hc
2024-12-19 9370bb92b2d16684ee45cf24e879c93c509162da
kernel/kernel/audit.h
....@@ -1,22 +1,9 @@
1
+/* SPDX-License-Identifier: GPL-2.0-or-later */
12 /* audit -- definition of audit_context structure and supporting types
23 *
34 * Copyright 2003-2004 Red Hat, Inc.
45 * Copyright 2005 Hewlett-Packard Development Company, L.P.
56 * Copyright 2005 IBM Corporation
6
- *
7
- * This program is free software; you can redistribute it and/or modify
8
- * it under the terms of the GNU General Public License as published by
9
- * the Free Software Foundation; either version 2 of the License, or
10
- * (at your option) any later version.
11
- *
12
- * This program is distributed in the hope that it will be useful,
13
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
- * GNU General Public License for more details.
16
- *
17
- * You should have received a copy of the GNU General Public License
18
- * along with this program; if not, write to the Free Software
19
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
207 */
218
229 #include <linux/fs.h>
....@@ -69,6 +56,7 @@
6956 kernel_cap_t effective; /* effective set of process */
7057 };
7158 kernel_cap_t ambient;
59
+ kuid_t rootid;
7260 };
7361
7462 /* When fs/namei.c:getname() is called, we store the pointer in name and bump
....@@ -203,6 +191,10 @@
203191 struct {
204192 char *name;
205193 } module;
194
+ struct {
195
+ struct audit_ntp_data ntp_data;
196
+ struct timespec64 tk_injoffset;
197
+ } time;
206198 };
207199 int fds[2];
208200 struct audit_proctitle proctitle;
....@@ -210,14 +202,7 @@
210202
211203 extern bool audit_ever_enabled;
212204
213
-extern void audit_copy_inode(struct audit_names *name,
214
- const struct dentry *dentry,
215
- struct inode *inode);
216
-extern void audit_log_cap(struct audit_buffer *ab, char *prefix,
217
- kernel_cap_t *cap);
218
-extern void audit_log_name(struct audit_context *context,
219
- struct audit_names *n, const struct path *path,
220
- int record_num, int *call_panic);
205
+extern void audit_log_session_info(struct audit_buffer *ab);
221206
222207 extern int auditd_test_task(struct task_struct *task);
223208
....@@ -237,7 +222,7 @@
237222 extern int audit_uid_comparator(kuid_t left, u32 op, kuid_t right);
238223 extern int audit_gid_comparator(kgid_t left, u32 op, kgid_t right);
239224 extern int parent_len(const char *path);
240
-extern int audit_compare_dname_path(const char *dname, const char *path, int plen);
225
+extern int audit_compare_dname_path(const struct qstr *dname, const char *path, int plen);
241226 extern struct sk_buff *audit_make_reply(int seq, int type, int done, int multi,
242227 const void *payload, int size);
243228 extern void audit_panic(const char *message);
....@@ -262,28 +247,55 @@
262247 extern void audit_log_d_path_exe(struct audit_buffer *ab,
263248 struct mm_struct *mm);
264249
265
-extern struct tty_struct *audit_get_tty(struct task_struct *tsk);
250
+extern struct tty_struct *audit_get_tty(void);
266251 extern void audit_put_tty(struct tty_struct *tty);
267252
268
-/* audit watch functions */
269
-#ifdef CONFIG_AUDIT_WATCH
253
+/* audit watch/mark/tree functions */
254
+#ifdef CONFIG_AUDITSYSCALL
255
+extern unsigned int audit_serial(void);
256
+extern int auditsc_get_stamp(struct audit_context *ctx,
257
+ struct timespec64 *t, unsigned int *serial);
258
+
270259 extern void audit_put_watch(struct audit_watch *watch);
271260 extern void audit_get_watch(struct audit_watch *watch);
272
-extern int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op);
261
+extern int audit_to_watch(struct audit_krule *krule, char *path, int len,
262
+ u32 op);
273263 extern int audit_add_watch(struct audit_krule *krule, struct list_head **list);
274264 extern void audit_remove_watch_rule(struct audit_krule *krule);
275265 extern char *audit_watch_path(struct audit_watch *watch);
276
-extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev);
266
+extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino,
267
+ dev_t dev);
277268
278
-extern struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len);
269
+extern struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule,
