.. | .. |
---|
| 1 | +/* SPDX-License-Identifier: GPL-2.0-or-later */ |
---|
1 | 2 | /* audit -- definition of audit_context structure and supporting types |
---|
2 | 3 | * |
---|
3 | 4 | * Copyright 2003-2004 Red Hat, Inc. |
---|
4 | 5 | * Copyright 2005 Hewlett-Packard Development Company, L.P. |
---|
5 | 6 | * Copyright 2005 IBM Corporation |
---|
6 | | - * |
---|
7 | | - * This program is free software; you can redistribute it and/or modify |
---|
8 | | - * it under the terms of the GNU General Public License as published by |
---|
9 | | - * the Free Software Foundation; either version 2 of the License, or |
---|
10 | | - * (at your option) any later version. |
---|
11 | | - * |
---|
12 | | - * This program is distributed in the hope that it will be useful, |
---|
13 | | - * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
14 | | - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
15 | | - * GNU General Public License for more details. |
---|
16 | | - * |
---|
17 | | - * You should have received a copy of the GNU General Public License |
---|
18 | | - * along with this program; if not, write to the Free Software |
---|
19 | | - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
---|
20 | 7 | */ |
---|
21 | 8 | |
---|
22 | 9 | #include <linux/fs.h> |
---|
.. | .. |
---|
69 | 56 | kernel_cap_t effective; /* effective set of process */ |
---|
70 | 57 | }; |
---|
71 | 58 | kernel_cap_t ambient; |
---|
| 59 | + kuid_t rootid; |
---|
72 | 60 | }; |
---|
73 | 61 | |
---|
74 | 62 | /* When fs/namei.c:getname() is called, we store the pointer in name and bump |
---|
.. | .. |
---|
203 | 191 | struct { |
---|
204 | 192 | char *name; |
---|
205 | 193 | } module; |
---|
| 194 | + struct { |
---|
| 195 | + struct audit_ntp_data ntp_data; |
---|
| 196 | + struct timespec64 tk_injoffset; |
---|
| 197 | + } time; |
---|
206 | 198 | }; |
---|
207 | 199 | int fds[2]; |
---|
208 | 200 | struct audit_proctitle proctitle; |
---|
.. | .. |
---|
210 | 202 | |
---|
211 | 203 | extern bool audit_ever_enabled; |
---|
212 | 204 | |
---|
213 | | -extern void audit_copy_inode(struct audit_names *name, |
---|
214 | | - const struct dentry *dentry, |
---|
215 | | - struct inode *inode); |
---|
216 | | -extern void audit_log_cap(struct audit_buffer *ab, char *prefix, |
---|
217 | | - kernel_cap_t *cap); |
---|
218 | | -extern void audit_log_name(struct audit_context *context, |
---|
219 | | - struct audit_names *n, const struct path *path, |
---|
220 | | - int record_num, int *call_panic); |
---|
| 205 | +extern void audit_log_session_info(struct audit_buffer *ab); |
---|
221 | 206 | |
---|
222 | 207 | extern int auditd_test_task(struct task_struct *task); |
---|
223 | 208 | |
---|
.. | .. |
---|
237 | 222 | extern int audit_uid_comparator(kuid_t left, u32 op, kuid_t right); |
---|
238 | 223 | extern int audit_gid_comparator(kgid_t left, u32 op, kgid_t right); |
---|
239 | 224 | extern int parent_len(const char *path); |
---|
240 | | -extern int audit_compare_dname_path(const char *dname, const char *path, int plen); |
---|
| 225 | +extern int audit_compare_dname_path(const struct qstr *dname, const char *path, int plen); |
---|
241 | 226 | extern struct sk_buff *audit_make_reply(int seq, int type, int done, int multi, |
---|
242 | 227 | const void *payload, int size); |
---|
243 | 228 | extern void audit_panic(const char *message); |
---|
.. | .. |
---|
