path: root/kernel/auditsc.c (plain)
blob: c2aaf539728fb2764d81caa74a979b04663e4b2d

1	/* auditsc.c -- System-call auditing support
2	* Handles all system-call specific auditing features.
3	*
4	* Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
5	* Copyright 2005 Hewlett-Packard Development Company, L.P.
6	* Copyright (C) 2005, 2006 IBM Corporation
7	* All Rights Reserved.
8	*
9	* This program is free software; you can redistribute it and/or modify
10	* it under the terms of the GNU General Public License as published by
11	* the Free Software Foundation; either version 2 of the License, or
12	* (at your option) any later version.
13	*
14	* This program is distributed in the hope that it will be useful,
15	* but WITHOUT ANY WARRANTY; without even the implied warranty of
16	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17	* GNU General Public License for more details.
18	*
19	* You should have received a copy of the GNU General Public License
20	* along with this program; if not, write to the Free Software
21	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22	*
23	* Written by Rickard E. (Rik) Faith <faith@redhat.com>
24	*
25	* Many of the ideas implemented here are from Stephen C. Tweedie,
26	* especially the idea of avoiding a copy by using getname.
27	*
28	* The method for actual interception of syscall entry and exit (not in
29	* this file -- see entry.S) is based on a GPL'd patch written by
30	* okir@suse.de and Copyright 2003 SuSE Linux AG.
31	*
32	* POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>,
33	* 2006.
34	*
35	* The support of additional filter rules compares (>, <, >=, <=) was
36	* added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005.
37	*
38	* Modified by Amy Griffis <amy.griffis@hp.com> to collect additional
39	* filesystem information.
40	*
41	* Subject and object context labeling support added by <danjones@us.ibm.com>
42	* and <dustin.kirkland@us.ibm.com> for LSPP certification compliance.
43	*/
44
45	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
46
47	#include <linux/init.h>
48	#include <asm/types.h>
49	#include <linux/atomic.h>
50	#include <linux/fs.h>
51	#include <linux/namei.h>
52	#include <linux/mm.h>
53	#include <linux/export.h>
54	#include <linux/slab.h>
55	#include <linux/mount.h>
56	#include <linux/socket.h>
57	#include <linux/mqueue.h>
58	#include <linux/audit.h>
59	#include <linux/personality.h>
60	#include <linux/time.h>
61	#include <linux/netlink.h>
62	#include <linux/compiler.h>
63	#include <asm/unistd.h>
64	#include <linux/security.h>
65	#include <linux/list.h>
66	#include <linux/binfmts.h>
67	#include <linux/highmem.h>
68	#include <linux/syscalls.h>
69	#include <asm/syscall.h>
70	#include <linux/capability.h>
71	#include <linux/fs_struct.h>
72	#include <linux/compat.h>
73	#include <linux/ctype.h>
74	#include <linux/string.h>
75	#include <linux/uaccess.h>
76	#include <uapi/linux/limits.h>
77
78	#include "audit.h"
79
80	/* flags stating the success for a syscall */
81	#define AUDITSC_INVALID 0
82	#define AUDITSC_SUCCESS 1
83	#define AUDITSC_FAILURE 2
84
85	/* no execve audit message should be longer than this (userspace limits),
86	* see the note near the top of audit_log_execve_info() about this value */
87	#define MAX_EXECVE_AUDIT_LEN 7500
88
89	/* max length to print of cmdline/proctitle value during audit */
90	#define MAX_PROCTITLE_AUDIT_LEN 128
91
92	/* number of audit rules */
93	int audit_n_rules;
94
95	/* determines whether we collect data for signals sent */
96	int audit_signals;
97
98	struct audit_aux_data {
99	struct audit_aux_data *next;
100	int type;
101	};
102
103	#define AUDIT_AUX_IPCPERM 0
104
105	/* Number of target pids per aux struct. */
106	#define AUDIT_AUX_PIDS 16
107
108	struct audit_aux_data_pids {
109	struct audit_aux_data d;
110	pid_t target_pid[AUDIT_AUX_PIDS];
111	kuid_t target_auid[AUDIT_AUX_PIDS];
112	kuid_t target_uid[AUDIT_AUX_PIDS];
113	unsigned int target_sessionid[AUDIT_AUX_PIDS];
114	u32 target_sid[AUDIT_AUX_PIDS];
115	char target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
116	int pid_count;
117	};
118
119	struct audit_aux_data_bprm_fcaps {
120	struct audit_aux_data d;
121	struct audit_cap_data fcap;
122	unsigned int fcap_ver;
123	struct audit_cap_data old_pcap;
124	struct audit_cap_data new_pcap;
125	};
126
127	struct audit_tree_refs {
128	struct audit_tree_refs *next;
129	struct audit_chunk *c[31];
130	};
131
132	static int audit_match_perm(struct audit_context *ctx, int mask)
133	{
134	unsigned n;
135	if (unlikely(!ctx))
136	return 0;
137	n = ctx->major;
138
139	switch (audit_classify_syscall(ctx->arch, n)) {
140	case 0: /* native */
141	if ((mask & AUDIT_PERM_WRITE) &&
142	audit_match_class(AUDIT_CLASS_WRITE, n))
143	return 1;
144	if ((mask & AUDIT_PERM_READ) &&
145	audit_match_class(AUDIT_CLASS_READ, n))
146	return 1;
147	if ((mask & AUDIT_PERM_ATTR) &&
148	audit_match_class(AUDIT_CLASS_CHATTR, n))
149	return 1;
150	return 0;
151	case 1: /* 32bit on biarch */
152	if ((mask & AUDIT_PERM_WRITE) &&
153	audit_match_class(AUDIT_CLASS_WRITE_32, n))
154	return 1;
155	if ((mask & AUDIT_PERM_READ) &&
156	audit_match_class(AUDIT_CLASS_READ_32, n))
157	return 1;
158	if ((mask & AUDIT_PERM_ATTR) &&
159	audit_match_class(AUDIT_CLASS_CHATTR_32, n))
160	return 1;
161	return 0;
162	case 2: /* open */
163	return mask & ACC_MODE(ctx->argv[1]);
164	case 3: /* openat */
165	return mask & ACC_MODE(ctx->argv[2]);
166	case 4: /* socketcall */
167	return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);
168	case 5: /* execve */
169	return mask & AUDIT_PERM_EXEC;
170	default:
171	return 0;
172	}
173	}
174
175	static int audit_match_filetype(struct audit_context *ctx, int val)
176	{
177	struct audit_names *n;
178	umode_t mode = (umode_t)val;
179
180	if (unlikely(!ctx))
181	return 0;
182
183	list_for_each_entry(n, &ctx->names_list, list) {
184	if ((n->ino != AUDIT_INO_UNSET) &&
185	((n->mode & S_IFMT) == mode))
186	return 1;
187	}
188
189	return 0;
190	}
191
192	/*
193	* We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *;
194	* ->first_trees points to its beginning, ->trees - to the current end of data.
195	* ->tree_count is the number of free entries in array pointed to by ->trees.
196	* Original condition is (NULL, NULL, 0); as soon as it grows we never revert to NULL,
197	* "empty" becomes (p, p, 31) afterwards. We don't shrink the list (and seriously,
198	* it's going to remain 1-element for almost any setup) until we free context itself.
199	* References in it _are_ dropped - at the same time we free/drop aux stuff.
200	*/
201
202	#ifdef CONFIG_AUDIT_TREE
203	static void audit_set_auditable(struct audit_context *ctx)
204	{
205	if (!ctx->prio) {
206	ctx->prio = 1;
207	ctx->current_state = AUDIT_RECORD_CONTEXT;
208	}
209	}
210
211	static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk)
212	{
213	struct audit_tree_refs *p = ctx->trees;
214	int left = ctx->tree_count;
215	if (likely(left)) {
216	p->c[--left] = chunk;
217	ctx->tree_count = left;
218	return 1;
219	}
220	if (!p)
221	return 0;
222	p = p->next;
223	if (p) {
224	p->c[30] = chunk;
225	ctx->trees = p;
226	ctx->tree_count = 30;
227	return 1;
228	}
229	return 0;
230	}
231
232	static int grow_tree_refs(struct audit_context *ctx)
233	{
234	struct audit_tree_refs *p = ctx->trees;
235	ctx->trees = kzalloc(sizeof(struct audit_tree_refs), GFP_KERNEL);
236	if (!ctx->trees) {
237	ctx->trees = p;
238	return 0;
239	}
240	if (p)
241	p->next = ctx->trees;
242	else
243	ctx->first_trees = ctx->trees;
244	ctx->tree_count = 31;
245	return 1;
246	}
247	#endif
248
249	static void unroll_tree_refs(struct audit_context *ctx,
250	struct audit_tree_refs *p, int count)
251	{
252	#ifdef CONFIG_AUDIT_TREE
253	struct audit_tree_refs *q;
254	int n;
255	if (!p) {
256	/* we started with empty chain */
257	p = ctx->first_trees;
258	count = 31;
259	/* if the very first allocation has failed, nothing to do */
260	if (!p)
261	return;
262	}
263	n = count;
264	for (q = p; q != ctx->trees; q = q->next, n = 31) {
265	while (n--) {
266	audit_put_chunk(q->c[n]);
267	q->c[n] = NULL;
268	}
269	}
270	while (n-- > ctx->tree_count) {
271	audit_put_chunk(q->c[n]);
272	q->c[n] = NULL;
273	}
274	ctx->trees = p;
275	ctx->tree_count = count;
276	#endif
277	}
278
279	static void free_tree_refs(struct audit_context *ctx)
280	{
281	struct audit_tree_refs *p, *q;
282	for (p = ctx->first_trees; p; p = q) {
283	q = p->next;
284	kfree(p);
285	}
286	}
287
288	static int match_tree_refs(struct audit_context *ctx, struct audit_tree *tree)
289	{
290	#ifdef CONFIG_AUDIT_TREE
291	struct audit_tree_refs *p;
292	int n;
293	if (!tree)
294	return 0;
295	/* full ones */
296	for (p = ctx->first_trees; p != ctx->trees; p = p->next) {
297	for (n = 0; n < 31; n++)
298	if (audit_tree_match(p->c[n], tree))
299	return 1;
300	}
301	/* partial */
302	if (p) {
303	for (n = ctx->tree_count; n < 31; n++)
