apparmor/include/audit.h

0001 /* SPDX-License-Identifier: GPL-2.0-only */
0002 /*
0003  * AppArmor security module
0004  *
0005  * This file contains AppArmor auditing function definitions.
0006  *
0007  * Copyright (C) 1998-2008 Novell/SUSE
0008  * Copyright 2009-2010 Canonical Ltd.
0009  */
0010
0011 #ifndef __AA_AUDIT_H
0012 #define __AA_AUDIT_H
0013
0014 #include <linux/audit.h>
0015 #include <linux/fs.h>
0016 #include <linux/lsm_audit.h>
0017 #include <linux/sched.h>
0018 #include <linux/slab.h>
0019
0020 #include "file.h"
0021 #include "label.h"
0022
0023 extern const char *const audit_mode_names[];
0024 #define AUDIT_MAX_INDEX 5
0025 enum audit_mode {
0026     AUDIT_NORMAL,       /* follow normal auditing of accesses */
0027     AUDIT_QUIET_DENIED, /* quiet all denied access messages */
0028     AUDIT_QUIET,        /* quiet all messages */
0029     AUDIT_NOQUIET,      /* do not quiet audit messages */
0030     AUDIT_ALL       /* audit all accesses */
0031 };
0032
0033 enum audit_type {
0034     AUDIT_APPARMOR_AUDIT,
0035     AUDIT_APPARMOR_ALLOWED,
0036     AUDIT_APPARMOR_DENIED,
0037     AUDIT_APPARMOR_HINT,
0038     AUDIT_APPARMOR_STATUS,
0039     AUDIT_APPARMOR_ERROR,
0040     AUDIT_APPARMOR_KILL,
0041     AUDIT_APPARMOR_AUTO
0042 };
0043
0044 #define OP_NULL NULL
0045
0046 #define OP_SYSCTL "sysctl"
0047 #define OP_CAPABLE "capable"
0048
0049 #define OP_UNLINK "unlink"
0050 #define OP_MKDIR "mkdir"
0051 #define OP_RMDIR "rmdir"
0052 #define OP_MKNOD "mknod"
0053 #define OP_TRUNC "truncate"
0054 #define OP_LINK "link"
0055 #define OP_SYMLINK "symlink"
0056 #define OP_RENAME_SRC "rename_src"
0057 #define OP_RENAME_DEST "rename_dest"
0058 #define OP_CHMOD "chmod"
0059 #define OP_CHOWN "chown"
0060 #define OP_GETATTR "getattr"
0061 #define OP_OPEN "open"
0062
0063 #define OP_FRECEIVE "file_receive"
0064 #define OP_FPERM "file_perm"
0065 #define OP_FLOCK "file_lock"
0066 #define OP_FMMAP "file_mmap"
0067 #define OP_FMPROT "file_mprotect"
0068 #define OP_INHERIT "file_inherit"
0069
0070 #define OP_PIVOTROOT "pivotroot"
0071 #define OP_MOUNT "mount"
0072 #define OP_UMOUNT "umount"
0073
0074 #define OP_CREATE "create"
0075 #define OP_POST_CREATE "post_create"
0076 #define OP_BIND "bind"
0077 #define OP_CONNECT "connect"
0078 #define OP_LISTEN "listen"
0079 #define OP_ACCEPT "accept"
0080 #define OP_SENDMSG "sendmsg"
0081 #define OP_RECVMSG "recvmsg"
0082 #define OP_GETSOCKNAME "getsockname"
0083 #define OP_GETPEERNAME "getpeername"
0084 #define OP_GETSOCKOPT "getsockopt"
0085 #define OP_SETSOCKOPT "setsockopt"
0086 #define OP_SHUTDOWN "socket_shutdown"
0087
0088 #define OP_PTRACE "ptrace"
0089 #define OP_SIGNAL "signal"
0090
0091 #define OP_EXEC "exec"
0092
0093 #define OP_CHANGE_HAT "change_hat"
0094 #define OP_CHANGE_PROFILE "change_profile"
0095 #define OP_CHANGE_ONEXEC "change_onexec"
0096 #define OP_STACK "stack"
0097 #define OP_STACK_ONEXEC "stack_onexec"
0098
0099 #define OP_SETPROCATTR "setprocattr"
0100 #define OP_SETRLIMIT "setrlimit"
0101
0102 #define OP_PROF_REPL "profile_replace"
0103 #define OP_PROF_LOAD "profile_load"
0104 #define OP_PROF_RM "profile_remove"
0105
0106
0107 struct apparmor_audit_data {
0108     int error;
0109     int type;
0110     const char *op;
0111     struct aa_label *label;
0112     const char *name;
0113     const char *info;
0114     u32 request;
0115     u32 denied;
0116     union {
0117         /* these entries require a custom callback fn */
0118         struct {
0119             struct aa_label *peer;
0120             union {
0121                 struct {
0122                     const char *target;
0123                     kuid_t ouid;
0124                 } fs;
0125                 struct {
0126                     int rlim;
0127                     unsigned long max;
0128                 } rlim;
0129                 struct {
0130                     int signal;
0131                     int unmappedsig;
0132                 };
0133                 struct {
0134                     int type, protocol;
0135                     struct sock *peer_sk;
0136                     void *addr;
0137                     int addrlen;
0138                 } net;
0139             };
0140         };
0141         struct {
0142             struct aa_profile *profile;
0143             const char *ns;
0144             long pos;
0145         } iface;
0146         struct {
0147             const char *src_name;
0148             const char *type;
0149             const char *trans;
0150             const char *data;
0151             unsigned long flags;
0152         } mnt;
0153     };
0154 };
0155
0156 /* macros for dealing with  apparmor_audit_data structure */
0157 #define aad(SA) ((SA)->apparmor_audit_data)
0158 #define DEFINE_AUDIT_DATA(NAME, T, X)                   \
0159     /* TODO: cleanup audit init so we don't need _aad = {0,} */ \
0160     struct apparmor_audit_data NAME ## _aad = { .op = (X), };   \
0161     struct common_audit_data NAME =                 \
0162     {                               \
0163     .type = (T),                            \
0164     .u.tsk = NULL,                          \
0165     };                              \
0166     NAME.apparmor_audit_data = &(NAME ## _aad)
0167
0168 void aa_audit_msg(int type, struct common_audit_data *sa,
0169           void (*cb) (struct audit_buffer *, void *));
0170 int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa,
0171          void (*cb) (struct audit_buffer *, void *));
0172
0173 #define aa_audit_error(ERROR, SA, CB)               \
0174 ({                              \
0175     aad((SA))->error = (ERROR);             \
0176     aa_audit_msg(AUDIT_APPARMOR_ERROR, (SA), (CB));     \
0177     aad((SA))->error;                   \
0178 })
0179
0180
0181 static inline int complain_error(int error)
0182 {
0183     if (error == -EPERM || error == -EACCES)
0184         return 0;
0185     return error;
0186 }
0187
0188 void aa_audit_rule_free(void *vrule);
0189 int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule);
0190 int aa_audit_rule_known(struct audit_krule *rule);
0191 int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule);
0192
0193 #endif /* __AA_AUDIT_H */