| .. | .. |
|---|
| 1 | +/* SPDX-License-Identifier: GPL-2.0-or-later */ |
|---|
| 1 | 2 | /* audit -- definition of audit_context structure and supporting types |
|---|
| 2 | 3 | * |
|---|
| 3 | 4 | * Copyright 2003-2004 Red Hat, Inc. |
|---|
| 4 | 5 | * Copyright 2005 Hewlett-Packard Development Company, L.P. |
|---|
| 5 | 6 | * Copyright 2005 IBM Corporation |
|---|
| 6 | | - * |
|---|
| 7 | | - * This program is free software; you can redistribute it and/or modify |
|---|
| 8 | | - * it under the terms of the GNU General Public License as published by |
|---|
| 9 | | - * the Free Software Foundation; either version 2 of the License, or |
|---|
| 10 | | - * (at your option) any later version. |
|---|
| 11 | | - * |
|---|
| 12 | | - * This program is distributed in the hope that it will be useful, |
|---|
| 13 | | - * but WITHOUT ANY WARRANTY; without even the implied warranty of |
|---|
| 14 | | - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|---|
| 15 | | - * GNU General Public License for more details. |
|---|
| 16 | | - * |
|---|
| 17 | | - * You should have received a copy of the GNU General Public License |
|---|
| 18 | | - * along with this program; if not, write to the Free Software |
|---|
| 19 | | - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
|---|
| 20 | 7 | */ |
|---|
| 21 | 8 | |
|---|
| 22 | 9 | #include <linux/fs.h> |
|---|
| .. | .. |
|---|
| 69 | 56 | kernel_cap_t effective; /* effective set of process */ |
|---|
| 70 | 57 | }; |
|---|
| 71 | 58 | kernel_cap_t ambient; |
|---|
| 59 | + kuid_t rootid; |
|---|
| 72 | 60 | }; |
|---|
| 73 | 61 | |
|---|
| 74 | 62 | /* When fs/namei.c:getname() is called, we store the pointer in name and bump |
|---|
| .. | .. |
|---|
| 203 | 191 | struct { |
|---|
| 204 | 192 | char *name; |
|---|
| 205 | 193 | } module; |
|---|
| 194 | + struct { |
|---|
| 195 | + struct audit_ntp_data ntp_data; |
|---|
| 196 | + struct timespec64 tk_injoffset; |
|---|
| 197 | + } time; |
|---|
| 206 | 198 | }; |
|---|
| 207 | 199 | int fds[2]; |
|---|
| 208 | 200 | struct audit_proctitle proctitle; |
|---|
| .. | .. |
|---|
| 210 | 202 | |
|---|
| 211 | 203 | extern bool audit_ever_enabled; |
|---|
| 212 | 204 | |
|---|
| 213 | | -extern void audit_copy_inode(struct audit_names *name, |
|---|
| 214 | | - const struct dentry *dentry, |
|---|
| 215 | | - struct inode *inode); |
|---|
| 216 | | -extern void audit_log_cap(struct audit_buffer *ab, char *prefix, |
|---|
| 217 | | - kernel_cap_t *cap); |
|---|
| 218 | | -extern void audit_log_name(struct audit_context *context, |
|---|
| 219 | | - struct audit_names *n, const struct path *path, |
|---|
| 220 | | - int record_num, int *call_panic); |
|---|
| 205 | +extern void audit_log_session_info(struct audit_buffer *ab); |
|---|
| 221 | 206 | |
|---|
| 222 | 207 | extern int auditd_test_task(struct task_struct *task); |
|---|
| 223 | 208 | |
|---|
| .. | .. |
|---|
| 237 | 222 | extern int audit_uid_comparator(kuid_t left, u32 op, kuid_t right); |
|---|
| 238 | 223 | extern int audit_gid_comparator(kgid_t left, u32 op, kgid_t right); |
|---|
| 239 | 224 | extern int parent_len(const char *path); |
|---|
| 240 | | -extern int audit_compare_dname_path(const char *dname, const char *path, int plen); |
|---|
| 225 | +extern int audit_compare_dname_path(const struct qstr *dname, const char *path, int plen); |
|---|
| 241 | 226 | extern struct sk_buff *audit_make_reply(int seq, int type, int done, int multi, |
|---|
| 242 | 227 | const void *payload, int size); |
|---|
| 243 | 228 | extern void audit_panic(const char *message); |
