1 /* audit.h -- Auditing support
3 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
23 #ifndef _LINUX_AUDIT_H_
24 #define _LINUX_AUDIT_H_
26 #include <linux/sched.h>
27 #include <linux/ptrace.h>
28 #include <uapi/linux/audit.h>
30 struct audit_sig_info {
39 struct netlink_skb_parms;
52 u32 mask[AUDIT_BITMASK_SIZE];
53 u32 buflen; /* for data alloc on list rules */
55 char *filterkey; /* ties events to rules */
56 struct audit_field *fields;
57 struct audit_field *arch_f; /* quick access to arch field */
58 struct audit_field *inode_f; /* quick access to an inode field */
59 struct audit_watch *watch; /* associated watch */
60 struct audit_tree *tree; /* associated watched tree */
61 struct list_head rlist; /* entry in audit_{watch,tree}.rules list */
62 struct list_head list; /* for AUDIT_LIST* purposes only */
76 extern int is_audit_feature_set(int which);
78 extern int __init audit_register_class(int class, unsigned *list);
79 extern int audit_classify_syscall(int abi, unsigned syscall);
80 extern int audit_classify_arch(int arch);
82 /* audit_names->type values */
83 #define AUDIT_TYPE_UNKNOWN 0 /* we don't know yet */
84 #define AUDIT_TYPE_NORMAL 1 /* a "normal" audit record */
85 #define AUDIT_TYPE_PARENT 2 /* a parent audit record */
86 #define AUDIT_TYPE_CHILD_DELETE 3 /* a child being deleted */
87 #define AUDIT_TYPE_CHILD_CREATE 4 /* a child being created */
89 /* maximized args number that audit_socketcall can process */
90 #define AUDITSC_ARGS 6
94 extern void audit_log_session_info(struct audit_buffer *ab);
96 #ifdef CONFIG_AUDITSYSCALL
97 /* These are defined in auditsc.c */
99 extern int audit_alloc(struct task_struct *task);
100 extern void __audit_free(struct task_struct *task);
101 extern void __audit_syscall_entry(int arch,
102 int major, unsigned long a0, unsigned long a1,
103 unsigned long a2, unsigned long a3);
104 extern void __audit_syscall_exit(int ret_success, long ret_value);
105 extern struct filename *__audit_reusename(const __user char *uptr);
106 extern void __audit_getname(struct filename *name);
107 extern void audit_putname(struct filename *name);
109 #define AUDIT_INODE_PARENT 1 /* dentry represents the parent */
110 #define AUDIT_INODE_HIDDEN 2 /* audit record should be hidden */
111 extern void __audit_inode(struct filename *name, const struct dentry *dentry,
113 extern void __audit_inode_child(const struct inode *parent,
114 const struct dentry *dentry,
115 const unsigned char type);
116 extern void __audit_seccomp(unsigned long syscall, long signr, int code);
117 extern void __audit_ptrace(struct task_struct *t);
119 static inline int audit_dummy_context(void)
121 void *p = current->audit_context;
122 return !p || *(int *)p;
124 static inline void audit_free(struct task_struct *task)
126 if (unlikely(task->audit_context))
129 static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
130 unsigned long a1, unsigned long a2,
133 if (unlikely(current->audit_context))
134 __audit_syscall_entry(arch, major, a0, a1, a2, a3);
136 static inline void audit_syscall_exit(void *pt_regs)
138 if (unlikely(current->audit_context)) {
139 int success = is_syscall_success(pt_regs);
140 int return_code = regs_return_value(pt_regs);
142 __audit_syscall_exit(success, return_code);
145 static inline struct filename *audit_reusename(const __user char *name)
147 if (unlikely(!audit_dummy_context()))
148 return __audit_reusename(name);
151 static inline void audit_getname(struct filename *name)
153 if (unlikely(!audit_dummy_context()))
154 __audit_getname(name);
156 static inline void audit_inode(struct filename *name,
157 const struct dentry *dentry,
158 unsigned int parent) {
159 if (unlikely(!audit_dummy_context())) {
160 unsigned int flags = 0;
162 flags |= AUDIT_INODE_PARENT;
163 __audit_inode(name, dentry, flags);
166 static inline void audit_inode_parent_hidden(struct filename *name,
167 const struct dentry *dentry)
169 if (unlikely(!audit_dummy_context()))
170 __audit_inode(name, dentry,
171 AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN);
173 static inline void audit_inode_child(const struct inode *parent,
174 const struct dentry *dentry,
175 const unsigned char type) {
176 if (unlikely(!audit_dummy_context()))
177 __audit_inode_child(parent, dentry, type);
179 void audit_core_dumps(long signr);
181 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
183 /* Force a record to be reported if a signal was delivered. */
184 if (signr || unlikely(!audit_dummy_context()))
185 __audit_seccomp(syscall, signr, code);
188 static inline void audit_ptrace(struct task_struct *t)
190 if (unlikely(!audit_dummy_context()))
