Root/security/lsm_audit.c

1/*
2 * common LSM auditing functions
3 *
4 * Based on code written for SELinux by :
5 * Stephen Smalley, <sds@epoch.ncsc.mil>
6 * James Morris <jmorris@redhat.com>
7 * Author : Etienne Basset, <etienne.basset@ensta.org>
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2,
11 * as published by the Free Software Foundation.
12 */
13
14#include <linux/types.h>
15#include <linux/stddef.h>
16#include <linux/kernel.h>
17#include <linux/gfp.h>
18#include <linux/fs.h>
19#include <linux/init.h>
20#include <net/sock.h>
21#include <linux/un.h>
22#include <net/af_unix.h>
23#include <linux/audit.h>
24#include <linux/ipv6.h>
25#include <linux/ip.h>
26#include <net/ip.h>
27#include <net/ipv6.h>
28#include <linux/tcp.h>
29#include <linux/udp.h>
30#include <linux/dccp.h>
31#include <linux/sctp.h>
32#include <linux/lsm_audit.h>
33
34/**
35 * ipv4_skb_to_auditdata : fill auditdata from skb
36 * @skb : the skb
37 * @ad : the audit data to fill
38 * @proto : the layer 4 protocol
39 *
40 * return 0 on success
41 */
42int ipv4_skb_to_auditdata(struct sk_buff *skb,
43        struct common_audit_data *ad, u8 *proto)
44{
45    int ret = 0;
46    struct iphdr *ih;
47
48    ih = ip_hdr(skb);
49    if (ih == NULL)
50        return -EINVAL;
51
52    ad->u.net->v4info.saddr = ih->saddr;
53    ad->u.net->v4info.daddr = ih->daddr;
54
55    if (proto)
56        *proto = ih->protocol;
57    /* non initial fragment */
58    if (ntohs(ih->frag_off) & IP_OFFSET)
59        return 0;
60
61    switch (ih->protocol) {
62    case IPPROTO_TCP: {
63        struct tcphdr *th = tcp_hdr(skb);
64        if (th == NULL)
65            break;
66
67        ad->u.net->sport = th->source;
68        ad->u.net->dport = th->dest;
69        break;
70    }
71    case IPPROTO_UDP: {
72        struct udphdr *uh = udp_hdr(skb);
73        if (uh == NULL)
74            break;
75
76        ad->u.net->sport = uh->source;
77        ad->u.net->dport = uh->dest;
78        break;
79    }
80    case IPPROTO_DCCP: {
81        struct dccp_hdr *dh = dccp_hdr(skb);
82        if (dh == NULL)
83            break;
84
85        ad->u.net->sport = dh->dccph_sport;
86        ad->u.net->dport = dh->dccph_dport;
87        break;
88    }
89    case IPPROTO_SCTP: {
90        struct sctphdr *sh = sctp_hdr(skb);
91        if (sh == NULL)
92            break;
93        ad->u.net->sport = sh->source;
94        ad->u.net->dport = sh->dest;
95        break;
96    }
97    default:
98        ret = -EINVAL;
99    }
100    return ret;
101}
102#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
103/**
104 * ipv6_skb_to_auditdata : fill auditdata from skb
105 * @skb : the skb
106 * @ad : the audit data to fill
107 * @proto : the layer 4 protocol
108 *
109 * return 0 on success
110 */
111int ipv6_skb_to_auditdata(struct sk_buff *skb,
112        struct common_audit_data *ad, u8 *proto)
113{
114    int offset, ret = 0;
115    struct ipv6hdr *ip6;
116    u8 nexthdr;
117    __be16 frag_off;
118
119    ip6 = ipv6_hdr(skb);
120    if (ip6 == NULL)
121        return -EINVAL;
122    ad->u.net->v6info.saddr = ip6->saddr;
123    ad->u.net->v6info.daddr = ip6->daddr;
124    ret = 0;
125    /* IPv6 can have several extension header before the Transport header
126     * skip them */
127    offset = skb_network_offset(skb);
128    offset += sizeof(*ip6);
129    nexthdr = ip6->nexthdr;
130    offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
131    if (offset < 0)
132        return 0;
133    if (proto)
134        *proto = nexthdr;
135    switch (nexthdr) {
136    case IPPROTO_TCP: {
137        struct tcphdr _tcph, *th;
138
139        th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
140        if (th == NULL)
141            break;
142
143        ad->u.net->sport = th->source;
144        ad->u.net->dport = th->dest;
145        break;
146    }
147    case IPPROTO_UDP: {
148        struct udphdr _udph, *uh;
149
150        uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
151        if (uh == NULL)
152            break;
153
154        ad->u.net->sport = uh->source;
155        ad->u.net->dport = uh->dest;
156        break;