304	if (audit_tree_match(p->c[n], tree))
305	return 1;
306	}
307	#endif
308	return 0;
309	}
310
311	static int audit_compare_uid(kuid_t uid,
312	struct audit_names *name,
313	struct audit_field *f,
314	struct audit_context *ctx)
315	{
316	struct audit_names *n;
317	int rc;
318
319	if (name) {
320	rc = audit_uid_comparator(uid, f->op, name->uid);
321	if (rc)
322	return rc;
323	}
324
325	if (ctx) {
326	list_for_each_entry(n, &ctx->names_list, list) {
327	rc = audit_uid_comparator(uid, f->op, n->uid);
328	if (rc)
329	return rc;
330	}
331	}
332	return 0;
333	}
334
335	static int audit_compare_gid(kgid_t gid,
336	struct audit_names *name,
337	struct audit_field *f,
338	struct audit_context *ctx)
339	{
340	struct audit_names *n;
341	int rc;
342
343	if (name) {
344	rc = audit_gid_comparator(gid, f->op, name->gid);
345	if (rc)
346	return rc;
347	}
348
349	if (ctx) {
350	list_for_each_entry(n, &ctx->names_list, list) {
351	rc = audit_gid_comparator(gid, f->op, n->gid);
352	if (rc)
353	return rc;
354	}
355	}
356	return 0;
357	}
358
359	static int audit_field_compare(struct task_struct *tsk,
360	const struct cred *cred,
361	struct audit_field *f,
362	struct audit_context *ctx,
363	struct audit_names *name)
364	{
365	switch (f->val) {
366	/* process to file object comparisons */
367	case AUDIT_COMPARE_UID_TO_OBJ_UID:
368	return audit_compare_uid(cred->uid, name, f, ctx);
369	case AUDIT_COMPARE_GID_TO_OBJ_GID:
370	return audit_compare_gid(cred->gid, name, f, ctx);
371	case AUDIT_COMPARE_EUID_TO_OBJ_UID:
372	return audit_compare_uid(cred->euid, name, f, ctx);
373	case AUDIT_COMPARE_EGID_TO_OBJ_GID:
374	return audit_compare_gid(cred->egid, name, f, ctx);
375	case AUDIT_COMPARE_AUID_TO_OBJ_UID:
376	return audit_compare_uid(tsk->loginuid, name, f, ctx);
377	case AUDIT_COMPARE_SUID_TO_OBJ_UID:
378	return audit_compare_uid(cred->suid, name, f, ctx);
379	case AUDIT_COMPARE_SGID_TO_OBJ_GID:
380	return audit_compare_gid(cred->sgid, name, f, ctx);
381	case AUDIT_COMPARE_FSUID_TO_OBJ_UID:
382	return audit_compare_uid(cred->fsuid, name, f, ctx);
383	case AUDIT_COMPARE_FSGID_TO_OBJ_GID:
384	return audit_compare_gid(cred->fsgid, name, f, ctx);
385	/* uid comparisons */
386	case AUDIT_COMPARE_UID_TO_AUID:
387	return audit_uid_comparator(cred->uid, f->op, tsk->loginuid);
388	case AUDIT_COMPARE_UID_TO_EUID:
389	return audit_uid_comparator(cred->uid, f->op, cred->euid);
390	case AUDIT_COMPARE_UID_TO_SUID:
391	return audit_uid_comparator(cred->uid, f->op, cred->suid);
392	case AUDIT_COMPARE_UID_TO_FSUID:
393	return audit_uid_comparator(cred->uid, f->op, cred->fsuid);
394	/* auid comparisons */
395	case AUDIT_COMPARE_AUID_TO_EUID:
396	return audit_uid_comparator(tsk->loginuid, f->op, cred->euid);
397	case AUDIT_COMPARE_AUID_TO_SUID:
398	return audit_uid_comparator(tsk->loginuid, f->op, cred->suid);
399	case AUDIT_COMPARE_AUID_TO_FSUID:
400	return audit_uid_comparator(tsk->loginuid, f->op, cred->fsuid);
401	/* euid comparisons */
402	case AUDIT_COMPARE_EUID_TO_SUID:
403	return audit_uid_comparator(cred->euid, f->op, cred->suid);
404	case AUDIT_COMPARE_EUID_TO_FSUID:
405	return audit_uid_comparator(cred->euid, f->op, cred->fsuid);
406	/* suid comparisons */
407	case AUDIT_COMPARE_SUID_TO_FSUID:
408	return audit_uid_comparator(cred->suid, f->op, cred->fsuid);
409	/* gid comparisons */
410	case AUDIT_COMPARE_GID_TO_EGID:
411	return audit_gid_comparator(cred->gid, f->op, cred->egid);
412	case AUDIT_COMPARE_GID_TO_SGID:
413	return audit_gid_comparator(cred->gid, f->op, cred->sgid);
414	case AUDIT_COMPARE_GID_TO_FSGID:
415	return audit_gid_comparator(cred->gid, f->op, cred->fsgid);
416	/* egid comparisons */
417	case AUDIT_COMPARE_EGID_TO_SGID:
418	return audit_gid_comparator(cred->egid, f->op, cred->sgid);
419	case AUDIT_COMPARE_EGID_TO_FSGID:
420	return audit_gid_comparator(cred->egid, f->op, cred->fsgid);
421	/* sgid comparison */
422	case AUDIT_COMPARE_SGID_TO_FSGID:
423	return audit_gid_comparator(cred->sgid, f->op, cred->fsgid);
424	default:
425	WARN(1, "Missing AUDIT_COMPARE define. Report as a bug\n");
426	return 0;
427	}
428	return 0;
429	}
430
431	/* Determine if any context name data matches a rule's watch data */
432	/* Compare a task_struct with an audit_rule. Return 1 on match, 0
433	* otherwise.
434	*
435	* If task_creation is true, this is an explicit indication that we are
436	* filtering a task rule at task creation time. This and tsk == current are
437	* the only situations where tsk->cred may be accessed without an rcu read lock.
438	*/
439	static int audit_filter_rules(struct task_struct *tsk,
440	struct audit_krule *rule,
441	struct audit_context *ctx,
442	struct audit_names *name,
443	enum audit_state *state,
444	bool task_creation)
445	{
446	const struct cred *cred;
447	int i, need_sid = 1;
448	u32 sid;
449
450	cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation);
451
452	for (i = 0; i < rule->field_count; i++) {
453	struct audit_field *f = &rule->fields[i];
454	struct audit_names *n;
455	int result = 0;
456	pid_t pid;
457
458	switch (f->type) {
459	case AUDIT_PID:
460	pid = task_tgid_nr(tsk);
461	result = audit_comparator(pid, f->op, f->val);
462	break;
463	case AUDIT_PPID:
464	if (ctx) {
465	if (!ctx->ppid)
466	ctx->ppid = task_ppid_nr(tsk);
467	result = audit_comparator(ctx->ppid, f->op, f->val);
468	}
469	break;
470	case AUDIT_EXE:
471	result = audit_exe_compare(tsk, rule->exe);
472	if (f->op == Audit_not_equal)
473	result = !result;
474	break;
475	case AUDIT_UID:
476	result = audit_uid_comparator(cred->uid, f->op, f->uid);
477	break;
478	case AUDIT_EUID:
479	result = audit_uid_comparator(cred->euid, f->op, f->uid);
480	break;
481	case AUDIT_SUID:
482	result = audit_uid_comparator(cred->suid, f->op, f->uid);
483	break;
484	case AUDIT_FSUID:
485	result = audit_uid_comparator(cred->fsuid, f->op, f->uid);
486	break;
487	case AUDIT_GID:
488	result = audit_gid_comparator(cred->gid, f->op, f->gid);
489	if (f->op == Audit_equal) {
490	if (!result)
491	result = in_group_p(f->gid);
492	} else if (f->op == Audit_not_equal) {
493	if (result)
494	result = !in_group_p(f->gid);
495	}
496	break;
497	case AUDIT_EGID:
498	result = audit_gid_comparator(cred->egid, f->op, f->gid);
499	if (f->op == Audit_equal) {
500	if (!result)
501	result = in_egroup_p(f->gid);
502	} else if (f->op == Audit_not_equal) {
503	if (result)
504	result = !in_egroup_p(f->gid);
505	}
506	break;
507	case AUDIT_SGID:
508	result = audit_gid_comparator(cred->sgid, f->op, f->gid);
509	break;
510	case AUDIT_FSGID:
511	result = audit_gid_comparator(cred->fsgid, f->op, f->gid);
512	break;
513	case AUDIT_PERS:
514	result = audit_comparator(tsk->personality, f->op, f->val);
515	break;
516	case AUDIT_ARCH:
517	if (ctx)
518	result = audit_comparator(ctx->arch, f->op, f->val);
519	break;
520
521	case AUDIT_EXIT:
522	if (ctx && ctx->return_valid)
523	result = audit_comparator(ctx->return_code, f->op, f->val);
524	break;
525	case AUDIT_SUCCESS:
526	if (ctx && ctx->return_valid) {
527	if (f->val)
528	result = audit_comparator(ctx->return_valid, f->op, AUDITSC_SUCCESS);
529	else
530	result = audit_comparator(ctx->return_valid, f->op, AUDITSC_FAILURE);
531	}
532	break;
533	case AUDIT_DEVMAJOR:
534	if (name) {
535	if (audit_comparator(MAJOR(name->dev), f->op, f->val) ||
536	audit_comparator(MAJOR(name->rdev), f->op, f->val))
537	++result;
538	} else if (ctx) {
539	list_for_each_entry(n, &ctx->names_list, list) {
540	if (audit_comparator(MAJOR(n->dev), f->op, f->val) ||
541	audit_comparator(MAJOR(n->rdev), f->op, f->val)) {
542	++result;
543	break;
544	}
545	}
546	}
547	break;
548	case AUDIT_DEVMINOR:
549	if (name) {
550	if (audit_comparator(MINOR(name->dev), f->op, f->val) ||
551	audit_comparator(MINOR(name->rdev), f->op, f->val))
552	++result;
553	} else if (ctx) {
554	list_for_each_entry(n, &ctx->names_list, list) {
555	if (audit_comparator(MINOR(n->dev), f->op, f->val) ||
556	audit_comparator(MINOR(n->rdev), f->op, f->val)) {
557	++result;
558	break;
559	}
560	}
561	}
562	break;
563	case AUDIT_INODE:
564	if (name)
565	result = audit_comparator(name->ino, f->op, f->val);
566	else if (ctx) {
567	list_for_each_entry(n, &ctx->names_list, list) {
568	if (audit_comparator(n->ino, f->op, f->val)) {
569	++result;
570	break;
571	}
572	}
573	}
574	break;
575	case AUDIT_OBJ_UID:
576	if (name) {
577	result = audit_uid_comparator(name->uid, f->op, f->uid);
578	} else if (ctx) {
579	list_for_each_entry(n, &ctx->names_list, list) {
580	if (audit_uid_comparator(n->uid, f->op, f->uid)) {
581	++result;
582	break;
583	}
584	}
585	}
586	break;
587	case AUDIT_OBJ_GID:
588	if (name) {
589	result = audit_gid_comparator(name->gid, f->op, f->gid);
590	} else if (ctx) {
591	list_for_each_entry(n, &ctx->names_list, list) {
592	if (audit_gid_comparator(n->gid, f->op, f->gid)) {
593	++result;
594	break;
595	}
596	}
597	}
598	break;
599	case AUDIT_WATCH:
600	if (name)
601	result = audit_watch_compare(rule->watch, name->ino, name->dev);
