aboutsummaryrefslogtreecommitdiff
path: root/include/linux/audit.h
AgeCommit message (Collapse)AuthorFilesLines
2012-09-17audit: Remove the unused uid parameter from audit_receive_filterEric W. Biederman1-1/+1
Cc: Al Viro <[email protected]> Cc: Eric Paris <[email protected]> Signed-off-by: "Eric W. Biederman" <[email protected]>
2012-09-17audit: Use current instead of NETLINK_CREDS() in audit_filterEric W. Biederman1-1/+1
Get caller process uid and gid and pid values from the current task instead of the NETLINK_CB. This is simpler than passing NETLINK_CREDS from from audit_receive_msg to audit_filter_user_rules and avoid the chance of being hit by the occassional bugs in netlink uid/gid credential passing. This is a safe changes because all netlink requests are processed in the task of the sending process. Cc: Al Viro <[email protected]> Cc: Eric Paris <[email protected]> Signed-off-by: "Eric W. Biederman" <[email protected]>
2012-09-12audit: export audit_log_task_infoPeter Moody1-0/+2
At the suggestion of [email protected], move this chunk of task logging from audit_log_exit to audit_log_task_info and export this function so it's usuable elsewhere in the kernel. This patch is against git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity#next-ima-appraisal Changelog v2: - add empty audit_log_task_info if CONFIG_AUDITSYSCALL isn't set. Changelog v1: - Initial post. Signed-off-by: Peter Moody <[email protected]> Signed-off-by: Mimi Zohar <[email protected]>
2012-07-29fs: add link restriction audit reportingKees Cook1-0/+4
Adds audit messages for unexpected link restriction violations so that system owners will have some sort of potentially actionable information about misbehaving processes. Signed-off-by: Kees Cook <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-04-14seccomp: remove duplicated failure loggingKees Cook1-4/+4
This consolidates the seccomp filter error logging path and adds more details to the audit log. Signed-off-by: Will Drewry <[email protected]> Signed-off-by: Kees Cook <[email protected]> Acked-by: Eric Paris <[email protected]> v18: make compat= permanent in the record v15: added a return code to the audit_seccomp path by [email protected] (suggested by [email protected]) v*: original by [email protected] Signed-off-by: James Morris <[email protected]>
2012-03-20constify path argument of audit_log_d_path()Al Viro1-1/+1
Signed-off-by: Al Viro <[email protected]>
2012-01-17audit: comparison on interprocess fieldsPeter Moody1-1/+23
This allows audit to specify rules in which we compare two fields of a process. Such as is the running process uid != to the running process euid? Signed-off-by: Peter Moody <[email protected]> Signed-off-by: Eric Paris <[email protected]>
2012-01-17audit: implement all object interfield comparisonsPeter Moody1-1/+9
This completes the matrix of interfield comparisons between uid/gid information for the current task and the uid/gid information for inodes. aka I can audit based on differences between the euid of the process and the uid of fs objects. Signed-off-by: Peter Moody <[email protected]> Signed-off-by: Eric Paris <[email protected]>
2012-01-17audit: allow interfield comparison between gid and ogidEric Paris1-1/+2
Allow audit rules to compare the gid of the running task to the gid of the inode in question. Signed-off-by: Eric Paris <[email protected]>
2012-01-17audit: allow interfield comparison in audit rulesEric Paris1-0/+4
We wish to be able to audit when a uid=500 task accesses a file which is uid=0. Or vice versa. This patch introduces a new audit filter type AUDIT_FIELD_COMPARE which takes as an 'enum' which indicates which fields should be compared. At this point we only define the task->uid vs inode->uid, but other comparisons can be added. Signed-off-by: Eric Paris <[email protected]>
2012-01-17audit: remove task argument to audit_set_loginuidEric Paris1-1/+1
The function always deals with current. Don't expose an option pretending one can use it for something. You can't. Signed-off-by: Eric Paris <[email protected]>
2012-01-17audit: allow audit matching on inode gidEric Paris1-0/+1
