mirror of
https://github.com/cregit/cregit.git
synced 2026-10-19 04:18:24 +02:00
9207 lines
202 KiB
Plaintext
9207 lines
202 KiB
Plaintext
-:- begin_unit|revision:0.9.5;language:C;cregit-version:0.0.1
|
|
-:- begin_comment
|
|
1:1 comment|/* audit.c -- Auditing support * Gateway between the kernel (e.g., selinux) and the user-space audit daemon. * System-call specific features have moved to auditsc.c * * Copyright 2003-2007 Red Hat Inc., Durham, North Carolina. * All Rights Reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA * * Written by Rickard E. (Rik) Faith<faith@redhat.com> * * Goals: 1) Integrate fully with Security Modules. * 2) Minimal run-time overhead: * a) Minimal when syscall auditing is disabled (audit_enable=0). * b) Small when syscall auditing is enabled and no audit record * is generated (defer as much work as possible to record * generation time): * i) context is allocated, * ii) names from getname are stored without a copy, and * iii) inode information stored from path_lookup. * 3) Ability to disable syscall auditing at boot time (audit=0). * 4) Usable by other parts of the kernel (if audit_log* is called, * then a syscall record will be generated automatically for the * current syscall). * 5) Netlink interface to user-space. * 6) Support low-overhead kernel-based filtering to minimize the * information that must be passed to user-space. * * Example user-space utilities: http://people.redhat.com/sgrubb/audit/ */
|
|
-:- end_comment
|
|
-:- begin_define
|
|
44:1 define|#
|
|
44:2 directive|define
|
|
44:9 name|pr_fmt
|
|
44:15 parameter_list|(
|
|
44:16 name|fmt
|
|
44:19 parameter_list|)
|
|
44:21 value|KBUILD_MODNAME ": " fmt
|
|
-:- end_define
|
|
-:- begin_include
|
|
46:1 include|#
|
|
46:2 directive|include
|
|
46:10 file|<linux/file.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
47:1 include|#
|
|
47:2 directive|include
|
|
47:10 file|<linux/init.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
48:1 include|#
|
|
48:2 directive|include
|
|
48:10 file|<linux/types.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
49:1 include|#
|
|
49:2 directive|include
|
|
49:10 file|<linux/atomic.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
50:1 include|#
|
|
50:2 directive|include
|
|
50:10 file|<linux/mm.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
51:1 include|#
|
|
51:2 directive|include
|
|
51:10 file|<linux/export.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
52:1 include|#
|
|
52:2 directive|include
|
|
52:10 file|<linux/slab.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
53:1 include|#
|
|
53:2 directive|include
|
|
53:10 file|<linux/err.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
54:1 include|#
|
|
54:2 directive|include
|
|
54:10 file|<linux/kthread.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
55:1 include|#
|
|
55:2 directive|include
|
|
55:10 file|<linux/kernel.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
56:1 include|#
|
|
56:2 directive|include
|
|
56:10 file|<linux/syscalls.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
57:1 include|#
|
|
57:2 directive|include
|
|
57:10 file|<linux/spinlock.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
58:1 include|#
|
|
58:2 directive|include
|
|
58:10 file|<linux/rcupdate.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
59:1 include|#
|
|
59:2 directive|include
|
|
59:10 file|<linux/mutex.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
60:1 include|#
|
|
60:2 directive|include
|
|
60:10 file|<linux/gfp.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
62:1 include|#
|
|
62:2 directive|include
|
|
62:10 file|<linux/audit.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
64:1 include|#
|
|
64:2 directive|include
|
|
64:10 file|<net/sock.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
65:1 include|#
|
|
65:2 directive|include
|
|
65:10 file|<net/netlink.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
66:1 include|#
|
|
66:2 directive|include
|
|
66:10 file|<linux/skbuff.h>
|
|
-:- end_include
|
|
-:- begin_ifdef
|
|
67:1 ifdef|#
|
|
67:2 directive|ifdef
|
|
67:8 name|CONFIG_SECURITY
|
|
-:- end_ifdef
|
|
-:- begin_include
|
|
68:1 include|#
|
|
68:2 directive|include
|
|
68:10 file|<linux/security.h>
|
|
-:- end_include
|
|
-:- begin_endif
|
|
69:1 endif|#
|
|
69:2 directive|endif
|
|
-:- end_endif
|
|
-:- begin_include
|
|
70:1 include|#
|
|
70:2 directive|include
|
|
70:10 file|<linux/freezer.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
71:1 include|#
|
|
71:2 directive|include
|
|
71:10 file|<linux/pid_namespace.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
72:1 include|#
|
|
72:2 directive|include
|
|
72:10 file|<net/netns/generic.h>
|
|
-:- end_include
|
|
-:- begin_include
|
|
74:1 include|#
|
|
74:2 directive|include
|
|
74:10 file|"audit.h"
|
|
-:- end_include
|
|
-:- begin_comment
|
|
76:1 comment|/* No auditing will take place until audit_initialized == AUDIT_INITIALIZED. * (Initialization happens after skb_init is called.) */
|
|
-:- end_comment
|
|
-:- begin_define
|
|
78:1 define|#
|
|
78:2 directive|define
|
|
78:9 name|AUDIT_DISABLED
|
|
78:25 value|-1
|
|
-:- end_define
|
|
-:- begin_define
|
|
79:1 define|#
|
|
79:2 directive|define
|
|
79:9 name|AUDIT_UNINITIALIZED
|
|
79:29 value|0
|
|
-:- end_define
|
|
-:- begin_define
|
|
80:1 define|#
|
|
80:2 directive|define
|
|
80:9 name|AUDIT_INITIALIZED
|
|
80:27 value|1
|
|
-:- end_define
|
|
-:- begin_decl_stmt
|
|
81:1 specifier|static
|
|
81:8 name|int
|
|
81:12 name|audit_initialized
|
|
81:29 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_define
|
|
83:1 define|#
|
|
83:2 directive|define
|
|
83:9 name|AUDIT_OFF
|
|
83:19 value|0
|
|
-:- end_define
|
|
-:- begin_define
|
|
84:1 define|#
|
|
84:2 directive|define
|
|
84:9 name|AUDIT_ON
|
|
84:18 value|1
|
|
-:- end_define
|
|
-:- begin_define
|
|
85:1 define|#
|
|
85:2 directive|define
|
|
85:9 name|AUDIT_LOCKED
|
|
85:22 value|2
|
|
-:- end_define
|
|
-:- begin_decl_stmt
|
|
86:1 name|u32
|
|
86:6 name|audit_enabled
|
|
86:19 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_decl_stmt
|
|
87:1 name|u32
|
|
87:6 name|audit_ever_enabled
|
|
87:24 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_expr_stmt
|
|
89:1 name|EXPORT_SYMBOL_GPL
|
|
89:18 argument_list|(
|
|
89:19 name|audit_enabled
|
|
89:32 argument_list|)
|
|
89:33 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_comment
|
|
91:1 comment|/* Default state when kernel boots without any parameters. */
|
|
-:- end_comment
|
|
-:- begin_decl_stmt
|
|
92:1 specifier|static
|
|
92:8 name|u32
|
|
92:12 name|audit_default
|
|
92:25 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_comment
|
|
94:1 comment|/* If auditing cannot proceed, audit_failure selects what happens. */
|
|
-:- end_comment
|
|
-:- begin_decl_stmt
|
|
95:1 specifier|static
|
|
95:8 name|u32
|
|
95:12 name|audit_failure
|
|
95:26 init|=
|
|
95:28 name|AUDIT_FAIL_PRINTK
|
|
95:45 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_comment
|
|
97:1 comment|/* private audit network namespace index */
|
|
-:- end_comment
|
|
-:- begin_decl_stmt
|
|
98:1 specifier|static
|
|
98:8 name|unsigned
|
|
98:17 name|int
|
|
98:21 name|audit_net_id
|
|
98:33 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_comment
|
|
100:1 comment|/** * struct audit_net - audit private network namespace data * @sk: communication socket */
|
|
-:- end_comment
|
|
-:- begin_struct
|
|
104:1 struct|struct
|
|
104:8 name|audit_net
|
|
104:18 block|{
|
|
105:2 name|struct
|
|
105:9 name|sock
|
|
105:14 modifier|*
|
|
105:15 name|sk
|
|
105:17 decl_stmt|;
|
|
106:1 block|}
|
|
106:2 struct|;
|
|
-:- end_struct
|
|
-:- begin_comment
|
|
108:1 comment|/** * struct auditd_connection - kernel/auditd connection state * @pid: auditd PID * @portid: netlink portid * @net: the associated network namespace * @lock: spinlock to protect write access * * Description: * This struct is RCU protected; you must either hold the RCU lock for reading * or the included spinlock for writing. */
|
|
-:- end_comment
|
|
-:- begin_struct
|
|
119:1 specifier|static
|
|
119:8 struct|struct
|
|
119:15 name|auditd_connection
|
|
119:33 block|{
|
|
120:2 name|int
|
|
120:6 name|pid
|
|
120:9 decl_stmt|;
|
|
121:2 name|u32
|
|
121:6 name|portid
|
|
121:12 decl_stmt|;
|
|
122:2 name|struct
|
|
122:9 name|net
|
|
122:13 modifier|*
|
|
122:14 name|net
|
|
122:17 decl_stmt|;
|
|
123:2 name|spinlock_t
|
|
123:13 name|lock
|
|
123:17 decl_stmt|;
|
|
124:1 block|}
|
|
124:3 name|auditd_conn
|
|
124:14 struct|;
|
|
-:- end_struct
|
|
-:- begin_comment
|
|
126:1 comment|/* If audit_rate_limit is non-zero, limit the rate of sending audit records * to that number per second. This prevents DoS attacks, but results in * audit records being dropped. */
|
|
-:- end_comment
|
|
-:- begin_decl_stmt
|
|
129:1 specifier|static
|
|
129:8 name|u32
|
|
129:12 name|audit_rate_limit
|
|
129:28 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_comment
|
|
131:1 comment|/* Number of outstanding audit_buffers allowed. * When set to zero, this means unlimited. */
|
|
-:- end_comment
|
|
-:- begin_decl_stmt
|
|
133:1 specifier|static
|
|
133:8 name|u32
|
|
133:12 name|audit_backlog_limit
|
|
133:32 init|=
|
|
133:34 literal|64
|
|
133:36 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_define
|
|
134:1 define|#
|
|
134:2 directive|define
|
|
134:9 name|AUDIT_BACKLOG_WAIT_TIME
|
|
134:33 value|(60 * HZ)
|
|
-:- end_define
|
|
-:- begin_decl_stmt
|
|
135:1 specifier|static
|
|
135:8 name|u32
|
|
135:12 name|audit_backlog_wait_time
|
|
135:36 init|=
|
|
135:38 name|AUDIT_BACKLOG_WAIT_TIME
|
|
135:61 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_comment
|
|
137:1 comment|/* The identity of the user shutting down the audit system. */
|
|
-:- end_comment
|
|
-:- begin_decl_stmt
|
|
138:1 name|kuid_t
|
|
138:9 name|audit_sig_uid
|
|
138:23 init|=
|
|
138:25 name|INVALID_UID
|
|
138:36 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_decl_stmt
|
|
139:1 name|pid_t
|
|
139:8 name|audit_sig_pid
|
|
139:22 init|=
|
|
139:24 operator|-
|
|
139:25 literal|1
|
|
139:26 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_decl_stmt
|
|
140:1 name|u32
|
|
140:6 name|audit_sig_sid
|
|
140:20 init|=
|
|
140:22 literal|0
|
|
140:23 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_comment
|
|
142:1 comment|/* Records can be lost in several ways: 0) [suppressed in audit_alloc] 1) out of memory in audit_log_start [kmalloc of struct audit_buffer] 2) out of memory in audit_log_move [alloc_skb] 3) suppressed due to audit_rate_limit 4) suppressed due to audit_backlog_limit */
|
|
-:- end_comment
|
|
-:- begin_decl_stmt
|
|
149:1 specifier|static
|
|
149:8 name|atomic_t
|
|
149:17 name|audit_lost
|
|
149:28 init|=
|
|
149:30 name|ATOMIC_INIT
|
|
149:41 argument_list|(
|
|
149:42 literal|0
|
|
149:43 argument_list|)
|
|
149:44 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_comment
|
|
151:1 comment|/* Hash for inode-based rules */
|
|
-:- end_comment
|
|
-:- begin_decl_stmt
|
|
152:1 name|struct
|
|
152:8 name|list_head
|
|
152:18 name|audit_inode_hash
|
|
152:34 index|[
|
|
152:35 name|AUDIT_INODE_BUCKETS
|
|
152:54 index|]
|
|
152:55 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_comment
|
|
154:1 comment|/* The audit_freelist is a list of pre-allocated audit buffers (if more * than AUDIT_MAXFREE are in use, the audit buffer is freed instead of * being placed on the freelist). */
|
|
-:- end_comment
|
|
-:- begin_expr_stmt
|
|
157:1 specifier|static
|
|
157:8 name|DEFINE_SPINLOCK
|
|
157:23 argument_list|(
|
|
157:24 name|audit_freelist_lock
|
|
157:43 argument_list|)
|
|
157:44 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_decl_stmt
|
|
158:1 specifier|static
|
|
158:8 name|int
|
|
158:15 name|audit_freelist_count
|
|
158:35 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_expr_stmt
|
|
159:1 specifier|static
|
|
159:8 name|LIST_HEAD
|
|
159:17 argument_list|(
|
|
159:18 name|audit_freelist
|
|
159:32 argument_list|)
|
|
159:33 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_comment
|
|
161:1 comment|/* queue msgs to send via kauditd_task */
|
|
-:- end_comment
|
|
-:- begin_decl_stmt
|
|
162:1 specifier|static
|
|
162:8 name|struct
|
|
162:15 name|sk_buff_head
|
|
162:28 name|audit_queue
|
|
162:39 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_comment
|
|
163:1 comment|/* queue msgs due to temporary unicast send problems */
|
|
-:- end_comment
|
|
-:- begin_decl_stmt
|
|
164:1 specifier|static
|
|
164:8 name|struct
|
|
164:15 name|sk_buff_head
|
|
164:28 name|audit_retry_queue
|
|
164:45 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_comment
|
|
165:1 comment|/* queue msgs waiting for new auditd connection */
|
|
-:- end_comment
|
|
-:- begin_decl_stmt
|
|
166:1 specifier|static
|
|
166:8 name|struct
|
|
166:15 name|sk_buff_head
|
|
166:28 name|audit_hold_queue
|
|
166:44 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_comment
|
|
168:1 comment|/* queue servicing thread */
|
|
-:- end_comment
|
|
-:- begin_decl_stmt
|
|
169:1 specifier|static
|
|
169:8 name|struct
|
|
169:15 name|task_struct
|
|
169:27 modifier|*
|
|
169:28 name|kauditd_task
|
|
169:40 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_expr_stmt
|
|
170:1 specifier|static
|
|
170:8 name|DECLARE_WAIT_QUEUE_HEAD
|
|
170:31 argument_list|(
|
|
170:32 name|kauditd_wait
|
|
170:44 argument_list|)
|
|
170:45 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_comment
|
|
172:1 comment|/* waitqueue for callers who are blocked on the audit backlog */
|
|
-:- end_comment
|
|
-:- begin_expr_stmt
|
|
173:1 specifier|static
|
|
173:8 name|DECLARE_WAIT_QUEUE_HEAD
|
|
173:31 argument_list|(
|
|
173:32 name|audit_backlog_wait
|
|
173:50 argument_list|)
|
|
173:51 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_decl_stmt
|
|
175:1 specifier|static
|
|
175:8 name|struct
|
|
175:15 name|audit_features
|
|
175:30 name|af
|
|
175:33 init|=
|
|
175:35 block|{
|
|
175:36 operator|.
|
|
175:37 name|vers
|
|
175:42 operator|=
|
|
175:44 name|AUDIT_FEATURE_VERSION
|
|
175:65 block|,
|
|
176:8 operator|.
|
|
176:9 name|mask
|
|
176:14 operator|=
|
|
176:16 operator|-
|
|
176:17 literal|1
|
|
176:18 block|,
|
|
177:8 operator|.
|
|
177:9 name|features
|
|
177:18 operator|=
|
|
177:20 literal|0
|
|
177:21 block|,
|
|
178:8 operator|.
|
|
178:9 name|lock
|
|
178:14 operator|=
|
|
178:16 literal|0
|
|
178:17 block|,}
|
|
178:19 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_decl_stmt
|
|
180:1 specifier|static
|
|
180:8 name|char
|
|
180:13 modifier|*
|
|
180:14 name|audit_feature_names
|
|
180:33 index|[
|
|
180:34 literal|2
|
|
180:35 index|]
|
|
180:37 init|=
|
|
180:39 block|{
|
|
181:2 literal|"only_unset_loginuid"
|
|
181:23 block|,
|
|
182:2 literal|"loginuid_immutable"
|
|
182:22 block|, }
|
|
183:2 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_comment
|
|
186:1 comment|/* Serialize requests from userspace. */
|
|
-:- end_comment
|
|
-:- begin_expr_stmt
|
|
187:1 name|DEFINE_MUTEX
|
|
187:13 argument_list|(
|
|
187:14 name|audit_cmd_mutex
|
|
187:29 argument_list|)
|
|
187:30 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_comment
|
|
189:1 comment|/* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting * audit records. Since printk uses a 1024 byte buffer, this buffer * should be at least that large. */
|
|
-:- end_comment
|
|
-:- begin_define
|
|
192:1 define|#
|
|
192:2 directive|define
|
|
192:9 name|AUDIT_BUFSIZ
|
|
192:22 value|1024
|
|
-:- end_define
|
|
-:- begin_comment
|
|
194:1 comment|/* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the * audit_freelist. Doing so eliminates many kmalloc/kfree calls. */
|
|
-:- end_comment
|
|
-:- begin_define
|
|
196:1 define|#
|
|
196:2 directive|define
|
|
196:9 name|AUDIT_MAXFREE
|
|
196:24 value|(2*NR_CPUS)
|
|
-:- end_define
|
|
-:- begin_comment
|
|
198:1 comment|/* The audit_buffer is used when formatting an audit record. The caller * locks briefly to get the record off the freelist or to allocate the * buffer, and locks briefly to send the buffer to the netlink layer or * to place it on a transmit queue. Multiple audit_buffers can be in * use simultaneously. */
|
|
-:- end_comment
|
|
-:- begin_struct
|
|
203:1 struct|struct
|
|
203:8 name|audit_buffer
|
|
203:21 block|{
|
|
204:2 name|struct
|
|
204:9 name|list_head
|
|
204:23 name|list
|
|
204:27 decl_stmt|;
|
|
205:2 name|struct
|
|
205:9 name|sk_buff
|
|
205:23 modifier|*
|
|
205:24 name|skb
|
|
205:27 decl_stmt|;
|
|
205:29 comment|/* formatted skb ready to send */
|
|
206:2 name|struct
|
|
206:9 name|audit_context
|
|
206:23 modifier|*
|
|
206:24 name|ctx
|
|
206:27 decl_stmt|;
|
|
206:29 comment|/* NULL or associated context */
|
|
207:2 name|gfp_t
|
|
207:14 name|gfp_mask
|
|
207:22 decl_stmt|;
|
|
208:1 block|}
|
|
208:2 struct|;
|
|
-:- end_struct
|
|
-:- begin_struct
|
|
210:1 struct|struct
|
|
210:8 name|audit_reply
|
|
210:20 block|{
|
|
211:2 name|__u32
|
|
211:8 name|portid
|
|
211:14 decl_stmt|;
|
|
212:2 name|struct
|
|
212:9 name|net
|
|
212:13 modifier|*
|
|
212:14 name|net
|
|
212:17 decl_stmt|;
|
|
213:2 name|struct
|
|
213:9 name|sk_buff
|
|
213:17 modifier|*
|
|
213:18 name|skb
|
|
213:21 decl_stmt|;
|
|
214:1 block|}
|
|
214:2 struct|;
|
|
-:- end_struct
|
|
-:- begin_comment
|
|
216:1 comment|/** * auditd_test_task - Check to see if a given task is an audit daemon * @task: the task to check * * Description: * Return 1 if the task is a registered audit daemon, 0 otherwise. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
223:1 name|int
|
|
223:5 name|auditd_test_task
|
|
223:21 parameter_list|(
|
|
223:22 specifier|const
|
|
223:28 name|struct
|
|
223:35 name|task_struct
|
|
223:47 modifier|*
|
|
223:48 name|task
|
|
223:52 parameter_list|)
|
|
224:1 block|{
|
|
225:2 name|int
|
|
225:6 name|rc
|
|
225:8 decl_stmt|;
|
|
227:2 name|rcu_read_lock
|
|
227:15 argument_list|()
|
|
227:17 expr_stmt|;
|
|
228:2 name|rc
|
|
228:5 operator|=
|
|
228:7 operator|(
|
|
228:8 name|auditd_conn
|
|
228:19 operator|.
|
|
228:20 name|pid
|
|
228:24 operator|&&
|
|
228:27 name|task
|
|
228:31 operator|->
|
|
228:33 name|tgid
|
|
228:38 operator|==
|
|
228:41 name|auditd_conn
|
|
228:52 operator|.
|
|
228:53 name|pid
|
|
228:57 condition|?
|
|
228:59 literal|1
|
|
228:61 else|:
|
|
228:63 literal|0
|
|
228:64 operator|)
|
|
228:65 expr_stmt|;
|
|
229:2 name|rcu_read_unlock
|
|
229:17 argument_list|()
|
|
229:19 expr_stmt|;
|
|
231:2 return|return
|
|
231:9 name|rc
|
|
231:11 return|;
|
|
232:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
234:1 comment|/** * audit_get_sk - Return the audit socket for the given network namespace * @net: the destination network namespace * * Description: * Returns the sock pointer if valid, NULL otherwise. The caller must ensure * that a reference is held for the network namespace while the sock is in use. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
242:1 specifier|static
|
|
242:8 name|struct
|
|
242:15 name|sock
|
|
242:20 modifier|*
|
|
242:21 name|audit_get_sk
|
|
242:33 parameter_list|(
|
|
242:34 specifier|const
|
|
242:40 name|struct
|
|
242:47 name|net
|
|
242:51 modifier|*
|
|
242:52 name|net
|
|
242:55 parameter_list|)
|
|
243:1 block|{
|
|
244:2 name|struct
|
|
244:9 name|audit_net
|
|
244:19 modifier|*
|
|
244:20 name|aunet
|
|
244:25 decl_stmt|;
|
|
246:2 if|if
|
|
246:5 condition|(
|
|
246:6 operator|!
|
|
246:7 name|net
|
|
246:10 condition|)
|
|
247:3 return|return
|
|
247:10 name|NULL
|
|
247:14 return|;
|
|
249:2 name|aunet
|
|
249:8 operator|=
|
|
249:10 name|net_generic
|
|
249:21 argument_list|(
|
|
249:22 name|net
|
|
249:25 argument_list|,
|
|
249:27 name|audit_net_id
|
|
249:39 argument_list|)
|
|
249:40 expr_stmt|;
|
|
250:2 return|return
|
|
250:9 name|aunet
|
|
250:14 operator|->
|
|
250:16 name|sk
|
|
250:18 return|;
|
|
251:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
253:1 specifier|static
|
|
253:8 name|void
|
|
253:13 name|audit_set_portid
|
|
253:29 parameter_list|(
|
|
253:30 name|struct
|
|
253:37 name|audit_buffer
|
|
253:50 modifier|*
|
|
253:51 name|ab
|
|
253:53 parameter_list|,
|
|
253:55 name|__u32
|
|
253:61 name|portid
|
|
253:67 parameter_list|)
|
|
254:1 block|{
|
|
255:2 if|if
|
|
255:5 condition|(
|
|
255:6 name|ab
|
|
255:8 condition|)
|
|
255:10 block|{
|
|
256:3 name|struct
|
|
256:10 name|nlmsghdr
|
|
256:19 modifier|*
|
|
256:20 name|nlh
|
|
256:24 init|=
|
|
256:26 name|nlmsg_hdr
|
|
256:35 argument_list|(
|
|
256:36 name|ab
|
|
256:38 operator|->
|
|
256:40 name|skb
|
|
256:43 argument_list|)
|
|
256:44 decl_stmt|;
|
|
257:3 name|nlh
|
|
257:6 operator|->
|
|
257:8 name|nlmsg_pid
|
|
257:18 operator|=
|
|
257:20 name|portid
|
|
257:26 expr_stmt|;
|
|
258:2 block|}
|
|
259:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
261:1 name|void
|
|
261:6 name|audit_panic
|
|
261:17 parameter_list|(
|
|
261:18 specifier|const
|
|
261:24 name|char
|
|
261:29 modifier|*
|
|
261:30 name|message
|
|
261:37 parameter_list|)
|
|
262:1 block|{
|
|
263:2 switch|switch
|
|
263:9 condition|(
|
|
263:10 name|audit_failure
|
|
263:23 condition|)
|
|
263:25 block|{
|
|
264:2 case|case
|
|
264:7 name|AUDIT_FAIL_SILENT
|
|
264:24 case|:
|
|
265:3 break|break;
|
|
266:2 case|case
|
|
266:7 name|AUDIT_FAIL_PRINTK
|
|
266:24 case|:
|
|
267:3 if|if
|
|
267:6 condition|(
|
|
267:7 name|printk_ratelimit
|
|
267:23 argument_list|()
|
|
267:25 condition|)
|
|
268:4 name|pr_err
|
|
268:10 argument_list|(
|
|
268:11 literal|"%s\n"
|
|
268:17 argument_list|,
|
|
268:19 name|message
|
|
268:26 argument_list|)
|
|
268:27 expr_stmt|;
|
|
269:3 break|break;
|
|
270:2 case|case
|
|
270:7 name|AUDIT_FAIL_PANIC
|
|
270:23 case|:
|
|
271:3 name|panic
|
|
271:8 argument_list|(
|
|
271:9 literal|"audit: %s\n"
|
|
271:22 argument_list|,
|
|
271:24 name|message
|
|
271:31 argument_list|)
|
|
271:32 expr_stmt|;
|
|
272:3 break|break;
|
|
273:2 block|}
|
|
274:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
276:1 specifier|static
|
|
276:8 specifier|inline
|
|
276:15 name|int
|
|
276:19 name|audit_rate_check
|
|
276:35 parameter_list|(
|
|
276:36 name|void
|
|
276:40 parameter_list|)
|
|
277:1 block|{
|
|
278:2 specifier|static
|
|
278:9 name|unsigned
|
|
278:18 name|long
|
|
278:23 name|last_check
|
|
278:34 init|=
|
|
278:36 literal|0
|
|
278:37 decl_stmt|;
|
|
279:2 specifier|static
|
|
279:9 name|int
|
|
279:14 name|messages
|
|
279:25 init|=
|
|
279:27 literal|0
|
|
279:28 decl_stmt|;
|
|
280:2 specifier|static
|
|
280:9 name|DEFINE_SPINLOCK
|
|
280:24 argument_list|(
|
|
280:25 name|lock
|
|
280:29 argument_list|)
|
|
280:30 expr_stmt|;
|
|
281:2 name|unsigned
|
|
281:11 name|long
|
|
281:17 name|flags
|
|
281:22 decl_stmt|;
|
|
282:2 name|unsigned
|
|
282:11 name|long
|
|
282:17 name|now
|
|
282:20 decl_stmt|;
|
|
283:2 name|unsigned
|
|
283:11 name|long
|
|
283:17 name|elapsed
|
|
283:24 decl_stmt|;
|
|
284:2 name|int
|
|
284:8 name|retval
|
|
284:18 init|=
|
|
284:20 literal|0
|
|
284:21 decl_stmt|;
|
|
286:2 if|if
|
|
286:5 condition|(
|
|
286:6 operator|!
|
|
286:7 name|audit_rate_limit
|
|
286:23 condition|)
|
|
286:25 return|return
|
|
286:32 literal|1
|
|
286:33 return|;
|
|
288:2 name|spin_lock_irqsave
|
|
288:19 argument_list|(
|
|
288:20 operator|&
|
|
288:21 name|lock
|
|
288:25 argument_list|,
|
|
288:27 name|flags
|
|
288:32 argument_list|)
|
|
288:33 expr_stmt|;
|
|
289:2 if|if
|
|
289:5 condition|(
|
|
289:6 operator|++
|
|
289:8 name|messages
|
|
289:17 operator|<
|
|
289:19 name|audit_rate_limit
|
|
289:35 condition|)
|
|
289:37 block|{
|
|
290:3 name|retval
|
|
290:10 operator|=
|
|
290:12 literal|1
|
|
290:13 expr_stmt|;
|
|
291:2 block|}
|
|
291:4 else|else
|
|
291:9 block|{
|
|
292:3 name|now
|
|
292:11 operator|=
|
|
292:13 name|jiffies
|
|
292:20 expr_stmt|;
|
|
293:3 name|elapsed
|
|
293:11 operator|=
|
|
293:13 name|now
|
|
293:17 operator|-
|
|
293:19 name|last_check
|
|
293:29 expr_stmt|;
|
|
294:3 if|if
|
|
294:6 condition|(
|
|
294:7 name|elapsed
|
|
294:15 operator|>
|
|
294:17 name|HZ
|
|
294:19 condition|)
|
|
294:21 block|{
|
|
295:4 name|last_check
|
|
295:15 operator|=
|
|
295:17 name|now
|
|
295:20 expr_stmt|;
|
|
296:4 name|messages
|
|
296:15 operator|=
|
|
296:17 literal|0
|
|
296:18 expr_stmt|;
|
|
297:4 name|retval
|
|
297:15 operator|=
|
|
297:17 literal|1
|
|
297:18 expr_stmt|;
|
|
298:3 block|}
|
|
299:2 block|}
|
|
300:2 name|spin_unlock_irqrestore
|
|
300:24 argument_list|(
|
|
300:25 operator|&
|
|
300:26 name|lock
|
|
300:30 argument_list|,
|
|
300:32 name|flags
|
|
300:37 argument_list|)
|
|
300:38 expr_stmt|;
|
|
302:2 return|return
|
|
302:9 name|retval
|
|
302:15 return|;
|
|
303:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
305:1 comment|/** * audit_log_lost - conditionally log lost audit message event * @message: the message stating reason for lost audit message * * Emit at least 1 message per second, even if audit_rate_check is * throttling. * Always increment the lost messages counter. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
313:1 name|void
|
|
313:6 name|audit_log_lost
|
|
313:20 parameter_list|(
|
|
313:21 specifier|const
|
|
313:27 name|char
|
|
313:32 modifier|*
|
|
313:33 name|message
|
|
313:40 parameter_list|)
|
|
314:1 block|{
|
|
315:2 specifier|static
|
|
315:9 name|unsigned
|
|
315:18 name|long
|
|
315:23 name|last_msg
|
|
315:32 init|=
|
|
315:34 literal|0
|
|
315:35 decl_stmt|;
|
|
316:2 specifier|static
|
|
316:9 name|DEFINE_SPINLOCK
|
|
316:24 argument_list|(
|
|
316:25 name|lock
|
|
316:29 argument_list|)
|
|
316:30 expr_stmt|;
|
|
317:2 name|unsigned
|
|
317:11 name|long
|
|
317:17 name|flags
|
|
317:22 decl_stmt|;
|
|
318:2 name|unsigned
|
|
318:11 name|long
|
|
318:17 name|now
|
|
318:20 decl_stmt|;
|
|
319:2 name|int
|
|
319:8 name|print
|
|
319:13 decl_stmt|;
|
|
321:2 name|atomic_inc
|
|
321:12 argument_list|(
|
|
321:13 operator|&
|
|
321:14 name|audit_lost
|
|
321:24 argument_list|)
|
|
321:25 expr_stmt|;
|
|
323:2 name|print
|
|
323:8 operator|=
|
|
323:10 operator|(
|
|
323:11 name|audit_failure
|
|
323:25 operator|==
|
|
323:28 name|AUDIT_FAIL_PANIC
|
|
323:45 operator|||
|
|
323:48 operator|!
|
|
323:49 name|audit_rate_limit
|
|
323:65 operator|)
|
|
323:66 expr_stmt|;
|
|
325:2 if|if
|
|
325:5 condition|(
|
|
325:6 operator|!
|
|
325:7 name|print
|
|
325:12 condition|)
|
|
325:14 block|{
|
|
326:3 name|spin_lock_irqsave
|
|
326:20 argument_list|(
|
|
326:21 operator|&
|
|
326:22 name|lock
|
|
326:26 argument_list|,
|
|
326:28 name|flags
|
|
326:33 argument_list|)
|
|
326:34 expr_stmt|;
|
|
327:3 name|now
|
|
327:7 operator|=
|
|
327:9 name|jiffies
|
|
327:16 expr_stmt|;
|
|
328:3 if|if
|
|
328:6 condition|(
|
|
328:7 name|now
|
|
328:11 operator|-
|
|
328:13 name|last_msg
|
|
328:22 operator|>
|
|
328:24 name|HZ
|
|
328:26 condition|)
|
|
328:28 block|{
|
|
329:4 name|print
|
|
329:10 operator|=
|
|
329:12 literal|1
|
|
329:13 expr_stmt|;
|
|
330:4 name|last_msg
|
|
330:13 operator|=
|
|
330:15 name|now
|
|
330:18 expr_stmt|;
|
|
331:3 block|}
|
|
332:3 name|spin_unlock_irqrestore
|
|
332:25 argument_list|(
|
|
332:26 operator|&
|
|
332:27 name|lock
|
|
332:31 argument_list|,
|
|
332:33 name|flags
|
|
332:38 argument_list|)
|
|
332:39 expr_stmt|;
|
|
333:2 block|}
|
|
335:2 if|if
|
|
335:5 condition|(
|
|
335:6 name|print
|
|
335:11 condition|)
|
|
335:13 block|{
|
|
336:3 if|if
|
|
336:6 condition|(
|
|
336:7 name|printk_ratelimit
|
|
336:23 argument_list|()
|
|
336:25 condition|)
|
|
337:4 name|pr_warn
|
|
337:11 argument_list|(
|
|
337:12 literal|"audit_lost=%u audit_rate_limit=%u audit_backlog_limit=%u\n"
|
|
337:72 argument_list|,
|
|
338:5 name|atomic_read
|
|
338:16 argument_list|(
|
|
338:17 operator|&
|
|
338:18 name|audit_lost
|
|
338:28 argument_list|)
|
|
338:29 argument_list|,
|
|
339:5 name|audit_rate_limit
|
|
339:21 argument_list|,
|
|
340:5 name|audit_backlog_limit
|
|
340:24 argument_list|)
|
|
340:25 expr_stmt|;
|
|
341:3 name|audit_panic
|
|
341:14 argument_list|(
|
|
341:15 name|message
|
|
341:22 argument_list|)
|
|
341:23 expr_stmt|;
|
|
342:2 block|}
|
|
343:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
345:1 specifier|static
|
|
345:8 name|int
|
|
345:12 name|audit_log_config_change
|
|
345:35 parameter_list|(
|
|
345:36 name|char
|
|
345:41 modifier|*
|
|
345:42 name|function_name
|
|
345:55 parameter_list|,
|
|
345:57 name|u32
|
|
345:61 name|new
|
|
345:64 parameter_list|,
|
|
345:66 name|u32
|
|
345:70 name|old
|
|
345:73 parameter_list|,
|
|
346:8 name|int
|
|
346:12 name|allow_changes
|
|
346:25 parameter_list|)
|
|
347:1 block|{
|
|
348:2 name|struct
|
|
348:9 name|audit_buffer
|
|
348:22 modifier|*
|
|
348:23 name|ab
|
|
348:25 decl_stmt|;
|
|
349:2 name|int
|
|
349:6 name|rc
|
|
349:9 init|=
|
|
349:11 literal|0
|
|
349:12 decl_stmt|;
|
|
351:2 name|ab
|
|
351:5 operator|=
|
|
351:7 name|audit_log_start
|
|
351:22 argument_list|(
|
|
351:23 name|NULL
|
|
351:27 argument_list|,
|
|
351:29 name|GFP_KERNEL
|
|
351:39 argument_list|,
|
|
351:41 name|AUDIT_CONFIG_CHANGE
|
|
351:60 argument_list|)
|
|
351:61 expr_stmt|;
|
|
352:2 if|if
|
|
352:5 condition|(
|
|
352:6 name|unlikely
|
|
352:14 argument_list|(
|
|
352:15 operator|!