602	break;
603	case AUDIT_DIR:
604	if (ctx)
605	result = match_tree_refs(ctx, rule->tree);
606	break;
607	case AUDIT_LOGINUID:
608	result = audit_uid_comparator(tsk->loginuid, f->op, f->uid);
609	break;
610	case AUDIT_LOGINUID_SET:
611	result = audit_comparator(audit_loginuid_set(tsk), f->op, f->val);
612	break;
613	case AUDIT_SUBJ_USER:
614	case AUDIT_SUBJ_ROLE:
615	case AUDIT_SUBJ_TYPE:
616	case AUDIT_SUBJ_SEN:
617	case AUDIT_SUBJ_CLR:
618	/* NOTE: this may return negative values indicating
619	a temporary error. We simply treat this as a
620	match for now to avoid losing information that
621	may be wanted. An error message will also be
622	logged upon error */
623	if (f->lsm_rule) {
624	if (need_sid) {
625	security_task_getsecid(tsk, &sid);
626	need_sid = 0;
627	}
628	result = security_audit_rule_match(sid, f->type,
629	f->op,
630	f->lsm_rule,
631	ctx);
632	}
633	break;
634	case AUDIT_OBJ_USER:
635	case AUDIT_OBJ_ROLE:
636	case AUDIT_OBJ_TYPE:
637	case AUDIT_OBJ_LEV_LOW:
638	case AUDIT_OBJ_LEV_HIGH:
639	/* The above note for AUDIT_SUBJ_USER...AUDIT_SUBJ_CLR
640	also applies here */
641	if (f->lsm_rule) {
642	/* Find files that match */
643	if (name) {
644	result = security_audit_rule_match(
645	name->osid, f->type, f->op,
646	f->lsm_rule, ctx);
647	} else if (ctx) {
648	list_for_each_entry(n, &ctx->names_list, list) {
649	if (security_audit_rule_match(n->osid, f->type,
650	f->op, f->lsm_rule,
651	ctx)) {
652	++result;
653	break;
654	}
655	}
656	}
657	/* Find ipc objects that match */
658	if (!ctx || ctx->type != AUDIT_IPC)
659	break;
660	if (security_audit_rule_match(ctx->ipc.osid,
661	f->type, f->op,
662	f->lsm_rule, ctx))
663	++result;
664	}
665	break;
666	case AUDIT_ARG0:
667	case AUDIT_ARG1:
668	case AUDIT_ARG2:
669	case AUDIT_ARG3:
670	if (ctx)
671	result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
672	break;
673	case AUDIT_FILTERKEY:
674	/* ignore this field for filtering */
675	result = 1;
676	break;
677	case AUDIT_PERM:
678	result = audit_match_perm(ctx, f->val);
679	break;
680	case AUDIT_FILETYPE:
681	result = audit_match_filetype(ctx, f->val);
682	break;
683	case AUDIT_FIELD_COMPARE:
684	result = audit_field_compare(tsk, cred, f, ctx, name);
685	break;
686	}
687	if (!result)
688	return 0;
689	}
690
691	if (ctx) {
692	if (rule->prio <= ctx->prio)
693	return 0;
694	if (rule->filterkey) {
695	kfree(ctx->filterkey);
696	ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
697	}
698	ctx->prio = rule->prio;
699	}
700	switch (rule->action) {
701	case AUDIT_NEVER:
702	*state = AUDIT_DISABLED;
703	break;
704	case AUDIT_ALWAYS:
705	*state = AUDIT_RECORD_CONTEXT;
706	break;
707	}
708	return 1;
709	}
710
711	/* At process creation time, we can determine if system-call auditing is
712	* completely disabled for this task. Since we only have the task
713	* structure at this point, we can only check uid and gid.
714	*/
715	static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
716	{
717	struct audit_entry *e;
718	enum audit_state state;
719
720	rcu_read_lock();
721	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
722	if (audit_filter_rules(tsk, &e->rule, NULL, NULL,
723	&state, true)) {
724	if (state == AUDIT_RECORD_CONTEXT)
725	*key = kstrdup(e->rule.filterkey, GFP_ATOMIC);
726	rcu_read_unlock();
727	return state;
728	}
729	}
730	rcu_read_unlock();
731	return AUDIT_BUILD_CONTEXT;
732	}
733
734	static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
735	{
736	int word, bit;
737
738	if (val > 0xffffffff)
739	return false;
740
741	word = AUDIT_WORD(val);
742	if (word >= AUDIT_BITMASK_SIZE)
743	return false;
744
745	bit = AUDIT_BIT(val);
746
747	return rule->mask[word] & bit;
748	}
749
750	/* At syscall entry and exit time, this filter is called if the
751	* audit_state is not low enough that auditing cannot take place, but is
752	* also not high enough that we already know we have to write an audit
753	* record (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT).
754	*/
755	static enum audit_state audit_filter_syscall(struct task_struct *tsk,
756	struct audit_context *ctx,
757	struct list_head *list)
758	{
759	struct audit_entry *e;
760	enum audit_state state;
761
762	if (audit_pid && tsk->tgid == audit_pid)
763	return AUDIT_DISABLED;
764
765	rcu_read_lock();
766	if (!list_empty(list)) {
767	list_for_each_entry_rcu(e, list, list) {
768	if (audit_in_mask(&e->rule, ctx->major) &&
769	audit_filter_rules(tsk, &e->rule, ctx, NULL,
770	&state, false)) {
771	rcu_read_unlock();
772	ctx->current_state = state;
773	return state;
774	}
775	}
776	}
777	rcu_read_unlock();
778	return AUDIT_BUILD_CONTEXT;
779	}
780
781	/*
782	* Given an audit_name check the inode hash table to see if they match.
783	* Called holding the rcu read lock to protect the use of audit_inode_hash
784	*/
785	static int audit_filter_inode_name(struct task_struct *tsk,
786	struct audit_names *n,
787	struct audit_context *ctx) {
788	int h = audit_hash_ino((u32)n->ino);
789	struct list_head *list = &audit_inode_hash[h];
790	struct audit_entry *e;
791	enum audit_state state;
792
793	if (list_empty(list))
794	return 0;
795
796	list_for_each_entry_rcu(e, list, list) {
797	if (audit_in_mask(&e->rule, ctx->major) &&
798	audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
799	ctx->current_state = state;
800	return 1;
801	}
802	}
803
804	return 0;
805	}
806
807	/* At syscall exit time, this filter is called if any audit_names have been
808	* collected during syscall processing. We only check rules in sublists at hash
809	* buckets applicable to the inode numbers in audit_names.
810	* Regarding audit_state, same rules apply as for audit_filter_syscall().
811	*/
812	void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx)
813	{
814	struct audit_names *n;
815
816	if (audit_pid && tsk->tgid == audit_pid)
817	return;
818
819	rcu_read_lock();
820
821	list_for_each_entry(n, &ctx->names_list, list) {
822	if (audit_filter_inode_name(tsk, n, ctx))
823	break;
824	}
825	rcu_read_unlock();
826	}
827
828	/* Transfer the audit context pointer to the caller, clearing it in the tsk's struct */
829	static inline struct audit_context *audit_take_context(struct task_struct *tsk,
830	int return_valid,
831	long return_code)
832	{
833	struct audit_context *context = tsk->audit_context;
834
835	if (!context)
836	return NULL;
837	context->return_valid = return_valid;
838
839	/*
840	* we need to fix up the return code in the audit logs if the actual
841	* return codes are later going to be fixed up by the arch specific
842	* signal handlers
843	*
844	* This is actually a test for:
845	* (rc == ERESTARTSYS ) || (rc == ERESTARTNOINTR) ||
846	* (rc == ERESTARTNOHAND) || (rc == ERESTART_RESTARTBLOCK)
847	*
848	* but is faster than a bunch of ||
849	*/
850	if (unlikely(return_code <= -ERESTARTSYS) &&
851	(return_code >= -ERESTART_RESTARTBLOCK) &&
852	(return_code != -ENOIOCTLCMD))
853	context->return_code = -EINTR;
854	else
855	context->return_code = return_code;
856
857	if (context->in_syscall && !context->dummy) {
858	audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
859	audit_filter_inodes(tsk, context);
860	}
861
862	tsk->audit_context = NULL;
863	return context;
864	}
865
866	static inline void audit_proctitle_free(struct audit_context *context)
867	{
868	kfree(context->proctitle.value);
869	context->proctitle.value = NULL;
870	context->proctitle.len = 0;
871	}
872
873	static inline void audit_free_names(struct audit_context *context)
874	{
875	struct audit_names *n, *next;
876
877	list_for_each_entry_safe(n, next, &context->names_list, list) {
878	list_del(&n->list);
879	if (n->name)
880	putname(n->name);
881	if (n->should_free)
882	kfree(n);
883	}
884	context->name_count = 0;
885	path_put(&context->pwd);
886	context->pwd.dentry = NULL;
887	context->pwd.mnt = NULL;
888	}
889
890	static inline void audit_free_aux(struct audit_context *context)
891	{
892	struct audit_aux_data *aux;
893
894	while ((aux = context->aux)) {
895	context->aux = aux->next;
896	kfree(aux);
897	}
898	while ((aux = context->aux_pids)) {
899	context->aux_pids = aux->next;
900	kfree(aux);
901	}
902	}
903
904	static inline struct audit_context *audit_alloc_context(enum audit_state state)
905	{
906	struct audit_context *context;
907
908	context = kzalloc(sizeof(*context), GFP_KERNEL);
909	if (!context)
910	return NULL;
911	context->state = state;
912	context->prio = state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;
913	INIT_LIST_HEAD(&context->killed_trees);
914	INIT_LIST_HEAD(&context->names_list);
915	return context;
916	}
917
918	/**
919	* audit_alloc - allocate an audit context block for a task
920	* @tsk: task
921	*
922	* Filter on the task information and allocate a per-task audit context
923	* if necessary. Doing so turns on system call auditing for the
924	* specified task. This is called from copy_process, so no lock is
925	* needed.
