drivers/char/tty_audit.c

   1 /*
   2  * Creating audit events from TTY input.
   3  *
   4  * Copyright (C) 2007 Red Hat, Inc.  All rights reserved.  This copyrighted
   5  * material is made available to anyone wishing to use, modify, copy, or
   6  * redistribute it subject to the terms and conditions of the GNU General
   7  * Public License v.2.
   8  *
   9  * Authors: Miloslav Trmac <mitr@redhat.com>
  10  */
  11
  12 #include <linux/audit.h>
  13 #include <linux/file.h>
  14 #include <linux/tty.h>
  15
  16 struct tty_audit_buf {
  17         atomic_t count;
  18         struct mutex mutex;     /* Protects all data below */
  19         int major, minor;       /* The TTY which the data is from */
  20         unsigned icanon:1;
  21         size_t valid;
  22         unsigned char *data;    /* Allocated size N_TTY_BUF_SIZE */
  23 };
  24
  25 static struct tty_audit_buf *tty_audit_buf_alloc(int major, int minor,
  26                                                  int icanon)
  27 {
  28         struct tty_audit_buf *buf;
  29
  30         buf = kmalloc(sizeof(*buf), GFP_KERNEL);
  31         if (!buf)
  32                 goto err;
  33         if (PAGE_SIZE != N_TTY_BUF_SIZE)
  34                 buf->data = kmalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
  35         else
  36                 buf->data = (unsigned char *)__get_free_page(GFP_KERNEL);
  37         if (!buf->data)
  38                 goto err_buf;
  39         atomic_set(&buf->count, 1);
  40         mutex_init(&buf->mutex);
  41         buf->major = major;
  42         buf->minor = minor;
  43         buf->icanon = icanon;
  44         buf->valid = 0;
  45         return buf;
  46
  47 err_buf:
  48         kfree(buf);
  49 err:
  50         return NULL;
  51 }
  52
  53 static void tty_audit_buf_free(struct tty_audit_buf *buf)
  54 {
  55         WARN_ON(buf->valid != 0);
  56         if (PAGE_SIZE != N_TTY_BUF_SIZE)
  57                 kfree(buf->data);
  58         else
  59                 free_page((unsigned long)buf->data);
  60         kfree(buf);
  61 }
  62
  63 static void tty_audit_buf_put(struct tty_audit_buf *buf)
  64 {
  65         if (atomic_dec_and_test(&buf->count))
  66                 tty_audit_buf_free(buf);
  67 }
  68
  69 /**
  70  *      tty_audit_buf_push      -       Push buffered data out
  71  *
  72  *      Generate an audit message from the contents of @buf, which is owned by
  73  *      @tsk with @loginuid.  @buf->mutex must be locked.
  74  */
  75 static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid,
  76                                unsigned int sessionid,
  77                                struct tty_audit_buf *buf)
  78 {
  79         struct audit_buffer *ab;
  80
  81         if (buf->valid == 0)
  82                 return;
  83         if (audit_enabled == 0)
  84                 return;
  85         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY);
  86         if (ab) {
  87                 char name[sizeof(tsk->comm)];
  88
  89                 audit_log_format(ab, "tty pid=%u uid=%u auid=%u ses=%u "
  90                                  "major=%d minor=%d comm=", tsk->pid, tsk->uid,
  91                                  loginuid, sessionid, buf->major, buf->minor);
  92                 get_task_comm(name, tsk);
  93                 audit_log_untrustedstring(ab, name);
  94                 audit_log_format(ab, " data=");
  95                 audit_log_n_untrustedstring(ab, buf->valid, buf->data);
  96                 audit_log_end(ab);
  97         }
  98         buf->valid = 0;
  99 }
 100
 101 /**
 102  *      tty_audit_buf_push_current      -       Push buffered data out
 103  *
 104  *      Generate an audit message from the contents of @buf, which is owned by
 105  *      the current task.  @buf->mutex must be locked.
