1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* auditsc.c -- System-call auditing support
3  * Handles all system-call specific auditing features.
4  *
5  * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
6  * Copyright 2005 Hewlett-Packard Development Company, L.P.
7  * Copyright (C) 2005, 2006 IBM Corporation
8  * All Rights Reserved.
9  *
10  * Written by Rickard E. (Rik) Faith <faith@redhat.com>
11  *
12  * Many of the ideas implemented here are from Stephen C. Tweedie,
13  * especially the idea of avoiding a copy by using getname.
14  *
15  * The method for actual interception of syscall entry and exit (not in
16  * this file -- see entry.S) is based on a GPL'd patch written by
17  * okir@suse.de and Copyright 2003 SuSE Linux AG.
18  *
19  * POSIX message queue support added by George Wilson <ltcgcw@us.ibm.com>,
20  * 2006.
21  *
22  * The support of additional filter rules compares (>, <, >=, <=) was
23  * added by Dustin Kirkland <dustin.kirkland@us.ibm.com>, 2005.
24  *
25  * Modified by Amy Griffis <amy.griffis@hp.com> to collect additional
26  * filesystem information.
27  *
28  * Subject and object context labeling support added by <danjones@us.ibm.com>
29  * and <dustin.kirkland@us.ibm.com> for LSPP certification compliance.
30  */
31 
32 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
33 
34 #include <linux/init.h>
35 #include <asm/types.h>
36 #include <linux/atomic.h>
37 #include <linux/fs.h>
38 #include <linux/namei.h>
39 #include <linux/mm.h>
40 #include <linux/export.h>
41 #include <linux/slab.h>
42 #include <linux/mount.h>
43 #include <linux/socket.h>
44 #include <linux/mqueue.h>
45 #include <linux/audit.h>
46 #include <linux/personality.h>
47 #include <linux/time.h>
48 #include <linux/netlink.h>
49 #include <linux/compiler.h>
50 #include <asm/unistd.h>
51 #include <linux/security.h>
52 #include <linux/list.h>
53 #include <linux/binfmts.h>
54 #include <linux/highmem.h>
55 #include <linux/syscalls.h>
56 #include <asm/syscall.h>
57 #include <linux/capability.h>
58 #include <linux/fs_struct.h>
59 #include <linux/compat.h>
60 #include <linux/ctype.h>
61 #include <linux/string.h>
62 #include <linux/uaccess.h>
63 #include <linux/fsnotify_backend.h>
64 #include <uapi/linux/limits.h>
65 #include <uapi/linux/netfilter/nf_tables.h>
66 #include <uapi/linux/openat2.h> // struct open_how
67 
68 #include "audit.h"
69 
70 /* flags stating the success for a syscall */
71 #define AUDITSC_INVALID 0
72 #define AUDITSC_SUCCESS 1
73 #define AUDITSC_FAILURE 2
74 
75 /* no execve audit message should be longer than this (userspace limits),
76  * see the note near the top of audit_log_execve_info() about this value */
77 #define MAX_EXECVE_AUDIT_LEN 7500
78 
79 /* max length to print of cmdline/proctitle value during audit */
80 #define MAX_PROCTITLE_AUDIT_LEN 128
81 
82 /* number of audit rules */
83 int audit_n_rules;
84 
85 /* determines whether we collect data for signals sent */
86 int audit_signals;
87 
88 struct audit_aux_data {
89 	struct audit_aux_data	*next;
90 	int			type;
91 };
92 
93 /* Number of target pids per aux struct. */
94 #define AUDIT_AUX_PIDS	16
95 
96 struct audit_aux_data_pids {
97 	struct audit_aux_data	d;
98 	pid_t			target_pid[AUDIT_AUX_PIDS];
99 	kuid_t			target_auid[AUDIT_AUX_PIDS];
100 	kuid_t			target_uid[AUDIT_AUX_PIDS];
101 	unsigned int		target_sessionid[AUDIT_AUX_PIDS];
102 	u32			target_sid[AUDIT_AUX_PIDS];
103 	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
104 	int			pid_count;
105 };
106 
107 struct audit_aux_data_bprm_fcaps {
108 	struct audit_aux_data	d;
109 	struct audit_cap_data	fcap;
110 	unsigned int		fcap_ver;
111 	struct audit_cap_data	old_pcap;
112 	struct audit_cap_data	new_pcap;
113 };
114 
115 struct audit_tree_refs {
116 	struct audit_tree_refs *next;
117 	struct audit_chunk *c[31];
118 };
119 
120 struct audit_nfcfgop_tab {
121 	enum audit_nfcfgop	op;
122 	const char		*s;
123 };
124 
125 static const struct audit_nfcfgop_tab audit_nfcfgs[] = {
126 	{ AUDIT_XT_OP_REGISTER,			"xt_register"		   },
127 	{ AUDIT_XT_OP_REPLACE,			"xt_replace"		   },
128 	{ AUDIT_XT_OP_UNREGISTER,		"xt_unregister"		   },
129 	{ AUDIT_NFT_OP_TABLE_REGISTER,		"nft_register_table"	   },
130 	{ AUDIT_NFT_OP_TABLE_UNREGISTER,	"nft_unregister_table"	   },
131 	{ AUDIT_NFT_OP_CHAIN_REGISTER,		"nft_register_chain"	   },
132 	{ AUDIT_NFT_OP_CHAIN_UNREGISTER,	"nft_unregister_chain"	   },
133 	{ AUDIT_NFT_OP_RULE_REGISTER,		"nft_register_rule"	   },
134 	{ AUDIT_NFT_OP_RULE_UNREGISTER,		"nft_unregister_rule"	   },
135 	{ AUDIT_NFT_OP_SET_REGISTER,		"nft_register_set"	   },
136 	{ AUDIT_NFT_OP_SET_UNREGISTER,		"nft_unregister_set"	   },
137 	{ AUDIT_NFT_OP_SETELEM_REGISTER,	"nft_register_setelem"	   },
138 	{ AUDIT_NFT_OP_SETELEM_UNREGISTER,	"nft_unregister_setelem"   },
139 	{ AUDIT_NFT_OP_GEN_REGISTER,		"nft_register_gen"	   },
140 	{ AUDIT_NFT_OP_OBJ_REGISTER,		"nft_register_obj"	   },
141 	{ AUDIT_NFT_OP_OBJ_UNREGISTER,		"nft_unregister_obj"	   },
142 	{ AUDIT_NFT_OP_OBJ_RESET,		"nft_reset_obj"		   },
143 	{ AUDIT_NFT_OP_FLOWTABLE_REGISTER,	"nft_register_flowtable"   },
144 	{ AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,	"nft_unregister_flowtable" },
145 	{ AUDIT_NFT_OP_INVALID,			"nft_invalid"		   },
146 };
147 
audit_match_perm(struct audit_context * ctx,int mask)148 static int audit_match_perm(struct audit_context *ctx, int mask)
149 {
150 	unsigned n;
151 
152 	if (unlikely(!ctx))
153 		return 0;
154 	n = ctx->major;
155 
156 	switch (audit_classify_syscall(ctx->arch, n)) {
157 	case AUDITSC_NATIVE:
158 		if ((mask & AUDIT_PERM_WRITE) &&
159 		     audit_match_class(AUDIT_CLASS_WRITE, n))
160 			return 1;
161 		if ((mask & AUDIT_PERM_READ) &&
162 		     audit_match_class(AUDIT_CLASS_READ, n))
163 			return 1;
164 		if ((mask & AUDIT_PERM_ATTR) &&
165 		     audit_match_class(AUDIT_CLASS_CHATTR, n))
166 			return 1;
167 		return 0;
168 	case AUDITSC_COMPAT: /* 32bit on biarch */
169 		if ((mask & AUDIT_PERM_WRITE) &&
170 		     audit_match_class(AUDIT_CLASS_WRITE_32, n))
171 			return 1;
172 		if ((mask & AUDIT_PERM_READ) &&
173 		     audit_match_class(AUDIT_CLASS_READ_32, n))
174 			return 1;
175 		if ((mask & AUDIT_PERM_ATTR) &&
176 		     audit_match_class(AUDIT_CLASS_CHATTR_32, n))
177 			return 1;
178 		return 0;
179 	case AUDITSC_OPEN:
180 		return mask & ACC_MODE(ctx->argv[1]);
181 	case AUDITSC_OPENAT:
182 		return mask & ACC_MODE(ctx->argv[2]);
183 	case AUDITSC_SOCKETCALL:
184 		return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);
185 	case AUDITSC_EXECVE:
186 		return mask & AUDIT_PERM_EXEC;
187 	case AUDITSC_OPENAT2:
188 		return mask & ACC_MODE((u32)ctx->openat2.flags);
189 	default:
190 		return 0;
191 	}
192 }
193 
audit_match_filetype(struct audit_context * ctx,int val)194 static int audit_match_filetype(struct audit_context *ctx, int val)
195 {
196 	struct audit_names *n;
197 	umode_t mode = (umode_t)val;
198 
199 	if (unlikely(!ctx))
200 		return 0;
201 
202 	list_for_each_entry(n, &ctx->names_list, list) {
203 		if ((n->ino != AUDIT_INO_UNSET) &&
204 		    ((n->mode & S_IFMT) == mode))
205 			return 1;
206 	}
207 
208 	return 0;
209 }
210 
211 /*
212  * We keep a linked list of fixed-sized (31 pointer) arrays of audit_chunk *;
213  * ->first_trees points to its beginning, ->trees - to the current end of data.
214  * ->tree_count is the number of free entries in array pointed to by ->trees.
215  * Original condition is (NULL, NULL, 0); as soon as it grows we never revert to NULL,
216  * "empty" becomes (p, p, 31) afterwards.  We don't shrink the list (and seriously,
217  * it's going to remain 1-element for almost any setup) until we free context itself.
218  * References in it _are_ dropped - at the same time we free/drop aux stuff.
219  */
220 
audit_set_auditable(struct audit_context * ctx)221 static void audit_set_auditable(struct audit_context *ctx)
222 {
223 	if (!ctx->prio) {
224 		ctx->prio = 1;
225 		ctx->current_state = AUDIT_STATE_RECORD;
226 	}
227 }
228 
put_tree_ref(struct audit_context * ctx,struct audit_chunk * chunk)229 static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk)
230 {
231 	struct audit_tree_refs *p = ctx->trees;
232 	int left = ctx->tree_count;
233 
234 	if (likely(left)) {
235 		p->c[--left] = chunk;
236 		ctx->tree_count = left;
237 		return 1;
238 	}
239 	if (!p)
240 		return 0;
241 	p = p->next;
242 	if (p) {
243 		p->c[30] = chunk;
244 		ctx->trees = p;
245 		ctx->tree_count = 30;
246 		return 1;
247 	}
248 	return 0;
249 }
250 
grow_tree_refs(struct audit_context * ctx)251 static int grow_tree_refs(struct audit_context *ctx)
252 {
253 	struct audit_tree_refs *p = ctx->trees;
254 
255 	ctx->trees = kzalloc(sizeof(struct audit_tree_refs), GFP_KERNEL);
256 	if (!ctx->trees) {
257 		ctx->trees = p;
258 		return 0;
259 	}
260 	if (p)
261 		p->next = ctx->trees;
262 	else
263 		ctx->first_trees = ctx->trees;
264 	ctx->tree_count = 31;
265 	return 1;
266 }
267 
unroll_tree_refs(struct audit_context * ctx,struct audit_tree_refs * p,int count)268 static void unroll_tree_refs(struct audit_context *ctx,
269 		      struct audit_tree_refs *p, int count)
270 {
271 	struct audit_tree_refs *q;
272 	int n;
273 
274 	if (!p) {
275 		/* we started with empty chain */
276 		p = ctx->first_trees;
277 		count = 31;
278 		/* if the very first allocation has failed, nothing to do */
279 		if (!p)
280 			return;
281 	}
282 	n = count;
283 	for (q = p; q != ctx->trees; q = q->next, n = 31) {
284 		while (n--) {
285 			audit_put_chunk(q->c[n]);
286 			q->c[n] = NULL;
287 		}
288 	}
289 	while (n-- > ctx->tree_count) {
290 		audit_put_chunk(q->c[n]);
291 		q->c[n] = NULL;
292 	}
293 	ctx->trees = p;
294 	ctx->tree_count = count;
295 }
296 
free_tree_refs(struct audit_context * ctx)297 static void free_tree_refs(struct audit_context *ctx)
298 {
299 	struct audit_tree_refs *p, *q;
300 
301 	for (p = ctx->first_trees; p; p = q) {
302 		q = p->next;
303 		kfree(p);
304 	}
305 }
306 
match_tree_refs(struct audit_context * ctx,struct audit_tree * tree)307 static int match_tree_refs(struct audit_context *ctx, struct audit_tree *tree)
308 {
309 	struct audit_tree_refs *p;
310 	int n;
311 
312 	if (!tree)
313 		return 0;
314 	/* full ones */
315 	for (p = ctx->first_trees; p != ctx->trees; p = p->next) {
316 		for (n = 0; n < 31; n++)
317 			if (audit_tree_match(p->c[n], tree))
318 				return 1;
319 	}
320 	/* partial */
321 	if (p) {
322 		for (n = ctx->tree_count; n < 31; n++)
323 			if (audit_tree_match(p->c[n], tree))
324 				return 1;
325 	}
326 	return 0;
327 }
328 
audit_compare_uid(kuid_t uid,struct audit_names * name,struct audit_field * f,struct audit_context * ctx)329 static int audit_compare_uid(kuid_t uid,
330 			     struct audit_names *name,
331 			     struct audit_field *f,
332 			     struct audit_context *ctx)
333 {
334 	struct audit_names *n;
335 	int rc;
336 
337 	if (name) {
338 		rc = audit_uid_comparator(uid, f->op, name->uid);
339 		if (rc)
340 			return rc;
341 	}
342 
343 	if (ctx) {
344 		list_for_each_entry(n, &ctx->names_list, list) {
345 			rc = audit_uid_comparator(uid, f->op, n->uid);
346 			if (rc)
347 				return rc;
348 		}
349 	}
350 	return 0;
351 }
352 
audit_compare_gid(kgid_t gid,struct audit_names * name,struct audit_field * f,struct audit_context * ctx)353 static int audit_compare_gid(kgid_t gid,
354 			     struct audit_names *name,
355 			     struct audit_field *f,
356 			     struct audit_context *ctx)
357 {
358 	struct audit_names *n;
359 	int rc;
360 
361 	if (name) {
362 		rc = audit_gid_comparator(gid, f->op, name->gid);
363 		if (rc)
364 			return rc;
365 	}
366 
367 	if (ctx) {
368 		list_for_each_entry(n, &ctx->names_list, list) {
369 			rc = audit_gid_comparator(gid, f->op, n->gid);
370 			if (rc)
371 				return rc;
372 		}
373 	}
374 	return 0;
375 }
376 
audit_field_compare(struct task_struct * tsk,const struct cred * cred,struct audit_field * f,struct audit_context * ctx,struct audit_names * name)377 static int audit_field_compare(struct task_struct *tsk,
378 			       const struct cred *cred,
379 			       struct audit_field *f,
380 			       struct audit_context *ctx,
381 			       struct audit_names *name)
382 {
383 	switch (f->val) {
384 	/* process to file object comparisons */
385 	case AUDIT_COMPARE_UID_TO_OBJ_UID:
386 		return audit_compare_uid(cred->uid, name, f, ctx);
387 	case AUDIT_COMPARE_GID_TO_OBJ_GID:
388 		return audit_compare_gid(cred->gid, name, f, ctx);
389 	case AUDIT_COMPARE_EUID_TO_OBJ_UID:
390 		return audit_compare_uid(cred->euid, name, f, ctx);
391 	case AUDIT_COMPARE_EGID_TO_OBJ_GID:
392 		return audit_compare_gid(cred->egid, name, f, ctx);
393 	case AUDIT_COMPARE_AUID_TO_OBJ_UID:
394 		return audit_compare_uid(audit_get_loginuid(tsk), name, f, ctx);
395 	case AUDIT_COMPARE_SUID_TO_OBJ_UID:
396 		return audit_compare_uid(cred->suid, name, f, ctx);
397 	case AUDIT_COMPARE_SGID_TO_OBJ_GID:
398 		return audit_compare_gid(cred->sgid, name, f, ctx);
399 	case AUDIT_COMPARE_FSUID_TO_OBJ_UID:
400 		return audit_compare_uid(cred->fsuid, name, f, ctx);
401 	case AUDIT_COMPARE_FSGID_TO_OBJ_GID:
402 		return audit_compare_gid(cred->fsgid, name, f, ctx);
403 	/* uid comparisons */
404 	case AUDIT_COMPARE_UID_TO_AUID:
405 		return audit_uid_comparator(cred->uid, f->op,
406 					    audit_get_loginuid(tsk));
407 	case AUDIT_COMPARE_UID_TO_EUID:
408 		return audit_uid_comparator(cred->uid, f->op, cred->euid);
409 	case AUDIT_COMPARE_UID_TO_SUID:
410 		return audit_uid_comparator(cred->uid, f->op, cred->suid);
411 	case AUDIT_COMPARE_UID_TO_FSUID:
412 		return audit_uid_comparator(cred->uid, f->op, cred->fsuid);
413 	/* auid comparisons */
414 	case AUDIT_COMPARE_AUID_TO_EUID:
415 		return audit_uid_comparator(audit_get_loginuid(tsk), f->op,
416 					    cred->euid);
417 	case AUDIT_COMPARE_AUID_TO_SUID:
418 		return audit_uid_comparator(audit_get_loginuid(tsk), f->op,
419 					    cred->suid);
420 	case AUDIT_COMPARE_AUID_TO_FSUID:
421 		return audit_uid_comparator(audit_get_loginuid(tsk), f->op,
422 					    cred->fsuid);
423 	/* euid comparisons */
424 	case AUDIT_COMPARE_EUID_TO_SUID:
425 		return audit_uid_comparator(cred->euid, f->op, cred->suid);
426 	case AUDIT_COMPARE_EUID_TO_FSUID:
427 		return audit_uid_comparator(cred->euid, f->op, cred->fsuid);
428 	/* suid comparisons */
429 	case AUDIT_COMPARE_SUID_TO_FSUID:
430 		return audit_uid_comparator(cred->suid, f->op, cred->fsuid);
431 	/* gid comparisons */
432 	case AUDIT_COMPARE_GID_TO_EGID:
433 		return audit_gid_comparator(cred->gid, f->op, cred->egid);
434 	case AUDIT_COMPARE_GID_TO_SGID:
435 		return audit_gid_comparator(cred->gid, f->op, cred->sgid);
436 	case AUDIT_COMPARE_GID_TO_FSGID:
437 		return audit_gid_comparator(cred->gid, f->op, cred->fsgid);
438 	/* egid comparisons */
439 	case AUDIT_COMPARE_EGID_TO_SGID:
440 		return audit_gid_comparator(cred->egid, f->op, cred->sgid);
441 	case AUDIT_COMPARE_EGID_TO_FSGID:
442 		return audit_gid_comparator(cred->egid, f->op, cred->fsgid);
443 	/* sgid comparison */
444 	case AUDIT_COMPARE_SGID_TO_FSGID:
445 		return audit_gid_comparator(cred->sgid, f->op, cred->fsgid);
446 	default:
447 		WARN(1, "Missing AUDIT_COMPARE define.  Report as a bug\n");
448 		return 0;
449 	}
450 	return 0;
451 }
452 
453 /* Determine if any context name data matches a rule's watch data */
454 /* Compare a task_struct with an audit_rule.  Return 1 on match, 0
455  * otherwise.