Much like the ability to filter audit on the uid of an inode collected, we should be able to filter on the gid of the inode. Signed-off-by: Eric Paris <[email protected]>
2012-01-17audit: allow matching on obj_uidEric Paris1-0/+1
Allow syscall exit filter matching based on the uid of the owner of an inode used in a syscall. aka: auditctl -a always,exit -S open -F obj_uid=0 -F perm=wa Signed-off-by: Eric Paris <[email protected]>
2012-01-17audit: remove audit_finish_fork as it can't be calledEric Paris1-2/+0
Audit entry,always rules are not allowed and are automatically changed in exit,always rules in userspace. The kernel refuses to load such rules. Thus a task in the middle of a syscall (and thus in audit_finish_fork()) can only be in one of two states: AUDIT_BUILD_CONTEXT or AUDIT_DISABLED. Since the current task cannot be in AUDIT_RECORD_CONTEXT we aren't every going to actually use the code in audit_finish_fork() since it will return without doing anything. Thus drop the code. Signed-off-by: Eric Paris <[email protected]>
2012-01-17audit: inline audit_free to simplify the look of generic codeEric Paris1-1/+6
make the conditional a static inline instead of doing it in generic code. Signed-off-by: Eric Paris <[email protected]>
2012-01-17audit: drop audit_set_macxattr as it doesn't do anythingEric Paris1-2/+0
unused. deleted. Signed-off-by: Eric Paris <[email protected]>
2012-01-17audit: inline checks for not needing to collect aux recordsEric Paris1-3/+20
A number of audit hooks make function calls before they determine that auxilary records do not need to be collected. Do those checks as static inlines since the most common case is going to be that records are not needed and we can skip the function call overhead. Signed-off-by: Eric Paris <[email protected]>
2012-01-17audit: inline audit_syscall_entry to reduce burden on archsEric Paris1-3/+10
Every arch calls: if (unlikely(current->audit_context)) audit_syscall_entry() which requires knowledge about audit (the existance of audit_context) in the arch code. Just do it all in static inline in audit.h so that arch's can remain blissfully ignorant. Signed-off-by: Eric Paris <[email protected]>
2012-01-17Audit: push audit success and retcode into arch ptrace.hEric Paris1-8/+14
The audit system previously expected arches calling to audit_syscall_exit to supply as arguments if the syscall was a success and what the return code was. Audit also provides a helper AUDITSC_RESULT which was supposed to simplify things by converting from negative retcodes to an audit internal magic value stating success or failure. This helper was wrong and could indicate that a valid pointer returned to userspace was a failed syscall. The fix is to fix the layering foolishness. We now pass audit_syscall_exit a struct pt_reg and it in turns calls back into arch code to collect the return value and to determine if the syscall was a success or failure. We also define a generic is_syscall_success() macro which determines success/failure based on if the value is < -MAX_ERRNO. This works for arches like x86 which do not use a separate mechanism to indicate syscall failure. We make both the is_syscall_success() and regs_return_value() static inlines instead of macros. The reason is because the audit function must take a void* for the regs. (uml calls theirs struct uml_pt_regs instead of just struct pt_regs so audit_syscall_exit can't take a struct pt_regs). Since the audit function takes a void* we need to use static inlines to cast it back to the arch correct structure to dereference it. The other major change is that on some arches, like ia64, MIPS and ppc, we change regs_return_value() to give us the negative value on syscall failure. THE only other user of this macro, kretprobe_example.c, won't notice and it makes the value signed consistently for the audit functions across all archs. In arch/sh/kernel/ptrace_64.c I see that we were using regs[9] in the old audit code as the return value. But the ptrace_64.h code defined the macro regs_return_value() as regs[3]. I have no idea which one is correct, but this patch now uses the regs_return_value() function, so