]>
Commit | Line | Data |
---|---|---|
1 | /* audit -- definition of audit_context structure and supporting types | |
2 | * | |
3 | * Copyright 2003-2004 Red Hat, Inc. | |
4 | * Copyright 2005 Hewlett-Packard Development Company, L.P. | |
5 | * Copyright 2005 IBM Corporation | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or modify | |
8 | * it under the terms of the GNU General Public License as published by | |
9 | * the Free Software Foundation; either version 2 of the License, or | |
10 | * (at your option) any later version. | |
11 | * | |
12 | * This program is distributed in the hope that it will be useful, | |
13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
15 | * GNU General Public License for more details. | |
16 | * | |
17 | * You should have received a copy of the GNU General Public License | |
18 | * along with this program; if not, write to the Free Software | |
19 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA | |
20 | */ | |
21 | ||
22 | #include <linux/fs.h> | |
23 | #include <linux/audit.h> | |
24 | #include <linux/skbuff.h> | |
25 | ||
26 | /* 0 = no checking | |
27 | 1 = put_count checking | |
28 | 2 = verbose put_count checking | |
29 | */ | |
30 | #define AUDIT_DEBUG 0 | |
31 | ||
32 | /* At task start time, the audit_state is set in the audit_context using | |
33 | a per-task filter. At syscall entry, the audit_state is augmented by | |
34 | the syscall filter. */ | |
35 | enum audit_state { | |
36 | AUDIT_DISABLED, /* Do not create per-task audit_context. | |
37 | * No syscall-specific audit records can | |
38 | * be generated. */ | |
39 | AUDIT_SETUP_CONTEXT, /* Create the per-task audit_context, | |
40 | * but don't necessarily fill it in at | |
41 | * syscall entry time (i.e., filter | |
42 | * instead). */ | |
43 | AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context, | |
44 | * and always fill it in at syscall | |
45 | * entry time. This makes a full | |
46 | * syscall record available if some | |
47 | * other part of the kernel decides it | |
48 | * should be recorded. */ | |
49 | AUDIT_RECORD_CONTEXT /* Create the per-task audit_context, | |
50 | * always fill it in at syscall entry | |
51 | * time, and always write out the audit | |
52 | * record at syscall exit time. */ | |
53 | }; | |
54 | ||
55 | /* Rule lists */ | |
56 | struct audit_watch; | |
57 | struct audit_tree; | |
58 | struct audit_chunk; | |
59 | ||
60 | struct audit_entry { | |
61 | struct list_head list; | |
62 | struct rcu_head rcu; | |
63 | struct audit_krule rule; | |
64 | }; | |
65 | ||
66 | #ifdef CONFIG_AUDIT | |
67 | extern int audit_enabled; | |
68 | extern int audit_ever_enabled; | |
69 | #endif | |
70 | ||
71 | extern int audit_pid; | |
72 | ||
73 | #define AUDIT_INODE_BUCKETS 32 | |
74 | extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; | |
75 | ||
76 | static inline int audit_hash_ino(u32 ino) | |
77 | { | |
78 | return (ino & (AUDIT_INODE_BUCKETS-1)); | |
79 | } | |
80 | ||
81 | extern int audit_match_class(int class, unsigned syscall); | |
82 | extern int audit_comparator(const u32 left, const u32 op, const u32 right); | |
83 | extern int audit_compare_dname_path(const char *dname, const char *path, | |
84 | int *dirlen); | |
85 | extern struct sk_buff * audit_make_reply(int pid, int seq, int type, | |
86 | int done, int multi, | |
87 | const void *payload, int size); | |
88 | extern void audit_panic(const char *message); | |
89 | ||
90 | struct audit_netlink_list { | |
91 | int pid; | |
92 | struct sk_buff_head q; | |