456  *
457  * If task_creation is true, this is an explicit indication that we are
458  * filtering a task rule at task creation time.  This and tsk == current are
459  * the only situations where tsk->cred may be accessed without an rcu read lock.
460  */
audit_filter_rules(struct task_struct * tsk,struct audit_krule * rule,struct audit_context * ctx,struct audit_names * name,enum audit_state * state,bool task_creation)461 static int audit_filter_rules(struct task_struct *tsk,
462 			      struct audit_krule *rule,
463 			      struct audit_context *ctx,
464 			      struct audit_names *name,
465 			      enum audit_state *state,
466 			      bool task_creation)
467 {
468 	const struct cred *cred;
469 	int i, need_sid = 1;
470 	u32 sid;
471 	unsigned int sessionid;
472 
473 	if (ctx && rule->prio <= ctx->prio)
474 		return 0;
475 
476 	cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation);
477 
478 	for (i = 0; i < rule->field_count; i++) {
479 		struct audit_field *f = &rule->fields[i];
480 		struct audit_names *n;
481 		int result = 0;
482 		pid_t pid;
483 
484 		switch (f->type) {
485 		case AUDIT_PID:
486 			pid = task_tgid_nr(tsk);
487 			result = audit_comparator(pid, f->op, f->val);
488 			break;
489 		case AUDIT_PPID:
490 			if (ctx) {
491 				if (!ctx->ppid)
492 					ctx->ppid = task_ppid_nr(tsk);
493 				result = audit_comparator(ctx->ppid, f->op, f->val);
494 			}
495 			break;
496 		case AUDIT_EXE:
497 			result = audit_exe_compare(tsk, rule->exe);
498 			if (f->op == Audit_not_equal)
499 				result = !result;
500 			break;
501 		case AUDIT_UID:
502 			result = audit_uid_comparator(cred->uid, f->op, f->uid);
503 			break;
504 		case AUDIT_EUID:
505 			result = audit_uid_comparator(cred->euid, f->op, f->uid);
506 			break;
507 		case AUDIT_SUID:
508 			result = audit_uid_comparator(cred->suid, f->op, f->uid);
509 			break;
510 		case AUDIT_FSUID:
511 			result = audit_uid_comparator(cred->fsuid, f->op, f->uid);
512 			break;
513 		case AUDIT_GID:
514 			result = audit_gid_comparator(cred->gid, f->op, f->gid);
515 			if (f->op == Audit_equal) {
516 				if (!result)
517 					result = groups_search(cred->group_info, f->gid);
518 			} else if (f->op == Audit_not_equal) {
519 				if (result)
520 					result = !groups_search(cred->group_info, f->gid);
521 			}
522 			break;
523 		case AUDIT_EGID:
524 			result = audit_gid_comparator(cred->egid, f->op, f->gid);
525 			if (f->op == Audit_equal) {
526 				if (!result)
527 					result = groups_search(cred->group_info, f->gid);
528 			} else if (f->op == Audit_not_equal) {
529 				if (result)
530 					result = !groups_search(cred->group_info, f->gid);
531 			}
532 			break;
533 		case AUDIT_SGID:
534 			result = audit_gid_comparator(cred->sgid, f->op, f->gid);
535 			break;
536 		case AUDIT_FSGID:
537 			result = audit_gid_comparator(cred->fsgid, f->op, f->gid);
538 			break;
539 		case AUDIT_SESSIONID:
540 			sessionid = audit_get_sessionid(tsk);
541 			result = audit_comparator(sessionid, f->op, f->val);
542 			break;
543 		case AUDIT_PERS:
544 			result = audit_comparator(tsk->personality, f->op, f->val);
545 			break;
546 		case AUDIT_ARCH:
547 			if (ctx)
548 				result = audit_comparator(ctx->arch, f->op, f->val);
549 			break;
550 
551 		case AUDIT_EXIT:
552 			if (ctx && ctx->return_valid != AUDITSC_INVALID)
553 				result = audit_comparator(ctx->return_code, f->op, f->val);
554 			break;
555 		case AUDIT_SUCCESS:
556 			if (ctx && ctx->return_valid != AUDITSC_INVALID) {
557 				if (f->val)
558 					result = audit_comparator(ctx->return_valid, f->op, AUDITSC_SUCCESS);
559 				else
560 					result = audit_comparator(ctx->return_valid, f->op, AUDITSC_FAILURE);
561 			}
562 			break;
563 		case AUDIT_DEVMAJOR:
564 			if (name) {
565 				if (audit_comparator(MAJOR(name->dev), f->op, f->val) ||
566 				    audit_comparator(MAJOR(name->rdev), f->op, f->val))
567 					++result;
568 			} else if (ctx) {
569 				list_for_each_entry(n, &ctx->names_list, list) {
570 					if (audit_comparator(MAJOR(n->dev), f->op, f->val) ||
571 					    audit_comparator(MAJOR(n->rdev), f->op, f->val)) {
572 						++result;
573 						break;
574 					}
575 				}
576 			}
577 			break;
578 		case AUDIT_DEVMINOR:
579 			if (name) {
580 				if (audit_comparator(MINOR(name->dev), f->op, f->val) ||
581 				    audit_comparator(MINOR(name->rdev), f->op, f->val))
582 					++result;
583 			} else if (ctx) {
584 				list_for_each_entry(n, &ctx->names_list, list) {
585 					if (audit_comparator(MINOR(n->dev), f->op, f->val) ||
586 					    audit_comparator(MINOR(n->rdev), f->op, f->val)) {
587 						++result;
588 						break;
589 					}
590 				}
591 			}
592 			break;
593 		case AUDIT_INODE:
594 			if (name)
595 				result = audit_comparator(name->ino, f->op, f->val);
596 			else if (ctx) {
597 				list_for_each_entry(n, &ctx->names_list, list) {
598 					if (audit_comparator(n->ino, f->op, f->val)) {
599 						++result;
600 						break;
601 					}
602 				}
603 			}
604 			break;
605 		case AUDIT_OBJ_UID:
606 			if (name) {
607 				result = audit_uid_comparator(name->uid, f->op, f->uid);
608 			} else if (ctx) {
609 				list_for_each_entry(n, &ctx->names_list, list) {
610 					if (audit_uid_comparator(n->uid, f->op, f->uid)) {
611 						++result;
612 						break;
613 					}
614 				}
615 			}
616 			break;
617 		case AUDIT_OBJ_GID:
618 			if (name) {
619 				result = audit_gid_comparator(name->gid, f->op, f->gid);
620 			} else if (ctx) {
621 				list_for_each_entry(n, &ctx->names_list, list) {
622 					if (audit_gid_comparator(n->gid, f->op, f->gid)) {
623 						++result;
624 						break;
625 					}
626 				}
627 			}
628 			break;
629 		case AUDIT_WATCH:
630 			if (name) {
631 				result = audit_watch_compare(rule->watch,
632 							     name->ino,
633 							     name->dev);
634 				if (f->op == Audit_not_equal)
635 					result = !result;
636 			}
637 			break;
638 		case AUDIT_DIR:
639 			if (ctx) {
640 				result = match_tree_refs(ctx, rule->tree);
641 				if (f->op == Audit_not_equal)
642 					result = !result;
643 			}
644 			break;
645 		case AUDIT_LOGINUID:
646 			result = audit_uid_comparator(audit_get_loginuid(tsk),
647 						      f->op, f->uid);
648 			break;
649 		case AUDIT_LOGINUID_SET:
650 			result = audit_comparator(audit_loginuid_set(tsk), f->op, f->val);
651 			break;
652 		case AUDIT_SADDR_FAM:
653 			if (ctx && ctx->sockaddr)
654 				result = audit_comparator(ctx->sockaddr->ss_family,
655 							  f->op, f->val);
656 			break;
657 		case AUDIT_SUBJ_USER:
658 		case AUDIT_SUBJ_ROLE:
659 		case AUDIT_SUBJ_TYPE:
660 		case AUDIT_SUBJ_SEN:
661 		case AUDIT_SUBJ_CLR:
662 			/* NOTE: this may return negative values indicating
663 			   a temporary error.  We simply treat this as a
664 			   match for now to avoid losing information that
665 			   may be wanted.   An error message will also be
666 			   logged upon error */
667 			if (f->lsm_rule) {
668 				if (need_sid) {
669 					/* @tsk should always be equal to
670 					 * @current with the exception of
671 					 * fork()/copy_process() in which case
672 					 * the new @tsk creds are still a dup
673 					 * of @current's creds so we can still
674 					 * use security_current_getsecid_subj()
675 					 * here even though it always refs
676 					 * @current's creds
677 					 */
678 					security_current_getsecid_subj(&sid);
679 					need_sid = 0;
680 				}
681 				result = security_audit_rule_match(sid, f->type,
682 								   f->op,
683 								   f->lsm_rule);
684 			}
685 			break;
686 		case AUDIT_OBJ_USER:
687 		case AUDIT_OBJ_ROLE:
688 		case AUDIT_OBJ_TYPE:
689 		case AUDIT_OBJ_LEV_LOW:
690 		case AUDIT_OBJ_LEV_HIGH:
691 			/* The above note for AUDIT_SUBJ_USER...AUDIT_SUBJ_CLR
692 			   also applies here */
693 			if (f->lsm_rule) {
694 				/* Find files that match */
695 				if (name) {
696 					result = security_audit_rule_match(
697 								name->osid,
698 								f->type,
699 								f->op,
700 								f->lsm_rule);
701 				} else if (ctx) {
702 					list_for_each_entry(n, &ctx->names_list, list) {
703 						if (security_audit_rule_match(
704 								n->osid,
705 								f->type,
706 								f->op,
707 								f->lsm_rule)) {
708 							++result;
709 							break;
710 						}
711 					}
712 				}
713 				/* Find ipc objects that match */
714 				if (!ctx || ctx->type != AUDIT_IPC)
715 					break;
716 				if (security_audit_rule_match(ctx->ipc.osid,
717 							      f->type, f->op,
718 							      f->lsm_rule))
719 					++result;
720 			}
721 			break;
722 		case AUDIT_ARG0:
723 		case AUDIT_ARG1:
724 		case AUDIT_ARG2:
725 		case AUDIT_ARG3:
726 			if (ctx)
727 				result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
728 			break;
729 		case AUDIT_FILTERKEY:
730 			/* ignore this field for filtering */
731 			result = 1;
732 			break;
733 		case AUDIT_PERM:
734 			result = audit_match_perm(ctx, f->val);
735 			if (f->op == Audit_not_equal)
736 				result = !result;
737 			break;
738 		case AUDIT_FILETYPE:
739 			result = audit_match_filetype(ctx, f->val);
740 			if (f->op == Audit_not_equal)
741 				result = !result;
742 			break;
743 		case AUDIT_FIELD_COMPARE:
744 			result = audit_field_compare(tsk, cred, f, ctx, name);
745 			break;
746 		}
747 		if (!result)
748 			return 0;
749 	}
750 
751 	if (ctx) {
752 		if (rule->filterkey) {
753 			kfree(ctx->filterkey);
754 			ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
755 		}
756 		ctx->prio = rule->prio;
757 	}
758 	switch (rule->action) {
759 	case AUDIT_NEVER:
760 		*state = AUDIT_STATE_DISABLED;
761 		break;
762 	case AUDIT_ALWAYS:
763 		*state = AUDIT_STATE_RECORD;
764 		break;
765 	}
766 	return 1;
767 }
768 
769 /* At process creation time, we can determine if system-call auditing is
770  * completely disabled for this task.  Since we only have the task
771  * structure at this point, we can only check uid and gid.
