1 /* SPDX-License-Identifier: GPL-2.0-or-later */
2 /* audit.h -- Auditing support
4 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
7 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
9 #ifndef _LINUX_AUDIT_H_
10 #define _LINUX_AUDIT_H_
12 #include <linux/sched.h>
13 #include <linux/ptrace.h>
14 #include <uapi/linux/audit.h>
15 #include <uapi/linux/netfilter/nf_tables.h>
17 #define AUDIT_INO_UNSET ((unsigned long)-1)
18 #define AUDIT_DEV_UNSET ((dev_t)-1)
20 struct audit_sig_info
{
29 struct netlink_skb_parms
;
43 u32 mask
[AUDIT_BITMASK_SIZE
];
44 u32 buflen
; /* for data alloc on list rules */
46 char *filterkey
; /* ties events to rules */
47 struct audit_field
*fields
;
48 struct audit_field
*arch_f
; /* quick access to arch field */
49 struct audit_field
*inode_f
; /* quick access to an inode field */
50 struct audit_watch
*watch
; /* associated watch */
51 struct audit_tree
*tree
; /* associated watched tree */
52 struct audit_fsnotify_mark
*exe
;
53 struct list_head rlist
; /* entry in audit_{watch,tree}.rules list */
54 struct list_head list
; /* for AUDIT_LIST* purposes only */
58 /* Flag to indicate legacy AUDIT_LOGINUID unset usage */
59 #define AUDIT_LOGINUID_LEGACY 0x1
83 AUDIT_NTP_NVALS
/* count */
86 #ifdef CONFIG_AUDITSYSCALL
87 struct audit_ntp_val
{
88 long long oldval
, newval
;
91 struct audit_ntp_data
{
92 struct audit_ntp_val vals
[AUDIT_NTP_NVALS
];
95 struct audit_ntp_data
{};
101 AUDIT_XT_OP_UNREGISTER
,
102 AUDIT_NFT_OP_TABLE_REGISTER
,
103 AUDIT_NFT_OP_TABLE_UNREGISTER
,
104 AUDIT_NFT_OP_CHAIN_REGISTER
,
105 AUDIT_NFT_OP_CHAIN_UNREGISTER
,
106 AUDIT_NFT_OP_RULE_REGISTER
,
107 AUDIT_NFT_OP_RULE_UNREGISTER
,
108 AUDIT_NFT_OP_SET_REGISTER
,
109 AUDIT_NFT_OP_SET_UNREGISTER
,
110 AUDIT_NFT_OP_SETELEM_REGISTER
,
111 AUDIT_NFT_OP_SETELEM_UNREGISTER
,
112 AUDIT_NFT_OP_GEN_REGISTER
,
113 AUDIT_NFT_OP_OBJ_REGISTER
,
114 AUDIT_NFT_OP_OBJ_UNREGISTER
,
115 AUDIT_NFT_OP_OBJ_RESET
,
116 AUDIT_NFT_OP_FLOWTABLE_REGISTER
,
117 AUDIT_NFT_OP_FLOWTABLE_UNREGISTER
,
118 AUDIT_NFT_OP_INVALID
,
121 extern int is_audit_feature_set(int which
);
123 extern int __init
audit_register_class(int class, unsigned *list
);
124 extern int audit_classify_syscall(int abi
, unsigned syscall
);
125 extern int audit_classify_arch(int arch
);
126 /* only for compat system calls */
127 extern unsigned compat_write_class
[];
128 extern unsigned compat_read_class
[];
129 extern unsigned compat_dir_class
[];
130 extern unsigned compat_chattr_class
[];
131 extern unsigned compat_signal_class
[];
133 extern int audit_classify_compat_syscall(int abi
, unsigned syscall
);
135 /* audit_names->type values */
136 #define AUDIT_TYPE_UNKNOWN 0 /* we don't know yet */
137 #define AUDIT_TYPE_NORMAL 1 /* a "normal" audit record */
138 #define AUDIT_TYPE_PARENT 2 /* a parent audit record */
139 #define AUDIT_TYPE_CHILD_DELETE 3 /* a child being deleted */
140 #define AUDIT_TYPE_CHILD_CREATE 4 /* a child being created */
142 /* maximized args number that audit_socketcall can process */
143 #define AUDITSC_ARGS 6
145 /* bit values for ->signal->audit_tty */
146 #define AUDIT_TTY_ENABLE BIT(0)
147 #define AUDIT_TTY_LOG_PASSWD BIT(1)
153 #define AUDIT_LOCKED 2
155 /* These are defined in audit.c */
157 extern __printf(4, 5)
158 void audit_log(struct audit_context
*ctx
, gfp_t gfp_mask
, int type
,
159 const char *fmt
, ...);
161 extern struct audit_buffer
*audit_log_start(struct audit_context
*ctx
, gfp_t gfp_mask
, int type
);
162 extern __printf(2, 3)
163 void audit_log_format(struct audit_buffer
*ab
, const char *fmt
, ...);
164 extern void audit_log_end(struct audit_buffer
*ab
);
165 extern bool audit_string_contains_control(const char *string
,
