Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Creating audit events from TTY input. |
| 3 | * |
| 4 | * Copyright (C) 2007 Red Hat, Inc. All rights reserved. This copyrighted |
| 5 | * material is made available to anyone wishing to use, modify, copy, or |
| 6 | * redistribute it subject to the terms and conditions of the GNU General |
| 7 | * Public License v.2. |
| 8 | * |
| 9 | * Authors: Miloslav Trmac <mitr@redhat.com> |
| 10 | */ |
| 11 | |
| 12 | #include <linux/audit.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 13 | #include <linux/slab.h> |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 14 | #include <linux/tty.h> |
| 15 | |
| 16 | struct tty_audit_buf { |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 17 | struct mutex mutex; /* Protects all data below */ |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 18 | dev_t dev; /* The TTY which the data is from */ |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 19 | unsigned icanon:1; |
| 20 | size_t valid; |
| 21 | unsigned char *data; /* Allocated size N_TTY_BUF_SIZE */ |
| 22 | }; |
| 23 | |
Peter Hurley | a75c9b0 | 2016-01-09 22:55:28 -0800 | [diff] [blame] | 24 | static struct tty_audit_buf *tty_audit_buf_alloc(void) |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 25 | { |
| 26 | struct tty_audit_buf *buf; |
| 27 | |
Alan Cox | 66c6cea | 2008-02-08 04:18:46 -0800 | [diff] [blame] | 28 | buf = kmalloc(sizeof(*buf), GFP_KERNEL); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 29 | if (!buf) |
| 30 | goto err; |
Alan Cox | c481c70 | 2009-06-11 13:04:27 +0100 | [diff] [blame] | 31 | buf->data = kmalloc(N_TTY_BUF_SIZE, GFP_KERNEL); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 32 | if (!buf->data) |
| 33 | goto err_buf; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 34 | mutex_init(&buf->mutex); |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 35 | buf->dev = MKDEV(0, 0); |
Peter Hurley | a75c9b0 | 2016-01-09 22:55:28 -0800 | [diff] [blame] | 36 | buf->icanon = 0; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 37 | buf->valid = 0; |
| 38 | return buf; |
| 39 | |
| 40 | err_buf: |
| 41 | kfree(buf); |
| 42 | err: |
| 43 | return NULL; |
| 44 | } |
| 45 | |
| 46 | static void tty_audit_buf_free(struct tty_audit_buf *buf) |
| 47 | { |
| 48 | WARN_ON(buf->valid != 0); |
Alan Cox | c481c70 | 2009-06-11 13:04:27 +0100 | [diff] [blame] | 49 | kfree(buf->data); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 50 | kfree(buf); |
| 51 | } |
| 52 | |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 53 | static void tty_audit_log(const char *description, dev_t dev, |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 54 | unsigned char *data, size_t size) |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 55 | { |
| 56 | struct audit_buffer *ab; |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 57 | struct task_struct *tsk = current; |
Richard Guy Briggs | f1dc486 | 2013-12-11 13:52:26 -0500 | [diff] [blame] | 58 | pid_t pid = task_pid_nr(tsk); |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 59 | uid_t uid = from_kuid(&init_user_ns, task_uid(tsk)); |
| 60 | uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(tsk)); |
Eric Paris | 4440e85 | 2013-11-27 17:35:17 -0500 | [diff] [blame] | 61 | unsigned int sessionid = audit_get_sessionid(tsk); |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 62 | |
| 63 | ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY); |
| 64 | if (ab) { |
| 65 | char name[sizeof(tsk->comm)]; |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 66 | |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 67 | audit_log_format(ab, "%s pid=%u uid=%u auid=%u ses=%u major=%d" |
Richard Guy Briggs | f1dc486 | 2013-12-11 13:52:26 -0500 | [diff] [blame] | 68 | " minor=%d comm=", description, pid, uid, |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 69 | loginuid, sessionid, MAJOR(dev), MINOR(dev)); |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 70 | get_task_comm(name, tsk); |
| 71 | audit_log_untrustedstring(ab, name); |
| 72 | audit_log_format(ab, " data="); |
| 73 | audit_log_n_hex(ab, data, size); |
| 74 | audit_log_end(ab); |
| 75 | } |
| 76 | } |
| 77 | |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 78 | /** |
| 79 | * tty_audit_buf_push - Push buffered data out |
| 80 | * |
| 81 | * Generate an audit message from the contents of @buf, which is owned by |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 82 | * the current task. @buf->mutex must be locked. |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 83 | */ |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 84 | static void tty_audit_buf_push(struct tty_audit_buf *buf) |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 85 | { |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 86 | if (buf->valid == 0) |