772  */
audit_filter_task(struct task_struct * tsk,char ** key)773 static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
774 {
775 	struct audit_entry *e;
776 	enum audit_state   state;
777 
778 	rcu_read_lock();
779 	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
780 		if (audit_filter_rules(tsk, &e->rule, NULL, NULL,
781 				       &state, true)) {
782 			if (state == AUDIT_STATE_RECORD)
783 				*key = kstrdup(e->rule.filterkey, GFP_ATOMIC);
784 			rcu_read_unlock();
785 			return state;
786 		}
787 	}
788 	rcu_read_unlock();
789 	return AUDIT_STATE_BUILD;
790 }
791 
audit_in_mask(const struct audit_krule * rule,unsigned long val)792 static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
793 {
794 	int word, bit;
795 
796 	if (val > 0xffffffff)
797 		return false;
798 
799 	word = AUDIT_WORD(val);
800 	if (word >= AUDIT_BITMASK_SIZE)
801 		return false;
802 
803 	bit = AUDIT_BIT(val);
804 
805 	return rule->mask[word] & bit;
806 }
807 
808 /**
809  * audit_filter_uring - apply filters to an io_uring operation
810  * @tsk: associated task
811  * @ctx: audit context
812  */
audit_filter_uring(struct task_struct * tsk,struct audit_context * ctx)813 static void audit_filter_uring(struct task_struct *tsk,
814 			       struct audit_context *ctx)
815 {
816 	struct audit_entry *e;
817 	enum audit_state state;
818 
819 	if (auditd_test_task(tsk))
820 		return;
821 
822 	rcu_read_lock();
823 	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_URING_EXIT],
824 				list) {
825 		if (audit_in_mask(&e->rule, ctx->uring_op) &&
826 		    audit_filter_rules(tsk, &e->rule, ctx, NULL, &state,
827 				       false)) {
828 			rcu_read_unlock();
829 			ctx->current_state = state;
830 			return;
831 		}
832 	}
833 	rcu_read_unlock();
834 }
835 
836 /* At syscall exit time, this filter is called if the audit_state is
837  * not low enough that auditing cannot take place, but is also not
838  * high enough that we already know we have to write an audit record
839  * (i.e., the state is AUDIT_STATE_BUILD).
840  */
audit_filter_syscall(struct task_struct * tsk,struct audit_context * ctx)841 static void audit_filter_syscall(struct task_struct *tsk,
842 				 struct audit_context *ctx)
843 {
844 	struct audit_entry *e;
845 	enum audit_state state;
846 
847 	if (auditd_test_task(tsk))
848 		return;
849 
850 	rcu_read_lock();
851 	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_EXIT], list) {
852 		if (audit_in_mask(&e->rule, ctx->major) &&
853 		    audit_filter_rules(tsk, &e->rule, ctx, NULL,
854 				       &state, false)) {
855 			rcu_read_unlock();
856 			ctx->current_state = state;
857 			return;
858 		}
859 	}
860 	rcu_read_unlock();
861 	return;
862 }
863 
864 /*
865  * Given an audit_name check the inode hash table to see if they match.
866  * Called holding the rcu read lock to protect the use of audit_inode_hash
867  */
audit_filter_inode_name(struct task_struct * tsk,struct audit_names * n,struct audit_context * ctx)868 static int audit_filter_inode_name(struct task_struct *tsk,
869 				   struct audit_names *n,
870 				   struct audit_context *ctx) {
871 	int h = audit_hash_ino((u32)n->ino);
872 	struct list_head *list = &audit_inode_hash[h];
873 	struct audit_entry *e;
874 	enum audit_state state;
875 
876 	list_for_each_entry_rcu(e, list, list) {
877 		if (audit_in_mask(&e->rule, ctx->major) &&
878 		    audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
879 			ctx->current_state = state;
880 			return 1;
881 		}
882 	}
883 	return 0;
884 }
885 
886 /* At syscall exit time, this filter is called if any audit_names have been
887  * collected during syscall processing.  We only check rules in sublists at hash
888  * buckets applicable to the inode numbers in audit_names.
889  * Regarding audit_state, same rules apply as for audit_filter_syscall().
890  */
audit_filter_inodes(struct task_struct * tsk,struct audit_context * ctx)891 void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx)
892 {
893 	struct audit_names *n;
894 
895 	if (auditd_test_task(tsk))
896 		return;
897 
898 	rcu_read_lock();
899 
900 	list_for_each_entry(n, &ctx->names_list, list) {
901 		if (audit_filter_inode_name(tsk, n, ctx))
902 			break;
903 	}
904 	rcu_read_unlock();
905 }
906 
audit_proctitle_free(struct audit_context * context)907 static inline void audit_proctitle_free(struct audit_context *context)
908 {
909 	kfree(context->proctitle.value);
910 	context->proctitle.value = NULL;
911 	context->proctitle.len = 0;
912 }
913 
audit_free_module(struct audit_context * context)914 static inline void audit_free_module(struct audit_context *context)
915 {
916 	if (context->type == AUDIT_KERN_MODULE) {
917 		kfree(context->module.name);
918 		context->module.name = NULL;
919 	}
920 }
audit_free_names(struct audit_context * context)921 static inline void audit_free_names(struct audit_context *context)
922 {
923 	struct audit_names *n, *next;
924 
925 	list_for_each_entry_safe(n, next, &context->names_list, list) {
926 		list_del(&n->list);
927 		if (n->name)
928 			putname(n->name);
929 		if (n->should_free)
930 			kfree(n);
931 	}
932 	context->name_count = 0;
933 	path_put(&context->pwd);
934 	context->pwd.dentry = NULL;
935 	context->pwd.mnt = NULL;
936 }
937 
audit_free_aux(struct audit_context * context)938 static inline void audit_free_aux(struct audit_context *context)
939 {
940 	struct audit_aux_data *aux;
941 
942 	while ((aux = context->aux)) {
943 		context->aux = aux->next;
944 		kfree(aux);
945 	}
946 	context->aux = NULL;
947 	while ((aux = context->aux_pids)) {
948 		context->aux_pids = aux->next;
949 		kfree(aux);
950 	}
951 	context->aux_pids = NULL;
952 }
953 
954 /**
955  * audit_reset_context - reset a audit_context structure
956  * @ctx: the audit_context to reset
957  *
958  * All fields in the audit_context will be reset to an initial state, all
959  * references held by fields will be dropped, and private memory will be
960  * released.  When this function returns the audit_context will be suitable
961  * for reuse, so long as the passed context is not NULL or a dummy context.
962  */
audit_reset_context(struct audit_context * ctx)963 static void audit_reset_context(struct audit_context *ctx)
964 {
965 	if (!ctx)
966 		return;
967 
968 	/* if ctx is non-null, reset the "ctx->state" regardless */
969 	ctx->context = AUDIT_CTX_UNUSED;
970 	if (ctx->dummy)
971 		return;
972 
973 	/*
974 	 * NOTE: It shouldn't matter in what order we release the fields, so
975 	 *       release them in the order in which they appear in the struct;
976 	 *       this gives us some hope of quickly making sure we are
977 	 *       resetting the audit_context properly.
978 	 *
979 	 *       Other things worth mentioning:
980 	 *       - we don't reset "dummy"
981 	 *       - we don't reset "state", we do reset "current_state"
982 	 *       - we preserve "filterkey" if "state" is AUDIT_STATE_RECORD
983 	 *       - much of this is likely overkill, but play it safe for now
984 	 *       - we really need to work on improving the audit_context struct
985 	 */
986 
987 	ctx->current_state = ctx->state;
988 	ctx->serial = 0;
989 	ctx->major = 0;
990 	ctx->uring_op = 0;
991 	ctx->ctime = (struct timespec64){ .tv_sec = 0, .tv_nsec = 0 };
992 	memset(ctx->argv, 0, sizeof(ctx->argv));
993 	ctx->return_code = 0;
994 	ctx->prio = (ctx->state == AUDIT_STATE_RECORD ? ~0ULL : 0);
995 	ctx->return_valid = AUDITSC_INVALID;
996 	audit_free_names(ctx);
997 	if (ctx->state != AUDIT_STATE_RECORD) {
998 		kfree(ctx->filterkey);
999 		ctx->filterkey = NULL;
1000 	}
1001 	audit_free_aux(ctx);
1002 	kfree(ctx->sockaddr);
1003 	ctx->sockaddr = NULL;
1004 	ctx->sockaddr_len = 0;
1005 	ctx->pid = ctx->ppid = 0;
1006 	ctx->uid = ctx->euid = ctx->suid = ctx->fsuid = KUIDT_INIT(0);
1007 	ctx->gid = ctx->egid = ctx->sgid = ctx->fsgid = KGIDT_INIT(0);
1008 	ctx->personality = 0;
1009 	ctx->arch = 0;
1010 	ctx->target_pid = 0;
1011 	ctx->target_auid = ctx->target_uid = KUIDT_INIT(0);
1012 	ctx->target_sessionid = 0;
1013 	ctx->target_sid = 0;
1014 	ctx->target_comm[0] = '\0';
1015 	unroll_tree_refs(ctx, NULL, 0);
1016 	WARN_ON(!list_empty(&ctx->killed_trees));
1017 	audit_free_module(ctx);
1018 	ctx->fds[0] = -1;
1019 	audit_proctitle_free(ctx);
1020 	ctx->type = 0; /* reset last for audit_free_*() */
1021 }
1022 
audit_alloc_context(enum audit_state state)1023 static inline struct audit_context *audit_alloc_context(enum audit_state state)
1024 {
1025 	struct audit_context *context;
1026 
1027 	context = kzalloc(sizeof(*context), GFP_KERNEL);
1028 	if (!context)
1029 		return NULL;
1030 	context->context = AUDIT_CTX_UNUSED;
1031 	context->state = state;
1032 	context->prio = state == AUDIT_STATE_RECORD ? ~0ULL : 0;
1033 	INIT_LIST_HEAD(&context->killed_trees);
1034 	INIT_LIST_HEAD(&context->names_list);
1035 	context->fds[0] = -1;
1036 	context->return_valid = AUDITSC_INVALID;
1037 	return context;
1038 }
1039 
1040 /**
1041  * audit_alloc - allocate an audit context block for a task
1042  * @tsk: task
1043  *
1044  * Filter on the task information and allocate a per-task audit context
1045  * if necessary.  Doing so turns on system call auditing for the
1046  * specified task.  This is called from copy_process, so no lock is
1047  * needed.
1048  */
audit_alloc(struct task_struct * tsk)1049 int audit_alloc(struct task_struct *tsk)
1050 {
1051 	struct audit_context *context;
1052 	enum audit_state     state;
1053 	char *key = NULL;
1054 
1055 	if (likely(!audit_ever_enabled))
1056 		return 0;
1057 
1058 	state = audit_filter_task(tsk, &key);
1059 	if (state == AUDIT_STATE_DISABLED) {
1060 		clear_task_syscall_work(tsk, SYSCALL_AUDIT);
1061 		return 0;
1062 	}
1063 
1064 	if (!(context = audit_alloc_context(state))) {
1065 		kfree(key);
1066 		audit_log_lost("out of memory in audit_alloc");
1067 		return -ENOMEM;
1068 	}
1069 	context->filterkey = key;
1070 
1071 	audit_set_context(tsk, context);
1072 	set_task_syscall_work(tsk, SYSCALL_AUDIT);
1073 	return 0;
1074 }
1075 
1076 /**
1077  * audit_alloc_kernel - allocate an audit_context for a kernel task
1078  * @tsk: the kernel task
1079  *
1080  * Similar to the audit_alloc() function, but intended for kernel private
1081  * threads.  Returns zero on success, negative values on failure.
1082  */
audit_alloc_kernel(struct task_struct * tsk)1083 int audit_alloc_kernel(struct task_struct *tsk)
1084 {
1085 	/*
1086 	 * At the moment we are just going to call into audit_alloc() to
1087 	 * simplify the code, but there two things to keep in mind with this
1088 	 * approach:
1089 	 *
1090 	 * 1. Filtering internal kernel tasks is a bit laughable in almost all
1091 	 * cases, but there is at least one case where there is a benefit:
1092 	 * the '-a task,never' case allows the admin to effectively disable
1093 	 * task auditing at runtime.
1094 	 *
1095 	 * 2. The {set,clear}_task_syscall_work() ops likely have zero effect
1096 	 * on these internal kernel tasks, but they probably don't hurt either.