|
|
352:16 name|ab
|
|
352:18 argument_list|)
|
|
352:19 condition|)
|
|
353:3 return|return
|
|
353:10 name|rc
|
|
353:12 return|;
|
|
354:2 name|audit_log_format
|
|
354:18 argument_list|(
|
|
354:19 name|ab
|
|
354:21 argument_list|,
|
|
354:23 literal|"%s=%u old=%u"
|
|
354:37 argument_list|,
|
|
354:39 name|function_name
|
|
354:52 argument_list|,
|
|
354:54 name|new
|
|
354:57 argument_list|,
|
|
354:59 name|old
|
|
354:62 argument_list|)
|
|
354:63 expr_stmt|;
|
|
355:2 name|audit_log_session_info
|
|
355:24 argument_list|(
|
|
355:25 name|ab
|
|
355:27 argument_list|)
|
|
355:28 expr_stmt|;
|
|
356:2 name|rc
|
|
356:5 operator|=
|
|
356:7 name|audit_log_task_context
|
|
356:29 argument_list|(
|
|
356:30 name|ab
|
|
356:32 argument_list|)
|
|
356:33 expr_stmt|;
|
|
357:2 if|if
|
|
357:5 condition|(
|
|
357:6 name|rc
|
|
357:8 condition|)
|
|
358:3 name|allow_changes
|
|
358:17 operator|=
|
|
358:19 literal|0
|
|
358:20 expr_stmt|;
|
|
358:22 comment|/* Something weird, deny request */
|
|
359:2 name|audit_log_format
|
|
359:18 argument_list|(
|
|
359:19 name|ab
|
|
359:21 argument_list|,
|
|
359:23 literal|" res=%d"
|
|
359:32 argument_list|,
|
|
359:34 name|allow_changes
|
|
359:47 argument_list|)
|
|
359:48 expr_stmt|;
|
|
360:2 name|audit_log_end
|
|
360:15 argument_list|(
|
|
360:16 name|ab
|
|
360:18 argument_list|)
|
|
360:19 expr_stmt|;
|
|
361:2 return|return
|
|
361:9 name|rc
|
|
361:11 return|;
|
|
362:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
364:1 specifier|static
|
|
364:8 name|int
|
|
364:12 name|audit_do_config_change
|
|
364:34 parameter_list|(
|
|
364:35 name|char
|
|
364:40 modifier|*
|
|
364:41 name|function_name
|
|
364:54 parameter_list|,
|
|
364:56 name|u32
|
|
364:60 modifier|*
|
|
364:61 name|to_change
|
|
364:70 parameter_list|,
|
|
364:72 name|u32
|
|
364:76 name|new
|
|
364:79 parameter_list|)
|
|
365:1 block|{
|
|
366:2 name|int
|
|
366:6 name|allow_changes
|
|
366:19 decl_stmt|,
|
|
366:21 name|rc
|
|
366:24 init|=
|
|
366:26 literal|0
|
|
366:27 decl_stmt|;
|
|
367:2 name|u32
|
|
367:6 name|old
|
|
367:10 init|=
|
|
367:12 operator|*
|
|
367:13 name|to_change
|
|
367:22 decl_stmt|;
|
|
369:2 comment|/* check if we are locked */
|
|
370:2 if|if
|
|
370:5 condition|(
|
|
370:6 name|audit_enabled
|
|
370:20 operator|==
|
|
370:23 name|AUDIT_LOCKED
|
|
370:35 condition|)
|
|
371:3 name|allow_changes
|
|
371:17 operator|=
|
|
371:19 literal|0
|
|
371:20 expr_stmt|;
|
|
372:2 else|else
|
|
373:3 name|allow_changes
|
|
373:17 operator|=
|
|
373:19 literal|1
|
|
373:20 expr_stmt|;
|
|
375:2 if|if
|
|
375:5 condition|(
|
|
375:6 name|audit_enabled
|
|
375:20 operator|!=
|
|
375:23 name|AUDIT_OFF
|
|
375:32 condition|)
|
|
375:34 block|{
|
|
376:3 name|rc
|
|
376:6 operator|=
|
|
376:8 name|audit_log_config_change
|
|
376:31 argument_list|(
|
|
376:32 name|function_name
|
|
376:45 argument_list|,
|
|
376:47 name|new
|
|
376:50 argument_list|,
|
|
376:52 name|old
|
|
376:55 argument_list|,
|
|
376:57 name|allow_changes
|
|
376:70 argument_list|)
|
|
376:71 expr_stmt|;
|
|
377:3 if|if
|
|
377:6 condition|(
|
|
377:7 name|rc
|
|
377:9 condition|)
|
|
378:4 name|allow_changes
|
|
378:18 operator|=
|
|
378:20 literal|0
|
|
378:21 expr_stmt|;
|
|
379:2 block|}
|
|
381:2 comment|/* If we are allowed, make the change */
|
|
382:2 if|if
|
|
382:5 condition|(
|
|
382:6 name|allow_changes
|
|
382:20 operator|==
|
|
382:23 literal|1
|
|
382:24 condition|)
|
|
383:3 operator|*
|
|
383:4 name|to_change
|
|
383:14 operator|=
|
|
383:16 name|new
|
|
383:19 expr_stmt|;
|
|
384:2 comment|/* Not allowed, update reason */
|
|
385:2 elseif|else
|
|
385:7 if|if
|
|
385:10 condition|(
|
|
385:11 name|rc
|
|
385:14 operator|==
|
|
385:17 literal|0
|
|
385:18 condition|)
|
|
386:3 name|rc
|
|
386:6 operator|=
|
|
386:8 operator|-
|
|
386:9 name|EPERM
|
|
386:14 expr_stmt|;
|
|
387:2 return|return
|
|
387:9 name|rc
|
|
387:11 return|;
|
|
388:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
390:1 specifier|static
|
|
390:8 name|int
|
|
390:12 name|audit_set_rate_limit
|
|
390:32 parameter_list|(
|
|
390:33 name|u32
|
|
390:37 name|limit
|
|
390:42 parameter_list|)
|
|
391:1 block|{
|
|
392:2 return|return
|
|
392:9 name|audit_do_config_change
|
|
392:31 argument_list|(
|
|
392:32 literal|"audit_rate_limit"
|
|
392:50 argument_list|,
|
|
392:52 operator|&
|
|
392:53 name|audit_rate_limit
|
|
392:69 argument_list|,
|
|
392:71 name|limit
|
|
392:76 argument_list|)
|
|
392:77 return|;
|
|
393:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
395:1 specifier|static
|
|
395:8 name|int
|
|
395:12 name|audit_set_backlog_limit
|
|
395:35 parameter_list|(
|
|
395:36 name|u32
|
|
395:40 name|limit
|
|
395:45 parameter_list|)
|
|
396:1 block|{
|
|
397:2 return|return
|
|
397:9 name|audit_do_config_change
|
|
397:31 argument_list|(
|
|
397:32 literal|"audit_backlog_limit"
|
|
397:53 argument_list|,
|
|
397:55 operator|&
|
|
397:56 name|audit_backlog_limit
|
|
397:75 argument_list|,
|
|
397:77 name|limit
|
|
397:82 argument_list|)
|
|
397:83 return|;
|
|
398:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
400:1 specifier|static
|
|
400:8 name|int
|
|
400:12 name|audit_set_backlog_wait_time
|
|
400:39 parameter_list|(
|
|
400:40 name|u32
|
|
400:44 name|timeout
|
|
400:51 parameter_list|)
|
|
401:1 block|{
|
|
402:2 return|return
|
|
402:9 name|audit_do_config_change
|
|
402:31 argument_list|(
|
|
402:32 literal|"audit_backlog_wait_time"
|
|
402:57 argument_list|,
|
|
403:11 operator|&
|
|
403:12 name|audit_backlog_wait_time
|
|
403:35 argument_list|,
|
|
403:37 name|timeout
|
|
403:44 argument_list|)
|
|
403:45 return|;
|
|
404:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
406:1 specifier|static
|
|
406:8 name|int
|
|
406:12 name|audit_set_enabled
|
|
406:29 parameter_list|(
|
|
406:30 name|u32
|
|
406:34 name|state
|
|
406:39 parameter_list|)
|
|
407:1 block|{
|
|
408:2 name|int
|
|
408:6 name|rc
|
|
408:8 decl_stmt|;
|
|
409:2 if|if
|
|
409:5 condition|(
|
|
409:6 name|state
|
|
409:12 operator|>
|
|
409:14 name|AUDIT_LOCKED
|
|
409:26 condition|)
|
|
410:3 return|return
|
|
410:10 operator|-
|
|
410:11 name|EINVAL
|
|
410:17 return|;
|
|
412:2 name|rc
|
|
412:5 operator|=
|
|
412:8 name|audit_do_config_change
|
|
412:30 argument_list|(
|
|
412:31 literal|"audit_enabled"
|
|
412:46 argument_list|,
|
|
412:48 operator|&
|
|
412:49 name|audit_enabled
|
|
412:62 argument_list|,
|
|
412:64 name|state
|
|
412:69 argument_list|)
|
|
412:70 expr_stmt|;
|
|
413:2 if|if
|
|
413:5 condition|(
|
|
413:6 operator|!
|
|
413:7 name|rc
|
|
413:9 condition|)
|
|
414:3 name|audit_ever_enabled
|
|
414:22 operator||=
|
|
414:25 operator|!
|
|
414:26 operator|!
|
|
414:27 name|state
|
|
414:32 expr_stmt|;
|
|
416:2 return|return
|
|
416:9 name|rc
|
|
416:11 return|;
|
|
417:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
419:1 specifier|static
|
|
419:8 name|int
|
|
419:12 name|audit_set_failure
|
|
419:29 parameter_list|(
|
|
419:30 name|u32
|
|
419:34 name|state
|
|
419:39 parameter_list|)
|
|
420:1 block|{
|
|
421:2 if|if
|
|
421:5 condition|(
|
|
421:6 name|state
|
|
421:12 operator|!=
|
|
421:15 name|AUDIT_FAIL_SILENT
|
|
422:6 operator|&&
|
|
422:9 name|state
|
|
422:15 operator|!=
|
|
422:18 name|AUDIT_FAIL_PRINTK
|
|
423:6 operator|&&
|
|
423:9 name|state
|
|
423:15 operator|!=
|
|
423:18 name|AUDIT_FAIL_PANIC
|
|
423:34 condition|)
|
|
424:3 return|return
|
|
424:10 operator|-
|
|
424:11 name|EINVAL
|
|
424:17 return|;
|
|
426:2 return|return
|
|
426:9 name|audit_do_config_change
|
|
426:31 argument_list|(
|
|
426:32 literal|"audit_failure"
|
|
426:47 argument_list|,
|
|
426:49 operator|&
|
|
426:50 name|audit_failure
|
|
426:63 argument_list|,
|
|
426:65 name|state
|
|
426:70 argument_list|)
|
|
426:71 return|;
|
|
427:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
429:1 comment|/** * auditd_set - Set/Reset the auditd connection state * @pid: auditd PID * @portid: auditd netlink portid * @net: auditd network namespace pointer * * Description: * This function will obtain and drop network namespace references as * necessary. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
439:1 specifier|static
|
|
439:8 name|void
|
|
439:13 name|auditd_set
|
|
439:23 parameter_list|(
|
|
439:24 name|int
|
|
439:28 name|pid
|
|
439:31 parameter_list|,
|
|
439:33 name|u32
|
|
439:37 name|portid
|
|
439:43 parameter_list|,
|
|
439:45 name|struct
|
|
439:52 name|net
|
|
439:56 modifier|*
|
|
439:57 name|net
|
|
439:60 parameter_list|)
|
|
440:1 block|{
|
|
441:2 name|unsigned
|
|
441:11 name|long
|
|
441:16 name|flags
|
|
441:21 decl_stmt|;
|
|
443:2 name|spin_lock_irqsave
|
|
443:19 argument_list|(
|
|
443:20 operator|&
|
|
443:21 name|auditd_conn
|
|
443:32 operator|.
|
|
443:33 name|lock
|
|
443:37 argument_list|,
|
|
443:39 name|flags
|
|
443:44 argument_list|)
|
|
443:45 expr_stmt|;
|
|
444:2 name|auditd_conn
|
|
444:13 operator|.
|
|
444:14 name|pid
|
|
444:18 operator|=
|
|
444:20 name|pid
|
|
444:23 expr_stmt|;
|
|
445:2 name|auditd_conn
|
|
445:13 operator|.
|
|
445:14 name|portid
|
|
445:21 operator|=
|
|
445:23 name|portid
|
|
445:29 expr_stmt|;
|
|
446:2 if|if
|
|
446:5 condition|(
|
|
446:6 name|auditd_conn
|
|
446:17 operator|.
|
|
446:18 name|net
|
|
446:21 condition|)
|
|
447:3 name|put_net
|
|
447:10 argument_list|(
|
|
447:11 name|auditd_conn
|
|
447:22 operator|.
|
|
447:23 name|net
|
|
447:26 argument_list|)
|
|
447:27 expr_stmt|;
|
|
448:2 if|if
|
|
448:5 condition|(
|
|
448:6 name|net
|
|
448:9 condition|)
|
|
449:3 name|auditd_conn
|
|
449:14 operator|.
|
|
449:15 name|net
|
|
449:19 operator|=
|
|
449:21 name|get_net
|
|
449:28 argument_list|(
|
|
449:29 name|net
|
|
449:32 argument_list|)
|
|
449:33 expr_stmt|;
|
|
450:2 else|else
|
|
451:3 name|auditd_conn
|
|
451:14 operator|.
|
|
451:15 name|net
|
|
451:19 operator|=
|
|
451:21 name|NULL
|
|
451:25 expr_stmt|;
|
|
452:2 name|spin_unlock_irqrestore
|
|
452:24 argument_list|(
|
|
452:25 operator|&
|
|
452:26 name|auditd_conn
|
|
452:37 operator|.
|
|
452:38 name|lock
|
|
452:42 argument_list|,
|
|
452:44 name|flags
|
|
452:49 argument_list|)
|
|
452:50 expr_stmt|;
|
|
453:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
455:1 comment|/** * kauditd_print_skb - Print the audit record to the ring buffer * @skb: audit record * * Whatever the reason, this packet may not make it to the auditd connection * so write it via printk so the information isn't completely lost. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
462:1 specifier|static
|
|
462:8 name|void
|
|
462:13 name|kauditd_printk_skb
|
|
462:31 parameter_list|(
|
|
462:32 name|struct
|
|
462:39 name|sk_buff
|
|
462:47 modifier|*
|
|
462:48 name|skb
|
|
462:51 parameter_list|)
|
|
463:1 block|{
|
|
464:2 name|struct
|
|
464:9 name|nlmsghdr
|
|
464:18 modifier|*
|
|
464:19 name|nlh
|
|
464:23 init|=
|
|
464:25 name|nlmsg_hdr
|
|
464:34 argument_list|(
|
|
464:35 name|skb
|
|
464:38 argument_list|)
|
|
464:39 decl_stmt|;
|
|
465:2 name|char
|
|
465:7 modifier|*
|
|
465:8 name|data
|
|
465:13 init|=
|
|
465:15 name|nlmsg_data
|
|
465:25 argument_list|(
|
|
465:26 name|nlh
|
|
465:29 argument_list|)
|
|
465:30 decl_stmt|;
|
|
467:2 if|if
|
|
467:5 condition|(
|
|
467:6 name|nlh
|
|
467:9 operator|->
|
|
467:11 name|nlmsg_type
|
|
467:22 operator|!=
|
|
467:25 name|AUDIT_EOE
|
|
467:35 operator|&&
|
|
467:38 name|printk_ratelimit
|
|
467:54 argument_list|()
|
|
467:56 condition|)
|
|
468:3 name|pr_notice
|
|
468:12 argument_list|(
|
|
468:13 literal|"type=%d %s\n"
|
|
468:27 argument_list|,
|
|
468:29 name|nlh
|
|
468:32 operator|->
|
|
468:34 name|nlmsg_type
|
|
468:44 argument_list|,
|
|
468:46 name|data
|
|
468:50 argument_list|)
|
|
468:51 expr_stmt|;
|
|
469:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
471:1 comment|/** * kauditd_rehold_skb - Handle a audit record send failure in the hold queue * @skb: audit record * * Description: * This should only be used by the kauditd_thread when it fails to flush the * hold queue. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
479:1 specifier|static
|
|
479:8 name|void
|
|
479:13 name|kauditd_rehold_skb
|
|
479:31 parameter_list|(
|
|
479:32 name|struct
|
|
479:39 name|sk_buff
|
|
479:47 modifier|*
|
|
479:48 name|skb
|
|
479:51 parameter_list|)
|
|
480:1 block|{
|
|
481:2 comment|/* put the record back in the queue at the same place */
|
|
482:2 name|skb_queue_head
|
|
482:16 argument_list|(
|
|
482:17 operator|&
|
|
482:18 name|audit_hold_queue
|
|
482:34 argument_list|,
|
|
482:36 name|skb
|
|
482:39 argument_list|)
|
|
482:40 expr_stmt|;
|
|
483:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
485:1 comment|/** * kauditd_hold_skb - Queue an audit record, waiting for auditd * @skb: audit record * * Description: * Queue the audit record, waiting for an instance of auditd. When this * function is called we haven't given up yet on sending the record, but things * are not looking good. The first thing we want to do is try to write the * record via printk and then see if we want to try and hold on to the record * and queue it, if we have room. If we want to hold on to the record, but we * don't have room, record a record lost message. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
497:1 specifier|static
|
|
497:8 name|void
|
|
497:13 name|kauditd_hold_skb
|
|
497:29 parameter_list|(
|
|
497:30 name|struct
|
|
497:37 name|sk_buff
|
|
497:45 modifier|*
|
|
497:46 name|skb
|
|
497:49 parameter_list|)
|
|
498:1 block|{
|
|
499:2 comment|/* at this point it is uncertain if we will ever send this to auditd so * try to send the message via printk before we go any further */
|
|
501:2 name|kauditd_printk_skb
|
|
501:20 argument_list|(
|
|
501:21 name|skb
|
|
501:24 argument_list|)
|
|
501:25 expr_stmt|;
|
|
503:2 comment|/* can we just silently drop the message? */
|
|
504:2 if|if
|
|
504:5 condition|(
|
|
504:6 operator|!
|
|
504:7 name|audit_default
|
|
504:20 condition|)
|
|
504:22 block|{
|
|
505:3 name|kfree_skb
|
|
505:12 argument_list|(
|
|
505:13 name|skb
|
|
505:16 argument_list|)
|
|
505:17 expr_stmt|;
|
|
506:3 return|return;
|
|
507:2 block|}
|
|
509:2 comment|/* if we have room, queue the message */
|
|
510:2 if|if
|
|
510:5 condition|(
|
|
510:6 operator|!
|
|
510:7 name|audit_backlog_limit
|
|
510:27 operator|||
|
|
511:6 name|skb_queue_len
|
|
511:19 argument_list|(
|
|
511:20 operator|&
|
|
511:21 name|audit_hold_queue
|
|
511:37 argument_list|)
|
|
511:39 operator|<
|
|
511:41 name|audit_backlog_limit
|
|
511:60 condition|)
|
|
511:62 block|{
|
|
512:3 name|skb_queue_tail
|
|
512:17 argument_list|(
|
|
512:18 operator|&
|
|
512:19 name|audit_hold_queue
|
|
512:35 argument_list|,
|
|
512:37 name|skb
|
|
512:40 argument_list|)
|
|
512:41 expr_stmt|;
|
|
513:3 return|return;
|
|
514:2 block|}
|
|
516:2 comment|/* we have no other options - drop the message */
|
|
517:2 name|audit_log_lost
|
|
517:16 argument_list|(
|
|
517:17 literal|"kauditd hold queue overflow"
|
|
517:46 argument_list|)
|
|
517:47 expr_stmt|;
|
|
518:2 name|kfree_skb
|
|
518:11 argument_list|(
|
|
518:12 name|skb
|
|
518:15 argument_list|)
|
|
518:16 expr_stmt|;
|
|
519:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
521:1 comment|/** * kauditd_retry_skb - Queue an audit record, attempt to send again to auditd * @skb: audit record * * Description: * Not as serious as kauditd_hold_skb() as we still have a connected auditd, * but for some reason we are having problems sending it audit records so * queue the given record and attempt to resend. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
530:1 specifier|static
|
|
530:8 name|void
|
|
530:13 name|kauditd_retry_skb
|
|
530:30 parameter_list|(
|
|
530:31 name|struct
|
|
530:38 name|sk_buff
|
|
530:46 modifier|*
|
|
530:47 name|skb
|
|
530:50 parameter_list|)
|
|
531:1 block|{
|
|
532:2 comment|/* NOTE: because records should only live in the retry queue for a * short period of time, before either being sent or moved to the hold * queue, we don't currently enforce a limit on this queue */
|
|
535:2 name|skb_queue_tail
|
|
535:16 argument_list|(
|
|
535:17 operator|&
|
|
535:18 name|audit_retry_queue
|
|
535:35 argument_list|,
|
|
535:37 name|skb
|
|
535:40 argument_list|)
|
|
535:41 expr_stmt|;
|
|
536:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
538:1 comment|/** * auditd_reset - Disconnect the auditd connection * * Description: * Break the auditd/kauditd connection and move all the queued records into the * hold queue in case auditd reconnects. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
545:1 specifier|static
|
|
545:8 name|void
|
|
545:13 name|auditd_reset
|
|
545:25 parameter_list|(
|
|
545:26 name|void
|
|
545:30 parameter_list|)
|
|
546:1 block|{
|
|
547:2 name|struct
|
|
547:9 name|sk_buff
|
|
547:17 modifier|*
|
|
547:18 name|skb
|
|
547:21 decl_stmt|;
|
|
549:2 comment|/* if it isn't already broken, break the connection */
|
|
550:2 name|rcu_read_lock
|
|
550:15 argument_list|()
|
|
550:17 expr_stmt|;
|
|
551:2 if|if
|
|
551:5 condition|(
|
|
551:6 name|auditd_conn
|
|
551:17 operator|.
|
|
551:18 name|pid
|
|
551:21 condition|)
|
|
552:3 name|auditd_set
|
|
552:13 argument_list|(
|
|
552:14 literal|0
|
|
552:15 argument_list|,
|
|
552:17 literal|0
|
|
552:18 argument_list|,
|
|
552:20 name|NULL
|
|
552:24 argument_list|)
|
|
552:25 expr_stmt|;
|
|
553:2 name|rcu_read_unlock
|
|
553:17 argument_list|()
|
|
553:19 expr_stmt|;
|
|
555:2 comment|/* flush all of the main and retry queues to the hold queue */
|
|
556:2 while|while
|
|
556:8 condition|(
|
|
556:9 operator|(
|
|
556:10 name|skb
|
|
556:14 operator|=
|
|
556:16 name|skb_dequeue
|
|
556:27 argument_list|(
|
|
556:28 operator|&
|
|
556:29 name|audit_retry_queue
|
|
556:46 argument_list|)
|
|
556:47 operator|)
|
|
556:48 condition|)
|
|
557:3 name|kauditd_hold_skb
|
|
557:19 argument_list|(
|
|
557:20 name|skb
|
|
557:23 argument_list|)
|
|
557:24 expr_stmt|;
|
|
558:2 while|while
|
|
558:8 condition|(
|
|
558:9 operator|(
|
|
558:10 name|skb
|
|
558:14 operator|=
|
|
558:16 name|skb_dequeue
|
|
558:27 argument_list|(
|
|
558:28 operator|&
|
|
558:29 name|audit_queue
|
|
558:40 argument_list|)
|
|
558:41 operator|)
|
|
558:42 condition|)
|
|
559:3 name|kauditd_hold_skb
|
|
559:19 argument_list|(
|
|
559:20 name|skb
|
|
559:23 argument_list|)
|
|
559:24 expr_stmt|;
|
|
560:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
562:1 comment|/** * auditd_send_unicast_skb - Send a record via unicast to auditd * @skb: audit record * * Description: * Send a skb to the audit daemon, returns positive/zero values on success and * negative values on failure; in all cases the skb will be consumed by this * function. If the send results in -ECONNREFUSED the connection with auditd * will be reset. This function may sleep so callers should not hold any locks * where this would cause a problem. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
573:1 specifier|static
|
|
573:8 name|int
|
|
573:12 name|auditd_send_unicast_skb
|
|
573:35 parameter_list|(
|
|
573:36 name|struct
|
|
573:43 name|sk_buff
|
|
573:51 modifier|*
|
|
573:52 name|skb
|
|
573:55 parameter_list|)
|
|
574:1 block|{
|
|
575:2 name|int
|
|
575:6 name|rc
|
|
575:8 decl_stmt|;
|
|
576:2 name|u32
|
|
576:6 name|portid
|
|
576:12 decl_stmt|;
|
|
577:2 name|struct
|
|
577:9 name|net
|
|
577:13 modifier|*
|
|
577:14 name|net
|
|
577:17 decl_stmt|;
|
|
578:2 name|struct
|
|
578:9 name|sock
|
|
578:14 modifier|*
|
|
578:15 name|sk
|
|
578:17 decl_stmt|;
|
|
580:2 comment|/* NOTE: we can't call netlink_unicast while in the RCU section so * take a reference to the network namespace and grab local * copies of the namespace, the sock, and the portid; the * namespace and sock aren't going to go away while we hold a * reference and if the portid does become invalid after the RCU * section netlink_unicast() should safely return an error */
|
|
587:2 name|rcu_read_lock
|
|
587:15 argument_list|()
|
|
587:17 expr_stmt|;
|
|
588:2 if|if
|
|
588:5 condition|(
|
|
588:6 operator|!
|
|
588:7 name|auditd_conn
|
|
588:18 operator|.
|
|
588:19 name|pid
|
|
588:22 condition|)
|
|
588:24 block|{
|
|
589:3 name|rcu_read_unlock
|
|
589:18 argument_list|()
|
|
589:20 expr_stmt|;
|
|
590:3 name|rc
|
|
590:6 operator|=
|
|
590:8 operator|-
|
|
590:9 name|ECONNREFUSED
|
|
590:21 expr_stmt|;
|
|
591:3 goto|goto
|
|
591:8 name|err
|
|
591:11 goto|;
|
|
592:2 block|}
|
|
593:2 name|net
|
|
593:6 operator|=
|
|
593:8 name|auditd_conn
|
|
593:19 operator|.
|
|
593:20 name|net
|
|
593:23 expr_stmt|;
|
|
594:2 name|get_net
|
|
594:9 argument_list|(
|
|
594:10 name|net
|
|
594:13 argument_list|)
|
|
594:14 expr_stmt|;
|
|
595:2 name|sk
|
|
595:5 operator|=
|
|
595:7 name|audit_get_sk
|
|
595:19 argument_list|(
|
|
595:20 name|net
|
|
595:23 argument_list|)
|
|
595:24 expr_stmt|;
|
|
596:2 name|portid
|
|
596:9 operator|=
|
|
596:11 name|auditd_conn
|
|
596:22 operator|.
|
|
596:23 name|portid
|
|
596:29 expr_stmt|;
|
|
597:2 name|rcu_read_unlock
|
|
597:17 argument_list|()
|
|
597:19 expr_stmt|;
|
|
599:2 name|rc
|
|
599:5 operator|=
|
|
599:7 name|netlink_unicast
|
|
599:22 argument_list|(
|
|
599:23 name|sk
|
|
599:25 argument_list|,
|
|
599:27 name|skb
|
|
599:30 argument_list|,
|
|
599:32 name|portid
|
|
599:38 argument_list|,
|
|
599:40 literal|0
|
|
599:41 argument_list|)
|
|
599:42 expr_stmt|;
|
|
600:2 name|put_net
|
|
600:9 argument_list|(
|
|
600:10 name|net
|
|
600:13 argument_list|)
|
|
600:14 expr_stmt|;
|
|
601:2 if|if
|
|
601:5 condition|(
|
|
601:6 name|rc
|
|
601:9 operator|<
|
|
601:11 literal|0
|
|
601:12 condition|)
|
|
602:3 goto|goto
|
|
602:8 name|err
|
|
602:11 goto|;
|
|
604:2 return|return
|
|
604:9 name|rc
|
|
604:11 return|;
|
|
606:1 name|err
|
|
606:4 label|:
|
|
607:2 if|if
|
|
607:5 condition|(
|
|
607:6 name|rc
|
|
607:9 operator|==
|
|
607:12 operator|-
|
|
607:13 name|ECONNREFUSED
|
|
607:25 condition|)
|
|
608:3 name|auditd_reset
|
|
608:15 argument_list|()
|
|
608:17 expr_stmt|;
|
|
609:2 return|return
|
|
609:9 name|rc
|
|
609:11 return|;
|
|
610:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
612:1 comment|/** * kauditd_send_queue - Helper for kauditd_thread to flush skb queues * @sk: the sending sock * @portid: the netlink destination * @queue: the skb queue to process * @retry_limit: limit on number of netlink unicast failures * @skb_hook: per-skb hook for additional processing * @err_hook: hook called if the skb fails the netlink unicast send * * Description: * Run through the given queue and attempt to send the audit records to auditd, * returns zero on success, negative values on failure. It is up to the caller * to ensure that the @sk is valid for the duration of this function. * */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
627:1 specifier|static
|
|
627:8 name|int
|
|
627:12 name|kauditd_send_queue
|
|
627:30 parameter_list|(
|
|
627:31 name|struct
|
|
627:38 name|sock
|
|
627:43 modifier|*
|
|
627:44 name|sk
|
|
627:46 parameter_list|,
|
|
627:48 name|u32
|
|
627:52 name|portid
|
|
627:58 parameter_list|,
|
|
628:10 name|struct
|
|
628:17 name|sk_buff_head
|
|
628:30 modifier|*
|
|
628:31 name|queue
|
|
628:36 parameter_list|,
|
|
629:10 name|unsigned
|
|
629:19 name|int
|
|
629:23 name|retry_limit
|
|
629:34 parameter_list|,
|
|
630:10 name|void
|
|
630:15 function_decl|(
|
|
630:16 modifier|*
|
|
630:17 name|skb_hook
|
|
630:25 function_decl|)
|
|
630:26 parameter_list|(
|
|
630:27 name|struct
|
|
630:34 name|sk_buff
|
|
630:42 modifier|*
|
|
630:43 name|skb
|
|
630:46 parameter_list|)
|
|
630:47 parameter_list|,
|
|
631:10 name|void
|
|
631:15 function_decl|(
|
|
631:16 modifier|*
|
|
631:17 name|err_hook
|
|
631:25 function_decl|)
|
|
631:26 parameter_list|(
|
|
631:27 name|struct
|
|
631:34 name|sk_buff
|
|
631:42 modifier|*
|
|
631:43 name|skb
|
|
631:46 parameter_list|)
|
|
631:47 parameter_list|)
|
|
632:1 block|{
|
|
633:2 name|int
|
|
633:6 name|rc
|
|
633:9 init|=
|
|
633:11 literal|0
|
|
633:12 decl_stmt|;
|
|
634:2 name|struct
|
|
634:9 name|sk_buff
|
|
634:17 modifier|*
|
|
634:18 name|skb
|
|
634:21 decl_stmt|;
|
|
635:2 specifier|static
|
|
635:9 name|unsigned
|
|
635:18 name|int
|
|
635:22 name|failed
|
|
635:29 init|=
|
|
635:31 literal|0
|
|
635:32 decl_stmt|;
|
|
637:2 comment|/* NOTE: kauditd_thread takes care of all our locking, we just use * the netlink info passed to us (e.g. sk and portid) */
|
|
640:2 while|while
|
|
640:8 condition|(
|
|
640:9 operator|(
|
|
640:10 name|skb
|
|
640:14 operator|=
|
|
640:16 name|skb_dequeue
|
|
640:27 argument_list|(
|
|
640:28 name|queue
|
|
640:33 argument_list|)
|
|
640:34 operator|)
|
|
640:35 condition|)
|
|
640:37 block|{
|
|
641:3 comment|/* call the skb_hook for each skb we touch */
|
|
642:3 if|if
|
|
642:6 condition|(
|
|
642:7 name|skb_hook
|
|
642:15 condition|)
|
|
643:4 call|(
|
|
643:5 modifier|*
|
|
643:6 name|skb_hook
|
|
643:14 call|)
|
|
643:15 argument_list|(
|
|
643:16 name|skb
|
|
643:19 argument_list|)
|
|
643:20 expr_stmt|;
|
|
645:3 comment|/* can we send to anyone via unicast? */
|
|
646:3 if|if
|
|
646:6 condition|(
|
|
646:7 operator|!
|
|
646:8 name|sk
|
|
646:10 condition|)
|
|
646:12 block|{
|
|
647:4 if|if
|
|
647:7 condition|(
|
|
647:8 name|err_hook
|
|
647:16 condition|)
|
|
648:5 call|(
|
|
648:6 modifier|*
|
|
648:7 name|err_hook
|
|
648:15 call|)
|
|
648:16 argument_list|(
|
|
648:17 name|skb
|
|
648:20 argument_list|)
|
|
648:21 expr_stmt|;
|
|
649:4 continue|continue;
|
|
650:3 block|}
|
|
652:3 comment|/* grab an extra skb reference in case of error */
|
|
653:3 name|skb_get
|
|
653:10 argument_list|(
|
|
653:11 name|skb
|
|
653:14 argument_list|)
|
|
653:15 expr_stmt|;
|
|
654:3 name|rc
|
|
654:6 operator|=
|
|
654:8 name|netlink_unicast
|
|
654:23 argument_list|(
|
|
654:24 name|sk
|
|
654:26 argument_list|,
|
|
654:28 name|skb
|
|
654:31 argument_list|,
|
|
654:33 name|portid
|
|
654:39 argument_list|,
|
|
654:41 literal|0
|
|
654:42 argument_list|)
|
|
654:43 expr_stmt|;
|
|
655:3 if|if
|
|
655:6 condition|(
|
|
655:7 name|rc
|
|
655:10 operator|<
|
|
655:12 literal|0
|
|
655:13 condition|)
|
|
655:15 block|{
|
|
656:4 comment|/* fatal failure for our queue flush attempt? */
|
|
657:4 if|if
|
|
657:7 condition|(
|
|
657:8 operator|++
|
|
657:10 name|failed
|
|
657:17 operator|>=
|
|
657:20 name|retry_limit
|
|
657:32 operator|||
|
|
658:8 name|rc
|
|
658:11 operator|==
|
|
658:14 operator|-
|
|
658:15 name|ECONNREFUSED
|
|
658:28 operator|||
|
|
658:31 name|rc
|
|
658:34 operator|==
|
|
658:37 operator|-
|
|
658:38 name|EPERM
|
|
658:43 condition|)
|
|
658:45 block|{
|
|
659:5 comment|/* yes - error processing for the queue */
|
|
660:5 name|sk
|
|
660:8 operator|=
|
|
660:10 name|NULL
|
|
660:14 expr_stmt|;
|
|
661:5 if|if
|
|
661:8 condition|(
|
|
661:9 name|err_hook
|
|
661:17 condition|)
|
|
662:6 call|(
|
|
662:7 modifier|*
|
|
662:8 name|err_hook
|
|
662:16 call|)
|
|
662:17 argument_list|(
|
|
662:18 name|skb
|
|
662:21 argument_list|)
|
|
662:22 expr_stmt|;
|
|
663:5 if|if
|
|
663:8 condition|(
|
|
663:9 operator|!
|
|
663:10 name|skb_hook
|
|
663:18 condition|)
|
|
664:6 goto|goto
|
|
664:11 name|out
|
|
664:14 goto|;
|
|
665:5 comment|/* keep processing with the skb_hook */
|
|
666:5 continue|continue;
|
|
667:4 block|}
|
|
667:6 else|else
|
|
668:5 comment|/* no - requeue to preserve ordering */
|
|
669:5 name|skb_queue_head
|
|
669:19 argument_list|(
|
|
669:20 name|queue
|
|
669:25 argument_list|,
|
|
669:27 name|skb
|
|
669:30 argument_list|)
|
|
669:31 expr_stmt|;
|
|
670:3 block|}
|
|
670:5 else|else
|
|
670:10 block|{
|
|
671:4 comment|/* it worked - drop the extra reference and continue */
|
|
672:4 name|consume_skb
|
|
672:15 argument_list|(
|
|
672:16 name|skb
|
|
672:19 argument_list|)
|
|
672:20 expr_stmt|;
|
|
673:4 name|failed
|
|
673:11 operator|=
|
|
673:13 literal|0
|
|
673:14 expr_stmt|;
|
|
674:3 block|}
|
|
675:2 block|}
|
|
677:1 name|out
|
|
677:4 label|:
|
|
678:2 return|return
|
|
678:9 operator|(
|
|
678:10 name|rc
|
|
678:13 operator|>=
|
|
678:16 literal|0
|
|
678:18 condition|?
|
|
678:20 literal|0
|
|
678:22 else|:
|
|
678:24 name|rc
|
|
678:26 operator|)
|
|
678:27 return|;
|
|
679:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
681:1 comment|/* * kauditd_send_multicast_skb - Send a record to any multicast listeners * @skb: audit record * * Description: * Write a multicast message to anyone listening in the initial network * namespace. This function doesn't consume an skb as might be expected since * it has to copy it anyways. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
690:1 specifier|static
|
|
690:8 name|void
|
|
690:13 name|kauditd_send_multicast_skb
|
|
690:39 parameter_list|(
|
|
690:40 name|struct
|
|
690:47 name|sk_buff
|
|
690:55 modifier|*
|
|
690:56 name|skb
|
|
690:59 parameter_list|)
|
|
691:1 block|{
|
|
692:2 name|struct
|
|
692:9 name|sk_buff
|
|
692:17 modifier|*
|
|
692:18 name|copy
|
|
692:22 decl_stmt|;
|
|
693:2 name|struct
|
|
693:9 name|sock
|
|
693:14 modifier|*
|
|
693:15 name|sock
|
|
693:20 init|=
|
|
693:22 name|audit_get_sk
|
|
693:34 argument_list|(
|
|
693:35 operator|&
|
|
693:36 name|init_net
|
|
693:44 argument_list|)
|
|
693:45 decl_stmt|;
|
|
694:2 name|struct
|
|
694:9 name|nlmsghdr
|
|
694:18 modifier|*
|
|
694:19 name|nlh
|
|
694:22 decl_stmt|;
|
|
696:2 comment|/* NOTE: we are not taking an additional reference for init_net since * we don't have to worry about it going away */
|
|
699:2 if|if
|
|
699:5 condition|(
|
|
699:6 operator|!
|
|
699:7 name|netlink_has_listeners
|
|
699:28 argument_list|(
|
|
699:29 name|sock
|
|
699:33 argument_list|,
|
|
699:35 name|AUDIT_NLGRP_READLOG
|
|
699:54 argument_list|)
|
|
699:55 condition|)
|
|
700:3 return|return;
|
|
702:2 comment|/* * The seemingly wasteful skb_copy() rather than bumping the refcount * using skb_get() is necessary because non-standard mods are made to * the skb by the original kaudit unicast socket send routine. The * existing auditd daemon assumes this breakage. Fixing this would * require co-ordinating a change in the established protocol between * the kaudit kernel subsystem and the auditd userspace code. There is * no reason for new multicast clients to continue with this * non-compliance. */
|
|
712:2 name|copy
|
|
712:7 operator|=
|
|
712:9 name|skb_copy
|
|
712:17 argument_list|(
|
|
712:18 name|skb
|
|
712:21 argument_list|,
|
|
712:23 name|GFP_KERNEL
|
|
712:33 argument_list|)
|
|
712:34 expr_stmt|;
|
|
713:2 if|if
|
|
713:5 condition|(
|
|
713:6 operator|!