926	*/
927	int audit_alloc(struct task_struct *tsk)
928	{
929	struct audit_context *context;
930	enum audit_state state;
931	char *key = NULL;
932
933	if (likely(!audit_ever_enabled))
934	return 0; /* Return if not auditing. */
935
936	state = audit_filter_task(tsk, &key);
937	if (state == AUDIT_DISABLED) {
938	clear_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
939	return 0;
940	}
941
942	if (!(context = audit_alloc_context(state))) {
943	kfree(key);
944	audit_log_lost("out of memory in audit_alloc");
945	return -ENOMEM;
946	}
947	context->filterkey = key;
948
949	tsk->audit_context = context;
950	set_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
951	return 0;
952	}
953
954	static inline void audit_free_context(struct audit_context *context)
955	{
956	audit_free_names(context);
957	unroll_tree_refs(context, NULL, 0);
958	free_tree_refs(context);
959	audit_free_aux(context);
960	kfree(context->filterkey);
961	kfree(context->sockaddr);
962	audit_proctitle_free(context);
963	kfree(context);
964	}
965
966	static int audit_log_pid_context(struct audit_context *context, pid_t pid,
967	kuid_t auid, kuid_t uid, unsigned int sessionid,
968	u32 sid, char *comm)
969	{
970	struct audit_buffer *ab;
971	char *ctx = NULL;
972	u32 len;
973	int rc = 0;
974
975	ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
976	if (!ab)
977	return rc;
978
979	audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid,
980	from_kuid(&init_user_ns, auid),
981	from_kuid(&init_user_ns, uid), sessionid);
982	if (sid) {
983	if (security_secid_to_secctx(sid, &ctx, &len)) {
984	audit_log_format(ab, " obj=(none)");
985	rc = 1;
986	} else {
987	audit_log_format(ab, " obj=%s", ctx);
988	security_release_secctx(ctx, len);
989	}
990	}
991	audit_log_format(ab, " ocomm=");
992	audit_log_untrustedstring(ab, comm);
993	audit_log_end(ab);
994
995	return rc;
996	}
997
998	static void audit_log_execve_info(struct audit_context *context,
999	struct audit_buffer **ab)
1000	{
1001	long len_max;
1002	long len_rem;
1003	long len_full;
1004	long len_buf;
1005	long len_abuf;
1006	long len_tmp;
1007	bool require_data;
1008	bool encode;
1009	unsigned int iter;
1010	unsigned int arg;
1011	char *buf_head;
1012	char *buf;
1013	const char __user *p = (const char __user *)current->mm->arg_start;
1014
1015	/* NOTE: this buffer needs to be large enough to hold all the non-arg
1016	* data we put in the audit record for this argument (see the
1017	* code below) ... at this point in time 96 is plenty */
1018	char abuf[96];
1019
1020	/* NOTE: we set MAX_EXECVE_AUDIT_LEN to a rather arbitrary limit, the
1021	* current value of 7500 is not as important as the fact that it
1022	* is less than 8k, a setting of 7500 gives us plenty of wiggle
1023	* room if we go over a little bit in the logging below */
1024	WARN_ON_ONCE(MAX_EXECVE_AUDIT_LEN > 7500);
1025	len_max = MAX_EXECVE_AUDIT_LEN;
1026
1027	/* scratch buffer to hold the userspace args */
1028	buf_head = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
1029	if (!buf_head) {
1030	audit_panic("out of memory for argv string");
1031	return;
1032	}
1033	buf = buf_head;
1034
1035	audit_log_format(*ab, "argc=%d", context->execve.argc);
1036
1037	len_rem = len_max;
1038	len_buf = 0;
1039	len_full = 0;
1040	require_data = true;
1041	encode = false;
1042	iter = 0;
1043	arg = 0;
1044	do {
1045	/* NOTE: we don't ever want to trust this value for anything
1046	* serious, but the audit record format insists we
1047	* provide an argument length for really long arguments,
1048	* e.g. > MAX_EXECVE_AUDIT_LEN, so we have no choice but
1049	* to use strncpy_from_user() to obtain this value for
1050	* recording in the log, although we don't use it
1051	* anywhere here to avoid a double-fetch problem */
1052	if (len_full == 0)
1053	len_full = strnlen_user(p, MAX_ARG_STRLEN) - 1;
1054
1055	/* read more data from userspace */
1056	if (require_data) {
1057	/* can we make more room in the buffer? */
1058	if (buf != buf_head) {
1059	memmove(buf_head, buf, len_buf);
1060	buf = buf_head;
1061	}
1062
1063	/* fetch as much as we can of the argument */
1064	len_tmp = strncpy_from_user(&buf_head[len_buf], p,
1065	len_max - len_buf);
1066	if (len_tmp == -EFAULT) {
1067	/* unable to copy from userspace */
1068	send_sig(SIGKILL, current, 0);
1069	goto out;
1070	} else if (len_tmp == (len_max - len_buf)) {
1071	/* buffer is not large enough */
1072	require_data = true;
1073	/* NOTE: if we are going to span multiple
1074	* buffers force the encoding so we stand
1075	* a chance at a sane len_full value and
1076	* consistent record encoding */
1077	encode = true;
1078	len_full = len_full * 2;
1079	p += len_tmp;
1080	} else {
1081	require_data = false;
1082	if (!encode)
1083	encode = audit_string_contains_control(
1084	buf, len_tmp);
1085	/* try to use a trusted value for len_full */
1086	if (len_full < len_max)
1087	len_full = (encode ?
1088	len_tmp * 2 : len_tmp);
1089	p += len_tmp + 1;
1090	}
1091	len_buf += len_tmp;
1092	buf_head[len_buf] = '\0';
1093
1094	/* length of the buffer in the audit record? */
1095	len_abuf = (encode ? len_buf * 2 : len_buf + 2);
1096	}
1097
1098	/* write as much as we can to the audit log */
1099	if (len_buf > 0) {
1100	/* NOTE: some magic numbers here - basically if we
1101	* can't fit a reasonable amount of data into the
1102	* existing audit buffer, flush it and start with
1103	* a new buffer */
1104	if ((sizeof(abuf) + 8) > len_rem) {
1105	len_rem = len_max;
1106	audit_log_end(*ab);
1107	*ab = audit_log_start(context,
1108	GFP_KERNEL, AUDIT_EXECVE);
1109	if (!*ab)
1110	goto out;
1111	}
1112
1113	/* create the non-arg portion of the arg record */
1114	len_tmp = 0;
1115	if (require_data || (iter > 0) ||
1116	((len_abuf + sizeof(abuf)) > len_rem)) {
1117	if (iter == 0) {
1118	len_tmp += snprintf(&abuf[len_tmp],
1119	sizeof(abuf) - len_tmp,
1120	" a%d_len=%lu",
1121	arg, len_full);
1122	}
1123	len_tmp += snprintf(&abuf[len_tmp],
1124	sizeof(abuf) - len_tmp,
1125	" a%d[%d]=", arg, iter++);
1126	} else
1127	len_tmp += snprintf(&abuf[len_tmp],
1128	sizeof(abuf) - len_tmp,
1129	" a%d=", arg);
1130	WARN_ON(len_tmp >= sizeof(abuf));
1131	abuf[sizeof(abuf) - 1] = '\0';
1132
1133	/* log the arg in the audit record */
1134	audit_log_format(*ab, "%s", abuf);
1135	len_rem -= len_tmp;
1136	len_tmp = len_buf;
1137	if (encode) {
1138	if (len_abuf > len_rem)
1139	len_tmp = len_rem / 2; /* encoding */
1140	audit_log_n_hex(*ab, buf, len_tmp);
1141	len_rem -= len_tmp * 2;
1142	len_abuf -= len_tmp * 2;
1143	} else {
1144	if (len_abuf > len_rem)
1145	len_tmp = len_rem - 2; /* quotes */
1146	audit_log_n_string(*ab, buf, len_tmp);
1147	len_rem -= len_tmp + 2;
1148	/* don't subtract the "2" because we still need
1149	* to add quotes to the remaining string */
1150	len_abuf -= len_tmp;
1151	}
1152	len_buf -= len_tmp;
1153	buf += len_tmp;
1154	}
1155
1156	/* ready to move to the next argument? */
1157	if ((len_buf == 0) && !require_data) {
1158	arg++;
1159	iter = 0;
1160	len_full = 0;
1161	require_data = true;
1162	encode = false;
1163	}
1164	} while (arg < context->execve.argc);
1165
1166	/* NOTE: the caller handles the final audit_log_end() call */
1167
1168	out:
1169	kfree(buf_head);
1170	}
1171
1172	static void show_special(struct audit_context *context, int *call_panic)
1173	{
1174	struct audit_buffer *ab;
1175	int i;
1176
1177	ab = audit_log_start(context, GFP_KERNEL, context->type);
1178	if (!ab)
1179	return;
1180
1181	switch (context->type) {
1182	case AUDIT_SOCKETCALL: {
1183	int nargs = context->socketcall.nargs;
1184	audit_log_format(ab, "nargs=%d", nargs);
1185	for (i = 0; i < nargs; i++)
1186	audit_log_format(ab, " a%d=%lx", i,
1187	context->socketcall.args[i]);
1188	break; }
1189	case AUDIT_IPC: {
1190	u32 osid = context->ipc.osid;
1191
1192	audit_log_format(ab, "ouid=%u ogid=%u mode=%#ho",
1193	from_kuid(&init_user_ns, context->ipc.uid),
1194	from_kgid(&init_user_ns, context->ipc.gid),
1195	context->ipc.mode);
1196	if (osid) {
1197	char *ctx = NULL;
1198	u32 len;
1199	if (security_secid_to_secctx(osid, &ctx, &len)) {
1200	audit_log_format(ab, " osid=%u", osid);
1201	*call_panic = 1;
1202	} else {
1203	audit_log_format(ab, " obj=%s", ctx);
1204	security_release_secctx(ctx, len);
1205	}
1206	}
1207	if (context->ipc.has_perm) {
1208	audit_log_end(ab);
1209	ab = audit_log_start(context, GFP_KERNEL,
1210	AUDIT_IPC_SET_PERM);
1211	if (unlikely(!ab))
1212	return;
1213	audit_log_format(ab,
1214	"qbytes=%lx ouid=%u ogid=%u mode=%#ho",
1215	context->ipc.qbytes,
1216	context->ipc.perm_uid,
1217	context->ipc.perm_gid,
1218	context->ipc.perm_mode);
1219	}
1220	break; }
1221	case AUDIT_MQ_OPEN: {
1222	audit_log_format(ab,