| 87 | return; |
Xiaotian Feng | 00bff39 | 2011-03-03 18:08:24 +0800 | [diff] [blame] | 88 | if (audit_enabled == 0) { |
| 89 | buf->valid = 0; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 90 | return; |
Xiaotian Feng | 00bff39 | 2011-03-03 18:08:24 +0800 | [diff] [blame] | 91 | } |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 92 | tty_audit_log("tty", buf->dev, buf->data, buf->valid); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 93 | buf->valid = 0; |
| 94 | } |
| 95 | |
| 96 | /** |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 97 | * tty_audit_exit - Handle a task exit |
| 98 | * |
| 99 | * Make sure all buffered data is written out and deallocate the buffer. |
| 100 | * Only needs to be called if current->signal->tty_audit_buf != %NULL. |
Peter Hurley | 5493090 | 2016-01-09 22:55:35 -0800 | [diff] [blame] | 101 | * |
| 102 | * The process is single-threaded at this point; no other threads share |
| 103 | * current->signal. |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 104 | */ |
| 105 | void tty_audit_exit(void) |
| 106 | { |
| 107 | struct tty_audit_buf *buf; |
| 108 | |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 109 | buf = current->signal->tty_audit_buf; |
| 110 | current->signal->tty_audit_buf = NULL; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 111 | if (!buf) |
| 112 | return; |
| 113 | |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 114 | tty_audit_buf_push(buf); |
Peter Hurley | 5493090 | 2016-01-09 22:55:35 -0800 | [diff] [blame] | 115 | tty_audit_buf_free(buf); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 116 | } |
| 117 | |
| 118 | /** |
| 119 | * tty_audit_fork - Copy TTY audit state for a new task |
| 120 | * |
| 121 | * Set up TTY audit state in @sig from current. @sig needs no locking. |
| 122 | */ |
| 123 | void tty_audit_fork(struct signal_struct *sig) |
| 124 | { |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 125 | sig->audit_tty = current->signal->audit_tty; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 126 | } |
| 127 | |
| 128 | /** |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 129 | * tty_audit_tiocsti - Log TIOCSTI |
| 130 | */ |
| 131 | void tty_audit_tiocsti(struct tty_struct *tty, char ch) |
| 132 | { |
| 133 | struct tty_audit_buf *buf; |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 134 | dev_t dev; |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 135 | |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 136 | dev = MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index; |
Peter Hurley | 5493090 | 2016-01-09 22:55:35 -0800 | [diff] [blame] | 137 | buf = current->signal->tty_audit_buf; |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 138 | if (buf) { |
| 139 | mutex_lock(&buf->mutex); |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 140 | if (buf->dev == dev) |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 141 | tty_audit_buf_push(buf); |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 142 | mutex_unlock(&buf->mutex); |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 143 | } |
| 144 | |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 145 | if (audit_enabled && (current->signal->audit_tty & AUDIT_TTY_ENABLE)) { |
Eric W. Biederman | e1760bd | 2012-09-10 22:39:43 -0700 | [diff] [blame] | 146 | kuid_t auid; |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 147 | unsigned int sessionid; |
| 148 | |
| 149 | auid = audit_get_loginuid(current); |
| 150 | sessionid = audit_get_sessionid(current); |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 151 | tty_audit_log("ioctl=TIOCSTI", dev, &ch, 1); |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 152 | } |
| 153 | } |
| 154 | |
| 155 | /** |
Peter Hurley | 37282a7 | 2016-01-09 22:55:31 -0800 | [diff] [blame] | 156 | * tty_audit_push - Flush current's pending audit data |
Thomas Gleixner | 3c80fe4 | 2009-12-09 14:19:31 +0000 | [diff] [blame] | 157 | * |
Peter Hurley | 37282a7 | 2016-01-09 22:55:31 -0800 | [diff] [blame] | 158 | * Returns 0 if success, -EPERM if tty audit is disabled |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 159 | */ |
Peter Hurley | 37282a7 | 2016-01-09 22:55:31 -0800 | [diff] [blame] | 160 | int tty_audit_push(void) |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 161 | { |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 162 | struct tty_audit_buf *buf; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 163 | |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 164 | if (~current->signal->audit_tty & AUDIT_TTY_ENABLE) |
| 165 | return -EPERM; |
| 166 | |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 167 | buf = current->signal->tty_audit_buf; |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 168 | if (buf) { |