|
|
713:7 name|copy
|
|
713:11 condition|)
|
|
714:3 return|return;
|
|
715:2 name|nlh
|
|
715:6 operator|=
|
|
715:8 name|nlmsg_hdr
|
|
715:17 argument_list|(
|
|
715:18 name|copy
|
|
715:22 argument_list|)
|
|
715:23 expr_stmt|;
|
|
716:2 name|nlh
|
|
716:5 operator|->
|
|
716:7 name|nlmsg_len
|
|
716:17 operator|=
|
|
716:19 name|skb
|
|
716:22 operator|->
|
|
716:24 name|len
|
|
716:27 expr_stmt|;
|
|
718:2 name|nlmsg_multicast
|
|
718:17 argument_list|(
|
|
718:18 name|sock
|
|
718:22 argument_list|,
|
|
718:24 name|copy
|
|
718:28 argument_list|,
|
|
718:30 literal|0
|
|
718:31 argument_list|,
|
|
718:33 name|AUDIT_NLGRP_READLOG
|
|
718:52 argument_list|,
|
|
718:54 name|GFP_KERNEL
|
|
718:64 argument_list|)
|
|
718:65 expr_stmt|;
|
|
719:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
721:1 comment|/** * kauditd_thread - Worker thread to send audit records to userspace * @dummy: unused */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
725:1 specifier|static
|
|
725:8 name|int
|
|
725:12 name|kauditd_thread
|
|
725:26 parameter_list|(
|
|
725:27 name|void
|
|
725:32 modifier|*
|
|
725:33 name|dummy
|
|
725:38 parameter_list|)
|
|
726:1 block|{
|
|
727:2 name|int
|
|
727:6 name|rc
|
|
727:8 decl_stmt|;
|
|
728:2 name|u32
|
|
728:6 name|portid
|
|
728:13 init|=
|
|
728:15 literal|0
|
|
728:16 decl_stmt|;
|
|
729:2 name|struct
|
|
729:9 name|net
|
|
729:13 modifier|*
|
|
729:14 name|net
|
|
729:18 init|=
|
|
729:20 name|NULL
|
|
729:24 decl_stmt|;
|
|
730:2 name|struct
|
|
730:9 name|sock
|
|
730:14 modifier|*
|
|
730:15 name|sk
|
|
730:18 init|=
|
|
730:20 name|NULL
|
|
730:24 decl_stmt|;
|
|
732:1 define|#
|
|
732:2 directive|define
|
|
732:9 name|UNICAST_RETRIES
|
|
732:25 value|5
|
|
734:2 name|set_freezable
|
|
734:15 argument_list|()
|
|
734:17 expr_stmt|;
|
|
735:2 while|while
|
|
735:8 condition|(
|
|
735:9 operator|!
|
|
735:10 name|kthread_should_stop
|
|
735:29 argument_list|()
|
|
735:31 condition|)
|
|
735:33 block|{
|
|
736:3 comment|/* NOTE: see the lock comments in auditd_send_unicast_skb() */
|
|
737:3 name|rcu_read_lock
|
|
737:16 argument_list|()
|
|
737:18 expr_stmt|;
|
|
738:3 if|if
|
|
738:6 condition|(
|
|
738:7 operator|!
|
|
738:8 name|auditd_conn
|
|
738:19 operator|.
|
|
738:20 name|pid
|
|
738:23 condition|)
|
|
738:25 block|{
|
|
739:4 name|rcu_read_unlock
|
|
739:19 argument_list|()
|
|
739:21 expr_stmt|;
|
|
740:4 goto|goto
|
|
740:9 name|main_queue
|
|
740:19 goto|;
|
|
741:3 block|}
|
|
742:3 name|net
|
|
742:7 operator|=
|
|
742:9 name|auditd_conn
|
|
742:20 operator|.
|
|
742:21 name|net
|
|
742:24 expr_stmt|;
|
|
743:3 name|get_net
|
|
743:10 argument_list|(
|
|
743:11 name|net
|
|
743:14 argument_list|)
|
|
743:15 expr_stmt|;
|
|
744:3 name|sk
|
|
744:6 operator|=
|
|
744:8 name|audit_get_sk
|
|
744:20 argument_list|(
|
|
744:21 name|net
|
|
744:24 argument_list|)
|
|
744:25 expr_stmt|;
|
|
745:3 name|portid
|
|
745:10 operator|=
|
|
745:12 name|auditd_conn
|
|
745:23 operator|.
|
|
745:24 name|portid
|
|
745:30 expr_stmt|;
|
|
746:3 name|rcu_read_unlock
|
|
746:18 argument_list|()
|
|
746:20 expr_stmt|;
|
|
748:3 comment|/* attempt to flush the hold queue */
|
|
749:3 name|rc
|
|
749:6 operator|=
|
|
749:8 name|kauditd_send_queue
|
|
749:26 argument_list|(
|
|
749:27 name|sk
|
|
749:29 argument_list|,
|
|
749:31 name|portid
|
|
749:37 argument_list|,
|
|
750:6 operator|&
|
|
750:7 name|audit_hold_queue
|
|
750:23 argument_list|,
|
|
750:25 name|UNICAST_RETRIES
|
|
750:40 argument_list|,
|
|
751:6 name|NULL
|
|
751:10 argument_list|,
|
|
751:12 name|kauditd_rehold_skb
|
|
751:30 argument_list|)
|
|
751:31 expr_stmt|;
|
|
752:3 if|if
|
|
752:6 condition|(
|
|
752:7 name|rc
|
|
752:10 operator|<
|
|
752:12 literal|0
|
|
752:13 condition|)
|
|
752:15 block|{
|
|
753:4 name|sk
|
|
753:7 operator|=
|
|
753:9 name|NULL
|
|
753:13 expr_stmt|;
|
|
754:4 name|auditd_reset
|
|
754:16 argument_list|()
|
|
754:18 expr_stmt|;
|
|
755:4 goto|goto
|
|
755:9 name|main_queue
|
|
755:19 goto|;
|
|
756:3 block|}
|
|
758:3 comment|/* attempt to flush the retry queue */
|
|
759:3 name|rc
|
|
759:6 operator|=
|
|
759:8 name|kauditd_send_queue
|
|
759:26 argument_list|(
|
|
759:27 name|sk
|
|
759:29 argument_list|,
|
|
759:31 name|portid
|
|
759:37 argument_list|,
|
|
760:6 operator|&
|
|
760:7 name|audit_retry_queue
|
|
760:24 argument_list|,
|
|
760:26 name|UNICAST_RETRIES
|
|
760:41 argument_list|,
|
|
761:6 name|NULL
|
|
761:10 argument_list|,
|
|
761:12 name|kauditd_hold_skb
|
|
761:28 argument_list|)
|
|
761:29 expr_stmt|;
|
|
762:3 if|if
|
|
762:6 condition|(
|
|
762:7 name|rc
|
|
762:10 operator|<
|
|
762:12 literal|0
|
|
762:13 condition|)
|
|
762:15 block|{
|
|
763:4 name|sk
|
|
763:7 operator|=
|
|
763:9 name|NULL
|
|
763:13 expr_stmt|;
|
|
764:4 name|auditd_reset
|
|
764:16 argument_list|()
|
|
764:18 expr_stmt|;
|
|
765:4 goto|goto
|
|
765:9 name|main_queue
|
|
765:19 goto|;
|
|
766:3 block|}
|
|
768:1 name|main_queue
|
|
768:11 label|:
|
|
769:3 comment|/* process the main queue - do the multicast send and attempt * unicast, dump failed record sends to the retry queue; if * sk == NULL due to previous failures we will just do the * multicast send and move the record to the retry queue */
|
|
773:3 name|rc
|
|
773:6 operator|=
|
|
773:8 name|kauditd_send_queue
|
|
773:26 argument_list|(
|
|
773:27 name|sk
|
|
773:29 argument_list|,
|
|
773:31 name|portid
|
|
773:37 argument_list|,
|
|
773:39 operator|&
|
|
773:40 name|audit_queue
|
|
773:51 argument_list|,
|
|
773:53 literal|1
|
|
773:54 argument_list|,
|
|
774:6 name|kauditd_send_multicast_skb
|
|
774:32 argument_list|,
|
|
775:6 name|kauditd_retry_skb
|
|
775:23 argument_list|)
|
|
775:24 expr_stmt|;
|
|
776:3 if|if
|
|
776:6 condition|(
|
|
776:7 name|sk
|
|
776:10 operator|==
|
|
776:13 name|NULL
|
|
776:18 operator|||
|
|
776:21 name|rc
|
|
776:24 operator|<
|
|
776:26 literal|0
|
|
776:27 condition|)
|
|
777:4 name|auditd_reset
|
|
777:16 argument_list|()
|
|
777:18 expr_stmt|;
|
|
778:3 name|sk
|
|
778:6 operator|=
|
|
778:8 name|NULL
|
|
778:12 expr_stmt|;
|
|
780:3 comment|/* drop our netns reference, no auditd sends past this line */
|
|
781:3 if|if
|
|
781:6 condition|(
|
|
781:7 name|net
|
|
781:10 condition|)
|
|
781:12 block|{
|
|
782:4 name|put_net
|
|
782:11 argument_list|(
|
|
782:12 name|net
|
|
782:15 argument_list|)
|
|
782:16 expr_stmt|;
|
|
783:4 name|net
|
|
783:8 operator|=
|
|
783:10 name|NULL
|
|
783:14 expr_stmt|;
|
|
784:3 block|}
|
|
786:3 comment|/* we have processed all the queues so wake everyone */
|
|
787:3 name|wake_up
|
|
787:10 argument_list|(
|
|
787:11 operator|&
|
|
787:12 name|audit_backlog_wait
|
|
787:30 argument_list|)
|
|
787:31 expr_stmt|;
|
|
789:3 comment|/* NOTE: we want to wake up if there is anything on the queue, * regardless of if an auditd is connected, as we need to * do the multicast send and rotate records from the * main queue to the retry/hold queues */
|
|
793:3 name|wait_event_freezable
|
|
793:23 argument_list|(
|
|
793:24 name|kauditd_wait
|
|
793:36 argument_list|,
|
|
794:10 operator|(
|
|
794:11 name|skb_queue_len
|
|
794:24 argument_list|(
|
|
794:25 operator|&
|
|
794:26 name|audit_queue
|
|
794:37 argument_list|)
|
|
794:39 condition|?
|
|
794:41 literal|1
|
|
794:43 else|:
|
|
794:45 literal|0
|
|
794:46 operator|)
|
|
794:47 argument_list|)
|
|
794:48 expr_stmt|;
|
|
795:2 block|}
|
|
797:2 return|return
|
|
797:9 literal|0
|
|
797:10 return|;
|
|
798:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
800:1 name|int
|
|
800:5 name|audit_send_list
|
|
800:20 parameter_list|(
|
|
800:21 name|void
|
|
800:26 modifier|*
|
|
800:27 name|_dest
|
|
800:32 parameter_list|)
|
|
801:1 block|{
|
|
802:2 name|struct
|
|
802:9 name|audit_netlink_list
|
|
802:28 modifier|*
|
|
802:29 name|dest
|
|
802:34 init|=
|
|
802:36 name|_dest
|
|
802:41 decl_stmt|;
|
|
803:2 name|struct
|
|
803:9 name|sk_buff
|
|
803:17 modifier|*
|
|
803:18 name|skb
|
|
803:21 decl_stmt|;
|
|
804:2 name|struct
|
|
804:9 name|sock
|
|
804:14 modifier|*
|
|
804:15 name|sk
|
|
804:18 init|=
|
|
804:20 name|audit_get_sk
|
|
804:32 argument_list|(
|
|
804:33 name|dest
|
|
804:37 operator|->
|
|
804:39 name|net
|
|
804:42 argument_list|)
|
|
804:43 decl_stmt|;
|
|
806:2 comment|/* wait for parent to finish and send an ACK */
|
|
807:2 name|mutex_lock
|
|
807:12 argument_list|(
|
|
807:13 operator|&
|
|
807:14 name|audit_cmd_mutex
|
|
807:29 argument_list|)
|
|
807:30 expr_stmt|;
|
|
808:2 name|mutex_unlock
|
|
808:14 argument_list|(
|
|
808:15 operator|&
|
|
808:16 name|audit_cmd_mutex
|
|
808:31 argument_list|)
|
|
808:32 expr_stmt|;
|
|
810:2 while|while
|
|
810:8 condition|(
|
|
810:9 operator|(
|
|
810:10 name|skb
|
|
810:14 operator|=
|
|
810:16 name|__skb_dequeue
|
|
810:29 argument_list|(
|
|
810:30 operator|&
|
|
810:31 name|dest
|
|
810:35 operator|->
|
|
810:37 name|q
|
|
810:38 argument_list|)
|
|
810:39 operator|)
|
|
810:41 operator|!=
|
|
810:44 name|NULL
|
|
810:48 condition|)
|
|
811:3 name|netlink_unicast
|
|
811:18 argument_list|(
|
|
811:19 name|sk
|
|
811:21 argument_list|,
|
|
811:23 name|skb
|
|
811:26 argument_list|,
|
|
811:28 name|dest
|
|
811:32 operator|->
|
|
811:34 name|portid
|
|
811:40 argument_list|,
|
|
811:42 literal|0
|
|
811:43 argument_list|)
|
|
811:44 expr_stmt|;
|
|
813:2 name|put_net
|
|
813:9 argument_list|(
|
|
813:10 name|dest
|
|
813:14 operator|->
|
|
813:16 name|net
|
|
813:19 argument_list|)
|
|
813:20 expr_stmt|;
|
|
814:2 name|kfree
|
|
814:7 argument_list|(
|
|
814:8 name|dest
|
|
814:12 argument_list|)
|
|
814:13 expr_stmt|;
|
|
816:2 return|return
|
|
816:9 literal|0
|
|
816:10 return|;
|
|
817:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
819:1 name|struct
|
|
819:8 name|sk_buff
|
|
819:16 modifier|*
|
|
819:17 name|audit_make_reply
|
|
819:33 parameter_list|(
|
|
819:34 name|__u32
|
|
819:40 name|portid
|
|
819:46 parameter_list|,
|
|
819:48 name|int
|
|
819:52 name|seq
|
|
819:55 parameter_list|,
|
|
819:57 name|int
|
|
819:61 name|type
|
|
819:65 parameter_list|,
|
|
819:67 name|int
|
|
819:71 name|done
|
|
819:75 parameter_list|,
|
|
820:6 name|int
|
|
820:10 name|multi
|
|
820:15 parameter_list|,
|
|
820:17 specifier|const
|
|
820:23 name|void
|
|
820:28 modifier|*
|
|
820:29 name|payload
|
|
820:36 parameter_list|,
|
|
820:38 name|int
|
|
820:42 name|size
|
|
820:46 parameter_list|)
|
|
821:1 block|{
|
|
822:2 name|struct
|
|
822:9 name|sk_buff
|
|
822:17 modifier|*
|
|
822:18 name|skb
|
|
822:21 decl_stmt|;
|
|
823:2 name|struct
|
|
823:9 name|nlmsghdr
|
|
823:18 modifier|*
|
|
823:19 name|nlh
|
|
823:22 decl_stmt|;
|
|
824:2 name|void
|
|
824:8 modifier|*
|
|
824:9 name|data
|
|
824:13 decl_stmt|;
|
|
825:2 name|int
|
|
825:7 name|flags
|
|
825:13 init|=
|
|
825:15 name|multi
|
|
825:21 condition|?
|
|
825:23 name|NLM_F_MULTI
|
|
825:35 else|:
|
|
825:37 literal|0
|
|
825:38 decl_stmt|;
|
|
826:2 name|int
|
|
826:7 name|t
|
|
826:13 init|=
|
|
826:15 name|done
|
|
826:21 condition|?
|
|
826:23 name|NLMSG_DONE
|
|
826:35 else|:
|
|
826:37 name|type
|
|
826:41 decl_stmt|;
|
|
828:2 name|skb
|
|
828:6 operator|=
|
|
828:8 name|nlmsg_new
|
|
828:17 argument_list|(
|
|
828:18 name|size
|
|
828:22 argument_list|,
|
|
828:24 name|GFP_KERNEL
|
|
828:34 argument_list|)
|
|
828:35 expr_stmt|;
|
|
829:2 if|if
|
|
829:5 condition|(
|
|
829:6 operator|!
|
|
829:7 name|skb
|
|
829:10 condition|)
|
|
830:3 return|return
|
|
830:10 name|NULL
|
|
830:14 return|;
|
|
832:2 name|nlh
|
|
832:6 operator|=
|
|
832:8 name|nlmsg_put
|
|
832:17 argument_list|(
|
|
832:18 name|skb
|
|
832:21 argument_list|,
|
|
832:23 name|portid
|
|
832:29 argument_list|,
|
|
832:31 name|seq
|
|
832:34 argument_list|,
|
|
832:36 name|t
|
|
832:37 argument_list|,
|
|
832:39 name|size
|
|
832:43 argument_list|,
|
|
832:45 name|flags
|
|
832:50 argument_list|)
|
|
832:51 expr_stmt|;
|
|
833:2 if|if
|
|
833:5 condition|(
|
|
833:6 operator|!
|
|
833:7 name|nlh
|
|
833:10 condition|)
|
|
834:3 goto|goto
|
|
834:8 name|out_kfree_skb
|
|
834:21 goto|;
|
|
835:2 name|data
|
|
835:7 operator|=
|
|
835:9 name|nlmsg_data
|
|
835:19 argument_list|(
|
|
835:20 name|nlh
|
|
835:23 argument_list|)
|
|
835:24 expr_stmt|;
|
|
836:2 name|memcpy
|
|
836:8 argument_list|(
|
|
836:9 name|data
|
|
836:13 argument_list|,
|
|
836:15 name|payload
|
|
836:22 argument_list|,
|
|
836:24 name|size
|
|
836:28 argument_list|)
|
|
836:29 expr_stmt|;
|
|
837:2 return|return
|
|
837:9 name|skb
|
|
837:12 return|;
|
|
839:1 name|out_kfree_skb
|
|
839:14 label|:
|
|
840:2 name|kfree_skb
|
|
840:11 argument_list|(
|
|
840:12 name|skb
|
|
840:15 argument_list|)
|
|
840:16 expr_stmt|;
|
|
841:2 return|return
|
|
841:9 name|NULL
|
|
841:13 return|;
|
|
842:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
844:1 specifier|static
|
|
844:8 name|int
|
|
844:12 name|audit_send_reply_thread
|
|
844:35 parameter_list|(
|
|
844:36 name|void
|
|
844:41 modifier|*
|
|
844:42 name|arg
|
|
844:45 parameter_list|)
|
|
845:1 block|{
|
|
846:2 name|struct
|
|
846:9 name|audit_reply
|
|
846:21 modifier|*
|
|
846:22 name|reply
|
|
846:28 init|=
|
|
846:30 operator|(
|
|
846:31 expr|struct
|
|
846:38 name|audit_reply
|
|
846:50 operator|*
|
|
846:51 operator|)
|
|
846:52 name|arg
|
|
846:55 decl_stmt|;
|
|
847:2 name|struct
|
|
847:9 name|sock
|
|
847:14 modifier|*
|
|
847:15 name|sk
|
|
847:18 init|=
|
|
847:20 name|audit_get_sk
|
|
847:32 argument_list|(
|
|
847:33 name|reply
|
|
847:38 operator|->
|
|
847:40 name|net
|
|
847:43 argument_list|)
|
|
847:44 decl_stmt|;
|
|
849:2 name|mutex_lock
|
|
849:12 argument_list|(
|
|
849:13 operator|&
|
|
849:14 name|audit_cmd_mutex
|
|
849:29 argument_list|)
|
|
849:30 expr_stmt|;
|
|
850:2 name|mutex_unlock
|
|
850:14 argument_list|(
|
|
850:15 operator|&
|
|
850:16 name|audit_cmd_mutex
|
|
850:31 argument_list|)
|
|
850:32 expr_stmt|;
|
|
852:2 comment|/* Ignore failure. It'll only happen if the sender goes away, because our timeout is set to infinite. */
|
|
854:2 name|netlink_unicast
|
|
854:17 argument_list|(
|
|
854:18 name|sk
|
|
854:20 argument_list|,
|
|
854:22 name|reply
|
|
854:27 operator|->
|
|
854:29 name|skb
|
|
854:32 argument_list|,
|
|
854:34 name|reply
|
|
854:39 operator|->
|
|
854:41 name|portid
|
|
854:47 argument_list|,
|
|
854:49 literal|0
|
|
854:50 argument_list|)
|
|
854:51 expr_stmt|;
|
|
855:2 name|put_net
|
|
855:9 argument_list|(
|
|
855:10 name|reply
|
|
855:15 operator|->
|
|
855:17 name|net
|
|
855:20 argument_list|)
|
|
855:21 expr_stmt|;
|
|
856:2 name|kfree
|
|
856:7 argument_list|(
|
|
856:8 name|reply
|
|
856:13 argument_list|)
|
|
856:14 expr_stmt|;
|
|
857:2 return|return
|
|
857:9 literal|0
|
|
857:10 return|;
|
|
858:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
860:1 comment|/** * audit_send_reply - send an audit reply message via netlink * @request_skb: skb of request we are replying to (used to target the reply) * @seq: sequence number * @type: audit message type * @done: done (last) flag * @multi: multi-part message flag * @payload: payload data * @size: payload size * * Allocates an skb, builds the netlink message, and sends it to the port id. * No failure notifications. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
873:1 specifier|static
|
|
873:8 name|void
|
|
873:13 name|audit_send_reply
|
|
873:29 parameter_list|(
|
|
873:30 name|struct
|
|
873:37 name|sk_buff
|
|
873:45 modifier|*
|
|
873:46 name|request_skb
|
|
873:57 parameter_list|,
|
|
873:59 name|int
|
|
873:63 name|seq
|
|
873:66 parameter_list|,
|
|
873:68 name|int
|
|
873:72 name|type
|
|
873:76 parameter_list|,
|
|
873:78 name|int
|
|
873:82 name|done
|
|
873:86 parameter_list|,
|
|
874:9 name|int
|
|
874:13 name|multi
|
|
874:18 parameter_list|,
|
|
874:20 specifier|const
|
|
874:26 name|void
|
|
874:31 modifier|*
|
|
874:32 name|payload
|
|
874:39 parameter_list|,
|
|
874:41 name|int
|
|
874:45 name|size
|
|
874:49 parameter_list|)
|
|
875:1 block|{
|
|
876:2 name|u32
|
|
876:6 name|portid
|
|
876:13 init|=
|
|
876:15 name|NETLINK_CB
|
|
876:25 argument_list|(
|
|
876:26 name|request_skb
|
|
876:37 argument_list|)
|
|
876:38 operator|.
|
|
876:39 name|portid
|
|
876:45 decl_stmt|;
|
|
877:2 name|struct
|
|
877:9 name|net
|
|
877:13 modifier|*
|
|
877:14 name|net
|
|
877:18 init|=
|
|
877:20 name|sock_net
|
|
877:28 argument_list|(
|
|
877:29 name|NETLINK_CB
|
|
877:39 argument_list|(
|
|
877:40 name|request_skb
|
|
877:51 argument_list|)
|
|
877:52 operator|.
|
|
877:53 name|sk
|
|
877:55 argument_list|)
|
|
877:56 decl_stmt|;
|
|
878:2 name|struct
|
|
878:9 name|sk_buff
|
|
878:17 modifier|*
|
|
878:18 name|skb
|
|
878:21 decl_stmt|;
|
|
879:2 name|struct
|
|
879:9 name|task_struct
|
|
879:21 modifier|*
|
|
879:22 name|tsk
|
|
879:25 decl_stmt|;
|
|
880:2 name|struct
|
|
880:9 name|audit_reply
|
|
880:21 modifier|*
|
|
880:22 name|reply
|
|
880:28 init|=
|
|
880:30 name|kmalloc
|
|
880:37 argument_list|(
|
|
880:38 sizeof|sizeof
|
|
880:44 argument_list|(
|
|
880:45 expr|struct
|
|
880:52 name|audit_reply
|
|
880:63 argument_list|)
|
|
880:64 argument_list|,
|
|
881:10 name|GFP_KERNEL
|
|
881:20 argument_list|)
|
|
881:21 decl_stmt|;
|
|
883:2 if|if
|
|
883:5 condition|(
|
|
883:6 operator|!
|
|
883:7 name|reply
|
|
883:12 condition|)
|
|
884:3 return|return;
|
|
886:2 name|skb
|
|
886:6 operator|=
|
|
886:8 name|audit_make_reply
|
|
886:24 argument_list|(
|
|
886:25 name|portid
|
|
886:31 argument_list|,
|
|
886:33 name|seq
|
|
886:36 argument_list|,
|
|
886:38 name|type
|
|
886:42 argument_list|,
|
|
886:44 name|done
|
|
886:48 argument_list|,
|
|
886:50 name|multi
|
|
886:55 argument_list|,
|
|
886:57 name|payload
|
|
886:64 argument_list|,
|
|
886:66 name|size
|
|
886:70 argument_list|)
|
|
886:71 expr_stmt|;
|
|
887:2 if|if
|
|
887:5 condition|(
|
|
887:6 operator|!
|
|
887:7 name|skb
|
|
887:10 condition|)
|
|
888:3 goto|goto
|
|
888:8 name|out
|
|
888:11 goto|;
|
|
890:2 name|reply
|
|
890:7 operator|->
|
|
890:9 name|net
|
|
890:13 operator|=
|
|
890:15 name|get_net
|
|
890:22 argument_list|(
|
|
890:23 name|net
|
|
890:26 argument_list|)
|
|
890:27 expr_stmt|;
|
|
891:2 name|reply
|
|
891:7 operator|->
|
|
891:9 name|portid
|
|
891:16 operator|=
|
|
891:18 name|portid
|
|
891:24 expr_stmt|;
|
|
892:2 name|reply
|
|
892:7 operator|->
|
|
892:9 name|skb
|
|
892:13 operator|=
|
|
892:15 name|skb
|
|
892:18 expr_stmt|;
|
|
894:2 name|tsk
|
|
894:6 operator|=
|
|
894:8 name|kthread_run
|
|
894:19 argument_list|(
|
|
894:20 name|audit_send_reply_thread
|
|
894:43 argument_list|,
|
|
894:45 name|reply
|
|
894:50 argument_list|,
|
|
894:52 literal|"audit_send_reply"
|
|
894:70 argument_list|)
|
|
894:71 expr_stmt|;
|
|
895:2 if|if
|
|
895:5 condition|(
|
|
895:6 operator|!
|
|
895:7 name|IS_ERR
|
|
895:13 argument_list|(
|
|
895:14 name|tsk
|
|
895:17 argument_list|)
|
|
895:18 condition|)
|
|
896:3 return|return;
|
|
897:2 name|kfree_skb
|
|
897:11 argument_list|(
|
|
897:12 name|skb
|
|
897:15 argument_list|)
|
|
897:16 expr_stmt|;
|
|
898:1 name|out
|
|
898:4 label|:
|
|
899:2 name|kfree
|
|
899:7 argument_list|(
|
|
899:8 name|reply
|
|
899:13 argument_list|)
|
|
899:14 expr_stmt|;
|
|
900:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
902:1 comment|/* * Check for appropriate CAP_AUDIT_ capabilities on incoming audit * control messages. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
906:1 specifier|static
|
|
906:8 name|int
|
|
906:12 name|audit_netlink_ok
|
|
906:28 parameter_list|(
|
|
906:29 name|struct
|
|
906:36 name|sk_buff
|
|
906:44 modifier|*
|
|
906:45 name|skb
|
|
906:48 parameter_list|,
|
|
906:50 name|u16
|
|
906:54 name|msg_type
|
|
906:62 parameter_list|)
|
|
907:1 block|{
|
|
908:2 name|int
|
|
908:6 name|err
|
|
908:10 init|=
|
|
908:12 literal|0
|
|
908:13 decl_stmt|;
|
|
910:2 comment|/* Only support initial user namespace for now. */
|
|
911:2 comment|/* * We return ECONNREFUSED because it tricks userspace into thinking * that audit was not configured into the kernel. Lots of users * configure their PAM stack (because that's what the distro does) * to reject login if unable to send messages to audit. If we return * ECONNREFUSED the PAM stack thinks the kernel does not have audit * configured in and will let login proceed. If we return EPERM * userspace will reject all logins. This should be removed when we * support non init namespaces!! */
|
|
921:2 if|if
|
|
921:5 condition|(
|
|
921:6 name|current_user_ns
|
|
921:21 argument_list|()
|
|
921:24 operator|!=
|
|
921:27 operator|&
|
|
921:28 name|init_user_ns
|
|
921:40 condition|)
|
|
922:3 return|return
|
|
922:10 operator|-
|
|
922:11 name|ECONNREFUSED
|
|
922:23 return|;
|
|
924:2 switch|switch
|
|
924:9 condition|(
|
|
924:10 name|msg_type
|
|
924:18 condition|)
|
|
924:20 block|{
|
|
925:2 case|case
|
|
925:7 name|AUDIT_LIST
|
|
925:17 case|:
|
|
926:2 case|case
|
|
926:7 name|AUDIT_ADD
|
|
926:16 case|:
|
|
927:2 case|case
|
|
927:7 name|AUDIT_DEL
|
|
927:16 case|:
|
|
928:3 return|return
|
|
928:10 operator|-
|
|
928:11 name|EOPNOTSUPP
|
|
928:21 return|;
|
|
929:2 case|case
|
|
929:7 name|AUDIT_GET
|
|
929:16 case|:
|
|
930:2 case|case
|
|
930:7 name|AUDIT_SET
|
|
930:16 case|:
|
|
931:2 case|case
|
|
931:7 name|AUDIT_GET_FEATURE
|
|
931:24 case|:
|
|
932:2 case|case
|
|
932:7 name|AUDIT_SET_FEATURE
|
|
932:24 case|:
|
|
933:2 case|case
|
|
933:7 name|AUDIT_LIST_RULES
|
|
933:23 case|:
|
|
934:2 case|case
|
|
934:7 name|AUDIT_ADD_RULE
|
|
934:21 case|:
|
|
935:2 case|case
|
|
935:7 name|AUDIT_DEL_RULE
|
|
935:21 case|:
|
|
936:2 case|case
|
|
936:7 name|AUDIT_SIGNAL_INFO
|
|
936:24 case|:
|
|
937:2 case|case
|
|
937:7 name|AUDIT_TTY_GET
|
|
937:20 case|:
|
|
938:2 case|case
|
|
938:7 name|AUDIT_TTY_SET
|
|
938:20 case|:
|
|
939:2 case|case
|
|
939:7 name|AUDIT_TRIM
|
|
939:17 case|:
|
|
940:2 case|case
|
|
940:7 name|AUDIT_MAKE_EQUIV
|
|
940:23 case|:
|
|
941:3 comment|/* Only support auditd and auditctl in initial pid namespace * for now. */
|
|
943:3 if|if
|
|
943:6 condition|(
|
|
943:7 name|task_active_pid_ns
|
|
943:25 argument_list|(
|
|
943:26 name|current
|
|
943:33 argument_list|)
|
|
943:35 operator|!=
|
|
943:38 operator|&
|
|
943:39 name|init_pid_ns
|
|
943:50 condition|)
|
|
944:4 return|return
|
|
944:11 operator|-
|
|
944:12 name|EPERM
|
|
944:17 return|;
|
|
946:3 if|if
|
|
946:6 condition|(
|
|
946:7 operator|!
|
|
946:8 name|netlink_capable
|
|
946:23 argument_list|(
|
|
946:24 name|skb
|
|
946:27 argument_list|,
|
|
946:29 name|CAP_AUDIT_CONTROL
|
|
946:46 argument_list|)
|
|
946:47 condition|)
|
|
947:4 name|err
|
|
947:8 operator|=
|
|
947:10 operator|-
|
|
947:11 name|EPERM
|
|
947:16 expr_stmt|;
|
|
948:3 break|break;
|
|
949:2 case|case
|
|
949:7 name|AUDIT_USER
|
|
949:17 case|:
|
|
950:2 case|case
|
|
950:7 name|AUDIT_FIRST_USER_MSG
|
|
950:28 operator|...
|
|
950:32 name|AUDIT_LAST_USER_MSG
|
|
950:51 case|:
|
|
951:2 case|case
|
|
951:7 name|AUDIT_FIRST_USER_MSG2
|
|
951:29 operator|...
|
|
951:33 name|AUDIT_LAST_USER_MSG2
|
|
951:53 case|:
|
|
952:3 if|if
|
|
952:6 condition|(
|
|
952:7 operator|!
|
|
952:8 name|netlink_capable
|
|
952:23 argument_list|(
|
|
952:24 name|skb
|
|
952:27 argument_list|,
|
|
952:29 name|CAP_AUDIT_WRITE
|
|
952:44 argument_list|)
|
|
952:45 condition|)
|
|
953:4 name|err
|
|
953:8 operator|=
|
|
953:10 operator|-
|
|
953:11 name|EPERM
|
|
953:16 expr_stmt|;
|
|
954:3 break|break;
|
|
955:2 default|default:
|
|
955:12 comment|/* bad msg */
|
|
956:3 name|err
|
|
956:7 operator|=
|
|
956:9 operator|-
|
|
956:10 name|EINVAL
|
|
956:16 expr_stmt|;
|
|
957:2 block|}
|
|
959:2 return|return
|
|
959:9 name|err
|
|
959:12 return|;
|
|
960:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
962:1 specifier|static
|
|
962:8 name|void
|
|
962:13 name|audit_log_common_recv_msg
|
|
962:38 parameter_list|(
|
|
962:39 name|struct
|
|
962:46 name|audit_buffer
|
|
962:59 modifier|*
|
|
962:60 modifier|*
|
|
962:61 name|ab
|
|
962:63 parameter_list|,
|
|
962:65 name|u16
|
|
962:69 name|msg_type
|
|
962:77 parameter_list|)
|
|
963:1 block|{
|
|
964:2 name|uid_t
|
|
964:8 name|uid
|
|
964:12 init|=
|
|
964:14 name|from_kuid
|
|
964:23 argument_list|(
|
|
964:24 operator|&
|
|
964:25 name|init_user_ns
|
|
964:37 argument_list|,
|
|
964:39 name|current_uid
|
|
964:50 argument_list|()
|
|
964:52 argument_list|)
|
|
964:53 decl_stmt|;
|
|
965:2 name|pid_t
|
|
965:8 name|pid
|
|
965:12 init|=
|
|
965:14 name|task_tgid_nr
|
|
965:26 argument_list|(
|
|
965:27 name|current
|
|
965:34 argument_list|)
|
|
965:35 decl_stmt|;
|
|
967:2 if|if
|
|
967:5 condition|(
|
|
967:6 operator|!
|
|
967:7 name|audit_enabled
|
|
967:21 operator|&&
|
|
967:24 name|msg_type
|
|
967:33 operator|!=
|
|
967:36 name|AUDIT_USER_AVC
|
|
967:50 condition|)
|
|
967:52 block|{
|
|
968:3 operator|*
|
|
968:4 name|ab
|
|
968:7 operator|=
|
|
968:9 name|NULL
|
|
968:13 expr_stmt|;
|
|
969:3 return|return;
|
|
970:2 block|}
|
|
972:2 operator|*
|
|
972:3 name|ab
|
|
972:6 operator|=
|
|
972:8 name|audit_log_start
|
|
972:23 argument_list|(
|
|
972:24 name|NULL
|
|
972:28 argument_list|,
|
|
972:30 name|GFP_KERNEL
|
|
972:40 argument_list|,
|
|
972:42 name|msg_type
|
|
972:50 argument_list|)
|
|
972:51 expr_stmt|;
|
|
973:2 if|if
|
|
973:5 condition|(
|
|
973:6 name|unlikely
|
|
973:14 argument_list|(
|
|
973:15 operator|!
|
|
973:16 operator|*
|
|
973:17 name|ab
|
|
973:19 argument_list|)
|
|
973:20 condition|)
|
|
974:3 return|return;
|
|
975:2 name|audit_log_format
|
|
975:18 argument_list|(
|
|
975:19 operator|*
|
|
975:20 name|ab
|
|
975:22 argument_list|,
|
|
975:24 literal|"pid=%d uid=%u"
|
|
975:39 argument_list|,
|
|
975:41 name|pid
|
|
975:44 argument_list|,
|
|
975:46 name|uid
|
|
975:49 argument_list|)
|
|
975:50 expr_stmt|;
|
|
976:2 name|audit_log_session_info
|
|
976:24 argument_list|(
|
|
976:25 operator|*
|
|
976:26 name|ab
|
|
976:28 argument_list|)
|
|
976:29 expr_stmt|;
|
|
977:2 name|audit_log_task_context
|
|
977:24 argument_list|(
|
|
977:25 operator|*
|
|
977:26 name|ab
|
|
977:28 argument_list|)
|
|
977:29 expr_stmt|;
|
|
978:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
980:1 name|int
|
|
980:5 name|is_audit_feature_set
|
|
980:25 parameter_list|(
|
|
980:26 name|int
|
|
980:30 name|i
|
|
980:31 parameter_list|)
|
|
981:1 block|{
|
|
982:2 return|return
|
|
982:9 name|af
|
|
982:11 operator|.
|
|
982:12 name|features
|
|
982:21 operator|&
|
|
982:23 name|AUDIT_FEATURE_TO_MASK
|
|
982:44 argument_list|(
|
|
982:45 name|i
|
|
982:46 argument_list|)
|
|
982:47 return|;
|
|
983:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
986:1 specifier|static
|
|
986:8 name|int
|
|
986:12 name|audit_get_feature
|
|
986:29 parameter_list|(
|
|
986:30 name|struct
|
|
986:37 name|sk_buff
|
|
986:45 modifier|*
|
|
986:46 name|skb
|
|
986:49 parameter_list|)
|
|
987:1 block|{
|
|
988:2 name|u32
|
|
988:6 name|seq
|
|
988:9 decl_stmt|;
|
|
990:2 name|seq
|
|
990:6 operator|=
|
|
990:8 name|nlmsg_hdr
|
|
990:17 argument_list|(
|
|
990:18 name|skb
|
|
990:21 argument_list|)
|
|
990:22 operator|->
|
|
990:24 name|nlmsg_seq
|
|
990:33 expr_stmt|;
|
|
992:2 name|audit_send_reply
|
|
992:18 argument_list|(
|
|
992:19 name|skb
|
|
992:22 argument_list|,
|
|
992:24 name|seq
|
|
992:27 argument_list|,
|
|
992:29 name|AUDIT_GET_FEATURE
|
|
992:46 argument_list|,
|
|
992:48 literal|0
|
|
992:49 argument_list|,
|
|
992:51 literal|0
|
|
992:52 argument_list|,
|
|
992:54 operator|&
|
|
992:55 name|af
|
|
992:57 argument_list|,
|
|
992:59 sizeof|sizeof
|
|
992:65 argument_list|(
|
|
992:66 name|af
|
|
992:68 argument_list|)
|
|
992:69 argument_list|)
|
|
992:70 expr_stmt|;
|
|
994:2 return|return
|
|
994:9 literal|0
|
|
994:10 return|;
|
|
995:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
997:1 specifier|static
|
|
997:8 name|void
|
|
997:13 name|audit_log_feature_change
|
|
997:37 parameter_list|(
|
|
997:38 name|int
|
|
997:42 name|which
|
|
997:47 parameter_list|,
|
|
997:49 name|u32
|
|
997:53 name|old_feature
|
|
997:64 parameter_list|,
|
|
997:66 name|u32
|
|
997:70 name|new_feature
|
|
997:81 parameter_list|,
|
|
998:10 name|u32
|
|
998:14 name|old_lock
|
|
998:22 parameter_list|,
|
|
998:24 name|u32
|
|
998:28 name|new_lock
|
|
998:36 parameter_list|,
|
|
998:38 name|int
|
|
998:42 name|res
|
|
998:45 parameter_list|)
|
|
999:1 block|{
|
|
1000:2 name|struct
|
|
1000:9 name|audit_buffer
|
|
1000:22 modifier|*
|
|
1000:23 name|ab
|
|
1000:25 decl_stmt|;
|
|
1002:2 if|if
|
|
1002:5 condition|(
|
|
1002:6 name|audit_enabled
|
|
1002:20 operator|==
|
|
1002:23 name|AUDIT_OFF
|
|
1002:32 condition|)
|
|
1003:3 return|return;
|
|
1005:2 name|ab
|
|
1005:5 operator|=
|
|
1005:7 name|audit_log_start
|
|
1005:22 argument_list|(
|
|
1005:23 name|NULL
|
|
1005:27 argument_list|,
|
|
1005:29 name|GFP_KERNEL
|
|
1005:39 argument_list|,
|
|
1005:41 name|AUDIT_FEATURE_CHANGE
|
|
1005:61 argument_list|)
|
|
1005:62 expr_stmt|;
|
|
1006:2 name|audit_log_task_info
|
|
1006:21 argument_list|(
|
|
1006:22 name|ab
|
|
1006:24 argument_list|,
|
|
1006:26 name|current
|
|
1006:33 argument_list|)
|
|
1006:34 expr_stmt|;
|
|
1007:2 name|audit_log_format
|
|
1007:18 argument_list|(
|
|
1007:19 name|ab
|
|
1007:21 argument_list|,
|
|
1007:23 literal|" feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d"
|
|
1007:81 argument_list|,
|
|
1008:5 name|audit_feature_names
|
|
1008:24 index|[
|
|
1008:25 name|which
|
|
1008:30 index|]
|
|
1008:31 argument_list|,
|
|
1008:33 operator|!
