1 /* audit.h -- Auditing support
3 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
23 #ifndef _LINUX_AUDIT_H_
24 #define _LINUX_AUDIT_H_
26 #include <linux/sched.h>
27 #include <uapi/linux/audit.h>
29 struct audit_sig_info {
38 struct netlink_skb_parms;
51 u32 mask[AUDIT_BITMASK_SIZE];
52 u32 buflen; /* for data alloc on list rules */
54 char *filterkey; /* ties events to rules */
55 struct audit_field *fields;
56 struct audit_field *arch_f; /* quick access to arch field */
57 struct audit_field *inode_f; /* quick access to an inode field */
58 struct audit_watch *watch; /* associated watch */
59 struct audit_tree *tree; /* associated watched tree */
60 struct list_head rlist; /* entry in audit_{watch,tree}.rules list */
61 struct list_head list; /* for AUDIT_LIST* purposes only */
75 extern int __init audit_register_class(int class, unsigned *list);
76 extern int audit_classify_syscall(int abi, unsigned syscall);
77 extern int audit_classify_arch(int arch);
79 /* audit_names->type values */
80 #define AUDIT_TYPE_UNKNOWN 0 /* we don't know yet */
81 #define AUDIT_TYPE_NORMAL 1 /* a "normal" audit record */
82 #define AUDIT_TYPE_PARENT 2 /* a parent audit record */
83 #define AUDIT_TYPE_CHILD_DELETE 3 /* a child being deleted */
84 #define AUDIT_TYPE_CHILD_CREATE 4 /* a child being created */
88 #ifdef CONFIG_AUDITSYSCALL
89 /* These are defined in auditsc.c */
91 extern int audit_alloc(struct task_struct *task);
92 extern void __audit_free(struct task_struct *task);
93 extern void __audit_syscall_entry(int arch,
94 int major, unsigned long a0, unsigned long a1,
95 unsigned long a2, unsigned long a3);
96 extern void __audit_syscall_exit(int ret_success, long ret_value);
97 extern struct filename *__audit_reusename(const __user char *uptr);
98 extern void __audit_getname(struct filename *name);
99 extern void audit_putname(struct filename *name);
100 extern void __audit_inode(struct filename *name, const struct dentry *dentry,
101 unsigned int parent);
102 extern void __audit_inode_child(const struct inode *parent,
103 const struct dentry *dentry,
104 const unsigned char type);
105 extern void __audit_seccomp(unsigned long syscall, long signr, int code);
106 extern void __audit_ptrace(struct task_struct *t);
108 static inline int audit_dummy_context(void)
110 void *p = current->audit_context;
111 return !p || *(int *)p;
113 static inline void audit_free(struct task_struct *task)
115 if (unlikely(task->audit_context))
118 static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
119 unsigned long a1, unsigned long a2,
122 if (unlikely(!audit_dummy_context()))
123 __audit_syscall_entry(arch, major, a0, a1, a2, a3);
125 static inline void audit_syscall_exit(void *pt_regs)
127 if (unlikely(current->audit_context)) {
128 int success = is_syscall_success(pt_regs);
129 int return_code = regs_return_value(pt_regs);
131 __audit_syscall_exit(success, return_code);
134 static inline struct filename *audit_reusename(const __user char *name)
136 if (unlikely(!audit_dummy_context()))
137 return __audit_reusename(name);
140 static inline void audit_getname(struct filename *name)
142 if (unlikely(!audit_dummy_context()))
143 __audit_getname(name);
145 static inline void audit_inode(struct filename *name, const struct dentry *dentry,
146 unsigned int parent) {
147 if (unlikely(!audit_dummy_context()))
148 __audit_inode(name, dentry, parent);
150 static inline void audit_inode_child(const struct inode *parent,
151 const struct dentry *dentry,
152 const unsigned char type) {
153 if (unlikely(!audit_dummy_context()))
154 __audit_inode_child(parent, dentry, type);
156 void audit_core_dumps(long signr);
158 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
160 /* Force a record to be reported if a signal was delivered. */
161 if (signr || unlikely(!audit_dummy_context()))
162 __audit_seccomp(syscall, signr, code);
165 static inline void audit_ptrace(struct task_struct *t)
167 if (unlikely(!audit_dummy_context()))
171 /* Private API (for audit.c only) */
172 extern unsigned int audit_serial(void);
173 extern int auditsc_get_stamp(struct audit_context *ctx,
174 struct timespec *t, unsigned int *serial);
175 extern int audit_set_loginuid(kuid_t loginuid);
177 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
179 return tsk->loginuid;