1223	"oflag=0x%x mode=%#ho mq_flags=0x%lx mq_maxmsg=%ld "
1224	"mq_msgsize=%ld mq_curmsgs=%ld",
1225	context->mq_open.oflag, context->mq_open.mode,
1226	context->mq_open.attr.mq_flags,
1227	context->mq_open.attr.mq_maxmsg,
1228	context->mq_open.attr.mq_msgsize,
1229	context->mq_open.attr.mq_curmsgs);
1230	break; }
1231	case AUDIT_MQ_SENDRECV: {
1232	audit_log_format(ab,
1233	"mqdes=%d msg_len=%zd msg_prio=%u "
1234	"abs_timeout_sec=%ld abs_timeout_nsec=%ld",
1235	context->mq_sendrecv.mqdes,
1236	context->mq_sendrecv.msg_len,
1237	context->mq_sendrecv.msg_prio,
1238	context->mq_sendrecv.abs_timeout.tv_sec,
1239	context->mq_sendrecv.abs_timeout.tv_nsec);
1240	break; }
1241	case AUDIT_MQ_NOTIFY: {
1242	audit_log_format(ab, "mqdes=%d sigev_signo=%d",
1243	context->mq_notify.mqdes,
1244	context->mq_notify.sigev_signo);
1245	break; }
1246	case AUDIT_MQ_GETSETATTR: {
1247	struct mq_attr *attr = &context->mq_getsetattr.mqstat;
1248	audit_log_format(ab,
1249	"mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
1250	"mq_curmsgs=%ld ",
1251	context->mq_getsetattr.mqdes,
1252	attr->mq_flags, attr->mq_maxmsg,
1253	attr->mq_msgsize, attr->mq_curmsgs);
1254	break; }
1255	case AUDIT_CAPSET: {
1256	audit_log_format(ab, "pid=%d", context->capset.pid);
1257	audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable);
1258	audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted);
1259	audit_log_cap(ab, "cap_pe", &context->capset.cap.effective);
1260	break; }
1261	case AUDIT_MMAP: {
1262	audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd,
1263	context->mmap.flags);
1264	break; }
1265	case AUDIT_EXECVE: {
1266	audit_log_execve_info(context, &ab);
1267	break; }
1268	}
1269	audit_log_end(ab);
1270	}
1271
1272	static inline int audit_proctitle_rtrim(char *proctitle, int len)
1273	{
1274	char *end = proctitle + len - 1;
1275	while (end > proctitle && !isprint(*end))
1276	end--;
1277
1278	/* catch the case where proctitle is only 1 non-print character */
1279	len = end - proctitle + 1;
1280	len -= isprint(proctitle[len-1]) == 0;
1281	return len;
1282	}
1283
1284	static void audit_log_proctitle(struct task_struct *tsk,
1285	struct audit_context *context)
1286	{
1287	int res;
1288	char *buf;
1289	char *msg = "(null)";
1290	int len = strlen(msg);
1291	struct audit_buffer *ab;
1292
1293	ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE);
1294	if (!ab)
1295	return; /* audit_panic or being filtered */
1296
1297	audit_log_format(ab, "proctitle=");
1298
1299	/* Not cached */
1300	if (!context->proctitle.value) {
1301	buf = kmalloc(MAX_PROCTITLE_AUDIT_LEN, GFP_KERNEL);
1302	if (!buf)
1303	goto out;
1304	/* Historically called this from procfs naming */
1305	res = get_cmdline(tsk, buf, MAX_PROCTITLE_AUDIT_LEN);
1306	if (res == 0) {
1307	kfree(buf);
1308	goto out;
1309	}
1310	res = audit_proctitle_rtrim(buf, res);
1311	if (res == 0) {
1312	kfree(buf);
1313	goto out;
1314	}
1315	context->proctitle.value = buf;
1316	context->proctitle.len = res;
1317	}
1318	msg = context->proctitle.value;
1319	len = context->proctitle.len;
1320	out:
1321	audit_log_n_untrustedstring(ab, msg, len);
1322	audit_log_end(ab);
1323	}
1324
1325	static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)
1326	{
1327	int i, call_panic = 0;
1328	struct audit_buffer *ab;
1329	struct audit_aux_data *aux;
1330	struct audit_names *n;
1331
1332	/* tsk == current */
1333	context->personality = tsk->personality;
1334
1335	ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
1336	if (!ab)
1337	return; /* audit_panic has been called */
1338	audit_log_format(ab, "arch=%x syscall=%d",
1339	context->arch, context->major);
1340	if (context->personality != PER_LINUX)
1341	audit_log_format(ab, " per=%lx", context->personality);
1342	if (context->return_valid)
1343	audit_log_format(ab, " success=%s exit=%ld",
1344	(context->return_valid==AUDITSC_SUCCESS)?"yes":"no",
1345	context->return_code);
1346
1347	audit_log_format(ab,
1348	" a0=%lx a1=%lx a2=%lx a3=%lx items=%d",
1349	context->argv[0],
1350	context->argv[1],
1351	context->argv[2],
1352	context->argv[3],
1353	context->name_count);
1354
1355	audit_log_task_info(ab, tsk);
1356	audit_log_key(ab, context->filterkey);
1357	audit_log_end(ab);
1358
1359	for (aux = context->aux; aux; aux = aux->next) {
1360
1361	ab = audit_log_start(context, GFP_KERNEL, aux->type);
1362	if (!ab)
1363	continue; /* audit_panic has been called */
1364
1365	switch (aux->type) {
1366
1367	case AUDIT_BPRM_FCAPS: {
1368	struct audit_aux_data_bprm_fcaps *axs = (void *)aux;
1369	audit_log_format(ab, "fver=%x", axs->fcap_ver);
1370	audit_log_cap(ab, "fp", &axs->fcap.permitted);
1371	audit_log_cap(ab, "fi", &axs->fcap.inheritable);
1372	audit_log_format(ab, " fe=%d", axs->fcap.fE);
1373	audit_log_cap(ab, "old_pp", &axs->old_pcap.permitted);
1374	audit_log_cap(ab, "old_pi", &axs->old_pcap.inheritable);
1375	audit_log_cap(ab, "old_pe", &axs->old_pcap.effective);
1376	audit_log_cap(ab, "new_pp", &axs->new_pcap.permitted);
1377	audit_log_cap(ab, "new_pi", &axs->new_pcap.inheritable);
1378	audit_log_cap(ab, "new_pe", &axs->new_pcap.effective);
1379	break; }
1380
1381	}
1382	audit_log_end(ab);
1383	}
1384
1385	if (context->type)
1386	show_special(context, &call_panic);
1387
1388	if (context->fds[0] >= 0) {
1389	ab = audit_log_start(context, GFP_KERNEL, AUDIT_FD_PAIR);
1390	if (ab) {
1391	audit_log_format(ab, "fd0=%d fd1=%d",
1392	context->fds[0], context->fds[1]);
1393	audit_log_end(ab);
1394	}
1395	}
1396
1397	if (context->sockaddr_len) {
1398	ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR);
1399	if (ab) {
1400	audit_log_format(ab, "saddr=");
1401	audit_log_n_hex(ab, (void *)context->sockaddr,
1402	context->sockaddr_len);
1403	audit_log_end(ab);
1404	}
1405	}
1406
1407	for (aux = context->aux_pids; aux; aux = aux->next) {
1408	struct audit_aux_data_pids *axs = (void *)aux;
1409
1410	for (i = 0; i < axs->pid_count; i++)
1411	if (audit_log_pid_context(context, axs->target_pid[i],
1412	axs->target_auid[i],
1413	axs->target_uid[i],
1414	axs->target_sessionid[i],
1415	axs->target_sid[i],
1416	axs->target_comm[i]))
1417	call_panic = 1;
1418	}
1419
1420	if (context->target_pid &&
1421	audit_log_pid_context(context, context->target_pid,
1422	context->target_auid, context->target_uid,
1423	context->target_sessionid,
1424	context->target_sid, context->target_comm))
1425	call_panic = 1;
1426
1427	if (context->pwd.dentry && context->pwd.mnt) {
1428	ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
1429	if (ab) {
1430	audit_log_d_path(ab, "cwd=", &context->pwd);
1431	audit_log_end(ab);
1432	}
1433	}
1434
1435	i = 0;
1436	list_for_each_entry(n, &context->names_list, list) {
1437	if (n->hidden)
1438	continue;
1439	audit_log_name(context, n, NULL, i++, &call_panic);
1440	}
1441
1442	audit_log_proctitle(tsk, context);
1443
1444	/* Send end of event record to help user space know we are finished */
1445	ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
1446	if (ab)
1447	audit_log_end(ab);
1448	if (call_panic)
1449	audit_panic("error converting sid to string");
1450	}
1451
1452	/**
1453	* audit_free - free a per-task audit context
1454	* @tsk: task whose audit context block to free
1455	*
1456	* Called from copy_process and do_exit
1457	*/
1458	void __audit_free(struct task_struct *tsk)
1459	{
1460	struct audit_context *context;
1461
1462	context = audit_take_context(tsk, 0, 0);
1463	if (!context)
1464	return;
1465
1466	/* Check for system calls that do not go through the exit
1467	* function (e.g., exit_group), then free context block.
1468	* We use GFP_ATOMIC here because we might be doing this
1469	* in the context of the idle thread */
1470	/* that can happen only if we are called from do_exit() */
1471	if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT)
1472	audit_log_exit(context, tsk);
1473	if (!list_empty(&context->killed_trees))
1474	audit_kill_trees(&context->killed_trees);
1475
1476	audit_free_context(context);
1477	}
1478
1479	/**
1480	* audit_syscall_entry - fill in an audit record at syscall entry
1481	* @major: major syscall type (function)
1482	* @a1: additional syscall register 1
1483	* @a2: additional syscall register 2
1484	* @a3: additional syscall register 3
1485	* @a4: additional syscall register 4
1486	*
1487	* Fill in audit context at syscall entry. This only happens if the
1488	* audit context was created when the task was created and the state or
1489	* filters demand the audit context be built. If the state from the
1490	* per-task filter or from the per-syscall filter is AUDIT_RECORD_CONTEXT,
1491	* then the record will be written at syscall exit time (otherwise, it
1492	* will only be written if another part of the kernel requests that it
1493	* be written).