|
|
1008:34 operator|!
|
|
1008:35 name|old_feature
|
|
1008:46 argument_list|,
|
|
1008:48 operator|!
|
|
1008:49 operator|!
|
|
1008:50 name|new_feature
|
|
1008:61 argument_list|,
|
|
1009:5 operator|!
|
|
1009:6 operator|!
|
|
1009:7 name|old_lock
|
|
1009:15 argument_list|,
|
|
1009:17 operator|!
|
|
1009:18 operator|!
|
|
1009:19 name|new_lock
|
|
1009:27 argument_list|,
|
|
1009:29 name|res
|
|
1009:32 argument_list|)
|
|
1009:33 expr_stmt|;
|
|
1010:2 name|audit_log_end
|
|
1010:15 argument_list|(
|
|
1010:16 name|ab
|
|
1010:18 argument_list|)
|
|
1010:19 expr_stmt|;
|
|
1011:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
1013:1 specifier|static
|
|
1013:8 name|int
|
|
1013:12 name|audit_set_feature
|
|
1013:29 parameter_list|(
|
|
1013:30 name|struct
|
|
1013:37 name|sk_buff
|
|
1013:45 modifier|*
|
|
1013:46 name|skb
|
|
1013:49 parameter_list|)
|
|
1014:1 block|{
|
|
1015:2 name|struct
|
|
1015:9 name|audit_features
|
|
1015:24 modifier|*
|
|
1015:25 name|uaf
|
|
1015:28 decl_stmt|;
|
|
1016:2 name|int
|
|
1016:6 name|i
|
|
1016:7 decl_stmt|;
|
|
1018:2 name|BUILD_BUG_ON
|
|
1018:14 argument_list|(
|
|
1018:15 name|AUDIT_LAST_FEATURE
|
|
1018:34 operator|+
|
|
1018:36 literal|1
|
|
1018:38 operator|>
|
|
1018:40 name|ARRAY_SIZE
|
|
1018:50 argument_list|(
|
|
1018:51 name|audit_feature_names
|
|
1018:70 argument_list|)
|
|
1018:71 argument_list|)
|
|
1018:72 expr_stmt|;
|
|
1019:2 name|uaf
|
|
1019:6 operator|=
|
|
1019:8 name|nlmsg_data
|
|
1019:18 argument_list|(
|
|
1019:19 name|nlmsg_hdr
|
|
1019:28 argument_list|(
|
|
1019:29 name|skb
|
|
1019:32 argument_list|)
|
|
1019:33 argument_list|)
|
|
1019:34 expr_stmt|;
|
|
1021:2 comment|/* if there is ever a version 2 we should handle that here */
|
|
1023:2 for|for
|
|
1023:6 control|(
|
|
1023:7 name|i
|
|
1023:9 operator|=
|
|
1023:11 literal|0
|
|
1023:12 init|;
|
|
1023:14 name|i
|
|
1023:16 operator|<=
|
|
1023:19 name|AUDIT_LAST_FEATURE
|
|
1023:37 condition|;
|
|
1023:39 name|i
|
|
1023:40 operator|++
|
|
1023:42 control|)
|
|
1023:44 block|{
|
|
1024:3 name|u32
|
|
1024:7 name|feature
|
|
1024:15 init|=
|
|
1024:17 name|AUDIT_FEATURE_TO_MASK
|
|
1024:38 argument_list|(
|
|
1024:39 name|i
|
|
1024:40 argument_list|)
|
|
1024:41 decl_stmt|;
|
|
1025:3 name|u32
|
|
1025:7 name|old_feature
|
|
1025:18 decl_stmt|,
|
|
1025:20 name|new_feature
|
|
1025:31 decl_stmt|,
|
|
1025:33 name|old_lock
|
|
1025:41 decl_stmt|,
|
|
1025:43 name|new_lock
|
|
1025:51 decl_stmt|;
|
|
1027:3 comment|/* if we are not changing this feature, move along */
|
|
1028:3 if|if
|
|
1028:6 condition|(
|
|
1028:7 operator|!
|
|
1028:8 operator|(
|
|
1028:9 name|feature
|
|
1028:17 operator|&
|
|
1028:19 name|uaf
|
|
1028:22 operator|->
|
|
1028:24 name|mask
|
|
1028:28 operator|)
|
|
1028:29 condition|)
|
|
1029:4 continue|continue;
|
|
1031:3 name|old_feature
|
|
1031:15 operator|=
|
|
1031:17 name|af
|
|
1031:19 operator|.
|
|
1031:20 name|features
|
|
1031:29 operator|&
|
|
1031:31 name|feature
|
|
1031:38 expr_stmt|;
|
|
1032:3 name|new_feature
|
|
1032:15 operator|=
|
|
1032:17 name|uaf
|
|
1032:20 operator|->
|
|
1032:22 name|features
|
|
1032:31 operator|&
|
|
1032:33 name|feature
|
|
1032:40 expr_stmt|;
|
|
1033:3 name|new_lock
|
|
1033:12 operator|=
|
|
1033:14 operator|(
|
|
1033:15 name|uaf
|
|
1033:18 operator|->
|
|
1033:20 name|lock
|
|
1033:25 operator||
|
|
1033:27 name|af
|
|
1033:29 operator|.
|
|
1033:30 name|lock
|
|
1033:34 operator|)
|
|
1033:36 operator|&
|
|
1033:38 name|feature
|
|
1033:45 expr_stmt|;
|
|
1034:3 name|old_lock
|
|
1034:12 operator|=
|
|
1034:14 name|af
|
|
1034:16 operator|.
|
|
1034:17 name|lock
|
|
1034:22 operator|&
|
|
1034:24 name|feature
|
|
1034:31 expr_stmt|;
|
|
1036:3 comment|/* are we changing a locked feature? */
|
|
1037:3 if|if
|
|
1037:6 condition|(
|
|
1037:7 name|old_lock
|
|
1037:16 operator|&&
|
|
1037:19 operator|(
|
|
1037:20 name|new_feature
|
|
1037:32 operator|!=
|
|
1037:35 name|old_feature
|
|
1037:46 operator|)
|
|
1037:47 condition|)
|
|
1037:49 block|{
|
|
1038:4 name|audit_log_feature_change
|
|
1038:28 argument_list|(
|
|
1038:29 name|i
|
|
1038:30 argument_list|,
|
|
1038:32 name|old_feature
|
|
1038:43 argument_list|,
|
|
1038:45 name|new_feature
|
|
1038:56 argument_list|,
|
|
1039:8 name|old_lock
|
|
1039:16 argument_list|,
|
|
1039:18 name|new_lock
|
|
1039:26 argument_list|,
|
|
1039:28 literal|0
|
|
1039:29 argument_list|)
|
|
1039:30 expr_stmt|;
|
|
1040:4 return|return
|
|
1040:11 operator|-
|
|
1040:12 name|EPERM
|
|
1040:17 return|;
|
|
1041:3 block|}
|
|
1042:2 block|}
|
|
1043:2 comment|/* nothing invalid, do the changes */
|
|
1044:2 for|for
|
|
1044:6 control|(
|
|
1044:7 name|i
|
|
1044:9 operator|=
|
|
1044:11 literal|0
|
|
1044:12 init|;
|
|
1044:14 name|i
|
|
1044:16 operator|<=
|
|
1044:19 name|AUDIT_LAST_FEATURE
|
|
1044:37 condition|;
|
|
1044:39 name|i
|
|
1044:40 operator|++
|
|
1044:42 control|)
|
|
1044:44 block|{
|
|
1045:3 name|u32
|
|
1045:7 name|feature
|
|
1045:15 init|=
|
|
1045:17 name|AUDIT_FEATURE_TO_MASK
|
|
1045:38 argument_list|(
|
|
1045:39 name|i
|
|
1045:40 argument_list|)
|
|
1045:41 decl_stmt|;
|
|
1046:3 name|u32
|
|
1046:7 name|old_feature
|
|
1046:18 decl_stmt|,
|
|
1046:20 name|new_feature
|
|
1046:31 decl_stmt|,
|
|
1046:33 name|old_lock
|
|
1046:41 decl_stmt|,
|
|
1046:43 name|new_lock
|
|
1046:51 decl_stmt|;
|
|
1048:3 comment|/* if we are not changing this feature, move along */
|
|
1049:3 if|if
|
|
1049:6 condition|(
|
|
1049:7 operator|!
|
|
1049:8 operator|(
|
|
1049:9 name|feature
|
|
1049:17 operator|&
|
|
1049:19 name|uaf
|
|
1049:22 operator|->
|
|
1049:24 name|mask
|
|
1049:28 operator|)
|
|
1049:29 condition|)
|
|
1050:4 continue|continue;
|
|
1052:3 name|old_feature
|
|
1052:15 operator|=
|
|
1052:17 name|af
|
|
1052:19 operator|.
|
|
1052:20 name|features
|
|
1052:29 operator|&
|
|
1052:31 name|feature
|
|
1052:38 expr_stmt|;
|
|
1053:3 name|new_feature
|
|
1053:15 operator|=
|
|
1053:17 name|uaf
|
|
1053:20 operator|->
|
|
1053:22 name|features
|
|
1053:31 operator|&
|
|
1053:33 name|feature
|
|
1053:40 expr_stmt|;
|
|
1054:3 name|old_lock
|
|
1054:12 operator|=
|
|
1054:14 name|af
|
|
1054:16 operator|.
|
|
1054:17 name|lock
|
|
1054:22 operator|&
|
|
1054:24 name|feature
|
|
1054:31 expr_stmt|;
|
|
1055:3 name|new_lock
|
|
1055:12 operator|=
|
|
1055:14 operator|(
|
|
1055:15 name|uaf
|
|
1055:18 operator|->
|
|
1055:20 name|lock
|
|
1055:25 operator||
|
|
1055:27 name|af
|
|
1055:29 operator|.
|
|
1055:30 name|lock
|
|
1055:34 operator|)
|
|
1055:36 operator|&
|
|
1055:38 name|feature
|
|
1055:45 expr_stmt|;
|
|
1057:3 if|if
|
|
1057:6 condition|(
|
|
1057:7 name|new_feature
|
|
1057:19 operator|!=
|
|
1057:22 name|old_feature
|
|
1057:33 condition|)
|
|
1058:4 name|audit_log_feature_change
|
|
1058:28 argument_list|(
|
|
1058:29 name|i
|
|
1058:30 argument_list|,
|
|
1058:32 name|old_feature
|
|
1058:43 argument_list|,
|
|
1058:45 name|new_feature
|
|
1058:56 argument_list|,
|
|
1059:8 name|old_lock
|
|
1059:16 argument_list|,
|
|
1059:18 name|new_lock
|
|
1059:26 argument_list|,
|
|
1059:28 literal|1
|
|
1059:29 argument_list|)
|
|
1059:30 expr_stmt|;
|
|
1061:3 if|if
|
|
1061:6 condition|(
|
|
1061:7 name|new_feature
|
|
1061:18 condition|)
|
|
1062:4 name|af
|
|
1062:6 operator|.
|
|
1062:7 name|features
|
|
1062:16 operator||=
|
|
1062:19 name|feature
|
|
1062:26 expr_stmt|;
|
|
1063:3 else|else
|
|
1064:4 name|af
|
|
1064:6 operator|.
|
|
1064:7 name|features
|
|
1064:16 operator|&=
|
|
1064:19 operator|~
|
|
1064:20 name|feature
|
|
1064:27 expr_stmt|;
|
|
1065:3 name|af
|
|
1065:5 operator|.
|
|
1065:6 name|lock
|
|
1065:11 operator||=
|
|
1065:14 name|new_lock
|
|
1065:22 expr_stmt|;
|
|
1066:2 block|}
|
|
1068:2 return|return
|
|
1068:9 literal|0
|
|
1068:10 return|;
|
|
1069:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
1071:1 specifier|static
|
|
1071:8 name|int
|
|
1071:12 name|audit_replace
|
|
1071:25 parameter_list|(
|
|
1071:26 name|pid_t
|
|
1071:32 name|pid
|
|
1071:35 parameter_list|)
|
|
1072:1 block|{
|
|
1073:2 name|struct
|
|
1073:9 name|sk_buff
|
|
1073:17 modifier|*
|
|
1073:18 name|skb
|
|
1073:21 decl_stmt|;
|
|
1075:2 name|skb
|
|
1075:6 operator|=
|
|
1075:8 name|audit_make_reply
|
|
1075:24 argument_list|(
|
|
1075:25 literal|0
|
|
1075:26 argument_list|,
|
|
1075:28 literal|0
|
|
1075:29 argument_list|,
|
|
1075:31 name|AUDIT_REPLACE
|
|
1075:44 argument_list|,
|
|
1075:46 literal|0
|
|
1075:47 argument_list|,
|
|
1075:49 literal|0
|
|
1075:50 argument_list|,
|
|
1075:52 operator|&
|
|
1075:53 name|pid
|
|
1075:56 argument_list|,
|
|
1075:58 sizeof|sizeof
|
|
1075:64 argument_list|(
|
|
1075:65 name|pid
|
|
1075:68 argument_list|)
|
|
1075:69 argument_list|)
|
|
1075:70 expr_stmt|;
|
|
1076:2 if|if
|
|
1076:5 condition|(
|
|
1076:6 operator|!
|
|
1076:7 name|skb
|
|
1076:10 condition|)
|
|
1077:3 return|return
|
|
1077:10 operator|-
|
|
1077:11 name|ENOMEM
|
|
1077:17 return|;
|
|
1078:2 return|return
|
|
1078:9 name|auditd_send_unicast_skb
|
|
1078:32 argument_list|(
|
|
1078:33 name|skb
|
|
1078:36 argument_list|)
|
|
1078:37 return|;
|
|
1079:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
1081:1 specifier|static
|
|
1081:8 name|int
|
|
1081:12 name|audit_receive_msg
|
|
1081:29 parameter_list|(
|
|
1081:30 name|struct
|
|
1081:37 name|sk_buff
|
|
1081:45 modifier|*
|
|
1081:46 name|skb
|
|
1081:49 parameter_list|,
|
|
1081:51 name|struct
|
|
1081:58 name|nlmsghdr
|
|
1081:67 modifier|*
|
|
1081:68 name|nlh
|
|
1081:71 parameter_list|)
|
|
1082:1 block|{
|
|
1083:2 name|u32
|
|
1083:8 name|seq
|
|
1083:11 decl_stmt|;
|
|
1084:2 name|void
|
|
1084:9 modifier|*
|
|
1084:10 name|data
|
|
1084:14 decl_stmt|;
|
|
1085:2 name|int
|
|
1085:8 name|err
|
|
1085:11 decl_stmt|;
|
|
1086:2 name|struct
|
|
1086:9 name|audit_buffer
|
|
1086:22 modifier|*
|
|
1086:23 name|ab
|
|
1086:25 decl_stmt|;
|
|
1087:2 name|u16
|
|
1087:8 name|msg_type
|
|
1087:17 init|=
|
|
1087:19 name|nlh
|
|
1087:22 operator|->
|
|
1087:24 name|nlmsg_type
|
|
1087:34 decl_stmt|;
|
|
1088:2 name|struct
|
|
1088:9 name|audit_sig_info
|
|
1088:26 modifier|*
|
|
1088:27 name|sig_data
|
|
1088:35 decl_stmt|;
|
|
1089:2 name|char
|
|
1089:9 modifier|*
|
|
1089:10 name|ctx
|
|
1089:14 init|=
|
|
1089:16 name|NULL
|
|
1089:20 decl_stmt|;
|
|
1090:2 name|u32
|
|
1090:8 name|len
|
|
1090:11 decl_stmt|;
|
|
1092:2 name|err
|
|
1092:6 operator|=
|
|
1092:8 name|audit_netlink_ok
|
|
1092:24 argument_list|(
|
|
1092:25 name|skb
|
|
1092:28 argument_list|,
|
|
1092:30 name|msg_type
|
|
1092:38 argument_list|)
|
|
1092:39 expr_stmt|;
|
|
1093:2 if|if
|
|
1093:5 condition|(
|
|
1093:6 name|err
|
|
1093:9 condition|)
|
|
1094:3 return|return
|
|
1094:10 name|err
|
|
1094:13 return|;
|
|
1096:2 name|seq
|
|
1096:7 operator|=
|
|
1096:9 name|nlh
|
|
1096:12 operator|->
|
|
1096:14 name|nlmsg_seq
|
|
1096:23 expr_stmt|;
|
|
1097:2 name|data
|
|
1097:7 operator|=
|
|
1097:9 name|nlmsg_data
|
|
1097:19 argument_list|(
|
|
1097:20 name|nlh
|
|
1097:23 argument_list|)
|
|
1097:24 expr_stmt|;
|
|
1099:2 switch|switch
|
|
1099:9 condition|(
|
|
1099:10 name|msg_type
|
|
1099:18 condition|)
|
|
1099:20 block|{
|
|
1100:2 case|case
|
|
1100:7 name|AUDIT_GET
|
|
1100:16 case|:
|
|
1100:18 block|{
|
|
1101:3 name|struct
|
|
1101:10 name|audit_status
|
|
1101:23 name|s
|
|
1101:24 decl_stmt|;
|
|
1102:3 name|memset
|
|
1102:9 argument_list|(
|
|
1102:10 operator|&
|
|
1102:11 name|s
|
|
1102:12 argument_list|,
|
|
1102:14 literal|0
|
|
1102:15 argument_list|,
|
|
1102:17 sizeof|sizeof
|
|
1102:23 argument_list|(
|
|
1102:24 name|s
|
|
1102:25 argument_list|)
|
|
1102:26 argument_list|)
|
|
1102:27 expr_stmt|;
|
|
1103:3 name|s
|
|
1103:4 operator|.
|
|
1103:5 name|enabled
|
|
1103:14 operator|=
|
|
1103:16 name|audit_enabled
|
|
1103:29 expr_stmt|;
|
|
1104:3 name|s
|
|
1104:4 operator|.
|
|
1104:5 name|failure
|
|
1104:14 operator|=
|
|
1104:16 name|audit_failure
|
|
1104:29 expr_stmt|;
|
|
1105:3 name|rcu_read_lock
|
|
1105:16 argument_list|()
|
|
1105:18 expr_stmt|;
|
|
1106:3 name|s
|
|
1106:4 operator|.
|
|
1106:5 name|pid
|
|
1106:11 operator|=
|
|
1106:13 name|auditd_conn
|
|
1106:24 operator|.
|
|
1106:25 name|pid
|
|
1106:28 expr_stmt|;
|
|
1107:3 name|rcu_read_unlock
|
|
1107:18 argument_list|()
|
|
1107:20 expr_stmt|;
|
|
1108:3 name|s
|
|
1108:4 operator|.
|
|
1108:5 name|rate_limit
|
|
1108:17 operator|=
|
|
1108:19 name|audit_rate_limit
|
|
1108:35 expr_stmt|;
|
|
1109:3 name|s
|
|
1109:4 operator|.
|
|
1109:5 name|backlog_limit
|
|
1109:20 operator|=
|
|
1109:22 name|audit_backlog_limit
|
|
1109:41 expr_stmt|;
|
|
1110:3 name|s
|
|
1110:4 operator|.
|
|
1110:5 name|lost
|
|
1110:12 operator|=
|
|
1110:14 name|atomic_read
|
|
1110:25 argument_list|(
|
|
1110:26 operator|&
|
|
1110:27 name|audit_lost
|
|
1110:37 argument_list|)
|
|
1110:38 expr_stmt|;
|
|
1111:3 name|s
|
|
1111:4 operator|.
|
|
1111:5 name|backlog
|
|
1111:14 operator|=
|
|
1111:16 name|skb_queue_len
|
|
1111:29 argument_list|(
|
|
1111:30 operator|&
|
|
1111:31 name|audit_queue
|
|
1111:42 argument_list|)
|
|
1111:43 expr_stmt|;
|
|
1112:3 name|s
|
|
1112:4 operator|.
|
|
1112:5 name|feature_bitmap
|
|
1112:20 operator|=
|
|
1112:22 name|AUDIT_FEATURE_BITMAP_ALL
|
|
1112:46 expr_stmt|;
|
|
1113:3 name|s
|
|
1113:4 operator|.
|
|
1113:5 name|backlog_wait_time
|
|
1113:23 operator|=
|
|
1113:25 name|audit_backlog_wait_time
|
|
1113:48 expr_stmt|;
|
|
1114:3 name|audit_send_reply
|
|
1114:19 argument_list|(
|
|
1114:20 name|skb
|
|
1114:23 argument_list|,
|
|
1114:25 name|seq
|
|
1114:28 argument_list|,
|
|
1114:30 name|AUDIT_GET
|
|
1114:39 argument_list|,
|
|
1114:41 literal|0
|
|
1114:42 argument_list|,
|
|
1114:44 literal|0
|
|
1114:45 argument_list|,
|
|
1114:47 operator|&
|
|
1114:48 name|s
|
|
1114:49 argument_list|,
|
|
1114:51 sizeof|sizeof
|
|
1114:57 argument_list|(
|
|
1114:58 name|s
|
|
1114:59 argument_list|)
|
|
1114:60 argument_list|)
|
|
1114:61 expr_stmt|;
|
|
1115:3 break|break;
|
|
1116:2 block|}
|
|
1117:2 case|case
|
|
1117:7 name|AUDIT_SET
|
|
1117:16 case|:
|
|
1117:18 block|{
|
|
1118:3 name|struct
|
|
1118:10 name|audit_status
|
|
1118:23 name|s
|
|
1118:24 decl_stmt|;
|
|
1119:3 name|memset
|
|
1119:9 argument_list|(
|
|
1119:10 operator|&
|
|
1119:11 name|s
|
|
1119:12 argument_list|,
|
|
1119:14 literal|0
|
|
1119:15 argument_list|,
|
|
1119:17 sizeof|sizeof
|
|
1119:23 argument_list|(
|
|
1119:24 name|s
|
|
1119:25 argument_list|)
|
|
1119:26 argument_list|)
|
|
1119:27 expr_stmt|;
|
|
1120:3 comment|/* guard against past and future API changes */
|
|
1121:3 name|memcpy
|
|
1121:9 argument_list|(
|
|
1121:10 operator|&
|
|
1121:11 name|s
|
|
1121:12 argument_list|,
|
|
1121:14 name|data
|
|
1121:18 argument_list|,
|
|
1121:20 name|min_t
|
|
1121:25 argument_list|(
|
|
1121:26 name|size_t
|
|
1121:32 argument_list|,
|
|
1121:34 sizeof|sizeof
|
|
1121:40 argument_list|(
|
|
1121:41 name|s
|
|
1121:42 argument_list|)
|
|
1121:43 argument_list|,
|
|
1121:45 name|nlmsg_len
|
|
1121:54 argument_list|(
|
|
1121:55 name|nlh
|
|
1121:58 argument_list|)
|
|
1121:59 argument_list|)
|
|
1121:60 argument_list|)
|
|
1121:61 expr_stmt|;
|
|
1122:3 if|if
|
|
1122:6 condition|(
|
|
1122:7 name|s
|
|
1122:8 operator|.
|
|
1122:9 name|mask
|
|
1122:14 operator|&
|
|
1122:16 name|AUDIT_STATUS_ENABLED
|
|
1122:36 condition|)
|
|
1122:38 block|{
|
|
1123:4 name|err
|
|
1123:8 operator|=
|
|
1123:10 name|audit_set_enabled
|
|
1123:27 argument_list|(
|
|
1123:28 name|s
|
|
1123:29 operator|.
|
|
1123:30 name|enabled
|
|
1123:37 argument_list|)
|
|
1123:38 expr_stmt|;
|
|
1124:4 if|if
|
|
1124:7 condition|(
|
|
1124:8 name|err
|
|
1124:12 operator|<
|
|
1124:14 literal|0
|
|
1124:15 condition|)
|
|
1125:5 return|return
|
|
1125:12 name|err
|
|
1125:15 return|;
|
|
1126:3 block|}
|
|
1127:3 if|if
|
|
1127:6 condition|(
|
|
1127:7 name|s
|
|
1127:8 operator|.
|
|
1127:9 name|mask
|
|
1127:14 operator|&
|
|
1127:16 name|AUDIT_STATUS_FAILURE
|
|
1127:36 condition|)
|
|
1127:38 block|{
|
|
1128:4 name|err
|
|
1128:8 operator|=
|
|
1128:10 name|audit_set_failure
|
|
1128:27 argument_list|(
|
|
1128:28 name|s
|
|
1128:29 operator|.
|
|
1128:30 name|failure
|
|
1128:37 argument_list|)
|
|
1128:38 expr_stmt|;
|
|
1129:4 if|if
|
|
1129:7 condition|(
|
|
1129:8 name|err
|
|
1129:12 operator|<
|
|
1129:14 literal|0
|
|
1129:15 condition|)
|
|
1130:5 return|return
|
|
1130:12 name|err
|
|
1130:15 return|;
|
|
1131:3 block|}
|
|
1132:3 if|if
|
|
1132:6 condition|(
|
|
1132:7 name|s
|
|
1132:8 operator|.
|
|
1132:9 name|mask
|
|
1132:14 operator|&
|
|
1132:16 name|AUDIT_STATUS_PID
|
|
1132:32 condition|)
|
|
1132:34 block|{
|
|
1133:4 comment|/* NOTE: we are using task_tgid_vnr() below because * the s.pid value is relative to the namespace * of the caller; at present this doesn't matter * much since you can really only run auditd * from the initial pid namespace, but something * to keep in mind if this changes */
|
|
1139:4 name|int
|
|
1139:8 name|new_pid
|
|
1139:16 init|=
|
|
1139:18 name|s
|
|
1139:19 operator|.
|
|
1139:20 name|pid
|
|
1139:23 decl_stmt|;
|
|
1140:4 name|pid_t
|
|
1140:10 name|auditd_pid
|
|
1140:20 decl_stmt|;
|
|
1141:4 name|pid_t
|
|
1141:10 name|requesting_pid
|
|
1141:25 init|=
|
|
1141:27 name|task_tgid_vnr
|
|
1141:40 argument_list|(
|
|
1141:41 name|current
|
|
1141:48 argument_list|)
|
|
1141:49 decl_stmt|;
|
|
1143:4 comment|/* test the auditd connection */
|
|
1144:4 name|audit_replace
|
|
1144:17 argument_list|(
|
|
1144:18 name|requesting_pid
|
|
1144:32 argument_list|)
|
|
1144:33 expr_stmt|;
|
|
1146:4 name|rcu_read_lock
|
|
1146:17 argument_list|()
|
|
1146:19 expr_stmt|;
|
|
1147:4 name|auditd_pid
|
|
1147:15 operator|=
|
|
1147:17 name|auditd_conn
|
|
1147:28 operator|.
|
|
1147:29 name|pid
|
|
1147:32 expr_stmt|;
|
|
1148:4 comment|/* only the current auditd can unregister itself */
|
|
1149:4 if|if
|
|
1149:7 condition|(
|
|
1149:8 operator|(
|
|
1149:9 operator|!
|
|
1149:10 name|new_pid
|
|
1149:17 operator|)
|
|
1149:19 operator|&&
|
|
1149:22 operator|(
|
|
1149:23 name|requesting_pid
|
|
1149:38 operator|!=
|
|
1149:41 name|auditd_pid
|
|
1149:51 operator|)
|
|
1149:52 condition|)
|
|
1149:54 block|{
|
|
1150:5 name|rcu_read_unlock
|
|
1150:20 argument_list|()
|
|
1150:22 expr_stmt|;
|
|
1151:5 name|audit_log_config_change
|
|
1151:28 argument_list|(
|
|
1151:29 literal|"audit_pid"
|
|
1151:40 argument_list|,
|
|
1151:42 name|new_pid
|
|
1151:49 argument_list|,
|
|
1152:8 name|auditd_pid
|
|
1152:18 argument_list|,
|
|
1152:20 literal|0
|
|
1152:21 argument_list|)
|
|
1152:22 expr_stmt|;
|
|
1153:5 return|return
|
|
1153:12 operator|-
|
|
1153:13 name|EACCES
|
|
1153:19 return|;
|
|
1154:4 block|}
|
|
1155:4 comment|/* replacing a healthy auditd is not allowed */
|
|
1156:4 if|if
|
|
1156:7 condition|(
|
|
1156:8 name|auditd_pid
|
|
1156:19 operator|&&
|
|
1156:22 name|new_pid
|
|
1156:29 condition|)
|
|
1156:31 block|{
|
|
1157:5 name|rcu_read_unlock
|
|
1157:20 argument_list|()
|
|
1157:22 expr_stmt|;
|
|
1158:5 name|audit_log_config_change
|
|
1158:28 argument_list|(
|
|
1158:29 literal|"audit_pid"
|
|
1158:40 argument_list|,
|
|
1158:42 name|new_pid
|
|
1158:49 argument_list|,
|
|
1159:8 name|auditd_pid
|
|
1159:18 argument_list|,
|
|
1159:20 literal|0
|
|
1159:21 argument_list|)
|
|
1159:22 expr_stmt|;
|
|
1160:5 return|return
|
|
1160:12 operator|-
|
|
1160:13 name|EEXIST
|
|
1160:19 return|;
|
|
1161:4 block|}
|
|
1162:4 name|rcu_read_unlock
|
|
1162:19 argument_list|()
|
|
1162:21 expr_stmt|;
|
|
1164:4 if|if
|
|
1164:7 condition|(
|
|
1164:8 name|audit_enabled
|
|
1164:22 operator|!=
|
|
1164:25 name|AUDIT_OFF
|
|
1164:34 condition|)
|
|
1165:5 name|audit_log_config_change
|
|
1165:28 argument_list|(
|
|
1165:29 literal|"audit_pid"
|
|
1165:40 argument_list|,
|
|
1165:42 name|new_pid
|
|
1165:49 argument_list|,
|
|
1166:8 name|auditd_pid
|
|
1166:18 argument_list|,
|
|
1166:20 literal|1
|
|
1166:21 argument_list|)
|
|
1166:22 expr_stmt|;
|
|
1168:4 if|if
|
|
1168:7 condition|(
|
|
1168:8 name|new_pid
|
|
1168:15 condition|)
|
|
1168:17 block|{
|
|
1169:5 comment|/* register a new auditd connection */
|
|
1170:5 name|auditd_set
|
|
1170:15 argument_list|(
|
|
1170:16 name|new_pid
|
|
1170:23 argument_list|,
|
|
1171:9 name|NETLINK_CB
|
|
1171:19 argument_list|(
|
|
1171:20 name|skb
|
|
1171:23 argument_list|)
|
|
1171:24 operator|.
|
|
1171:25 name|portid
|
|
1171:31 argument_list|,
|
|
1172:9 name|sock_net
|
|
1172:17 argument_list|(
|
|
1172:18 name|NETLINK_CB
|
|
1172:28 argument_list|(
|
|
1172:29 name|skb
|
|
1172:32 argument_list|)
|
|
1172:33 operator|.
|
|
1172:34 name|sk
|
|
1172:36 argument_list|)
|
|
1172:37 argument_list|)
|
|
1172:38 expr_stmt|;
|
|
1173:5 comment|/* try to process any backlog */
|
|
1174:5 name|wake_up_interruptible
|
|
1174:26 argument_list|(
|
|
1174:27 operator|&
|
|
1174:28 name|kauditd_wait
|
|
1174:40 argument_list|)
|
|
1174:41 expr_stmt|;
|
|
1175:4 block|}
|
|
1175:6 else|else
|
|
1176:5 comment|/* unregister the auditd connection */
|
|
1177:5 name|auditd_reset
|
|
1177:17 argument_list|()
|
|
1177:19 expr_stmt|;
|
|
1178:3 block|}
|
|
1179:3 if|if
|
|
1179:6 condition|(
|
|
1179:7 name|s
|
|
1179:8 operator|.
|
|
1179:9 name|mask
|
|
1179:14 operator|&
|
|
1179:16 name|AUDIT_STATUS_RATE_LIMIT
|
|
1179:39 condition|)
|
|
1179:41 block|{
|
|
1180:4 name|err
|
|
1180:8 operator|=
|
|
1180:10 name|audit_set_rate_limit
|
|
1180:30 argument_list|(
|
|
1180:31 name|s
|
|
1180:32 operator|.
|
|
1180:33 name|rate_limit
|
|
1180:43 argument_list|)
|
|
1180:44 expr_stmt|;
|
|
1181:4 if|if
|
|
1181:7 condition|(
|
|
1181:8 name|err
|
|
1181:12 operator|<
|
|
1181:14 literal|0
|
|
1181:15 condition|)
|
|
1182:5 return|return
|
|
1182:12 name|err
|
|
1182:15 return|;
|
|
1183:3 block|}
|
|
1184:3 if|if
|
|
1184:6 condition|(
|
|
1184:7 name|s
|
|
1184:8 operator|.
|
|
1184:9 name|mask
|
|
1184:14 operator|&
|
|
1184:16 name|AUDIT_STATUS_BACKLOG_LIMIT
|
|
1184:42 condition|)
|
|
1184:44 block|{
|
|
1185:4 name|err
|
|
1185:8 operator|=
|
|
1185:10 name|audit_set_backlog_limit
|
|
1185:33 argument_list|(
|
|
1185:34 name|s
|
|
1185:35 operator|.
|
|
1185:36 name|backlog_limit
|
|
1185:49 argument_list|)
|
|
1185:50 expr_stmt|;
|
|
1186:4 if|if
|
|
1186:7 condition|(
|
|
1186:8 name|err
|
|
1186:12 operator|<
|
|
1186:14 literal|0
|
|
1186:15 condition|)
|
|
1187:5 return|return
|
|
1187:12 name|err
|
|
1187:15 return|;
|
|
1188:3 block|}
|
|
1189:3 if|if
|
|
1189:6 condition|(
|
|
1189:7 name|s
|
|
1189:8 operator|.
|
|
1189:9 name|mask
|
|
1189:14 operator|&
|
|
1189:16 name|AUDIT_STATUS_BACKLOG_WAIT_TIME
|
|
1189:46 condition|)
|
|
1189:48 block|{
|
|
1190:4 if|if
|
|
1190:7 condition|(
|
|
1190:8 sizeof|sizeof
|
|
1190:14 argument_list|(
|
|
1190:15 name|s
|
|
1190:16 argument_list|)
|
|
1190:18 operator|>
|
|
1190:20 operator|(
|
|
1190:21 name|size_t
|
|
1190:27 operator|)
|
|
1190:28 name|nlh
|
|
1190:31 operator|->
|
|
1190:33 name|nlmsg_len
|
|
1190:42 condition|)
|
|
1191:5 return|return
|
|
1191:12 operator|-
|
|
1191:13 name|EINVAL
|
|
1191:19 return|;
|
|
1192:4 if|if
|
|
1192:7 condition|(
|
|
1192:8 name|s
|
|
1192:9 operator|.
|
|
1192:10 name|backlog_wait_time
|
|
1192:28 operator|>
|
|
1192:30 literal|10
|
|
1192:32 operator|*
|
|
1192:33 name|AUDIT_BACKLOG_WAIT_TIME
|
|
1192:56 condition|)
|
|
1193:5 return|return
|
|
1193:12 operator|-
|
|
1193:13 name|EINVAL
|
|
1193:19 return|;
|
|
1194:4 name|err
|
|
1194:8 operator|=
|
|
1194:10 name|audit_set_backlog_wait_time
|
|
1194:37 argument_list|(
|
|
1194:38 name|s
|
|
1194:39 operator|.
|
|
1194:40 name|backlog_wait_time
|
|
1194:57 argument_list|)
|
|
1194:58 expr_stmt|;
|
|
1195:4 if|if
|
|
1195:7 condition|(
|
|
1195:8 name|err
|
|
1195:12 operator|<
|
|
1195:14 literal|0
|
|
1195:15 condition|)
|
|
1196:5 return|return
|
|
1196:12 name|err
|
|
1196:15 return|;
|
|
1197:3 block|}
|
|
1198:3 if|if
|
|
1198:6 condition|(
|
|
1198:7 name|s
|
|
1198:8 operator|.