167 extern void audit_log_n_hex(struct audit_buffer
*ab
,
168 const unsigned char *buf
,
170 extern void audit_log_n_string(struct audit_buffer
*ab
,
173 extern void audit_log_n_untrustedstring(struct audit_buffer
*ab
,
176 extern void audit_log_untrustedstring(struct audit_buffer
*ab
,
178 extern void audit_log_d_path(struct audit_buffer
*ab
,
180 const struct path
*path
);
181 extern void audit_log_key(struct audit_buffer
*ab
,
183 extern void audit_log_path_denied(int type
,
184 const char *operation
);
185 extern void audit_log_lost(const char *message
);
187 extern int audit_log_task_context(struct audit_buffer
*ab
);
188 extern void audit_log_task_info(struct audit_buffer
*ab
);
190 extern int audit_update_lsm_rules(void);
192 /* Private API (for audit.c only) */
193 extern int audit_rule_change(int type
, int seq
, void *data
, size_t datasz
);
194 extern int audit_list_rules_send(struct sk_buff
*request_skb
, int seq
);
196 extern int audit_set_loginuid(kuid_t loginuid
);
198 static inline kuid_t
audit_get_loginuid(struct task_struct
*tsk
)
200 return tsk
->loginuid
;
203 static inline unsigned int audit_get_sessionid(struct task_struct
*tsk
)
205 return tsk
->sessionid
;
208 extern u32 audit_enabled
;
210 extern int audit_signal_info(int sig
, struct task_struct
*t
);
212 #else /* CONFIG_AUDIT */
213 static inline __printf(4, 5)
214 void audit_log(struct audit_context
*ctx
, gfp_t gfp_mask
, int type
,
215 const char *fmt
, ...)
217 static inline struct audit_buffer
*audit_log_start(struct audit_context
*ctx
,
218 gfp_t gfp_mask
, int type
)
222 static inline __printf(2, 3)
223 void audit_log_format(struct audit_buffer
*ab
, const char *fmt
, ...)
225 static inline void audit_log_end(struct audit_buffer
*ab
)
227 static inline void audit_log_n_hex(struct audit_buffer
*ab
,
228 const unsigned char *buf
, size_t len
)
230 static inline void audit_log_n_string(struct audit_buffer
*ab
,
231 const char *buf
, size_t n
)
233 static inline void audit_log_n_untrustedstring(struct audit_buffer
*ab
,
234 const char *string
, size_t n
)
236 static inline void audit_log_untrustedstring(struct audit_buffer
*ab
,
239 static inline void audit_log_d_path(struct audit_buffer
*ab
,
241 const struct path
*path
)
243 static inline void audit_log_key(struct audit_buffer
*ab
, char *key
)
245 static inline void audit_log_path_denied(int type
, const char *operation
)
247 static inline int audit_log_task_context(struct audit_buffer
*ab
)
251 static inline void audit_log_task_info(struct audit_buffer
*ab
)
254 static inline kuid_t
audit_get_loginuid(struct task_struct
*tsk
)
259 static inline unsigned int audit_get_sessionid(struct task_struct
*tsk
)
261 return AUDIT_SID_UNSET
;
264 #define audit_enabled AUDIT_OFF
266 static inline int audit_signal_info(int sig
, struct task_struct
*t
)
271 #endif /* CONFIG_AUDIT */
273 #ifdef CONFIG_AUDIT_COMPAT_GENERIC
274 #define audit_is_compat(arch) (!((arch) & __AUDIT_ARCH_64BIT))
276 #define audit_is_compat(arch) false
279 #define AUDIT_INODE_PARENT 1 /* dentry represents the parent */
280 #define AUDIT_INODE_HIDDEN 2 /* audit record should be hidden */
281 #define AUDIT_INODE_NOEVAL 4 /* audit record incomplete */
283 #ifdef CONFIG_AUDITSYSCALL
284 #include <asm/syscall.h> /* for syscall_get_arch() */
286 /* These are defined in auditsc.c */
288 extern int audit_alloc(struct task_struct
*task
);
289 extern void __audit_free(struct task_struct
*task
);
290 extern void __audit_syscall_entry(int major
, unsigned long a0
, unsigned long a1
,
291 unsigned long a2
, unsigned long a3
);
292 extern void __audit_syscall_exit(int ret_success
, long ret_value
);
293 extern struct filename
*__audit_reusename(const __user
char *uptr
);
294 extern void __audit_getname(struct filename
