2 * Creating audit events from TTY input.
4 * Copyright (C) 2007 Red Hat, Inc. All rights reserved. This copyrighted
5 * material is made available to anyone wishing to use, modify, copy, or
6 * redistribute it subject to the terms and conditions of the GNU General
9 * Authors: Miloslav Trmac <mitr@redhat.com>
12 #include <linux/audit.h>
13 #include <linux/file.h>
14 #include <linux/tty.h>
16 struct tty_audit_buf
{
18 struct mutex mutex
; /* Protects all data below */
19 int major
, minor
; /* The TTY which the data is from */
22 unsigned char *data
; /* Allocated size N_TTY_BUF_SIZE */
25 static struct tty_audit_buf
*tty_audit_buf_alloc(int major
, int minor
,
28 struct tty_audit_buf
*buf
;
30 buf
= kmalloc(sizeof(*buf
), GFP_KERNEL
);
33 if (PAGE_SIZE
!= N_TTY_BUF_SIZE
)
34 buf
->data
= kmalloc(N_TTY_BUF_SIZE
, GFP_KERNEL
);
36 buf
->data
= (unsigned char *)__get_free_page(GFP_KERNEL
);
39 atomic_set(&buf
->count
, 1);
40 mutex_init(&buf
->mutex
);
53 static void tty_audit_buf_free(struct tty_audit_buf
*buf
)
55 WARN_ON(buf
->valid
!= 0);
56 if (PAGE_SIZE
!= N_TTY_BUF_SIZE
)
59 free_page((unsigned long)buf
->data
);
63 static void tty_audit_buf_put(struct tty_audit_buf
*buf
)
65 if (atomic_dec_and_test(&buf
->count
))
66 tty_audit_buf_free(buf
);
70 * tty_audit_buf_push - Push buffered data out
72 * Generate an audit message from the contents of @buf, which is owned by
73 * @tsk with @loginuid. @buf->mutex must be locked.
75 static void tty_audit_buf_push(struct task_struct
*tsk
, uid_t loginuid
,
76 unsigned int sessionid
,
77 struct tty_audit_buf
*buf
)
79 struct audit_buffer
*ab
;
83 if (audit_enabled
== 0)
85 ab
= audit_log_start(NULL
, GFP_KERNEL
, AUDIT_TTY
);
87 char name
[sizeof(tsk
->comm
)];
89 audit_log_format(ab
, "tty pid=%u uid=%u auid=%u ses=%u "
90 "major=%d minor=%d comm=", tsk
->pid
, tsk
->uid
,
91 loginuid
, sessionid
, buf
->major
, buf
->minor
);
92 get_task_comm(name
, tsk
);
93 audit_log_untrustedstring(ab
, name
);
94 audit_log_format(ab
, " data=");
95 audit_log_n_untrustedstring(ab
, buf
->data
, buf
->valid
);
102 * tty_audit_buf_push_current - Push buffered data out
104 * Generate an audit message from the contents of @buf, which is owned by
105 * the current task. @buf->mutex must be locked.
107 static void tty_audit_buf_push_current(struct tty_audit_buf
*buf
)
109 uid_t auid
= audit_get_loginuid(current
);
110 unsigned int sessionid
= audit_get_sessionid(current
);
111 tty_audit_buf_push(current
, auid
, sessionid
, buf
);
115 * tty_audit_exit - Handle a task exit
117 * Make sure all buffered data is written out and deallocate the buffer.
118 * Only needs to be called if current->signal->tty_audit_buf != %NULL.
120 void tty_audit_exit(void)
122 struct tty_audit_buf
*buf
;
124 spin_lock_irq(¤t
->sighand
->siglock
);
125 buf
= current
->signal
->tty_audit_buf
;
126 current
->signal
->tty_audit_buf
= NULL
;
127 spin_unlock_irq(¤t
->sighand
->siglock
);
131 mutex_lock(&buf
->mutex
);
132 tty_audit_buf_push_current(buf
);
133 mutex_unlock(&buf
->mutex
);
135 tty_audit_buf_put(buf
);
139 * tty_audit_fork - Copy TTY audit state for a new task
141 * Set up TTY audit state in @sig from current. @sig needs no locking.