|
|
1198:9 name|mask
|
|
1198:14 operator|==
|
|
1198:17 name|AUDIT_STATUS_LOST
|
|
1198:34 condition|)
|
|
1198:36 block|{
|
|
1199:4 name|u32
|
|
1199:8 name|lost
|
|
1199:13 init|=
|
|
1199:15 name|atomic_xchg
|
|
1199:26 argument_list|(
|
|
1199:27 operator|&
|
|
1199:28 name|audit_lost
|
|
1199:38 argument_list|,
|
|
1199:40 literal|0
|
|
1199:41 argument_list|)
|
|
1199:42 decl_stmt|;
|
|
1201:4 name|audit_log_config_change
|
|
1201:27 argument_list|(
|
|
1201:28 literal|"lost"
|
|
1201:34 argument_list|,
|
|
1201:36 literal|0
|
|
1201:37 argument_list|,
|
|
1201:39 name|lost
|
|
1201:43 argument_list|,
|
|
1201:45 literal|1
|
|
1201:46 argument_list|)
|
|
1201:47 expr_stmt|;
|
|
1202:4 return|return
|
|
1202:11 name|lost
|
|
1202:15 return|;
|
|
1203:3 block|}
|
|
1204:3 break|break;
|
|
1205:2 block|}
|
|
1206:2 case|case
|
|
1206:7 name|AUDIT_GET_FEATURE
|
|
1206:24 case|:
|
|
1207:3 name|err
|
|
1207:7 operator|=
|
|
1207:9 name|audit_get_feature
|
|
1207:26 argument_list|(
|
|
1207:27 name|skb
|
|
1207:30 argument_list|)
|
|
1207:31 expr_stmt|;
|
|
1208:3 if|if
|
|
1208:6 condition|(
|
|
1208:7 name|err
|
|
1208:10 condition|)
|
|
1209:4 return|return
|
|
1209:11 name|err
|
|
1209:14 return|;
|
|
1210:3 break|break;
|
|
1211:2 case|case
|
|
1211:7 name|AUDIT_SET_FEATURE
|
|
1211:24 case|:
|
|
1212:3 name|err
|
|
1212:7 operator|=
|
|
1212:9 name|audit_set_feature
|
|
1212:26 argument_list|(
|
|
1212:27 name|skb
|
|
1212:30 argument_list|)
|
|
1212:31 expr_stmt|;
|
|
1213:3 if|if
|
|
1213:6 condition|(
|
|
1213:7 name|err
|
|
1213:10 condition|)
|
|
1214:4 return|return
|
|
1214:11 name|err
|
|
1214:14 return|;
|
|
1215:3 break|break;
|
|
1216:2 case|case
|
|
1216:7 name|AUDIT_USER
|
|
1216:17 case|:
|
|
1217:2 case|case
|
|
1217:7 name|AUDIT_FIRST_USER_MSG
|
|
1217:28 operator|...
|
|
1217:32 name|AUDIT_LAST_USER_MSG
|
|
1217:51 case|:
|
|
1218:2 case|case
|
|
1218:7 name|AUDIT_FIRST_USER_MSG2
|
|
1218:29 operator|...
|
|
1218:33 name|AUDIT_LAST_USER_MSG2
|
|
1218:53 case|:
|
|
1219:3 if|if
|
|
1219:6 condition|(
|
|
1219:7 operator|!
|
|
1219:8 name|audit_enabled
|
|
1219:22 operator|&&
|
|
1219:25 name|msg_type
|
|
1219:34 operator|!=
|
|
1219:37 name|AUDIT_USER_AVC
|
|
1219:51 condition|)
|
|
1220:4 return|return
|
|
1220:11 literal|0
|
|
1220:12 return|;
|
|
1222:3 name|err
|
|
1222:7 operator|=
|
|
1222:9 name|audit_filter
|
|
1222:21 argument_list|(
|
|
1222:22 name|msg_type
|
|
1222:30 argument_list|,
|
|
1222:32 name|AUDIT_FILTER_USER
|
|
1222:49 argument_list|)
|
|
1222:50 expr_stmt|;
|
|
1223:3 if|if
|
|
1223:6 condition|(
|
|
1223:7 name|err
|
|
1223:11 operator|==
|
|
1223:14 literal|1
|
|
1223:15 condition|)
|
|
1223:17 block|{
|
|
1223:19 comment|/* match or error */
|
|
1224:4 name|err
|
|
1224:8 operator|=
|
|
1224:10 literal|0
|
|
1224:11 expr_stmt|;
|
|
1225:4 if|if
|
|
1225:7 condition|(
|
|
1225:8 name|msg_type
|
|
1225:17 operator|==
|
|
1225:20 name|AUDIT_USER_TTY
|
|
1225:34 condition|)
|
|
1225:36 block|{
|
|
1226:5 name|err
|
|
1226:9 operator|=
|
|
1226:11 name|tty_audit_push
|
|
1226:25 argument_list|()
|
|
1226:27 expr_stmt|;
|
|
1227:5 if|if
|
|
1227:8 condition|(
|
|
1227:9 name|err
|
|
1227:12 condition|)
|
|
1228:6 break|break;
|
|
1229:4 block|}
|
|
1230:4 name|audit_log_common_recv_msg
|
|
1230:29 argument_list|(
|
|
1230:30 operator|&
|
|
1230:31 name|ab
|
|
1230:33 argument_list|,
|
|
1230:35 name|msg_type
|
|
1230:43 argument_list|)
|
|
1230:44 expr_stmt|;
|
|
1231:4 if|if
|
|
1231:7 condition|(
|
|
1231:8 name|msg_type
|
|
1231:17 operator|!=
|
|
1231:20 name|AUDIT_USER_TTY
|
|
1231:34 condition|)
|
|
1232:5 name|audit_log_format
|
|
1232:21 argument_list|(
|
|
1232:22 name|ab
|
|
1232:24 argument_list|,
|
|
1232:26 literal|" msg='%.*s'"
|
|
1232:39 argument_list|,
|
|
1233:8 name|AUDIT_MESSAGE_TEXT_MAX
|
|
1233:30 argument_list|,
|
|
1234:8 operator|(
|
|
1234:9 name|char
|
|
1234:14 operator|*
|
|
1234:15 operator|)
|
|
1234:16 name|data
|
|
1234:20 argument_list|)
|
|
1234:21 expr_stmt|;
|
|
1235:4 else|else
|
|
1235:9 block|{
|
|
1236:5 name|int
|
|
1236:9 name|size
|
|
1236:13 decl_stmt|;
|
|
1238:5 name|audit_log_format
|
|
1238:21 argument_list|(
|
|
1238:22 name|ab
|
|
1238:24 argument_list|,
|
|
1238:26 literal|" data="
|
|
1238:34 argument_list|)
|
|
1238:35 expr_stmt|;
|
|
1239:5 name|size
|
|
1239:10 operator|=
|
|
1239:12 name|nlmsg_len
|
|
1239:21 argument_list|(
|
|
1239:22 name|nlh
|
|
1239:25 argument_list|)
|
|
1239:26 expr_stmt|;
|
|
1240:5 if|if
|
|
1240:8 condition|(
|
|
1240:9 name|size
|
|
1240:14 operator|>
|
|
1240:16 literal|0
|
|
1240:18 operator|&&
|
|
1241:9 operator|(
|
|
1241:10 operator|(
|
|
1241:11 name|unsigned
|
|
1241:20 name|char
|
|
1241:25 operator|*
|
|
1241:26 operator|)
|
|
1241:27 name|data
|
|
1241:31 operator|)
|
|
1241:32 index|[
|
|
1241:33 name|size
|
|
1241:38 operator|-
|
|
1241:40 literal|1
|
|
1241:41 index|]
|
|
1241:43 operator|==
|
|
1241:46 literal|'\0'
|
|
1241:50 condition|)
|
|
1242:6 name|size
|
|
1242:10 operator|--
|
|
1242:12 expr_stmt|;
|
|
1243:5 name|audit_log_n_untrustedstring
|
|
1243:32 argument_list|(
|
|
1243:33 name|ab
|
|
1243:35 argument_list|,
|
|
1243:37 name|data
|
|
1243:41 argument_list|,
|
|
1243:43 name|size
|
|
1243:47 argument_list|)
|
|
1243:48 expr_stmt|;
|
|
1244:4 block|}
|
|
1245:4 name|audit_set_portid
|
|
1245:20 argument_list|(
|
|
1245:21 name|ab
|
|
1245:23 argument_list|,
|
|
1245:25 name|NETLINK_CB
|
|
1245:35 argument_list|(
|
|
1245:36 name|skb
|
|
1245:39 argument_list|)
|
|
1245:40 operator|.
|
|
1245:41 name|portid
|
|
1245:47 argument_list|)
|
|
1245:48 expr_stmt|;
|
|
1246:4 name|audit_log_end
|
|
1246:17 argument_list|(
|
|
1246:18 name|ab
|
|
1246:20 argument_list|)
|
|
1246:21 expr_stmt|;
|
|
1247:3 block|}
|
|
1248:3 break|break;
|
|
1249:2 case|case
|
|
1249:7 name|AUDIT_ADD_RULE
|
|
1249:21 case|:
|
|
1250:2 case|case
|
|
1250:7 name|AUDIT_DEL_RULE
|
|
1250:21 case|:
|
|
1251:3 if|if
|
|
1251:6 condition|(
|
|
1251:7 name|nlmsg_len
|
|
1251:16 argument_list|(
|
|
1251:17 name|nlh
|
|
1251:20 argument_list|)
|
|
1251:22 operator|<
|
|
1251:24 sizeof|sizeof
|
|
1251:30 argument_list|(
|
|
1251:31 expr|struct
|
|
1251:38 name|audit_rule_data
|
|
1251:53 argument_list|)
|
|
1251:54 condition|)
|
|
1252:4 return|return
|
|
1252:11 operator|-
|
|
1252:12 name|EINVAL
|
|
1252:18 return|;
|
|
1253:3 if|if
|
|
1253:6 condition|(
|
|
1253:7 name|audit_enabled
|
|
1253:21 operator|==
|
|
1253:24 name|AUDIT_LOCKED
|
|
1253:36 condition|)
|
|
1253:38 block|{
|
|
1254:4 name|audit_log_common_recv_msg
|
|
1254:29 argument_list|(
|
|
1254:30 operator|&
|
|
1254:31 name|ab
|
|
1254:33 argument_list|,
|
|
1254:35 name|AUDIT_CONFIG_CHANGE
|
|
1254:54 argument_list|)
|
|
1254:55 expr_stmt|;
|
|
1255:4 name|audit_log_format
|
|
1255:20 argument_list|(
|
|
1255:21 name|ab
|
|
1255:23 argument_list|,
|
|
1255:25 literal|" audit_enabled=%d res=0"
|
|
1255:50 argument_list|,
|
|
1255:52 name|audit_enabled
|
|
1255:65 argument_list|)
|
|
1255:66 expr_stmt|;
|
|
1256:4 name|audit_log_end
|
|
1256:17 argument_list|(
|
|
1256:18 name|ab
|
|
1256:20 argument_list|)
|
|
1256:21 expr_stmt|;
|
|
1257:4 return|return
|
|
1257:11 operator|-
|
|
1257:12 name|EPERM
|
|
1257:17 return|;
|
|
1258:3 block|}
|
|
1259:3 name|err
|
|
1259:7 operator|=
|
|
1259:9 name|audit_rule_change
|
|
1259:26 argument_list|(
|
|
1259:27 name|msg_type
|
|
1259:35 argument_list|,
|
|
1259:37 name|NETLINK_CB
|
|
1259:47 argument_list|(
|
|
1259:48 name|skb
|
|
1259:51 argument_list|)
|
|
1259:52 operator|.
|
|
1259:53 name|portid
|
|
1259:59 argument_list|,
|
|
1260:9 name|seq
|
|
1260:12 argument_list|,
|
|
1260:14 name|data
|
|
1260:18 argument_list|,
|
|
1260:20 name|nlmsg_len
|
|
1260:29 argument_list|(
|
|
1260:30 name|nlh
|
|
1260:33 argument_list|)
|
|
1260:34 argument_list|)
|
|
1260:35 expr_stmt|;
|
|
1261:3 break|break;
|
|
1262:2 case|case
|
|
1262:7 name|AUDIT_LIST_RULES
|
|
1262:23 case|:
|
|
1263:3 name|err
|
|
1263:7 operator|=
|
|
1263:9 name|audit_list_rules_send
|
|
1263:30 argument_list|(
|
|
1263:31 name|skb
|
|
1263:34 argument_list|,
|
|
1263:36 name|seq
|
|
1263:39 argument_list|)
|
|
1263:40 expr_stmt|;
|
|
1264:3 break|break;
|
|
1265:2 case|case
|
|
1265:7 name|AUDIT_TRIM
|
|
1265:17 case|:
|
|
1266:3 name|audit_trim_trees
|
|
1266:19 argument_list|()
|
|
1266:21 expr_stmt|;
|
|
1267:3 name|audit_log_common_recv_msg
|
|
1267:28 argument_list|(
|
|
1267:29 operator|&
|
|
1267:30 name|ab
|
|
1267:32 argument_list|,
|
|
1267:34 name|AUDIT_CONFIG_CHANGE
|
|
1267:53 argument_list|)
|
|
1267:54 expr_stmt|;
|
|
1268:3 name|audit_log_format
|
|
1268:19 argument_list|(
|
|
1268:20 name|ab
|
|
1268:22 argument_list|,
|
|
1268:24 literal|" op=trim res=1"
|
|
1268:40 argument_list|)
|
|
1268:41 expr_stmt|;
|
|
1269:3 name|audit_log_end
|
|
1269:16 argument_list|(
|
|
1269:17 name|ab
|
|
1269:19 argument_list|)
|
|
1269:20 expr_stmt|;
|
|
1270:3 break|break;
|
|
1271:2 case|case
|
|
1271:7 name|AUDIT_MAKE_EQUIV
|
|
1271:23 case|:
|
|
1271:25 block|{
|
|
1272:3 name|void
|
|
1272:8 modifier|*
|
|
1272:9 name|bufp
|
|
1272:14 init|=
|
|
1272:16 name|data
|
|
1272:20 decl_stmt|;
|
|
1273:3 name|u32
|
|
1273:7 name|sizes
|
|
1273:12 index|[
|
|
1273:13 literal|2
|
|
1273:14 index|]
|
|
1273:15 decl_stmt|;
|
|
1274:3 name|size_t
|
|
1274:10 name|msglen
|
|
1274:17 init|=
|
|
1274:19 name|nlmsg_len
|
|
1274:28 argument_list|(
|
|
1274:29 name|nlh
|
|
1274:32 argument_list|)
|
|
1274:33 decl_stmt|;
|
|
1275:3 name|char
|
|
1275:8 modifier|*
|
|
1275:9 name|old
|
|
1275:12 decl_stmt|,
|
|
1275:14 modifier|*
|
|
1275:15 name|new
|
|
1275:18 decl_stmt|;
|
|
1277:3 name|err
|
|
1277:7 operator|=
|
|
1277:9 operator|-
|
|
1277:10 name|EINVAL
|
|
1277:16 expr_stmt|;
|
|
1278:3 if|if
|
|
1278:6 condition|(
|
|
1278:7 name|msglen
|
|
1278:14 operator|<
|
|
1278:16 literal|2
|
|
1278:18 operator|*
|
|
1278:20 sizeof|sizeof
|
|
1278:26 argument_list|(
|
|
1278:27 name|u32
|
|
1278:30 argument_list|)
|
|
1278:31 condition|)
|
|
1279:4 break|break;
|
|
1280:3 name|memcpy
|
|
1280:9 argument_list|(
|
|
1280:10 name|sizes
|
|
1280:15 argument_list|,
|
|
1280:17 name|bufp
|
|
1280:21 argument_list|,
|
|
1280:23 literal|2
|
|
1280:25 operator|*
|
|
1280:27 sizeof|sizeof
|
|
1280:33 argument_list|(
|
|
1280:34 name|u32
|
|
1280:37 argument_list|)
|
|
1280:38 argument_list|)
|
|
1280:39 expr_stmt|;
|
|
1281:3 name|bufp
|
|
1281:8 operator|+=
|
|
1281:11 literal|2
|
|
1281:13 operator|*
|
|
1281:15 sizeof|sizeof
|
|
1281:21 argument_list|(
|
|
1281:22 name|u32
|
|
1281:25 argument_list|)
|
|
1281:26 expr_stmt|;
|
|
1282:3 name|msglen
|
|
1282:10 operator|-=
|
|
1282:13 literal|2
|
|
1282:15 operator|*
|
|
1282:17 sizeof|sizeof
|
|
1282:23 argument_list|(
|
|
1282:24 name|u32
|
|
1282:27 argument_list|)
|
|
1282:28 expr_stmt|;
|
|
1283:3 name|old
|
|
1283:7 operator|=
|
|
1283:9 name|audit_unpack_string
|
|
1283:28 argument_list|(
|
|
1283:29 operator|&
|
|
1283:30 name|bufp
|
|
1283:34 argument_list|,
|
|
1283:36 operator|&
|
|
1283:37 name|msglen
|
|
1283:43 argument_list|,
|
|
1283:45 name|sizes
|
|
1283:50 index|[
|
|
1283:51 literal|0
|
|
1283:52 index|]
|
|
1283:53 argument_list|)
|
|
1283:54 expr_stmt|;
|
|
1284:3 if|if
|
|
1284:6 condition|(
|
|
1284:7 name|IS_ERR
|
|
1284:13 argument_list|(
|
|
1284:14 name|old
|
|
1284:17 argument_list|)
|
|
1284:18 condition|)
|
|
1284:20 block|{
|
|
1285:4 name|err
|
|
1285:8 operator|=
|
|
1285:10 name|PTR_ERR
|
|
1285:17 argument_list|(
|
|
1285:18 name|old
|
|
1285:21 argument_list|)
|
|
1285:22 expr_stmt|;
|
|
1286:4 break|break;
|
|
1287:3 block|}
|
|
1288:3 name|new
|
|
1288:7 operator|=
|
|
1288:9 name|audit_unpack_string
|
|
1288:28 argument_list|(
|
|
1288:29 operator|&
|
|
1288:30 name|bufp
|
|
1288:34 argument_list|,
|
|
1288:36 operator|&
|
|
1288:37 name|msglen
|
|
1288:43 argument_list|,
|
|
1288:45 name|sizes
|
|
1288:50 index|[
|
|
1288:51 literal|1
|
|
1288:52 index|]
|
|
1288:53 argument_list|)
|
|
1288:54 expr_stmt|;
|
|
1289:3 if|if
|
|
1289:6 condition|(
|
|
1289:7 name|IS_ERR
|
|
1289:13 argument_list|(
|
|
1289:14 name|new
|
|
1289:17 argument_list|)
|
|
1289:18 condition|)
|
|
1289:20 block|{
|
|
1290:4 name|err
|
|
1290:8 operator|=
|
|
1290:10 name|PTR_ERR
|
|
1290:17 argument_list|(
|
|
1290:18 name|new
|
|
1290:21 argument_list|)
|
|
1290:22 expr_stmt|;
|
|
1291:4 name|kfree
|
|
1291:9 argument_list|(
|
|
1291:10 name|old
|
|
1291:13 argument_list|)
|
|
1291:14 expr_stmt|;
|
|
1292:4 break|break;
|
|
1293:3 block|}
|
|
1294:3 comment|/* OK, here comes... */
|
|
1295:3 name|err
|
|
1295:7 operator|=
|
|
1295:9 name|audit_tag_tree
|
|
1295:23 argument_list|(
|
|
1295:24 name|old
|
|
1295:27 argument_list|,
|
|
1295:29 name|new
|
|
1295:32 argument_list|)
|
|
1295:33 expr_stmt|;
|
|
1297:3 name|audit_log_common_recv_msg
|
|
1297:28 argument_list|(
|
|
1297:29 operator|&
|
|
1297:30 name|ab
|
|
1297:32 argument_list|,
|
|
1297:34 name|AUDIT_CONFIG_CHANGE
|
|
1297:53 argument_list|)
|
|
1297:54 expr_stmt|;
|
|
1299:3 name|audit_log_format
|
|
1299:19 argument_list|(
|
|
1299:20 name|ab
|
|
1299:22 argument_list|,
|
|
1299:24 literal|" op=make_equiv old="
|
|
1299:45 argument_list|)
|
|
1299:46 expr_stmt|;
|
|
1300:3 name|audit_log_untrustedstring
|
|
1300:28 argument_list|(
|
|
1300:29 name|ab
|
|
1300:31 argument_list|,
|
|
1300:33 name|old
|
|
1300:36 argument_list|)
|
|
1300:37 expr_stmt|;
|
|
1301:3 name|audit_log_format
|
|
1301:19 argument_list|(
|
|
1301:20 name|ab
|
|
1301:22 argument_list|,
|
|
1301:24 literal|" new="
|
|
1301:31 argument_list|)
|
|
1301:32 expr_stmt|;
|
|
1302:3 name|audit_log_untrustedstring
|
|
1302:28 argument_list|(
|
|
1302:29 name|ab
|
|
1302:31 argument_list|,
|
|
1302:33 name|new
|
|
1302:36 argument_list|)
|
|
1302:37 expr_stmt|;
|
|
1303:3 name|audit_log_format
|
|
1303:19 argument_list|(
|
|
1303:20 name|ab
|
|
1303:22 argument_list|,
|
|
1303:24 literal|" res=%d"
|
|
1303:33 argument_list|,
|
|
1303:35 operator|!
|
|
1303:36 name|err
|
|
1303:39 argument_list|)
|
|
1303:40 expr_stmt|;
|
|
1304:3 name|audit_log_end
|
|
1304:16 argument_list|(
|
|
1304:17 name|ab
|
|
1304:19 argument_list|)
|
|
1304:20 expr_stmt|;
|
|
1305:3 name|kfree
|
|
1305:8 argument_list|(
|
|
1305:9 name|old
|
|
1305:12 argument_list|)
|
|
1305:13 expr_stmt|;
|
|
1306:3 name|kfree
|
|
1306:8 argument_list|(
|
|
1306:9 name|new
|
|
1306:12 argument_list|)
|
|
1306:13 expr_stmt|;
|
|
1307:3 break|break;
|
|
1308:2 block|}
|
|
1309:2 case|case
|
|
1309:7 name|AUDIT_SIGNAL_INFO
|
|
1309:24 case|:
|
|
1310:3 name|len
|
|
1310:7 operator|=
|
|
1310:9 literal|0
|
|
1310:10 expr_stmt|;
|
|
1311:3 if|if
|
|
1311:6 condition|(
|
|
1311:7 name|audit_sig_sid
|
|
1311:20 condition|)
|
|
1311:22 block|{
|
|
1312:4 name|err
|
|
1312:8 operator|=
|
|
1312:10 name|security_secid_to_secctx
|
|
1312:34 argument_list|(
|
|
1312:35 name|audit_sig_sid
|
|
1312:48 argument_list|,
|
|
1312:50 operator|&
|
|
1312:51 name|ctx
|
|
1312:54 argument_list|,
|
|
1312:56 operator|&
|
|
1312:57 name|len
|
|
1312:60 argument_list|)
|
|
1312:61 expr_stmt|;
|
|
1313:4 if|if
|
|
1313:7 condition|(
|
|
1313:8 name|err
|
|
1313:11 condition|)
|
|
1314:5 return|return
|
|
1314:12 name|err
|
|
1314:15 return|;
|
|
1315:3 block|}
|
|
1316:3 name|sig_data
|
|
1316:12 operator|=
|
|
1316:14 name|kmalloc
|
|
1316:21 argument_list|(
|
|
1316:22 sizeof|sizeof
|
|
1316:28 argument_list|(
|
|
1316:29 operator|*
|
|
1316:30 name|sig_data
|
|
1316:38 argument_list|)
|
|
1316:40 operator|+
|
|
1316:42 name|len
|
|
1316:45 argument_list|,
|
|
1316:47 name|GFP_KERNEL
|
|
1316:57 argument_list|)
|
|
1316:58 expr_stmt|;
|
|
1317:3 if|if
|
|
1317:6 condition|(
|
|
1317:7 operator|!
|
|
1317:8 name|sig_data
|
|
1317:16 condition|)
|
|
1317:18 block|{
|
|
1318:4 if|if
|
|
1318:7 condition|(
|
|
1318:8 name|audit_sig_sid
|
|
1318:21 condition|)
|
|
1319:5 name|security_release_secctx
|
|
1319:28 argument_list|(
|
|
1319:29 name|ctx
|
|
1319:32 argument_list|,
|
|
1319:34 name|len
|
|
1319:37 argument_list|)
|
|
1319:38 expr_stmt|;
|
|
1320:4 return|return
|
|
1320:11 operator|-
|
|
1320:12 name|ENOMEM
|
|
1320:18 return|;
|
|
1321:3 block|}
|
|
1322:3 name|sig_data
|
|
1322:11 operator|->
|
|
1322:13 name|uid
|
|
1322:17 operator|=
|
|
1322:19 name|from_kuid
|
|
1322:28 argument_list|(
|
|
1322:29 operator|&
|
|
1322:30 name|init_user_ns
|
|
1322:42 argument_list|,
|
|
1322:44 name|audit_sig_uid
|
|
1322:57 argument_list|)
|
|
1322:58 expr_stmt|;
|
|
1323:3 name|sig_data
|
|
1323:11 operator|->
|
|
1323:13 name|pid
|
|
1323:17 operator|=
|
|
1323:19 name|audit_sig_pid
|
|
1323:32 expr_stmt|;
|
|
1324:3 if|if
|
|
1324:6 condition|(
|
|
1324:7 name|audit_sig_sid
|
|
1324:20 condition|)
|
|
1324:22 block|{
|
|
1325:4 name|memcpy
|
|
1325:10 argument_list|(
|
|
1325:11 name|sig_data
|
|
1325:19 operator|->
|
|
1325:21 name|ctx
|
|
1325:24 argument_list|,
|
|
1325:26 name|ctx
|
|
1325:29 argument_list|,
|
|
1325:31 name|len
|
|
1325:34 argument_list|)
|
|
1325:35 expr_stmt|;
|
|
1326:4 name|security_release_secctx
|
|
1326:27 argument_list|(
|
|
1326:28 name|ctx
|
|
1326:31 argument_list|,
|
|
1326:33 name|len
|
|
1326:36 argument_list|)
|
|
1326:37 expr_stmt|;
|
|
1327:3 block|}
|
|
1328:3 name|audit_send_reply
|
|
1328:19 argument_list|(
|
|
1328:20 name|skb
|
|
1328:23 argument_list|,
|
|
1328:25 name|seq
|
|
1328:28 argument_list|,
|
|
1328:30 name|AUDIT_SIGNAL_INFO
|
|
1328:47 argument_list|,
|
|
1328:49 literal|0
|
|
1328:50 argument_list|,
|
|
1328:52 literal|0
|
|
1328:53 argument_list|,
|
|
1329:6 name|sig_data
|
|
1329:14 argument_list|,
|
|
1329:16 sizeof|sizeof
|
|
1329:22 argument_list|(
|
|
1329:23 operator|*
|
|
1329:24 name|sig_data
|
|
1329:32 argument_list|)
|
|
1329:34 operator|+
|
|
1329:36 name|len
|
|
1329:39 argument_list|)
|
|
1329:40 expr_stmt|;
|
|
1330:3 name|kfree
|
|
1330:8 argument_list|(
|
|
1330:9 name|sig_data
|
|
1330:17 argument_list|)
|
|
1330:18 expr_stmt|;
|
|
1331:3 break|break;
|
|
1332:2 case|case
|
|
1332:7 name|AUDIT_TTY_GET
|
|
1332:20 case|:
|
|
1332:22 block|{
|
|
1333:3 name|struct
|
|
1333:10 name|audit_tty_status
|
|
1333:27 name|s
|
|
1333:28 decl_stmt|;
|
|
1334:3 name|unsigned
|
|
1334:12 name|int
|
|
1334:16 name|t
|
|
1334:17 decl_stmt|;
|
|
1336:3 name|t
|
|
1336:5 operator|=
|
|
1336:7 name|READ_ONCE
|
|
1336:16 argument_list|(
|
|
1336:17 name|current
|
|
1336:24 operator|->
|
|
1336:26 name|signal
|
|
1336:32 operator|->
|
|
1336:34 name|audit_tty
|
|
1336:43 argument_list|)
|
|
1336:44 expr_stmt|;
|
|
1337:3 name|s
|
|
1337:4 operator|.
|
|
1337:5 name|enabled
|
|
1337:13 operator|=
|
|
1337:15 name|t
|
|
1337:17 operator|&
|
|
1337:19 name|AUDIT_TTY_ENABLE
|
|
1337:35 expr_stmt|;
|
|
1338:3 name|s
|
|
1338:4 operator|.
|
|
1338:5 name|log_passwd
|
|
1338:16 operator|=
|
|
1338:18 operator|!
|
|
1338:19 operator|!
|
|
1338:20 operator|(
|
|
1338:21 name|t
|
|
1338:23 operator|&
|
|
1338:25 name|AUDIT_TTY_LOG_PASSWD
|
|
1338:45 operator|)
|
|
1338:46 expr_stmt|;
|
|
1340:3 name|audit_send_reply
|
|
1340:19 argument_list|(
|
|
1340:20 name|skb
|
|
1340:23 argument_list|,
|
|
1340:25 name|seq
|
|
1340:28 argument_list|,
|
|
1340:30 name|AUDIT_TTY_GET
|
|
1340:43 argument_list|,
|
|
1340:45 literal|0
|
|
1340:46 argument_list|,
|
|
1340:48 literal|0
|
|
1340:49 argument_list|,
|
|
1340:51 operator|&
|
|
1340:52 name|s
|
|
1340:53 argument_list|,
|
|
1340:55 sizeof|sizeof
|
|
1340:61 argument_list|(
|
|
1340:62 name|s
|
|
1340:63 argument_list|)
|
|
1340:64 argument_list|)
|
|
1340:65 expr_stmt|;
|
|
1341:3 break|break;
|
|
1342:2 block|}
|
|
1343:2 case|case
|
|
1343:7 name|AUDIT_TTY_SET
|
|
1343:20 case|:
|
|
1343:22 block|{
|
|
1344:3 name|struct
|
|
1344:10 name|audit_tty_status
|
|
1344:27 name|s
|
|
1344:28 decl_stmt|,
|
|
1344:30 name|old
|
|
1344:33 decl_stmt|;
|
|
1345:3 name|struct
|
|
1345:10 name|audit_buffer
|
|
1345:23 modifier|*
|
|
1345:24 name|ab
|
|
1345:26 decl_stmt|;
|
|
1346:3 name|unsigned
|
|
1346:12 name|int
|
|
1346:16 name|t
|
|
1346:17 decl_stmt|;
|
|
1348:3 name|memset
|
|
1348:9 argument_list|(
|
|
1348:10 operator|&
|
|
1348:11 name|s
|
|
1348:12 argument_list|,
|
|
1348:14 literal|0
|
|
1348:15 argument_list|,
|
|
1348:17 sizeof|sizeof
|
|
1348:23 argument_list|(
|
|
1348:24 name|s
|
|
1348:25 argument_list|)
|
|
1348:26 argument_list|)
|
|
1348:27 expr_stmt|;
|
|
1349:3 comment|/* guard against past and future API changes */
|
|
1350:3 name|memcpy
|
|
1350:9 argument_list|(
|
|
1350:10 operator|&
|
|
1350:11 name|s
|
|
1350:12 argument_list|,
|
|
1350:14 name|data
|
|
1350:18 argument_list|,
|
|
1350:20 name|min_t
|
|
1350:25 argument_list|(
|
|
1350:26 name|size_t
|
|
1350:32 argument_list|,
|
|
1350:34 sizeof|sizeof
|
|
1350:40 argument_list|(
|
|
1350:41 name|s
|
|
1350:42 argument_list|)
|
|
1350:43 argument_list|,
|
|
1350:45 name|nlmsg_len
|
|
1350:54 argument_list|(
|
|
1350:55 name|nlh
|
|
1350:58 argument_list|)
|
|
1350:59 argument_list|)
|
|
1350:60 argument_list|)
|
|
1350:61 expr_stmt|;
|
|
1351:3 comment|/* check if new data is valid */
|
|
1352:3 if|if
|
|
1352:6 condition|(
|
|
1352:7 operator|(
|
|
1352:8 name|s
|
|
1352:9 operator|.
|
|
1352:10 name|enabled
|
|
1352:18 operator|!=
|
|
1352:21 literal|0
|
|
1352:23 operator|&&
|
|
1352:26 name|s
|
|
1352:27 operator|.
|
|
1352:28 name|enabled
|
|
1352:36 operator|!=
|
|
1352:39 literal|1
|
|
1352:40 operator|)
|
|
1352:42 operator|||
|
|
1353:7 operator|(
|
|
1353:8 name|s
|
|
1353:9 operator|.
|
|
1353:10 name|log_passwd
|
|
1353:21 operator|!=
|
|
1353:24 literal|0
|
|
1353:26 operator|&&
|
|
1353:29 name|s
|
|
1353:30 operator|.
|
|
1353:31 name|log_passwd
|
|
1353:42 operator|!=
|
|
1353:45 literal|1
|
|
1353:46 operator|)
|
|
1353:47 condition|)
|
|
1354:4 name|err
|
|
1354:8 operator|=
|
|
1354:10 operator|-
|
|
1354:11 name|EINVAL
|
|
1354:17 expr_stmt|;
|
|
1356:3 if|if
|
|
1356:6 condition|(
|
|
1356:7 name|err
|
|
1356:10 condition|)
|
|
1357:4 name|t
|
|
1357:6 operator|=
|
|
1357:8 name|READ_ONCE
|
|
1357:17 argument_list|(
|
|
1357:18 name|current
|
|
1357:25 operator|->
|
|
1357:27 name|signal
|
|
1357:33 operator|->
|
|
1357:35 name|audit_tty
|
|
1357:44 argument_list|)
|
|
1357:45 expr_stmt|;
|
|
1358:3 else|else
|
|
1358:8 block|{
|
|
1359:4 name|t
|
|
1359:6 operator|=
|
|
1359:8 name|s
|
|
1359:9 operator|.
|
|
1359:10 name|enabled
|
|
1359:18 operator||
|
|
1359:20 operator|(
|
|
1359:21 operator|-
|
|
1359:22 name|s
|
|
1359:23 operator|.
|
|
1359:24 name|log_passwd
|
|
1359:35 operator|&
|
|
1359:37 name|AUDIT_TTY_LOG_PASSWD
|
|
1359:57 operator|)
|
|
1359:58 expr_stmt|;
|
|
1360:4 name|t
|
|
1360:6 operator|=
|
|
1360:8 name|xchg
|
|
1360:12 argument_list|(
|
|
1360:13 operator|&
|
|
1360:14 name|current
|
|
1360:21 operator|->
|
|
1360:23 name|signal
|
|
1360:29 operator|->
|
|
1360:31 name|audit_tty
|
|
1360:40 argument_list|,
|
|
1360:42 name|t
|
|
1360:43 argument_list|)
|
|
1360:44 expr_stmt|;
|
|
1361:3 block|}
|
|
1362:3 name|old
|
|
1362:6 operator|.
|
|
1362:7 name|enabled
|
|
1362:15 operator|=
|
|
1362:17 name|t
|
|
1362:19 operator|&
|
|
1362:21 name|AUDIT_TTY_ENABLE
|
|
1362:37 expr_stmt|;
|
|
1363:3 name|old
|
|
1363:6 operator|.
|
|
1363:7 name|log_passwd
|
|
1363:18 operator|=
|
|
1363:20 operator|!
|
|
1363:21 operator|!
|
|
1363:22 operator|(
|
|
1363:23 name|t
|
|
1363:25 operator|&
|
|
1363:27 name|AUDIT_TTY_LOG_PASSWD
|
|
1363:47 operator|)
|
|
1363:48 expr_stmt|;
|
|
1365:3 name|audit_log_common_recv_msg
|
|
1365:28 argument_list|(
|
|
1365:29 operator|&
|
|
1365:30 name|ab
|
|
1365:32 argument_list|,
|
|
1365:34 name|AUDIT_CONFIG_CHANGE
|
|
1365:53 argument_list|)
|
|
1365:54 expr_stmt|;
|
|
1366:3 name|audit_log_format
|
|
1366:19 argument_list|(
|
|
1366:20 name|ab
|
|
1366:22 argument_list|,
|
|
1366:24 literal|" op=tty_set old-enabled=%d new-enabled=%d"
|
|
1367:6 literal|" old-log_passwd=%d new-log_passwd=%d res=%d"
|
|
1367:51 argument_list|,
|
|
1368:6 name|old
|
|
1368:9 operator|.
|
|
1368:10 name|enabled
|
|
1368:17 argument_list|,
|
|
1368:19 name|s
|
|
1368:20 operator|.
|
|
1368:21 name|enabled
|
|
1368:28 argument_list|,
|
|
1368:30 name|old
|
|
1368:33 operator|.
|
|
1368:34 name|log_passwd
|
|
1368:44 argument_list|,
|
|
1369:6 name|s
|
|
1369:7 operator|.
|
|
1369:8 name|log_passwd
|
|
1369:18 argument_list|,
|
|
1369:20 operator|!
|
|
1369:21 name|err
|
|
1369:24 argument_list|)
|
|
1369:25 expr_stmt|;
|
|
1370:3 name|audit_log_end
|
|
1370:16 argument_list|(
|
|
1370:17 name|ab
|
|
1370:19 argument_list|)
|
|
1370:20 expr_stmt|;
|
|
1371:3 break|break;
|
|
1372:2 block|}
|
|
1373:2 default|default:
|
|
1374:3 name|err
|
|
1374:7 operator|=
|
|
1374:9 operator|-
|
|
1374:10 name|EINVAL
|
|
1374:16 expr_stmt|;
|
|
1375:3 break|break;
|
|
1376:2 block|}
|
|
1378:2 return|return
|
|
1378:9 name|err
|
|
1378:13 operator|<
|
|
1378:15 literal|0
|
|
1378:17 condition|?