270
+ char *pathname, int len);
279271 extern char *audit_mark_path(struct audit_fsnotify_mark *mark);
280272 extern void audit_remove_mark(struct audit_fsnotify_mark *audit_mark);
281273 extern void audit_remove_mark_rule(struct audit_krule *krule);
282
-extern int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev);
274
+extern int audit_mark_compare(struct audit_fsnotify_mark *mark,
275
+ unsigned long ino, dev_t dev);
283276 extern int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old);
284
-extern int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark);
277
+extern int audit_exe_compare(struct task_struct *tsk,
278
+ struct audit_fsnotify_mark *mark);
285279
286
-#else
280
+extern struct audit_chunk *audit_tree_lookup(const struct inode *inode);
281
+extern void audit_put_chunk(struct audit_chunk *chunk);
282
+extern bool audit_tree_match(struct audit_chunk *chunk,
283
+ struct audit_tree *tree);
284
+extern int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op);
285
+extern int audit_add_tree_rule(struct audit_krule *rule);
286
+extern int audit_remove_tree_rule(struct audit_krule *rule);
287
+extern void audit_trim_trees(void);
288
+extern int audit_tag_tree(char *old, char *new);
289
+extern const char *audit_tree_path(struct audit_tree *tree);
290
+extern void audit_put_tree(struct audit_tree *tree);
291
+extern void audit_kill_trees(struct audit_context *context);
292
+
293
+extern int audit_signal_info_syscall(struct task_struct *t);
294
+extern void audit_filter_inodes(struct task_struct *tsk,
295
+ struct audit_context *ctx);
296
+extern struct list_head *audit_killed_trees(void);
297
+#else /* CONFIG_AUDITSYSCALL */
298
+#define auditsc_get_stamp(c, t, s) 0
287299 #define audit_put_watch(w) {}
288300 #define audit_get_watch(w) {}
289301 #define audit_to_watch(k, p, l, o) (-EINVAL)
....@@ -299,21 +311,7 @@
299311 #define audit_mark_compare(m, i, d) 0
300312 #define audit_exe_compare(t, m) (-EINVAL)
301313 #define audit_dupe_exe(n, o) (-EINVAL)
302
-#endif /* CONFIG_AUDIT_WATCH */
303314
304
-#ifdef CONFIG_AUDIT_TREE
305
-extern struct audit_chunk *audit_tree_lookup(const struct inode *inode);
306
-extern void audit_put_chunk(struct audit_chunk *chunk);
307
-extern bool audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree);
308
-extern int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op);
309
-extern int audit_add_tree_rule(struct audit_krule *rule);
310
-extern int audit_remove_tree_rule(struct audit_krule *rule);
311
-extern void audit_trim_trees(void);
312
-extern int audit_tag_tree(char *old, char *new);
313
-extern const char *audit_tree_path(struct audit_tree *tree);
314
-extern void audit_put_tree(struct audit_tree *tree);
315
-extern void audit_kill_trees(struct list_head *list);
316
-#else
317315 #define audit_remove_tree_rule(rule) BUG()
318316 #define audit_add_tree_rule(rule) -EINVAL
319317 #define audit_make_tree(rule, str, op) -EINVAL
....@@ -321,25 +319,19 @@
321319 #define audit_put_tree(tree) (void)0
322320 #define audit_tag_tree(old, new) -EINVAL
323321 #define audit_tree_path(rule) "" /* never called */
324
-#define audit_kill_trees(list) BUG()
325
-#endif
322
+#define audit_kill_trees(context) BUG()
323
+
324
+static inline int audit_signal_info_syscall(struct task_struct *t)
325
+{
326
+ return 0;
327
+}
328
+
329
+#define audit_filter_inodes(t, c) AUDIT_DISABLED
330
+#endif /* CONFIG_AUDITSYSCALL */
326331
327332 extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);
328333
329
-extern pid_t audit_sig_pid;
330
-extern kuid_t audit_sig_uid;
331
-extern u32 audit_sig_sid;
332
-
333334 extern int audit_filter(int msgtype, unsigned int listtype);
334
-
335
-#ifdef CONFIG_AUDITSYSCALL
336
-extern int audit_signal_info(int sig, struct task_struct *t);
337
-extern void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx);
338
-extern struct list_head *audit_killed_trees(void);
339
-#else
340
-#define audit_signal_info(s,t) AUDIT_DISABLED
341
-#define audit_filter_inodes(t,c) AUDIT_DISABLED
342
-#endif
343335
344336 extern void audit_ctl_lock(void);
345337 extern void audit_ctl_unlock(void);