blob: 6953dc82850cb278fd99da209e560021d4d0c1e8 [file] [log] [blame]
Miloslav Trmac522ed772007-07-15 23:40:56 -07001/*
2 * Creating audit events from TTY input.
3 *
4 * Copyright (C) 2007 Red Hat, Inc. All rights reserved. This copyrighted
5 * material is made available to anyone wishing to use, modify, copy, or
6 * redistribute it subject to the terms and conditions of the GNU General
7 * Public License v.2.
8 *
9 * Authors: Miloslav Trmac <mitr@redhat.com>
10 */
11
12#include <linux/audit.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090013#include <linux/slab.h>
Miloslav Trmac522ed772007-07-15 23:40:56 -070014#include <linux/tty.h>
15
16struct tty_audit_buf {
17 atomic_t count;
18 struct mutex mutex; /* Protects all data below */
19 int major, minor; /* The TTY which the data is from */
20 unsigned icanon:1;
21 size_t valid;
22 unsigned char *data; /* Allocated size N_TTY_BUF_SIZE */
23};
24
25static struct tty_audit_buf *tty_audit_buf_alloc(int major, int minor,
Jiri Slaby6c633f22012-10-18 22:26:37 +020026 unsigned icanon)
Miloslav Trmac522ed772007-07-15 23:40:56 -070027{
28 struct tty_audit_buf *buf;
29
Alan Cox66c6cea2008-02-08 04:18:46 -080030 buf = kmalloc(sizeof(*buf), GFP_KERNEL);
Miloslav Trmac522ed772007-07-15 23:40:56 -070031 if (!buf)
32 goto err;
Alan Coxc481c702009-06-11 13:04:27 +010033 buf->data = kmalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
Miloslav Trmac522ed772007-07-15 23:40:56 -070034 if (!buf->data)
35 goto err_buf;
36 atomic_set(&buf->count, 1);
37 mutex_init(&buf->mutex);
38 buf->major = major;
39 buf->minor = minor;
40 buf->icanon = icanon;
41 buf->valid = 0;
42 return buf;
43
44err_buf:
45 kfree(buf);
46err:
47 return NULL;
48}
49
50static void tty_audit_buf_free(struct tty_audit_buf *buf)
51{
52 WARN_ON(buf->valid != 0);
Alan Coxc481c702009-06-11 13:04:27 +010053 kfree(buf->data);
Miloslav Trmac522ed772007-07-15 23:40:56 -070054 kfree(buf);
55}
56
57static void tty_audit_buf_put(struct tty_audit_buf *buf)
58{
59 if (atomic_dec_and_test(&buf->count))
60 tty_audit_buf_free(buf);
61}
62
Al Viro1e641742008-12-09 09:23:33 +000063static void tty_audit_log(const char *description, struct task_struct *tsk,
Eric W. Biedermane1760bd2012-09-10 22:39:43 -070064 kuid_t loginuid, unsigned sessionid, int major,
Al Viro1e641742008-12-09 09:23:33 +000065 int minor, unsigned char *data, size_t size)
66{
67 struct audit_buffer *ab;
68
69 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY);
70 if (ab) {
71 char name[sizeof(tsk->comm)];
Eric W. Biedermancca080d2012-02-07 16:53:48 -080072 kuid_t uid = task_uid(tsk);
Al Viro1e641742008-12-09 09:23:33 +000073
74 audit_log_format(ab, "%s pid=%u uid=%u auid=%u ses=%u "
75 "major=%d minor=%d comm=", description,
Eric W. Biedermancca080d2012-02-07 16:53:48 -080076 tsk->pid,
77 from_kuid(&init_user_ns, uid),
Eric W. Biedermane1760bd2012-09-10 22:39:43 -070078 from_kuid(&init_user_ns, loginuid),
79 sessionid,
Al Viro1e641742008-12-09 09:23:33 +000080 major, minor);
81 get_task_comm(name, tsk);
82 audit_log_untrustedstring(ab, name);
83 audit_log_format(ab, " data=");
84 audit_log_n_hex(ab, data, size);
85 audit_log_end(ab);
86 }
87}
88
Miloslav Trmac522ed772007-07-15 23:40:56 -070089/**
90 * tty_audit_buf_push - Push buffered data out
91 *
92 * Generate an audit message from the contents of @buf, which is owned by
93 * @tsk with @loginuid. @buf->mutex must be locked.