|
|
1378:19 name|err
|
|
1378:23 else|:
|
|
1378:25 literal|0
|
|
1378:26 return|;
|
|
1379:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1381:1 comment|/* * Get message from skb. Each message is processed by audit_receive_msg. * Malformed skbs with wrong length are discarded silently. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1385:1 specifier|static
|
|
1385:8 name|void
|
|
1385:13 name|audit_receive_skb
|
|
1385:30 parameter_list|(
|
|
1385:31 name|struct
|
|
1385:38 name|sk_buff
|
|
1385:46 modifier|*
|
|
1385:47 name|skb
|
|
1385:50 parameter_list|)
|
|
1386:1 block|{
|
|
1387:2 name|struct
|
|
1387:9 name|nlmsghdr
|
|
1387:18 modifier|*
|
|
1387:19 name|nlh
|
|
1387:22 decl_stmt|;
|
|
1388:2 comment|/* * len MUST be signed for nlmsg_next to be able to dec it below 0 * if the nlmsg_len was not aligned */
|
|
1392:2 name|int
|
|
1392:6 name|len
|
|
1392:9 decl_stmt|;
|
|
1393:2 name|int
|
|
1393:6 name|err
|
|
1393:9 decl_stmt|;
|
|
1395:2 name|nlh
|
|
1395:6 operator|=
|
|
1395:8 name|nlmsg_hdr
|
|
1395:17 argument_list|(
|
|
1395:18 name|skb
|
|
1395:21 argument_list|)
|
|
1395:22 expr_stmt|;
|
|
1396:2 name|len
|
|
1396:6 operator|=
|
|
1396:8 name|skb
|
|
1396:11 operator|->
|
|
1396:13 name|len
|
|
1396:16 expr_stmt|;
|
|
1398:2 while|while
|
|
1398:8 condition|(
|
|
1398:9 name|nlmsg_ok
|
|
1398:17 argument_list|(
|
|
1398:18 name|nlh
|
|
1398:21 argument_list|,
|
|
1398:23 name|len
|
|
1398:26 argument_list|)
|
|
1398:27 condition|)
|
|
1398:29 block|{
|
|
1399:3 name|err
|
|
1399:7 operator|=
|
|
1399:9 name|audit_receive_msg
|
|
1399:26 argument_list|(
|
|
1399:27 name|skb
|
|
1399:30 argument_list|,
|
|
1399:32 name|nlh
|
|
1399:35 argument_list|)
|
|
1399:36 expr_stmt|;
|
|
1400:3 comment|/* if err or if this message says it wants a response */
|
|
1401:3 if|if
|
|
1401:6 condition|(
|
|
1401:7 name|err
|
|
1401:11 operator|||
|
|
1401:14 operator|(
|
|
1401:15 name|nlh
|
|
1401:18 operator|->
|
|
1401:20 name|nlmsg_flags
|
|
1401:32 operator|&
|
|
1401:34 name|NLM_F_ACK
|
|
1401:43 operator|)
|
|
1401:44 condition|)
|
|
1402:4 name|netlink_ack
|
|
1402:15 argument_list|(
|
|
1402:16 name|skb
|
|
1402:19 argument_list|,
|
|
1402:21 name|nlh
|
|
1402:24 argument_list|,
|
|
1402:26 name|err
|
|
1402:29 argument_list|)
|
|
1402:30 expr_stmt|;
|
|
1404:3 name|nlh
|
|
1404:7 operator|=
|
|
1404:9 name|nlmsg_next
|
|
1404:19 argument_list|(
|
|
1404:20 name|nlh
|
|
1404:23 argument_list|,
|
|
1404:25 operator|&
|
|
1404:26 name|len
|
|
1404:29 argument_list|)
|
|
1404:30 expr_stmt|;
|
|
1405:2 block|}
|
|
1406:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1408:1 comment|/* Receive messages from netlink socket. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1409:1 specifier|static
|
|
1409:8 name|void
|
|
1409:13 name|audit_receive
|
|
1409:26 parameter_list|(
|
|
1409:27 name|struct
|
|
1409:34 name|sk_buff
|
|
1409:43 modifier|*
|
|
1409:44 name|skb
|
|
1409:47 parameter_list|)
|
|
1410:1 block|{
|
|
1411:2 name|mutex_lock
|
|
1411:12 argument_list|(
|
|
1411:13 operator|&
|
|
1411:14 name|audit_cmd_mutex
|
|
1411:29 argument_list|)
|
|
1411:30 expr_stmt|;
|
|
1412:2 name|audit_receive_skb
|
|
1412:19 argument_list|(
|
|
1412:20 name|skb
|
|
1412:23 argument_list|)
|
|
1412:24 expr_stmt|;
|
|
1413:2 name|mutex_unlock
|
|
1413:14 argument_list|(
|
|
1413:15 operator|&
|
|
1413:16 name|audit_cmd_mutex
|
|
1413:31 argument_list|)
|
|
1413:32 expr_stmt|;
|
|
1414:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1416:1 comment|/* Run custom bind function on netlink socket group connect or bind requests. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1417:1 specifier|static
|
|
1417:8 name|int
|
|
1417:12 name|audit_bind
|
|
1417:22 parameter_list|(
|
|
1417:23 name|struct
|
|
1417:30 name|net
|
|
1417:34 modifier|*
|
|
1417:35 name|net
|
|
1417:38 parameter_list|,
|
|
1417:40 name|int
|
|
1417:44 name|group
|
|
1417:49 parameter_list|)
|
|
1418:1 block|{
|
|
1419:2 if|if
|
|
1419:5 condition|(
|
|
1419:6 operator|!
|
|
1419:7 name|capable
|
|
1419:14 argument_list|(
|
|
1419:15 name|CAP_AUDIT_READ
|
|
1419:29 argument_list|)
|
|
1419:30 condition|)
|
|
1420:3 return|return
|
|
1420:10 operator|-
|
|
1420:11 name|EPERM
|
|
1420:16 return|;
|
|
1422:2 return|return
|
|
1422:9 literal|0
|
|
1422:10 return|;
|
|
1423:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
1425:1 specifier|static
|
|
1425:8 name|int
|
|
1425:12 name|__net_init
|
|
1425:23 name|audit_net_init
|
|
1425:37 parameter_list|(
|
|
1425:38 name|struct
|
|
1425:45 name|net
|
|
1425:49 modifier|*
|
|
1425:50 name|net
|
|
1425:53 parameter_list|)
|
|
1426:1 block|{
|
|
1427:2 name|struct
|
|
1427:9 name|netlink_kernel_cfg
|
|
1427:28 name|cfg
|
|
1427:32 init|=
|
|
1427:34 block|{
|
|
1428:3 operator|.
|
|
1428:4 name|input
|
|
1428:10 operator|=
|
|
1428:12 name|audit_receive
|
|
1428:25 block|,
|
|
1429:3 operator|.
|
|
1429:4 name|bind
|
|
1429:9 operator|=
|
|
1429:11 name|audit_bind
|
|
1429:21 block|,
|
|
1430:3 operator|.
|
|
1430:4 name|flags
|
|
1430:10 operator|=
|
|
1430:12 name|NL_CFG_F_NONROOT_RECV
|
|
1430:33 block|,
|
|
1431:3 operator|.
|
|
1431:4 name|groups
|
|
1431:11 operator|=
|
|
1431:13 name|AUDIT_NLGRP_MAX
|
|
1431:28 block|, }
|
|
1432:3 decl_stmt|;
|
|
1434:2 name|struct
|
|
1434:9 name|audit_net
|
|
1434:19 modifier|*
|
|
1434:20 name|aunet
|
|
1434:26 init|=
|
|
1434:28 name|net_generic
|
|
1434:39 argument_list|(
|
|
1434:40 name|net
|
|
1434:43 argument_list|,
|
|
1434:45 name|audit_net_id
|
|
1434:57 argument_list|)
|
|
1434:58 decl_stmt|;
|
|
1436:2 name|aunet
|
|
1436:7 operator|->
|
|
1436:9 name|sk
|
|
1436:12 operator|=
|
|
1436:14 name|netlink_kernel_create
|
|
1436:35 argument_list|(
|
|
1436:36 name|net
|
|
1436:39 argument_list|,
|
|
1436:41 name|NETLINK_AUDIT
|
|
1436:54 argument_list|,
|
|
1436:56 operator|&
|
|
1436:57 name|cfg
|
|
1436:60 argument_list|)
|
|
1436:61 expr_stmt|;
|
|
1437:2 if|if
|
|
1437:5 condition|(
|
|
1437:6 name|aunet
|
|
1437:11 operator|->
|
|
1437:13 name|sk
|
|
1437:16 operator|==
|
|
1437:19 name|NULL
|
|
1437:23 condition|)
|
|
1437:25 block|{
|
|
1438:3 name|audit_panic
|
|
1438:14 argument_list|(
|
|
1438:15 literal|"cannot initialize netlink socket in namespace"
|
|
1438:62 argument_list|)
|
|
1438:63 expr_stmt|;
|
|
1439:3 return|return
|
|
1439:10 operator|-
|
|
1439:11 name|ENOMEM
|
|
1439:17 return|;
|
|
1440:2 block|}
|
|
1441:2 name|aunet
|
|
1441:7 operator|->
|
|
1441:9 name|sk
|
|
1441:11 operator|->
|
|
1441:13 name|sk_sndtimeo
|
|
1441:25 operator|=
|
|
1441:27 name|MAX_SCHEDULE_TIMEOUT
|
|
1441:47 expr_stmt|;
|
|
1443:2 return|return
|
|
1443:9 literal|0
|
|
1443:10 return|;
|
|
1444:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
1446:1 specifier|static
|
|
1446:8 name|void
|
|
1446:13 name|__net_exit
|
|
1446:24 name|audit_net_exit
|
|
1446:38 parameter_list|(
|
|
1446:39 name|struct
|
|
1446:46 name|net
|
|
1446:50 modifier|*
|
|
1446:51 name|net
|
|
1446:54 parameter_list|)
|
|
1447:1 block|{
|
|
1448:2 name|struct
|
|
1448:9 name|audit_net
|
|
1448:19 modifier|*
|
|
1448:20 name|aunet
|
|
1448:26 init|=
|
|
1448:28 name|net_generic
|
|
1448:39 argument_list|(
|
|
1448:40 name|net
|
|
1448:43 argument_list|,
|
|
1448:45 name|audit_net_id
|
|
1448:57 argument_list|)
|
|
1448:58 decl_stmt|;
|
|
1450:2 name|rcu_read_lock
|
|
1450:15 argument_list|()
|
|
1450:17 expr_stmt|;
|
|
1451:2 if|if
|
|
1451:5 condition|(
|
|
1451:6 name|net
|
|
1451:10 operator|==
|
|
1451:13 name|auditd_conn
|
|
1451:24 operator|.
|
|
1451:25 name|net
|
|
1451:28 condition|)
|
|
1452:3 name|auditd_reset
|
|
1452:15 argument_list|()
|
|
1452:17 expr_stmt|;
|
|
1453:2 name|rcu_read_unlock
|
|
1453:17 argument_list|()
|
|
1453:19 expr_stmt|;
|
|
1455:2 name|netlink_kernel_release
|
|
1455:24 argument_list|(
|
|
1455:25 name|aunet
|
|
1455:30 operator|->
|
|
1455:32 name|sk
|
|
1455:34 argument_list|)
|
|
1455:35 expr_stmt|;
|
|
1456:1 block|}
|
|
-:- end_function
|
|
-:- begin_decl_stmt
|
|
1458:1 specifier|static
|
|
1458:8 name|struct
|
|
1458:15 name|pernet_operations
|
|
1458:33 name|audit_net_ops
|
|
1458:47 name|__net_initdata
|
|
1458:62 init|=
|
|
1458:64 block|{
|
|
1459:2 operator|.
|
|
1459:3 name|init
|
|
1459:8 operator|=
|
|
1459:10 name|audit_net_init
|
|
1459:24 block|,
|
|
1460:2 operator|.
|
|
1460:3 name|exit
|
|
1460:8 operator|=
|
|
1460:10 name|audit_net_exit
|
|
1460:24 block|,
|
|
1461:2 operator|.
|
|
1461:3 name|id
|
|
1461:6 operator|=
|
|
1461:8 operator|&
|
|
1461:9 name|audit_net_id
|
|
1461:21 block|,
|
|
1462:2 operator|.
|
|
1462:3 name|size
|
|
1462:8 operator|=
|
|
1462:10 sizeof|sizeof
|
|
1462:16 argument_list|(
|
|
1462:17 expr|struct
|
|
1462:24 name|audit_net
|
|
1462:33 argument_list|)
|
|
1462:34 block|, }
|
|
1463:2 decl_stmt|;
|
|
-:- end_decl_stmt
|
|
-:- begin_comment
|
|
1465:1 comment|/* Initialize audit support at boot time. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1466:1 specifier|static
|
|
1466:8 name|int
|
|
1466:12 name|__init
|
|
1466:19 name|audit_init
|
|
1466:29 parameter_list|(
|
|
1466:30 name|void
|
|
1466:34 parameter_list|)
|
|
1467:1 block|{
|
|
1468:2 name|int
|
|
1468:6 name|i
|
|
1468:7 decl_stmt|;
|
|
1470:2 if|if
|
|
1470:5 condition|(
|
|
1470:6 name|audit_initialized
|
|
1470:24 operator|==
|
|
1470:27 name|AUDIT_DISABLED
|
|
1470:41 condition|)
|
|
1471:3 return|return
|
|
1471:10 literal|0
|
|
1471:11 return|;
|
|
1473:2 name|memset
|
|
1473:8 argument_list|(
|
|
1473:9 operator|&
|
|
1473:10 name|auditd_conn
|
|
1473:21 argument_list|,
|
|
1473:23 literal|0
|
|
1473:24 argument_list|,
|
|
1473:26 sizeof|sizeof
|
|
1473:32 argument_list|(
|
|
1473:33 name|auditd_conn
|
|
1473:44 argument_list|)
|
|
1473:45 argument_list|)
|
|
1473:46 expr_stmt|;
|
|
1474:2 name|spin_lock_init
|
|
1474:16 argument_list|(
|
|
1474:17 operator|&
|
|
1474:18 name|auditd_conn
|
|
1474:29 operator|.
|
|
1474:30 name|lock
|
|
1474:34 argument_list|)
|
|
1474:35 expr_stmt|;
|
|
1476:2 name|skb_queue_head_init
|
|
1476:21 argument_list|(
|
|
1476:22 operator|&
|
|
1476:23 name|audit_queue
|
|
1476:34 argument_list|)
|
|
1476:35 expr_stmt|;
|
|
1477:2 name|skb_queue_head_init
|
|
1477:21 argument_list|(
|
|
1477:22 operator|&
|
|
1477:23 name|audit_retry_queue
|
|
1477:40 argument_list|)
|
|
1477:41 expr_stmt|;
|
|
1478:2 name|skb_queue_head_init
|
|
1478:21 argument_list|(
|
|
1478:22 operator|&
|
|
1478:23 name|audit_hold_queue
|
|
1478:39 argument_list|)
|
|
1478:40 expr_stmt|;
|
|
1480:2 for|for
|
|
1480:6 control|(
|
|
1480:7 name|i
|
|
1480:9 operator|=
|
|
1480:11 literal|0
|
|
1480:12 init|;
|
|
1480:14 name|i
|
|
1480:16 operator|<
|
|
1480:18 name|AUDIT_INODE_BUCKETS
|
|
1480:37 condition|;
|
|
1480:39 name|i
|
|
1480:40 operator|++
|
|
1480:42 control|)
|
|
1481:3 name|INIT_LIST_HEAD
|
|
1481:17 argument_list|(
|
|
1481:18 operator|&
|
|
1481:19 name|audit_inode_hash
|
|
1481:35 index|[
|
|
1481:36 name|i
|
|
1481:37 index|]
|
|
1481:38 argument_list|)
|
|
1481:39 expr_stmt|;
|
|
1483:2 name|pr_info
|
|
1483:9 argument_list|(
|
|
1483:10 literal|"initializing netlink subsys (%s)\n"
|
|
1483:46 argument_list|,
|
|
1484:3 name|audit_default
|
|
1484:17 condition|?
|
|
1484:19 literal|"enabled"
|
|
1484:29 else|:
|
|
1484:31 literal|"disabled"
|
|
1484:41 argument_list|)
|
|
1484:42 expr_stmt|;
|
|
1485:2 name|register_pernet_subsys
|
|
1485:24 argument_list|(
|
|
1485:25 operator|&
|
|
1485:26 name|audit_net_ops
|
|
1485:39 argument_list|)
|
|
1485:40 expr_stmt|;
|
|
1487:2 name|audit_initialized
|
|
1487:20 operator|=
|
|
1487:22 name|AUDIT_INITIALIZED
|
|
1487:39 expr_stmt|;
|
|
1488:2 name|audit_enabled
|
|
1488:16 operator|=
|
|
1488:18 name|audit_default
|
|
1488:31 expr_stmt|;
|
|
1489:2 name|audit_ever_enabled
|
|
1489:21 operator||=
|
|
1489:24 operator|!
|
|
1489:25 operator|!
|
|
1489:26 name|audit_default
|
|
1489:39 expr_stmt|;
|
|
1491:2 name|kauditd_task
|
|
1491:15 operator|=
|
|
1491:17 name|kthread_run
|
|
1491:28 argument_list|(
|
|
1491:29 name|kauditd_thread
|
|
1491:43 argument_list|,
|
|
1491:45 name|NULL
|
|
1491:49 argument_list|,
|
|
1491:51 literal|"kauditd"
|
|
1491:60 argument_list|)
|
|
1491:61 expr_stmt|;
|
|
1492:2 if|if
|
|
1492:5 condition|(
|
|
1492:6 name|IS_ERR
|
|
1492:12 argument_list|(
|
|
1492:13 name|kauditd_task
|
|
1492:25 argument_list|)
|
|
1492:26 condition|)
|
|
1492:28 block|{
|
|
1493:3 name|int
|
|
1493:7 name|err
|
|
1493:11 init|=
|
|
1493:13 name|PTR_ERR
|
|
1493:20 argument_list|(
|
|
1493:21 name|kauditd_task
|
|
1493:33 argument_list|)
|
|
1493:34 decl_stmt|;
|
|
1494:3 name|panic
|
|
1494:8 argument_list|(
|
|
1494:9 literal|"audit: failed to start the kauditd thread (%d)\n"
|
|
1494:59 argument_list|,
|
|
1494:61 name|err
|
|
1494:64 argument_list|)
|
|
1494:65 expr_stmt|;
|
|
1495:2 block|}
|
|
1497:2 name|audit_log
|
|
1497:11 argument_list|(
|
|
1497:12 name|NULL
|
|
1497:16 argument_list|,
|
|
1497:18 name|GFP_KERNEL
|
|
1497:28 argument_list|,
|
|
1497:30 name|AUDIT_KERNEL
|
|
1497:42 argument_list|,
|
|
1498:3 literal|"state=initialized audit_enabled=%u res=1"
|
|
1498:45 argument_list|,
|
|
1499:4 name|audit_enabled
|
|
1499:17 argument_list|)
|
|
1499:18 expr_stmt|;
|
|
1501:2 return|return
|
|
1501:9 literal|0
|
|
1501:10 return|;
|
|
1502:1 block|}
|
|
-:- end_function
|
|
-:- begin_expr_stmt
|
|
1503:1 name|__initcall
|
|
1503:11 argument_list|(
|
|
1503:12 name|audit_init
|
|
1503:22 argument_list|)
|
|
1503:23 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_comment
|
|
1505:1 comment|/* Process kernel command-line parameter at boot time. audit=0 or audit=1. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1506:1 specifier|static
|
|
1506:8 name|int
|
|
1506:12 name|__init
|
|
1506:19 name|audit_enable
|
|
1506:31 parameter_list|(
|
|
1506:32 name|char
|
|
1506:37 modifier|*
|
|
1506:38 name|str
|
|
1506:41 parameter_list|)
|
|
1507:1 block|{
|
|
1508:2 name|audit_default
|
|
1508:16 operator|=
|
|
1508:18 operator|!
|
|
1508:19 operator|!
|
|
1508:20 name|simple_strtol
|
|
1508:33 argument_list|(
|
|
1508:34 name|str
|
|
1508:37 argument_list|,
|
|
1508:39 name|NULL
|
|
1508:43 argument_list|,
|
|
1508:45 literal|0
|
|
1508:46 argument_list|)
|
|
1508:47 expr_stmt|;
|
|
1509:2 if|if
|
|
1509:5 condition|(
|
|
1509:6 operator|!
|
|
1509:7 name|audit_default
|
|
1509:20 condition|)
|
|
1510:3 name|audit_initialized
|
|
1510:21 operator|=
|
|
1510:23 name|AUDIT_DISABLED
|
|
1510:37 expr_stmt|;
|
|
1512:2 name|pr_info
|
|
1512:9 argument_list|(
|
|
1512:10 literal|"%s\n"
|
|
1512:16 argument_list|,
|
|
1512:18 name|audit_default
|
|
1512:32 condition|?
|
|
1513:3 literal|"enabled (after initialization)"
|
|
1513:36 else|:
|
|
1513:38 literal|"disabled (until reboot)"
|
|
1513:63 argument_list|)
|
|
1513:64 expr_stmt|;
|
|
1515:2 return|return
|
|
1515:9 literal|1
|
|
1515:10 return|;
|
|
1516:1 block|}
|
|
-:- end_function
|
|
-:- begin_expr_stmt
|
|
1517:1 name|__setup
|
|
1517:8 argument_list|(
|
|
1517:9 literal|"audit="
|
|
1517:17 argument_list|,
|
|
1517:19 name|audit_enable
|
|
1517:31 argument_list|)
|
|
1517:32 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_comment
|
|
1519:1 comment|/* Process kernel command-line parameter at boot time. * audit_backlog_limit=<n> */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1521:1 specifier|static
|
|
1521:8 name|int
|
|
1521:12 name|__init
|
|
1521:19 name|audit_backlog_limit_set
|
|
1521:42 parameter_list|(
|
|
1521:43 name|char
|
|
1521:48 modifier|*
|
|
1521:49 name|str
|
|
1521:52 parameter_list|)
|
|
1522:1 block|{
|
|
1523:2 name|u32
|
|
1523:6 name|audit_backlog_limit_arg
|
|
1523:29 decl_stmt|;
|
|
1525:2 name|pr_info
|
|
1525:9 argument_list|(
|
|
1525:10 literal|"audit_backlog_limit: "
|
|
1525:33 argument_list|)
|
|
1525:34 expr_stmt|;
|
|
1526:2 if|if
|
|
1526:5 condition|(
|
|
1526:6 name|kstrtouint
|
|
1526:16 argument_list|(
|
|
1526:17 name|str
|
|
1526:20 argument_list|,
|
|
1526:22 literal|0
|
|
1526:23 argument_list|,
|
|
1526:25 operator|&
|
|
1526:26 name|audit_backlog_limit_arg
|
|
1526:49 argument_list|)
|
|
1526:50 condition|)
|
|
1526:52 block|{
|
|
1527:3 name|pr_cont
|
|
1527:10 argument_list|(
|
|
1527:11 literal|"using default of %u, unable to parse %s\n"
|
|
1527:54 argument_list|,
|
|
1528:4 name|audit_backlog_limit
|
|
1528:23 argument_list|,
|
|
1528:25 name|str
|
|
1528:28 argument_list|)
|
|
1528:29 expr_stmt|;
|
|
1529:3 return|return
|
|
1529:10 literal|1
|
|
1529:11 return|;
|
|
1530:2 block|}
|
|
1532:2 name|audit_backlog_limit
|
|
1532:22 operator|=
|
|
1532:24 name|audit_backlog_limit_arg
|
|
1532:47 expr_stmt|;
|
|
1533:2 name|pr_cont
|
|
1533:9 argument_list|(
|
|
1533:10 literal|"%d\n"
|
|
1533:16 argument_list|,
|
|
1533:18 name|audit_backlog_limit
|
|
1533:37 argument_list|)
|
|
1533:38 expr_stmt|;
|
|
1535:2 return|return
|
|
1535:9 literal|1
|
|
1535:10 return|;
|
|
1536:1 block|}
|
|
-:- end_function
|
|
-:- begin_expr_stmt
|
|
1537:1 name|__setup
|
|
1537:8 argument_list|(
|
|
1537:9 literal|"audit_backlog_limit="
|
|
1537:31 argument_list|,
|
|
1537:33 name|audit_backlog_limit_set
|
|
1537:56 argument_list|)
|
|
1537:57 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_function
|
|
1539:1 specifier|static
|
|
1539:8 name|void
|
|
1539:13 name|audit_buffer_free
|
|
1539:30 parameter_list|(
|
|
1539:31 name|struct
|
|
1539:38 name|audit_buffer
|
|
1539:51 modifier|*
|
|
1539:52 name|ab
|
|
1539:54 parameter_list|)
|
|
1540:1 block|{
|
|
1541:2 name|unsigned
|
|
1541:11 name|long
|
|
1541:16 name|flags
|
|
1541:21 decl_stmt|;
|
|
1543:2 if|if
|
|
1543:5 condition|(
|
|
1543:6 operator|!
|
|
1543:7 name|ab
|
|
1543:9 condition|)
|
|
1544:3 return|return;
|
|
1546:2 name|kfree_skb
|
|
1546:11 argument_list|(
|
|
1546:12 name|ab
|
|
1546:14 operator|->
|
|
1546:16 name|skb
|
|
1546:19 argument_list|)
|
|
1546:20 expr_stmt|;
|
|
1547:2 name|spin_lock_irqsave
|
|
1547:19 argument_list|(
|
|
1547:20 operator|&
|
|
1547:21 name|audit_freelist_lock
|
|
1547:40 argument_list|,
|
|
1547:42 name|flags
|
|
1547:47 argument_list|)
|
|
1547:48 expr_stmt|;
|
|
1548:2 if|if
|
|
1548:5 condition|(
|
|
1548:6 name|audit_freelist_count
|
|
1548:27 operator|>
|
|
1548:29 name|AUDIT_MAXFREE
|
|
1548:42 condition|)
|
|
1549:3 name|kfree
|
|
1549:8 argument_list|(
|
|
1549:9 name|ab
|
|
1549:11 argument_list|)
|
|
1549:12 expr_stmt|;
|
|
1550:2 else|else
|
|
1550:7 block|{
|
|
1551:3 name|audit_freelist_count
|
|
1551:23 operator|++
|
|
1551:25 expr_stmt|;
|
|
1552:3 name|list_add
|
|
1552:11 argument_list|(
|
|
1552:12 operator|&
|
|
1552:13 name|ab
|
|
1552:15 operator|->
|
|
1552:17 name|list
|
|
1552:21 argument_list|,
|
|
1552:23 operator|&
|
|
1552:24 name|audit_freelist
|
|
1552:38 argument_list|)
|
|
1552:39 expr_stmt|;
|
|
1553:2 block|}
|
|
1554:2 name|spin_unlock_irqrestore
|
|
1554:24 argument_list|(
|
|
1554:25 operator|&
|
|
1554:26 name|audit_freelist_lock
|
|
1554:45 argument_list|,
|
|
1554:47 name|flags
|
|
1554:52 argument_list|)
|
|
1554:53 expr_stmt|;
|
|
1555:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
1557:1 specifier|static
|
|
1557:8 name|struct
|
|
1557:15 name|audit_buffer
|
|
1557:28 modifier|*
|
|
1557:30 name|audit_buffer_alloc
|
|
1557:48 parameter_list|(
|
|
1557:49 name|struct
|
|
1557:56 name|audit_context
|
|
1557:70 modifier|*
|
|
1557:71 name|ctx
|
|
1557:74 parameter_list|,
|
|
1558:7 name|gfp_t
|
|
1558:13 name|gfp_mask
|
|
1558:21 parameter_list|,
|
|
1558:23 name|int
|
|
1558:27 name|type
|
|
1558:31 parameter_list|)
|
|
1559:1 block|{
|
|
1560:2 name|unsigned
|
|
1560:11 name|long
|
|
1560:16 name|flags
|
|
1560:21 decl_stmt|;
|
|
1561:2 name|struct
|
|
1561:9 name|audit_buffer
|
|
1561:22 modifier|*
|
|
1561:23 name|ab
|
|
1561:26 init|=
|
|
1561:28 name|NULL
|
|
1561:32 decl_stmt|;
|
|
1562:2 name|struct
|
|
1562:9 name|nlmsghdr
|
|
1562:18 modifier|*
|
|
1562:19 name|nlh
|
|
1562:22 decl_stmt|;
|
|
1564:2 name|spin_lock_irqsave
|
|
1564:19 argument_list|(
|
|
1564:20 operator|&
|
|
1564:21 name|audit_freelist_lock
|
|
1564:40 argument_list|,
|
|
1564:42 name|flags
|
|
1564:47 argument_list|)
|
|
1564:48 expr_stmt|;
|
|
1565:2 if|if
|
|
1565:5 condition|(
|
|
1565:6 operator|!
|
|
1565:7 name|list_empty
|
|
1565:17 argument_list|(
|
|
1565:18 operator|&
|
|
1565:19 name|audit_freelist
|
|
1565:33 argument_list|)
|
|
1565:34 condition|)
|
|
1565:36 block|{
|
|
1566:3 name|ab
|
|
1566:6 operator|=
|
|
1566:8 name|list_entry
|
|
1566:18 argument_list|(
|
|
1566:19 name|audit_freelist
|
|
1566:33 operator|.
|
|
1566:34 name|next
|
|
1566:38 argument_list|,
|
|
1567:5 expr|struct
|
|
1567:12 name|audit_buffer
|
|
1567:24 argument_list|,
|
|
1567:26 name|list
|
|
1567:30 argument_list|)
|
|
1567:31 expr_stmt|;
|
|
1568:3 name|list_del
|
|
1568:11 argument_list|(
|
|
1568:12 operator|&
|
|
1568:13 name|ab
|
|
1568:15 operator|->
|
|
1568:17 name|list
|
|
1568:21 argument_list|)
|
|
1568:22 expr_stmt|;
|
|
1569:3 operator|--
|
|
1569:5 name|audit_freelist_count
|
|
1569:25 expr_stmt|;
|
|
1570:2 block|}
|
|
1571:2 name|spin_unlock_irqrestore
|
|
1571:24 argument_list|(
|
|
1571:25 operator|&
|
|
1571:26 name|audit_freelist_lock
|
|
1571:45 argument_list|,
|
|
1571:47 name|flags
|
|
1571:52 argument_list|)
|
|
1571:53 expr_stmt|;
|
|
1573:2 if|if
|
|
1573:5 condition|(
|
|
1573:6 operator|!
|
|
1573:7 name|ab
|
|
1573:9 condition|)
|
|
1573:11 block|{
|
|
1574:3 name|ab
|
|
1574:6 operator|=
|
|
1574:8 name|kmalloc
|
|
1574:15 argument_list|(
|
|
1574:16 sizeof|sizeof
|
|
1574:22 argument_list|(
|
|
1574:23 operator|*
|
|
1574:24 name|ab
|
|
1574:26 argument_list|)
|
|
1574:27 argument_list|,
|
|
1574:29 name|gfp_mask
|
|
1574:37 argument_list|)
|
|
1574:38 expr_stmt|;
|
|
1575:3 if|if
|
|
1575:6 condition|(
|
|
1575:7 operator|!
|
|
1575:8 name|ab
|
|
1575:10 condition|)
|
|
1576:4 goto|goto
|
|
1576:9 name|err
|
|
1576:12 goto|;
|
|
1577:2 block|}
|
|
1579:2 name|ab
|
|
1579:4 operator|->
|
|
1579:6 name|ctx
|
|
1579:10 operator|=
|
|
1579:12 name|ctx
|
|
1579:15 expr_stmt|;
|
|
1580:2 name|ab
|
|
1580:4 operator|->
|
|
1580:6 name|gfp_mask
|
|
1580:15 operator|=
|
|
1580:17 name|gfp_mask
|
|
1580:25 expr_stmt|;
|
|
1582:2 name|ab
|
|
1582:4 operator|->
|
|
1582:6 name|skb
|
|
1582:10 operator|=
|
|
1582:12 name|nlmsg_new
|
|
1582:21 argument_list|(
|
|
1582:22 name|AUDIT_BUFSIZ
|
|
1582:34 argument_list|,
|
|
1582:36 name|gfp_mask
|
|
1582:44 argument_list|)
|
|
1582:45 expr_stmt|;
|
|
1583:2 if|if
|
|
1583:5 condition|(
|
|
1583:6 operator|!
|
|
1583:7 name|ab
|
|
1583:9 operator|->
|
|
1583:11 name|skb
|
|
1583:14 condition|)
|
|
1584:3 goto|goto
|
|
1584:8 name|err
|
|
1584:11 goto|;
|
|
1586:2 name|nlh
|
|
1586:6 operator|=
|
|
1586:8 name|nlmsg_put
|
|
1586:17 argument_list|(
|
|
1586:18 name|ab
|
|
1586:20 operator|->
|
|
1586:22 name|skb
|
|
1586:25 argument_list|,
|
|
1586:27 literal|0
|
|
1586:28 argument_list|,
|
|
1586:30 literal|0
|
|
1586:31 argument_list|,
|
|
1586:33 name|type
|
|
1586:37 argument_list|,
|
|
1586:39 literal|0
|
|
1586:40 argument_list|,
|
|
1586:42 literal|0
|
|
1586:43 argument_list|)
|
|
1586:44 expr_stmt|;
|
|
1587:2 if|if
|
|
1587:5 condition|(
|
|
1587:6 operator|!
|
|
1587:7 name|nlh
|
|
1587:10 condition|)
|
|
1588:3 goto|goto
|
|
1588:8 name|out_kfree_skb
|
|
1588:21 goto|;
|
|
1590:2 return|return
|
|
1590:9 name|ab
|
|
1590:11 return|;
|
|
1592:1 name|out_kfree_skb
|
|
1592:14 label|:
|
|
1593:2 name|kfree_skb
|
|
1593:11 argument_list|(
|
|
1593:12 name|ab
|
|
1593:14 operator|->
|
|
1593:16 name|skb
|
|
1593:19 argument_list|)
|
|
1593:20 expr_stmt|;
|
|
1594:2 name|ab
|
|
1594:4 operator|->
|
|
1594:6 name|skb
|
|
1594:10 operator|=
|
|
1594:12 name|NULL
|
|
1594:16 expr_stmt|;
|
|
1595:1 name|err
|
|
1595:4 label|:
|
|
1596:2 name|audit_buffer_free
|
|
1596:19 argument_list|(
|
|
1596:20 name|ab
|
|
1596:22 argument_list|)
|
|
1596:23 expr_stmt|;
|
|
1597:2 return|return
|
|
1597:9 name|NULL
|
|
1597:13 return|;
|
|
1598:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1600:1 comment|/** * audit_serial - compute a serial number for the audit record * * Compute a serial number for the audit record. Audit records are * written to user-space as soon as they are generated, so a complete * audit record may be written in several pieces. The timestamp of the * record and this serial number are used by the user-space tools to * determine which pieces belong to the same audit record. The * (timestamp,serial) tuple is unique for each syscall and is live from * syscall entry to syscall exit. * * NOTE: Another possibility is to store the formatted records off the * audit context (for those records that have a context), and emit them * all at syscall exit. However, this could delay the reporting of * significant errors until syscall exit (or never, if the system * halts). */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1617:1 name|unsigned
|
|
1617:10 name|int
|
|
1617:14 name|audit_serial
|
|
1617:26 parameter_list|(
|
|
1617:27 name|void
|
|
1617:31 parameter_list|)
|
|
1618:1 block|{
|
|
1619:2 specifier|static
|
|
1619:9 name|atomic_t
|
|
1619:18 name|serial
|
|
1619:25 init|=
|
|
1619:27 name|ATOMIC_INIT
|
|
1619:38 argument_list|(
|
|
1619:39 literal|0
|
|
1619:40 argument_list|)
|
|
1619:41 decl_stmt|;
|
|
1621:2 return|return
|
|
1621:9 name|atomic_add_return
|
|
1621:26 argument_list|(
|
|
1621:27 literal|1
|
|
1621:28 argument_list|,
|
|
1621:30 operator|&
|
|
1621:31 name|serial
|
|
1621:37 argument_list|)
|
|
1621:38 return|;
|
|
1622:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
1624:1 specifier|static
|
|
1624:8 specifier|inline
|
|
1624:15 name|void
|
|
1624:20 name|audit_get_stamp
|
|
1624:35 parameter_list|(
|
|
1624:36 name|struct
|
|
1624:43 name|audit_context
|
|
1624:57 modifier|*
|
|
1624:58 name|ctx
|
|
1624:61 parameter_list|,
|
|
1625:8 name|struct
|
|
1625:15 name|timespec
|
|
1625:24 modifier|*
|
|
1625:25 name|t
|
|
1625:26 parameter_list|,
|
|
1625:28 name|unsigned
|
|
1625:37 name|int
|
|
1625:41 modifier|*
|
|
1625:42 name|serial
|
|
1625:48 parameter_list|)
|
|
1626:1 block|{
|
|
1627:2 if|if
|
|
1627:5 condition|(
|
|
1627:6 operator|!
|
|
1627:7 name|ctx
|
|
1627:11 operator|||
|
|
1627:14 operator|!
|
|
1627:15 name|auditsc_get_stamp
|
|
1627:32 argument_list|(
|
|
1627:33 name|ctx
|
|
1627:36 argument_list|,
|
|
1627:38 name|t
|
|
1627:39 argument_list|,
|
|
1627:41 name|serial
|
|
1627:47 argument_list|)
|
|
1627:48 condition|)
|
|
1627:50 block|{
|
|
1628:3 operator|*
|
|
1628:4 name|t
|
|
1628:6 operator|=
|
|
1628:8 name|CURRENT_TIME
|
|
1628:20 expr_stmt|;
|
|
1629:3 operator|*
|
|
1629:4 name|serial
|
|
1629:11 operator|=
|
|
1629:13 name|audit_serial
|
|
1629:25 argument_list|()
|
|
1629:27 expr_stmt|;
|
|
1630:2 block|}
|
|
1631:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1633:1 comment|/** * audit_log_start - obtain an audit buffer * @ctx: audit_context (may be NULL) * @gfp_mask: type of allocation * @type: audit message type * * Returns audit_buffer pointer on success or NULL on error. * * Obtain an audit buffer. This routine does locking to obtain the * audit buffer, but then no locking is required for calls to * audit_log_*format. If the task (ctx) is a task that is currently in a * syscall, then the syscall is marked as auditable and an audit record * will be written at syscall exit. If there is no associated task, then * task context (ctx) should be NULL. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1648:1 name|struct
|
|
1648:8 name|audit_buffer
|
|
1648:21 modifier|*
|
|
1648:22 name|audit_log_start
|
|
1648:37 parameter_list|(
|
|
1648:38 name|struct
|
|
1648:45 name|audit_context
|
|
1648:59 modifier|*
|
|
1648:60 name|ctx
|
|
1648:63 parameter_list|,
|
|
1648:65 name|gfp_t
|
|
1648:71 name|gfp_mask
|
|
1648:79 parameter_list|,
|
|
1649:10 name|int
|
|
1649:14 name|type
|
|
1649:18 parameter_list|)
|
|
1650:1 block|{
|
|
1651:2 name|struct
|
|
1651:9 name|audit_buffer
|
|
1651:22 modifier|*
|
|
1651:23 name|ab
|
|
1651:25 decl_stmt|;
|
|
1652:2 name|struct
|
|
1652:9 name|timespec
|
|
1652:18 name|t
|
|
1652:19 decl_stmt|;
|
|
1653:2 name|unsigned
|
|
1653:11 name|int
|
|
1653:15 name|uninitialized_var
|
|
1653:32 argument_list|(
|
|
1653:33 name|serial
|
|
1653:39 argument_list|)
|
|
1653:40 decl_stmt|;
|
|
1655:2 if|if
|
|
1655:5 condition|(
|
|
1655:6 name|audit_initialized
|
|
1655:24 operator|!=
|
|
1655:27 name|AUDIT_INITIALIZED
|
|
1655:44 condition|)
|
|
1656:3 return|return
|
|
1656:10 name|NULL
|
|
1656:14 return|;
|
|
1658:2 if|if
|
|
1658:5 condition|(
|
|
1658:6 name|unlikely
|
|
1658:14 argument_list|(
|
|
1658:15 operator|!
