2 * Creating audit events from TTY input.
4 * Copyright (C) 2007 Red Hat, Inc. All rights reserved. This copyrighted
5 * material is made available to anyone wishing to use, modify, copy, or
6 * redistribute it subject to the terms and conditions of the GNU General
9 * Authors: Miloslav Trmac <mitr@redhat.com>
12 #include <linux/audit.h>
13 #include <linux/slab.h>
14 #include <linux/tty.h>
16 struct tty_audit_buf {
18 struct mutex mutex; /* Protects all data below */
19 int major, minor; /* The TTY which the data is from */
22 unsigned char *data; /* Allocated size N_TTY_BUF_SIZE */
25 static struct tty_audit_buf *tty_audit_buf_alloc(int major, int minor,
28 struct tty_audit_buf *buf;
30 buf = kmalloc(sizeof(*buf), GFP_KERNEL);
33 buf->data = kmalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
36 atomic_set(&buf->count, 1);
37 mutex_init(&buf->mutex);
50 static void tty_audit_buf_free(struct tty_audit_buf *buf)
52 WARN_ON(buf->valid != 0);
57 static void tty_audit_buf_put(struct tty_audit_buf *buf)
59 if (atomic_dec_and_test(&buf->count))
60 tty_audit_buf_free(buf);
63 static void tty_audit_log(const char *description, struct task_struct *tsk,
64 kuid_t loginuid, unsigned sessionid, int major,
65 int minor, unsigned char *data, size_t size)
67 struct audit_buffer *ab;
69 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY);
71 char name[sizeof(tsk->comm)];
72 kuid_t uid = task_uid(tsk);
74 audit_log_format(ab, "%s pid=%u uid=%u auid=%u ses=%u "
75 "major=%d minor=%d comm=", description,
77 from_kuid(&init_user_ns, uid),
78 from_kuid(&init_user_ns, loginuid),
81 get_task_comm(name, tsk);
82 audit_log_untrustedstring(ab, name);
83 audit_log_format(ab, " data=");
84 audit_log_n_hex(ab, data, size);
90 * tty_audit_buf_push - Push buffered data out
92 * Generate an audit message from the contents of @buf, which is owned by
93 * @tsk with @loginuid. @buf->mutex must be locked.
95 static void tty_audit_buf_push(struct task_struct *tsk, kuid_t loginuid,
96 unsigned int sessionid,
97 struct tty_audit_buf *buf)
101 if (audit_enabled == 0) {
105 tty_audit_log("tty", tsk, loginuid, sessionid, buf->major, buf->minor,
106 buf->data, buf->valid);
111 * tty_audit_buf_push_current - Push buffered data out
113 * Generate an audit message from the contents of @buf, which is owned by
114 * the current task. @buf->mutex must be locked.
116 static void tty_audit_buf_push_current(struct tty_audit_buf *buf)
118 kuid_t auid = audit_get_loginuid(current);
119 unsigned int sessionid = audit_get_sessionid(current);
120 tty_audit_buf_push(current, auid, sessionid, buf);
124 * tty_audit_exit - Handle a task exit
126 * Make sure all buffered data is written out and deallocate the buffer.
127 * Only needs to be called if current->signal->tty_audit_buf != %NULL.
129 void tty_audit_exit(void)
131 struct tty_audit_buf *buf;
133 spin_lock_irq(¤t->sighand->siglock);
134 buf = current->signal->tty_audit_buf;
135 current->signal->tty_audit_buf = NULL;
136 spin_unlock_irq(¤t->sighand->siglock);
140 mutex_lock(&buf->mutex);
141 tty_audit_buf_push_current(buf);
142 mutex_unlock(&buf->mutex);
144 tty_audit_buf_put(buf);
148 * tty_audit_fork - Copy TTY audit state for a new task
150 * Set up TTY audit state in @sig from current. @sig needs no locking.
152 void tty_audit_fork(struct signal_struct *sig)
154 spin_lock_irq(¤t->sighand->siglock);
155 sig->audit_tty = current->signal->audit_tty;
156 spin_unlock_irq(¤t->sighand->siglock);
160 * tty_audit_tiocsti - Log TIOCSTI
162 void tty_audit_tiocsti(struct tty_struct *tty, char ch)
164 struct tty_audit_buf *buf;
165 int major, minor, should_audit;
167 spin_lock_irq(¤t->sighand->siglock);
168 should_audit = current->signal->audit_tty;
169 buf = current->signal->tty_audit_buf;
171 atomic_inc(&buf->count);
172 spin_unlock_irq(¤t->sighand->siglock);
174 major = tty->driver->major;
175 minor = tty->driver->minor_start + tty->index;
177 mutex_lock(&buf->mutex);
178 if (buf->major == major && buf->minor == minor)
179 tty_audit_buf_push_current(buf);
180 mutex_unlock(&buf->mutex);
181 tty_audit_buf_put(buf);
184 if (should_audit && audit_enabled) {
186 unsigned int sessionid;
188 auid = audit_get_loginuid(current);
189 sessionid = audit_get_sessionid(current);
190 tty_audit_log("ioctl=TIOCSTI", current, auid, sessionid, major,
196 * tty_audit_push_task - Flush task's pending audit data
198 * @loginuid: sender login uid
199 * @sessionid: sender session id
201 * Called with a ref on @tsk held. Try to lock sighand and get a
202 * reference to the tty audit buffer if available.
