1/* auditfilter.c -- filtering of audit events 2 * 3 * Copyright 2003-2004 Red Hat, Inc. 4 * Copyright 2005 Hewlett-Packard Development Company, L.P. 5 * Copyright 2005 IBM Corporation 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License as published by 9 * the Free Software Foundation; either version 2 of the License, or 10 * (at your option) any later version. 11 * 12 * This program is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * GNU General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License 18 * along with this program; if not, write to the Free Software 19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 20 */ 21 22#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 23 24#include <linux/kernel.h> 25#include <linux/audit.h> 26#include <linux/kthread.h> 27#include <linux/mutex.h> 28#include <linux/fs.h> 29#include <linux/namei.h> 30#include <linux/netlink.h> 31#include <linux/sched.h> 32#include <linux/slab.h> 33#include <linux/security.h> 34#include <net/net_namespace.h> 35#include <net/sock.h> 36#include "audit.h" 37 38/* 39 * Locking model: 40 * 41 * audit_filter_mutex: 42 * Synchronizes writes and blocking reads of audit's filterlist 43 * data. Rcu is used to traverse the filterlist and access 44 * contents of structs audit_entry, audit_watch and opaque 45 * LSM rules during filtering. If modified, these structures 46 * must be copied and replace their counterparts in the filterlist. 47 * An audit_parent struct is not accessed during filtering, so may 48 * be written directly provided audit_filter_mutex is held. 49 */ 50 51/* Audit filter lists, defined in <linux/audit.h> */ 52struct list_head audit_filter_list[AUDIT_NR_FILTERS] = { 53 LIST_HEAD_INIT(audit_filter_list[0]), 54 LIST_HEAD_INIT(audit_filter_list[1]), 55 LIST_HEAD_INIT(audit_filter_list[2]), 56 LIST_HEAD_INIT(audit_filter_list[3]), 57 LIST_HEAD_INIT(audit_filter_list[4]), 58 LIST_HEAD_INIT(audit_filter_list[5]), 59#if AUDIT_NR_FILTERS != 6 60#error Fix audit_filter_list initialiser 61#endif 62}; 63static struct list_head audit_rules_list[AUDIT_NR_FILTERS] = { 64 LIST_HEAD_INIT(audit_rules_list[0]), 65 LIST_HEAD_INIT(audit_rules_list[1]), 66 LIST_HEAD_INIT(audit_rules_list[2]), 67 LIST_HEAD_INIT(audit_rules_list[3]), 68 LIST_HEAD_INIT(audit_rules_list[4]), 69 LIST_HEAD_INIT(audit_rules_list[5]), 70}; 71 72DEFINE_MUTEX(audit_filter_mutex); 73 74static void audit_free_lsm_field(struct audit_field *f) 75{ 76 switch (f->type) { 77 case AUDIT_SUBJ_USER: 78 case AUDIT_SUBJ_ROLE: 79 case AUDIT_SUBJ_TYPE: 80 case AUDIT_SUBJ_SEN: 81 case AUDIT_SUBJ_CLR: 82 case AUDIT_OBJ_USER: 83 case AUDIT_OBJ_ROLE: 84 case AUDIT_OBJ_TYPE: 85 case AUDIT_OBJ_LEV_LOW: 86 case AUDIT_OBJ_LEV_HIGH: 87 kfree(f->lsm_str); 88 security_audit_rule_free(f->lsm_rule); 89 } 90} 91 92static inline void audit_free_rule(struct audit_entry *e) 93{ 94 int i; 95 struct audit_krule *erule = &e->rule; 96 97 /* some rules don't have associated watches */ 98 if (erule->watch) 99 audit_put_watch(erule->watch); 100 if (erule->fields) 101 for (i = 0; i < erule->field_count; i++) 102 audit_free_lsm_field(&erule->fields[i]); 103 kfree(erule->fields); 104 kfree(erule->filterkey); 105 kfree(e); 106} 107 108void audit_free_rule_rcu(struct rcu_head *head) 109{ 110 struct audit_entry *e = container_of(head, struct audit_entry, rcu); 111 audit_free_rule(e); 112} 113 114/* Initialize an audit filterlist entry. */ 115static inline struct audit_entry *audit_init_entry(u32 field_count) 116{ 117 struct audit_entry *entry; 118 struct audit_field *fields; 119 120 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 121 if (unlikely(!entry)) 122 return NULL; 123 124 fields = kcalloc(field_count, sizeof(*fields), GFP_KERNEL); 125 if (unlikely(!fields)) { 126 kfree(entry); 127 return NULL; 128 } 129 entry->rule.fields = fields; 130 131 return entry; 132} 133 134/* Unpack a filter field's string representation from user-space 135 * buffer. */ 136char *audit_unpack_string(void **bufp, size_t *remain, size_t len) 137{ 138 char *str; 139 140 if (!*bufp || (len == 0) || (len > *remain)) 141 return ERR_PTR(-EINVAL); 142 143 /* Of the currently implemented string fields, PATH_MAX 144 * defines the longest valid length. 