94 */
Eric W. Biedermane1760bd2012-09-10 22:39:43 -070095static void tty_audit_buf_push(struct task_struct *tsk, kuid_t loginuid,
Eric Paris4746ec52008-01-08 10:06:53 -050096 unsigned int sessionid,
Miloslav Trmac522ed772007-07-15 23:40:56 -070097 struct tty_audit_buf *buf)
98{
Miloslav Trmac522ed772007-07-15 23:40:56 -070099 if (buf->valid == 0)
100 return;
Xiaotian Feng00bff392011-03-03 18:08:24 +0800101 if (audit_enabled == 0) {
102 buf->valid = 0;
Miloslav Trmac522ed772007-07-15 23:40:56 -0700103 return;
Xiaotian Feng00bff392011-03-03 18:08:24 +0800104 }
Al Viro1e641742008-12-09 09:23:33 +0000105 tty_audit_log("tty", tsk, loginuid, sessionid, buf->major, buf->minor,
106 buf->data, buf->valid);
Miloslav Trmac522ed772007-07-15 23:40:56 -0700107 buf->valid = 0;
108}
109
110/**
111 * tty_audit_buf_push_current - Push buffered data out
112 *
113 * Generate an audit message from the contents of @buf, which is owned by
114 * the current task. @buf->mutex must be locked.
115 */
116static void tty_audit_buf_push_current(struct tty_audit_buf *buf)
117{
Eric W. Biedermane1760bd2012-09-10 22:39:43 -0700118 kuid_t auid = audit_get_loginuid(current);
Eric Paris4746ec52008-01-08 10:06:53 -0500119 unsigned int sessionid = audit_get_sessionid(current);
120 tty_audit_buf_push(current, auid, sessionid, buf);
Miloslav Trmac522ed772007-07-15 23:40:56 -0700121}
122
123/**
124 * tty_audit_exit - Handle a task exit
125 *
126 * Make sure all buffered data is written out and deallocate the buffer.
127 * Only needs to be called if current->signal->tty_audit_buf != %NULL.
128 */
129void tty_audit_exit(void)
130{
131 struct tty_audit_buf *buf;
132
133 spin_lock_irq(&current->sighand->siglock);
134 buf = current->signal->tty_audit_buf;
135 current->signal->tty_audit_buf = NULL;
136 spin_unlock_irq(&current->sighand->siglock);
137 if (!buf)
138 return;
139
140 mutex_lock(&buf->mutex);
141 tty_audit_buf_push_current(buf);
142 mutex_unlock(&buf->mutex);
143
144 tty_audit_buf_put(buf);
145}
146
147/**
148 * tty_audit_fork - Copy TTY audit state for a new task
149 *
150 * Set up TTY audit state in @sig from current. @sig needs no locking.
151 */
152void tty_audit_fork(struct signal_struct *sig)
153{
154 spin_lock_irq(&current->sighand->siglock);
155 sig->audit_tty = current->signal->audit_tty;
156 spin_unlock_irq(&current->sighand->siglock);
Miloslav Trmac522ed772007-07-15 23:40:56 -0700157}
158
159/**
Al Viro1e641742008-12-09 09:23:33 +0000160 * tty_audit_tiocsti - Log TIOCSTI
161 */
162void tty_audit_tiocsti(struct tty_struct *tty, char ch)
163{
164 struct tty_audit_buf *buf;
165 int major, minor, should_audit;
166
167 spin_lock_irq(&current->sighand->siglock);
168 should_audit = current->signal->audit_tty;
169 buf = current->signal->tty_audit_buf;
170 if (buf)
171 atomic_inc(&buf->count);
172 spin_unlock_irq(&current->sighand->siglock);
173
174 major = tty->driver->major;
175 minor = tty->driver->minor_start + tty->index;
176 if (buf) {
177 mutex_lock(&buf->mutex);
178 if (buf->major == major && buf->minor == minor)
179 tty_audit_buf_push_current(buf);
180 mutex_unlock(&buf->mutex);
181 tty_audit_buf_put(buf);
182 }
183
184 if (should_audit && audit_enabled) {
Eric W. Biedermane1760bd2012-09-10 22:39:43 -0700185 kuid_t auid;
Al Viro1e641742008-12-09 09:23:33 +0000186 unsigned int sessionid;
187
188 auid = audit_get_loginuid(current);
189 sessionid = audit_get_sessionid(current);
190 tty_audit_log("ioctl=TIOCSTI", current, auid, sessionid, major,
191 minor, &ch, 1);
192 }
193}
194
195/**
Thomas Gleixner3c80fe42009-12-09 14:19:31 +0000196 * tty_audit_push_task - Flush task's pending audit data
197 * @tsk: task pointer
198 * @loginuid: sender login uid
199 * @sessionid: sender session id
200 *
201 * Called with a ref on @tsk held. Try to lock sighand and get a
202 * reference to the tty audit buffer if available.
203 * Flush the buffer or return an appropriate error code.
Miloslav Trmac522ed772007-07-15 23:40:56 -0700204 */
Eric W. Biedermane1760bd2012-09-10 22:39:43 -0700205int tty_audit_push_task(struct task_struct *tsk, kuid_t loginuid, u32 sessionid)
Miloslav Trmac522ed772007-07-15 23:40:56 -0700206{
Thomas Gleixner3c80fe42009-12-09 14:19:31 +0000207 struct tty_audit_buf *buf = ERR_PTR(-EPERM);
208 unsigned long flags;
Miloslav Trmac522ed772007-07-15 23:40:56 -0700209
Thomas Gleixner3c80fe42009-12-09 14:19:31 +0000210 if (!lock_task_sighand(tsk, &flags))
211 return -ESRCH;
212
213 if (tsk->signal->audit_tty) {
214 buf = tsk->signal->tty_audit_buf;
215 if (buf)
216 atomic_inc(&buf->count);
217 }
218 unlock_task_sighand(tsk, &flags);
219
220 /*
221 * Return 0 when signal->audit_tty set
222 * but tsk->signal->tty_audit_buf == NULL.
223 */
224 if (!buf || IS_ERR(buf))
225 return PTR_ERR(buf);
Miloslav Trmac522ed772007-07-15 23:40:56 -0700226
227 mutex_lock(&buf->mutex);
Eric Paris4746ec52008-01-08 10:06:53 -0500228 tty_audit_buf_push(tsk, loginuid, sessionid, buf);
Miloslav Trmac522ed772007-07-15 23:40:56 -0700229 mutex_unlock(&buf->mutex);
230
231 tty_audit_buf_put(buf);
Thomas Gleixner3c80fe42009-12-09 14:19:31 +0000232 return 0;
Miloslav Trmac522ed772007-07-15 23:40:56 -0700233}
234
235/**
236 * tty_audit_buf_get - Get an audit buffer.
237 *
238 * Get an audit buffer for @tty, allocate it if necessary. Return %NULL
239 * if TTY auditing is disabled or out of memory. Otherwise, return a new
240 * reference to the buffer.
241 */
Jiri Slaby6c633f22012-10-18 22:26:37 +0200242static struct tty_audit_buf *tty_audit_buf_get(struct tty_struct *tty,
243 unsigned icanon)
Miloslav Trmac522ed772007-07-15 23:40:56 -0700244{
245 struct tty_audit_buf *buf, *buf2;
246
247 buf = NULL;
248 buf2 = NULL;
249 spin_lock_irq(&current->sighand->siglock);
250 if (likely(!current->signal->audit_tty))
251 goto out;
252 buf = current->signal->tty_audit_buf;
253 if (buf) {
254 atomic_inc(&buf->count);
255 goto out;
256 }
257 spin_unlock_irq(&current->sighand->siglock);
258
259 buf2 = tty_audit_buf_alloc(tty->driver->major,
260 tty->driver->minor_start + tty->index,
Jiri Slaby6c633f22012-10-18 22:26:37 +0200261 icanon);
Miloslav Trmac522ed772007-07-15 23:40:56 -0700262 if (buf2 == NULL) {
263 audit_log_lost("out of memory in TTY auditing");
264 return NULL;
265 }
266
267 spin_lock_irq(&current->sighand->siglock);
268 if (!current->signal->audit_tty)
269 goto out;
270 buf = current->signal->tty_audit_buf;
271 if (!buf) {
272 current->signal->tty_audit_buf = buf2;
273 buf = buf2;
274 buf2 = NULL;
275 }
276 atomic_inc(&buf->count);
277 /* Fall through */
278 out:
279 spin_unlock_irq(&current->sighand->siglock);
280 if (buf2)
281 tty_audit_buf_free(buf2);
282 return buf;
283}
284
285/**
286 * tty_audit_add_data - Add data for TTY auditing.
287 *
288 * Audit @data of @size from @tty, if necessary.
289 */
290void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
Jiri Slaby6c633f22012-10-18 22:26:37 +0200291 size_t size, unsigned icanon)
Miloslav Trmac522ed772007-07-15 23:40:56 -0700292{
293 struct tty_audit_buf *buf;
294 int major, minor;
295
296 if (unlikely(size == 0))
297 return;
298
Miloslav Trmac41126222008-04-18 13:30:14 -0700299 if (tty->driver->type == TTY_DRIVER_TYPE_PTY
300 && tty->driver->subtype == PTY_TYPE_MASTER)
301 return;
302
Jiri Slaby6c633f22012-10-18 22:26:37 +0200303 buf = tty_audit_buf_get(tty, icanon);
Miloslav Trmac522ed772007-07-15 23:40:56 -0700304 if (!buf)
305 return;
306
307 mutex_lock(&buf->mutex);
308 major = tty->driver->major;
309 minor = tty->driver->minor_start + tty->index;
310 if (buf->major != major || buf->minor != minor
Jiri Slaby6c633f22012-10-18 22:26:37 +0200311 || buf->icanon != icanon) {
Miloslav Trmac522ed772007-07-15 23:40:56 -0700312 tty_audit_buf_push_current(buf);
313 buf->major = major;
314 buf->minor = minor;
Jiri Slaby6c633f22012-10-18 22:26:37 +0200315 buf->icanon = icanon;
Miloslav Trmac522ed772007-07-15 23:40:56 -0700316 }
317 do {
318 size_t run;
319
320 run = N_TTY_BUF_SIZE - buf->valid;
321 if (run > size)
322 run = size;
323 memcpy(buf->data + buf->valid, data, run);
324 buf->valid += run;
325 data += run;
326 size -= run;
327 if (buf->valid == N_TTY_BUF_SIZE)
328 tty_audit_buf_push_current(buf);
329 } while (size != 0);
330 mutex_unlock(&buf->mutex);
331 tty_audit_buf_put(buf);
332}
333
334/**
335 * tty_audit_push - Push buffered data out
336 *
337 * Make sure no audit data is pending for @tty on the current process.
338 */
339void tty_audit_push(struct tty_struct *tty)
340{
341 struct tty_audit_buf *buf;
342
343 spin_lock_irq(&current->sighand->siglock);
344 if (likely(!current->signal->audit_tty)) {
345 spin_unlock_irq(&current->sighand->siglock);
346 return;
347 }
348 buf = current->signal->tty_audit_buf;
349 if (buf)
350 atomic_inc(&buf->count);
351 spin_unlock_irq(&current->sighand->siglock);
352
353 if (buf) {
354 int major, minor;
355
356 major = tty->driver->major;
357 minor = tty->driver->minor_start + tty->index;
358 mutex_lock(&buf->mutex);
359 if (buf->major == major && buf->minor == minor)
360 tty_audit_buf_push_current(buf);
361 mutex_unlock(&buf->mutex);
362 tty_audit_buf_put(buf);
363 }
364}