it now uses regs[3]. For powerpc we previously used regs->result but now use the regs_return_value() function which uses regs->gprs[3]. regs->gprs[3] is always positive so the regs_return_value(), much like ia64 makes it negative before calling the audit code when appropriate. Signed-off-by: Eric Paris <[email protected]> Acked-by: H. Peter Anvin <[email protected]> [for x86 portion] Acked-by: Tony Luck <[email protected]> [for ia64] Acked-by: Richard Weinberger <[email protected]> [for uml] Acked-by: David S. Miller <[email protected]> [for sparc] Acked-by: Ralf Baechle <[email protected]> [for mips] Acked-by: Benjamin Herrenschmidt <[email protected]> [for ppc]
2012-01-17seccomp: audit abnormal end to a process due to seccompEric Paris1-0/+8
The audit system likes to collect information about processes that end abnormally (SIGSEGV) as this may me useful intrusion detection information. This patch adds audit support to collect information when seccomp forces a task to exit because of misbehavior in a similar way. Signed-off-by: Eric Paris <[email protected]>
2012-01-03switch kern_ipc_perm to umode_tAl Viro1-2/+2
Signed-off-by: Al Viro <[email protected]>
2012-01-03switch mq_open() to umode_tAl Viro1-2/+2
2011-10-31treewide: use __printf not __attribute__((format(printf,...)))Joe Perches1-6/+5
Standardize the style for compiler based printf format verification. Standardized the location of __printf too. Done via script and a little typing. $ grep -rPl --include=*.[ch] -w "__attribute__" * | \ grep -vP "^(tools|scripts|include/linux/compiler-gcc.h)" | \ xargs perl -n -i -e 'local $/; while (<>) { s/\b__attribute__\s*\(\s*\(\s*format\s*\(\s*printf\s*,\s*(.+)\s*,\s*(.+)\s*\)\s*\)\s*\)/__printf($1, $2)/g ; print; }' [[email protected]: revert arch bits] Signed-off-by: Joe Perches <[email protected]> Cc: "Kirill A. Shutemov" <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2011-06-30netfilter: add SELinux context support to AUDIT targetMr Dash Four1-0/+7
In this revision the conversion of secid to SELinux context and adding it to the audit log is moved from xt_AUDIT.c to audit.c with the aid of a separate helper function - audit_log_secctx - which does both the conversion and logging of SELinux context, thus also preventing internal secid number being leaked to userspace. If conversion is not successful an error is raised. With the introduction of this helper function the work done in xt_AUDIT.c is much more simplified. It also opens the possibility of this helper function being used by other modules (including auditd itself), if desired. With this addition, typical (raw auditd) output after applying the patch would be: type=NETFILTER_PKT msg=audit(1305852240.082:31012): action=0 hook=1 len=52 inif=? outif=eth0 saddr=10.1.1.7 daddr=10.1.2.1 ipid=16312 proto=6 sport=56150 dport=22 obj=system_u:object_r:ssh_client_packet_t:s0 type=NETFILTER_PKT msg=audit(1306772064.079:56): action=0 hook=3 len=48 inif=eth0 outif=? smac=00:05:5d:7c:27:0b dmac=00:02:b3:0a:7f:81 macproto=0x0800 saddr=10.1.2.1 daddr=10.1.1.7 ipid=462 proto=6 sport=22 dport=3561 obj=system_u:object_r:ssh_server_packet_t:s0 Acked-by: Eric Paris <[email protected]> Signed-off-by: Mr Dash Four <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2011-01-19Merge branch 'master' of /repos/git/net-next-2.6Patrick McHardy1-0/+1
2011-01-16netfilter: create audit records for x_tables replacesThomas Graf1-0/+1
The setsockopt() syscall to replace tables is already recorded in the audit logs. This patch stores additional information such as table name and netfilter protocol. Cc: Patrick McHardy <[email protected]> Cc: Eric Paris <[email protected]> Cc: Al Viro <[email protected]> Signed-off-by: Thomas Graf <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2011-01-16netfilter: audit target to record accepted/dropped packetsThomas Graf1-0/+1
