security/apparmor/audit.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * AppArmor security module
0004  *
0005  * This file contains AppArmor auditing functions
0006  *
0007  * Copyright (C) 1998-2008 Novell/SUSE
0008  * Copyright 2009-2010 Canonical Ltd.
0009  */
0010
0011 #include <linux/audit.h>
0012 #include <linux/socket.h>
0013
0014 #include "include/apparmor.h"
0015 #include "include/audit.h"
0016 #include "include/policy.h"
0017 #include "include/policy_ns.h"
0018 #include "include/secid.h"
0019
0020 const char *const audit_mode_names[] = {
0021     "normal",
0022     "quiet_denied",
0023     "quiet",
0024     "noquiet",
0025     "all"
0026 };
0027
0028 static const char *const aa_audit_type[] = {
0029     "AUDIT",
0030     "ALLOWED",
0031     "DENIED",
0032     "HINT",
0033     "STATUS",
0034     "ERROR",
0035     "KILLED",
0036     "AUTO"
0037 };
0038
0039 /*
0040  * Currently AppArmor auditing is fed straight into the audit framework.
0041  *
0042  * TODO:
0043  * netlink interface for complain mode
0044  * user auditing, - send user auditing to netlink interface
0045  * system control of whether user audit messages go to system log
0046  */
0047
0048 /**
0049  * audit_base - core AppArmor function.
0050  * @ab: audit buffer to fill (NOT NULL)
0051  * @ca: audit structure containing data to audit (NOT NULL)
0052  *
0053  * Record common AppArmor audit data from @sa
0054  */
0055 static void audit_pre(struct audit_buffer *ab, void *ca)
0056 {
0057     struct common_audit_data *sa = ca;
0058
0059     if (aa_g_audit_header) {
0060         audit_log_format(ab, "apparmor=\"%s\"",
0061                  aa_audit_type[aad(sa)->type]);
0062     }
0063
0064     if (aad(sa)->op) {
0065         audit_log_format(ab, " operation=\"%s\"", aad(sa)->op);
0066     }
0067
0068     if (aad(sa)->info) {
0069         audit_log_format(ab, " info=\"%s\"", aad(sa)->info);
0070         if (aad(sa)->error)
0071             audit_log_format(ab, " error=%d", aad(sa)->error);
0072     }
0073
0074     if (aad(sa)->label) {
0075         struct aa_label *label = aad(sa)->label;
0076
0077         if (label_isprofile(label)) {
0078             struct aa_profile *profile = labels_profile(label);
0079
0080             if (profile->ns != root_ns) {
0081                 audit_log_format(ab, " namespace=");
0082                 audit_log_untrustedstring(ab,
0083                                profile->ns->base.hname);
0084             }
0085             audit_log_format(ab, " profile=");
0086             audit_log_untrustedstring(ab, profile->base.hname);
0087         } else {
0088             audit_log_format(ab, " label=");
0089             aa_label_xaudit(ab, root_ns, label, FLAG_VIEW_SUBNS,
0090                     GFP_ATOMIC);
0091         }
0092     }
0093
0094     if (aad(sa)->name) {
0095         audit_log_format(ab, " name=");
0096         audit_log_untrustedstring(ab, aad(sa)->name);
0097     }
0098 }
0099
0100 /**
0101  * aa_audit_msg - Log a message to the audit subsystem
0102  * @sa: audit event structure (NOT NULL)
0103  * @cb: optional callback fn for type specific fields (MAYBE NULL)
0104  */
0105 void aa_audit_msg(int type, struct common_audit_data *sa,
0106           void (*cb) (struct audit_buffer *, void *))
0107 {
0108     aad(sa)->type = type;
0109     common_lsm_audit(sa, audit_pre, cb);
0110 }
0111
0112 /**
0113  * aa_audit - Log a profile based audit event to the audit subsystem
0114  * @type: audit type for the message
0115  * @profile: profile to check against (NOT NULL)
0116  * @sa: audit event (NOT NULL)
0117  * @cb: optional callback fn for type specific fields (MAYBE NULL)