1097 	 */
1098 	return audit_alloc(tsk);
1099 }
1100 
audit_free_context(struct audit_context * context)1101 static inline void audit_free_context(struct audit_context *context)
1102 {
1103 	/* resetting is extra work, but it is likely just noise */
1104 	audit_reset_context(context);
1105 	free_tree_refs(context);
1106 	kfree(context->filterkey);
1107 	kfree(context);
1108 }
1109 
audit_log_pid_context(struct audit_context * context,pid_t pid,kuid_t auid,kuid_t uid,unsigned int sessionid,u32 sid,char * comm)1110 static int audit_log_pid_context(struct audit_context *context, pid_t pid,
1111 				 kuid_t auid, kuid_t uid, unsigned int sessionid,
1112 				 u32 sid, char *comm)
1113 {
1114 	struct audit_buffer *ab;
1115 	char *ctx = NULL;
1116 	u32 len;
1117 	int rc = 0;
1118 
1119 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
1120 	if (!ab)
1121 		return rc;
1122 
1123 	audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid,
1124 			 from_kuid(&init_user_ns, auid),
1125 			 from_kuid(&init_user_ns, uid), sessionid);
1126 	if (sid) {
1127 		if (security_secid_to_secctx(sid, &ctx, &len)) {
1128 			audit_log_format(ab, " obj=(none)");
1129 			rc = 1;
1130 		} else {
1131 			audit_log_format(ab, " obj=%s", ctx);
1132 			security_release_secctx(ctx, len);
1133 		}
1134 	}
1135 	audit_log_format(ab, " ocomm=");
1136 	audit_log_untrustedstring(ab, comm);
1137 	audit_log_end(ab);
1138 
1139 	return rc;
1140 }
1141 
audit_log_execve_info(struct audit_context * context,struct audit_buffer ** ab)1142 static void audit_log_execve_info(struct audit_context *context,
1143 				  struct audit_buffer **ab)
1144 {
1145 	long len_max;
1146 	long len_rem;
1147 	long len_full;
1148 	long len_buf;
1149 	long len_abuf = 0;
1150 	long len_tmp;
1151 	bool require_data;
1152 	bool encode;
1153 	unsigned int iter;
1154 	unsigned int arg;
1155 	char *buf_head;
1156 	char *buf;
1157 	const char __user *p = (const char __user *)current->mm->arg_start;
1158 
1159 	/* NOTE: this buffer needs to be large enough to hold all the non-arg
1160 	 *       data we put in the audit record for this argument (see the
1161 	 *       code below) ... at this point in time 96 is plenty */
1162 	char abuf[96];
1163 
1164 	/* NOTE: we set MAX_EXECVE_AUDIT_LEN to a rather arbitrary limit, the
1165 	 *       current value of 7500 is not as important as the fact that it
1166 	 *       is less than 8k, a setting of 7500 gives us plenty of wiggle
1167 	 *       room if we go over a little bit in the logging below */
1168 	WARN_ON_ONCE(MAX_EXECVE_AUDIT_LEN > 7500);
1169 	len_max = MAX_EXECVE_AUDIT_LEN;
1170 
1171 	/* scratch buffer to hold the userspace args */
1172 	buf_head = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
1173 	if (!buf_head) {
1174 		audit_panic("out of memory for argv string");
1175 		return;
1176 	}
1177 	buf = buf_head;
1178 
1179 	audit_log_format(*ab, "argc=%d", context->execve.argc);
1180 
1181 	len_rem = len_max;
1182 	len_buf = 0;
1183 	len_full = 0;
1184 	require_data = true;
1185 	encode = false;
1186 	iter = 0;
1187 	arg = 0;
1188 	do {
1189 		/* NOTE: we don't ever want to trust this value for anything
1190 		 *       serious, but the audit record format insists we
1191 		 *       provide an argument length for really long arguments,
1192 		 *       e.g. > MAX_EXECVE_AUDIT_LEN, so we have no choice but
1193 		 *       to use strncpy_from_user() to obtain this value for
1194 		 *       recording in the log, although we don't use it
1195 		 *       anywhere here to avoid a double-fetch problem */
1196 		if (len_full == 0)
1197 			len_full = strnlen_user(p, MAX_ARG_STRLEN) - 1;
1198 
1199 		/* read more data from userspace */
1200 		if (require_data) {
1201 			/* can we make more room in the buffer? */
1202 			if (buf != buf_head) {
1203 				memmove(buf_head, buf, len_buf);
1204 				buf = buf_head;
1205 			}
1206 
1207 			/* fetch as much as we can of the argument */
1208 			len_tmp = strncpy_from_user(&buf_head[len_buf], p,
1209 						    len_max - len_buf);
1210 			if (len_tmp == -EFAULT) {
1211 				/* unable to copy from userspace */
1212 				send_sig(SIGKILL, current, 0);
1213 				goto out;
1214 			} else if (len_tmp == (len_max - len_buf)) {
1215 				/* buffer is not large enough */
1216 				require_data = true;
1217 				/* NOTE: if we are going to span multiple
1218 				 *       buffers force the encoding so we stand
1219 				 *       a chance at a sane len_full value and
1220 				 *       consistent record encoding */
1221 				encode = true;
1222 				len_full = len_full * 2;
1223 				p += len_tmp;
1224 			} else {
1225 				require_data = false;
1226 				if (!encode)
1227 					encode = audit_string_contains_control(
1228 								buf, len_tmp);
1229 				/* try to use a trusted value for len_full */
1230 				if (len_full < len_max)
1231 					len_full = (encode ?
1232 						    len_tmp * 2 : len_tmp);
1233 				p += len_tmp + 1;
1234 			}
1235 			len_buf += len_tmp;
1236 			buf_head[len_buf] = '\0';
1237 
1238 			/* length of the buffer in the audit record? */
1239 			len_abuf = (encode ? len_buf * 2 : len_buf + 2);
1240 		}
1241 
1242 		/* write as much as we can to the audit log */
1243 		if (len_buf >= 0) {
1244 			/* NOTE: some magic numbers here - basically if we
1245 			 *       can't fit a reasonable amount of data into the
1246 			 *       existing audit buffer, flush it and start with
1247 			 *       a new buffer */
1248 			if ((sizeof(abuf) + 8) > len_rem) {
1249 				len_rem = len_max;
1250 				audit_log_end(*ab);
1251 				*ab = audit_log_start(context,
1252 						      GFP_KERNEL, AUDIT_EXECVE);
1253 				if (!*ab)
1254 					goto out;
1255 			}
1256 
1257 			/* create the non-arg portion of the arg record */
1258 			len_tmp = 0;
1259 			if (require_data || (iter > 0) ||
1260 			    ((len_abuf + sizeof(abuf)) > len_rem)) {
1261 				if (iter == 0) {
1262 					len_tmp += snprintf(&abuf[len_tmp],
1263 							sizeof(abuf) - len_tmp,
1264 							" a%d_len=%lu",
1265 							arg, len_full);
1266 				}
1267 				len_tmp += snprintf(&abuf[len_tmp],
1268 						    sizeof(abuf) - len_tmp,
1269 						    " a%d[%d]=", arg, iter++);
1270 			} else
1271 				len_tmp += snprintf(&abuf[len_tmp],
1272 						    sizeof(abuf) - len_tmp,
1273 						    " a%d=", arg);
1274 			WARN_ON(len_tmp >= sizeof(abuf));
1275 			abuf[sizeof(abuf) - 1] = '\0';
1276 
1277 			/* log the arg in the audit record */
1278 			audit_log_format(*ab, "%s", abuf);
1279 			len_rem -= len_tmp;
1280 			len_tmp = len_buf;
1281 			if (encode) {
1282 				if (len_abuf > len_rem)
1283 					len_tmp = len_rem / 2; /* encoding */
1284 				audit_log_n_hex(*ab, buf, len_tmp);
1285 				len_rem -= len_tmp * 2;
1286 				len_abuf -= len_tmp * 2;
1287 			} else {
1288 				if (len_abuf > len_rem)
1289 					len_tmp = len_rem - 2; /* quotes */
1290 				audit_log_n_string(*ab, buf, len_tmp);
1291 				len_rem -= len_tmp + 2;
1292 				/* don't subtract the "2" because we still need
1293 				 * to add quotes to the remaining string */
1294 				len_abuf -= len_tmp;
1295 			}
1296 			len_buf -= len_tmp;
1297 			buf += len_tmp;
1298 		}
1299 
1300 		/* ready to move to the next argument? */
1301 		if ((len_buf == 0) && !require_data) {
1302 			arg++;
1303 			iter = 0;
1304 			len_full = 0;
1305 			require_data = true;
1306 			encode = false;
1307 		}
1308 	} while (arg < context->execve.argc);
1309 
1310 	/* NOTE: the caller handles the final audit_log_end() call */
1311 
1312 out:
1313 	kfree(buf_head);
1314 }
1315 
audit_log_cap(struct audit_buffer * ab,char * prefix,kernel_cap_t * cap)1316 static void audit_log_cap(struct audit_buffer *ab, char *prefix,
1317 			  kernel_cap_t *cap)
1318 {
1319 	int i;
1320 
1321 	if (cap_isclear(*cap)) {
1322 		audit_log_format(ab, " %s=0", prefix);
1323 		return;
1324 	}
1325 	audit_log_format(ab, " %s=", prefix);
1326 	CAP_FOR_EACH_U32(i)
1327 		audit_log_format(ab, "%08x", cap->cap[CAP_LAST_U32 - i]);
1328 }
1329 
audit_log_fcaps(struct audit_buffer * ab,struct audit_names * name)1330 static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
1331 {
1332 	if (name->fcap_ver == -1) {
1333 		audit_log_format(ab, " cap_fe=? cap_fver=? cap_fp=? cap_fi=?");
1334 		return;
1335 	}
1336 	audit_log_cap(ab, "cap_fp", &name->fcap.permitted);
1337 	audit_log_cap(ab, "cap_fi", &name->fcap.inheritable);
1338 	audit_log_format(ab, " cap_fe=%d cap_fver=%x cap_frootid=%d",
1339 			 name->fcap.fE, name->fcap_ver,
1340 			 from_kuid(&init_user_ns, name->fcap.rootid));
1341 }
1342 
audit_log_time(struct audit_context * context,struct audit_buffer ** ab)1343 static void audit_log_time(struct audit_context *context, struct audit_buffer **ab)
1344 {
1345 	const struct audit_ntp_data *ntp = &context->time.ntp_data;
1346 	const struct timespec64 *tk = &context->time.tk_injoffset;
1347 	static const char * const ntp_name[] = {
1348 		"offset",
1349 		"freq",
1350 		"status",
1351 		"tai",
1352 		"tick",
1353 		"adjust",
1354 	};
1355 	int type;
1356 
1357 	if (context->type == AUDIT_TIME_ADJNTPVAL) {
1358 		for (type = 0; type < AUDIT_NTP_NVALS; type++) {
1359 			if (ntp->vals[type].newval != ntp->vals[type].oldval) {
1360 				if (!*ab) {
1361 					*ab = audit_log_start(context,
1362 							GFP_KERNEL,
1363 							AUDIT_TIME_ADJNTPVAL);
1364 					if (!*ab)
1365 						return;
1366 				}
1367 				audit_log_format(*ab, "op=%s old=%lli new=%lli",
1368 						 ntp_name[type],
1369 						 ntp->vals[type].oldval,
1370 						 ntp->vals[type].newval);
1371 				audit_log_end(*ab);
1372 				*ab = NULL;
1373 			}
1374 		}
1375 	}
1376 	if (tk->tv_sec != 0 || tk->tv_nsec != 0) {
1377 		if (!*ab) {
1378 			*ab = audit_log_start(context, GFP_KERNEL,
1379 					      AUDIT_TIME_INJOFFSET);
1380 			if (!*ab)
1381 				return;
1382 		}
1383 		audit_log_format(*ab, "sec=%lli nsec=%li",
1384 				 (long long)tk->tv_sec, tk->tv_nsec);
1385 		audit_log_end(*ab);
1386 		*ab = NULL;
1387 	}
1388 }
1389 
show_special(struct audit_context * context,int * call_panic)1390 static void show_special(struct audit_context *context, int *call_panic)
1391 {
1392 	struct audit_buffer *ab;
1393 	int i;
1394 
1395 	ab = audit_log_start(context, GFP_KERNEL, context->type);
1396 	if (!ab)
1397 		return;
1398 
1399 	switch (context->type) {
1400 	case AUDIT_SOCKETCALL: {
1401 		int nargs = context->socketcall.nargs;
1402 
1403 		audit_log_format(ab, "nargs=%d", nargs);
1404 		for (i = 0; i < nargs; i++)
1405 			audit_log_format(ab, " a%d=%lx", i,
1406 				context->socketcall.args[i]);
1407 		break; }
1408 	case AUDIT_IPC: {
1409 		u32 osid = context->ipc.osid;
1410 
1411 		audit_log_format(ab, "ouid=%u ogid=%u mode=%#ho",
1412 				 from_kuid(&init_user_ns, context->ipc.uid),
1413 				 from_kgid(&init_user_ns, context->ipc.gid),
1414 				 context->ipc.mode);
1415 		if (osid) {
1416 			char *ctx = NULL;
1417 			u32 len;
1418 
1419 			if (security_secid_to_secctx(osid, &ctx, &len)) {
1420 				audit_log_format(ab, " osid=%u", osid);
1421 				*call_panic = 1;
1422 			} else {
1423 				audit_log_format(ab, " obj=%s", ctx);
1424 				security_release_secctx(ctx, len);
1425 			}
1426 		}
1427 		if (context->ipc.has_perm) {
1428 			audit_log_end(ab);
1429 			ab = audit_log_start(context, GFP_KERNEL,
1430 					     AUDIT_IPC_SET_PERM);
1431 			if (unlikely(!ab))
1432 				return;
1433 			audit_log_format(ab,
1434 				"qbytes=%lx ouid=%u ogid=%u mode=%#ho",
1435 				context->ipc.qbytes,
1436 				context->ipc.perm_uid,
1437 				context->ipc.perm_gid,
1438 				context->ipc.perm_mode);
1439 		}
1440 		break; }
1441 	case AUDIT_MQ_OPEN:
1442 		audit_log_format(ab,
1443 			"oflag=0x%x mode=%#ho mq_flags=0x%lx mq_maxmsg=%ld "
1444 			"mq_msgsize=%ld mq_curmsgs=%ld",
1445 			context->mq_open.oflag, context->mq_open.mode,
1446 			context->mq_open.attr.mq_flags,
1447 			context->mq_open.attr.mq_maxmsg,
1448 			context->mq_open.attr.mq_msgsize,
1449 			context->mq_open.attr.mq_curmsgs);
1450 		break;
1451 	case AUDIT_MQ_SENDRECV:
1452 		audit_log_format(ab,
1453 			"mqdes=%d msg_len=%zd msg_prio=%u "
1454 			"abs_timeout_sec=%lld abs_timeout_nsec=%ld",
1455 			context->mq_sendrecv.mqdes,
1456 			context->mq_sendrecv.msg_len,
1457 			context->mq_sendrecv.msg_prio,
1458 			(long long) context->mq_sendrecv.abs_timeout.tv_sec,
1459 			context->mq_sendrecv.abs_timeout.tv_nsec);
1460 		break;
1461 	case AUDIT_MQ_NOTIFY:
1462 		audit_log_format(ab, "mqdes=%d sigev_signo=%d",
1463 				context->mq_notify.mqdes,
1464 				context->mq_notify.sigev_signo);
1465 		break;
1466 	case AUDIT_MQ_GETSETATTR: {
1467 		struct mq_attr *attr = &context->mq_getsetattr.mqstat;
1468 
1469 		audit_log_format(ab,
1470 			"mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
1471 			"mq_curmsgs=%ld ",
1472 			context->mq_getsetattr.mqdes,
1473 			attr->mq_flags, attr->mq_maxmsg,
1474 			attr->mq_msgsize, attr->mq_curmsgs);
1475 		break; }
1476 	case AUDIT_CAPSET:
1477 		audit_log_format(ab, "pid=%d", context->capset.pid);
1478 		audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable);
1479 		audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted);
1480 		audit_log_cap(ab, "cap_pe", &context->capset.cap.effective);
1481 		audit_log_cap(ab, "cap_pa", &context->capset.cap.ambient);
1482 		break;
1483 	case AUDIT_MMAP:
1484 		audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd,
1485 				 context->mmap.flags);
1486 		break;
1487 	case AUDIT_OPENAT2:
1488 		audit_log_format(ab, "oflag=0%llo mode=0%llo resolve=0x%llx",