*name
);
295 extern void __audit_inode(struct filename
*name
, const struct dentry
*dentry
,
297 extern void __audit_file(const struct file
*);
298 extern void __audit_inode_child(struct inode
*parent
,
299 const struct dentry
*dentry
,
300 const unsigned char type
);
301 extern void audit_seccomp(unsigned long syscall
, long signr
, int code
);
302 extern void audit_seccomp_actions_logged(const char *names
,
303 const char *old_names
, int res
);
304 extern void __audit_ptrace(struct task_struct
*t
);
306 static inline void audit_set_context(struct task_struct
*task
, struct audit_context
*ctx
)
308 task
->audit_context
= ctx
;
311 static inline struct audit_context
*audit_context(void)
313 return current
->audit_context
;
316 static inline bool audit_dummy_context(void)
318 void *p
= audit_context();
319 return !p
|| *(int *)p
;
321 static inline void audit_free(struct task_struct
*task
)
323 if (unlikely(task
->audit_context
))
326 static inline void audit_syscall_entry(int major
, unsigned long a0
,
327 unsigned long a1
, unsigned long a2
,
330 if (unlikely(audit_context()))
331 __audit_syscall_entry(major
, a0
, a1
, a2
, a3
);
333 static inline void audit_syscall_exit(void *pt_regs
)
335 if (unlikely(audit_context())) {
336 int success
= is_syscall_success(pt_regs
);
337 long return_code
= regs_return_value(pt_regs
);
339 __audit_syscall_exit(success
, return_code
);
342 static inline struct filename
*audit_reusename(const __user
char *name
)
344 if (unlikely(!audit_dummy_context()))
345 return __audit_reusename(name
);
348 static inline void audit_getname(struct filename
*name
)
350 if (unlikely(!audit_dummy_context()))
351 __audit_getname(name
);
353 static inline void audit_inode(struct filename
*name
,
354 const struct dentry
*dentry
,
355 unsigned int aflags
) {
356 if (unlikely(!audit_dummy_context()))
357 __audit_inode(name
, dentry
, aflags
);
359 static inline void audit_file(struct file
*file
)
361 if (unlikely(!audit_dummy_context()))
364 static inline void audit_inode_parent_hidden(struct filename
*name
,
365 const struct dentry
*dentry
)
367 if (unlikely(!audit_dummy_context()))
368 __audit_inode(name
, dentry
,
369 AUDIT_INODE_PARENT
| AUDIT_INODE_HIDDEN
);
371 static inline void audit_inode_child(struct inode
*parent
,
372 const struct dentry
*dentry
,
373 const unsigned char type
) {
374 if (unlikely(!audit_dummy_context()))
375 __audit_inode_child(parent
, dentry
, type
);
377 void audit_core_dumps(long signr
);
379 static inline void audit_ptrace(struct task_struct
*t
)
381 if (unlikely(!audit_dummy_context()))
385 /* Private API (for audit.c only) */
386 extern void __audit_ipc_obj(struct kern_ipc_perm
*ipcp
);
387 extern void __audit_ipc_set_perm(unsigned long qbytes
, uid_t uid
, gid_t gid
, umode_t mode
);
388 extern void __audit_bprm(struct linux_binprm
*bprm
);
389 extern int __audit_socketcall(int nargs
, unsigned long *args
);
390 extern int __audit_sockaddr(int len
, void *addr
);
391 extern void __audit_fd_pair(int fd1
, int fd2
);
392 extern void __audit_mq_open(int oflag
, umode_t mode
, struct mq_attr
*attr
);
393 extern void __audit_mq_sendrecv(mqd_t mqdes
, size_t msg_len
, unsigned int msg_prio
, const struct timespec64
*abs_timeout
);
394 extern void __audit_mq_notify(mqd_t mqdes
, const struct sigevent
*notification
);
395 extern void __audit_mq_getsetattr(mqd_t mqdes
, struct mq_attr
*mqstat
);
396 extern int __audit_log_bprm_fcaps(struct linux_binprm
*bprm
,
397 const struct cred
*new,
398 const struct cred
*old
);
399 extern void __audit_log_capset(const struct cred
*new, const struct cred
*old
);
400 extern void __audit_mmap_fd(int fd
, int flags
);
401 extern void __audit_log_kern_module(char *name