 106  */
 107 static void tty_audit_buf_push_current(struct tty_audit_buf *buf)
 108 {
 109         uid_t auid = audit_get_loginuid(current);
 110         unsigned int sessionid = audit_get_sessionid(current);
 111         tty_audit_buf_push(current, auid, sessionid, buf);
 112 }
 113
 114 /**
 115  *      tty_audit_exit  -       Handle a task exit
 116  *
 117  *      Make sure all buffered data is written out and deallocate the buffer.
 118  *      Only needs to be called if current->signal->tty_audit_buf != %NULL.
 119  */
 120 void tty_audit_exit(void)
 121 {
 122         struct tty_audit_buf *buf;
 123
 124         spin_lock_irq(&current->sighand->siglock);
 125         buf = current->signal->tty_audit_buf;
 126         current->signal->tty_audit_buf = NULL;
 127         spin_unlock_irq(&current->sighand->siglock);
 128         if (!buf)
 129                 return;
 130
 131         mutex_lock(&buf->mutex);
 132         tty_audit_buf_push_current(buf);
 133         mutex_unlock(&buf->mutex);
 134
 135         tty_audit_buf_put(buf);
 136 }
 137
 138 /**
 139  *      tty_audit_fork  -       Copy TTY audit state for a new task
 140  *
 141  *      Set up TTY audit state in @sig from current.  @sig needs no locking.
 142  */
 143 void tty_audit_fork(struct signal_struct *sig)
 144 {
 145         spin_lock_irq(&current->sighand->siglock);
 146         sig->audit_tty = current->signal->audit_tty;
 147         spin_unlock_irq(&current->sighand->siglock);
 148         sig->tty_audit_buf = NULL;
 149 }
 150
 151 /**
 152  *      tty_audit_push_task     -       Flush task's pending audit data
 153  */
 154 void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid)
 155 {
 156         struct tty_audit_buf *buf;
 157
 158         spin_lock_irq(&tsk->sighand->siglock);
 159         buf = tsk->signal->tty_audit_buf;
 160         if (buf)
 161                 atomic_inc(&buf->count);
 162         spin_unlock_irq(&tsk->sighand->siglock);
 163         if (!buf)
 164                 return;
 165
 166         mutex_lock(&buf->mutex);
 167         tty_audit_buf_push(tsk, loginuid, sessionid, buf);
 168         mutex_unlock(&buf->mutex);
 169
 170         tty_audit_buf_put(buf);
 171 }
 172
 173 /**
 174  *      tty_audit_buf_get       -       Get an audit buffer.
 175  *
 176  *      Get an audit buffer for @tty, allocate it if necessary.  Return %NULL
 177  *      if TTY auditing is disabled or out of memory.  Otherwise, return a new
 178  *      reference to the buffer.
 179  */
 180 static struct tty_audit_buf *tty_audit_buf_get(struct tty_struct *tty)
 181 {
 182         struct tty_audit_buf *buf, *buf2;
 183
 184         buf = NULL;
 185         buf2 = NULL;
 186         spin_lock_irq(&current->sighand->siglock);
 187         if (likely(!current->signal->audit_tty))
 188                 goto out;
 189         buf = current->signal->tty_audit_buf;
 190         if (buf) {
 191                 atomic_inc(&buf->count);
 192                 goto out;
 193         }
 194         spin_unlock_irq(&current->sighand->siglock);
 195
 196         buf2 = tty_audit_buf_alloc(tty->driver->major,
 197                                    tty->driver->minor_start + tty->index,
 198                                    tty->icanon);
 199         if (buf2 == NULL) {
 200                 audit_log_lost("out of memory in TTY auditing");
 201                 return NULL;
 202         }
 203
 204         spin_lock_irq(&current->sighand->siglock);
 205         if (!current->signal->audit_tty)
 206                 goto out;
 207         buf = current->signal->tty_audit_buf;
 208         if (!buf) {
 209                 current->signal->tty_audit_buf = buf2;
 210                 buf = buf2;
 211                 buf2 = NULL;
 212         }
 213         atomic_inc(&buf->count);
 214         /* Fall through */
 215  out:
 216         spin_unlock_irq(&current->sighand->siglock);
 217         if (buf2)
 218                 tty_audit_buf_free(buf2);
 219         return buf;
 220 }
 221
 222 /**
 223  *      tty_audit_add_data      -       Add data for TTY auditing.