1494	*/
1495	void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
1496	unsigned long a3, unsigned long a4)
1497	{
1498	struct task_struct *tsk = current;
1499	struct audit_context *context = tsk->audit_context;
1500	enum audit_state state;
1501
1502	if (!context)
1503	return;
1504
1505	BUG_ON(context->in_syscall || context->name_count);
1506
1507	if (!audit_enabled)
1508	return;
1509
1510	context->arch = syscall_get_arch();
1511	context->major = major;
1512	context->argv[0] = a1;
1513	context->argv[1] = a2;
1514	context->argv[2] = a3;
1515	context->argv[3] = a4;
1516
1517	state = context->state;
1518	context->dummy = !audit_n_rules;
1519	if (!context->dummy && state == AUDIT_BUILD_CONTEXT) {
1520	context->prio = 0;
1521	state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
1522	}
1523	if (state == AUDIT_DISABLED)
1524	return;
1525
1526	context->serial = 0;
1527	context->ctime = CURRENT_TIME;
1528	context->in_syscall = 1;
1529	context->current_state = state;
1530	context->ppid = 0;
1531	}
1532
1533	/**
1534	* audit_syscall_exit - deallocate audit context after a system call
1535	* @success: success value of the syscall
1536	* @return_code: return value of the syscall
1537	*
1538	* Tear down after system call. If the audit context has been marked as
1539	* auditable (either because of the AUDIT_RECORD_CONTEXT state from
1540	* filtering, or because some other part of the kernel wrote an audit
1541	* message), then write out the syscall information. In call cases,
1542	* free the names stored from getname().
1543	*/
1544	void __audit_syscall_exit(int success, long return_code)
1545	{
1546	struct task_struct *tsk = current;
1547	struct audit_context *context;
1548
1549	if (success)
1550	success = AUDITSC_SUCCESS;
1551	else
1552	success = AUDITSC_FAILURE;
1553
1554	context = audit_take_context(tsk, success, return_code);
1555	if (!context)
1556	return;
1557
1558	if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT)
1559	audit_log_exit(context, tsk);
1560
1561	context->in_syscall = 0;
1562	context->prio = context->state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;
1563
1564	if (!list_empty(&context->killed_trees))
1565	audit_kill_trees(&context->killed_trees);
1566
1567	audit_free_names(context);
1568	unroll_tree_refs(context, NULL, 0);
1569	audit_free_aux(context);
1570	context->aux = NULL;
1571	context->aux_pids = NULL;
1572	context->target_pid = 0;
1573	context->target_sid = 0;
1574	context->sockaddr_len = 0;
1575	context->type = 0;
1576	context->fds[0] = -1;
1577	if (context->state != AUDIT_RECORD_CONTEXT) {
1578	kfree(context->filterkey);
1579	context->filterkey = NULL;
1580	}
1581	tsk->audit_context = context;
1582	}
1583
1584	static inline void handle_one(const struct inode *inode)
1585	{
1586	#ifdef CONFIG_AUDIT_TREE
1587	struct audit_context *context;
1588	struct audit_tree_refs *p;
1589	struct audit_chunk *chunk;
1590	int count;
1591	if (likely(hlist_empty(&inode->i_fsnotify_marks)))
1592	return;
1593	context = current->audit_context;
1594	p = context->trees;
1595	count = context->tree_count;
1596	rcu_read_lock();
1597	chunk = audit_tree_lookup(inode);
1598	rcu_read_unlock();
1599	if (!chunk)
1600	return;
1601	if (likely(put_tree_ref(context, chunk)))
1602	return;
1603	if (unlikely(!grow_tree_refs(context))) {
1604	pr_warn("out of memory, audit has lost a tree reference\n");
1605	audit_set_auditable(context);
1606	audit_put_chunk(chunk);
1607	unroll_tree_refs(context, p, count);
1608	return;
1609	}
1610	put_tree_ref(context, chunk);
1611	#endif
1612	}
1613
1614	static void handle_path(const struct dentry *dentry)
1615	{
1616	#ifdef CONFIG_AUDIT_TREE
1617	struct audit_context *context;
1618	struct audit_tree_refs *p;
1619	const struct dentry *d, *parent;
1620	struct audit_chunk *drop;
1621	unsigned long seq;
1622	int count;
1623
1624	context = current->audit_context;
1625	p = context->trees;
1626	count = context->tree_count;
1627	retry:
1628	drop = NULL;
1629	d = dentry;
1630	rcu_read_lock();
1631	seq = read_seqbegin(&rename_lock);
1632	for(;;) {
1633	struct inode *inode = d_backing_inode(d);
1634	if (inode && unlikely(!hlist_empty(&inode->i_fsnotify_marks))) {
1635	struct audit_chunk *chunk;
1636	chunk = audit_tree_lookup(inode);
1637	if (chunk) {
1638	if (unlikely(!put_tree_ref(context, chunk))) {
1639	drop = chunk;
1640	break;
1641	}
1642	}
1643	}
1644	parent = d->d_parent;
1645	if (parent == d)
1646	break;
1647	d = parent;
1648	}
1649	if (unlikely(read_seqretry(&rename_lock, seq) || drop)) { /* in this order */
1650	rcu_read_unlock();
1651	if (!drop) {
1652	/* just a race with rename */
1653	unroll_tree_refs(context, p, count);
1654	goto retry;
1655	}
1656	audit_put_chunk(drop);
1657	if (grow_tree_refs(context)) {
1658	/* OK, got more space */
1659	unroll_tree_refs(context, p, count);
1660	goto retry;
1661	}
1662	/* too bad */
1663	pr_warn("out of memory, audit has lost a tree reference\n");
1664	unroll_tree_refs(context, p, count);
1665	audit_set_auditable(context);
1666	return;
1667	}
1668	rcu_read_unlock();
1669	#endif
1670	}
1671
1672	static struct audit_names *audit_alloc_name(struct audit_context *context,
1673	unsigned char type)
1674	{
1675	struct audit_names *aname;
1676
1677	if (context->name_count < AUDIT_NAMES) {
1678	aname = &context->preallocated_names[context->name_count];
1679	memset(aname, 0, sizeof(*aname));
1680	} else {
1681	aname = kzalloc(sizeof(*aname), GFP_NOFS);
1682	if (!aname)
1683	return NULL;
1684	aname->should_free = true;
1685	}
1686
1687	aname->ino = AUDIT_INO_UNSET;
1688	aname->type = type;
1689	list_add_tail(&aname->list, &context->names_list);
1690
1691	context->name_count++;
1692	return aname;
1693	}
1694
1695	/**
1696	* audit_reusename - fill out filename with info from existing entry
1697	* @uptr: userland ptr to pathname
1698	*
1699	* Search the audit_names list for the current audit context. If there is an
1700	* existing entry with a matching "uptr" then return the filename
1701	* associated with that audit_name. If not, return NULL.
1702	*/
1703	struct filename *
1704	__audit_reusename(const __user char *uptr)
1705	{
1706	struct audit_context *context = current->audit_context;
1707	struct audit_names *n;
1708
1709	list_for_each_entry(n, &context->names_list, list) {
1710	if (!n->name)
1711	continue;
1712	if (n->name->uptr == uptr) {
1713	n->name->refcnt++;
1714	return n->name;
1715	}
1716	}
1717	return NULL;
1718	}
1719
1720	/**
1721	* audit_getname - add a name to the list
1722	* @name: name to add
1723	*
1724	* Add a name to the list of audit names for this context.
1725	* Called from fs/namei.c:getname().
1726	*/
1727	void __audit_getname(struct filename *name)
1728	{
1729	struct audit_context *context = current->audit_context;
1730	struct audit_names *n;
1731
1732	if (!context->in_syscall)
1733	return;
1734
1735	n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
1736	if (!n)
1737	return;
1738
1739	n->name = name;
1740	n->name_len = AUDIT_NAME_FULL;
1741	name->aname = n;
1742	name->refcnt++;
1743
1744	if (!context->pwd.dentry)
1745	get_fs_pwd(current->fs, &context->pwd);
1746	}
1747
1748	/**
1749	* __audit_inode - store the inode and device from a lookup
1750	* @name: name being audited
1751	* @dentry: dentry being audited
1752	* @flags: attributes for this particular entry
1753	*/
1754	void __audit_inode(struct filename *name, const struct dentry *dentry,
1755	unsigned int flags)
1756	{
1757	struct audit_context *context = current->audit_context;
1758	struct inode *inode = d_backing_inode(dentry);
1759	struct audit_names *n;
1760	bool parent = flags & AUDIT_INODE_PARENT;
1761
1762	if (!context->in_syscall)
1763	return;
1764
1765	if (!name)
1766	goto out_alloc;
1767
1768	/*
1769	* If we have a pointer to an audit_names entry already, then we can
1770	* just use it directly if the type is correct.
1771	*/
1772	n = name->aname;
1773	if (n) {
1774	if (parent) {
1775	if (n->type == AUDIT_TYPE_PARENT ||
1776	n->type == AUDIT_TYPE_UNKNOWN)
1777	goto out;
1778	} else {
1779	if (n->type != AUDIT_TYPE_PARENT)
1780	goto out;
1781	}
1782	}
1783
1784	list_for_each_entry_reverse(n, &context->names_list, list) {
1785	if (n->ino) {
1786	/* valid inode number, use that for the comparison */
1787	if (n->ino != inode->i_ino ||
1788	n->dev != inode->i_sb->s_dev)
1789	continue;
1790	} else if (n->name) {
1791	/* inode number has not been set, check the name */
1792	if (strcmp(n->name->name, name->name))
1793	continue;
1794	} else
1795	/* no inode and no name (?!) ... this is odd ... */
1796	continue;
1797
1798	/* match the correct record type */
1799	if (parent) {
1800	if (n->type == AUDIT_TYPE_PARENT ||
1801	n->type == AUDIT_TYPE_UNKNOWN)
1802	goto out;
1803	} else {
1804	if (n->type != AUDIT_TYPE_PARENT)
1805	goto out;
1806	}
1807	}
1808
1809	out_alloc:
1810	/* unable to find an entry with both a matching name and type */
1811	n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
1812	if (!n)
1813	return;
1814	if (name) {
1815	n->name = name;
1816	name->refcnt++;
1817	}
1818
1819	out:
1820	if (parent) {
1821	n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;
1822	n->type = AUDIT_TYPE_PARENT;
1823	if (flags & AUDIT_INODE_HIDDEN)
1824	n->hidden = true;
1825	} else {
1826	n->name_len = AUDIT_NAME_FULL;
1827	n->type = AUDIT_TYPE_NORMAL;
1828	}
1829	handle_path(dentry);
1830	audit_copy_inode(n, dentry, inode);
1831	}
1832
1833	void __audit_file(const struct file *file)
1834	{
1835	__audit_inode(NULL, file->f_path.dentry, 0);
1836	}
1837
1838	/**
1839	* __audit_inode_child - collect inode info for created/removed objects
1840	* @parent: inode of dentry parent
1841	* @dentry: dentry being audited
1842	* @type: AUDIT_TYPE_* value that we're looking for
1843	*
1844	* For syscalls that create or remove filesystem objects, audit_inode
1845	* can only collect information for the filesystem object's parent.
1846	* This call updates the audit context with the child's information.
1847	* Syscalls that create a new filesystem object must be hooked after
1848	* the object is created. Syscalls that remove a filesystem object
1849	* must be hooked prior, in order to capture the target inode during
1850	* unsuccessful attempts.