182 static inline int audit_get_sessionid(struct task_struct *tsk)
184 return tsk->sessionid;
187 extern void audit_log_task_context(struct audit_buffer *ab);
188 extern void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk);
189 extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);
190 extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode);
191 extern int __audit_bprm(struct linux_binprm *bprm);
192 extern void __audit_socketcall(int nargs, unsigned long *args);
193 extern int __audit_sockaddr(int len, void *addr);
194 extern void __audit_fd_pair(int fd1, int fd2);
195 extern void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr);
196 extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout);
197 extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification);
198 extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat);
199 extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
200 const struct cred *new,
201 const struct cred *old);
202 extern void __audit_log_capset(pid_t pid, const struct cred *new, const struct cred *old);
203 extern void __audit_mmap_fd(int fd, int flags);
205 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
207 if (unlikely(!audit_dummy_context()))
208 __audit_ipc_obj(ipcp);
210 static inline void audit_fd_pair(int fd1, int fd2)
212 if (unlikely(!audit_dummy_context()))
213 __audit_fd_pair(fd1, fd2);
215 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode)
217 if (unlikely(!audit_dummy_context()))
218 __audit_ipc_set_perm(qbytes, uid, gid, mode);
220 static inline int audit_bprm(struct linux_binprm *bprm)
222 if (unlikely(!audit_dummy_context()))
223 return __audit_bprm(bprm);
226 static inline void audit_socketcall(int nargs, unsigned long *args)
228 if (unlikely(!audit_dummy_context()))
229 __audit_socketcall(nargs, args);
231 static inline int audit_sockaddr(int len, void *addr)
233 if (unlikely(!audit_dummy_context()))
234 return __audit_sockaddr(len, addr);
237 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
239 if (unlikely(!audit_dummy_context()))
240 __audit_mq_open(oflag, mode, attr);
242 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout)
244 if (unlikely(!audit_dummy_context()))
245 __audit_mq_sendrecv(mqdes, msg_len, msg_prio, abs_timeout);
247 static inline void audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
249 if (unlikely(!audit_dummy_context()))
250 __audit_mq_notify(mqdes, notification);
252 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
254 if (unlikely(!audit_dummy_context()))
255 __audit_mq_getsetattr(mqdes, mqstat);
258 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
259 const struct cred *new,
260 const struct cred *old)
262 if (unlikely(!audit_dummy_context()))
263 return __audit_log_bprm_fcaps(bprm, new, old);
267 static inline void audit_log_capset(pid_t pid, const struct cred *new,
268 const struct cred *old)
270 if (unlikely(!audit_dummy_context()))
271 __audit_log_capset(pid, new, old);
274 static inline void audit_mmap_fd(int fd, int flags)
276 if (unlikely(!audit_dummy_context()))
277 __audit_mmap_fd(fd, flags);
280 extern int audit_n_rules;
281 extern int audit_signals;
282 #else /* CONFIG_AUDITSYSCALL */
283 static inline int audit_alloc(struct task_struct *task)
287 static inline void audit_free(struct task_struct *task)
289 static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
290 unsigned long a1, unsigned long a2,
293 static inline void audit_syscall_exit(void *pt_regs)
295 static inline int audit_dummy_context(void)
299 static inline struct filename *audit_reusename(const __user char *name)
303 static inline void audit_getname(struct filename *name)
305 static inline void audit_putname(struct filename *name)
307 static inline void __audit_inode(struct filename *name,
308 const struct dentry *dentry,
311 static inline void __audit_inode_child(const struct inode *parent,
312 const struct dentry *dentry,
313 const unsigned char type)
315 static inline void audit_inode(struct filename *name,
316 const struct dentry *dentry,
319 static inline void audit_inode_child(const struct inode *parent,
320 const struct dentry *dentry,
321 const unsigned char type)
323 static inline void audit_core_dumps(long signr)
325 static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
327 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