1489 				 context->openat2.flags,
1490 				 context->openat2.mode,
1491 				 context->openat2.resolve);
1492 		break;
1493 	case AUDIT_EXECVE:
1494 		audit_log_execve_info(context, &ab);
1495 		break;
1496 	case AUDIT_KERN_MODULE:
1497 		audit_log_format(ab, "name=");
1498 		if (context->module.name) {
1499 			audit_log_untrustedstring(ab, context->module.name);
1500 		} else
1501 			audit_log_format(ab, "(null)");
1502 
1503 		break;
1504 	case AUDIT_TIME_ADJNTPVAL:
1505 	case AUDIT_TIME_INJOFFSET:
1506 		/* this call deviates from the rest, eating the buffer */
1507 		audit_log_time(context, &ab);
1508 		break;
1509 	}
1510 	audit_log_end(ab);
1511 }
1512 
audit_proctitle_rtrim(char * proctitle,int len)1513 static inline int audit_proctitle_rtrim(char *proctitle, int len)
1514 {
1515 	char *end = proctitle + len - 1;
1516 
1517 	while (end > proctitle && !isprint(*end))
1518 		end--;
1519 
1520 	/* catch the case where proctitle is only 1 non-print character */
1521 	len = end - proctitle + 1;
1522 	len -= isprint(proctitle[len-1]) == 0;
1523 	return len;
1524 }
1525 
1526 /*
1527  * audit_log_name - produce AUDIT_PATH record from struct audit_names
1528  * @context: audit_context for the task
1529  * @n: audit_names structure with reportable details
1530  * @path: optional path to report instead of audit_names->name
1531  * @record_num: record number to report when handling a list of names
1532  * @call_panic: optional pointer to int that will be updated if secid fails
1533  */
audit_log_name(struct audit_context * context,struct audit_names * n,const struct path * path,int record_num,int * call_panic)1534 static void audit_log_name(struct audit_context *context, struct audit_names *n,
1535 		    const struct path *path, int record_num, int *call_panic)
1536 {
1537 	struct audit_buffer *ab;
1538 
1539 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
1540 	if (!ab)
1541 		return;
1542 
1543 	audit_log_format(ab, "item=%d", record_num);
1544 
1545 	if (path)
1546 		audit_log_d_path(ab, " name=", path);
1547 	else if (n->name) {
1548 		switch (n->name_len) {
1549 		case AUDIT_NAME_FULL:
1550 			/* log the full path */
1551 			audit_log_format(ab, " name=");
1552 			audit_log_untrustedstring(ab, n->name->name);
1553 			break;
1554 		case 0:
1555 			/* name was specified as a relative path and the
1556 			 * directory component is the cwd
1557 			 */
1558 			if (context->pwd.dentry && context->pwd.mnt)
1559 				audit_log_d_path(ab, " name=", &context->pwd);
1560 			else
1561 				audit_log_format(ab, " name=(null)");
1562 			break;
1563 		default:
1564 			/* log the name's directory component */
1565 			audit_log_format(ab, " name=");
1566 			audit_log_n_untrustedstring(ab, n->name->name,
1567 						    n->name_len);
1568 		}
1569 	} else
1570 		audit_log_format(ab, " name=(null)");
1571 
1572 	if (n->ino != AUDIT_INO_UNSET)
1573 		audit_log_format(ab, " inode=%lu dev=%02x:%02x mode=%#ho ouid=%u ogid=%u rdev=%02x:%02x",
1574 				 n->ino,
1575 				 MAJOR(n->dev),
1576 				 MINOR(n->dev),
1577 				 n->mode,
1578 				 from_kuid(&init_user_ns, n->uid),
1579 				 from_kgid(&init_user_ns, n->gid),
1580 				 MAJOR(n->rdev),
1581 				 MINOR(n->rdev));
1582 	if (n->osid != 0) {
1583 		char *ctx = NULL;
1584 		u32 len;
1585 
1586 		if (security_secid_to_secctx(
1587 			n->osid, &ctx, &len)) {
1588 			audit_log_format(ab, " osid=%u", n->osid);
1589 			if (call_panic)
1590 				*call_panic = 2;
1591 		} else {
1592 			audit_log_format(ab, " obj=%s", ctx);
1593 			security_release_secctx(ctx, len);
1594 		}
1595 	}
1596 
1597 	/* log the audit_names record type */
1598 	switch (n->type) {
1599 	case AUDIT_TYPE_NORMAL:
1600 		audit_log_format(ab, " nametype=NORMAL");
1601 		break;
1602 	case AUDIT_TYPE_PARENT:
1603 		audit_log_format(ab, " nametype=PARENT");
1604 		break;
1605 	case AUDIT_TYPE_CHILD_DELETE:
1606 		audit_log_format(ab, " nametype=DELETE");
1607 		break;
1608 	case AUDIT_TYPE_CHILD_CREATE:
1609 		audit_log_format(ab, " nametype=CREATE");
1610 		break;
1611 	default:
1612 		audit_log_format(ab, " nametype=UNKNOWN");
1613 		break;
1614 	}
1615 
1616 	audit_log_fcaps(ab, n);
1617 	audit_log_end(ab);
1618 }
1619 
audit_log_proctitle(void)1620 static void audit_log_proctitle(void)
1621 {
1622 	int res;
1623 	char *buf;
1624 	char *msg = "(null)";
1625 	int len = strlen(msg);
1626 	struct audit_context *context = audit_context();
1627 	struct audit_buffer *ab;
1628 
1629 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE);
1630 	if (!ab)
1631 		return;	/* audit_panic or being filtered */
1632 
1633 	audit_log_format(ab, "proctitle=");
1634 
1635 	/* Not  cached */
1636 	if (!context->proctitle.value) {
1637 		buf = kmalloc(MAX_PROCTITLE_AUDIT_LEN, GFP_KERNEL);
1638 		if (!buf)
1639 			goto out;
1640 		/* Historically called this from procfs naming */
1641 		res = get_cmdline(current, buf, MAX_PROCTITLE_AUDIT_LEN);
1642 		if (res == 0) {
1643 			kfree(buf);
1644 			goto out;
1645 		}
1646 		res = audit_proctitle_rtrim(buf, res);
1647 		if (res == 0) {
1648 			kfree(buf);
1649 			goto out;
1650 		}
1651 		context->proctitle.value = buf;
1652 		context->proctitle.len = res;
1653 	}
1654 	msg = context->proctitle.value;
1655 	len = context->proctitle.len;
1656 out:
1657 	audit_log_n_untrustedstring(ab, msg, len);
1658 	audit_log_end(ab);
1659 }
1660 
1661 /**
1662  * audit_log_uring - generate a AUDIT_URINGOP record
1663  * @ctx: the audit context
1664  */
audit_log_uring(struct audit_context * ctx)1665 static void audit_log_uring(struct audit_context *ctx)
1666 {
1667 	struct audit_buffer *ab;
1668 	const struct cred *cred;
1669 
1670 	ab = audit_log_start(ctx, GFP_ATOMIC, AUDIT_URINGOP);
1671 	if (!ab)
1672 		return;
1673 	cred = current_cred();
1674 	audit_log_format(ab, "uring_op=%d", ctx->uring_op);
1675 	if (ctx->return_valid != AUDITSC_INVALID)
1676 		audit_log_format(ab, " success=%s exit=%ld",
1677 				 (ctx->return_valid == AUDITSC_SUCCESS ?
1678 				  "yes" : "no"),
1679 				 ctx->return_code);
1680 	audit_log_format(ab,
1681 			 " items=%d"
1682 			 " ppid=%d pid=%d uid=%u gid=%u euid=%u suid=%u"
1683 			 " fsuid=%u egid=%u sgid=%u fsgid=%u",
1684 			 ctx->name_count,
1685 			 task_ppid_nr(current), task_tgid_nr(current),
1686 			 from_kuid(&init_user_ns, cred->uid),
1687 			 from_kgid(&init_user_ns, cred->gid),
1688 			 from_kuid(&init_user_ns, cred->euid),
1689 			 from_kuid(&init_user_ns, cred->suid),
1690 			 from_kuid(&init_user_ns, cred->fsuid),
1691 			 from_kgid(&init_user_ns, cred->egid),
1692 			 from_kgid(&init_user_ns, cred->sgid),
1693 			 from_kgid(&init_user_ns, cred->fsgid));
1694 	audit_log_task_context(ab);
1695 	audit_log_key(ab, ctx->filterkey);
1696 	audit_log_end(ab);
1697 }
1698 
audit_log_exit(void)1699 static void audit_log_exit(void)
1700 {
1701 	int i, call_panic = 0;
1702 	struct audit_context *context = audit_context();
1703 	struct audit_buffer *ab;
1704 	struct audit_aux_data *aux;
1705 	struct audit_names *n;
1706 
1707 	context->personality = current->personality;
1708 
1709 	switch (context->context) {
1710 	case AUDIT_CTX_SYSCALL:
1711 		ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
1712 		if (!ab)
1713 			return;
1714 		audit_log_format(ab, "arch=%x syscall=%d",
1715 				 context->arch, context->major);
1716 		if (context->personality != PER_LINUX)
1717 			audit_log_format(ab, " per=%lx", context->personality);
1718 		if (context->return_valid != AUDITSC_INVALID)
1719 			audit_log_format(ab, " success=%s exit=%ld",
1720 					 (context->return_valid == AUDITSC_SUCCESS ?
1721 					  "yes" : "no"),
1722 					 context->return_code);
1723 		audit_log_format(ab,
1724 				 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d",
1725 				 context->argv[0],
1726 				 context->argv[1],
1727 				 context->argv[2],
1728 				 context->argv[3],
1729 				 context->name_count);
1730 		audit_log_task_info(ab);
1731 		audit_log_key(ab, context->filterkey);
1732 		audit_log_end(ab);
1733 		break;
1734 	case AUDIT_CTX_URING:
1735 		audit_log_uring(context);
1736 		break;
1737 	default:
1738 		BUG();
1739 		break;
1740 	}
1741 
1742 	for (aux = context->aux; aux; aux = aux->next) {
1743 
1744 		ab = audit_log_start(context, GFP_KERNEL, aux->type);
1745 		if (!ab)
1746 			continue; /* audit_panic has been called */
1747 
1748 		switch (aux->type) {
1749 
1750 		case AUDIT_BPRM_FCAPS: {
1751 			struct audit_aux_data_bprm_fcaps *axs = (void *)aux;
1752 
1753 			audit_log_format(ab, "fver=%x", axs->fcap_ver);
1754 			audit_log_cap(ab, "fp", &axs->fcap.permitted);
1755 			audit_log_cap(ab, "fi", &axs->fcap.inheritable);
1756 			audit_log_format(ab, " fe=%d", axs->fcap.fE);
1757 			audit_log_cap(ab, "old_pp", &axs->old_pcap.permitted);
1758 			audit_log_cap(ab, "old_pi", &axs->old_pcap.inheritable);
1759 			audit_log_cap(ab, "old_pe", &axs->old_pcap.effective);
1760 			audit_log_cap(ab, "old_pa", &axs->old_pcap.ambient);
1761 			audit_log_cap(ab, "pp", &axs->new_pcap.permitted);
1762 			audit_log_cap(ab, "pi", &axs->new_pcap.inheritable);
1763 			audit_log_cap(ab, "pe", &axs->new_pcap.effective);
1764 			audit_log_cap(ab, "pa", &axs->new_pcap.ambient);
1765 			audit_log_format(ab, " frootid=%d",
1766 					 from_kuid(&init_user_ns,
1767 						   axs->fcap.rootid));
1768 			break; }
1769 
1770 		}
1771 		audit_log_end(ab);
1772 	}
1773 
1774 	if (context->type)
1775 		show_special(context, &call_panic);
1776 
1777 	if (context->fds[0] >= 0) {
1778 		ab = audit_log_start(context, GFP_KERNEL, AUDIT_FD_PAIR);
1779 		if (ab) {
1780 			audit_log_format(ab, "fd0=%d fd1=%d",
1781 					context->fds[0], context->fds[1]);
1782 			audit_log_end(ab);
1783 		}
1784 	}
1785 
1786 	if (context->sockaddr_len) {
1787 		ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR);
1788 		if (ab) {
1789 			audit_log_format(ab, "saddr=");
1790 			audit_log_n_hex(ab, (void *)context->sockaddr,
1791 					context->sockaddr_len);
1792 			audit_log_end(ab);
1793 		}
1794 	}
1795 
1796 	for (aux = context->aux_pids; aux; aux = aux->next) {
1797 		struct audit_aux_data_pids *axs = (void *)aux;
1798 
1799 		for (i = 0; i < axs->pid_count; i++)
1800 			if (audit_log_pid_context(context, axs->target_pid[i],
1801 						  axs->target_auid[i],
1802 						  axs->target_uid[i],
1803 						  axs->target_sessionid[i],
1804 						  axs->target_sid[i],
1805 						  axs->target_comm[i]))
1806 				call_panic = 1;
1807 	}
1808 
1809 	if (context->target_pid &&
1810 	    audit_log_pid_context(context, context->target_pid,
1811 				  context->target_auid, context->target_uid,
1812 				  context->target_sessionid,
1813 				  context->target_sid, context->target_comm))
1814 			call_panic = 1;
1815 
1816 	if (context->pwd.dentry && context->pwd.mnt) {
1817 		ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
1818 		if (ab) {
1819 			audit_log_d_path(ab, "cwd=", &context->pwd);
1820 			audit_log_end(ab);
1821 		}
1822 	}
1823 
1824 	i = 0;
1825 	list_for_each_entry(n, &context->names_list, list) {
1826 		if (n->hidden)
1827 			continue;
1828 		audit_log_name(context, n, NULL, i++, &call_panic);
1829 	}
1830 
1831 	if (context->context == AUDIT_CTX_SYSCALL)
1832 		audit_log_proctitle();
1833 
1834 	/* Send end of event record to help user space know we are finished */
1835 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
1836 	if (ab)
1837 		audit_log_end(ab);
1838 	if (call_panic)
1839 		audit_panic("error in audit_log_exit()");
1840 }
1841 
1842 /**
1843  * __audit_free - free a per-task audit context
1844  * @tsk: task whose audit context block to free
1845  *
1846  * Called from copy_process, do_exit, and the io_uring code
1847  */
__audit_free(struct task_struct * tsk)1848 void __audit_free(struct task_struct *tsk)
1849 {
1850 	struct audit_context *context = tsk->audit_context;
1851 
1852 	if (!context)
1853 		return;
1854 
1855 	/* this may generate CONFIG_CHANGE records */
1856 	if (!list_empty(&context->killed_trees))
1857 		audit_kill_trees(context);
1858 
1859 	/* We are called either by do_exit() or the fork() error handling code;
1860 	 * in the former case tsk == current and in the latter tsk is a
1861 	 * random task_struct that doesn't doesn't have any meaningful data we
1862 	 * need to log via audit_log_exit().
1863 	 */
1864 	if (tsk == current && !context->dummy) {
1865 		context->return_valid = AUDITSC_INVALID;
1866 		context->return_code = 0;
1867 		if (context->context == AUDIT_CTX_SYSCALL) {
1868 			audit_filter_syscall(tsk, context);
1869 			audit_filter_inodes(tsk, context);
1870 			if (context->current_state == AUDIT_STATE_RECORD)
1871 				audit_log_exit();
1872 		} else if (context->context == AUDIT_CTX_URING) {
1873 			/* TODO: verify this case is real and valid */
1874 			audit_filter_uring(tsk, context);
1875 			audit_filter_inodes(tsk, context);
1876 			if (context->current_state == AUDIT_STATE_RECORD)
1877 				audit_log_uring(context);
1878 		}
1879 	}
1880 
1881 	audit_set_context(tsk, NULL);
1882 	audit_free_context(context);
1883 }
1884 
1885 /**
1886  * audit_return_fixup - fixup the return codes in the audit_context
1887  * @ctx: the audit_context
1888  * @success: true/false value to indicate if the operation succeeded or not
1889  * @code: operation return code
1890  *
1891  * We need to fixup the return code in the audit logs if the actual return
1892  * codes are later going to be fixed by the arch specific signal handlers.