1851	*/
1852	void __audit_inode_child(struct inode *parent,
1853	const struct dentry *dentry,
1854	const unsigned char type)
1855	{
1856	struct audit_context *context = current->audit_context;
1857	struct inode *inode = d_backing_inode(dentry);
1858	const char *dname = dentry->d_name.name;
1859	struct audit_names *n, *found_parent = NULL, *found_child = NULL;
1860
1861	if (!context->in_syscall)
1862	return;
1863
1864	if (inode)
1865	handle_one(inode);
1866
1867	/* look for a parent entry first */
1868	list_for_each_entry(n, &context->names_list, list) {
1869	if (!n->name ||
1870	(n->type != AUDIT_TYPE_PARENT &&
1871	n->type != AUDIT_TYPE_UNKNOWN))
1872	continue;
1873
1874	if (n->ino == parent->i_ino && n->dev == parent->i_sb->s_dev &&
1875	!audit_compare_dname_path(dname,
1876	n->name->name, n->name_len)) {
1877	if (n->type == AUDIT_TYPE_UNKNOWN)
1878	n->type = AUDIT_TYPE_PARENT;
1879	found_parent = n;
1880	break;
1881	}
1882	}
1883
1884	/* is there a matching child entry? */
1885	list_for_each_entry(n, &context->names_list, list) {
1886	/* can only match entries that have a name */
1887	if (!n->name ||
1888	(n->type != type && n->type != AUDIT_TYPE_UNKNOWN))
1889	continue;
1890
1891	if (!strcmp(dname, n->name->name) ||
1892	!audit_compare_dname_path(dname, n->name->name,
1893	found_parent ?
1894	found_parent->name_len :
1895	AUDIT_NAME_FULL)) {
1896	if (n->type == AUDIT_TYPE_UNKNOWN)
1897	n->type = type;
1898	found_child = n;
1899	break;
1900	}
1901	}
1902
1903	if (!found_parent) {
1904	/* create a new, "anonymous" parent record */
1905	n = audit_alloc_name(context, AUDIT_TYPE_PARENT);
1906	if (!n)
1907	return;
1908	audit_copy_inode(n, NULL, parent);
1909	}
1910
1911	if (!found_child) {
1912	found_child = audit_alloc_name(context, type);
1913	if (!found_child)
1914	return;
1915
1916	/* Re-use the name belonging to the slot for a matching parent
1917	* directory. All names for this context are relinquished in
1918	* audit_free_names() */
1919	if (found_parent) {
1920	found_child->name = found_parent->name;
1921	found_child->name_len = AUDIT_NAME_FULL;
1922	found_child->name->refcnt++;
1923	}
1924	}
1925
1926	if (inode)
1927	audit_copy_inode(found_child, dentry, inode);
1928	else
1929	found_child->ino = AUDIT_INO_UNSET;
1930	}
1931	EXPORT_SYMBOL_GPL(__audit_inode_child);
1932
1933	/**
1934	* auditsc_get_stamp - get local copies of audit_context values
1935	* @ctx: audit_context for the task
1936	* @t: timespec to store time recorded in the audit_context
1937	* @serial: serial value that is recorded in the audit_context
1938	*
1939	* Also sets the context as auditable.
1940	*/
1941	int auditsc_get_stamp(struct audit_context *ctx,
1942	struct timespec *t, unsigned int *serial)
1943	{
1944	if (!ctx->in_syscall)
1945	return 0;
1946	if (!ctx->serial)
1947	ctx->serial = audit_serial();
1948	t->tv_sec = ctx->ctime.tv_sec;
1949	t->tv_nsec = ctx->ctime.tv_nsec;
1950	*serial = ctx->serial;
1951	if (!ctx->prio) {
1952	ctx->prio = 1;
1953	ctx->current_state = AUDIT_RECORD_CONTEXT;
1954	}
1955	return 1;
1956	}
1957
1958	/* global counter which is incremented every time something logs in */
1959	static atomic_t session_id = ATOMIC_INIT(0);
1960
1961	static int audit_set_loginuid_perm(kuid_t loginuid)
1962	{
1963	/* if we are unset, we don't need privs */
1964	if (!audit_loginuid_set(current))
1965	return 0;
1966	/* if AUDIT_FEATURE_LOGINUID_IMMUTABLE means never ever allow a change*/
1967	if (is_audit_feature_set(AUDIT_FEATURE_LOGINUID_IMMUTABLE))
1968	return -EPERM;
1969	/* it is set, you need permission */
1970	if (!capable(CAP_AUDIT_CONTROL))
1971	return -EPERM;
1972	/* reject if this is not an unset and we don't allow that */
1973	if (is_audit_feature_set(AUDIT_FEATURE_ONLY_UNSET_LOGINUID) && uid_valid(loginuid))
1974	return -EPERM;
1975	return 0;
1976	}
1977
1978	static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid,
1979	unsigned int oldsessionid, unsigned int sessionid,
1980	int rc)
1981	{
1982	struct audit_buffer *ab;
1983	uid_t uid, oldloginuid, loginuid;
1984	struct tty_struct *tty;
1985
1986	if (!audit_enabled)
1987	return;
1988
1989	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
1990	if (!ab)
1991	return;
1992
1993	uid = from_kuid(&init_user_ns, task_uid(current));
1994	oldloginuid = from_kuid(&init_user_ns, koldloginuid);
1995	loginuid = from_kuid(&init_user_ns, kloginuid),
1996	tty = audit_get_tty(current);
1997
1998	audit_log_format(ab, "pid=%d uid=%u", task_tgid_nr(current), uid);
1999	audit_log_task_context(ab);
2000	audit_log_format(ab, " old-auid=%u auid=%u tty=%s old-ses=%u ses=%u res=%d",
2001	oldloginuid, loginuid, tty ? tty_name(tty) : "(none)",
2002	oldsessionid, sessionid, !rc);
2003	audit_put_tty(tty);
2004	audit_log_end(ab);
2005	}
2006
2007	/**
2008	* audit_set_loginuid - set current task's audit_context loginuid
2009	* @loginuid: loginuid value
2010	*
2011	* Returns 0.
2012	*
2013	* Called (set) from fs/proc/base.c::proc_loginuid_write().
2014	*/
2015	int audit_set_loginuid(kuid_t loginuid)
2016	{
2017	struct task_struct *task = current;
2018	unsigned int oldsessionid, sessionid = (unsigned int)-1;
2019	kuid_t oldloginuid;
2020	int rc;
2021
2022	oldloginuid = audit_get_loginuid(current);
2023	oldsessionid = audit_get_sessionid(current);
2024
2025	rc = audit_set_loginuid_perm(loginuid);
2026	if (rc)
2027	goto out;
2028
2029	/* are we setting or clearing? */
2030	if (uid_valid(loginuid))
2031	sessionid = (unsigned int)atomic_inc_return(&session_id);
2032
2033	task->sessionid = sessionid;
2034	task->loginuid = loginuid;
2035	out:
2036	audit_log_set_loginuid(oldloginuid, loginuid, oldsessionid, sessionid, rc);
2037	return rc;
2038	}
2039
2040	/**
2041	* __audit_mq_open - record audit data for a POSIX MQ open
2042	* @oflag: open flag
2043	* @mode: mode bits
2044	* @attr: queue attributes
2045	*
2046	*/
2047	void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
2048	{
2049	struct audit_context *context = current->audit_context;
2050
2051	if (attr)
2052	memcpy(&context->mq_open.attr, attr, sizeof(struct mq_attr));
2053	else
2054	memset(&context->mq_open.attr, 0, sizeof(struct mq_attr));
2055
2056	context->mq_open.oflag = oflag;
2057	context->mq_open.mode = mode;
2058
2059	context->type = AUDIT_MQ_OPEN;
2060	}
2061
2062	/**
2063	* __audit_mq_sendrecv - record audit data for a POSIX MQ timed send/receive
2064	* @mqdes: MQ descriptor
2065	* @msg_len: Message length
2066	* @msg_prio: Message priority
2067	* @abs_timeout: Message timeout in absolute time
2068	*
2069	*/
2070	void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio,
2071	const struct timespec *abs_timeout)
2072	{
2073	struct audit_context *context = current->audit_context;
2074	struct timespec *p = &context->mq_sendrecv.abs_timeout;
2075
2076	if (abs_timeout)
2077	memcpy(p, abs_timeout, sizeof(struct timespec));
2078	else
2079	memset(p, 0, sizeof(struct timespec));
2080
2081	context->mq_sendrecv.mqdes = mqdes;
2082	context->mq_sendrecv.msg_len = msg_len;
2083	context->mq_sendrecv.msg_prio = msg_prio;
2084
2085	context->type = AUDIT_MQ_SENDRECV;
2086	}
2087
2088	/**
2089	* __audit_mq_notify - record audit data for a POSIX MQ notify
2090	* @mqdes: MQ descriptor
2091	* @notification: Notification event
2092	*
2093	*/
2094
2095	void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
2096	{
2097	struct audit_context *context = current->audit_context;
2098
2099	if (notification)
2100	context->mq_notify.sigev_signo = notification->sigev_signo;
2101	else
2102	context->mq_notify.sigev_signo = 0;
2103
2104	context->mq_notify.mqdes = mqdes;
2105	context->type = AUDIT_MQ_NOTIFY;
2106	}
2107
2108	/**
2109	* __audit_mq_getsetattr - record audit data for a POSIX MQ get/set attribute
2110	* @mqdes: MQ descriptor
2111	* @mqstat: MQ flags
2112	*
2113	*/
2114	void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
2115	{
2116	struct audit_context *context = current->audit_context;
2117	context->mq_getsetattr.mqdes = mqdes;
2118	context->mq_getsetattr.mqstat = *mqstat;
2119	context->type = AUDIT_MQ_GETSETATTR;
2120	}
2121
2122	/**
2123	* audit_ipc_obj - record audit data for ipc object
2124	* @ipcp: ipc permissions
2125	*
2126	*/
2127	void __audit_ipc_obj(struct kern_ipc_perm *ipcp)
2128	{
2129	struct audit_context *context = current->audit_context;
2130	context->ipc.uid = ipcp->uid;
2131	context->ipc.gid = ipcp->gid;
2132	context->ipc.mode = ipcp->mode;
2133	context->ipc.has_perm = 0;
2134	security_ipc_getsecid(ipcp, &context->ipc.osid);
2135	context->type = AUDIT_IPC;
2136	}
2137
2138	/**
2139	* audit_ipc_set_perm - record audit data for new ipc permissions
2140	* @qbytes: msgq bytes
2141	* @uid: msgq user id
2142	* @gid: msgq group id
2143	* @mode: msgq mode (permissions)
2144	*
2145	* Called only after audit_ipc_obj().
