security/integrity/integrity_audit.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * Copyright (C) 2008 IBM Corporation
0004  * Author: Mimi Zohar <zohar@us.ibm.com>
0005  *
0006  * File: integrity_audit.c
0007  *  Audit calls for the integrity subsystem
0008  */
0009
0010 #include <linux/fs.h>
0011 #include <linux/gfp.h>
0012 #include <linux/audit.h>
0013 #include "integrity.h"
0014
0015 static int integrity_audit_info;
0016
0017 /* ima_audit_setup - enable informational auditing messages */
0018 static int __init integrity_audit_setup(char *str)
0019 {
0020     unsigned long audit;
0021
0022     if (!kstrtoul(str, 0, &audit))
0023         integrity_audit_info = audit ? 1 : 0;
0024     return 1;
0025 }
0026 __setup("integrity_audit=", integrity_audit_setup);
0027
0028 void integrity_audit_msg(int audit_msgno, struct inode *inode,
0029              const unsigned char *fname, const char *op,
0030              const char *cause, int result, int audit_info)
0031 {
0032     integrity_audit_message(audit_msgno, inode, fname, op, cause,
0033                 result, audit_info, 0);
0034 }
0035
0036 void integrity_audit_message(int audit_msgno, struct inode *inode,
0037                  const unsigned char *fname, const char *op,
0038                  const char *cause, int result, int audit_info,
0039                  int errno)
0040 {
0041     struct audit_buffer *ab;
0042     char name[TASK_COMM_LEN];
0043
0044     if (!integrity_audit_info && audit_info == 1)   /* Skip info messages */
0045         return;
0046
0047     ab = audit_log_start(audit_context(), GFP_KERNEL, audit_msgno);
0048     if (!ab)
0049         return;
0050     audit_log_format(ab, "pid=%d uid=%u auid=%u ses=%u",
0051              task_pid_nr(current),
0052              from_kuid(&init_user_ns, current_uid()),
0053              from_kuid(&init_user_ns, audit_get_loginuid(current)),
0054              audit_get_sessionid(current));
0055     audit_log_task_context(ab);
0056     audit_log_format(ab, " op=%s cause=%s comm=", op, cause);
0057     audit_log_untrustedstring(ab, get_task_comm(name, current));
0058     if (fname) {
0059         audit_log_format(ab, " name=");
0060         audit_log_untrustedstring(ab, fname);
0061     }
0062     if (inode) {
0063         audit_log_format(ab, " dev=");
0064         audit_log_untrustedstring(ab, inode->i_sb->s_id);
0065         audit_log_format(ab, " ino=%lu", inode->i_ino);
0066     }
0067     audit_log_format(ab, " res=%d errno=%d", !result, errno);
0068     audit_log_end(ab);
0069 }