203 * Flush the buffer or return an appropriate error code.
205 int tty_audit_push_task(struct task_struct *tsk, kuid_t loginuid, u32 sessionid)
207 struct tty_audit_buf *buf = ERR_PTR(-EPERM);
210 if (!lock_task_sighand(tsk, &flags))
213 if (tsk->signal->audit_tty) {
214 buf = tsk->signal->tty_audit_buf;
216 atomic_inc(&buf->count);
218 unlock_task_sighand(tsk, &flags);
221 * Return 0 when signal->audit_tty set
222 * but tsk->signal->tty_audit_buf == NULL.
224 if (!buf || IS_ERR(buf))
227 mutex_lock(&buf->mutex);
228 tty_audit_buf_push(tsk, loginuid, sessionid, buf);
229 mutex_unlock(&buf->mutex);
231 tty_audit_buf_put(buf);
236 * tty_audit_buf_get - Get an audit buffer.
238 * Get an audit buffer for @tty, allocate it if necessary. Return %NULL
239 * if TTY auditing is disabled or out of memory. Otherwise, return a new
240 * reference to the buffer.
242 static struct tty_audit_buf *tty_audit_buf_get(struct tty_struct *tty)
244 struct tty_audit_buf *buf, *buf2;
248 spin_lock_irq(¤t->sighand->siglock);
249 if (likely(!current->signal->audit_tty))
251 buf = current->signal->tty_audit_buf;
253 atomic_inc(&buf->count);
256 spin_unlock_irq(¤t->sighand->siglock);
258 buf2 = tty_audit_buf_alloc(tty->driver->major,
259 tty->driver->minor_start + tty->index,
262 audit_log_lost("out of memory in TTY auditing");
266 spin_lock_irq(¤t->sighand->siglock);
267 if (!current->signal->audit_tty)
269 buf = current->signal->tty_audit_buf;
271 current->signal->tty_audit_buf = buf2;
275 atomic_inc(&buf->count);
278 spin_unlock_irq(¤t->sighand->siglock);
280 tty_audit_buf_free(buf2);
285 * tty_audit_add_data - Add data for TTY auditing.
287 * Audit @data of @size from @tty, if necessary.
289 void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
292 struct tty_audit_buf *buf;
295 if (unlikely(size == 0))
298 if (tty->driver->type == TTY_DRIVER_TYPE_PTY
299 && tty->driver->subtype == PTY_TYPE_MASTER)
302 buf = tty_audit_buf_get(tty);
306 mutex_lock(&buf->mutex);
307 major = tty->driver->major;
308 minor = tty->driver->minor_start + tty->index;
309 if (buf->major != major || buf->minor != minor
310 || buf->icanon != tty->icanon) {
311 tty_audit_buf_push_current(buf);
314 buf->icanon = tty->icanon;
319 run = N_TTY_BUF_SIZE - buf->valid;
322 memcpy(buf->data + buf->valid, data, run);
326 if (buf->valid == N_TTY_BUF_SIZE)
327 tty_audit_buf_push_current(buf);
329 mutex_unlock(&buf->mutex);
330 tty_audit_buf_put(buf);
334 * tty_audit_push - Push buffered data out
336 * Make sure no audit data is pending for @tty on the current process.
338 void tty_audit_push(struct tty_struct *tty)
340 struct tty_audit_buf *buf;
342 spin_lock_irq(¤t->sighand->siglock);
343 if (likely(!current->signal->audit_tty)) {
344 spin_unlock_irq(¤t->sighand->siglock);
347 buf = current->signal->tty_audit_buf;
349 atomic_inc(&buf->count);
350 spin_unlock_irq(¤t->sighand->siglock);
355 major = tty->driver->major;
356 minor = tty->driver->minor_start + tty->index;
357 mutex_lock(&buf->mutex);
358 if (buf->major == major && buf->minor == minor)
359 tty_audit_buf_push_current(buf);
360 mutex_unlock(&buf->mutex);
361 tty_audit_buf_put(buf);