Thomas Gleixner | b886d83c | 2019-06-01 10:08:55 +0200 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0-only |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 2 | /* |
| 3 | * AppArmor security module |
| 4 | * |
| 5 | * This file contains AppArmor auditing functions |
| 6 | * |
| 7 | * Copyright (C) 1998-2008 Novell/SUSE |
| 8 | * Copyright 2009-2010 Canonical Ltd. |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 9 | */ |
| 10 | |
| 11 | #include <linux/audit.h> |
| 12 | #include <linux/socket.h> |
| 13 | |
| 14 | #include "include/apparmor.h" |
| 15 | #include "include/audit.h" |
| 16 | #include "include/policy.h" |
John Johansen | cff281f | 2017-01-16 00:42:15 -0800 | [diff] [blame] | 17 | #include "include/policy_ns.h" |
Matthew Garrett | e79c26d | 2018-04-16 11:23:58 -0700 | [diff] [blame] | 18 | #include "include/secid.h" |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 19 | |
Jan Engelhardt | 2d4cee7 | 2012-03-14 13:30:36 +0100 | [diff] [blame] | 20 | const char *const audit_mode_names[] = { |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 21 | "normal", |
| 22 | "quiet_denied", |
| 23 | "quiet", |
| 24 | "noquiet", |
| 25 | "all" |
| 26 | }; |
| 27 | |
Jan Engelhardt | 2d4cee7 | 2012-03-14 13:30:36 +0100 | [diff] [blame] | 28 | static const char *const aa_audit_type[] = { |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 29 | "AUDIT", |
| 30 | "ALLOWED", |
| 31 | "DENIED", |
| 32 | "HINT", |
| 33 | "STATUS", |
| 34 | "ERROR", |
John Johansen | b492d50 | 2013-02-18 16:13:34 -0800 | [diff] [blame] | 35 | "KILLED", |
John Johansen | ade3ddc | 2012-02-22 00:20:26 -0800 | [diff] [blame] | 36 | "AUTO" |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 37 | }; |
| 38 | |
| 39 | /* |
| 40 | * Currently AppArmor auditing is fed straight into the audit framework. |
| 41 | * |
| 42 | * TODO: |
| 43 | * netlink interface for complain mode |
| 44 | * user auditing, - send user auditing to netlink interface |
| 45 | * system control of whether user audit messages go to system log |
| 46 | */ |
| 47 | |
| 48 | /** |
| 49 | * audit_base - core AppArmor function. |
| 50 | * @ab: audit buffer to fill (NOT NULL) |
| 51 | * @ca: audit structure containing data to audit (NOT NULL) |
| 52 | * |
| 53 | * Record common AppArmor audit data from @sa |
| 54 | */ |
| 55 | static void audit_pre(struct audit_buffer *ab, void *ca) |
| 56 | { |
| 57 | struct common_audit_data *sa = ca; |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 58 | |
| 59 | if (aa_g_audit_header) { |
Richard Guy Briggs | f1d9b23 | 2020-07-13 15:51:59 -0400 | [diff] [blame] | 60 | audit_log_format(ab, "apparmor=\"%s\"", |
| 61 | aa_audit_type[aad(sa)->type]); |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 62 | } |
| 63 | |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 64 | if (aad(sa)->op) { |
Richard Guy Briggs | f1d9b23 | 2020-07-13 15:51:59 -0400 | [diff] [blame] | 65 | audit_log_format(ab, " operation=\"%s\"", aad(sa)->op); |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 66 | } |
| 67 | |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 68 | if (aad(sa)->info) { |
Richard Guy Briggs | f1d9b23 | 2020-07-13 15:51:59 -0400 | [diff] [blame] | 69 | audit_log_format(ab, " info=\"%s\"", aad(sa)->info); |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 70 | if (aad(sa)->error) |
| 71 | audit_log_format(ab, " error=%d", aad(sa)->error); |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 72 | } |
| 73 | |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 74 | if (aad(sa)->label) { |
| 75 | struct aa_label *label = aad(sa)->label; |
| 76 | |
| 77 | if (label_isprofile(label)) { |
| 78 | struct aa_profile *profile = labels_profile(label); |
| 79 | |
| 80 | if (profile->ns != root_ns) { |
| 81 | audit_log_format(ab, " namespace="); |
| 82 | audit_log_untrustedstring(ab, |
| 83 | profile->ns->base.hname); |