145 */ 146 if (len > PATH_MAX) 147 return ERR_PTR(-ENAMETOOLONG); 148 149 str = kmalloc(len + 1, GFP_KERNEL); 150 if (unlikely(!str)) 151 return ERR_PTR(-ENOMEM); 152 153 memcpy(str, *bufp, len); 154 str[len] = 0; 155 *bufp += len; 156 *remain -= len; 157 158 return str; 159} 160 161/* Translate an inode field to kernel respresentation. */ 162static inline int audit_to_inode(struct audit_krule *krule, 163 struct audit_field *f) 164{ 165 if (krule->listnr != AUDIT_FILTER_EXIT || 166 krule->inode_f || krule->watch || krule->tree || 167 (f->op != Audit_equal && f->op != Audit_not_equal)) 168 return -EINVAL; 169 170 krule->inode_f = f; 171 return 0; 172} 173 174static __u32 *classes[AUDIT_SYSCALL_CLASSES]; 175 176int __init audit_register_class(int class, unsigned *list) 177{ 178 __u32 *p = kcalloc(AUDIT_BITMASK_SIZE, sizeof(__u32), GFP_KERNEL); 179 if (!p) 180 return -ENOMEM; 181 while (*list != ~0U) { 182 unsigned n = *list++; 183 if (n >= AUDIT_BITMASK_SIZE * 32 - AUDIT_SYSCALL_CLASSES) { 184 kfree(p); 185 return -EINVAL; 186 } 187 p[AUDIT_WORD(n)] |= AUDIT_BIT(n); 188 } 189 if (class >= AUDIT_SYSCALL_CLASSES || classes[class]) { 190 kfree(p); 191 return -EINVAL; 192 } 193 classes[class] = p; 194 return 0; 195} 196 197int audit_match_class(int class, unsigned syscall) 198{ 199 if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32)) 200 return 0; 201 if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class])) 202 return 0; 203 return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall); 204} 205 206#ifdef CONFIG_AUDITSYSCALL 207static inline int audit_match_class_bits(int class, u32 *mask) 208{ 209 int i; 210 211 if (classes[class]) { 212 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 213 if (mask[i] & classes[class][i]) 214 return 0; 215 } 216 return 1; 217} 218 219static int audit_match_signal(struct audit_entry *entry) 220{ 221 struct audit_field *arch = entry->rule.arch_f; 222 223 if (!arch) { 224 /* When arch is unspecified, we must check both masks on biarch 225 * as syscall number alone is ambiguous. */ 226 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL, 227 entry->rule.mask) && 228 audit_match_class_bits(AUDIT_CLASS_SIGNAL_32, 229 entry->rule.mask)); 230 } 231 232 switch(audit_classify_arch(arch->val)) { 233 case 0: /* native */ 234 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL, 235 entry->rule.mask)); 236 case 1: /* 32bit on biarch */ 237 return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32, 238 entry->rule.mask)); 239 default: 240 return 1; 241 } 242} 243#endif 244 245/* Common user-space to kernel rule translation. */ 246static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *rule) 247{ 248 unsigned listnr; 249 struct audit_entry *entry; 250 int i, err; 251 252 err = -EINVAL; 253 listnr = rule->flags & ~AUDIT_FILTER_PREPEND; 254 switch(listnr) { 255 default: 256 goto exit_err; 257#ifdef CONFIG_AUDITSYSCALL 258 case AUDIT_FILTER_ENTRY: 259 if (rule->action == AUDIT_ALWAYS) 260 goto exit_err; 261 case AUDIT_FILTER_EXIT: 262 case AUDIT_FILTER_TASK: 263#endif 264 case AUDIT_FILTER_USER: 265 case AUDIT_FILTER_TYPE: 266 ; 267 } 268 if (unlikely(rule->action == AUDIT_POSSIBLE)) { 269 pr_err("AUDIT_POSSIBLE is deprecated\n"); 270 goto exit_err; 271 } 272 if (rule->action != AUDIT_NEVER && rule->action != AUDIT_ALWAYS) 273 goto exit_err; 274 if (rule->field_count > AUDIT_MAX_FIELDS) 275 goto exit_err; 276 277 err = -ENOMEM; 278 entry = audit_init_entry(rule->field_count); 279 if (!entry) 280 goto exit_err; 281 282 entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND; 283 entry->rule.listnr = listnr; 284 entry->rule.action = rule->action; 285 entry->rule.field_count = rule->field_count; 286 287 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 288 entry->rule.mask[i] = rule->mask[i]; 289 290 for (i = 0; i < AUDIT_SYSCALL_CLASSES; i++) { 291 int bit = AUDIT_BITMASK_SIZE * 32 - i - 1; 292 __u32 *p = &entry->rule.mask[AUDIT_WORD(bit)]; 293 __u32 *class; 294 295 if (!(*p & AUDIT_BIT(bit))) 296 continue; 297 *p &= ~AUDIT_BIT(bit); 298 class = classes[i]; 299 if (class) { 300 int j; 301 for (j = 0; j < AUDIT_BITMASK_SIZE; j++) 302 entry->rule.mask[j] |= class[j]; 303 } 304 } 305 306 return entry; 307 308exit_err: 309 return ERR_PTR(err); 310} 311 312static u32 audit_ops[] = 313{ 314 [Audit_equal] = AUDIT_EQUAL, 315 [Audit_not_equal] = AUDIT_NOT_EQUAL, 316 [Audit_bitmask] = AUDIT_BIT_MASK, 317 [Audit_bittest] = AUDIT_BIT_TEST, 318 [Audit_lt] = AUDIT_LESS_THAN, 319 [Audit_gt] = AUDIT_GREATER_THAN, 320 [Audit_le] = AUDIT_LESS_THAN_OR_EQUAL, 321 [Audit_ge] = AUDIT_GREATER_THAN_OR_EQUAL, 322}; 323 324static u32 audit_to_op(u32 op) 325{ 326 u32 n; 327 for (n = Audit_equal; n < Audit_bad && audit_ops[n] != op; n++) 328 ; 329 return n; 330} 331 332/* check if an audit field is valid */ 333static int audit_field_valid(struct audit_entry *entry, struct audit_field *f) 334{ 335 switch(f->type) { 336 case AUDIT_MSGTYPE: 337 if (entry->rule.listnr != AUDIT_FILTER_TYPE && 338 entry->rule.listnr != AUDIT_FILTER_USER) 339 return -EINVAL; 340 break; 341 }; 342 343 switch(f->type) { 344 default: 345 return -EINVAL; 346 case AUDIT_UID: 347 case AUDIT_EUID: 348 case AUDIT_SUID: 