262 | 247 | extern void audit_log_d_path_exe(struct audit_buffer *ab, |
---|
263 | 248 | struct mm_struct *mm); |
---|
264 | 249 | |
---|
265 | | -extern struct tty_struct *audit_get_tty(struct task_struct *tsk); |
---|
| 250 | +extern struct tty_struct *audit_get_tty(void); |
---|
266 | 251 | extern void audit_put_tty(struct tty_struct *tty); |
---|
267 | 252 | |
---|
268 | | -/* audit watch functions */ |
---|
269 | | -#ifdef CONFIG_AUDIT_WATCH |
---|
| 253 | +/* audit watch/mark/tree functions */ |
---|
| 254 | +#ifdef CONFIG_AUDITSYSCALL |
---|
| 255 | +extern unsigned int audit_serial(void); |
---|
| 256 | +extern int auditsc_get_stamp(struct audit_context *ctx, |
---|
| 257 | + struct timespec64 *t, unsigned int *serial); |
---|
| 258 | + |
---|
270 | 259 | extern void audit_put_watch(struct audit_watch *watch); |
---|
271 | 260 | extern void audit_get_watch(struct audit_watch *watch); |
---|
272 | | -extern int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op); |
---|
| 261 | +extern int audit_to_watch(struct audit_krule *krule, char *path, int len, |
---|
| 262 | + u32 op); |
---|
273 | 263 | extern int audit_add_watch(struct audit_krule *krule, struct list_head **list); |
---|
274 | 264 | extern void audit_remove_watch_rule(struct audit_krule *krule); |
---|
275 | 265 | extern char *audit_watch_path(struct audit_watch *watch); |
---|
276 | | -extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev); |
---|
| 266 | +extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, |
---|
| 267 | + dev_t dev); |
---|
277 | 268 | |
---|
278 | | -extern struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len); |
---|
| 269 | +extern struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, |
---|
| 270 | + char *pathname, int len); |
---|
279 | 271 | extern char *audit_mark_path(struct audit_fsnotify_mark *mark); |
---|
280 | 272 | extern void audit_remove_mark(struct audit_fsnotify_mark *audit_mark); |
---|
281 | 273 | extern void audit_remove_mark_rule(struct audit_krule *krule); |
---|
282 | | -extern int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev); |
---|
| 274 | +extern int audit_mark_compare(struct audit_fsnotify_mark *mark, |
---|
| 275 | + unsigned long ino, dev_t dev); |
---|
283 | 276 | extern int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old); |
---|
284 | | -extern int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark); |
---|
| 277 | +extern int audit_exe_compare(struct task_struct *tsk, |
---|
| 278 | + struct audit_fsnotify_mark *mark); |
---|
285 | 279 | |
---|
286 | | -#else |
---|
| 280 | +extern struct audit_chunk *audit_tree_lookup(const struct inode *inode); |
---|
| 281 | +extern void audit_put_chunk(struct audit_chunk *chunk); |
---|
| 282 | +extern bool audit_tree_match(struct audit_chunk *chunk, |
---|
| 283 | + struct audit_tree *tree); |
---|
| 284 | +extern int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op); |
---|
| 285 | +extern int audit_add_tree_rule(struct audit_krule *rule); |
---|
| 286 | +extern int audit_remove_tree_rule(struct audit_krule *rule); |
---|
| 287 | +extern void audit_trim_trees(void); |
---|
| 288 | +extern int audit_tag_tree(char *old, char *new); |
---|
| 289 | +extern const char *audit_tree_path(struct audit_tree *tree); |
---|
| 290 | +extern void audit_put_tree(struct audit_tree *tree); |
---|
| 291 | +extern void audit_kill_trees(struct audit_context *context); |
---|
| 292 | + |