| 84 | } |
| 85 | audit_log_format(ab, " profile="); |
| 86 | audit_log_untrustedstring(ab, profile->base.hname); |
| 87 | } else { |
| 88 | audit_log_format(ab, " label="); |
| 89 | aa_label_xaudit(ab, root_ns, label, FLAG_VIEW_SUBNS, |
| 90 | GFP_ATOMIC); |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 91 | } |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 92 | } |
| 93 | |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 94 | if (aad(sa)->name) { |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 95 | audit_log_format(ab, " name="); |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 96 | audit_log_untrustedstring(ab, aad(sa)->name); |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 97 | } |
| 98 | } |
| 99 | |
| 100 | /** |
| 101 | * aa_audit_msg - Log a message to the audit subsystem |
| 102 | * @sa: audit event structure (NOT NULL) |
| 103 | * @cb: optional callback fn for type specific fields (MAYBE NULL) |
| 104 | */ |
| 105 | void aa_audit_msg(int type, struct common_audit_data *sa, |
| 106 | void (*cb) (struct audit_buffer *, void *)) |
| 107 | { |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 108 | aad(sa)->type = type; |
Linus Torvalds | b61c37f | 2012-04-02 15:48:12 -0700 | [diff] [blame] | 109 | common_lsm_audit(sa, audit_pre, cb); |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 110 | } |
| 111 | |
| 112 | /** |
| 113 | * aa_audit - Log a profile based audit event to the audit subsystem |
| 114 | * @type: audit type for the message |
| 115 | * @profile: profile to check against (NOT NULL) |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 116 | * @sa: audit event (NOT NULL) |
| 117 | * @cb: optional callback fn for type specific fields (MAYBE NULL) |
| 118 | * |
| 119 | * Handle default message switching based off of audit mode flags |
| 120 | * |
| 121 | * Returns: error on failure |
| 122 | */ |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 123 | int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa, |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 124 | void (*cb) (struct audit_buffer *, void *)) |
| 125 | { |
John Johansen | e6bfa25 | 2017-01-16 00:43:15 -0800 | [diff] [blame] | 126 | AA_BUG(!profile); |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 127 | |
| 128 | if (type == AUDIT_APPARMOR_AUTO) { |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 129 | if (likely(!aad(sa)->error)) { |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 130 | if (AUDIT_MODE(profile) != AUDIT_ALL) |
| 131 | return 0; |
| 132 | type = AUDIT_APPARMOR_AUDIT; |
| 133 | } else if (COMPLAIN_MODE(profile)) |
| 134 | type = AUDIT_APPARMOR_ALLOWED; |
| 135 | else |
| 136 | type = AUDIT_APPARMOR_DENIED; |
| 137 | } |
| 138 | if (AUDIT_MODE(profile) == AUDIT_QUIET || |
| 139 | (type == AUDIT_APPARMOR_DENIED && |
| 140 | AUDIT_MODE(profile) == AUDIT_QUIET)) |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 141 | return aad(sa)->error; |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 142 | |
| 143 | if (KILL_MODE(profile) && type == AUDIT_APPARMOR_DENIED) |
| 144 | type = AUDIT_APPARMOR_KILL; |
| 145 | |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 146 | aad(sa)->label = &profile->label; |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 147 | |
| 148 | aa_audit_msg(type, sa, cb); |
| 149 | |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 150 | if (aad(sa)->type == AUDIT_APPARMOR_KILL) |
Eric Paris | 0972c74 | 2012-04-04 15:01:42 -0400 | [diff] [blame] | 151 | (void)send_sig_info(SIGKILL, NULL, |
John Johansen | b6b1b81 | 2014-06-08 11:20:54 -0700 | [diff] [blame] | 152 | sa->type == LSM_AUDIT_DATA_TASK && sa->u.tsk ? |
| 153 | sa->u.tsk : current); |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 154 | |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 155 | if (aad(sa)->type == AUDIT_APPARMOR_ALLOWED) |