|
|
1658:16 name|audit_filter
|
|
1658:28 argument_list|(
|
|
1658:29 name|type
|
|
1658:33 argument_list|,
|
|
1658:35 name|AUDIT_FILTER_TYPE
|
|
1658:52 argument_list|)
|
|
1658:53 argument_list|)
|
|
1658:54 condition|)
|
|
1659:3 return|return
|
|
1659:10 name|NULL
|
|
1659:14 return|;
|
|
1661:2 comment|/* NOTE: don't ever fail/sleep on these two conditions: * 1. auditd generated record - since we need auditd to drain the * queue; also, when we are checking for auditd, compare PIDs using * task_tgid_vnr() since auditd_pid is set in audit_receive_msg() * using a PID anchored in the caller's namespace * 2. generator holding the audit_cmd_mutex - we don't want to block * while holding the mutex */
|
|
1668:2 if|if
|
|
1668:5 condition|(
|
|
1668:6 operator|!
|
|
1668:7 operator|(
|
|
1668:8 name|auditd_test_task
|
|
1668:24 argument_list|(
|
|
1668:25 name|current
|
|
1668:32 argument_list|)
|
|
1668:34 operator|||
|
|
1669:8 operator|(
|
|
1669:9 name|current
|
|
1669:17 operator|==
|
|
1669:20 name|__mutex_owner
|
|
1669:33 argument_list|(
|
|
1669:34 operator|&
|
|
1669:35 name|audit_cmd_mutex
|
|
1669:50 argument_list|)
|
|
1669:51 operator|)
|
|
1669:52 operator|)
|
|
1669:53 condition|)
|
|
1669:55 block|{
|
|
1670:3 name|long
|
|
1670:8 name|stime
|
|
1670:14 init|=
|
|
1670:16 name|audit_backlog_wait_time
|
|
1670:39 decl_stmt|;
|
|
1672:3 while|while
|
|
1672:9 condition|(
|
|
1672:10 name|audit_backlog_limit
|
|
1672:30 operator|&&
|
|
1673:10 operator|(
|
|
1673:11 name|skb_queue_len
|
|
1673:24 argument_list|(
|
|
1673:25 operator|&
|
|
1673:26 name|audit_queue
|
|
1673:37 argument_list|)
|
|
1673:39 operator|>
|
|
1673:41 name|audit_backlog_limit
|
|
1673:60 operator|)
|
|
1673:61 condition|)
|
|
1673:63 block|{
|
|
1674:4 comment|/* wake kauditd to try and flush the queue */
|
|
1675:4 name|wake_up_interruptible
|
|
1675:25 argument_list|(
|
|
1675:26 operator|&
|
|
1675:27 name|kauditd_wait
|
|
1675:39 argument_list|)
|
|
1675:40 expr_stmt|;
|
|
1677:4 comment|/* sleep if we are allowed and we haven't exhausted our * backlog wait limit */
|
|
1679:4 if|if
|
|
1679:7 condition|(
|
|
1679:8 name|gfpflags_allow_blocking
|
|
1679:31 argument_list|(
|
|
1679:32 name|gfp_mask
|
|
1679:40 argument_list|)
|
|
1679:42 operator|&&
|
|
1679:45 operator|(
|
|
1679:46 name|stime
|
|
1679:52 operator|>
|
|
1679:54 literal|0
|
|
1679:55 operator|)
|
|
1679:56 condition|)
|
|
1679:58 block|{
|
|
1680:5 name|DECLARE_WAITQUEUE
|
|
1680:22 argument_list|(
|
|
1680:23 name|wait
|
|
1680:27 argument_list|,
|
|
1680:29 name|current
|
|
1680:36 argument_list|)
|
|
1680:37 expr_stmt|;
|
|
1682:5 name|add_wait_queue_exclusive
|
|
1682:29 argument_list|(
|
|
1682:30 operator|&
|
|
1682:31 name|audit_backlog_wait
|
|
1682:49 argument_list|,
|
|
1683:9 operator|&
|
|
1683:10 name|wait
|
|
1683:14 argument_list|)
|
|
1683:15 expr_stmt|;
|
|
1684:5 name|set_current_state
|
|
1684:22 argument_list|(
|
|
1684:23 name|TASK_UNINTERRUPTIBLE
|
|
1684:43 argument_list|)
|
|
1684:44 expr_stmt|;
|
|
1685:5 name|stime
|
|
1685:11 operator|=
|
|
1685:13 name|schedule_timeout
|
|
1685:29 argument_list|(
|
|
1685:30 name|stime
|
|
1685:35 argument_list|)
|
|
1685:36 expr_stmt|;
|
|
1686:5 name|remove_wait_queue
|
|
1686:22 argument_list|(
|
|
1686:23 operator|&
|
|
1686:24 name|audit_backlog_wait
|
|
1686:42 argument_list|,
|
|
1686:44 operator|&
|
|
1686:45 name|wait
|
|
1686:49 argument_list|)
|
|
1686:50 expr_stmt|;
|
|
1687:4 block|}
|
|
1687:6 else|else
|
|
1687:11 block|{
|
|
1688:5 if|if
|
|
1688:8 condition|(
|
|
1688:9 name|audit_rate_check
|
|
1688:25 argument_list|()
|
|
1688:28 operator|&&
|
|
1688:31 name|printk_ratelimit
|
|
1688:47 argument_list|()
|
|
1688:49 condition|)
|
|
1689:6 name|pr_warn
|
|
1689:13 argument_list|(
|
|
1689:14 literal|"audit_backlog=%d> audit_backlog_limit=%d\n"
|
|
1689:59 argument_list|,
|
|
1690:7 name|skb_queue_len
|
|
1690:20 argument_list|(
|
|
1690:21 operator|&
|
|
1690:22 name|audit_queue
|
|
1690:33 argument_list|)
|
|
1690:34 argument_list|,
|
|
1691:7 name|audit_backlog_limit
|
|
1691:26 argument_list|)
|
|
1691:27 expr_stmt|;
|
|
1692:5 name|audit_log_lost
|
|
1692:19 argument_list|(
|
|
1692:20 literal|"backlog limit exceeded"
|
|
1692:44 argument_list|)
|
|
1692:45 expr_stmt|;
|
|
1693:5 return|return
|
|
1693:12 name|NULL
|
|
1693:16 return|;
|
|
1694:4 block|}
|
|
1695:3 block|}
|
|
1696:2 block|}
|
|
1698:2 name|ab
|
|
1698:5 operator|=
|
|
1698:7 name|audit_buffer_alloc
|
|
1698:25 argument_list|(
|
|
1698:26 name|ctx
|
|
1698:29 argument_list|,
|
|
1698:31 name|gfp_mask
|
|
1698:39 argument_list|,
|
|
1698:41 name|type
|
|
1698:45 argument_list|)
|
|
1698:46 expr_stmt|;
|
|
1699:2 if|if
|
|
1699:5 condition|(
|
|
1699:6 operator|!
|
|
1699:7 name|ab
|
|
1699:9 condition|)
|
|
1699:11 block|{
|
|
1700:3 name|audit_log_lost
|
|
1700:17 argument_list|(
|
|
1700:18 literal|"out of memory in audit_log_start"
|
|
1700:52 argument_list|)
|
|
1700:53 expr_stmt|;
|
|
1701:3 return|return
|
|
1701:10 name|NULL
|
|
1701:14 return|;
|
|
1702:2 block|}
|
|
1704:2 name|audit_get_stamp
|
|
1704:17 argument_list|(
|
|
1704:18 name|ab
|
|
1704:20 operator|->
|
|
1704:22 name|ctx
|
|
1704:25 argument_list|,
|
|
1704:27 operator|&
|
|
1704:28 name|t
|
|
1704:29 argument_list|,
|
|
1704:31 operator|&
|
|
1704:32 name|serial
|
|
1704:38 argument_list|)
|
|
1704:39 expr_stmt|;
|
|
1705:2 name|audit_log_format
|
|
1705:18 argument_list|(
|
|
1705:19 name|ab
|
|
1705:21 argument_list|,
|
|
1705:23 literal|"audit(%lu.%03lu:%u): "
|
|
1705:46 argument_list|,
|
|
1706:5 name|t
|
|
1706:6 operator|.
|
|
1706:7 name|tv_sec
|
|
1706:13 argument_list|,
|
|
1706:15 name|t
|
|
1706:16 operator|.
|
|
1706:17 name|tv_nsec
|
|
1706:24 operator|/
|
|
1706:25 literal|1000000
|
|
1706:32 argument_list|,
|
|
1706:34 name|serial
|
|
1706:40 argument_list|)
|
|
1706:41 expr_stmt|;
|
|
1708:2 return|return
|
|
1708:9 name|ab
|
|
1708:11 return|;
|
|
1709:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1711:1 comment|/** * audit_expand - expand skb in the audit buffer * @ab: audit_buffer * @extra: space to add at tail of the skb * * Returns 0 (no space) on failed expansion, or available space if * successful. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1719:1 specifier|static
|
|
1719:8 specifier|inline
|
|
1719:15 name|int
|
|
1719:19 name|audit_expand
|
|
1719:31 parameter_list|(
|
|
1719:32 name|struct
|
|
1719:39 name|audit_buffer
|
|
1719:52 modifier|*
|
|
1719:53 name|ab
|
|
1719:55 parameter_list|,
|
|
1719:57 name|int
|
|
1719:61 name|extra
|
|
1719:66 parameter_list|)
|
|
1720:1 block|{
|
|
1721:2 name|struct
|
|
1721:9 name|sk_buff
|
|
1721:17 modifier|*
|
|
1721:18 name|skb
|
|
1721:22 init|=
|
|
1721:24 name|ab
|
|
1721:26 operator|->
|
|
1721:28 name|skb
|
|
1721:31 decl_stmt|;
|
|
1722:2 name|int
|
|
1722:6 name|oldtail
|
|
1722:14 init|=
|
|
1722:16 name|skb_tailroom
|
|
1722:28 argument_list|(
|
|
1722:29 name|skb
|
|
1722:32 argument_list|)
|
|
1722:33 decl_stmt|;
|
|
1723:2 name|int
|
|
1723:6 name|ret
|
|
1723:10 init|=
|
|
1723:12 name|pskb_expand_head
|
|
1723:28 argument_list|(
|
|
1723:29 name|skb
|
|
1723:32 argument_list|,
|
|
1723:34 literal|0
|
|
1723:35 argument_list|,
|
|
1723:37 name|extra
|
|
1723:42 argument_list|,
|
|
1723:44 name|ab
|
|
1723:46 operator|->
|
|
1723:48 name|gfp_mask
|
|
1723:56 argument_list|)
|
|
1723:57 decl_stmt|;
|
|
1724:2 name|int
|
|
1724:6 name|newtail
|
|
1724:14 init|=
|
|
1724:16 name|skb_tailroom
|
|
1724:28 argument_list|(
|
|
1724:29 name|skb
|
|
1724:32 argument_list|)
|
|
1724:33 decl_stmt|;
|
|
1726:2 if|if
|
|
1726:5 condition|(
|
|
1726:6 name|ret
|
|
1726:10 operator|<
|
|
1726:12 literal|0
|
|
1726:13 condition|)
|
|
1726:15 block|{
|
|
1727:3 name|audit_log_lost
|
|
1727:17 argument_list|(
|
|
1727:18 literal|"out of memory in audit_expand"
|
|
1727:49 argument_list|)
|
|
1727:50 expr_stmt|;
|
|
1728:3 return|return
|
|
1728:10 literal|0
|
|
1728:11 return|;
|
|
1729:2 block|}
|
|
1731:2 name|skb
|
|
1731:5 operator|->
|
|
1731:7 name|truesize
|
|
1731:16 operator|+=
|
|
1731:19 name|newtail
|
|
1731:27 operator|-
|
|
1731:29 name|oldtail
|
|
1731:36 expr_stmt|;
|
|
1732:2 return|return
|
|
1732:9 name|newtail
|
|
1732:16 return|;
|
|
1733:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1735:1 comment|/* * Format an audit message into the audit buffer. If there isn't enough * room in the audit buffer, more room will be allocated and vsnprint * will be called a second time. Currently, we assume that a printk * can't format message larger than 1024 bytes, so we don't either. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1741:1 specifier|static
|
|
1741:8 name|void
|
|
1741:13 name|audit_log_vformat
|
|
1741:30 parameter_list|(
|
|
1741:31 name|struct
|
|
1741:38 name|audit_buffer
|
|
1741:51 modifier|*
|
|
1741:52 name|ab
|
|
1741:54 parameter_list|,
|
|
1741:56 specifier|const
|
|
1741:62 name|char
|
|
1741:67 modifier|*
|
|
1741:68 name|fmt
|
|
1741:71 parameter_list|,
|
|
1742:10 name|va_list
|
|
1742:18 name|args
|
|
1742:22 parameter_list|)
|
|
1743:1 block|{
|
|
1744:2 name|int
|
|
1744:6 name|len
|
|
1744:9 decl_stmt|,
|
|
1744:11 name|avail
|
|
1744:16 decl_stmt|;
|
|
1745:2 name|struct
|
|
1745:9 name|sk_buff
|
|
1745:17 modifier|*
|
|
1745:18 name|skb
|
|
1745:21 decl_stmt|;
|
|
1746:2 name|va_list
|
|
1746:10 name|args2
|
|
1746:15 decl_stmt|;
|
|
1748:2 if|if
|
|
1748:5 condition|(
|
|
1748:6 operator|!
|
|
1748:7 name|ab
|
|
1748:9 condition|)
|
|
1749:3 return|return;
|
|
1751:2 name|BUG_ON
|
|
1751:8 argument_list|(
|
|
1751:9 operator|!
|
|
1751:10 name|ab
|
|
1751:12 operator|->
|
|
1751:14 name|skb
|
|
1751:17 argument_list|)
|
|
1751:18 expr_stmt|;
|
|
1752:2 name|skb
|
|
1752:6 operator|=
|
|
1752:8 name|ab
|
|
1752:10 operator|->
|
|
1752:12 name|skb
|
|
1752:15 expr_stmt|;
|
|
1753:2 name|avail
|
|
1753:8 operator|=
|
|
1753:10 name|skb_tailroom
|
|
1753:22 argument_list|(
|
|
1753:23 name|skb
|
|
1753:26 argument_list|)
|
|
1753:27 expr_stmt|;
|
|
1754:2 if|if
|
|
1754:5 condition|(
|
|
1754:6 name|avail
|
|
1754:12 operator|==
|
|
1754:15 literal|0
|
|
1754:16 condition|)
|
|
1754:18 block|{
|
|
1755:3 name|avail
|
|
1755:9 operator|=
|
|
1755:11 name|audit_expand
|
|
1755:23 argument_list|(
|
|
1755:24 name|ab
|
|
1755:26 argument_list|,
|
|
1755:28 name|AUDIT_BUFSIZ
|
|
1755:40 argument_list|)
|
|
1755:41 expr_stmt|;
|
|
1756:3 if|if
|
|
1756:6 condition|(
|
|
1756:7 operator|!
|
|
1756:8 name|avail
|
|
1756:13 condition|)
|
|
1757:4 goto|goto
|
|
1757:9 name|out
|
|
1757:12 goto|;
|
|
1758:2 block|}
|
|
1759:2 name|va_copy
|
|
1759:9 argument_list|(
|
|
1759:10 name|args2
|
|
1759:15 argument_list|,
|
|
1759:17 name|args
|
|
1759:21 argument_list|)
|
|
1759:22 expr_stmt|;
|
|
1760:2 name|len
|
|
1760:6 operator|=
|
|
1760:8 name|vsnprintf
|
|
1760:17 argument_list|(
|
|
1760:18 name|skb_tail_pointer
|
|
1760:34 argument_list|(
|
|
1760:35 name|skb
|
|
1760:38 argument_list|)
|
|
1760:39 argument_list|,
|
|
1760:41 name|avail
|
|
1760:46 argument_list|,
|
|
1760:48 name|fmt
|
|
1760:51 argument_list|,
|
|
1760:53 name|args
|
|
1760:57 argument_list|)
|
|
1760:58 expr_stmt|;
|
|
1761:2 if|if
|
|
1761:5 condition|(
|
|
1761:6 name|len
|
|
1761:10 operator|>=
|
|
1761:13 name|avail
|
|
1761:18 condition|)
|
|
1761:20 block|{
|
|
1762:3 comment|/* The printk buffer is 1024 bytes long, so if we get * here and AUDIT_BUFSIZ is at least 1024, then we can * log everything that printk could have logged. */
|
|
1765:3 name|avail
|
|
1765:9 operator|=
|
|
1765:11 name|audit_expand
|
|
1765:23 argument_list|(
|
|
1765:24 name|ab
|
|
1765:26 argument_list|,
|
|
1766:4 name|max_t
|
|
1766:9 argument_list|(
|
|
1766:10 name|unsigned
|
|
1766:18 argument_list|,
|
|
1766:20 name|AUDIT_BUFSIZ
|
|
1766:32 argument_list|,
|
|
1766:34 literal|1
|
|
1766:35 operator|+
|
|
1766:36 name|len
|
|
1766:39 operator|-
|
|
1766:40 name|avail
|
|
1766:45 argument_list|)
|
|
1766:46 argument_list|)
|
|
1766:47 expr_stmt|;
|
|
1767:3 if|if
|
|
1767:6 condition|(
|
|
1767:7 operator|!
|
|
1767:8 name|avail
|
|
1767:13 condition|)
|
|
1768:4 goto|goto
|
|
1768:9 name|out_va_end
|
|
1768:19 goto|;
|
|
1769:3 name|len
|
|
1769:7 operator|=
|
|
1769:9 name|vsnprintf
|
|
1769:18 argument_list|(
|
|
1769:19 name|skb_tail_pointer
|
|
1769:35 argument_list|(
|
|
1769:36 name|skb
|
|
1769:39 argument_list|)
|
|
1769:40 argument_list|,
|
|
1769:42 name|avail
|
|
1769:47 argument_list|,
|
|
1769:49 name|fmt
|
|
1769:52 argument_list|,
|
|
1769:54 name|args2
|
|
1769:59 argument_list|)
|
|
1769:60 expr_stmt|;
|
|
1770:2 block|}
|
|
1771:2 if|if
|
|
1771:5 condition|(
|
|
1771:6 name|len
|
|
1771:10 operator|>
|
|
1771:12 literal|0
|
|
1771:13 condition|)
|
|
1772:3 name|skb_put
|
|
1772:10 argument_list|(
|
|
1772:11 name|skb
|
|
1772:14 argument_list|,
|
|
1772:16 name|len
|
|
1772:19 argument_list|)
|
|
1772:20 expr_stmt|;
|
|
1773:1 name|out_va_end
|
|
1773:11 label|:
|
|
1774:2 name|va_end
|
|
1774:8 argument_list|(
|
|
1774:9 name|args2
|
|
1774:14 argument_list|)
|
|
1774:15 expr_stmt|;
|
|
1775:1 name|out
|
|
1775:4 label|:
|
|
1776:2 return|return;
|
|
1777:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1779:1 comment|/** * audit_log_format - format a message into the audit buffer. * @ab: audit_buffer * @fmt: format string * @...: optional parameters matching @fmt string * * All the work is done in audit_log_vformat. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1787:1 name|void
|
|
1787:6 name|audit_log_format
|
|
1787:22 parameter_list|(
|
|
1787:23 name|struct
|
|
1787:30 name|audit_buffer
|
|
1787:43 modifier|*
|
|
1787:44 name|ab
|
|
1787:46 parameter_list|,
|
|
1787:48 specifier|const
|
|
1787:54 name|char
|
|
1787:59 modifier|*
|
|
1787:60 name|fmt
|
|
1787:63 parameter_list|,
|
|
1787:65 modifier|...
|
|
1787:68 parameter_list|)
|
|
1788:1 block|{
|
|
1789:2 name|va_list
|
|
1789:10 name|args
|
|
1789:14 decl_stmt|;
|
|
1791:2 if|if
|
|
1791:5 condition|(
|
|
1791:6 operator|!
|
|
1791:7 name|ab
|
|
1791:9 condition|)
|
|
1792:3 return|return;
|
|
1793:2 name|va_start
|
|
1793:10 argument_list|(
|
|
1793:11 name|args
|
|
1793:15 argument_list|,
|
|
1793:17 name|fmt
|
|
1793:20 argument_list|)
|
|
1793:21 expr_stmt|;
|
|
1794:2 name|audit_log_vformat
|
|
1794:19 argument_list|(
|
|
1794:20 name|ab
|
|
1794:22 argument_list|,
|
|
1794:24 name|fmt
|
|
1794:27 argument_list|,
|
|
1794:29 name|args
|
|
1794:33 argument_list|)
|
|
1794:34 expr_stmt|;
|
|
1795:2 name|va_end
|
|
1795:8 argument_list|(
|
|
1795:9 name|args
|
|
1795:13 argument_list|)
|
|
1795:14 expr_stmt|;
|
|
1796:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1798:1 comment|/** * audit_log_hex - convert a buffer to hex and append it to the audit skb * @ab: the audit_buffer * @buf: buffer to convert to hex * @len: length of @buf to be converted * * No return value; failure to expand is silently ignored. * * This function will take the passed buf and convert it into a string of * ascii hex digits. The new string is placed onto the skb. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1809:1 name|void
|
|
1809:6 name|audit_log_n_hex
|
|
1809:21 parameter_list|(
|
|
1809:22 name|struct
|
|
1809:29 name|audit_buffer
|
|
1809:42 modifier|*
|
|
1809:43 name|ab
|
|
1809:45 parameter_list|,
|
|
1809:47 specifier|const
|
|
1809:53 name|unsigned
|
|
1809:62 name|char
|
|
1809:67 modifier|*
|
|
1809:68 name|buf
|
|
1809:71 parameter_list|,
|
|
1810:3 name|size_t
|
|
1810:10 name|len
|
|
1810:13 parameter_list|)
|
|
1811:1 block|{
|
|
1812:2 name|int
|
|
1812:6 name|i
|
|
1812:7 decl_stmt|,
|
|
1812:9 name|avail
|
|
1812:14 decl_stmt|,
|
|
1812:16 name|new_len
|
|
1812:23 decl_stmt|;
|
|
1813:2 name|unsigned
|
|
1813:11 name|char
|
|
1813:16 modifier|*
|
|
1813:17 name|ptr
|
|
1813:20 decl_stmt|;
|
|
1814:2 name|struct
|
|
1814:9 name|sk_buff
|
|
1814:17 modifier|*
|
|
1814:18 name|skb
|
|
1814:21 decl_stmt|;
|
|
1816:2 if|if
|
|
1816:5 condition|(
|
|
1816:6 operator|!
|
|
1816:7 name|ab
|
|
1816:9 condition|)
|
|
1817:3 return|return;
|
|
1819:2 name|BUG_ON
|
|
1819:8 argument_list|(
|
|
1819:9 operator|!
|
|
1819:10 name|ab
|
|
1819:12 operator|->
|
|
1819:14 name|skb
|
|
1819:17 argument_list|)
|
|
1819:18 expr_stmt|;
|
|
1820:2 name|skb
|
|
1820:6 operator|=
|
|
1820:8 name|ab
|
|
1820:10 operator|->
|
|
1820:12 name|skb
|
|
1820:15 expr_stmt|;
|
|
1821:2 name|avail
|
|
1821:8 operator|=
|
|
1821:10 name|skb_tailroom
|
|
1821:22 argument_list|(
|
|
1821:23 name|skb
|
|
1821:26 argument_list|)
|
|
1821:27 expr_stmt|;
|
|
1822:2 name|new_len
|
|
1822:10 operator|=
|
|
1822:12 name|len
|
|
1822:15 operator|<<
|
|
1822:17 literal|1
|
|
1822:18 expr_stmt|;
|
|
1823:2 if|if
|
|
1823:5 condition|(
|
|
1823:6 name|new_len
|
|
1823:14 operator|>=
|
|
1823:17 name|avail
|
|
1823:22 condition|)
|
|
1823:24 block|{
|
|
1824:3 comment|/* Round the buffer request up to the next multiple */
|
|
1825:3 name|new_len
|
|
1825:11 operator|=
|
|
1825:13 name|AUDIT_BUFSIZ
|
|
1825:25 operator|*
|
|
1825:26 operator|(
|
|
1825:27 operator|(
|
|
1825:28 operator|(
|
|
1825:29 name|new_len
|
|
1825:36 operator|-
|
|
1825:37 name|avail
|
|
1825:42 operator|)
|
|
1825:43 operator|/
|
|
1825:44 name|AUDIT_BUFSIZ
|
|
1825:56 operator|)
|
|
1825:58 operator|+
|
|
1825:60 literal|1
|
|
1825:61 operator|)
|
|
1825:62 expr_stmt|;
|
|
1826:3 name|avail
|
|
1826:9 operator|=
|
|
1826:11 name|audit_expand
|
|
1826:23 argument_list|(
|
|
1826:24 name|ab
|
|
1826:26 argument_list|,
|
|
1826:28 name|new_len
|
|
1826:35 argument_list|)
|
|
1826:36 expr_stmt|;
|
|
1827:3 if|if
|
|
1827:6 condition|(
|
|
1827:7 operator|!
|
|
1827:8 name|avail
|
|
1827:13 condition|)
|
|
1828:4 return|return;
|
|
1829:2 block|}
|
|
1831:2 name|ptr
|
|
1831:6 operator|=
|
|
1831:8 name|skb_tail_pointer
|
|
1831:24 argument_list|(
|
|
1831:25 name|skb
|
|
1831:28 argument_list|)
|
|
1831:29 expr_stmt|;
|
|
1832:2 for|for
|
|
1832:6 control|(
|
|
1832:7 name|i
|
|
1832:9 operator|=
|
|
1832:11 literal|0
|
|
1832:12 init|;
|
|
1832:14 name|i
|
|
1832:16 operator|<
|
|
1832:18 name|len
|
|
1832:21 condition|;
|
|
1832:23 name|i
|
|
1832:24 operator|++
|
|
1832:26 control|)
|
|
1833:3 name|ptr
|
|
1833:7 operator|=
|
|
1833:9 name|hex_byte_pack_upper
|
|
1833:28 argument_list|(
|
|
1833:29 name|ptr
|
|
1833:32 argument_list|,
|
|
1833:34 name|buf
|
|
1833:37 index|[
|
|
1833:38 name|i
|
|
1833:39 index|]
|
|
1833:40 argument_list|)
|
|
1833:41 expr_stmt|;
|
|
1834:2 operator|*
|
|
1834:3 name|ptr
|
|
1834:7 operator|=
|
|
1834:9 literal|0
|
|
1834:10 expr_stmt|;
|
|
1835:2 name|skb_put
|
|
1835:9 argument_list|(
|
|
1835:10 name|skb
|
|
1835:13 argument_list|,
|
|
1835:15 name|len
|
|
1835:19 operator|<<
|
|
1835:22 literal|1
|
|
1835:23 argument_list|)
|
|
1835:24 expr_stmt|;
|
|
1835:26 comment|/* new string is twice the old string */
|
|
1836:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1838:1 comment|/* * Format a string of no more than slen characters into the audit buffer, * enclosed in quote marks. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1842:1 name|void
|
|
1842:6 name|audit_log_n_string
|
|
1842:24 parameter_list|(
|
|
1842:25 name|struct
|
|
1842:32 name|audit_buffer
|
|
1842:45 modifier|*
|
|
1842:46 name|ab
|
|
1842:48 parameter_list|,
|
|
1842:50 specifier|const
|
|
1842:56 name|char
|
|
1842:61 modifier|*
|
|
1842:62 name|string
|
|
1842:68 parameter_list|,
|
|
1843:4 name|size_t
|
|
1843:11 name|slen
|
|
1843:15 parameter_list|)
|
|
1844:1 block|{
|
|
1845:2 name|int
|
|
1845:6 name|avail
|
|
1845:11 decl_stmt|,
|
|
1845:13 name|new_len
|
|
1845:20 decl_stmt|;
|
|
1846:2 name|unsigned
|
|
1846:11 name|char
|
|
1846:16 modifier|*
|
|
1846:17 name|ptr
|
|
1846:20 decl_stmt|;
|
|
1847:2 name|struct
|
|
1847:9 name|sk_buff
|
|
1847:17 modifier|*
|
|
1847:18 name|skb
|
|
1847:21 decl_stmt|;
|
|
1849:2 if|if
|
|
1849:5 condition|(
|
|
1849:6 operator|!
|
|
1849:7 name|ab
|
|
1849:9 condition|)
|
|
1850:3 return|return;
|
|
1852:2 name|BUG_ON
|
|
1852:8 argument_list|(
|
|
1852:9 operator|!
|
|
1852:10 name|ab
|
|
1852:12 operator|->
|
|
1852:14 name|skb
|
|
1852:17 argument_list|)
|
|
1852:18 expr_stmt|;
|
|
1853:2 name|skb
|
|
1853:6 operator|=
|
|
1853:8 name|ab
|
|
1853:10 operator|->
|
|
1853:12 name|skb
|
|
1853:15 expr_stmt|;
|
|
1854:2 name|avail
|
|
1854:8 operator|=
|
|
1854:10 name|skb_tailroom
|
|
1854:22 argument_list|(
|
|
1854:23 name|skb
|
|
1854:26 argument_list|)
|
|
1854:27 expr_stmt|;
|
|
1855:2 name|new_len
|
|
1855:10 operator|=
|
|
1855:12 name|slen
|
|
1855:17 operator|+
|
|
1855:19 literal|3
|
|
1855:20 expr_stmt|;
|
|
1855:22 comment|/* enclosing quotes + null terminator */
|
|
1856:2 if|if
|
|
1856:5 condition|(
|
|
1856:6 name|new_len
|
|
1856:14 operator|>
|
|
1856:16 name|avail
|
|
1856:21 condition|)
|
|
1856:23 block|{
|
|
1857:3 name|avail
|
|
1857:9 operator|=
|
|
1857:11 name|audit_expand
|
|
1857:23 argument_list|(
|
|
1857:24 name|ab
|
|
1857:26 argument_list|,
|
|
1857:28 name|new_len
|
|
1857:35 argument_list|)
|
|
1857:36 expr_stmt|;
|
|
1858:3 if|if
|
|
1858:6 condition|(
|
|
1858:7 operator|!
|
|
1858:8 name|avail
|
|
1858:13 condition|)
|
|
1859:4 return|return;
|
|
1860:2 block|}
|
|
1861:2 name|ptr
|
|
1861:6 operator|=
|
|
1861:8 name|skb_tail_pointer
|
|
1861:24 argument_list|(
|
|
1861:25 name|skb
|
|
1861:28 argument_list|)
|
|
1861:29 expr_stmt|;
|
|
1862:2 operator|*
|
|
1862:3 name|ptr
|
|
1862:6 operator|++
|
|
1862:9 operator|=
|
|
1862:11 literal|'"'
|
|
1862:14 expr_stmt|;
|
|
1863:2 name|memcpy
|
|
1863:8 argument_list|(
|
|
1863:9 name|ptr
|
|
1863:12 argument_list|,
|
|
1863:14 name|string
|
|
1863:20 argument_list|,
|
|
1863:22 name|slen
|
|
1863:26 argument_list|)
|
|
1863:27 expr_stmt|;
|
|
1864:2 name|ptr
|
|
1864:6 operator|+=
|
|
1864:9 name|slen
|
|
1864:13 expr_stmt|;
|
|
1865:2 operator|*
|
|
1865:3 name|ptr
|
|
1865:6 operator|++
|
|
1865:9 operator|=
|
|
1865:11 literal|'"'
|
|
1865:14 expr_stmt|;
|
|
1866:2 operator|*
|
|
1866:3 name|ptr
|
|
1866:7 operator|=
|
|
1866:9 literal|0
|
|
1866:10 expr_stmt|;
|
|
1867:2 name|skb_put
|
|
1867:9 argument_list|(
|
|
1867:10 name|skb
|
|
1867:13 argument_list|,
|
|
1867:15 name|slen
|
|
1867:20 operator|+
|
|
1867:22 literal|2
|
|
1867:23 argument_list|)
|
|
1867:24 expr_stmt|;
|
|
1867:26 comment|/* don't include null terminator */
|
|
1868:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1870:1 comment|/** * audit_string_contains_control - does a string need to be logged in hex * @string: string to be checked * @len: max length of the string to check */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1875:1 name|bool
|
|
1875:6 name|audit_string_contains_control
|
|
1875:35 parameter_list|(
|
|
1875:36 specifier|const
|
|
1875:42 name|char
|
|
1875:47 modifier|*
|
|
1875:48 name|string
|
|
1875:54 parameter_list|,
|
|
1875:56 name|size_t
|
|
1875:63 name|len
|
|
1875:66 parameter_list|)
|
|
1876:1 block|{
|
|
1877:2 specifier|const
|
|
1877:8 name|unsigned
|
|
1877:17 name|char
|
|
1877:22 modifier|*
|
|
1877:23 name|p
|
|
1877:24 decl_stmt|;
|
|
1878:2 for|for
|
|
1878:6 control|(
|
|
1878:7 name|p
|
|
1878:9 operator|=
|
|
1878:11 name|string
|
|
1878:17 init|;
|
|
1878:19 name|p
|
|
1878:21 operator|<
|
|
1878:23 operator|(
|
|
1878:24 specifier|const
|
|
1878:30 name|unsigned
|
|
1878:39 name|char
|
|
1878:44 operator|*
|
|
1878:45 operator|)
|
|
1878:46 name|string
|
|
1878:53 operator|+
|
|
1878:55 name|len
|
|
1878:58 condition|;
|
|
1878:60 name|p
|
|
1878:61 operator|++
|
|
1878:63 control|)
|
|
1878:65 block|{
|
|
1879:3 if|if
|
|
1879:6 condition|(
|
|
1879:7 operator|*
|
|
1879:8 name|p
|
|
1879:10 operator|==
|
|
1879:13 literal|'"'
|
|
1879:17 operator|||
|
|
1879:20 operator|*
|
|
1879:21 name|p
|
|
1879:23 operator|<
|
|
1879:25 literal|0x21
|
|
1879:30 operator|||
|
|
1879:33 operator|*
|
|
1879:34 name|p
|
|
1879:36 operator|>
|
|
1879:38 literal|0x7e
|
|
1879:42 condition|)
|
|
1880:4 return|return
|
|
1880:11 name|true
|
|
1880:15 return|;
|
|
1881:2 block|}
|
|
1882:2 return|return
|
|
1882:9 name|false
|
|
1882:14 return|;
|
|
1883:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1885:1 comment|/** * audit_log_n_untrustedstring - log a string that may contain random characters * @ab: audit_buffer * @len: length of string (not including trailing null) * @string: string to be logged * * This code will escape a string that is passed to it if the string * contains a control character, unprintable character, double quote mark, * or a space. Unescaped strings will start and end with a double quote mark. * Strings that are escaped are printed in hex (2 digits per char). * * The caller specifies the number of characters in the string to log, which may * or may not be the entire string. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1899:1 name|void
|
|
1899:6 name|audit_log_n_untrustedstring
|
|
1899:33 parameter_list|(
|
|
1899:34 name|struct
|
|
1899:41 name|audit_buffer
|
|
1899:54 modifier|*
|
|
1899:55 name|ab
|
|
1899:57 parameter_list|,
|
|
1899:59 specifier|const
|
|
1899:65 name|char
|
|
1899:70 modifier|*
|
|
1899:71 name|string
|
|
1899:77 parameter_list|,
|
|
1900:6 name|size_t
|
|
1900:13 name|len
|
|
1900:16 parameter_list|)
|
|
1901:1 block|{
|
|
1902:2 if|if
|
|
1902:5 condition|(
|
|
1902:6 name|audit_string_contains_control
|
|
1902:35 argument_list|(
|
|
1902:36 name|string
|
|
1902:42 argument_list|,
|
|
1902:44 name|len
|
|
1902:47 argument_list|)
|
|
1902:48 condition|)
|
|
1903:3 name|audit_log_n_hex
|
|
1903:18 argument_list|(
|
|
1903:19 name|ab
|
|
1903:21 argument_list|,
|
|
1903:23 name|string
|
|
1903:29 argument_list|,
|
|
1903:31 name|len
|
|
1903:34 argument_list|)
|
|
1903:35 expr_stmt|;
|
|
1904:2 else|else
|
|
1905:3 name|audit_log_n_string
|
|
1905:21 argument_list|(
|
|
1905:22 name|ab
|
|
1905:24 argument_list|,
|
|
1905:26 name|string
|
|
1905:32 argument_list|,
|
|
1905:34 name|len
|
|
1905:37 argument_list|)
|
|
1905:38 expr_stmt|;
|
|
1906:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1908:1 comment|/** * audit_log_untrustedstring - log a string that may contain random characters * @ab: audit_buffer * @string: string to be logged * * Same as audit_log_n_untrustedstring(), except that strlen is used to * determine string length. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1916:1 name|void
|
|
1916:6 name|audit_log_untrustedstring
|
|
1916:31 parameter_list|(
|
|
1916:32 name|struct
|
|
1916:39 name|audit_buffer
|
|
1916:52 modifier|*
|
|
1916:53 name|ab
|
|
1916:55 parameter_list|,
|
|
1916:57 specifier|const
|
|
1916:63 name|char
|
|
1916:68 modifier|*
|
|
1916:69 name|string
|
|
1916:75 parameter_list|)
|
|
1917:1 block|{
|
|
1918:2 name|audit_log_n_untrustedstring
|
|
1918:29 argument_list|(
|
|
1918:30 name|ab
|
|
1918:32 argument_list|,
|
|
1918:34 name|string
|
|
1918:40 argument_list|,
|
|
1918:42 name|strlen
|
|
1918:48 argument_list|(
|
|
1918:49 name|string
|
|
1918:55 argument_list|)
|
|
1918:56 argument_list|)
|
|
1918:57 expr_stmt|;
|
|
1919:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
1921:1 comment|/* This is a helper-function to print the escaped d_path */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
1922:1 name|void
|
|
1922:6 name|audit_log_d_path
|
|
1922:22 parameter_list|(
|
|
1922:23 name|struct
|
|
1922:30 name|audit_buffer
|
|
1922:43 modifier|*
|
|
1922:44 name|ab
|
|
1922:46 parameter_list|,
|
|
1922:48 specifier|const
|
|
1922:54 name|char
|
|
1922:59 modifier|*
|
|
1922:60 name|prefix
|
|
1922:66 parameter_list|,
|
|
1923:9 specifier|const
|
|
1923:15 name|struct
|
|
1923:22 name|path
|
|
1923:27 modifier|*
|
|
1923:28 name|path
|
|
1923:32 parameter_list|)
|
|
1924:1 block|{
|
|
1925:2 name|char
|
|
1925:7 modifier|*
|
|
1925:8 name|p
|
|
1925:9 decl_stmt|,
|
|
1925:11 modifier|*
|
|
1925:12 name|pathname
|
|
1925:20 decl_stmt|;
|
|
1927:2 if|if
|
|
1927:5 condition|(
|
|
1927:6 name|prefix
|
|
1927:12 condition|)
|
|
1928:3 name|audit_log_format
|
|
1928:19 argument_list|(
|
|
1928:20 name|ab
|
|
1928:22 argument_list|,
|
|
1928:24 literal|"%s"
|
|
1928:28 argument_list|,
|
|
1928:30 name|prefix
|
|
1928:36 argument_list|)
|
|
1928:37 expr_stmt|;
|
|
1930:2 comment|/* We will allow 11 spaces for ' (deleted)' to be appended */
|
|
1931:2 name|pathname
|
|
1931:11 operator|=
|
|
1931:13 name|kmalloc
|
|
1931:20 argument_list|(
|
|
1931:21 name|PATH_MAX
|
|
1931:29 operator|+
|
|
1931:30 literal|11
|
|
1931:32 argument_list|,
|
|
1931:34 name|ab
|
|
1931:36 operator|->
|
|
1931:38 name|gfp_mask
|
|
1931:46 argument_list|)
|
|
1931:47 expr_stmt|;
|
|
1932:2 if|if
|
|
1932:5 condition|(
|
|
1932:6 operator|!