194 /* Private API (for audit.c only) */
195 extern unsigned int audit_serial(void);
196 extern int auditsc_get_stamp(struct audit_context *ctx,
197 struct timespec *t, unsigned int *serial);
198 extern int audit_set_loginuid(kuid_t loginuid);
200 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
202 return tsk->loginuid;
205 static inline int audit_get_sessionid(struct task_struct *tsk)
207 return tsk->sessionid;
210 extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);
211 extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode);
212 extern int __audit_bprm(struct linux_binprm *bprm);
213 extern int __audit_socketcall(int nargs, unsigned long *args);
214 extern int __audit_sockaddr(int len, void *addr);
215 extern void __audit_fd_pair(int fd1, int fd2);
216 extern void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr);
217 extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout);
218 extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification);
219 extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat);
220 extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
221 const struct cred *new,
222 const struct cred *old);
223 extern void __audit_log_capset(pid_t pid, const struct cred *new, const struct cred *old);
224 extern void __audit_mmap_fd(int fd, int flags);
226 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
228 if (unlikely(!audit_dummy_context()))
229 __audit_ipc_obj(ipcp);
231 static inline void audit_fd_pair(int fd1, int fd2)
233 if (unlikely(!audit_dummy_context()))
234 __audit_fd_pair(fd1, fd2);
236 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode)
238 if (unlikely(!audit_dummy_context()))
239 __audit_ipc_set_perm(qbytes, uid, gid, mode);
241 static inline int audit_bprm(struct linux_binprm *bprm)
243 if (unlikely(!audit_dummy_context()))
244 return __audit_bprm(bprm);
247 static inline int audit_socketcall(int nargs, unsigned long *args)
249 if (unlikely(!audit_dummy_context()))
250 return __audit_socketcall(nargs, args);
253 static inline int audit_sockaddr(int len, void *addr)
255 if (unlikely(!audit_dummy_context()))
256 return __audit_sockaddr(len, addr);
259 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
261 if (unlikely(!audit_dummy_context()))
262 __audit_mq_open(oflag, mode, attr);
264 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout)
266 if (unlikely(!audit_dummy_context()))
267 __audit_mq_sendrecv(mqdes, msg_len, msg_prio, abs_timeout);
269 static inline void audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
271 if (unlikely(!audit_dummy_context()))
272 __audit_mq_notify(mqdes, notification);
274 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
276 if (unlikely(!audit_dummy_context()))
277 __audit_mq_getsetattr(mqdes, mqstat);
280 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
281 const struct cred *new,
282 const struct cred *old)
284 if (unlikely(!audit_dummy_context()))
285 return __audit_log_bprm_fcaps(bprm, new, old);
289 static inline void audit_log_capset(pid_t pid, const struct cred *new,
290 const struct cred *old)
292 if (unlikely(!audit_dummy_context()))
293 __audit_log_capset(pid, new, old);
296 static inline void audit_mmap_fd(int fd, int flags)
298 if (unlikely(!audit_dummy_context()))
299 __audit_mmap_fd(fd, flags);
302 extern int audit_n_rules;
303 extern int audit_signals;
304 #else /* CONFIG_AUDITSYSCALL */
305 static inline int audit_alloc(struct task_struct *task)
309 static inline void audit_free(struct task_struct *task)
311 static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
312 unsigned long a1, unsigned long a2,
315 static inline void audit_syscall_exit(void *pt_regs)
317 static inline int audit_dummy_context(void)
321 static inline struct filename *audit_reusename(const __user char *name)
325 static inline void audit_getname(struct filename *name)
327 static inline void audit_putname(struct filename *name)
329 static inline void __audit_inode(struct filename *name,
330 const struct dentry *dentry,
333 static inline void __audit_inode_child(const struct inode *parent,
334 const struct dentry *dentry,
335 const unsigned char type)
337 static inline void audit_inode(struct filename *name,
338 const struct dentry *dentry,
341 static inline void audit_inode_parent_hidden(struct filename *name,
342 const struct dentry *dentry)
344 static inline void audit_inode_child(const struct inode *parent,
345 const struct dentry *dentry,
346 const unsigned char type)
348 static inline void audit_core_dumps(long signr)
350 static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