---|
| 293 | +extern int audit_signal_info_syscall(struct task_struct *t); |
---|
| 294 | +extern void audit_filter_inodes(struct task_struct *tsk, |
---|
| 295 | + struct audit_context *ctx); |
---|
| 296 | +extern struct list_head *audit_killed_trees(void); |
---|
| 297 | +#else /* CONFIG_AUDITSYSCALL */ |
---|
| 298 | +#define auditsc_get_stamp(c, t, s) 0 |
---|
287 | 299 | #define audit_put_watch(w) {} |
---|
288 | 300 | #define audit_get_watch(w) {} |
---|
289 | 301 | #define audit_to_watch(k, p, l, o) (-EINVAL) |
---|
.. | .. |
---|
299 | 311 | #define audit_mark_compare(m, i, d) 0 |
---|
300 | 312 | #define audit_exe_compare(t, m) (-EINVAL) |
---|
301 | 313 | #define audit_dupe_exe(n, o) (-EINVAL) |
---|
302 | | -#endif /* CONFIG_AUDIT_WATCH */ |
---|
303 | 314 | |
---|
304 | | -#ifdef CONFIG_AUDIT_TREE |
---|
305 | | -extern struct audit_chunk *audit_tree_lookup(const struct inode *inode); |
---|
306 | | -extern void audit_put_chunk(struct audit_chunk *chunk); |
---|
307 | | -extern bool audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree); |
---|
308 | | -extern int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op); |
---|
309 | | -extern int audit_add_tree_rule(struct audit_krule *rule); |
---|
310 | | -extern int audit_remove_tree_rule(struct audit_krule *rule); |
---|
311 | | -extern void audit_trim_trees(void); |
---|
312 | | -extern int audit_tag_tree(char *old, char *new); |
---|
313 | | -extern const char *audit_tree_path(struct audit_tree *tree); |
---|
314 | | -extern void audit_put_tree(struct audit_tree *tree); |
---|
315 | | -extern void audit_kill_trees(struct list_head *list); |
---|
316 | | -#else |
---|
317 | 315 | #define audit_remove_tree_rule(rule) BUG() |
---|
318 | 316 | #define audit_add_tree_rule(rule) -EINVAL |
---|
319 | 317 | #define audit_make_tree(rule, str, op) -EINVAL |
---|
.. | .. |
---|
321 | 319 | #define audit_put_tree(tree) (void)0 |
---|
322 | 320 | #define audit_tag_tree(old, new) -EINVAL |
---|
323 | 321 | #define audit_tree_path(rule) "" /* never called */ |
---|
324 | | -#define audit_kill_trees(list) BUG() |
---|
325 | | -#endif |
---|
| 322 | +#define audit_kill_trees(context) BUG() |
---|
| 323 | + |
---|
| 324 | +static inline int audit_signal_info_syscall(struct task_struct *t) |
---|
| 325 | +{ |
---|
| 326 | + return 0; |
---|
| 327 | +} |
---|
| 328 | + |
---|
| 329 | +#define audit_filter_inodes(t, c) AUDIT_DISABLED |
---|
| 330 | +#endif /* CONFIG_AUDITSYSCALL */ |
---|
326 | 331 | |
---|
327 | 332 | extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len); |
---|
328 | 333 | |
---|
329 | | -extern pid_t audit_sig_pid; |
---|
330 | | -extern kuid_t audit_sig_uid; |
---|
331 | | -extern u32 audit_sig_sid; |
---|
332 | | - |
---|
333 | 334 | extern int audit_filter(int msgtype, unsigned int listtype); |
---|
334 | | - |
---|
335 | | -#ifdef CONFIG_AUDITSYSCALL |
---|
336 | | -extern int audit_signal_info(int sig, struct task_struct *t); |
---|
337 | | -extern void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx); |
---|
338 | | -extern struct list_head *audit_killed_trees(void); |
---|
339 | | -#else |
---|
340 | | -#define audit_signal_info(s,t) AUDIT_DISABLED |
---|
341 | | -#define audit_filter_inodes(t,c) AUDIT_DISABLED |
---|
342 | | -#endif |
---|
343 | 335 | |
---|
344 | 336 | extern void audit_ctl_lock(void); |
---|
345 | 337 | extern void audit_ctl_unlock(void); |
---|