 224  *
 225  *      Audit @data of @size from @tty, if necessary.
 226  */
 227 void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
 228                         size_t size)
 229 {
 230         struct tty_audit_buf *buf;
 231         int major, minor;
 232
 233         if (unlikely(size == 0))
 234                 return;
 235
 236         buf = tty_audit_buf_get(tty);
 237         if (!buf)
 238                 return;
 239
 240         mutex_lock(&buf->mutex);
 241         major = tty->driver->major;
 242         minor = tty->driver->minor_start + tty->index;
 243         if (buf->major != major || buf->minor != minor
 244             || buf->icanon != tty->icanon) {
 245                 tty_audit_buf_push_current(buf);
 246                 buf->major = major;
 247                 buf->minor = minor;
 248                 buf->icanon = tty->icanon;
 249         }
 250         do {
 251                 size_t run;
 252
 253                 run = N_TTY_BUF_SIZE - buf->valid;
 254                 if (run > size)
 255                         run = size;
 256                 memcpy(buf->data + buf->valid, data, run);
 257                 buf->valid += run;
 258                 data += run;
 259                 size -= run;
 260                 if (buf->valid == N_TTY_BUF_SIZE)
 261                         tty_audit_buf_push_current(buf);
 262         } while (size != 0);
 263         mutex_unlock(&buf->mutex);
 264         tty_audit_buf_put(buf);
 265 }
 266
 267 /**
 268  *      tty_audit_push  -       Push buffered data out
 269  *
 270  *      Make sure no audit data is pending for @tty on the current process.
 271  */
 272 void tty_audit_push(struct tty_struct *tty)
 273 {
 274         struct tty_audit_buf *buf;
 275
 276         spin_lock_irq(&current->sighand->siglock);
 277         if (likely(!current->signal->audit_tty)) {
 278                 spin_unlock_irq(&current->sighand->siglock);
 279                 return;
 280         }
 281         buf = current->signal->tty_audit_buf;
 282         if (buf)
 283                 atomic_inc(&buf->count);
 284         spin_unlock_irq(&current->sighand->siglock);
 285
 286         if (buf) {
 287                 int major, minor;
 288
 289                 major = tty->driver->major;
 290                 minor = tty->driver->minor_start + tty->index;
 291                 mutex_lock(&buf->mutex);
 292                 if (buf->major == major && buf->minor == minor)
 293                         tty_audit_buf_push_current(buf);
 294                 mutex_unlock(&buf->mutex);
 295                 tty_audit_buf_put(buf);
 296         }
 297 }
 298
 299 /**
 300  *      tty_audit_opening       -       A TTY is being opened.
 301  *
 302  *      As a special hack, tasks that close all their TTYs and open new ones
 303  *      are assumed to be system daemons (e.g. getty) and auditing is
 304  *      automatically disabled for them.
 305  */
 306 void tty_audit_opening(void)
 307 {
 308         int disable;
 309
 310         disable = 1;
 311         spin_lock_irq(&current->sighand->siglock);
 312         if (current->signal->audit_tty == 0)
 313                 disable = 0;
 314         spin_unlock_irq(&current->sighand->siglock);
 315         if (!disable)
 316                 return;
 317
 318         task_lock(current);
 319         if (current->files) {
 320                 struct fdtable *fdt;
 321                 unsigned i;
 322
 323                 /*
 324                  * We don't take a ref to the file, so we must hold ->file_lock
 325                  * instead.
 326                  */
 327                 spin_lock(&current->files->file_lock);
 328                 fdt = files_fdtable(current->files);
 329                 for (i = 0; i < fdt->max_fds; i++) {
 330                         struct file *filp;
 331
 332                         filp = fcheck_files(current->files, i);
 333                         if (filp && is_tty(filp)) {
 334                                 disable = 0;
 335                                 break;
 336                         }
 337                 }
 338                 spin_unlock(&current->files->file_lock);
 339         }
 340         task_unlock(current);
 341         if (!disable)
 342                 return;
 343
 344         spin_lock_irq(&current->sighand->siglock);
 345         current->signal->audit_tty = 0;
 346         spin_unlock_irq(&current->sighand->siglock);
 347 }