0118  *
0119  * Handle default message switching based off of audit mode flags
0120  *
0121  * Returns: error on failure
0122  */
0123 int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa,
0124          void (*cb) (struct audit_buffer *, void *))
0125 {
0126     AA_BUG(!profile);
0127
0128     if (type == AUDIT_APPARMOR_AUTO) {
0129         if (likely(!aad(sa)->error)) {
0130             if (AUDIT_MODE(profile) != AUDIT_ALL)
0131                 return 0;
0132             type = AUDIT_APPARMOR_AUDIT;
0133         } else if (COMPLAIN_MODE(profile))
0134             type = AUDIT_APPARMOR_ALLOWED;
0135         else
0136             type = AUDIT_APPARMOR_DENIED;
0137     }
0138     if (AUDIT_MODE(profile) == AUDIT_QUIET ||
0139         (type == AUDIT_APPARMOR_DENIED &&
0140          AUDIT_MODE(profile) == AUDIT_QUIET_DENIED))
0141         return aad(sa)->error;
0142
0143     if (KILL_MODE(profile) && type == AUDIT_APPARMOR_DENIED)
0144         type = AUDIT_APPARMOR_KILL;
0145
0146     aad(sa)->label = &profile->label;
0147
0148     aa_audit_msg(type, sa, cb);
0149
0150     if (aad(sa)->type == AUDIT_APPARMOR_KILL)
0151         (void)send_sig_info(SIGKILL, NULL,
0152             sa->type == LSM_AUDIT_DATA_TASK && sa->u.tsk ?
0153                     sa->u.tsk : current);
0154
0155     if (aad(sa)->type == AUDIT_APPARMOR_ALLOWED)
0156         return complain_error(aad(sa)->error);
0157
0158     return aad(sa)->error;
0159 }
0160
0161 struct aa_audit_rule {
0162     struct aa_label *label;
0163 };
0164
0165 void aa_audit_rule_free(void *vrule)
0166 {
0167     struct aa_audit_rule *rule = vrule;
0168
0169     if (rule) {
0170         if (!IS_ERR(rule->label))
0171             aa_put_label(rule->label);
0172         kfree(rule);
0173     }
0174 }
0175
0176 int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
0177 {
0178     struct aa_audit_rule *rule;
0179
0180     switch (field) {
0181     case AUDIT_SUBJ_ROLE:
0182         if (op != Audit_equal && op != Audit_not_equal)
0183             return -EINVAL;
0184         break;
0185     default:
0186         return -EINVAL;
0187     }
0188
0189     rule = kzalloc(sizeof(struct aa_audit_rule), GFP_KERNEL);
0190
0191     if (!rule)
0192         return -ENOMEM;
0193
0194     /* Currently rules are treated as coming from the root ns */
0195     rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
0196                      GFP_KERNEL, true, false);
0197     if (IS_ERR(rule->label)) {
0198         int err = PTR_ERR(rule->label);
0199         aa_audit_rule_free(rule);
0200         return err;
0201     }
0202
0203     *vrule = rule;
0204     return 0;
0205 }
0206
0207 int aa_audit_rule_known(struct audit_krule *rule)
0208 {
0209     int i;
0210
0211     for (i = 0; i < rule->field_count; i++) {
0212         struct audit_field *f = &rule->fields[i];
0213
0214         switch (f->type) {
0215         case AUDIT_SUBJ_ROLE:
0216             return 1;
0217         }
0218     }
0219
0220     return 0;
0221 }
0222
0223 int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule)
0224 {
0225     struct aa_audit_rule *rule = vrule;
0226     struct aa_label *label;
0227     int found = 0;
0228
0229     label = aa_secid_to_label(sid);
0230
0231     if (!label)
0232         return -ENOENT;
0233
0234     if (aa_label_is_subset(label, rule->label))
0235         found = 1;
0236
0237     switch (field) {
0238     case AUDIT_SUBJ_ROLE:
0239         switch (op) {
0240         case Audit_equal:
0241             return found;
0242         case Audit_not_equal:
0243             return !found;
0244         }
0245     }
0246     return 0;
0247 }