349 case AUDIT_FSUID: 350 case AUDIT_LOGINUID: 351 case AUDIT_OBJ_UID: 352 case AUDIT_GID: 353 case AUDIT_EGID: 354 case AUDIT_SGID: 355 case AUDIT_FSGID: 356 case AUDIT_OBJ_GID: 357 case AUDIT_PID: 358 case AUDIT_PERS: 359 case AUDIT_MSGTYPE: 360 case AUDIT_PPID: 361 case AUDIT_DEVMAJOR: 362 case AUDIT_DEVMINOR: 363 case AUDIT_EXIT: 364 case AUDIT_SUCCESS: 365 case AUDIT_INODE: 366 /* bit ops are only useful on syscall args */ 367 if (f->op == Audit_bitmask || f->op == Audit_bittest) 368 return -EINVAL; 369 break; 370 case AUDIT_ARG0: 371 case AUDIT_ARG1: 372 case AUDIT_ARG2: 373 case AUDIT_ARG3: 374 case AUDIT_SUBJ_USER: 375 case AUDIT_SUBJ_ROLE: 376 case AUDIT_SUBJ_TYPE: 377 case AUDIT_SUBJ_SEN: 378 case AUDIT_SUBJ_CLR: 379 case AUDIT_OBJ_USER: 380 case AUDIT_OBJ_ROLE: 381 case AUDIT_OBJ_TYPE: 382 case AUDIT_OBJ_LEV_LOW: 383 case AUDIT_OBJ_LEV_HIGH: 384 case AUDIT_WATCH: 385 case AUDIT_DIR: 386 case AUDIT_FILTERKEY: 387 break; 388 case AUDIT_LOGINUID_SET: 389 if ((f->val != 0) && (f->val != 1)) 390 return -EINVAL; 391 /* FALL THROUGH */ 392 case AUDIT_ARCH: 393 if (f->op != Audit_not_equal && f->op != Audit_equal) 394 return -EINVAL; 395 break; 396 case AUDIT_PERM: 397 if (f->val & ~15) 398 return -EINVAL; 399 break; 400 case AUDIT_FILETYPE: 401 if (f->val & ~S_IFMT) 402 return -EINVAL; 403 break; 404 case AUDIT_FIELD_COMPARE: 405 if (f->val > AUDIT_MAX_FIELD_COMPARE) 406 return -EINVAL; 407 break; 408 }; 409 return 0; 410} 411 412/* Translate struct audit_rule_data to kernel's rule respresentation. */ 413static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, 414 size_t datasz) 415{ 416 int err = 0; 417 struct audit_entry *entry; 418 void *bufp; 419 size_t remain = datasz - sizeof(struct audit_rule_data); 420 int i; 421 char *str; 422 423 entry = audit_to_entry_common(data); 424 if (IS_ERR(entry)) 425 goto exit_nofree; 426 427 bufp = data->buf; 428 for (i = 0; i < data->field_count; i++) { 429 struct audit_field *f = &entry->rule.fields[i]; 430 431 err = -EINVAL; 432 433 f->op = audit_to_op(data->fieldflags[i]); 434 if (f->op == Audit_bad) 435 goto exit_free; 436 437 f->type = data->fields[i]; 438 f->val = data->values[i]; 439 440 /* Support legacy tests for a valid loginuid */ 441 if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) { 442 f->type = AUDIT_LOGINUID_SET; 443 f->val = 0; 444 entry->rule.pflags |= AUDIT_LOGINUID_LEGACY; 445 } 446 447 err = audit_field_valid(entry, f); 448 if (err) 449 goto exit_free; 450 451 err = -EINVAL; 452 switch (f->type) { 453 case AUDIT_LOGINUID: 454 case AUDIT_UID: 455 case AUDIT_EUID: 456 case AUDIT_SUID: 457 case AUDIT_FSUID: 458 case AUDIT_OBJ_UID: 459 f->uid = make_kuid(current_user_ns(), f->val); 460 if (!uid_valid(f->uid)) 461 goto exit_free; 462 break; 463 case AUDIT_GID: 464 case AUDIT_EGID: 465 case AUDIT_SGID: 466 case AUDIT_FSGID: 467 case AUDIT_OBJ_GID: 468 f->gid = make_kgid(current_user_ns(), f->val); 469 if (!gid_valid(f->gid)) 470 goto exit_free; 471 break; 472 case AUDIT_ARCH: 473 entry->rule.arch_f = f; 474 break; 475 case AUDIT_SUBJ_USER: 476 case AUDIT_SUBJ_ROLE: 477 case AUDIT_SUBJ_TYPE: 478 case AUDIT_SUBJ_SEN: 479 case AUDIT_SUBJ_CLR: 480 case AUDIT_OBJ_USER: 481 case AUDIT_OBJ_ROLE: 482 case AUDIT_OBJ_TYPE: 483 case AUDIT_OBJ_LEV_LOW: 484 case AUDIT_OBJ_LEV_HIGH: 485 str = audit_unpack_string(&bufp, &remain, f->val); 486 if (IS_ERR(str)) 487 goto exit_free; 488 entry->rule.buflen += f->val; 489 490 err = security_audit_rule_init(f->type, f->op, str, 491 (void **)&f->lsm_rule); 492 /* Keep currently invalid fields around in case they 493 * become valid after a policy reload. */ 494 if (err == -EINVAL) { 495 pr_warn("audit rule for LSM \'%s\' is invalid\n", 496 str); 497 err = 0; 498 } 499 if (err) { 500 kfree(str); 501 goto exit_free; 502 } else 503 f->lsm_str = str; 504 break; 505 case AUDIT_WATCH: 506 str = audit_unpack_string(&bufp, &remain, f->val); 507 if (IS_ERR(str)) 508 goto exit_free; 509 entry->rule.buflen += f->val; 510 511 err = audit_to_watch(&entry->rule, str, f->val, f->op); 512 if (err) { 513 kfree(str); 514 goto exit_free; 515 } 516 break; 517 case AUDIT_DIR: 518 str = audit_unpack_string(&bufp, &remain, f->val); 519 if (IS_ERR(str)) 520 goto exit_free; 521 entry->rule.buflen += f->val; 522 523 err = audit_make_tree(&entry->rule, str, f->op); 524 kfree(str); 525 if (err) 526 goto exit_free; 527 break; 528 case AUDIT_INODE: 529 err = audit_to_inode(&entry->rule, f); 530 if (err) 531 goto exit_free; 532 break; 533 case AUDIT_FILTERKEY: 534 if (entry->rule.filterkey || f->val > AUDIT_MAX_KEY_LEN) 535 goto exit_free; 536 str = audit_unpack_string(&bufp, &remain, f->val); 537 if (IS_ERR(str)) 538 goto exit_free; 539 entry->rule.buflen += f->val; 540 entry->rule.filterkey = str; 541 break; 542 } 543 } 544 545 if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal) 546 entry->rule.inode_f = NULL; 547 548exit_nofree: 549 return entry; 550 551exit_free: 552 if (entry->rule.watch) 553 audit_put_watch(entry->rule.watch); /* matches initial get */ 554 if (entry->rule.tree) 555 audit_put_tree(entry->rule.tree); /* that's the temporary one */ 556 audit_free_rule(entry); 557 return ERR_PTR(err); 558} 559 560/* Pack a filter field's string representation into data block. */ 561static inline size_t audit_pack_string(void **bufp, const char *str) 562{ 563 size_t len = strlen(str); 564 565 memcpy(*bufp, str, len); 566 *bufp += len; 567 568 return len; 569} 570 571/* Translate kernel rule respresentation to struct audit_rule_data. */ 572static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) 573{ 574 struct audit_rule_data *data; 575 void *bufp; 576 int i; 577 578 data = kmalloc(sizeof(*data) + krule->buflen, GFP_KERNEL); 579 if (unlikely(!data)) 580 return NULL; 581 memset(data, 0, sizeof(*data)); 582 583 data->flags = krule->flags | krule->listnr; 584 data->action = krule->action; 585 data->field_count = krule->field_count; 586 bufp = data->buf; 587 for (i = 0; i < data->field_count; i++) { 588 struct audit_field *f = &krule->fields[i]; 589 590 data->fields[i] = f->type; 591 data->fieldflags[i] = audit_ops[f->op]; 592 switch(f->type) { 593 case AUDIT_SUBJ_USER: 594 case AUDIT_SUBJ_ROLE: 595 case AUDIT_SUBJ_TYPE: 596 case AUDIT_SUBJ_SEN: 597 case AUDIT_SUBJ_CLR: 598 case AUDIT_OBJ_USER: 599 case AUDIT_OBJ_ROLE: 600 case AUDIT_OBJ_TYPE: 601 case AUDIT_OBJ_LEV_LOW: 602 case AUDIT_OBJ_LEV_HIGH: 603 data->buflen += data->values[i] = 604 audit_pack_string(&bufp, f->lsm_str); 605 break; 606 case AUDIT_WATCH: 607 data->buflen += data->values[i] = 608 audit_pack_string(&bufp, 609 audit_watch_path(krule->watch)); 610 break; 611 case AUDIT_DIR: 612 data->buflen += data->values[i] = 613 audit_pack_string(&bufp, 614 audit_tree_path(krule->tree)); 615 break; 616 case AUDIT_FILTERKEY: 617 data->buflen += data->values[i] = 618 audit_pack_string(&bufp, krule->filterkey); 619 break; 620 case AUDIT_LOGINUID_SET: 621 if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) { 622 data->fields[i] = AUDIT_LOGINUID; 623 data->values[i] = AUDIT_UID_UNSET; 624 break; 625 } 626 /* fallthrough if set */ 627 default: 628 data->values[i] = f->val; 629 } 630 } 631 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i]; 632 633 return data; 634} 635 636/* Compare two rules in kernel format. Considered success if rules 637 * don't match. */ 638static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b) 639{ 640 int i; 641 642 if (a->flags != b->flags || 643 a->pflags != b->pflags || 644 a->listnr != b->listnr || 645 a->action != b->action || 646 a->field_count != b->field_count) 647 return 1; 648 649 for (i = 0; i < a->field_count; i++) { 650 if (a->fields[i].type != b->fields[i].type || 651 a->fields[i].op != b->fields[i].op) 652 return 1; 653 654 switch(a->fields[i].type) { 655 case AUDIT_SUBJ_USER: 656 case AUDIT_SUBJ_ROLE: 657 case AUDIT_SUBJ_TYPE: 658 case AUDIT_SUBJ_SEN: 659 case AUDIT_SUBJ_CLR: 660 case AUDIT_OBJ_USER: 661 case AUDIT_OBJ_ROLE: 662 case AUDIT_OBJ_TYPE: 663 case AUDIT_OBJ_LEV_LOW: 664 case AUDIT_OBJ_LEV_HIGH: 665 if (strcmp(a->fields[i].lsm_str, b->fields[i].lsm_str)) 666 return 1; 667 break; 668 case AUDIT_WATCH: 669 if (strcmp(audit_watch_path(a->watch), 670 audit_watch_path(b->watch))) 671 return 1; 672 break; 673 case AUDIT_DIR: 674 if (strcmp(audit_tree_path(a->tree), 675 audit_tree_path(b->tree))) 676 return 1; 677 break; 678 case AUDIT_FILTERKEY: 679 /* both filterkeys exist based on above type compare */ 680 if (strcmp(a->filterkey, b->filterkey)) 681 return 1; 682 break; 683 case AUDIT_UID: 684 case AUDIT_EUID: 685 case AUDIT_SUID: 686 case AUDIT_FSUID: 687 case AUDIT_LOGINUID: 688 case AUDIT_OBJ_UID: 689 if (!uid_eq(a->fields[i].uid, b->fields[i].uid)) 690 return 1; 691 break; 692 case AUDIT_GID: 693 case AUDIT_EGID: 694 case AUDIT_SGID: 695 case AUDIT_FSGID: 696 case AUDIT_OBJ_GID: 697 if (!gid_eq(a->fields[i].gid, b->fields[i].gid)) 698 return 1; 699 break; 700 default: 701 if (a->fields[i].val != b->fields[i].val) 702 return 1; 703 } 704 } 705 706 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 707 if (a->mask[i] != b->mask[i]) 708 return 1; 709 710 return 0; 711} 712 713/* Duplicate LSM field information. The lsm_rule is opaque, so must be 714 * re-initialized. */ 715static inline int audit_dupe_lsm_field(struct audit_field *df, 716 struct audit_field *sf) 717{ 718 int ret = 0; 719 char *lsm_str; 720 721 /* our own copy of lsm_str */ 722 lsm_str = kstrdup(sf->lsm_str, GFP_KERNEL); 723 if (unlikely(!lsm_str)) 724 return -ENOMEM; 725 df->lsm_str = lsm_str; 726 727 /* our own (refreshed) copy of lsm_rule */ 728 ret = security_audit_rule_init(df->type, df->op, df->lsm_str, 729 (void **)&df->lsm_rule); 730 /* Keep currently invalid fields around in case they 731 * become valid after a policy reload. */ 732 if (ret == -EINVAL) { 733 pr_warn("audit rule for LSM \'%s\' is invalid\n", 734 df->lsm_str); 735 ret = 0; 736 } 737 738 return ret; 739} 740 741/* Duplicate an audit rule. This will be a deep copy with the exception 742 * of the watch - that pointer is carried over. The LSM specific fields 743 * will be updated in the copy. The point is to be able to replace the old 744 * rule with the new rule in the filterlist, then free the old rule. 745 * The rlist element is undefined; list manipulations are handled apart from 746 * the initial copy. */ 747struct audit_entry *audit_dupe_rule(struct audit_krule *old) 748{ 749 u32 fcount = old->field_count; 750 struct audit_entry *entry; 751 struct audit_krule *new; 752 char *fk; 753 int i, err = 0; 754 755 entry = audit_init_entry(fcount); 756 if (unlikely(!entry)) 757 return ERR_PTR(-ENOMEM); 758 759 new = &entry->rule; 760 new->flags = old->flags; 761 new->pflags = old->pflags; 762 new->listnr = old->listnr; 763 new->action = old->action; 764 for (i = 0; i < AUDIT_BITMASK_SIZE; i++) 765 new->mask[i] = old->mask[i]; 766 new->prio = old->prio; 767 new->buflen = old->buflen; 768 new->inode_f = old->inode_f; 769 new->field_count = old->field_count; 770 771 /* 772 * note that we are OK with not refcounting here; audit_match_tree() 773 * never dereferences tree and we can't get false positives there 774 * since we'd have to have rule gone from the list *and* removed 775 * before the chunks found by lookup had been allocated, i.e. before 776 * the beginning of list scan. 777 */ 778 new->tree = old->tree; 779 memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount); 780 781 /* deep copy this information, updating the lsm_rule fields, because 782 * the originals will all be freed when the old rule is freed. */ 783 for (i = 0; i < fcount; i++) { 784 switch (new->fields[i].type) { 785 case AUDIT_SUBJ_USER: 786 case AUDIT_SUBJ_ROLE: 787 case AUDIT_SUBJ_TYPE: 788 case AUDIT_SUBJ_SEN: 789 case AUDIT_SUBJ_CLR: 790 case AUDIT_OBJ_USER: 791 case AUDIT_OBJ_ROLE: 792 case AUDIT_OBJ_TYPE: 793 case AUDIT_OBJ_LEV_LOW: 794 case AUDIT_OBJ_LEV_HIGH: 795 err = audit_dupe_lsm_field(&new->fields[i], 796 &old->fields[i]); 797 break; 798 case AUDIT_FILTERKEY: 799 fk = kstrdup(old->filterkey, GFP_KERNEL); 800 if (unlikely(!fk)) 801 err = -ENOMEM; 802 else 803 new->filterkey = fk; 804 } 805 if (err) { 806 audit_free_rule(entry); 807 return ERR_PTR(err); 808 } 809 } 810 811 if (old->watch) { 812 audit_get_watch(old->watch); 813 new->watch = old->watch; 814 } 815 816 return entry; 817} 818 819/* Find an existing audit rule. 820 * Caller must hold audit_filter_mutex to prevent stale rule data. */ 821static struct audit_entry *audit_find_rule(struct audit_entry *entry, 822 struct list_head **p) 823{ 824 struct audit_entry *e, *found = NULL; 825 struct list_head *list; 826 int h; 827 828 if (entry->rule.inode_f) { 829 h = audit_hash_ino(entry->rule.inode_f->val); 830 *p = list = &audit_inode_hash[h]; 831 } else if (entry->rule.watch) { 832 /* we don't know the inode number, so must walk entire hash */ 833 for (h = 0; h < AUDIT_INODE_BUCKETS; h++) { 834 list = &audit_inode_hash[h]; 835 list_for_each_entry(e, list, list) 836 if (!audit_compare_rule(&entry->rule, &e->rule)) { 837 found = e; 838 goto out; 839 } 840 } 841 goto out; 842 } else { 843 *p = list = &audit_filter_list[entry->rule.listnr]; 844 } 845 846 list_for_each_entry(e, list, list) 847 if (!audit_compare_rule(&entry->rule, &e->rule)) { 848 found = e; 849 goto out; 850 } 851 852out: 853 return found; 854} 855 856static u64 prio_low = ~0ULL/2; 857static u64 prio_high = ~0ULL/2 - 1; 858 859/* Add rule to given filterlist if not a duplicate. */ 860static inline int audit_add_rule(struct audit_entry *entry) 861{ 862 struct audit_entry *e; 863 struct audit_watch *watch = entry->rule.watch; 864 struct audit_tree *tree = entry->rule.tree; 865 struct list_head *list; 866 int err; 867#ifdef CONFIG_AUDITSYSCALL 868 int dont_count = 0; 869 870 /* If either of these, don't count towards total */ 871 if (entry->rule.listnr == AUDIT_FILTER_USER || 872 entry->rule.listnr == AUDIT_FILTER_TYPE) 873 dont_count = 1; 874#endif 875 876 mutex_lock(&audit_filter_mutex); 877 e = audit_find_rule(entry, &list); 878 if (e) { 879 mutex_unlock(&audit_filter_mutex); 880 err = -EEXIST; 881 /* normally audit_add_tree_rule() will free