1893  */
audit_return_fixup(struct audit_context * ctx,int success,long code)1894 static void audit_return_fixup(struct audit_context *ctx,
1895 			       int success, long code)
1896 {
1897 	/*
1898 	 * This is actually a test for:
1899 	 * (rc == ERESTARTSYS ) || (rc == ERESTARTNOINTR) ||
1900 	 * (rc == ERESTARTNOHAND) || (rc == ERESTART_RESTARTBLOCK)
1901 	 *
1902 	 * but is faster than a bunch of ||
1903 	 */
1904 	if (unlikely(code <= -ERESTARTSYS) &&
1905 	    (code >= -ERESTART_RESTARTBLOCK) &&
1906 	    (code != -ENOIOCTLCMD))
1907 		ctx->return_code = -EINTR;
1908 	else
1909 		ctx->return_code  = code;
1910 	ctx->return_valid = (success ? AUDITSC_SUCCESS : AUDITSC_FAILURE);
1911 }
1912 
1913 /**
1914  * __audit_uring_entry - prepare the kernel task's audit context for io_uring
1915  * @op: the io_uring opcode
1916  *
1917  * This is similar to audit_syscall_entry() but is intended for use by io_uring
1918  * operations.  This function should only ever be called from
1919  * audit_uring_entry() as we rely on the audit context checking present in that
1920  * function.
1921  */
__audit_uring_entry(u8 op)1922 void __audit_uring_entry(u8 op)
1923 {
1924 	struct audit_context *ctx = audit_context();
1925 
1926 	if (ctx->state == AUDIT_STATE_DISABLED)
1927 		return;
1928 
1929 	/*
1930 	 * NOTE: It's possible that we can be called from the process' context
1931 	 *       before it returns to userspace, and before audit_syscall_exit()
1932 	 *       is called.  In this case there is not much to do, just record
1933 	 *       the io_uring details and return.
1934 	 */
1935 	ctx->uring_op = op;
1936 	if (ctx->context == AUDIT_CTX_SYSCALL)
1937 		return;
1938 
1939 	ctx->dummy = !audit_n_rules;
1940 	if (!ctx->dummy && ctx->state == AUDIT_STATE_BUILD)
1941 		ctx->prio = 0;
1942 
1943 	ctx->context = AUDIT_CTX_URING;
1944 	ctx->current_state = ctx->state;
1945 	ktime_get_coarse_real_ts64(&ctx->ctime);
1946 }
1947 
1948 /**
1949  * __audit_uring_exit - wrap up the kernel task's audit context after io_uring
1950  * @success: true/false value to indicate if the operation succeeded or not
1951  * @code: operation return code
1952  *
1953  * This is similar to audit_syscall_exit() but is intended for use by io_uring
1954  * operations.  This function should only ever be called from
1955  * audit_uring_exit() as we rely on the audit context checking present in that
1956  * function.
1957  */
__audit_uring_exit(int success,long code)1958 void __audit_uring_exit(int success, long code)
1959 {
1960 	struct audit_context *ctx = audit_context();
1961 
1962 	if (ctx->dummy) {
1963 		if (ctx->context != AUDIT_CTX_URING)
1964 			return;
1965 		goto out;
1966 	}
1967 
1968 	audit_return_fixup(ctx, success, code);
1969 	if (ctx->context == AUDIT_CTX_SYSCALL) {
1970 		/*
1971 		 * NOTE: See the note in __audit_uring_entry() about the case
1972 		 *       where we may be called from process context before we
1973 		 *       return to userspace via audit_syscall_exit().  In this
1974 		 *       case we simply emit a URINGOP record and bail, the
1975 		 *       normal syscall exit handling will take care of
1976 		 *       everything else.
1977 		 *       It is also worth mentioning that when we are called,
1978 		 *       the current process creds may differ from the creds
1979 		 *       used during the normal syscall processing; keep that
1980 		 *       in mind if/when we move the record generation code.
1981 		 */
1982 
1983 		/*
1984 		 * We need to filter on the syscall info here to decide if we
1985 		 * should emit a URINGOP record.  I know it seems odd but this
1986 		 * solves the problem where users have a filter to block *all*
1987 		 * syscall records in the "exit" filter; we want to preserve
1988 		 * the behavior here.
1989 		 */
1990 		audit_filter_syscall(current, ctx);
1991 		if (ctx->current_state != AUDIT_STATE_RECORD)
1992 			audit_filter_uring(current, ctx);
1993 		audit_filter_inodes(current, ctx);
1994 		if (ctx->current_state != AUDIT_STATE_RECORD)
1995 			return;
1996 
1997 		audit_log_uring(ctx);
1998 		return;
1999 	}
2000 
2001 	/* this may generate CONFIG_CHANGE records */
2002 	if (!list_empty(&ctx->killed_trees))
2003 		audit_kill_trees(ctx);
2004 
2005 	/* run through both filters to ensure we set the filterkey properly */
2006 	audit_filter_uring(current, ctx);
2007 	audit_filter_inodes(current, ctx);
2008 	if (ctx->current_state != AUDIT_STATE_RECORD)
2009 		goto out;
2010 	audit_log_exit();
2011 
2012 out:
2013 	audit_reset_context(ctx);
2014 }
2015 
2016 /**
2017  * __audit_syscall_entry - fill in an audit record at syscall entry
2018  * @major: major syscall type (function)
2019  * @a1: additional syscall register 1
2020  * @a2: additional syscall register 2
2021  * @a3: additional syscall register 3
2022  * @a4: additional syscall register 4
2023  *
2024  * Fill in audit context at syscall entry.  This only happens if the
2025  * audit context was created when the task was created and the state or
2026  * filters demand the audit context be built.  If the state from the
2027  * per-task filter or from the per-syscall filter is AUDIT_STATE_RECORD,
2028  * then the record will be written at syscall exit time (otherwise, it
2029  * will only be written if another part of the kernel requests that it
2030  * be written).
2031  */
__audit_syscall_entry(int major,unsigned long a1,unsigned long a2,unsigned long a3,unsigned long a4)2032 void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
2033 			   unsigned long a3, unsigned long a4)
2034 {
2035 	struct audit_context *context = audit_context();
2036 	enum audit_state     state;
2037 
2038 	if (!audit_enabled || !context)
2039 		return;
2040 
2041 	WARN_ON(context->context != AUDIT_CTX_UNUSED);
2042 	WARN_ON(context->name_count);
2043 	if (context->context != AUDIT_CTX_UNUSED || context->name_count) {
2044 		audit_panic("unrecoverable error in audit_syscall_entry()");
2045 		return;
2046 	}
2047 
2048 	state = context->state;
2049 	if (state == AUDIT_STATE_DISABLED)
2050 		return;
2051 
2052 	context->dummy = !audit_n_rules;
2053 	if (!context->dummy && state == AUDIT_STATE_BUILD) {
2054 		context->prio = 0;
2055 		if (auditd_test_task(current))
2056 			return;
2057 	}
2058 
2059 	context->arch	    = syscall_get_arch(current);
2060 	context->major      = major;
2061 	context->argv[0]    = a1;
2062 	context->argv[1]    = a2;
2063 	context->argv[2]    = a3;
2064 	context->argv[3]    = a4;
2065 	context->context = AUDIT_CTX_SYSCALL;
2066 	context->current_state  = state;
2067 	ktime_get_coarse_real_ts64(&context->ctime);
2068 }
2069 
2070 /**
2071  * __audit_syscall_exit - deallocate audit context after a system call
2072  * @success: success value of the syscall
2073  * @return_code: return value of the syscall
2074  *
2075  * Tear down after system call.  If the audit context has been marked as
2076  * auditable (either because of the AUDIT_STATE_RECORD state from
2077  * filtering, or because some other part of the kernel wrote an audit
2078  * message), then write out the syscall information.  In call cases,
2079  * free the names stored from getname().
2080  */
__audit_syscall_exit(int success,long return_code)2081 void __audit_syscall_exit(int success, long return_code)
2082 {
2083 	struct audit_context *context = audit_context();
2084 
2085 	if (!context || context->dummy ||
2086 	    context->context != AUDIT_CTX_SYSCALL)
2087 		goto out;
2088 
2089 	/* this may generate CONFIG_CHANGE records */
2090 	if (!list_empty(&context->killed_trees))
2091 		audit_kill_trees(context);
2092 
2093 	audit_return_fixup(context, success, return_code);
2094 	/* run through both filters to ensure we set the filterkey properly */
2095 	audit_filter_syscall(current, context);
2096 	audit_filter_inodes(current, context);
2097 	if (context->current_state < AUDIT_STATE_RECORD)
2098 		goto out;
2099 
2100 	audit_log_exit();
2101 
2102 out:
2103 	audit_reset_context(context);
2104 }
2105 
handle_one(const struct inode * inode)2106 static inline void handle_one(const struct inode *inode)
2107 {
2108 	struct audit_context *context;
2109 	struct audit_tree_refs *p;
2110 	struct audit_chunk *chunk;
2111 	int count;
2112 
2113 	if (likely(!inode->i_fsnotify_marks))
2114 		return;
2115 	context = audit_context();
2116 	p = context->trees;
2117 	count = context->tree_count;
2118 	rcu_read_lock();
2119 	chunk = audit_tree_lookup(inode);
2120 	rcu_read_unlock();
2121 	if (!chunk)
2122 		return;
2123 	if (likely(put_tree_ref(context, chunk)))
2124 		return;
2125 	if (unlikely(!grow_tree_refs(context))) {
2126 		pr_warn("out of memory, audit has lost a tree reference\n");
2127 		audit_set_auditable(context);
2128 		audit_put_chunk(chunk);
2129 		unroll_tree_refs(context, p, count);
2130 		return;
2131 	}
2132 	put_tree_ref(context, chunk);
2133 }
2134 
handle_path(const struct dentry * dentry)2135 static void handle_path(const struct dentry *dentry)
2136 {
2137 	struct audit_context *context;
2138 	struct audit_tree_refs *p;
2139 	const struct dentry *d, *parent;
2140 	struct audit_chunk *drop;
2141 	unsigned long seq;
2142 	int count;
2143 
2144 	context = audit_context();
2145 	p = context->trees;
2146 	count = context->tree_count;
2147 retry:
2148 	drop = NULL;
2149 	d = dentry;
2150 	rcu_read_lock();
2151 	seq = read_seqbegin(&rename_lock);
2152 	for(;;) {
2153 		struct inode *inode = d_backing_inode(d);
2154 
2155 		if (inode && unlikely(inode->i_fsnotify_marks)) {
2156 			struct audit_chunk *chunk;
2157 
2158 			chunk = audit_tree_lookup(inode);
2159 			if (chunk) {
2160 				if (unlikely(!put_tree_ref(context, chunk))) {
2161 					drop = chunk;
2162 					break;
2163 				}
2164 			}
2165 		}
2166 		parent = d->d_parent;
2167 		if (parent == d)
2168 			break;
2169 		d = parent;
2170 	}
2171 	if (unlikely(read_seqretry(&rename_lock, seq) || drop)) {  /* in this order */
2172 		rcu_read_unlock();
2173 		if (!drop) {
2174 			/* just a race with rename */
2175 			unroll_tree_refs(context, p, count);
2176 			goto retry;
2177 		}
2178 		audit_put_chunk(drop);
2179 		if (grow_tree_refs(context)) {
2180 			/* OK, got more space */
2181 			unroll_tree_refs(context, p, count);
2182 			goto retry;
2183 		}
2184 		/* too bad */
2185 		pr_warn("out of memory, audit has lost a tree reference\n");
2186 		unroll_tree_refs(context, p, count);
2187 		audit_set_auditable(context);
2188 		return;
2189 	}
2190 	rcu_read_unlock();
2191 }
2192 
audit_alloc_name(struct audit_context * context,unsigned char type)2193 static struct audit_names *audit_alloc_name(struct audit_context *context,
2194 						unsigned char type)
2195 {
2196 	struct audit_names *aname;
2197 
2198 	if (context->name_count < AUDIT_NAMES) {
2199 		aname = &context->preallocated_names[context->name_count];
2200 		memset(aname, 0, sizeof(*aname));
2201 	} else {
2202 		aname = kzalloc(sizeof(*aname), GFP_NOFS);
2203 		if (!aname)
2204 			return NULL;
2205 		aname->should_free = true;
2206 	}
2207 
2208 	aname->ino = AUDIT_INO_UNSET;
2209 	aname->type = type;
2210 	list_add_tail(&aname->list, &context->names_list);
2211 
2212 	context->name_count++;
2213 	if (!context->pwd.dentry)
2214 		get_fs_pwd(current->fs, &context->pwd);
2215 	return aname;
2216 }
2217 
2218 /**
2219  * __audit_reusename - fill out filename with info from existing entry
2220  * @uptr: userland ptr to pathname
2221  *
2222  * Search the audit_names list for the current audit context. If there is an
2223  * existing entry with a matching "uptr" then return the filename
2224  * associated with that audit_name. If not, return NULL.
2225  */
2226 struct filename *
__audit_reusename(const __user char * uptr)2227 __audit_reusename(const __user char *uptr)
2228 {
2229 	struct audit_context *context = audit_context();
2230 	struct audit_names *n;
2231 
2232 	list_for_each_entry(n, &context->names_list, list) {
2233 		if (!n->name)
2234 			continue;
2235 		if (n->name->uptr == uptr) {
2236 			n->name->refcnt++;
2237 			return n->name;
2238 		}
2239 	}
2240 	return NULL;
2241 }
2242 
2243 /**
2244  * __audit_getname - add a name to the list
2245  * @name: name to add
2246  *
2247  * Add a name to the list of audit names for this context.
2248  * Called from fs/namei.c:getname().