352 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
354 static inline int auditsc_get_stamp(struct audit_context *ctx,
355 struct timespec *t, unsigned int *serial)
359 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
363 static inline int audit_get_sessionid(struct task_struct *tsk)
367 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
369 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,
370 gid_t gid, umode_t mode)
372 static inline int audit_bprm(struct linux_binprm *bprm)
376 static inline int audit_socketcall(int nargs, unsigned long *args)
380 static inline void audit_fd_pair(int fd1, int fd2)
382 static inline int audit_sockaddr(int len, void *addr)
386 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
388 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len,
389 unsigned int msg_prio,
390 const struct timespec *abs_timeout)
392 static inline void audit_mq_notify(mqd_t mqdes,
393 const struct sigevent *notification)
395 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
397 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
398 const struct cred *new,
399 const struct cred *old)
403 static inline void audit_log_capset(pid_t pid, const struct cred *new,
404 const struct cred *old)
406 static inline void audit_mmap_fd(int fd, int flags)
408 static inline void audit_ptrace(struct task_struct *t)
410 #define audit_n_rules 0
411 #define audit_signals 0
412 #endif /* CONFIG_AUDITSYSCALL */
414 static inline bool audit_loginuid_set(struct task_struct *tsk)
416 return uid_valid(audit_get_loginuid(tsk));
420 /* These are defined in audit.c */
422 extern __printf(4, 5)
423 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
424 const char *fmt, ...);
426 extern struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type);
427 extern __printf(2, 3)
428 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...);
429 extern void audit_log_end(struct audit_buffer *ab);
430 extern int audit_string_contains_control(const char *string,
432 extern void audit_log_n_hex(struct audit_buffer *ab,
433 const unsigned char *buf,
435 extern void audit_log_n_string(struct audit_buffer *ab,
438 extern void audit_log_n_untrustedstring(struct audit_buffer *ab,
441 extern void audit_log_untrustedstring(struct audit_buffer *ab,
443 extern void audit_log_d_path(struct audit_buffer *ab,
445 const struct path *path);
446 extern void audit_log_key(struct audit_buffer *ab,
448 extern void audit_log_link_denied(const char *operation,
450 extern void audit_log_lost(const char *message);
451 #ifdef CONFIG_SECURITY
452 extern void audit_log_secctx(struct audit_buffer *ab, u32 secid);
454 static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid)
458 extern int audit_log_task_context(struct audit_buffer *ab);
459 extern void audit_log_task_info(struct audit_buffer *ab,
460 struct task_struct *tsk);
462 extern int audit_update_lsm_rules(void);
464 /* Private API (for audit.c only) */
465 extern int audit_filter_user(int type);
466 extern int audit_filter_type(int type);
467 extern int audit_receive_filter(int type, int pid, int seq,
468 void *data, size_t datasz);
469 extern int audit_enabled;
470 #else /* CONFIG_AUDIT */
471 static inline __printf(4, 5)
472 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
473 const char *fmt, ...)
475 static inline struct audit_buffer *audit_log_start(struct audit_context *ctx,
476 gfp_t gfp_mask, int type)
480 static inline __printf(2, 3)
481 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
483 static inline void audit_log_end(struct audit_buffer *ab)
485 static inline void audit_log_n_hex(struct audit_buffer *ab,
486 const unsigned char *buf, size_t len)
488 static inline void audit_log_n_string(struct audit_buffer *ab,
489 const char *buf, size_t n)
491 static inline void audit_log_n_untrustedstring(struct audit_buffer *ab,
492 const char *string, size_t n)
494 static inline void audit_log_untrustedstring(struct audit_buffer *ab,
497 static inline void audit_log_d_path(struct audit_buffer *ab,
499 const struct path *path)
501 static inline void audit_log_key(struct audit_buffer *ab, char *key)
503 static inline void audit_log_link_denied(const char *string,
504 const struct path *link)
506 static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid)
508 static inline int audit_log_task_context(struct audit_buffer *ab)
512 static inline void audit_log_task_info(struct audit_buffer *ab,
513 struct task_struct *tsk)
515 #define audit_enabled 0
516 #endif /* CONFIG_AUDIT */
517 static inline void audit_log_string(struct audit_buffer *ab, const char *buf)
519 audit_log_n_string(ab, buf, strlen(buf));