it on failure */ 882 if (tree) 883 audit_put_tree(tree); 884 goto error; 885 } 886 887 if (watch) { 888 /* audit_filter_mutex is dropped and re-taken during this call */ 889 err = audit_add_watch(&entry->rule, &list); 890 if (err) { 891 mutex_unlock(&audit_filter_mutex); 892 /* 893 * normally audit_add_tree_rule() will free it 894 * on failure 895 */ 896 if (tree) 897 audit_put_tree(tree); 898 goto error; 899 } 900 } 901 if (tree) { 902 err = audit_add_tree_rule(&entry->rule); 903 if (err) { 904 mutex_unlock(&audit_filter_mutex); 905 goto error; 906 } 907 } 908 909 entry->rule.prio = ~0ULL; 910 if (entry->rule.listnr == AUDIT_FILTER_EXIT) { 911 if (entry->rule.flags & AUDIT_FILTER_PREPEND) 912 entry->rule.prio = ++prio_high; 913 else 914 entry->rule.prio = --prio_low; 915 } 916 917 if (entry->rule.flags & AUDIT_FILTER_PREPEND) { 918 list_add(&entry->rule.list, 919 &audit_rules_list[entry->rule.listnr]); 920 list_add_rcu(&entry->list, list); 921 entry->rule.flags &= ~AUDIT_FILTER_PREPEND; 922 } else { 923 list_add_tail(&entry->rule.list, 924 &audit_rules_list[entry->rule.listnr]); 925 list_add_tail_rcu(&entry->list, list); 926 } 927#ifdef CONFIG_AUDITSYSCALL 928 if (!dont_count) 929 audit_n_rules++; 930 931 if (!audit_match_signal(entry)) 932 audit_signals++; 933#endif 934 mutex_unlock(&audit_filter_mutex); 935 936 return 0; 937 938error: 939 if (watch) 940 audit_put_watch(watch); /* tmp watch, matches initial get */ 941 return err; 942} 943 944/* Remove an existing rule from filterlist. */ 945static inline int audit_del_rule(struct audit_entry *entry) 946{ 947 struct audit_entry *e; 948 struct audit_watch *watch = entry->rule.watch; 949 struct audit_tree *tree = entry->rule.tree; 950 struct list_head *list; 951 int ret = 0; 952#ifdef CONFIG_AUDITSYSCALL 953 int dont_count = 0; 954 955 /* If either of these, don't count towards total */ 956 if (entry->rule.listnr == AUDIT_FILTER_USER || 957 entry->rule.listnr == AUDIT_FILTER_TYPE) 958 dont_count = 1; 959#endif 960 961 mutex_lock(&audit_filter_mutex); 962 e = audit_find_rule(entry, &list); 963 if (!e) { 964 mutex_unlock(&audit_filter_mutex); 965 ret = -ENOENT; 966 goto out; 967 } 968 969 if (e->rule.watch) 970 audit_remove_watch_rule(&e->rule); 971 972 if (e->rule.tree) 973 audit_remove_tree_rule(&e->rule); 974 975 list_del_rcu(&e->list); 976 list_del(&e->rule.list); 977 call_rcu(&e->rcu, audit_free_rule_rcu); 978 979#ifdef CONFIG_AUDITSYSCALL 980 if (!dont_count) 981 audit_n_rules--; 982 983 if (!audit_match_signal(entry)) 984 audit_signals--; 985#endif 986 mutex_unlock(&audit_filter_mutex); 987 988out: 989 if (watch) 990 audit_put_watch(watch); /* match initial get */ 991 if (tree) 992 audit_put_tree(tree); /* that's the temporary one */ 993 994 return ret; 995} 996 997/* List rules using struct audit_rule_data. */ 998static void audit_list_rules(__u32 portid, int seq, struct sk_buff_head *q) 999{ 1000 struct sk_buff *skb; 1001 struct audit_krule *r; 1002 int i; 1003 1004 /* This is a blocking read, so use audit_filter_mutex instead of rcu 1005 * iterator to sync with list writers. */ 1006 for (i=0; i<AUDIT_NR_FILTERS; i++) { 1007 list_for_each_entry(r, &audit_rules_list[i], list) { 1008 struct audit_rule_data *data; 1009 1010 data = audit_krule_to_data(r); 1011 if (unlikely(!data)) 1012 break; 1013 skb = audit_make_reply(portid, seq, AUDIT_LIST_RULES, 1014 0, 1, data, 1015 sizeof(*data) + data->buflen); 1016 if (skb) 1017 skb_queue_tail(q, skb); 1018 kfree(data); 1019 } 1020 } 1021 skb = audit_make_reply(portid, seq, AUDIT_LIST_RULES, 1, 1, NULL, 0); 1022 if (skb) 1023 skb_queue_tail(q, skb); 1024} 1025 1026/* Log rule additions and removals */ 1027static void audit_log_rule_change(char *action, struct audit_krule *rule, int res) 1028{ 1029 struct audit_buffer *ab; 1030 uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(current)); 1031 unsigned int sessionid = audit_get_sessionid(current); 1032 1033 if (!audit_enabled) 1034 return; 1035 1036 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE); 1037 if (!ab) 1038 return; 1039 audit_log_format(ab, "auid=%u ses=%u" ,loginuid, sessionid); 1040 audit_log_task_context(ab); 1041 audit_log_format(ab, " op="); 1042 audit_log_string(ab, action); 1043 audit_log_key(ab, rule->filterkey); 1044 audit_log_format(ab, " list=%d res=%d", rule->listnr, res); 1045 audit_log_end(ab); 1046} 1047 1048/** 1049 * audit_rule_change - apply all rules to the specified message type 1050 * @type: audit message type 1051 * @portid: target port id for netlink audit messages 1052 * @seq: netlink audit message sequence (serial) number 1053 * @data: payload data 1054 * @datasz: size of payload data 1055 */ 1056int audit_rule_change(int type, __u32 