93 | }; | |
94 | ||
95 | int audit_send_list(void *); | |
96 | ||
97 | extern int selinux_audit_rule_update(void); | |
98 | ||
99 | extern struct mutex audit_filter_mutex; | |
100 | extern void audit_free_rule_rcu(struct rcu_head *); | |
101 | extern struct list_head audit_filter_list[]; | |
102 | ||
103 | extern struct audit_entry *audit_dupe_rule(struct audit_krule *old); | |
104 | ||
105 | /* audit watch functions */ | |
106 | #ifdef CONFIG_AUDIT_WATCH | |
107 | extern void audit_put_watch(struct audit_watch *watch); | |
108 | extern void audit_get_watch(struct audit_watch *watch); | |
109 | extern int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op); | |
110 | extern int audit_add_watch(struct audit_krule *krule, struct list_head **list); | |
111 | extern void audit_remove_watch_rule(struct audit_krule *krule); | |
112 | extern char *audit_watch_path(struct audit_watch *watch); | |
113 | extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev); | |
114 | #else | |
115 | #define audit_put_watch(w) {} | |
116 | #define audit_get_watch(w) {} | |
117 | #define audit_to_watch(k, p, l, o) (-EINVAL) | |
118 | #define audit_add_watch(k, l) (-EINVAL) | |
119 | #define audit_remove_watch_rule(k) BUG() | |
120 | #define audit_watch_path(w) "" | |
121 | #define audit_watch_compare(w, i, d) 0 | |
122 | ||
123 | #endif /* CONFIG_AUDIT_WATCH */ | |
124 | ||
125 | #ifdef CONFIG_AUDIT_TREE | |
126 | extern struct audit_chunk *audit_tree_lookup(const struct inode *); | |
127 | extern void audit_put_chunk(struct audit_chunk *); | |
128 | extern int audit_tree_match(struct audit_chunk *, struct audit_tree *); | |
129 | extern int audit_make_tree(struct audit_krule *, char *, u32); | |
130 | extern int audit_add_tree_rule(struct audit_krule *); | |
131 | extern int audit_remove_tree_rule(struct audit_krule *); | |
132 | extern void audit_trim_trees(void); | |
133 | extern int audit_tag_tree(char *old, char *new); | |
134 | extern const char *audit_tree_path(struct audit_tree *); | |
135 | extern void audit_put_tree(struct audit_tree *); | |
136 | extern void audit_kill_trees(struct list_head *); | |
137 | #else | |
138 | #define audit_remove_tree_rule(rule) BUG() | |
139 | #define audit_add_tree_rule(rule) -EINVAL | |
140 | #define audit_make_tree(rule, str, op) -EINVAL | |
141 | #define audit_trim_trees() (void)0 | |
142 | #define audit_put_tree(tree) (void)0 | |
143 | #define audit_tag_tree(old, new) -EINVAL | |
144 | #define audit_tree_path(rule) "" /* never called */ | |
145 | #define audit_kill_trees(list) BUG() | |
146 | #endif | |
147 | ||
148 | extern char *audit_unpack_string(void **, size_t *, size_t); | |
149 | ||
150 | extern pid_t audit_sig_pid; | |
151 | extern uid_t audit_sig_uid; | |
152 | extern u32 audit_sig_sid; | |
153 | ||
154 | #ifdef CONFIG_AUDITSYSCALL | |
155 | extern int __audit_signal_info(int sig, struct task_struct *t); | |
156 | static inline int audit_signal_info(int sig, struct task_struct *t) | |
157 | { | |
158 | if (unlikely((audit_pid && t->tgid == audit_pid) || | |
159 | (audit_signals && !audit_dummy_context()))) | |
160 | return __audit_signal_info(sig, t); | |
161 | return 0; | |
162 | } | |
163 | extern void audit_filter_inodes(struct task_struct *, struct audit_context *); | |
164 | extern struct list_head *audit_killed_trees(void); | |
165 | #else | |
166 | #define audit_signal_info(s,t) AUDIT_DISABLED | |
167 | #define audit_filter_inodes(t,c) AUDIT_DISABLED | |
168 | #endif | |
169 | ||
170 | extern struct mutex audit_cmd_mutex; |