157    }
158    case IPPROTO_DCCP: {
159        struct dccp_hdr _dccph, *dh;
160
161        dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
162        if (dh == NULL)
163            break;
164
165        ad->u.net->sport = dh->dccph_sport;
166        ad->u.net->dport = dh->dccph_dport;
167        break;
168    }
169    case IPPROTO_SCTP: {
170        struct sctphdr _sctph, *sh;
171
172        sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
173        if (sh == NULL)
174            break;
175        ad->u.net->sport = sh->source;
176        ad->u.net->dport = sh->dest;
177        break;
178    }
179    default:
180        ret = -EINVAL;
181    }
182    return ret;
183}
184#endif
185
186
187static inline void print_ipv6_addr(struct audit_buffer *ab,
188                   struct in6_addr *addr, __be16 port,
189                   char *name1, char *name2)
190{
191    if (!ipv6_addr_any(addr))
192        audit_log_format(ab, " %s=%pI6c", name1, addr);
193    if (port)
194        audit_log_format(ab, " %s=%d", name2, ntohs(port));
195}
196
197static inline void print_ipv4_addr(struct audit_buffer *ab, __be32 addr,
198                   __be16 port, char *name1, char *name2)
199{
200    if (addr)
201        audit_log_format(ab, " %s=%pI4", name1, &addr);
202    if (port)
203        audit_log_format(ab, " %s=%d", name2, ntohs(port));
204}
205
206/**
207 * dump_common_audit_data - helper to dump common audit data
208 * @a : common audit data
209 *
210 */
211static void dump_common_audit_data(struct audit_buffer *ab,
212                   struct common_audit_data *a)
213{
214    struct task_struct *tsk = current;
215
216    if (a->tsk)
217        tsk = a->tsk;
218    if (tsk && tsk->pid) {
219        audit_log_format(ab, " pid=%d comm=", tsk->pid);
220        audit_log_untrustedstring(ab, tsk->comm);
221    }
222
223    switch (a->type) {
224    case LSM_AUDIT_DATA_NONE:
225        return;
226    case LSM_AUDIT_DATA_IPC:
227        audit_log_format(ab, " key=%d ", a->u.ipc_id);
228        break;
229    case LSM_AUDIT_DATA_CAP:
230        audit_log_format(ab, " capability=%d ", a->u.cap);
231        break;
232    case LSM_AUDIT_DATA_PATH: {
233        struct inode *inode;
234
235        audit_log_d_path(ab, " path=", &a->u.path);
236
237        inode = a->u.path.dentry->d_inode;
238        if (inode) {
239            audit_log_format(ab, " dev=");
240            audit_log_untrustedstring(ab, inode->i_sb->s_id);
241            audit_log_format(ab, " ino=%lu", inode->i_ino);
242        }
243        break;
244    }
245    case LSM_AUDIT_DATA_DENTRY: {
246        struct inode *inode;
247
248        audit_log_format(ab, " name=");
249        audit_log_untrustedstring(ab, a->u.dentry->d_name.name);
250
251        inode = a->u.dentry->d_inode;
252        if (inode) {
253            audit_log_format(ab, " dev=");
254            audit_log_untrustedstring(ab, inode->i_sb->s_id);
255            audit_log_format(ab, " ino=%lu", inode->i_ino);
256        }
257        break;
258    }
259    case LSM_AUDIT_DATA_INODE: {
260        struct dentry *dentry;
261        struct inode *inode;
262
263        inode = a->u.inode;
264        dentry = d_find_alias(inode);
265        if (dentry) {
266            audit_log_format(ab, " name=");
267            audit_log_untrustedstring(ab,
268                     dentry->d_name.name);
269            dput(dentry);
270        }
271        audit_log_format(ab, " dev=");
272        audit_log_untrustedstring(ab, inode->i_sb->s_id);
273        audit_log_format(ab, " ino=%lu", inode->i_ino);
274        break;
275    }
276    case LSM_AUDIT_DATA_TASK:
277        tsk = a->u.tsk;
278        if (tsk && tsk->pid) {
279            audit_log_format(ab, " pid=%d comm=", tsk->pid);
280            audit_log_untrustedstring(ab, tsk->comm);
281        }
282        break;
283    case LSM_AUDIT_DATA_NET:
284        if (a->u.net->sk) {
285            struct sock *sk = a->u.net->sk;
286            struct unix_sock *u;
287            int len = 0;
288            char *p = NULL;
289
290            switch (sk->sk_family) {
291            case AF_INET: {