This patch adds a new netfilter target which creates audit records for packets traversing a certain chain. It can be used to record packets which are rejected administraively as follows: -N AUDIT_DROP -A AUDIT_DROP -j AUDIT --type DROP -A AUDIT_DROP -j DROP a rule which would typically drop or reject a packet would then invoke the new chain to record packets before dropping them. -j AUDIT_DROP The module is protocol independant and works for iptables, ip6tables and ebtables. The following information is logged: - netfilter hook - packet length - incomming/outgoing interface - MAC src/dst/proto for ethernet packets - src/dst/protocol address for IPv4/IPv6 - src/dst port for TCP/UDP/UDPLITE - icmp type/code Cc: Patrick McHardy <[email protected]> Cc: Eric Paris <[email protected]> Cc: Al Viro <[email protected]> Signed-off-by: Thomas Graf <[email protected]> Signed-off-by: Patrick McHardy <[email protected]>
2011-01-10headers: path.h reduxAlexey Dobriyan1-0/+1
Remove path.h from sched.h and other files. Signed-off-by: Alexey Dobriyan <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-10-30audit mmapAl Viro1-0/+9
Normal syscall audit doesn't catch 5th argument of syscall. It also doesn't catch the contents of userland structures pointed to be syscall argument, so for both old and new mmap(2) ABI it doesn't record the descriptor we are mapping. For old one it also misses flags. Signed-off-by: Al Viro <[email protected]>
2010-08-07gcc-4.6: fs: fix unused but set warningsAndi Kleen1-1/+1
No real bugs I believe, just some dead code, and some shut up code. Signed-off-by: Andi Kleen <[email protected]> Cc: Eric Paris <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2010-02-08Lose the first argument of audit_inode_child()Al Viro1-6/+5
it's always equal to ->d_name.name of the second argument Signed-off-by: Al Viro <[email protected]>
2009-06-24Audit: clean up all op= output to include string quotingEric Paris1-0/+3
A number of places in the audit system we send an op= followed by a string that includes spaces. Somehow this works but it's just wrong. This patch moves all of those that I could find to be quoted. Example: Change From: type=CONFIG_CHANGE msg=audit(1244666690.117:31): auid=0 ses=1 subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 op=remove rule key="number2" list=4 res=0 Change To: type=CONFIG_CHANGE msg=audit(1244666690.117:31): auid=0 ses=1 subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 op="remove rule" key="number2" list=4 res=0 Signed-off-by: Eric Paris <[email protected]>
2009-02-12integrity: audit updateMimi Zohar1-1/+3
Based on discussions on linux-audit, as per Steve Grubb's request http://lkml.org/lkml/2009/2/6/269, the following changes were made: - forced audit result to be either 0 or 1. - made template names const - Added new stand-alone message type: AUDIT_INTEGRITY_RULE Signed-off-by: Mimi Zohar <[email protected]> Acked-by: Steve Grubb <[email protected]> Signed-off-by: James Morris <[email protected]>
2009-02-06Merge branch 'master' into nextJames Morris1-50/+48
Conflicts: fs/namei.c Manually merged per: diff --cc fs/namei.c index 734f2b5,bbc15c2..0000000 --- a/fs/namei.c +++ b/fs/namei.c @@@ -860,9 -848,8 +849,10 @@@ static int __link_path_walk(const char nd->flags |= LOOKUP_CONTINUE; err = exec_permission_lite(inode); if (err == -EAGAIN) - err = vfs_permission(nd, MAY_EXEC); + err = inode_permission(nd->path.dentry->d_inode, + MAY_EXEC); + if (!err) + err = ima_path_check(&nd->path, MAY_EXEC); if (err) break; @@@ -1525,14 -1506,9 +1509,14 @@@ int may_open(struct path *path, int acc flag &= ~O_TRUNC; } - error = vfs_permission(nd, acc_mode); + error = inode_permission(inode, acc_mode); if (error) return error; + - error = ima_path_check(&nd->path, ++ error = ima_path_check(path, + acc_mode & (MAY_READ | MAY_WRITE | MAY_EXEC)); + if (error) + return error; /* * An append-only file must be opened in append mode for writing. */ Signed-off-by: James Morris <[email protected]>
2009-02-06integrity: IMA as an integrity service providerMimi Zohar1-0/+5