329 static inline int auditsc_get_stamp(struct audit_context *ctx,
330 struct timespec *t, unsigned int *serial)
334 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
338 static inline int audit_get_sessionid(struct task_struct *tsk)
342 static inline void audit_log_task_context(struct audit_buffer *ab)
344 static inline void audit_log_task_info(struct audit_buffer *ab,
345 struct task_struct *tsk)
347 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
349 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,
350 gid_t gid, umode_t mode)
352 static inline int audit_bprm(struct linux_binprm *bprm)
356 static inline void audit_socketcall(int nargs, unsigned long *args)
358 static inline void audit_fd_pair(int fd1, int fd2)
360 static inline int audit_sockaddr(int len, void *addr)
364 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
366 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len,
367 unsigned int msg_prio,
368 const struct timespec *abs_timeout)
370 static inline void audit_mq_notify(mqd_t mqdes,
371 const struct sigevent *notification)
373 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
375 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
376 const struct cred *new,
377 const struct cred *old)
381 static inline void audit_log_capset(pid_t pid, const struct cred *new,
382 const struct cred *old)
384 static inline void audit_mmap_fd(int fd, int flags)
386 static inline void audit_ptrace(struct task_struct *t)
388 #define audit_n_rules 0
389 #define audit_signals 0
390 #endif /* CONFIG_AUDITSYSCALL */
393 /* These are defined in audit.c */
395 extern __printf(4, 5)
396 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
397 const char *fmt, ...);
399 extern struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type);
400 extern __printf(2, 3)
401 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...);
402 extern void audit_log_end(struct audit_buffer *ab);
403 extern int audit_string_contains_control(const char *string,
405 extern void audit_log_n_hex(struct audit_buffer *ab,
406 const unsigned char *buf,
408 extern void audit_log_n_string(struct audit_buffer *ab,
411 extern void audit_log_n_untrustedstring(struct audit_buffer *ab,
414 extern void audit_log_untrustedstring(struct audit_buffer *ab,
416 extern void audit_log_d_path(struct audit_buffer *ab,
418 const struct path *path);
419 extern void audit_log_key(struct audit_buffer *ab,
421 extern void audit_log_link_denied(const char *operation,
423 extern void audit_log_lost(const char *message);
424 #ifdef CONFIG_SECURITY
425 extern void audit_log_secctx(struct audit_buffer *ab, u32 secid);
427 static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid)
431 extern int audit_update_lsm_rules(void);
433 /* Private API (for audit.c only) */
434 extern int audit_filter_user(void);
435 extern int audit_filter_type(int type);
436 extern int audit_receive_filter(int type, int pid, int seq,
437 void *data, size_t datasz, kuid_t loginuid,
438 u32 sessionid, u32 sid);
439 extern int audit_enabled;
440 #else /* CONFIG_AUDIT */
441 static inline __printf(4, 5)
442 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
443 const char *fmt, ...)
445 static inline struct audit_buffer *audit_log_start(struct audit_context *ctx,
446 gfp_t gfp_mask, int type)
450 static inline __printf(2, 3)
451 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
453 static inline void audit_log_end(struct audit_buffer *ab)
455 static inline void audit_log_n_hex(struct audit_buffer *ab,
456 const unsigned char *buf, size_t len)
458 static inline void audit_log_n_string(struct audit_buffer *ab,
459 const char *buf, size_t n)
461 static inline void audit_log_n_untrustedstring(struct audit_buffer *ab,
462 const char *string, size_t n)
464 static inline void audit_log_untrustedstring(struct audit_buffer *ab,
467 static inline void audit_log_d_path(struct audit_buffer *ab,
469 const struct path *path)
471 static inline void audit_log_key(struct audit_buffer *ab, char *key)
473 static inline void audit_log_link_denied(const char *string,
474 const struct path *link)
476 static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid)
478 #define audit_enabled 0
479 #endif /* CONFIG_AUDIT */
480 static inline void audit_log_string(struct audit_buffer *ab, const char *buf)
482 audit_log_n_string(ab, buf, strlen(buf));