292                struct inet_sock *inet = inet_sk(sk);
293
294                print_ipv4_addr(ab, inet->inet_rcv_saddr,
295                        inet->inet_sport,
296                        "laddr", "lport");
297                print_ipv4_addr(ab, inet->inet_daddr,
298                        inet->inet_dport,
299                        "faddr", "fport");
300                break;
301            }
302            case AF_INET6: {
303                struct inet_sock *inet = inet_sk(sk);
304                struct ipv6_pinfo *inet6 = inet6_sk(sk);
305
306                print_ipv6_addr(ab, &inet6->rcv_saddr,
307                        inet->inet_sport,
308                        "laddr", "lport");
309                print_ipv6_addr(ab, &inet6->daddr,
310                        inet->inet_dport,
311                        "faddr", "fport");
312                break;
313            }
314            case AF_UNIX:
315                u = unix_sk(sk);
316                if (u->path.dentry) {
317                    audit_log_d_path(ab, " path=", &u->path);
318                    break;
319                }
320                if (!u->addr)
321                    break;
322                len = u->addr->len-sizeof(short);
323                p = &u->addr->name->sun_path[0];
324                audit_log_format(ab, " path=");
325                if (*p)
326                    audit_log_untrustedstring(ab, p);
327                else
328                    audit_log_n_hex(ab, p, len);
329                break;
330            }
331        }
332
333        switch (a->u.net->family) {
334        case AF_INET:
335            print_ipv4_addr(ab, a->u.net->v4info.saddr,
336                    a->u.net->sport,
337                    "saddr", "src");
338            print_ipv4_addr(ab, a->u.net->v4info.daddr,
339                    a->u.net->dport,
340                    "daddr", "dest");
341            break;
342        case AF_INET6:
343            print_ipv6_addr(ab, &a->u.net->v6info.saddr,
344                    a->u.net->sport,
345                    "saddr", "src");
346            print_ipv6_addr(ab, &a->u.net->v6info.daddr,
347                    a->u.net->dport,
348                    "daddr", "dest");
349            break;
350        }
351        if (a->u.net->netif > 0) {
352            struct net_device *dev;
353
354            /* NOTE: we always use init's namespace */
355            dev = dev_get_by_index(&init_net, a->u.net->netif);
356            if (dev) {
357                audit_log_format(ab, " netif=%s", dev->name);
358                dev_put(dev);
359            }
360        }
361        break;
362#ifdef CONFIG_KEYS
363    case LSM_AUDIT_DATA_KEY:
364        audit_log_format(ab, " key_serial=%u", a->u.key_struct.key);
365        if (a->u.key_struct.key_desc) {
366            audit_log_format(ab, " key_desc=");
367            audit_log_untrustedstring(ab, a->u.key_struct.key_desc);
368        }
369        break;
370#endif
371    case LSM_AUDIT_DATA_KMOD:
372        audit_log_format(ab, " kmod=");
373        audit_log_untrustedstring(ab, a->u.kmod_name);
374        break;
375    } /* switch (a->type) */
376}
377
378/**
379 * common_lsm_audit - generic LSM auditing function
380 * @a: auxiliary audit data
381 * @pre_audit: lsm-specific pre-audit callback
382 * @post_audit: lsm-specific post-audit callback
383 *
384 * setup the audit buffer for common security information
385 * uses callback to print LSM specific information
386 */
387void common_lsm_audit(struct common_audit_data *a,
388    void (*pre_audit)(struct audit_buffer *, void *),
389    void (*post_audit)(struct audit_buffer *, void *))
390{
391    struct audit_buffer *ab;
392
393    if (a == NULL)
394        return;
395    /* we use GFP_ATOMIC so we won't sleep */
396    ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_AVC);
397
398    if (ab == NULL)
399        return;
400
401    if (pre_audit)
402        pre_audit(ab, a);
403
404    dump_common_audit_data(ab, a);
405
406    if (post_audit)
407        post_audit(ab, a);
408
409    audit_log_end(ab);
410}
411

Archive Download this file



interactive