);
402 extern void __audit_fanotify(unsigned int response
);
403 extern void __audit_tk_injoffset(struct timespec64 offset
);
404 extern void __audit_ntp_log(const struct audit_ntp_data
*ad
);
405 extern void __audit_log_nfcfg(const char *name
, u8 af
, unsigned int nentries
,
406 enum audit_nfcfgop op
, gfp_t gfp
);
408 static inline void audit_ipc_obj(struct kern_ipc_perm
*ipcp
)
410 if (unlikely(!audit_dummy_context()))
411 __audit_ipc_obj(ipcp
);
413 static inline void audit_fd_pair(int fd1
, int fd2
)
415 if (unlikely(!audit_dummy_context()))
416 __audit_fd_pair(fd1
, fd2
);
418 static inline void audit_ipc_set_perm(unsigned long qbytes
, uid_t uid
, gid_t gid
, umode_t mode
)
420 if (unlikely(!audit_dummy_context()))
421 __audit_ipc_set_perm(qbytes
, uid
, gid
, mode
);
423 static inline void audit_bprm(struct linux_binprm
*bprm
)
425 if (unlikely(!audit_dummy_context()))
428 static inline int audit_socketcall(int nargs
, unsigned long *args
)
430 if (unlikely(!audit_dummy_context()))
431 return __audit_socketcall(nargs
, args
);
435 static inline int audit_socketcall_compat(int nargs
, u32
*args
)
437 unsigned long a
[AUDITSC_ARGS
];
440 if (audit_dummy_context())
443 for (i
= 0; i
< nargs
; i
++)
444 a
[i
] = (unsigned long)args
[i
];
445 return __audit_socketcall(nargs
, a
);
448 static inline int audit_sockaddr(int len
, void *addr
)
450 if (unlikely(!audit_dummy_context()))
451 return __audit_sockaddr(len
, addr
);
454 static inline void audit_mq_open(int oflag
, umode_t mode
, struct mq_attr
*attr
)
456 if (unlikely(!audit_dummy_context()))
457 __audit_mq_open(oflag
, mode
, attr
);
459 static inline void audit_mq_sendrecv(mqd_t mqdes
, size_t msg_len
, unsigned int msg_prio
, const struct timespec64
*abs_timeout
)
461 if (unlikely(!audit_dummy_context()))
462 __audit_mq_sendrecv(mqdes
, msg_len
, msg_prio
, abs_timeout
);
464 static inline void audit_mq_notify(mqd_t mqdes
, const struct sigevent
*notification
)
466 if (unlikely(!audit_dummy_context()))
467 __audit_mq_notify(mqdes
, notification
);
469 static inline void audit_mq_getsetattr(mqd_t mqdes
, struct mq_attr
*mqstat
)
471 if (unlikely(!audit_dummy_context()))
472 __audit_mq_getsetattr(mqdes
, mqstat
);
475 static inline int audit_log_bprm_fcaps(struct linux_binprm
*bprm
,
476 const struct cred
*new,
477 const struct cred
*old
)
479 if (unlikely(!audit_dummy_context()))
480 return __audit_log_bprm_fcaps(bprm
, new, old
);
484 static inline void audit_log_capset(const struct cred
*new,
485 const struct cred
*old
)
487 if (unlikely(!audit_dummy_context()))
488 __audit_log_capset(new, old
);
491 static inline void audit_mmap_fd(int fd
, int flags
)
493 if (unlikely(!audit_dummy_context()))
494 __audit_mmap_fd(fd
, flags
);
497 static inline void audit_log_kern_module(char *name
)
499 if (!audit_dummy_context())
500 __audit_log_kern_module(name
);
503 static inline void audit_fanotify(unsigned int response
)
505 if (!audit_dummy_context())
506 __audit_fanotify(response
);
509 static inline void audit_tk_injoffset(struct timespec64 offset
)
511 /* ignore no-op events */
512 if (offset
.tv_sec
== 0 && offset
.tv_nsec
== 0)
515 if (!audit_dummy_context())
516 __audit_tk_injoffset(offset
);
519 static inline void audit_ntp_init(struct audit_ntp_data
*ad
)
521 memset(ad
, 0, sizeof(*ad
));
524 static inline void audit_ntp_set_old(struct audit_ntp_data
*ad
,
525 enum audit_ntp_type type
, long long val
)
527 ad
->vals
[type
].oldval
= val
;
530 static inline void audit_ntp_set_new(struct audit_ntp_data
*ad
,
531 enum audit_ntp_type type
, long long val
)
533 ad
->vals
[type
].newval
= val
;
536 static inline void audit_ntp_log(const struct audit_ntp_data
*ad
)