| 156 | return complain_error(aad(sa)->error); |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 157 | |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 158 | return aad(sa)->error; |
John Johansen | 67012e8 | 2010-07-29 14:47:58 -0700 | [diff] [blame] | 159 | } |
Matthew Garrett | e79c26d | 2018-04-16 11:23:58 -0700 | [diff] [blame] | 160 | |
| 161 | struct aa_audit_rule { |
John Johansen | 2ab47da | 2018-05-03 00:39:58 -0700 | [diff] [blame] | 162 | struct aa_label *label; |
Matthew Garrett | e79c26d | 2018-04-16 11:23:58 -0700 | [diff] [blame] | 163 | }; |
| 164 | |
| 165 | void aa_audit_rule_free(void *vrule) |
| 166 | { |
| 167 | struct aa_audit_rule *rule = vrule; |
| 168 | |
| 169 | if (rule) { |
John Johansen | 2ab47da | 2018-05-03 00:39:58 -0700 | [diff] [blame] | 170 | if (!IS_ERR(rule->label)) |
| 171 | aa_put_label(rule->label); |
Matthew Garrett | e79c26d | 2018-04-16 11:23:58 -0700 | [diff] [blame] | 172 | kfree(rule); |
| 173 | } |
| 174 | } |
| 175 | |
| 176 | int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) |
| 177 | { |
| 178 | struct aa_audit_rule *rule; |
| 179 | |
| 180 | switch (field) { |
| 181 | case AUDIT_SUBJ_ROLE: |
| 182 | if (op != Audit_equal && op != Audit_not_equal) |
| 183 | return -EINVAL; |
| 184 | break; |
| 185 | default: |
| 186 | return -EINVAL; |
| 187 | } |
| 188 | |
| 189 | rule = kzalloc(sizeof(struct aa_audit_rule), GFP_KERNEL); |
| 190 | |
| 191 | if (!rule) |
| 192 | return -ENOMEM; |
| 193 | |
John Johansen | 2ab47da | 2018-05-03 00:39:58 -0700 | [diff] [blame] | 194 | /* Currently rules are treated as coming from the root ns */ |
| 195 | rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr, |
| 196 | GFP_KERNEL, true, false); |
Tyler Hicks | 52e8c38 | 2018-05-17 19:53:45 +0000 | [diff] [blame] | 197 | if (IS_ERR(rule->label)) { |
Navid Emamdoost | c54d481 | 2019-10-21 10:23:47 -0500 | [diff] [blame] | 198 | int err = PTR_ERR(rule->label); |
Tyler Hicks | 52e8c38 | 2018-05-17 19:53:45 +0000 | [diff] [blame] | 199 | aa_audit_rule_free(rule); |
Navid Emamdoost | c54d481 | 2019-10-21 10:23:47 -0500 | [diff] [blame] | 200 | return err; |
Tyler Hicks | 52e8c38 | 2018-05-17 19:53:45 +0000 | [diff] [blame] | 201 | } |
Matthew Garrett | e79c26d | 2018-04-16 11:23:58 -0700 | [diff] [blame] | 202 | |
Tyler Hicks | 52e8c38 | 2018-05-17 19:53:45 +0000 | [diff] [blame] | 203 | *vrule = rule; |
Matthew Garrett | e79c26d | 2018-04-16 11:23:58 -0700 | [diff] [blame] | 204 | return 0; |
| 205 | } |
| 206 | |
| 207 | int aa_audit_rule_known(struct audit_krule *rule) |
| 208 | { |
| 209 | int i; |
| 210 | |
| 211 | for (i = 0; i < rule->field_count; i++) { |
| 212 | struct audit_field *f = &rule->fields[i]; |
| 213 | |
| 214 | switch (f->type) { |
| 215 | case AUDIT_SUBJ_ROLE: |
| 216 | return 1; |
| 217 | } |
| 218 | } |
| 219 | |
| 220 | return 0; |
| 221 | } |
| 222 | |
Richard Guy Briggs | 90462a5 | 2019-01-31 11:52:11 -0500 | [diff] [blame] | 223 | int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule) |
Matthew Garrett | e79c26d | 2018-04-16 11:23:58 -0700 | [diff] [blame] | 224 | { |
| 225 | struct aa_audit_rule *rule = vrule; |
| 226 | struct aa_label *label; |
Matthew Garrett | e79c26d | 2018-04-16 11:23:58 -0700 | [diff] [blame] | 227 | int found = 0; |
| 228 | |
| 229 | label = aa_secid_to_label(sid); |
| 230 | |
| 231 | if (!label) |
| 232 | return -ENOENT; |
| 233 | |
John Johansen | 2ab47da | 2018-05-03 00:39:58 -0700 | [diff] [blame] | 234 | if (aa_label_is_subset(label, rule->label)) |
| 235 | found = 1; |
Matthew Garrett | e79c26d | 2018-04-16 11:23:58 -0700 | [diff] [blame] | 236 | |
| 237 | switch (field) { |
| 238 | case AUDIT_SUBJ_ROLE: |
| 239 | switch (op) { |
| 240 | case Audit_equal: |
| 241 | return found; |
| 242 | case Audit_not_equal: |
| 243 | return !found; |
| 244 | } |
| 245 | } |
| 246 | return 0; |
| 247 | } |