David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 1 | /* audit -- definition of audit_context structure and supporting types |
| 2 | * |
| 3 | * Copyright 2003-2004 Red Hat, Inc. |
| 4 | * Copyright 2005 Hewlett-Packard Development Company, L.P. |
| 5 | * Copyright 2005 IBM Corporation |
| 6 | * |
| 7 | * This program is free software; you can redistribute it and/or modify |
| 8 | * it under the terms of the GNU General Public License as published by |
| 9 | * the Free Software Foundation; either version 2 of the License, or |
| 10 | * (at your option) any later version. |
| 11 | * |
| 12 | * This program is distributed in the hope that it will be useful, |
| 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 15 | * GNU General Public License for more details. |
| 16 | * |
| 17 | * You should have received a copy of the GNU General Public License |
| 18 | * along with this program; if not, write to the Free Software |
| 19 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| 20 | */ |
| 21 | |
Ingo Molnar | 5a0bbce | 2006-03-07 23:51:38 -0800 | [diff] [blame] | 22 | #include <linux/mutex.h> |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 23 | #include <linux/fs.h> |
| 24 | #include <linux/audit.h> |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 25 | #include <linux/skbuff.h> |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 26 | |
| 27 | /* 0 = no checking |
| 28 | 1 = put_count checking |
| 29 | 2 = verbose put_count checking |
| 30 | */ |
| 31 | #define AUDIT_DEBUG 0 |
| 32 | |
| 33 | /* At task start time, the audit_state is set in the audit_context using |
| 34 | a per-task filter. At syscall entry, the audit_state is augmented by |
| 35 | the syscall filter. */ |
| 36 | enum audit_state { |
| 37 | AUDIT_DISABLED, /* Do not create per-task audit_context. |
| 38 | * No syscall-specific audit records can |
| 39 | * be generated. */ |
| 40 | AUDIT_SETUP_CONTEXT, /* Create the per-task audit_context, |
| 41 | * but don't necessarily fill it in at |
| 42 | * syscall entry time (i.e., filter |
| 43 | * instead). */ |
| 44 | AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context, |
| 45 | * and always fill it in at syscall |
| 46 | * entry time. This makes a full |
| 47 | * syscall record available if some |
| 48 | * other part of the kernel decides it |
| 49 | * should be recorded. */ |
| 50 | AUDIT_RECORD_CONTEXT /* Create the per-task audit_context, |
| 51 | * always fill it in at syscall entry |
| 52 | * time, and always write out the audit |
| 53 | * record at syscall exit time. */ |
| 54 | }; |
| 55 | |
| 56 | /* Rule lists */ |
Amy Griffis | 93315ed | 2006-02-07 12:05:27 -0500 | [diff] [blame] | 57 | struct audit_field { |
Darrel Goeddel | 3dc7e31 | 2006-03-10 18:14:06 -0600 | [diff] [blame] | 58 | u32 type; |
| 59 | u32 val; |
| 60 | u32 op; |
| 61 | char *se_str; |
| 62 | struct selinux_audit_rule *se_rule; |
Amy Griffis | 93315ed | 2006-02-07 12:05:27 -0500 | [diff] [blame] | 63 | }; |
| 64 | |
| 65 | struct audit_krule { |
| 66 | int vers_ops; |
| 67 | u32 flags; |
| 68 | u32 listnr; |
| 69 | u32 action; |
| 70 | u32 mask[AUDIT_BITMASK_SIZE]; |
| 71 | u32 buflen; /* for data alloc on list rules */ |
| 72 | u32 field_count; |
| 73 | struct audit_field *fields; |
| 74 | }; |
| 75 | |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 76 | struct audit_entry { |
Amy Griffis | 93315ed | 2006-02-07 12:05:27 -0500 | [diff] [blame] | 77 | struct list_head list; |
| 78 | struct rcu_head rcu; |
| 79 | struct audit_krule rule; |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 80 | }; |
| 81 | |
| 82 | |
| 83 | extern int audit_pid; |
| 84 | extern int audit_comparator(const u32 left, const u32 op, const u32 right); |
| 85 | |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 86 | extern struct sk_buff * audit_make_reply(int pid, int seq, int type, |
| 87 | int done, int multi, |
| 88 | void *payload, int size); |
David Woodhouse | fe7752b | 2005-12-15 18:33:52 +0000 | [diff] [blame] | 89 | extern void audit_send_reply(int pid, int seq, int type, |
| 90 | int done, int multi, |
| 91 | void *payload, int size); |
| 92 | extern void audit_log_lost(const char *message); |
| 93 | extern void audit_panic(const char *message); |
Ingo Molnar | 5a0bbce | 2006-03-07 23:51:38 -0800 | [diff] [blame] | 94 | extern struct mutex audit_netlink_mutex; |
Darrel Goeddel | 3dc7e31 | 2006-03-10 18:14:06 -0600 | [diff] [blame] | 95 | |
Al Viro | 9044e6b | 2006-05-22 01:09:24 -0400 | [diff] [blame] | 96 | struct audit_netlink_list { |
| 97 | int pid; |
| 98 | struct sk_buff_head q; |
| 99 | }; |
| 100 | |
| 101 | int audit_send_list(void *); |
| 102 | |
Darrel Goeddel | 3dc7e31 | 2006-03-10 18:14:06 -0600 | [diff] [blame] | 103 | extern int selinux_audit_rule_update(void); |
Al Viro | e139606 | 2006-05-25 10:19:47 -0400 | [diff] [blame^] | 104 | |
| 105 | #ifdef CONFIG_AUDITSYSCALL |
| 106 | extern void __audit_signal_info(int sig, struct task_struct *t); |
| 107 | static inline void audit_signal_info(int sig, struct task_struct *t) |
| 108 | { |
| 109 | if (unlikely(audit_pid && t->tgid == audit_pid)) |
| 110 | __audit_signal_info(sig, t); |
| 111 | } |
| 112 | #else |
| 113 | #define audit_signal_info(s,t) |
| 114 | #endif |