538 if (!audit_dummy_context())
542 static inline void audit_log_nfcfg(const char *name
, u8 af
,
543 unsigned int nentries
,
544 enum audit_nfcfgop op
, gfp_t gfp
)
547 __audit_log_nfcfg(name
, af
, nentries
, op
, gfp
);
550 extern int audit_n_rules
;
551 extern int audit_signals
;
552 #else /* CONFIG_AUDITSYSCALL */
553 static inline int audit_alloc(struct task_struct
*task
)
557 static inline void audit_free(struct task_struct
*task
)
559 static inline void audit_syscall_entry(int major
, unsigned long a0
,
560 unsigned long a1
, unsigned long a2
,
563 static inline void audit_syscall_exit(void *pt_regs
)
565 static inline bool audit_dummy_context(void)
569 static inline void audit_set_context(struct task_struct
*task
, struct audit_context
*ctx
)
571 static inline struct audit_context
*audit_context(void)
575 static inline struct filename
*audit_reusename(const __user
char *name
)
579 static inline void audit_getname(struct filename
*name
)
581 static inline void audit_inode(struct filename
*name
,
582 const struct dentry
*dentry
,
585 static inline void audit_file(struct file
*file
)
588 static inline void audit_inode_parent_hidden(struct filename
*name
,
589 const struct dentry
*dentry
)
591 static inline void audit_inode_child(struct inode
*parent
,
592 const struct dentry
*dentry
,
593 const unsigned char type
)
595 static inline void audit_core_dumps(long signr
)
597 static inline void audit_seccomp(unsigned long syscall
, long signr
, int code
)
599 static inline void audit_seccomp_actions_logged(const char *names
,
600 const char *old_names
, int res
)
602 static inline void audit_ipc_obj(struct kern_ipc_perm
*ipcp
)
604 static inline void audit_ipc_set_perm(unsigned long qbytes
, uid_t uid
,
605 gid_t gid
, umode_t mode
)
607 static inline void audit_bprm(struct linux_binprm
*bprm
)
609 static inline int audit_socketcall(int nargs
, unsigned long *args
)
614 static inline int audit_socketcall_compat(int nargs
, u32
*args
)
619 static inline void audit_fd_pair(int fd1
, int fd2
)
621 static inline int audit_sockaddr(int len
, void *addr
)
625 static inline void audit_mq_open(int oflag
, umode_t mode
, struct mq_attr
*attr
)
627 static inline void audit_mq_sendrecv(mqd_t mqdes
, size_t msg_len
,
628 unsigned int msg_prio
,
629 const struct timespec64
*abs_timeout
)
631 static inline void audit_mq_notify(mqd_t mqdes
,
632 const struct sigevent
*notification
)
634 static inline void audit_mq_getsetattr(mqd_t mqdes
, struct mq_attr
*mqstat
)
636 static inline int audit_log_bprm_fcaps(struct linux_binprm
*bprm
,
637 const struct cred
*new,
638 const struct cred
*old
)
642 static inline void audit_log_capset(const struct cred
*new,
643 const struct cred
*old
)
645 static inline void audit_mmap_fd(int fd
, int flags
)
648 static inline void audit_log_kern_module(char *name
)
652 static inline void audit_fanotify(unsigned int response
)
655 static inline void audit_tk_injoffset(struct timespec64 offset
)
658 static inline void audit_ntp_init(struct audit_ntp_data
*ad
)
661 static inline void audit_ntp_set_old(struct audit_ntp_data
*ad
,
662 enum audit_ntp_type type
, long long val
)
665 static inline void audit_ntp_set_new(struct audit_ntp_data
*ad
,
666 enum audit_ntp_type type
, long long val
)
669 static inline void audit_ntp_log(const struct audit_ntp_data
*ad
)
672 static inline void audit_ptrace(struct task_struct
*t
)
675 static inline void audit_log_nfcfg(const char *name
, u8 af
,
676 unsigned int nentries
,
677 enum audit_nfcfgop op
, gfp_t gfp
)
680 #define audit_n_rules 0
681 #define audit_signals 0
682 #endif /* CONFIG_AUDITSYSCALL */
684 static inline bool audit_loginuid_set(struct task_struct
*tsk
)
686 return uid_valid(audit_get_loginuid(tsk
));