|---|
| .. | .. |
|---|
| 262 | 247 | extern void audit_log_d_path_exe(struct audit_buffer *ab, |
|---|
| 263 | 248 | struct mm_struct *mm); |
|---|
| 264 | 249 | |
|---|
| 265 | | -extern struct tty_struct *audit_get_tty(struct task_struct *tsk); |
|---|
| 250 | +extern struct tty_struct *audit_get_tty(void); |
|---|
| 266 | 251 | extern void audit_put_tty(struct tty_struct *tty); |
|---|
| 267 | 252 | |
|---|
| 268 | | -/* audit watch functions */ |
|---|
| 269 | | -#ifdef CONFIG_AUDIT_WATCH |
|---|
| 253 | +/* audit watch/mark/tree functions */ |
|---|
| 254 | +#ifdef CONFIG_AUDITSYSCALL |
|---|
| 255 | +extern unsigned int audit_serial(void); |
|---|
| 256 | +extern int auditsc_get_stamp(struct audit_context *ctx, |
|---|
| 257 | + struct timespec64 *t, unsigned int *serial); |
|---|
| 258 | + |
|---|
| 270 | 259 | extern void audit_put_watch(struct audit_watch *watch); |
|---|
| 271 | 260 | extern void audit_get_watch(struct audit_watch *watch); |
|---|
| 272 | | -extern int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op); |
|---|
| 261 | +extern int audit_to_watch(struct audit_krule *krule, char *path, int len, |
|---|
| 262 | + u32 op); |
|---|
| 273 | 263 | extern int audit_add_watch(struct audit_krule *krule, struct list_head **list); |
|---|
| 274 | 264 | extern void audit_remove_watch_rule(struct audit_krule *krule); |
|---|
| 275 | 265 | extern char *audit_watch_path(struct audit_watch *watch); |
|---|
| 276 | | -extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev); |
|---|
| 266 | +extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, |
|---|
| 267 | + dev_t dev); |
|---|
| 277 | 268 | |
|---|
| 278 | | -extern struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len); |
|---|
| 269 | +extern struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, |
|---|
| 270 | + char *pathname, int len); |
|---|
| 279 | 271 | extern char *audit_mark_path(struct audit_fsnotify_mark *mark); |
|---|
| 280 | 272 | extern void audit_remove_mark(struct audit_fsnotify_mark *audit_mark); |
|---|
| 281 | 273 | extern void audit_remove_mark_rule(struct audit_krule *krule); |
|---|
| 282 | | -extern int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev); |
|---|
| 274 | +extern int audit_mark_compare(struct audit_fsnotify_mark *mark, |
|---|
| 275 | + unsigned long ino, dev_t dev); |
|---|
| 283 | 276 | extern int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old); |
|---|
| 284 | | -extern int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark); |
|---|
| 277 | +extern int audit_exe_compare(struct task_struct *tsk, |
|---|
| 278 | + struct audit_fsnotify_mark *mark); |
|---|
| 285 | 279 | |
|---|
| 286 | | -#else |
|---|
| 280 | +extern struct audit_chunk *audit_tree_lookup(const struct inode *inode); |
|---|
| 281 | +extern void audit_put_chunk(struct audit_chunk *chunk); |
|---|
| 282 | +extern bool audit_tree_match(struct audit_chunk *chunk, |
|---|
| 283 | + struct audit_tree *tree); |
|---|
| 284 | +extern int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op); |
|---|
| 285 | +extern int audit_add_tree_rule(struct audit_krule *rule); |
|---|
| 286 | +extern int audit_remove_tree_rule(struct audit_krule *rule); |
|---|
| 287 | +extern void audit_trim_trees(void); |
|---|
| 288 | +extern int audit_tag_tree(char *old, char *new); |
|---|
| 289 | +extern const char *audit_tree_path(struct audit_tree *tree); |
|---|
| 290 | +extern void audit_put_tree(struct audit_tree *tree); |
|---|
| 291 | +extern void audit_kill_trees(struct audit_context *context); |
|---|
| 292 | + |
|---|