IMA provides hardware (TPM) based measurement and attestation for file measurements. As the Trusted Computing (TPM) model requires, IMA measures all files before they are accessed in any way (on the integrity_bprm_check, integrity_path_check and integrity_file_mmap hooks), and commits the measurements to the TPM. Once added to the TPM, measurements can not be removed. In addition, IMA maintains a list of these file measurements, which can be used to validate the aggregate value stored in the TPM. The TPM can sign these measurements, and thus the system can prove, to itself and to a third party, the system's integrity in a way that cannot be circumvented by malicious or compromised software. - alloc ima_template_entry before calling ima_store_template() - log ima_add_boot_aggregate() failure - removed unused IMA_TEMPLATE_NAME_LEN - replaced hard coded string length with #define name Signed-off-by: Mimi Zohar <[email protected]> Signed-off-by: James Morris <[email protected]>
2009-01-04audit: validate comparison operations, store them in sane formAl Viro1-0/+12
Don't store the field->op in the messy (and very inconvenient for e.g. audit_comparator()) form; translate to dense set of values and do full validation of userland-submitted value while we are at it. ->audit_init_rule() and ->audit_match_rule() get new values now; in-tree instances updated. Signed-off-by: Al Viro <[email protected]>
2009-01-04audit rules ordering, part 2Al Viro1-0/+1
Fix the actual rule listing; add per-type lists _not_ used for matching, with all exit,... sitting on one such list. Simplifies "do something for all rules" logics, while we are at it... Signed-off-by: Al Viro <[email protected]>
2009-01-04fixing audit rule ordering mess, part 1Al Viro1-0/+1
Problem: ordering between the rules on exit chain is currently lost; all watch and inode rules are listed after everything else _and_ exit,never on one kind doesn't stop exit,always on another from being matched. Solution: assign priorities to rules, keep track of the current highest-priority matching rule and its result (always/never). Signed-off-by: Al Viro <[email protected]>
2009-01-04sanitize audit_log_capset()Al Viro1-5/+4
* no allocations * return void * don't duplicate checked for dummy context Signed-off-by: Al Viro <[email protected]>
2009-01-04sanitize audit_fd_pair()Al Viro1-5/+4
* no allocations * return void Signed-off-by: Al Viro <[email protected]>
2009-01-04sanitize audit_mq_open()Al Viro1-5/+4
* don't bother with allocations * don't do double copy_from_user() * don't duplicate parts of check for audit_dummy_context() Signed-off-by: Al Viro <[email protected]>
2009-01-04sanitize AUDIT_MQ_SENDRECVAl Viro1-13/+4
* logging the original value of *msg_prio in mq_timedreceive(2) is insane - the argument is write-only (i.e. syscall always ignores the original value and only overwrites it). * merge __audit_mq_timed{send,receive} * don't do copy_from_user() twice * don't mess with allocations in auditsc part * ... and don't bother checking !audit_enabled and !context in there - we'd already checked for audit_dummy_context(). Signed-off-by: Al Viro <[email protected]>
2009-01-04sanitize audit_mq_notify()Al Viro1-5/+4
* don't copy_from_user() twice * don't bother with allocations * don't duplicate parts of audit_dummy_context() * make it return void Signed-off-by: Al Viro <[email protected]>
2009-01-04sanitize audit_mq_getsetattr()Al Viro1-5/+4
* get rid of allocations * make it return void * don't duplicate parts of audit_dummy_context() Signed-off-by: Al Viro <[email protected]>
2009-01-04sanitize audit_ipc_set_perm()Al Viro1-5/+4
* get rid of allocations * make it return void * simplify callers Signed-off-by: Al Viro <[email protected]>
2009-01-04sanitize audit_ipc_obj()Al Viro1-5/+4
* get rid of allocations * make it return void * simplify callers Signed-off-by: Al Viro <[email protected]>
2009-01-04sanitize audit_socketcallAl Viro1-2/+2
* don't bother with allocations * now that it can't fail, make it return void Signed-off-by: Al Viro <[email protected]>
2008-12-25Merge branch 'next' into for-linusJames Morris1-0/+26
2008-12-09[PATCH] fix broken timestamps in AVC generated by kernel threadsAl Viro1-2/+2
Timestamp in audit_context is valid only if ->in_syscall is set. Signed-off-by: Al Viro <[email protected]>
2008-12-09[PATCH] return records for fork() both to child and parentAl Viro1-0/+2
Signed-off-by: Al Viro <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.