nlh);
uid_t loginuid = NETLINK_CB(skb).loginuid;
u32 sessionid = NETLINK_CB(skb).sessionid;
u32 sid = NETLINK_CB(skb).sid;
x = xfrm_user_state_lookup(p, attrs, &err); x = xfrm_user_state_lookup(p, attrs, &err);
if (x == NULL) if (x == NULL)
...@@ -502,8 +507,7 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -502,8 +507,7 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
km_state_notify(x, &c); km_state_notify(x, &c);
out: out:
xfrm_audit_state_delete(x, err ? 0 : 1, NETLINK_CB(skb).loginuid, xfrm_audit_state_delete(x, err ? 0 : 1, loginuid, sessionid, sid);
NETLINK_CB(skb).sid);
xfrm_state_put(x); xfrm_state_put(x);
return err; return err;
} }
...@@ -1123,6 +1127,9 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -1123,6 +1127,9 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
struct km_event c; struct km_event c;
int err; int err;
int excl; int excl;
uid_t loginuid = NETLINK_CB(skb).loginuid;
u32 sessionid = NETLINK_CB(skb).sessionid;
u32 sid = NETLINK_CB(skb).sid;
err = verify_newpolicy_info(p); err = verify_newpolicy_info(p);
if (err) if (err)
...@@ -1141,8 +1148,7 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -1141,8 +1148,7 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
* a type XFRM_MSG_UPDPOLICY - JHS */ * a type XFRM_MSG_UPDPOLICY - JHS */
excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY; excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
err = xfrm_policy_insert(p->dir, xp, excl); err = xfrm_policy_insert(p->dir, xp, excl);
xfrm_audit_policy_add(xp, err ? 0 : 1, NETLINK_CB(skb).loginuid, xfrm_audit_policy_add(xp, err ? 0 : 1, loginuid, sessionid, sid);
NETLINK_CB(skb).sid);
if (err) { if (err) {
security_xfrm_policy_free(xp->security); security_xfrm_policy_free(xp->security);
...@@ -1371,9 +1377,12 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -1371,9 +1377,12 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
NETLINK_CB(skb).pid); NETLINK_CB(skb).pid);
} }
} else { } else {
xfrm_audit_policy_delete(xp, err ? 0 : 1, uid_t loginuid = NETLINK_CB(skb).loginuid;
NETLINK_CB(skb).loginuid, u32 sessionid = NETLINK_CB(skb).sessionid;
NETLINK_CB(skb).sid); u32 sid = NETLINK_CB(skb).sid;
xfrm_audit_policy_delete(xp, err ? 0 : 1, loginuid, sessionid,
sid);
if (err != 0) if (err != 0)
goto out; goto out;
...@@ -1399,6 +1408,7 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -1399,6 +1408,7 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
int err; int err;
audit_info.loginuid = NETLINK_CB(skb).loginuid; audit_info.loginuid = NETLINK_CB(skb).loginuid;
audit_info.sessionid = NETLINK_CB(skb).sessionid;
audit_info.secid = NETLINK_CB(skb).sid; audit_info.secid = NETLINK_CB(skb).sid;
err = xfrm_state_flush(p->proto, &audit_info); err = xfrm_state_flush(p->proto, &audit_info);
if (err) if (err)
...@@ -1546,6 +1556,7 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -1546,6 +1556,7 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
return err; return err;
audit_info.loginuid = NETLINK_CB(skb).loginuid; audit_info.loginuid = NETLINK_CB(skb).loginuid;
audit_info.sessionid = NETLINK_CB(skb).sessionid;
audit_info.secid = NETLINK_CB(skb).sid; audit_info.secid = NETLINK_CB(skb).sid;
err = xfrm_policy_flush(type, &audit_info); err = xfrm_policy_flush(type, &audit_info);
if (err) if (err)
...@@ -1604,9 +1615,11 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -1604,9 +1615,11 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
read_unlock(&xp->lock); read_unlock(&xp->lock);
err = 0; err = 0;
if (up->hard) { if (up->hard) {
uid_t loginuid = NETLINK_CB(skb).loginuid;
uid_t sessionid = NETLINK_CB(skb).sessionid;
u32 sid = NETLINK_CB(skb).sid;
xfrm_policy_delete(xp, p->dir); xfrm_policy_delete(xp, p->dir);
xfrm_audit_policy_delete(xp, 1, NETLINK_CB(skb).loginuid, xfrm_audit_policy_delete(xp, 1, loginuid, sessionid, sid);
NETLINK_CB(skb).sid);
} else { } else {
// reset the timers here? // reset the timers here?
...@@ -1640,9 +1653,11 @@ static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -1640,9 +1653,11 @@ static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
km_state_expired(x, ue->hard, current->pid); km_state_expired(x, ue->hard, current->pid);
if (ue->hard) { if (ue->hard) {
uid_t loginuid = NETLINK_CB(skb).loginuid;
uid_t sessionid = NETLINK_CB(skb).sessionid;
u32 sid = NETLINK_CB(skb).sid;
__xfrm_state_delete(x); __xfrm_state_delete(x);
xfrm_audit_state_delete(x, 1, NETLINK_CB(skb).loginuid, xfrm_audit_state_delete(x, 1, loginuid, sessionid, sid);
NETLINK_CB(skb).sid);
} }
err = 0; err = 0;
out: out:
......
...@@ -646,7 +646,7 @@ void avc_audit(u32 ssid, u32 tsid, ...@@ -646,7 +646,7 @@ void avc_audit(u32 ssid, u32 tsid,
if (*p) if (*p)
audit_log_untrustedstring(ab, p); audit_log_untrustedstring(ab, p);
else else
audit_log_hex(ab, p, len); audit_log_n_hex(ab, p, len);
break; break;
} }
} }
......
...@@ -324,6 +324,7 @@ static void smk_cipso_doi(void) ...@@ -324,6 +324,7 @@ static void smk_cipso_doi(void)
struct netlbl_audit audit_info; struct netlbl_audit audit_info;
audit_info.loginuid = audit_get_loginuid(current); audit_info.loginuid = audit_get_loginuid(current);
audit_info.sessionid = audit_get_sessionid(current);
audit_info.secid = smack_to_secid(current->security); audit_info.secid = smack_to_secid(current->security);
rc = netlbl_cfg_map_del(NULL, &audit_info); rc = netlbl_cfg_map_del(NULL, &audit_info);
...@@ -356,6 +357,7 @@ static void smk_unlbl_ambient(char *oldambient) ...@@ -356,6 +357,7 @@ static void smk_unlbl_ambient(char *oldambient)
struct netlbl_audit audit_info; struct netlbl_audit audit_info;
audit_info.loginuid = audit_get_loginuid(current); audit_info.loginuid = audit_get_loginuid(current);
audit_info.sessionid = audit_get_sessionid(current);
audit_info.secid = smack_to_secid(current->security); audit_info.secid = smack_to_secid(current->security);
if (oldambient != NULL) { if (oldambient != NULL) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment