blob: ffb9c9da4f39f8779a55bc832b3f6657e45f23ac [file] [log] [blame]
Etienne Basset6e837fb2009-04-08 20:39:40 +02001/*
2 * Common LSM logging functions
3 * Heavily borrowed from selinux/avc.h
4 *
5 * Author : Etienne BASSET <etienne.basset@ensta.org>
6 *
7 * All credits to : Stephen Smalley, <sds@epoch.ncsc.mil>
8 * All BUGS to : Etienne BASSET <etienne.basset@ensta.org>
9 */
10#ifndef _LSM_COMMON_LOGGING_
11#define _LSM_COMMON_LOGGING_
12
13#include <linux/stddef.h>
14#include <linux/errno.h>
15#include <linux/kernel.h>
16#include <linux/kdev_t.h>
17#include <linux/spinlock.h>
18#include <linux/init.h>
19#include <linux/audit.h>
20#include <linux/in6.h>
21#include <linux/path.h>
22#include <linux/key.h>
23#include <linux/skbuff.h>
Etienne Basset6e837fb2009-04-08 20:39:40 +020024
Eric Paris48c62af2012-04-02 13:15:44 -040025struct lsm_network_audit {
26 int netif;
27 struct sock *sk;
28 u16 family;
29 __be16 dport;
30 __be16 sport;
31 union {
32 struct {
33 __be32 daddr;
34 __be32 saddr;
35 } v4;
36 struct {
37 struct in6_addr daddr;
38 struct in6_addr saddr;
39 } v6;
40 } fam;
41};
Etienne Basset6e837fb2009-04-08 20:39:40 +020042
Jeff Vander Stoep671a2782015-07-10 17:19:55 -040043struct lsm_ioctlop_audit {
44 struct path path;
45 u16 cmd;
46};
47
Etienne Basset6e837fb2009-04-08 20:39:40 +020048/* Auxiliary data to use in generating the audit record. */
49struct common_audit_data {
Eric Parisdd8dbf22009-11-03 16:35:32 +110050 char type;
Eric Parisf48b7392011-04-25 12:54:27 -040051#define LSM_AUDIT_DATA_PATH 1
Eric Parisdd8dbf22009-11-03 16:35:32 +110052#define LSM_AUDIT_DATA_NET 2
53#define LSM_AUDIT_DATA_CAP 3
54#define LSM_AUDIT_DATA_IPC 4
55#define LSM_AUDIT_DATA_TASK 5
56#define LSM_AUDIT_DATA_KEY 6
Eric Pariscb84aa92010-04-27 17:20:38 -040057#define LSM_AUDIT_DATA_NONE 7
Eric Parisdd8dbf22009-11-03 16:35:32 +110058#define LSM_AUDIT_DATA_KMOD 8
Eric Parisf48b7392011-04-25 12:54:27 -040059#define LSM_AUDIT_DATA_INODE 9
Eric Parisa2694342011-04-25 13:10:27 -040060#define LSM_AUDIT_DATA_DENTRY 10
Jeff Vander Stoep671a2782015-07-10 17:19:55 -040061#define LSM_AUDIT_DATA_IOCTL_OP 11
Etienne Basset6e837fb2009-04-08 20:39:40 +020062 union {
Eric Parisf48b7392011-04-25 12:54:27 -040063 struct path path;
Eric Parisa2694342011-04-25 13:10:27 -040064 struct dentry *dentry;
Eric Parisf48b7392011-04-25 12:54:27 -040065 struct inode *inode;
Eric Paris48c62af2012-04-02 13:15:44 -040066 struct lsm_network_audit *net;
Etienne Basset6e837fb2009-04-08 20:39:40 +020067 int cap;
68 int ipc_id;
69 struct task_struct *tsk;
70#ifdef CONFIG_KEYS
71 struct {
72 key_serial_t key;
73 char *key_desc;
74 } key_struct;
75#endif
Eric Parisdd8dbf22009-11-03 16:35:32 +110076 char *kmod_name;
Jeff Vander Stoep671a2782015-07-10 17:19:55 -040077 struct lsm_ioctlop_audit *op;
Etienne Basset6e837fb2009-04-08 20:39:40 +020078 } u;
Etienne Basset6e837fb2009-04-08 20:39:40 +020079 /* this union contains LSM specific data */
80 union {
Thomas Liu65c3f0a2009-07-09 10:00:31 -040081#ifdef CONFIG_SECURITY_SMACK
Eric Paris3b3b0e42012-04-03 09:37:02 -070082 struct smack_audit_data *smack_audit_data;
Thomas Liu65c3f0a2009-07-09 10:00:31 -040083#endif
84#ifdef CONFIG_SECURITY_SELINUX
Eric Paris3b3b0e42012-04-03 09:37:02 -070085 struct selinux_audit_data *selinux_audit_data;
Thomas Liu65c3f0a2009-07-09 10:00:31 -040086#endif
John Johansen67012e82010-07-29 14:47:58 -070087#ifdef CONFIG_SECURITY_APPARMOR
Eric Paris3b3b0e42012-04-03 09:37:02 -070088 struct apparmor_audit_data *apparmor_audit_data;
John Johansen67012e82010-07-29 14:47:58 -070089#endif
Eric Paris3b3b0e42012-04-03 09:37:02 -070090 }; /* per LSM data pointer union */
Etienne Basset6e837fb2009-04-08 20:39:40 +020091};
92
93#define v4info fam.v4
94#define v6info fam.v6
95
96int ipv4_skb_to_auditdata(struct sk_buff *skb,
97 struct common_audit_data *ad, u8 *proto);
98
99int ipv6_skb_to_auditdata(struct sk_buff *skb,
100 struct common_audit_data *ad, u8 *proto);
101
Linus Torvaldsb61c37f2012-04-02 15:48:12 -0700102void common_lsm_audit(struct common_audit_data *a,
103 void (*pre_audit)(struct audit_buffer *, void *),
104 void (*post_audit)(struct audit_buffer *, void *));
Etienne Basset6e837fb2009-04-08 20:39:40 +0200105
106#endif