2249  */
__audit_getname(struct filename * name)2250 void __audit_getname(struct filename *name)
2251 {
2252 	struct audit_context *context = audit_context();
2253 	struct audit_names *n;
2254 
2255 	if (context->context == AUDIT_CTX_UNUSED)
2256 		return;
2257 
2258 	n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
2259 	if (!n)
2260 		return;
2261 
2262 	n->name = name;
2263 	n->name_len = AUDIT_NAME_FULL;
2264 	name->aname = n;
2265 	name->refcnt++;
2266 }
2267 
audit_copy_fcaps(struct audit_names * name,const struct dentry * dentry)2268 static inline int audit_copy_fcaps(struct audit_names *name,
2269 				   const struct dentry *dentry)
2270 {
2271 	struct cpu_vfs_cap_data caps;
2272 	int rc;
2273 
2274 	if (!dentry)
2275 		return 0;
2276 
2277 	rc = get_vfs_caps_from_disk(&init_user_ns, dentry, &caps);
2278 	if (rc)
2279 		return rc;
2280 
2281 	name->fcap.permitted = caps.permitted;
2282 	name->fcap.inheritable = caps.inheritable;
2283 	name->fcap.fE = !!(caps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
2284 	name->fcap.rootid = caps.rootid;
2285 	name->fcap_ver = (caps.magic_etc & VFS_CAP_REVISION_MASK) >>
2286 				VFS_CAP_REVISION_SHIFT;
2287 
2288 	return 0;
2289 }
2290 
2291 /* Copy inode data into an audit_names. */
audit_copy_inode(struct audit_names * name,const struct dentry * dentry,struct inode * inode,unsigned int flags)2292 static void audit_copy_inode(struct audit_names *name,
2293 			     const struct dentry *dentry,
2294 			     struct inode *inode, unsigned int flags)
2295 {
2296 	name->ino   = inode->i_ino;
2297 	name->dev   = inode->i_sb->s_dev;
2298 	name->mode  = inode->i_mode;
2299 	name->uid   = inode->i_uid;
2300 	name->gid   = inode->i_gid;
2301 	name->rdev  = inode->i_rdev;
2302 	security_inode_getsecid(inode, &name->osid);
2303 	if (flags & AUDIT_INODE_NOEVAL) {
2304 		name->fcap_ver = -1;
2305 		return;
2306 	}
2307 	audit_copy_fcaps(name, dentry);
2308 }
2309 
2310 /**
2311  * __audit_inode - store the inode and device from a lookup
2312  * @name: name being audited
2313  * @dentry: dentry being audited
2314  * @flags: attributes for this particular entry
2315  */
__audit_inode(struct filename * name,const struct dentry * dentry,unsigned int flags)2316 void __audit_inode(struct filename *name, const struct dentry *dentry,
2317 		   unsigned int flags)
2318 {
2319 	struct audit_context *context = audit_context();
2320 	struct inode *inode = d_backing_inode(dentry);
2321 	struct audit_names *n;
2322 	bool parent = flags & AUDIT_INODE_PARENT;
2323 	struct audit_entry *e;
2324 	struct list_head *list = &audit_filter_list[AUDIT_FILTER_FS];
2325 	int i;
2326 
2327 	if (context->context == AUDIT_CTX_UNUSED)
2328 		return;
2329 
2330 	rcu_read_lock();
2331 	list_for_each_entry_rcu(e, list, list) {
2332 		for (i = 0; i < e->rule.field_count; i++) {
2333 			struct audit_field *f = &e->rule.fields[i];
2334 
2335 			if (f->type == AUDIT_FSTYPE
2336 			    && audit_comparator(inode->i_sb->s_magic,
2337 						f->op, f->val)
2338 			    && e->rule.action == AUDIT_NEVER) {
2339 				rcu_read_unlock();
2340 				return;
2341 			}
2342 		}
2343 	}
2344 	rcu_read_unlock();
2345 
2346 	if (!name)
2347 		goto out_alloc;
2348 
2349 	/*
2350 	 * If we have a pointer to an audit_names entry already, then we can
2351 	 * just use it directly if the type is correct.
2352 	 */
2353 	n = name->aname;
2354 	if (n) {
2355 		if (parent) {
2356 			if (n->type == AUDIT_TYPE_PARENT ||
2357 			    n->type == AUDIT_TYPE_UNKNOWN)
2358 				goto out;
2359 		} else {
2360 			if (n->type != AUDIT_TYPE_PARENT)
2361 				goto out;
2362 		}
2363 	}
2364 
2365 	list_for_each_entry_reverse(n, &context->names_list, list) {
2366 		if (n->ino) {
2367 			/* valid inode number, use that for the comparison */
2368 			if (n->ino != inode->i_ino ||
2369 			    n->dev != inode->i_sb->s_dev)
2370 				continue;
2371 		} else if (n->name) {
2372 			/* inode number has not been set, check the name */
2373 			if (strcmp(n->name->name, name->name))
2374 				continue;
2375 		} else
2376 			/* no inode and no name (?!) ... this is odd ... */
2377 			continue;
2378 
2379 		/* match the correct record type */
2380 		if (parent) {
2381 			if (n->type == AUDIT_TYPE_PARENT ||
2382 			    n->type == AUDIT_TYPE_UNKNOWN)
2383 				goto out;
2384 		} else {
2385 			if (n->type != AUDIT_TYPE_PARENT)
2386 				goto out;
2387 		}
2388 	}
2389 
2390 out_alloc:
2391 	/* unable to find an entry with both a matching name and type */
2392 	n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
2393 	if (!n)
2394 		return;
2395 	if (name) {
2396 		n->name = name;
2397 		name->refcnt++;
2398 	}
2399 
2400 out:
2401 	if (parent) {
2402 		n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;
2403 		n->type = AUDIT_TYPE_PARENT;
2404 		if (flags & AUDIT_INODE_HIDDEN)
2405 			n->hidden = true;
2406 	} else {
2407 		n->name_len = AUDIT_NAME_FULL;
2408 		n->type = AUDIT_TYPE_NORMAL;
2409 	}
2410 	handle_path(dentry);
2411 	audit_copy_inode(n, dentry, inode, flags & AUDIT_INODE_NOEVAL);
2412 }
2413 
__audit_file(const struct file * file)2414 void __audit_file(const struct file *file)
2415 {
2416 	__audit_inode(NULL, file->f_path.dentry, 0);
2417 }
2418 
2419 /**
2420  * __audit_inode_child - collect inode info for created/removed objects
2421  * @parent: inode of dentry parent
2422  * @dentry: dentry being audited
2423  * @type:   AUDIT_TYPE_* value that we're looking for
2424  *
2425  * For syscalls that create or remove filesystem objects, audit_inode
2426  * can only collect information for the filesystem object's parent.
2427  * This call updates the audit context with the child's information.
2428  * Syscalls that create a new filesystem object must be hooked after
2429  * the object is created.  Syscalls that remove a filesystem object
2430  * must be hooked prior, in order to capture the target inode during
2431  * unsuccessful attempts.
2432  */
__audit_inode_child(struct inode * parent,const struct dentry * dentry,const unsigned char type)2433 void __audit_inode_child(struct inode *parent,
2434 			 const struct dentry *dentry,
2435 			 const unsigned char type)
2436 {
2437 	struct audit_context *context = audit_context();
2438 	struct inode *inode = d_backing_inode(dentry);
2439 	const struct qstr *dname = &dentry->d_name;
2440 	struct audit_names *n, *found_parent = NULL, *found_child = NULL;
2441 	struct audit_entry *e;
2442 	struct list_head *list = &audit_filter_list[AUDIT_FILTER_FS];
2443 	int i;
2444 
2445 	if (context->context == AUDIT_CTX_UNUSED)
2446 		return;
2447 
2448 	rcu_read_lock();
2449 	list_for_each_entry_rcu(e, list, list) {
2450 		for (i = 0; i < e->rule.field_count; i++) {
2451 			struct audit_field *f = &e->rule.fields[i];
2452 
2453 			if (f->type == AUDIT_FSTYPE
2454 			    && audit_comparator(parent->i_sb->s_magic,
2455 						f->op, f->val)
2456 			    && e->rule.action == AUDIT_NEVER) {
2457 				rcu_read_unlock();
2458 				return;
2459 			}
2460 		}
2461 	}
2462 	rcu_read_unlock();
2463 
2464 	if (inode)
2465 		handle_one(inode);
2466 
2467 	/* look for a parent entry first */
2468 	list_for_each_entry(n, &context->names_list, list) {
2469 		if (!n->name ||
2470 		    (n->type != AUDIT_TYPE_PARENT &&
2471 		     n->type != AUDIT_TYPE_UNKNOWN))
2472 			continue;
2473 
2474 		if (n->ino == parent->i_ino && n->dev == parent->i_sb->s_dev &&
2475 		    !audit_compare_dname_path(dname,
2476 					      n->name->name, n->name_len)) {
2477 			if (n->type == AUDIT_TYPE_UNKNOWN)
2478 				n->type = AUDIT_TYPE_PARENT;
2479 			found_parent = n;
2480 			break;
2481 		}
2482 	}
2483 
2484 	/* is there a matching child entry? */
2485 	list_for_each_entry(n, &context->names_list, list) {
2486 		/* can only match entries that have a name */
2487 		if (!n->name ||
2488 		    (n->type != type && n->type != AUDIT_TYPE_UNKNOWN))
2489 			continue;
2490 
2491 		if (!strcmp(dname->name, n->name->name) ||
2492 		    !audit_compare_dname_path(dname, n->name->name,
2493 						found_parent ?
2494 						found_parent->name_len :
2495 						AUDIT_NAME_FULL)) {
2496 			if (n->type == AUDIT_TYPE_UNKNOWN)
2497 				n->type = type;
2498 			found_child = n;
2499 			break;
2500 		}
2501 	}
2502 
2503 	if (!found_parent) {
2504 		/* create a new, "anonymous" parent record */
2505 		n = audit_alloc_name(context, AUDIT_TYPE_PARENT);
2506 		if (!n)
2507 			return;
2508 		audit_copy_inode(n, NULL, parent, 0);
2509 	}
2510 
2511 	if (!found_child) {
2512 		found_child = audit_alloc_name(context, type);
2513 		if (!found_child)
2514 			return;
2515 
2516 		/* Re-use the name belonging to the slot for a matching parent
2517 		 * directory. All names for this context are relinquished in
2518 		 * audit_free_names() */
2519 		if (found_parent) {
2520 			found_child->name = found_parent->name;
2521 			found_child->name_len = AUDIT_NAME_FULL;
2522 			found_child->name->refcnt++;
2523 		}
2524 	}
2525 
2526 	if (inode)
2527 		audit_copy_inode(found_child, dentry, inode, 0);
2528 	else
2529 		found_child->ino = AUDIT_INO_UNSET;
2530 }
2531 EXPORT_SYMBOL_GPL(__audit_inode_child);
2532 
2533 /**
2534  * auditsc_get_stamp - get local copies of audit_context values
2535  * @ctx: audit_context for the task
2536  * @t: timespec64 to store time recorded in the audit_context
2537  * @serial: serial value that is recorded in the audit_context
2538  *
2539  * Also sets the context as auditable.
2540  */
auditsc_get_stamp(struct audit_context * ctx,struct timespec64 * t,unsigned int * serial)2541 int auditsc_get_stamp(struct audit_context *ctx,
2542 		       struct timespec64 *t, unsigned int *serial)
2543 {
2544 	if (ctx->context == AUDIT_CTX_UNUSED)
2545 		return 0;
2546 	if (!ctx->serial)
2547 		ctx->serial = audit_serial();
2548 	t->tv_sec  = ctx->ctime.tv_sec;
2549 	t->tv_nsec = ctx->ctime.tv_nsec;
2550 	*serial    = ctx->serial;
2551 	if (!ctx->prio) {
2552 		ctx->prio = 1;
2553 		ctx->current_state = AUDIT_STATE_RECORD;
2554 	}
2555 	return 1;
2556 }
2557 
2558 /**
2559  * __audit_mq_open - record audit data for a POSIX MQ open
2560  * @oflag: open flag
2561  * @mode: mode bits
2562  * @attr: queue attributes
2563  *
2564  */
__audit_mq_open(int oflag,umode_t mode,struct mq_attr * attr)2565 void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
2566 {
2567 	struct audit_context *context = audit_context();
2568 
2569 	if (attr)
2570 		memcpy(&context->mq_open.attr, attr, sizeof(struct mq_attr));
2571 	else
2572 		memset(&context->mq_open.attr, 0, sizeof(struct mq_attr));
2573 
2574 	context->mq_open.oflag = oflag;
2575 	context->mq_open.mode = mode;
2576 
2577 	context->type = AUDIT_MQ_OPEN;
2578 }
2579 
2580 /**
2581  * __audit_mq_sendrecv - record audit data for a POSIX MQ timed send/receive
2582  * @mqdes: MQ descriptor
2583  * @msg_len: Message length
2584  * @msg_prio: Message priority
2585  * @abs_timeout: Message timeout in absolute time
2586  *
2587  */
__audit_mq_sendrecv(mqd_t mqdes,size_t msg_len,unsigned int msg_prio,const struct timespec64 * abs_timeout)2588 void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio,
2589 			const struct timespec64 *abs_timeout)
2590 {
2591 	struct audit_context *context = audit_context();
2592 	struct timespec64 *p = &context->mq_sendrecv.abs_timeout;
2593 
2594 	if (abs_timeout)
2595 		memcpy(p, abs_timeout, sizeof(*p));
2596 	else
2597 		memset(p, 0, sizeof(*p));
2598 
2599 	context->mq_sendrecv.mqdes = mqdes;
2600 	context->mq_sendrecv.msg_len = msg_len;
2601 	context->mq_sendrecv.msg_prio = msg_prio;
2602 
2603 	context->type = AUDIT_MQ_SENDRECV;
2604 }
2605 
2606 /**
2607  * __audit_mq_notify - record audit data for a POSIX MQ notify
2608  * @mqdes: MQ descriptor
2609  * @notification: Notification event
2610  *
2611  */
2612 
__audit_mq_notify(mqd_t mqdes,const struct sigevent * notification)2613 void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
2614 {
2615 	struct audit_context *context = audit_context();
2616 
2617 	if (notification)
2618 		context->mq_notify.sigev_signo = notification->sigev_signo;
2619 	else
2620 		context->mq_notify.sigev_signo = 0;
2621 
2622 	context->mq_notify.mqdes = mqdes;
2623 	context->type = AUDIT_MQ_NOTIFY;
2624 }
2625 
2626 /**
2627  * __audit_mq_getsetattr - record audit data for a POSIX MQ get/set attribute
2628  * @mqdes: MQ descriptor
2629  * @mqstat: MQ flags
2630  *
2631  */
__audit_mq_getsetattr(mqd_t mqdes,struct mq_attr * mqstat)2632 void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
2633 {
2634 	struct audit_context *context = audit_context();
2635 
2636 	context->mq_getsetattr.mqdes = mqdes;
2637 	context->mq_getsetattr.mqstat = *mqstat;
2638 	context->type = AUDIT_MQ_GETSETATTR;
2639 }
2640 
2641 /**
2642  * __audit_ipc_obj - record audit data for ipc object
2643  * @ipcp: ipc permissions
2644  *
2645  */
__audit_ipc_obj(struct kern_ipc_perm * ipcp)2646 void __audit_ipc_obj(struct kern_ipc_perm *ipcp)
2647 {
2648 	struct audit_context *context = audit_context();
2649 
2650 	context->ipc.uid = ipcp->uid;
2651 	context->ipc.gid = ipcp->gid;
2652 	context->ipc.mode = ipcp->mode;
2653 	context->ipc.has_perm = 0;
2654 	security_ipc_getsecid(ipcp, &context->ipc.osid);
2655 	context->type = AUDIT_IPC;
2656 }
2657 
2658 /**
2659  * __audit_ipc_set_perm - record audit data for new ipc permissions
2660  * @qbytes: msgq bytes
2661  * @uid: msgq user id
2662  * @gid: msgq group id
2663  * @mode: msgq mode (permissions)
2664  *
2665  * Called only after audit_ipc_obj().
2666  */
__audit_ipc_set_perm(unsigned long qbytes,uid_t uid,gid_t gid,umode_t mode)2667 void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode)
2668 {
2669 	struct audit_context *context = audit_context();
2670 
2671 	context->ipc.qbytes = qbytes;
2672 	context->ipc.perm_uid = uid;
2673 	context->ipc.perm_gid = gid;
2674 	context->ipc.perm_mode = mode;
2675 	context->ipc.has_perm = 1;
2676 }
2677 
__audit_bprm(struct linux_binprm * bprm)2678 void __audit_bprm(struct linux_binprm *bprm)
2679 {
2680 	struct audit_context *context = audit_context();
2681 
2682 	context->type = AUDIT_EXECVE;
2683 	context->execve.argc = bprm->argc;
2684 }
2685 
2686 
2687 /**
2688  * __audit_socketcall - record audit data for sys_socketcall
2689  * @nargs: number of args, which should not be more than AUDITSC_ARGS.