143 void tty_audit_fork(struct signal_struct
*sig
)
145 spin_lock_irq(¤t
->sighand
->siglock
);
146 sig
->audit_tty
= current
->signal
->audit_tty
;
147 spin_unlock_irq(¤t
->sighand
->siglock
);
148 sig
->tty_audit_buf
= NULL
;
152 * tty_audit_push_task - Flush task's pending audit data
154 void tty_audit_push_task(struct task_struct
*tsk
, uid_t loginuid
, u32 sessionid
)
156 struct tty_audit_buf
*buf
;
158 spin_lock_irq(&tsk
->sighand
->siglock
);
159 buf
= tsk
->signal
->tty_audit_buf
;
161 atomic_inc(&buf
->count
);
162 spin_unlock_irq(&tsk
->sighand
->siglock
);
166 mutex_lock(&buf
->mutex
);
167 tty_audit_buf_push(tsk
, loginuid
, sessionid
, buf
);
168 mutex_unlock(&buf
->mutex
);
170 tty_audit_buf_put(buf
);
174 * tty_audit_buf_get - Get an audit buffer.
176 * Get an audit buffer for @tty, allocate it if necessary. Return %NULL
177 * if TTY auditing is disabled or out of memory. Otherwise, return a new
178 * reference to the buffer.
180 static struct tty_audit_buf
*tty_audit_buf_get(struct tty_struct
*tty
)
182 struct tty_audit_buf
*buf
, *buf2
;
186 spin_lock_irq(¤t
->sighand
->siglock
);
187 if (likely(!current
->signal
->audit_tty
))
189 buf
= current
->signal
->tty_audit_buf
;
191 atomic_inc(&buf
->count
);
194 spin_unlock_irq(¤t
->sighand
->siglock
);
196 buf2
= tty_audit_buf_alloc(tty
->driver
->major
,
197 tty
->driver
->minor_start
+ tty
->index
,
200 audit_log_lost("out of memory in TTY auditing");
204 spin_lock_irq(¤t
->sighand
->siglock
);
205 if (!current
->signal
->audit_tty
)
207 buf
= current
->signal
->tty_audit_buf
;
209 current
->signal
->tty_audit_buf
= buf2
;
213 atomic_inc(&buf
->count
);
216 spin_unlock_irq(¤t
->sighand
->siglock
);
218 tty_audit_buf_free(buf2
);
223 * tty_audit_add_data - Add data for TTY auditing.
225 * Audit @data of @size from @tty, if necessary.
227 void tty_audit_add_data(struct tty_struct
*tty
, unsigned char *data
,
230 struct tty_audit_buf
*buf
;
233 if (unlikely(size
== 0))
236 if (tty
->driver
->type
== TTY_DRIVER_TYPE_PTY
237 && tty
->driver
->subtype
== PTY_TYPE_MASTER
)
240 buf
= tty_audit_buf_get(tty
);
244 mutex_lock(&buf
->mutex
);
245 major
= tty
->driver
->major
;
246 minor
= tty
->driver
->minor_start
+ tty
->index
;
247 if (buf
->major
!= major
|| buf
->minor
!= minor
248 || buf
->icanon
!= tty
->icanon
) {
249 tty_audit_buf_push_current(buf
);
252 buf
->icanon
= tty
->icanon
;
257 run
= N_TTY_BUF_SIZE
- buf
->valid
;
260 memcpy(buf
->data
+ buf
->valid
, data
, run
);
264 if (buf
->valid
== N_TTY_BUF_SIZE
)
265 tty_audit_buf_push_current(buf
);
267 mutex_unlock(&buf
->mutex
);
268 tty_audit_buf_put(buf
);
272 * tty_audit_push - Push buffered data out
274 * Make sure no audit data is pending for @tty on the current process.
276 void tty_audit_push(struct tty_struct
*tty
)
278 struct tty_audit_buf
*buf
;
280 spin_lock_irq(¤t
->sighand
->siglock
);
281 if (likely(!current
->signal
->audit_tty
)) {
282 spin_unlock_irq(¤t
->sighand
->siglock
);
285 buf
= current
->signal
->tty_audit_buf
;
287 atomic_inc(&buf
->count
);
288 spin_unlock_irq(¤t
->sighand
->siglock
);
293 major
= tty
->driver
->major
;
294 minor
= tty
->driver
->minor_start
+ tty
->index
;
295 mutex_lock(&buf
->mutex
);
296 if (buf
->major
== major
&& buf
->minor
== minor
)
297 tty_audit_buf_push_current(buf
);
298 mutex_unlock(&buf
->mutex
);
299 tty_audit_buf_put(buf
);