| 169 | mutex_lock(&buf->mutex); |
| 170 | tty_audit_buf_push(buf); |
| 171 | mutex_unlock(&buf->mutex); |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 172 | } |
Thomas Gleixner | 3c80fe4 | 2009-12-09 14:19:31 +0000 | [diff] [blame] | 173 | return 0; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 174 | } |
| 175 | |
| 176 | /** |
| 177 | * tty_audit_buf_get - Get an audit buffer. |
| 178 | * |
Peter Hurley | a75c9b0 | 2016-01-09 22:55:28 -0800 | [diff] [blame] | 179 | * Get an audit buffer, allocate it if necessary. Return %NULL |
Peter Hurley | 5c8b318 | 2016-01-09 22:55:34 -0800 | [diff] [blame] | 180 | * if out of memory. Otherwise, return a new reference to the buffer. |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 181 | */ |
Peter Hurley | a75c9b0 | 2016-01-09 22:55:28 -0800 | [diff] [blame] | 182 | static struct tty_audit_buf *tty_audit_buf_get(void) |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 183 | { |
Peter Hurley | fbaa122 | 2016-01-09 22:55:36 -0800 | [diff] [blame^] | 184 | struct tty_audit_buf *buf; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 185 | |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 186 | buf = current->signal->tty_audit_buf; |
Peter Hurley | 5493090 | 2016-01-09 22:55:35 -0800 | [diff] [blame] | 187 | if (buf) |
| 188 | return buf; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 189 | |
Peter Hurley | fbaa122 | 2016-01-09 22:55:36 -0800 | [diff] [blame^] | 190 | buf = tty_audit_buf_alloc(); |
| 191 | if (buf == NULL) { |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 192 | audit_log_lost("out of memory in TTY auditing"); |
| 193 | return NULL; |
| 194 | } |
| 195 | |
Peter Hurley | fbaa122 | 2016-01-09 22:55:36 -0800 | [diff] [blame^] | 196 | /* Race to use this buffer, free it if another wins */ |
| 197 | if (cmpxchg(¤t->signal->tty_audit_buf, NULL, buf) != NULL) |
| 198 | tty_audit_buf_free(buf); |
| 199 | return current->signal->tty_audit_buf; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 200 | } |
| 201 | |
| 202 | /** |
| 203 | * tty_audit_add_data - Add data for TTY auditing. |
| 204 | * |
| 205 | * Audit @data of @size from @tty, if necessary. |
| 206 | */ |
Peter Hurley | 309426a | 2016-01-09 22:55:27 -0800 | [diff] [blame] | 207 | void tty_audit_add_data(struct tty_struct *tty, const void *data, size_t size) |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 208 | { |
| 209 | struct tty_audit_buf *buf; |
Peter Hurley | 309426a | 2016-01-09 22:55:27 -0800 | [diff] [blame] | 210 | unsigned int icanon = !!L_ICANON(tty); |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 211 | unsigned int audit_tty; |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 212 | dev_t dev; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 213 | |
| 214 | if (unlikely(size == 0)) |
| 215 | return; |
| 216 | |
Peter Hurley | d7c0ba4 | 2016-01-09 22:55:25 -0800 | [diff] [blame] | 217 | if (tty->driver->type == TTY_DRIVER_TYPE_PTY |
| 218 | && tty->driver->subtype == PTY_TYPE_MASTER) |
| 219 | return; |
| 220 | |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 221 | audit_tty = READ_ONCE(current->signal->audit_tty); |
| 222 | if (~audit_tty & AUDIT_TTY_ENABLE) |
| 223 | return; |
| 224 | if ((~audit_tty & AUDIT_TTY_LOG_PASSWD) && icanon && !L_ECHO(tty)) |
Richard Guy Briggs | 46e959e | 2013-05-03 14:03:50 -0400 | [diff] [blame] | 225 | return; |
| 226 | |
Peter Hurley | a75c9b0 | 2016-01-09 22:55:28 -0800 | [diff] [blame] | 227 | buf = tty_audit_buf_get(); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 228 | if (!buf) |
| 229 | return; |
| 230 | |
| 231 | mutex_lock(&buf->mutex); |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 232 | dev = MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index; |
| 233 | if (buf->dev != dev || buf->icanon != icanon) { |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 234 | tty_audit_buf_push(buf); |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 235 | buf->dev = dev; |
Jiri Slaby | 6c633f2 | 2012-10-18 22:26:37 +0200 | [diff] [blame] | 236 | buf->icanon = icanon; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 237 | } |
| 238 | do { |
| 239 | size_t run; |
| 240 | |
| 241 | run = N_TTY_BUF_SIZE - buf->valid; |
| 242 | if (run > size) |
| 243 | run = size; |
| 244 | memcpy(buf->data + buf->valid, data, run); |
| 245 | buf->valid += run; |
| 246 | data += run; |
| 247 | size -= run; |
| 248 | if (buf->valid == N_TTY_BUF_SIZE) |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 249 | tty_audit_buf_push(buf); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 250 | } while (size != 0); |
| 251 | mutex_unlock(&buf->mutex); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 252 | } |