2690  * @args: args array
2691  *
2692  */
__audit_socketcall(int nargs,unsigned long * args)2693 int __audit_socketcall(int nargs, unsigned long *args)
2694 {
2695 	struct audit_context *context = audit_context();
2696 
2697 	if (nargs <= 0 || nargs > AUDITSC_ARGS || !args)
2698 		return -EINVAL;
2699 	context->type = AUDIT_SOCKETCALL;
2700 	context->socketcall.nargs = nargs;
2701 	memcpy(context->socketcall.args, args, nargs * sizeof(unsigned long));
2702 	return 0;
2703 }
2704 
2705 /**
2706  * __audit_fd_pair - record audit data for pipe and socketpair
2707  * @fd1: the first file descriptor
2708  * @fd2: the second file descriptor
2709  *
2710  */
__audit_fd_pair(int fd1,int fd2)2711 void __audit_fd_pair(int fd1, int fd2)
2712 {
2713 	struct audit_context *context = audit_context();
2714 
2715 	context->fds[0] = fd1;
2716 	context->fds[1] = fd2;
2717 }
2718 
2719 /**
2720  * __audit_sockaddr - record audit data for sys_bind, sys_connect, sys_sendto
2721  * @len: data length in user space
2722  * @a: data address in kernel space
2723  *
2724  * Returns 0 for success or NULL context or < 0 on error.
2725  */
__audit_sockaddr(int len,void * a)2726 int __audit_sockaddr(int len, void *a)
2727 {
2728 	struct audit_context *context = audit_context();
2729 
2730 	if (!context->sockaddr) {
2731 		void *p = kmalloc(sizeof(struct sockaddr_storage), GFP_KERNEL);
2732 
2733 		if (!p)
2734 			return -ENOMEM;
2735 		context->sockaddr = p;
2736 	}
2737 
2738 	context->sockaddr_len = len;
2739 	memcpy(context->sockaddr, a, len);
2740 	return 0;
2741 }
2742 
__audit_ptrace(struct task_struct * t)2743 void __audit_ptrace(struct task_struct *t)
2744 {
2745 	struct audit_context *context = audit_context();
2746 
2747 	context->target_pid = task_tgid_nr(t);
2748 	context->target_auid = audit_get_loginuid(t);
2749 	context->target_uid = task_uid(t);
2750 	context->target_sessionid = audit_get_sessionid(t);
2751 	security_task_getsecid_obj(t, &context->target_sid);
2752 	memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
2753 }
2754 
2755 /**
2756  * audit_signal_info_syscall - record signal info for syscalls
2757  * @t: task being signaled
2758  *
2759  * If the audit subsystem is being terminated, record the task (pid)
2760  * and uid that is doing that.
2761  */
audit_signal_info_syscall(struct task_struct * t)2762 int audit_signal_info_syscall(struct task_struct *t)
2763 {
2764 	struct audit_aux_data_pids *axp;
2765 	struct audit_context *ctx = audit_context();
2766 	kuid_t t_uid = task_uid(t);
2767 
2768 	if (!audit_signals || audit_dummy_context())
2769 		return 0;
2770 
2771 	/* optimize the common case by putting first signal recipient directly
2772 	 * in audit_context */
2773 	if (!ctx->target_pid) {
2774 		ctx->target_pid = task_tgid_nr(t);
2775 		ctx->target_auid = audit_get_loginuid(t);
2776 		ctx->target_uid = t_uid;
2777 		ctx->target_sessionid = audit_get_sessionid(t);
2778 		security_task_getsecid_obj(t, &ctx->target_sid);
2779 		memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
2780 		return 0;
2781 	}
2782 
2783 	axp = (void *)ctx->aux_pids;
2784 	if (!axp || axp->pid_count == AUDIT_AUX_PIDS) {
2785 		axp = kzalloc(sizeof(*axp), GFP_ATOMIC);
2786 		if (!axp)
2787 			return -ENOMEM;
2788 
2789 		axp->d.type = AUDIT_OBJ_PID;
2790 		axp->d.next = ctx->aux_pids;
2791 		ctx->aux_pids = (void *)axp;
2792 	}
2793 	BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
2794 
2795 	axp->target_pid[axp->pid_count] = task_tgid_nr(t);
2796 	axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
2797 	axp->target_uid[axp->pid_count] = t_uid;
2798 	axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t);
2799 	security_task_getsecid_obj(t, &axp->target_sid[axp->pid_count]);
2800 	memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
2801 	axp->pid_count++;
2802 
2803 	return 0;
2804 }
2805 
2806 /**
2807  * __audit_log_bprm_fcaps - store information about a loading bprm and relevant fcaps
2808  * @bprm: pointer to the bprm being processed
2809  * @new: the proposed new credentials
2810  * @old: the old credentials
2811  *
2812  * Simply check if the proc already has the caps given by the file and if not
2813  * store the priv escalation info for later auditing at the end of the syscall
2814  *
2815  * -Eric
2816  */
__audit_log_bprm_fcaps(struct linux_binprm * bprm,const struct cred * new,const struct cred * old)2817 int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
2818 			   const struct cred *new, const struct cred *old)
2819 {
2820 	struct audit_aux_data_bprm_fcaps *ax;
2821 	struct audit_context *context = audit_context();
2822 	struct cpu_vfs_cap_data vcaps;
2823 
2824 	ax = kmalloc(sizeof(*ax), GFP_KERNEL);
2825 	if (!ax)
2826 		return -ENOMEM;
2827 
2828 	ax->d.type = AUDIT_BPRM_FCAPS;
2829 	ax->d.next = context->aux;
2830 	context->aux = (void *)ax;
2831 
2832 	get_vfs_caps_from_disk(&init_user_ns,
2833 			       bprm->file->f_path.dentry, &vcaps);
2834 
2835 	ax->fcap.permitted = vcaps.permitted;
2836 	ax->fcap.inheritable = vcaps.inheritable;
2837 	ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
2838 	ax->fcap.rootid = vcaps.rootid;
2839 	ax->fcap_ver = (vcaps.magic_etc & VFS_CAP_REVISION_MASK) >> VFS_CAP_REVISION_SHIFT;
2840 
2841 	ax->old_pcap.permitted   = old->cap_permitted;
2842 	ax->old_pcap.inheritable = old->cap_inheritable;
2843 	ax->old_pcap.effective   = old->cap_effective;
2844 	ax->old_pcap.ambient     = old->cap_ambient;
2845 
2846 	ax->new_pcap.permitted   = new->cap_permitted;
2847 	ax->new_pcap.inheritable = new->cap_inheritable;
2848 	ax->new_pcap.effective   = new->cap_effective;
2849 	ax->new_pcap.ambient     = new->cap_ambient;
2850 	return 0;
2851 }
2852 
2853 /**
2854  * __audit_log_capset - store information about the arguments to the capset syscall
2855  * @new: the new credentials
2856  * @old: the old (current) credentials
2857  *
2858  * Record the arguments userspace sent to sys_capset for later printing by the
2859  * audit system if applicable
2860  */
__audit_log_capset(const struct cred * new,const struct cred * old)2861 void __audit_log_capset(const struct cred *new, const struct cred *old)
2862 {
2863 	struct audit_context *context = audit_context();
2864 
2865 	context->capset.pid = task_tgid_nr(current);
2866 	context->capset.cap.effective   = new->cap_effective;
2867 	context->capset.cap.inheritable = new->cap_effective;
2868 	context->capset.cap.permitted   = new->cap_permitted;
2869 	context->capset.cap.ambient     = new->cap_ambient;
2870 	context->type = AUDIT_CAPSET;
2871 }
2872 
__audit_mmap_fd(int fd,int flags)2873 void __audit_mmap_fd(int fd, int flags)
2874 {
2875 	struct audit_context *context = audit_context();
2876 
2877 	context->mmap.fd = fd;
2878 	context->mmap.flags = flags;
2879 	context->type = AUDIT_MMAP;
2880 }
2881 
__audit_openat2_how(struct open_how * how)2882 void __audit_openat2_how(struct open_how *how)
2883 {
2884 	struct audit_context *context = audit_context();
2885 
2886 	context->openat2.flags = how->flags;
2887 	context->openat2.mode = how->mode;
2888 	context->openat2.resolve = how->resolve;
2889 	context->type = AUDIT_OPENAT2;
2890 }
2891 
__audit_log_kern_module(char * name)2892 void __audit_log_kern_module(char *name)
2893 {
2894 	struct audit_context *context = audit_context();
2895 
2896 	context->module.name = kstrdup(name, GFP_KERNEL);
2897 	if (!context->module.name)
2898 		audit_log_lost("out of memory in __audit_log_kern_module");
2899 	context->type = AUDIT_KERN_MODULE;
2900 }
2901 
__audit_fanotify(unsigned int response)2902 void __audit_fanotify(unsigned int response)
2903 {
2904 	audit_log(audit_context(), GFP_KERNEL,
2905 		AUDIT_FANOTIFY,	"resp=%u", response);
2906 }
2907 
__audit_tk_injoffset(struct timespec64 offset)2908 void __audit_tk_injoffset(struct timespec64 offset)
2909 {
2910 	struct audit_context *context = audit_context();
2911 
2912 	/* only set type if not already set by NTP */
2913 	if (!context->type)
2914 		context->type = AUDIT_TIME_INJOFFSET;
2915 	memcpy(&context->time.tk_injoffset, &offset, sizeof(offset));
2916 }
2917 
__audit_ntp_log(const struct audit_ntp_data * ad)2918 void __audit_ntp_log(const struct audit_ntp_data *ad)
2919 {
2920 	struct audit_context *context = audit_context();
2921 	int type;
2922 
2923 	for (type = 0; type < AUDIT_NTP_NVALS; type++)
2924 		if (ad->vals[type].newval != ad->vals[type].oldval) {
2925 			/* unconditionally set type, overwriting TK */
2926 			context->type = AUDIT_TIME_ADJNTPVAL;
2927 			memcpy(&context->time.ntp_data, ad, sizeof(*ad));
2928 			break;
2929 		}
2930 }
2931 
__audit_log_nfcfg(const char * name,u8 af,unsigned int nentries,enum audit_nfcfgop op,gfp_t gfp)2932 void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
2933 		       enum audit_nfcfgop op, gfp_t gfp)
2934 {
2935 	struct audit_buffer *ab;
2936 	char comm[sizeof(current->comm)];
2937 
2938 	ab = audit_log_start(audit_context(), gfp, AUDIT_NETFILTER_CFG);
2939 	if (!ab)
2940 		return;
2941 	audit_log_format(ab, "table=%s family=%u entries=%u op=%s",
2942 			 name, af, nentries, audit_nfcfgs[op].s);
2943 
2944 	audit_log_format(ab, " pid=%u", task_pid_nr(current));
2945 	audit_log_task_context(ab); /* subj= */
2946 	audit_log_format(ab, " comm=");
2947 	audit_log_untrustedstring(ab, get_task_comm(comm, current));
2948 	audit_log_end(ab);
2949 }
2950 EXPORT_SYMBOL_GPL(__audit_log_nfcfg);
2951 
audit_log_task(struct audit_buffer * ab)2952 static void audit_log_task(struct audit_buffer *ab)
2953 {
2954 	kuid_t auid, uid;
2955 	kgid_t gid;
2956 	unsigned int sessionid;
2957 	char comm[sizeof(current->comm)];
2958 
2959 	auid = audit_get_loginuid(current);
2960 	sessionid = audit_get_sessionid(current);
2961 	current_uid_gid(&uid, &gid);
2962 
2963 	audit_log_format(ab, "auid=%u uid=%u gid=%u ses=%u",
2964 			 from_kuid(&init_user_ns, auid),
2965 			 from_kuid(&init_user_ns, uid),
2966 			 from_kgid(&init_user_ns, gid),
2967 			 sessionid);
2968 	audit_log_task_context(ab);
2969 	audit_log_format(ab, " pid=%d comm=", task_tgid_nr(current));
2970 	audit_log_untrustedstring(ab, get_task_comm(comm, current));
2971 	audit_log_d_path_exe(ab, current->mm);
2972 }
2973 
2974 /**
2975  * audit_core_dumps - record information about processes that end abnormally
2976  * @signr: signal value
2977  *
2978  * If a process ends with a core dump, something fishy is going on and we
2979  * should record the event for investigation.
2980  */
audit_core_dumps(long signr)2981 void audit_core_dumps(long signr)
2982 {
2983 	struct audit_buffer *ab;
2984 
2985 	if (!audit_enabled)
2986 		return;
2987 
2988 	if (signr == SIGQUIT)	/* don't care for those */
2989 		return;
2990 
2991 	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_ANOM_ABEND);
2992 	if (unlikely(!ab))
2993 		return;
2994 	audit_log_task(ab);
2995 	audit_log_format(ab, " sig=%ld res=1", signr);
2996 	audit_log_end(ab);
2997 }
2998 
2999 /**
3000  * audit_seccomp - record information about a seccomp action
3001  * @syscall: syscall number
3002  * @signr: signal value
3003  * @code: the seccomp action
3004  *
3005  * Record the information associated with a seccomp action. Event filtering for
3006  * seccomp actions that are not to be logged is done in seccomp_log().
3007  * Therefore, this function forces auditing independent of the audit_enabled
3008  * and dummy context state because seccomp actions should be logged even when
3009  * audit is not in use.
3010  */
audit_seccomp(unsigned long syscall,long signr,int code)3011 void audit_seccomp(unsigned long syscall, long signr, int code)
3012 {
3013 	struct audit_buffer *ab;
3014 
3015 	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_SECCOMP);
3016 	if (unlikely(!ab))
3017 		return;
3018 	audit_log_task(ab);
3019 	audit_log_format(ab, " sig=%ld arch=%x syscall=%ld compat=%d ip=0x%lx code=0x%x",
3020 			 signr, syscall_get_arch(current), syscall,
3021 			 in_compat_syscall(), KSTK_EIP(current), code);
3022 	audit_log_end(ab);
3023 }
3024 
audit_seccomp_actions_logged(const char * names,const char * old_names,int res)3025 void audit_seccomp_actions_logged(const char *names, const char *old_names,
3026 				  int res)
3027 {
3028 	struct audit_buffer *ab;
3029 
3030 	if (!audit_enabled)
3031 		return;
3032 
3033 	ab = audit_log_start(audit_context(), GFP_KERNEL,
3034 			     AUDIT_CONFIG_CHANGE);
3035 	if (unlikely(!ab))
3036 		return;
3037 
3038 	audit_log_format(ab,
3039 			 "op=seccomp-logging actions=%s old-actions=%s res=%d",
3040 			 names, old_names, res);
3041 	audit_log_end(ab);
3042 }
3043 
audit_killed_trees(void)3044 struct list_head *audit_killed_trees(void)
3045 {
3046 	struct audit_context *ctx = audit_context();
3047 	if (likely(!ctx || ctx->context == AUDIT_CTX_UNUSED))
3048 		return NULL;
3049 	return &ctx->killed_trees;
3050 }
3051