2146	*/
2147	void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode)
2148	{
2149	struct audit_context *context = current->audit_context;
2150
2151	context->ipc.qbytes = qbytes;
2152	context->ipc.perm_uid = uid;
2153	context->ipc.perm_gid = gid;
2154	context->ipc.perm_mode = mode;
2155	context->ipc.has_perm = 1;
2156	}
2157
2158	void __audit_bprm(struct linux_binprm *bprm)
2159	{
2160	struct audit_context *context = current->audit_context;
2161
2162	context->type = AUDIT_EXECVE;
2163	context->execve.argc = bprm->argc;
2164	}
2165
2166
2167	/**
2168	* audit_socketcall - record audit data for sys_socketcall
2169	* @nargs: number of args, which should not be more than AUDITSC_ARGS.
2170	* @args: args array
2171	*
2172	*/
2173	int __audit_socketcall(int nargs, unsigned long *args)
2174	{
2175	struct audit_context *context = current->audit_context;
2176
2177	if (nargs <= 0 || nargs > AUDITSC_ARGS || !args)
2178	return -EINVAL;
2179	context->type = AUDIT_SOCKETCALL;
2180	context->socketcall.nargs = nargs;
2181	memcpy(context->socketcall.args, args, nargs * sizeof(unsigned long));
2182	return 0;
2183	}
2184
2185	/**
2186	* __audit_fd_pair - record audit data for pipe and socketpair
2187	* @fd1: the first file descriptor
2188	* @fd2: the second file descriptor
2189	*
2190	*/
2191	void __audit_fd_pair(int fd1, int fd2)
2192	{
2193	struct audit_context *context = current->audit_context;
2194	context->fds[0] = fd1;
2195	context->fds[1] = fd2;
2196	}
2197
2198	/**
2199	* audit_sockaddr - record audit data for sys_bind, sys_connect, sys_sendto
2200	* @len: data length in user space
2201	* @a: data address in kernel space
2202	*
2203	* Returns 0 for success or NULL context or < 0 on error.
2204	*/
2205	int __audit_sockaddr(int len, void *a)
2206	{
2207	struct audit_context *context = current->audit_context;
2208
2209	if (!context->sockaddr) {
2210	void *p = kmalloc(sizeof(struct sockaddr_storage), GFP_KERNEL);
2211	if (!p)
2212	return -ENOMEM;
2213	context->sockaddr = p;
2214	}
2215
2216	context->sockaddr_len = len;
2217	memcpy(context->sockaddr, a, len);
2218	return 0;
2219	}
2220
2221	void __audit_ptrace(struct task_struct *t)
2222	{
2223	struct audit_context *context = current->audit_context;
2224
2225	context->target_pid = task_tgid_nr(t);
2226	context->target_auid = audit_get_loginuid(t);
2227	context->target_uid = task_uid(t);
2228	context->target_sessionid = audit_get_sessionid(t);
2229	security_task_getsecid(t, &context->target_sid);
2230	memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
2231	}
2232
2233	/**
2234	* audit_signal_info - record signal info for shutting down audit subsystem
2235	* @sig: signal value
2236	* @t: task being signaled
2237	*
2238	* If the audit subsystem is being terminated, record the task (pid)
2239	* and uid that is doing that.
2240	*/
2241	int __audit_signal_info(int sig, struct task_struct *t)
2242	{
2243	struct audit_aux_data_pids *axp;
2244	struct task_struct *tsk = current;
2245	struct audit_context *ctx = tsk->audit_context;
2246	kuid_t uid = current_uid(), t_uid = task_uid(t);
2247
2248	if (audit_pid && t->tgid == audit_pid) {
2249	if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1 || sig == SIGUSR2) {
2250	audit_sig_pid = task_tgid_nr(tsk);
2251	if (uid_valid(tsk->loginuid))
2252	audit_sig_uid = tsk->loginuid;
2253	else
2254	audit_sig_uid = uid;
2255	security_task_getsecid(tsk, &audit_sig_sid);
2256	}
2257	if (!audit_signals || audit_dummy_context())
2258	return 0;
2259	}
2260
2261	/* optimize the common case by putting first signal recipient directly
2262	* in audit_context */
2263	if (!ctx->target_pid) {
2264	ctx->target_pid = task_tgid_nr(t);
2265	ctx->target_auid = audit_get_loginuid(t);
2266	ctx->target_uid = t_uid;
2267	ctx->target_sessionid = audit_get_sessionid(t);
2268	security_task_getsecid(t, &ctx->target_sid);
2269	memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
2270	return 0;
2271	}
2272
2273	axp = (void *)ctx->aux_pids;
2274	if (!axp || axp->pid_count == AUDIT_AUX_PIDS) {
2275	axp = kzalloc(sizeof(*axp), GFP_ATOMIC);
2276	if (!axp)
2277	return -ENOMEM;
2278
2279	axp->d.type = AUDIT_OBJ_PID;
2280	axp->d.next = ctx->aux_pids;
2281	ctx->aux_pids = (void *)axp;
2282	}
2283	BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
2284
2285	axp->target_pid[axp->pid_count] = task_tgid_nr(t);
2286	axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
2287	axp->target_uid[axp->pid_count] = t_uid;
2288	axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t);
2289	security_task_getsecid(t, &axp->target_sid[axp->pid_count]);
2290	memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
2291	axp->pid_count++;
2292
2293	return 0;
2294	}
2295
2296	/**
2297	* __audit_log_bprm_fcaps - store information about a loading bprm and relevant fcaps
2298	* @bprm: pointer to the bprm being processed
2299	* @new: the proposed new credentials
2300	* @old: the old credentials
2301	*
2302	* Simply check if the proc already has the caps given by the file and if not
2303	* store the priv escalation info for later auditing at the end of the syscall
2304	*
2305	* -Eric
2306	*/
2307	int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
2308	const struct cred *new, const struct cred *old)
2309	{
2310	struct audit_aux_data_bprm_fcaps *ax;
2311	struct audit_context *context = current->audit_context;
2312	struct cpu_vfs_cap_data vcaps;
2313
2314	ax = kmalloc(sizeof(*ax), GFP_KERNEL);
2315	if (!ax)
2316	return -ENOMEM;
2317
2318	ax->d.type = AUDIT_BPRM_FCAPS;
2319	ax->d.next = context->aux;
2320	context->aux = (void *)ax;
2321
2322	get_vfs_caps_from_disk(bprm->file->f_path.dentry, &vcaps);
2323
2324	ax->fcap.permitted = vcaps.permitted;
2325	ax->fcap.inheritable = vcaps.inheritable;
2326	ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
2327	ax->fcap_ver = (vcaps.magic_etc & VFS_CAP_REVISION_MASK) >> VFS_CAP_REVISION_SHIFT;
2328
2329	ax->old_pcap.permitted = old->cap_permitted;
2330	ax->old_pcap.inheritable = old->cap_inheritable;
2331	ax->old_pcap.effective = old->cap_effective;
2332
2333	ax->new_pcap.permitted = new->cap_permitted;
2334	ax->new_pcap.inheritable = new->cap_inheritable;
2335	ax->new_pcap.effective = new->cap_effective;
2336	return 0;
2337	}
2338
2339	/**
2340	* __audit_log_capset - store information about the arguments to the capset syscall
2341	* @new: the new credentials
2342	* @old: the old (current) credentials
2343	*
2344	* Record the arguments userspace sent to sys_capset for later printing by the
2345	* audit system if applicable
2346	*/
2347	void __audit_log_capset(const struct cred *new, const struct cred *old)
2348	{
2349	struct audit_context *context = current->audit_context;
2350	context->capset.pid = task_tgid_nr(current);
2351	context->capset.cap.effective = new->cap_effective;
2352	context->capset.cap.inheritable = new->cap_effective;
2353	context->capset.cap.permitted = new->cap_permitted;
2354	context->type = AUDIT_CAPSET;
2355	}
2356
2357	void __audit_mmap_fd(int fd, int flags)
2358	{
2359	struct audit_context *context = current->audit_context;
2360	context->mmap.fd = fd;
2361	context->mmap.flags = flags;
2362	context->type = AUDIT_MMAP;
2363	}
2364
2365	static void audit_log_task(struct audit_buffer *ab)
2366	{
2367	kuid_t auid, uid;
2368	kgid_t gid;
2369	unsigned int sessionid;
2370	char comm[sizeof(current->comm)];
2371
2372	auid = audit_get_loginuid(current);
2373	sessionid = audit_get_sessionid(current);
2374	current_uid_gid(&uid, &gid);
2375
2376	audit_log_format(ab, "auid=%u uid=%u gid=%u ses=%u",
2377	from_kuid(&init_user_ns, auid),
2378	from_kuid(&init_user_ns, uid),
2379	from_kgid(&init_user_ns, gid),
2380	sessionid);
2381	audit_log_task_context(ab);
2382	audit_log_format(ab, " pid=%d comm=", task_tgid_nr(current));
2383	audit_log_untrustedstring(ab, get_task_comm(comm, current));
2384	audit_log_d_path_exe(ab, current->mm);
2385	}
2386
2387	/**
2388	* audit_core_dumps - record information about processes that end abnormally
2389	* @signr: signal value
2390	*
2391	* If a process ends with a core dump, something fishy is going on and we
2392	* should record the event for investigation.
2393	*/
2394	void audit_core_dumps(long signr)
2395	{
2396	struct audit_buffer *ab;
2397
2398	if (!audit_enabled)
2399	return;
2400
2401	if (signr == SIGQUIT) /* don't care for those */
2402	return;
2403
2404	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
2405	if (unlikely(!ab))
2406	return;
2407	audit_log_task(ab);
2408	audit_log_format(ab, " sig=%ld", signr);
2409	audit_log_end(ab);
2410	}
2411
2412	void __audit_seccomp(unsigned long syscall, long signr, int code)
2413	{
2414	struct audit_buffer *ab;
2415
2416	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_SECCOMP);
2417	if (unlikely(!ab))
2418	return;
2419	audit_log_task(ab);
2420	audit_log_format(ab, " sig=%ld arch=%x syscall=%ld compat=%d ip=0x%lx code=0x%x",
2421	signr, syscall_get_arch(), syscall,
2422	in_compat_syscall(), KSTK_EIP(current), code);
2423	audit_log_end(ab);
2424	}
2425
2426	struct list_head *audit_killed_trees(void)
2427	{
2428	struct audit_context *ctx = current->audit_context;
2429	if (likely(!ctx || !ctx->in_syscall))
2430	return NULL;
2431	return &ctx->killed_trees;
2432	}
2433