portid, int seq, void *data, 1057 size_t datasz) 1058{ 1059 int err = 0; 1060 struct audit_entry *entry; 1061 1062 entry = audit_data_to_entry(data, datasz); 1063 if (IS_ERR(entry)) 1064 return PTR_ERR(entry); 1065 1066 switch (type) { 1067 case AUDIT_ADD_RULE: 1068 err = audit_add_rule(entry); 1069 audit_log_rule_change("add_rule", &entry->rule, !err); 1070 break; 1071 case AUDIT_DEL_RULE: 1072 err = audit_del_rule(entry); 1073 audit_log_rule_change("remove_rule", &entry->rule, !err); 1074 break; 1075 default: 1076 err = -EINVAL; 1077 WARN_ON(1); 1078 } 1079 1080 if (err || type == AUDIT_DEL_RULE) 1081 audit_free_rule(entry); 1082 1083 return err; 1084} 1085 1086/** 1087 * audit_list_rules_send - list the audit rules 1088 * @request_skb: skb of request we are replying to (used to target the reply) 1089 * @seq: netlink audit message sequence (serial) number 1090 */ 1091int audit_list_rules_send(struct sk_buff *request_skb, int seq) 1092{ 1093 u32 portid = NETLINK_CB(request_skb).portid; 1094 struct net *net = sock_net(NETLINK_CB(request_skb).sk); 1095 struct task_struct *tsk; 1096 struct audit_netlink_list *dest; 1097 int err = 0; 1098 1099 /* We can't just spew out the rules here because we might fill 1100 * the available socket buffer space and deadlock waiting for 1101 * auditctl to read from it... which isn't ever going to 1102 * happen if we're actually running in the context of auditctl 1103 * trying to _send_ the stuff */ 1104 1105 dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL); 1106 if (!dest) 1107 return -ENOMEM; 1108 dest->net = get_net(net); 1109 dest->portid = portid; 1110 skb_queue_head_init(&dest->q); 1111 1112 mutex_lock(&audit_filter_mutex); 1113 audit_list_rules(portid, seq, &dest->q); 1114 mutex_unlock(&audit_filter_mutex); 1115 1116 tsk = kthread_run(audit_send_list, dest, "audit_send_list"); 1117 if (IS_ERR(tsk)) { 1118 skb_queue_purge(&dest->q); 1119 kfree(dest); 1120 err = PTR_ERR(tsk); 1121 } 1122 1123 return err; 1124} 1125 1126int audit_comparator(u32 left, u32 op, u32 right) 1127{ 1128 switch (op) { 1129 case Audit_equal: 1130 return (left == right); 1131 case Audit_not_equal: 1132 return (left != right); 1133 case Audit_lt: 1134 return (left < right); 1135 case Audit_le: 1136 return (left <= right); 1137 case Audit_gt: 1138 return (left > right); 1139 case Audit_ge: 1140 return (left >= right); 1141 case Audit_bitmask: 1142 return (left & right); 1143 case Audit_bittest: 1144 return ((left & right) == right); 1145 default: 1146 BUG(); 1147 return 0; 1148 } 1149} 1150 1151int audit_uid_comparator(kuid_t left, u32 op, kuid_t right) 1152{ 1153 switch (op) { 1154 case Audit_equal: 1155 return uid_eq(left, right); 1156 case Audit_not_equal: 1157 return !uid_eq(left, right); 1158 case Audit_lt: 1159 return uid_lt(left, right); 1160 case Audit_le: 1161 return uid_lte(left, right); 1162 case Audit_gt: 1163 return uid_gt(left, right); 1164 case Audit_ge: 1165 return uid_gte(left, right); 1166 case Audit_bitmask: 1167 case Audit_bittest: 1168 default: 1169 BUG(); 1170 return 0; 1171 } 1172} 1173 1174int audit_gid_comparator(kgid_t left, u32 op, kgid_t right) 1175{ 1176 switch (op) { 1177 case Audit_equal: 1178 return gid_eq(left, right); 1179 case Audit_not_equal: 1180 return !gid_eq(left, right); 1181 case Audit_lt: 1182 return gid_lt(left, right); 1183 case Audit_le: 1184 return gid_lte(left, right); 1185 case Audit_gt: 1186 return gid_gt(left, right); 1187 case Audit_ge: 1188 return gid_gte(left, right); 1189 case Audit_bitmask: 1190 case Audit_bittest: 1191 default: 1192 BUG(); 1193 return 0; 1194 } 1195} 1196 1197/** 1198 * parent_len - find the length of the parent portion of a pathname 1199 * @path: pathname of which to determine length 1200 */ 1201int parent_len(const char *path) 1202{ 1203 int plen; 1204 const char *p; 1205 1206 plen = strlen(path); 1207 1208 if (plen == 0) 1209 return plen; 1210 1211 /* disregard trailing slashes */ 1212 p = path + plen - 1; 1213 while ((*p == '/') && (p > path)) 1214 p--; 1215 1216 /* walk backward until we find the next slash or hit beginning */ 1217 while ((*p != '/') && (p > path)) 1218 p--; 1219 1220 /* did we find a slash? Then increment to include it in path */ 1221 if (*p == '/') 1222 p++; 1223 1224 return p - path; 1225} 1226 1227/** 1228 * audit_compare_dname_path - compare given dentry name with last component in 1229 * given path. Return of 0 indicates a match. 1230 * @dname: dentry name that we're comparing 1231 * @path: full pathname that we're comparing 1232 * @parentlen: length of the parent if known. Passing in AUDIT_NAME_FULL 1233 * here indicates that we must compute this value. 