| 293 | +extern int audit_signal_info_syscall(struct task_struct *t); |
|---|
| 294 | +extern void audit_filter_inodes(struct task_struct *tsk, |
|---|
| 295 | + struct audit_context *ctx); |
|---|
| 296 | +extern struct list_head *audit_killed_trees(void); |
|---|
| 297 | +#else /* CONFIG_AUDITSYSCALL */ |
|---|
| 298 | +#define auditsc_get_stamp(c, t, s) 0 |
|---|
| 287 | 299 | #define audit_put_watch(w) {} |
|---|
| 288 | 300 | #define audit_get_watch(w) {} |
|---|
| 289 | 301 | #define audit_to_watch(k, p, l, o) (-EINVAL) |
|---|
| .. | .. |
|---|
| 299 | 311 | #define audit_mark_compare(m, i, d) 0 |
|---|
| 300 | 312 | #define audit_exe_compare(t, m) (-EINVAL) |
|---|
| 301 | 313 | #define audit_dupe_exe(n, o) (-EINVAL) |
|---|
| 302 | | -#endif /* CONFIG_AUDIT_WATCH */ |
|---|
| 303 | 314 | |
|---|
| 304 | | -#ifdef CONFIG_AUDIT_TREE |
|---|
| 305 | | -extern struct audit_chunk *audit_tree_lookup(const struct inode *inode); |
|---|
| 306 | | -extern void audit_put_chunk(struct audit_chunk *chunk); |
|---|
| 307 | | -extern bool audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree); |
|---|
| 308 | | -extern int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op); |
|---|
| 309 | | -extern int audit_add_tree_rule(struct audit_krule *rule); |
|---|
| 310 | | -extern int audit_remove_tree_rule(struct audit_krule *rule); |
|---|
| 311 | | -extern void audit_trim_trees(void); |
|---|
| 312 | | -extern int audit_tag_tree(char *old, char *new); |
|---|
| 313 | | -extern const char *audit_tree_path(struct audit_tree *tree); |
|---|
| 314 | | -extern void audit_put_tree(struct audit_tree *tree); |
|---|
| 315 | | -extern void audit_kill_trees(struct list_head *list); |
|---|
| 316 | | -#else |
|---|
| 317 | 315 | #define audit_remove_tree_rule(rule) BUG() |
|---|
| 318 | 316 | #define audit_add_tree_rule(rule) -EINVAL |
|---|
| 319 | 317 | #define audit_make_tree(rule, str, op) -EINVAL |
|---|
| .. | .. |
|---|
| 321 | 319 | #define audit_put_tree(tree) (void)0 |
|---|
| 322 | 320 | #define audit_tag_tree(old, new) -EINVAL |
|---|
| 323 | 321 | #define audit_tree_path(rule) "" /* never called */ |
|---|
| 324 | | -#define audit_kill_trees(list) BUG() |
|---|
| 325 | | -#endif |
|---|
| 322 | +#define audit_kill_trees(context) BUG() |
|---|
| 323 | + |
|---|
| 324 | +static inline int audit_signal_info_syscall(struct task_struct *t) |
|---|
| 325 | +{ |
|---|
| 326 | + return 0; |
|---|
| 327 | +} |
|---|
| 328 | + |
|---|
| 329 | +#define audit_filter_inodes(t, c) AUDIT_DISABLED |
|---|
| 330 | +#endif /* CONFIG_AUDITSYSCALL */ |
|---|
| 326 | 331 | |
|---|
| 327 | 332 | extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len); |
|---|
| 328 | 333 | |
|---|
| 329 | | -extern pid_t audit_sig_pid; |
|---|
| 330 | | -extern kuid_t audit_sig_uid; |
|---|
| 331 | | -extern u32 audit_sig_sid; |
|---|
| 332 | | - |
|---|
| 333 | 334 | extern int audit_filter(int msgtype, unsigned int listtype); |
|---|
| 334 | | - |
|---|
| 335 | | -#ifdef CONFIG_AUDITSYSCALL |
|---|
| 336 | | -extern int audit_signal_info(int sig, struct task_struct *t); |
|---|
| 337 | | -extern void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx); |
|---|
| 338 | | -extern struct list_head *audit_killed_trees(void); |
|---|
| 339 | | -#else |
|---|
| 340 | | -#define audit_signal_info(s,t) AUDIT_DISABLED |
|---|
| 341 | | -#define audit_filter_inodes(t,c) AUDIT_DISABLED |
|---|
| 342 | | -#endif |
|---|
| 343 | 335 | |
|---|
| 344 | 336 | extern void audit_ctl_lock(void); |
|---|
| 345 | 337 | extern void audit_ctl_unlock(void); |
|---|