1234 */ 1235int audit_compare_dname_path(const char *dname, const char *path, int parentlen) 1236{ 1237 int dlen, pathlen; 1238 const char *p; 1239 1240 dlen = strlen(dname); 1241 pathlen = strlen(path); 1242 if (pathlen < dlen) 1243 return 1; 1244 1245 parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen; 1246 if (pathlen - parentlen != dlen) 1247 return 1; 1248 1249 p = path + parentlen; 1250 1251 return strncmp(p, dname, dlen); 1252} 1253 1254static int audit_filter_user_rules(struct audit_krule *rule, int type, 1255 enum audit_state *state) 1256{ 1257 int i; 1258 1259 for (i = 0; i < rule->field_count; i++) { 1260 struct audit_field *f = &rule->fields[i]; 1261 pid_t pid; 1262 int result = 0; 1263 u32 sid; 1264 1265 switch (f->type) { 1266 case AUDIT_PID: 1267 pid = task_pid_nr(current); 1268 result = audit_comparator(pid, f->op, f->val); 1269 break; 1270 case AUDIT_UID: 1271 result = audit_uid_comparator(current_uid(), f->op, f->uid); 1272 break; 1273 case AUDIT_GID: 1274 result = audit_gid_comparator(current_gid(), f->op, f->gid); 1275 break; 1276 case AUDIT_LOGINUID: 1277 result = audit_uid_comparator(audit_get_loginuid(current), 1278 f->op, f->uid); 1279 break; 1280 case AUDIT_LOGINUID_SET: 1281 result = audit_comparator(audit_loginuid_set(current), 1282 f->op, f->val); 1283 break; 1284 case AUDIT_MSGTYPE: 1285 result = audit_comparator(type, f->op, f->val); 1286 break; 1287 case AUDIT_SUBJ_USER: 1288 case AUDIT_SUBJ_ROLE: 1289 case AUDIT_SUBJ_TYPE: 1290 case AUDIT_SUBJ_SEN: 1291 case AUDIT_SUBJ_CLR: 1292 if (f->lsm_rule) { 1293 security_task_getsecid(current, &sid); 1294 result = security_audit_rule_match(sid, 1295 f->type, 1296 f->op, 1297 f->lsm_rule, 1298 NULL); 1299 } 1300 break; 1301 } 1302 1303 if (!result) 1304 return 0; 1305 } 1306 switch (rule->action) { 1307 case AUDIT_NEVER: *state = AUDIT_DISABLED; break; 1308 case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break; 1309 } 1310 return 1; 1311} 1312 1313int audit_filter_user(int type) 1314{ 1315 enum audit_state state = AUDIT_DISABLED; 1316 struct audit_entry *e; 1317 int rc, ret; 1318 1319 ret = 1; /* Audit by default */ 1320 1321 rcu_read_lock(); 1322 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_USER], list) { 1323 rc = audit_filter_user_rules(&e->rule, type, &state); 1324 if (rc) { 1325 if (rc > 0 && state == AUDIT_DISABLED) 1326 ret = 0; 1327 break; 1328 } 1329 } 1330 rcu_read_unlock(); 1331 1332 return ret; 1333} 1334 1335int audit_filter_type(int type) 1336{ 1337 struct audit_entry *e; 1338 int result = 0; 1339 1340 rcu_read_lock(); 1341 if (list_empty(&audit_filter_list[AUDIT_FILTER_TYPE])) 1342 goto unlock_and_return; 1343 1344 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE], 1345 list) { 1346 int i; 1347 for (i = 0; i < e->rule.field_count; i++) { 1348 struct audit_field *f = &e->rule.fields[i]; 1349 if (f->type == AUDIT_MSGTYPE) { 1350 result = audit_comparator(type, f->op, f->val); 1351 if (!result) 1352 break; 1353 } 1354 } 1355 if (result) 1356 goto unlock_and_return; 1357 } 1358unlock_and_return: 1359 rcu_read_unlock(); 1360 return result; 1361} 1362 1363static int update_lsm_rule(struct audit_krule *r) 1364{ 1365 struct audit_entry *entry = container_of(r, struct audit_entry, rule); 1366 struct audit_entry *nentry; 1367 int err = 0; 1368 1369 if (!security_audit_rule_known(r)) 1370 return 0; 1371 1372 nentry = audit_dupe_rule(r); 1373 if (IS_ERR(nentry)) { 1374 /* save the first error encountered for the 1375 * return value */ 1376 err = PTR_ERR(nentry); 1377 audit_panic("error updating LSM filters"); 1378 if (r->watch) 1379 list_del(&r->rlist); 1380 list_del_rcu(&entry->list); 1381 list_del(&r->list); 1382 } else { 1383 if (r->watch || r->tree) 1384 list_replace_init(&r->rlist, &nentry->rule.rlist); 1385 list_replace_rcu(&entry->list, &nentry->list); 1386 list_replace(&r->list, &nentry->rule.list); 1387 } 1388 call_rcu(&entry->rcu, audit_free_rule_rcu); 1389 1390 return err; 1391} 1392 1393/* This function will re-initialize the lsm_rule field of all applicable rules. 1394 * It will traverse the filter lists serarching for rules that contain LSM 1395 * specific filter fields. When such a rule is found, it is copied, the 1396 * LSM field is re-initialized, and the old rule is replaced with the 1397 * updated rule. */ 1398int audit_update_lsm_rules(void) 1399{ 1400 struct audit_krule *r, *n; 1401 int i, err = 0; 1402 1403 /* audit_filter_mutex synchronizes the writers */ 1404 mutex_lock(&audit_filter_mutex); 1405 1406 for (i = 0; i < AUDIT_NR_FILTERS; i++) { 1407 list_for_each_entry_safe(r, n, &audit_rules_list[i], list) { 1408 int res = update_lsm_rule(r); 1409 if (!err) 1410 err = res; 1411 } 1412 } 1413 mutex_unlock(&audit_filter_mutex); 1414 1415 return err; 1416} 1417