|
|
1932:7 name|pathname
|
|
1932:15 condition|)
|
|
1932:17 block|{
|
|
1933:3 name|audit_log_string
|
|
1933:19 argument_list|(
|
|
1933:20 name|ab
|
|
1933:22 argument_list|,
|
|
1933:24 literal|"<no_memory>"
|
|
1933:37 argument_list|)
|
|
1933:38 expr_stmt|;
|
|
1934:3 return|return;
|
|
1935:2 block|}
|
|
1936:2 name|p
|
|
1936:4 operator|=
|
|
1936:6 name|d_path
|
|
1936:12 argument_list|(
|
|
1936:13 name|path
|
|
1936:17 argument_list|,
|
|
1936:19 name|pathname
|
|
1936:27 argument_list|,
|
|
1936:29 name|PATH_MAX
|
|
1936:37 operator|+
|
|
1936:38 literal|11
|
|
1936:40 argument_list|)
|
|
1936:41 expr_stmt|;
|
|
1937:2 if|if
|
|
1937:5 condition|(
|
|
1937:6 name|IS_ERR
|
|
1937:12 argument_list|(
|
|
1937:13 name|p
|
|
1937:14 argument_list|)
|
|
1937:15 condition|)
|
|
1937:17 block|{
|
|
1937:19 comment|/* Should never happen since we send PATH_MAX */
|
|
1938:3 comment|/* FIXME: can we save some information here? */
|
|
1939:3 name|audit_log_string
|
|
1939:19 argument_list|(
|
|
1939:20 name|ab
|
|
1939:22 argument_list|,
|
|
1939:24 literal|"<too_long>"
|
|
1939:36 argument_list|)
|
|
1939:37 expr_stmt|;
|
|
1940:2 block|}
|
|
1940:4 else|else
|
|
1941:3 name|audit_log_untrustedstring
|
|
1941:28 argument_list|(
|
|
1941:29 name|ab
|
|
1941:31 argument_list|,
|
|
1941:33 name|p
|
|
1941:34 argument_list|)
|
|
1941:35 expr_stmt|;
|
|
1942:2 name|kfree
|
|
1942:7 argument_list|(
|
|
1942:8 name|pathname
|
|
1942:16 argument_list|)
|
|
1942:17 expr_stmt|;
|
|
1943:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
1945:1 name|void
|
|
1945:6 name|audit_log_session_info
|
|
1945:28 parameter_list|(
|
|
1945:29 name|struct
|
|
1945:36 name|audit_buffer
|
|
1945:49 modifier|*
|
|
1945:50 name|ab
|
|
1945:52 parameter_list|)
|
|
1946:1 block|{
|
|
1947:2 name|unsigned
|
|
1947:11 name|int
|
|
1947:15 name|sessionid
|
|
1947:25 init|=
|
|
1947:27 name|audit_get_sessionid
|
|
1947:46 argument_list|(
|
|
1947:47 name|current
|
|
1947:54 argument_list|)
|
|
1947:55 decl_stmt|;
|
|
1948:2 name|uid_t
|
|
1948:8 name|auid
|
|
1948:13 init|=
|
|
1948:15 name|from_kuid
|
|
1948:24 argument_list|(
|
|
1948:25 operator|&
|
|
1948:26 name|init_user_ns
|
|
1948:38 argument_list|,
|
|
1948:40 name|audit_get_loginuid
|
|
1948:58 argument_list|(
|
|
1948:59 name|current
|
|
1948:66 argument_list|)
|
|
1948:67 argument_list|)
|
|
1948:68 decl_stmt|;
|
|
1950:2 name|audit_log_format
|
|
1950:18 argument_list|(
|
|
1950:19 name|ab
|
|
1950:21 argument_list|,
|
|
1950:23 literal|" auid=%u ses=%u"
|
|
1950:40 argument_list|,
|
|
1950:42 name|auid
|
|
1950:46 argument_list|,
|
|
1950:48 name|sessionid
|
|
1950:57 argument_list|)
|
|
1950:58 expr_stmt|;
|
|
1951:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
1953:1 name|void
|
|
1953:6 name|audit_log_key
|
|
1953:19 parameter_list|(
|
|
1953:20 name|struct
|
|
1953:27 name|audit_buffer
|
|
1953:40 modifier|*
|
|
1953:41 name|ab
|
|
1953:43 parameter_list|,
|
|
1953:45 name|char
|
|
1953:50 modifier|*
|
|
1953:51 name|key
|
|
1953:54 parameter_list|)
|
|
1954:1 block|{
|
|
1955:2 name|audit_log_format
|
|
1955:18 argument_list|(
|
|
1955:19 name|ab
|
|
1955:21 argument_list|,
|
|
1955:23 literal|" key="
|
|
1955:30 argument_list|)
|
|
1955:31 expr_stmt|;
|
|
1956:2 if|if
|
|
1956:5 condition|(
|
|
1956:6 name|key
|
|
1956:9 condition|)
|
|
1957:3 name|audit_log_untrustedstring
|
|
1957:28 argument_list|(
|
|
1957:29 name|ab
|
|
1957:31 argument_list|,
|
|
1957:33 name|key
|
|
1957:36 argument_list|)
|
|
1957:37 expr_stmt|;
|
|
1958:2 else|else
|
|
1959:3 name|audit_log_format
|
|
1959:19 argument_list|(
|
|
1959:20 name|ab
|
|
1959:22 argument_list|,
|
|
1959:24 literal|"(null)"
|
|
1959:32 argument_list|)
|
|
1959:33 expr_stmt|;
|
|
1960:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
1962:1 name|void
|
|
1962:6 name|audit_log_cap
|
|
1962:19 parameter_list|(
|
|
1962:20 name|struct
|
|
1962:27 name|audit_buffer
|
|
1962:40 modifier|*
|
|
1962:41 name|ab
|
|
1962:43 parameter_list|,
|
|
1962:45 name|char
|
|
1962:50 modifier|*
|
|
1962:51 name|prefix
|
|
1962:57 parameter_list|,
|
|
1962:59 name|kernel_cap_t
|
|
1962:72 modifier|*
|
|
1962:73 name|cap
|
|
1962:76 parameter_list|)
|
|
1963:1 block|{
|
|
1964:2 name|int
|
|
1964:6 name|i
|
|
1964:7 decl_stmt|;
|
|
1966:2 name|audit_log_format
|
|
1966:18 argument_list|(
|
|
1966:19 name|ab
|
|
1966:21 argument_list|,
|
|
1966:23 literal|" %s="
|
|
1966:29 argument_list|,
|
|
1966:31 name|prefix
|
|
1966:37 argument_list|)
|
|
1966:38 expr_stmt|;
|
|
1967:2 name|CAP_FOR_EACH_U32
|
|
1967:18 argument_list|(
|
|
1967:19 argument|i
|
|
1967:20 argument_list|)
|
|
1967:22 block|{
|
|
1968:3 name|audit_log_format
|
|
1968:19 argument_list|(
|
|
1968:20 name|ab
|
|
1968:22 argument_list|,
|
|
1968:24 literal|"%08x"
|
|
1968:30 argument_list|,
|
|
1969:6 name|cap
|
|
1969:9 operator|->
|
|
1969:11 name|cap
|
|
1969:14 index|[
|
|
1969:15 name|CAP_LAST_U32
|
|
1969:28 operator|-
|
|
1969:30 name|i
|
|
1969:31 index|]
|
|
1969:32 argument_list|)
|
|
1969:33 expr_stmt|;
|
|
1970:2 block|}
|
|
1971:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
1973:1 specifier|static
|
|
1973:8 name|void
|
|
1973:13 name|audit_log_fcaps
|
|
1973:28 parameter_list|(
|
|
1973:29 name|struct
|
|
1973:36 name|audit_buffer
|
|
1973:49 modifier|*
|
|
1973:50 name|ab
|
|
1973:52 parameter_list|,
|
|
1973:54 name|struct
|
|
1973:61 name|audit_names
|
|
1973:73 modifier|*
|
|
1973:74 name|name
|
|
1973:78 parameter_list|)
|
|
1974:1 block|{
|
|
1975:2 name|kernel_cap_t
|
|
1975:15 modifier|*
|
|
1975:16 name|perm
|
|
1975:21 init|=
|
|
1975:23 operator|&
|
|
1975:24 name|name
|
|
1975:28 operator|->
|
|
1975:30 name|fcap
|
|
1975:34 operator|.
|
|
1975:35 name|permitted
|
|
1975:44 decl_stmt|;
|
|
1976:2 name|kernel_cap_t
|
|
1976:15 modifier|*
|
|
1976:16 name|inh
|
|
1976:20 init|=
|
|
1976:22 operator|&
|
|
1976:23 name|name
|
|
1976:27 operator|->
|
|
1976:29 name|fcap
|
|
1976:33 operator|.
|
|
1976:34 name|inheritable
|
|
1976:45 decl_stmt|;
|
|
1977:2 name|int
|
|
1977:6 name|log
|
|
1977:10 init|=
|
|
1977:12 literal|0
|
|
1977:13 decl_stmt|;
|
|
1979:2 if|if
|
|
1979:5 condition|(
|
|
1979:6 operator|!
|
|
1979:7 name|cap_isclear
|
|
1979:18 argument_list|(
|
|
1979:19 operator|*
|
|
1979:20 name|perm
|
|
1979:24 argument_list|)
|
|
1979:25 condition|)
|
|
1979:27 block|{
|
|
1980:3 name|audit_log_cap
|
|
1980:16 argument_list|(
|
|
1980:17 name|ab
|
|
1980:19 argument_list|,
|
|
1980:21 literal|"cap_fp"
|
|
1980:29 argument_list|,
|
|
1980:31 name|perm
|
|
1980:35 argument_list|)
|
|
1980:36 expr_stmt|;
|
|
1981:3 name|log
|
|
1981:7 operator|=
|
|
1981:9 literal|1
|
|
1981:10 expr_stmt|;
|
|
1982:2 block|}
|
|
1983:2 if|if
|
|
1983:5 condition|(
|
|
1983:6 operator|!
|
|
1983:7 name|cap_isclear
|
|
1983:18 argument_list|(
|
|
1983:19 operator|*
|
|
1983:20 name|inh
|
|
1983:23 argument_list|)
|
|
1983:24 condition|)
|
|
1983:26 block|{
|
|
1984:3 name|audit_log_cap
|
|
1984:16 argument_list|(
|
|
1984:17 name|ab
|
|
1984:19 argument_list|,
|
|
1984:21 literal|"cap_fi"
|
|
1984:29 argument_list|,
|
|
1984:31 name|inh
|
|
1984:34 argument_list|)
|
|
1984:35 expr_stmt|;
|
|
1985:3 name|log
|
|
1985:7 operator|=
|
|
1985:9 literal|1
|
|
1985:10 expr_stmt|;
|
|
1986:2 block|}
|
|
1988:2 if|if
|
|
1988:5 condition|(
|
|
1988:6 name|log
|
|
1988:9 condition|)
|
|
1989:3 name|audit_log_format
|
|
1989:19 argument_list|(
|
|
1989:20 name|ab
|
|
1989:22 argument_list|,
|
|
1989:24 literal|" cap_fe=%d cap_fver=%x"
|
|
1989:48 argument_list|,
|
|
1990:6 name|name
|
|
1990:10 operator|->
|
|
1990:12 name|fcap
|
|
1990:16 operator|.
|
|
1990:17 name|fE
|
|
1990:19 argument_list|,
|
|
1990:21 name|name
|
|
1990:25 operator|->
|
|
1990:27 name|fcap_ver
|
|
1990:35 argument_list|)
|
|
1990:36 expr_stmt|;
|
|
1991:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
1993:1 specifier|static
|
|
1993:8 specifier|inline
|
|
1993:15 name|int
|
|
1993:19 name|audit_copy_fcaps
|
|
1993:35 parameter_list|(
|
|
1993:36 name|struct
|
|
1993:43 name|audit_names
|
|
1993:55 modifier|*
|
|
1993:56 name|name
|
|
1993:60 parameter_list|,
|
|
1994:8 specifier|const
|
|
1994:14 name|struct
|
|
1994:21 name|dentry
|
|
1994:28 modifier|*
|
|
1994:29 name|dentry
|
|
1994:35 parameter_list|)
|
|
1995:1 block|{
|
|
1996:2 name|struct
|
|
1996:9 name|cpu_vfs_cap_data
|
|
1996:26 name|caps
|
|
1996:30 decl_stmt|;
|
|
1997:2 name|int
|
|
1997:6 name|rc
|
|
1997:8 decl_stmt|;
|
|
1999:2 if|if
|
|
1999:5 condition|(
|
|
1999:6 operator|!
|
|
1999:7 name|dentry
|
|
1999:13 condition|)
|
|
2000:3 return|return
|
|
2000:10 literal|0
|
|
2000:11 return|;
|
|
2002:2 name|rc
|
|
2002:5 operator|=
|
|
2002:7 name|get_vfs_caps_from_disk
|
|
2002:29 argument_list|(
|
|
2002:30 name|dentry
|
|
2002:36 argument_list|,
|
|
2002:38 operator|&
|
|
2002:39 name|caps
|
|
2002:43 argument_list|)
|
|
2002:44 expr_stmt|;
|
|
2003:2 if|if
|
|
2003:5 condition|(
|
|
2003:6 name|rc
|
|
2003:8 condition|)
|
|
2004:3 return|return
|
|
2004:10 name|rc
|
|
2004:12 return|;
|
|
2006:2 name|name
|
|
2006:6 operator|->
|
|
2006:8 name|fcap
|
|
2006:12 operator|.
|
|
2006:13 name|permitted
|
|
2006:23 operator|=
|
|
2006:25 name|caps
|
|
2006:29 operator|.
|
|
2006:30 name|permitted
|
|
2006:39 expr_stmt|;
|
|
2007:2 name|name
|
|
2007:6 operator|->
|
|
2007:8 name|fcap
|
|
2007:12 operator|.
|
|
2007:13 name|inheritable
|
|
2007:25 operator|=
|
|
2007:27 name|caps
|
|
2007:31 operator|.
|
|
2007:32 name|inheritable
|
|
2007:43 expr_stmt|;
|
|
2008:2 name|name
|
|
2008:6 operator|->
|
|
2008:8 name|fcap
|
|
2008:12 operator|.
|
|
2008:13 name|fE
|
|
2008:16 operator|=
|
|
2008:18 operator|!
|
|
2008:19 operator|!
|
|
2008:20 operator|(
|
|
2008:21 name|caps
|
|
2008:25 operator|.
|
|
2008:26 name|magic_etc
|
|
2008:36 operator|&
|
|
2008:38 name|VFS_CAP_FLAGS_EFFECTIVE
|
|
2008:61 operator|)
|
|
2008:62 expr_stmt|;
|
|
2009:2 name|name
|
|
2009:6 operator|->
|
|
2009:8 name|fcap_ver
|
|
2009:17 operator|=
|
|
2009:19 operator|(
|
|
2009:20 name|caps
|
|
2009:24 operator|.
|
|
2009:25 name|magic_etc
|
|
2009:35 operator|&
|
|
2009:37 name|VFS_CAP_REVISION_MASK
|
|
2009:58 operator|)
|
|
2009:60 operator|>>
|
|
2010:5 name|VFS_CAP_REVISION_SHIFT
|
|
2010:27 expr_stmt|;
|
|
2012:2 return|return
|
|
2012:9 literal|0
|
|
2012:10 return|;
|
|
2013:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
2015:1 comment|/* Copy inode data into an audit_names. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
2016:1 name|void
|
|
2016:6 name|audit_copy_inode
|
|
2016:22 parameter_list|(
|
|
2016:23 name|struct
|
|
2016:30 name|audit_names
|
|
2016:42 modifier|*
|
|
2016:43 name|name
|
|
2016:47 parameter_list|,
|
|
2016:49 specifier|const
|
|
2016:55 name|struct
|
|
2016:62 name|dentry
|
|
2016:69 modifier|*
|
|
2016:70 name|dentry
|
|
2016:76 parameter_list|,
|
|
2017:9 name|struct
|
|
2017:16 name|inode
|
|
2017:22 modifier|*
|
|
2017:23 name|inode
|
|
2017:28 parameter_list|)
|
|
2018:1 block|{
|
|
2019:2 name|name
|
|
2019:6 operator|->
|
|
2019:8 name|ino
|
|
2019:14 operator|=
|
|
2019:16 name|inode
|
|
2019:21 operator|->
|
|
2019:23 name|i_ino
|
|
2019:28 expr_stmt|;
|
|
2020:2 name|name
|
|
2020:6 operator|->
|
|
2020:8 name|dev
|
|
2020:14 operator|=
|
|
2020:16 name|inode
|
|
2020:21 operator|->
|
|
2020:23 name|i_sb
|
|
2020:27 operator|->
|
|
2020:29 name|s_dev
|
|
2020:34 expr_stmt|;
|
|
2021:2 name|name
|
|
2021:6 operator|->
|
|
2021:8 name|mode
|
|
2021:14 operator|=
|
|
2021:16 name|inode
|
|
2021:21 operator|->
|
|
2021:23 name|i_mode
|
|
2021:29 expr_stmt|;
|
|
2022:2 name|name
|
|
2022:6 operator|->
|
|
2022:8 name|uid
|
|
2022:14 operator|=
|
|
2022:16 name|inode
|
|
2022:21 operator|->
|
|
2022:23 name|i_uid
|
|
2022:28 expr_stmt|;
|
|
2023:2 name|name
|
|
2023:6 operator|->
|
|
2023:8 name|gid
|
|
2023:14 operator|=
|
|
2023:16 name|inode
|
|
2023:21 operator|->
|
|
2023:23 name|i_gid
|
|
2023:28 expr_stmt|;
|
|
2024:2 name|name
|
|
2024:6 operator|->
|
|
2024:8 name|rdev
|
|
2024:14 operator|=
|
|
2024:16 name|inode
|
|
2024:21 operator|->
|
|
2024:23 name|i_rdev
|
|
2024:29 expr_stmt|;
|
|
2025:2 name|security_inode_getsecid
|
|
2025:25 argument_list|(
|
|
2025:26 name|inode
|
|
2025:31 argument_list|,
|
|
2025:33 operator|&
|
|
2025:34 name|name
|
|
2025:38 operator|->
|
|
2025:40 name|osid
|
|
2025:44 argument_list|)
|
|
2025:45 expr_stmt|;
|
|
2026:2 name|audit_copy_fcaps
|
|
2026:18 argument_list|(
|
|
2026:19 name|name
|
|
2026:23 argument_list|,
|
|
2026:25 name|dentry
|
|
2026:31 argument_list|)
|
|
2026:32 expr_stmt|;
|
|
2027:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
2029:1 comment|/** * audit_log_name - produce AUDIT_PATH record from struct audit_names * @context: audit_context for the task * @n: audit_names structure with reportable details * @path: optional path to report instead of audit_names->name * @record_num: record number to report when handling a list of names * @call_panic: optional pointer to int that will be updated if secid fails */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
2037:1 name|void
|
|
2037:6 name|audit_log_name
|
|
2037:20 parameter_list|(
|
|
2037:21 name|struct
|
|
2037:28 name|audit_context
|
|
2037:42 modifier|*
|
|
2037:43 name|context
|
|
2037:50 parameter_list|,
|
|
2037:52 name|struct
|
|
2037:59 name|audit_names
|
|
2037:71 modifier|*
|
|
2037:72 name|n
|
|
2037:73 parameter_list|,
|
|
2038:7 specifier|const
|
|
2038:13 name|struct
|
|
2038:20 name|path
|
|
2038:25 modifier|*
|
|
2038:26 name|path
|
|
2038:30 parameter_list|,
|
|
2038:32 name|int
|
|
2038:36 name|record_num
|
|
2038:46 parameter_list|,
|
|
2038:48 name|int
|
|
2038:52 modifier|*
|
|
2038:53 name|call_panic
|
|
2038:63 parameter_list|)
|
|
2039:1 block|{
|
|
2040:2 name|struct
|
|
2040:9 name|audit_buffer
|
|
2040:22 modifier|*
|
|
2040:23 name|ab
|
|
2040:25 decl_stmt|;
|
|
2041:2 name|ab
|
|
2041:5 operator|=
|
|
2041:7 name|audit_log_start
|
|
2041:22 argument_list|(
|
|
2041:23 name|context
|
|
2041:30 argument_list|,
|
|
2041:32 name|GFP_KERNEL
|
|
2041:42 argument_list|,
|
|
2041:44 name|AUDIT_PATH
|
|
2041:54 argument_list|)
|
|
2041:55 expr_stmt|;
|
|
2042:2 if|if
|
|
2042:5 condition|(
|
|
2042:6 operator|!
|
|
2042:7 name|ab
|
|
2042:9 condition|)
|
|
2043:3 return|return;
|
|
2045:2 name|audit_log_format
|
|
2045:18 argument_list|(
|
|
2045:19 name|ab
|
|
2045:21 argument_list|,
|
|
2045:23 literal|"item=%d"
|
|
2045:32 argument_list|,
|
|
2045:34 name|record_num
|
|
2045:44 argument_list|)
|
|
2045:45 expr_stmt|;
|
|
2047:2 if|if
|
|
2047:5 condition|(
|
|
2047:6 name|path
|
|
2047:10 condition|)
|
|
2048:3 name|audit_log_d_path
|
|
2048:19 argument_list|(
|
|
2048:20 name|ab
|
|
2048:22 argument_list|,
|
|
2048:24 literal|" name="
|
|
2048:32 argument_list|,
|
|
2048:34 name|path
|
|
2048:38 argument_list|)
|
|
2048:39 expr_stmt|;
|
|
2049:2 elseif|else
|
|
2049:7 if|if
|
|
2049:10 condition|(
|
|
2049:11 name|n
|
|
2049:12 operator|->
|
|
2049:14 name|name
|
|
2049:18 condition|)
|
|
2049:20 block|{
|
|
2050:3 switch|switch
|
|
2050:10 condition|(
|
|
2050:11 name|n
|
|
2050:12 operator|->
|
|
2050:14 name|name_len
|
|
2050:22 condition|)
|
|
2050:24 block|{
|
|
2051:3 case|case
|
|
2051:8 name|AUDIT_NAME_FULL
|
|
2051:23 case|:
|
|
2052:4 comment|/* log the full path */
|
|
2053:4 name|audit_log_format
|
|
2053:20 argument_list|(
|
|
2053:21 name|ab
|
|
2053:23 argument_list|,
|
|
2053:25 literal|" name="
|
|
2053:33 argument_list|)
|
|
2053:34 expr_stmt|;
|
|
2054:4 name|audit_log_untrustedstring
|
|
2054:29 argument_list|(
|
|
2054:30 name|ab
|
|
2054:32 argument_list|,
|
|
2054:34 name|n
|
|
2054:35 operator|->
|
|
2054:37 name|name
|
|
2054:41 operator|->
|
|
2054:43 name|name
|
|
2054:47 argument_list|)
|
|
2054:48 expr_stmt|;
|
|
2055:4 break|break;
|
|
2056:3 case|case
|
|
2056:8 literal|0
|
|
2056:9 case|:
|
|
2057:4 comment|/* name was specified as a relative path and the * directory component is the cwd */
|
|
2059:4 name|audit_log_d_path
|
|
2059:20 argument_list|(
|
|
2059:21 name|ab
|
|
2059:23 argument_list|,
|
|
2059:25 literal|" name="
|
|
2059:33 argument_list|,
|
|
2059:35 operator|&
|
|
2059:36 name|context
|
|
2059:43 operator|->
|
|
2059:45 name|pwd
|
|
2059:48 argument_list|)
|
|
2059:49 expr_stmt|;
|
|
2060:4 break|break;
|
|
2061:3 default|default:
|
|
2062:4 comment|/* log the name's directory component */
|
|
2063:4 name|audit_log_format
|
|
2063:20 argument_list|(
|
|
2063:21 name|ab
|
|
2063:23 argument_list|,
|
|
2063:25 literal|" name="
|
|
2063:33 argument_list|)
|
|
2063:34 expr_stmt|;
|
|
2064:4 name|audit_log_n_untrustedstring
|
|
2064:31 argument_list|(
|
|
2064:32 name|ab
|
|
2064:34 argument_list|,
|
|
2064:36 name|n
|
|
2064:37 operator|->
|
|
2064:39 name|name
|
|
2064:43 operator|->
|
|
2064:45 name|name
|
|
2064:49 argument_list|,
|
|
2065:11 name|n
|
|
2065:12 operator|->
|
|
2065:14 name|name_len
|
|
2065:22 argument_list|)
|
|
2065:23 expr_stmt|;
|
|
2066:3 block|}
|
|
2067:2 block|}
|
|
2067:4 else|else
|
|
2068:3 name|audit_log_format
|
|
2068:19 argument_list|(
|
|
2068:20 name|ab
|
|
2068:22 argument_list|,
|
|
2068:24 literal|" name=(null)"
|
|
2068:38 argument_list|)
|
|
2068:39 expr_stmt|;
|
|
2070:2 if|if
|
|
2070:5 condition|(
|
|
2070:6 name|n
|
|
2070:7 operator|->
|
|
2070:9 name|ino
|
|
2070:13 operator|!=
|
|
2070:16 name|AUDIT_INO_UNSET
|
|
2070:31 condition|)
|
|
2071:3 name|audit_log_format
|
|
2071:19 argument_list|(
|
|
2071:20 name|ab
|
|
2071:22 argument_list|,
|
|
2071:24 literal|" inode=%lu"
|
|
2072:6 literal|" dev=%02x:%02x mode=%#ho"
|
|
2073:6 literal|" ouid=%u ogid=%u rdev=%02x:%02x"
|
|
2073:39 argument_list|,
|
|
2074:6 name|n
|
|
2074:7 operator|->
|
|
2074:9 name|ino
|
|
2074:12 argument_list|,
|
|
2075:6 name|MAJOR
|
|
2075:11 argument_list|(
|
|
2075:12 name|n
|
|
2075:13 operator|->
|
|
2075:15 name|dev
|
|
2075:18 argument_list|)
|
|
2075:19 argument_list|,
|
|
2076:6 name|MINOR
|
|
2076:11 argument_list|(
|
|
2076:12 name|n
|
|
2076:13 operator|->
|
|
2076:15 name|dev
|
|
2076:18 argument_list|)
|
|
2076:19 argument_list|,
|
|
2077:6 name|n
|
|
2077:7 operator|->
|
|
2077:9 name|mode
|
|
2077:13 argument_list|,
|
|
2078:6 name|from_kuid
|
|
2078:15 argument_list|(
|
|
2078:16 operator|&
|
|
2078:17 name|init_user_ns
|
|
2078:29 argument_list|,
|
|
2078:31 name|n
|
|
2078:32 operator|->
|
|
2078:34 name|uid
|
|
2078:37 argument_list|)
|
|
2078:38 argument_list|,
|
|
2079:6 name|from_kgid
|
|
2079:15 argument_list|(
|
|
2079:16 operator|&
|
|
2079:17 name|init_user_ns
|
|
2079:29 argument_list|,
|
|
2079:31 name|n
|
|
2079:32 operator|->
|
|
2079:34 name|gid
|
|
2079:37 argument_list|)
|
|
2079:38 argument_list|,
|
|
2080:6 name|MAJOR
|
|
2080:11 argument_list|(
|
|
2080:12 name|n
|
|
2080:13 operator|->
|
|
2080:15 name|rdev
|
|
2080:19 argument_list|)
|
|
2080:20 argument_list|,
|
|
2081:6 name|MINOR
|
|
2081:11 argument_list|(
|
|
2081:12 name|n
|
|
2081:13 operator|->
|
|
2081:15 name|rdev
|
|
2081:19 argument_list|)
|
|
2081:20 argument_list|)
|
|
2081:21 expr_stmt|;
|
|
2082:2 if|if
|
|
2082:5 condition|(
|
|
2082:6 name|n
|
|
2082:7 operator|->
|
|
2082:9 name|osid
|
|
2082:14 operator|!=
|
|
2082:17 literal|0
|
|
2082:18 condition|)
|
|
2082:20 block|{
|
|
2083:3 name|char
|
|
2083:8 modifier|*
|
|
2083:9 name|ctx
|
|
2083:13 init|=
|
|
2083:15 name|NULL
|
|
2083:19 decl_stmt|;
|
|
2084:3 name|u32
|
|
2084:7 name|len
|
|
2084:10 decl_stmt|;
|
|
2085:3 if|if
|
|
2085:6 condition|(
|
|
2085:7 name|security_secid_to_secctx
|
|
2085:31 argument_list|(
|
|
2086:4 name|n
|
|
2086:5 operator|->
|
|
2086:7 name|osid
|
|
2086:11 argument_list|,
|
|
2086:13 operator|&
|
|
2086:14 name|ctx
|
|
2086:17 argument_list|,
|
|
2086:19 operator|&
|
|
2086:20 name|len
|
|
2086:23 argument_list|)
|
|
2086:24 condition|)
|
|
2086:26 block|{
|
|
2087:4 name|audit_log_format
|
|
2087:20 argument_list|(
|
|
2087:21 name|ab
|
|
2087:23 argument_list|,
|
|
2087:25 literal|" osid=%u"
|
|
2087:35 argument_list|,
|
|
2087:37 name|n
|
|
2087:38 operator|->
|
|
2087:40 name|osid
|
|
2087:44 argument_list|)
|
|
2087:45 expr_stmt|;
|
|
2088:4 if|if
|
|
2088:7 condition|(
|
|
2088:8 name|call_panic
|
|
2088:18 condition|)
|
|
2089:5 operator|*
|
|
2089:6 name|call_panic
|
|
2089:17 operator|=
|
|
2089:19 literal|2
|
|
2089:20 expr_stmt|;
|
|
2090:3 block|}
|
|
2090:5 else|else
|
|
2090:10 block|{
|
|
2091:4 name|audit_log_format
|
|
2091:20 argument_list|(
|
|
2091:21 name|ab
|
|
2091:23 argument_list|,
|
|
2091:25 literal|" obj=%s"
|
|
2091:34 argument_list|,
|
|
2091:36 name|ctx
|
|
2091:39 argument_list|)
|
|
2091:40 expr_stmt|;
|
|
2092:4 name|security_release_secctx
|
|
2092:27 argument_list|(
|
|
2092:28 name|ctx
|
|
2092:31 argument_list|,
|
|
2092:33 name|len
|
|
2092:36 argument_list|)
|
|
2092:37 expr_stmt|;
|
|
2093:3 block|}
|
|
2094:2 block|}
|
|
2096:2 comment|/* log the audit_names record type */
|
|
2097:2 name|audit_log_format
|
|
2097:18 argument_list|(
|
|
2097:19 name|ab
|
|
2097:21 argument_list|,
|
|
2097:23 literal|" nametype="
|
|
2097:35 argument_list|)
|
|
2097:36 expr_stmt|;
|
|
2098:2 switch|switch
|
|
2098:8 condition|(
|
|
2098:9 name|n
|
|
2098:10 operator|->
|
|
2098:12 name|type
|
|
2098:16 condition|)
|
|
2098:18 block|{
|
|
2099:2 case|case
|
|
2099:7 name|AUDIT_TYPE_NORMAL
|
|
2099:24 case|:
|
|
2100:3 name|audit_log_format
|
|
2100:19 argument_list|(
|
|
2100:20 name|ab
|
|
2100:22 argument_list|,
|
|
2100:24 literal|"NORMAL"
|
|
2100:32 argument_list|)
|
|
2100:33 expr_stmt|;
|
|
2101:3 break|break;
|
|
2102:2 case|case
|
|
2102:7 name|AUDIT_TYPE_PARENT
|
|
2102:24 case|:
|
|
2103:3 name|audit_log_format
|
|
2103:19 argument_list|(
|
|
2103:20 name|ab
|
|
2103:22 argument_list|,
|
|
2103:24 literal|"PARENT"
|
|
2103:32 argument_list|)
|
|
2103:33 expr_stmt|;
|
|
2104:3 break|break;
|
|
2105:2 case|case
|
|
2105:7 name|AUDIT_TYPE_CHILD_DELETE
|
|
2105:30 case|:
|
|
2106:3 name|audit_log_format
|
|
2106:19 argument_list|(
|
|
2106:20 name|ab
|
|
2106:22 argument_list|,
|
|
2106:24 literal|"DELETE"
|
|
2106:32 argument_list|)
|
|
2106:33 expr_stmt|;
|
|
2107:3 break|break;
|
|
2108:2 case|case
|
|
2108:7 name|AUDIT_TYPE_CHILD_CREATE
|
|
2108:30 case|:
|
|
2109:3 name|audit_log_format
|
|
2109:19 argument_list|(
|
|
2109:20 name|ab
|
|
2109:22 argument_list|,
|
|
2109:24 literal|"CREATE"
|
|
2109:32 argument_list|)
|
|
2109:33 expr_stmt|;
|
|
2110:3 break|break;
|
|
2111:2 default|default:
|
|
2112:3 name|audit_log_format
|
|
2112:19 argument_list|(
|
|
2112:20 name|ab
|
|
2112:22 argument_list|,
|
|
2112:24 literal|"UNKNOWN"
|
|
2112:33 argument_list|)
|
|
2112:34 expr_stmt|;
|
|
2113:3 break|break;
|
|
2114:2 block|}
|
|
2116:2 name|audit_log_fcaps
|
|
2116:17 argument_list|(
|
|
2116:18 name|ab
|
|
2116:20 argument_list|,
|
|
2116:22 name|n
|
|
2116:23 argument_list|)
|
|
2116:24 expr_stmt|;
|
|
2117:2 name|audit_log_end
|
|
2117:15 argument_list|(
|
|
2117:16 name|ab
|
|
2117:18 argument_list|)
|
|
2117:19 expr_stmt|;
|
|
2118:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
2120:1 name|int
|
|
2120:5 name|audit_log_task_context
|
|
2120:27 parameter_list|(
|
|
2120:28 name|struct
|
|
2120:35 name|audit_buffer
|
|
2120:48 modifier|*
|
|
2120:49 name|ab
|
|
2120:51 parameter_list|)
|
|
2121:1 block|{
|
|
2122:2 name|char
|
|
2122:7 modifier|*
|
|
2122:8 name|ctx
|
|
2122:12 init|=
|
|
2122:14 name|NULL
|
|
2122:18 decl_stmt|;
|
|
2123:2 name|unsigned
|
|
2123:11 name|len
|
|
2123:14 decl_stmt|;
|
|
2124:2 name|int
|
|
2124:6 name|error
|
|
2124:11 decl_stmt|;
|
|
2125:2 name|u32
|
|
2125:6 name|sid
|
|
2125:9 decl_stmt|;
|
|
2127:2 name|security_task_getsecid
|
|
2127:24 argument_list|(
|
|
2127:25 name|current
|
|
2127:32 argument_list|,
|
|
2127:34 operator|&
|
|
2127:35 name|sid
|
|
2127:38 argument_list|)
|
|
2127:39 expr_stmt|;
|
|
2128:2 if|if
|
|
2128:5 condition|(
|
|
2128:6 operator|!
|
|
2128:7 name|sid
|
|
2128:10 condition|)
|
|
2129:3 return|return
|
|
2129:10 literal|0
|
|
2129:11 return|;
|
|
2131:2 name|error
|
|
2131:8 operator|=
|
|
2131:10 name|security_secid_to_secctx
|
|
2131:34 argument_list|(
|
|
2131:35 name|sid
|
|
2131:38 argument_list|,
|
|
2131:40 operator|&
|
|
2131:41 name|ctx
|
|
2131:44 argument_list|,
|
|
2131:46 operator|&
|
|
2131:47 name|len
|
|
2131:50 argument_list|)
|
|
2131:51 expr_stmt|;
|
|
2132:2 if|if
|
|
2132:5 condition|(
|
|
2132:6 name|error
|
|
2132:11 condition|)
|
|
2132:13 block|{
|
|
2133:3 if|if
|
|
2133:6 condition|(
|
|
2133:7 name|error
|
|
2133:13 operator|!=
|
|
2133:16 operator|-
|
|
2133:17 name|EINVAL
|
|
2133:23 condition|)
|
|
2134:4 goto|goto
|
|
2134:9 name|error_path
|
|
2134:19 goto|;
|
|
2135:3 return|return
|
|
2135:10 literal|0
|
|
2135:11 return|;
|
|
2136:2 block|}
|
|
2138:2 name|audit_log_format
|
|
2138:18 argument_list|(
|
|
2138:19 name|ab
|
|
2138:21 argument_list|,
|
|
2138:23 literal|" subj=%s"
|
|
2138:33 argument_list|,
|
|
2138:35 name|ctx
|
|
2138:38 argument_list|)
|
|
2138:39 expr_stmt|;
|
|
2139:2 name|security_release_secctx
|
|
2139:25 argument_list|(
|
|
2139:26 name|ctx
|
|
2139:29 argument_list|,
|
|
2139:31 name|len
|
|
2139:34 argument_list|)
|
|
2139:35 expr_stmt|;
|
|
2140:2 return|return
|
|
2140:9 literal|0
|
|
2140:10 return|;
|
|
2142:1 name|error_path
|
|
2142:11 label|:
|
|
2143:2 name|audit_panic
|
|
2143:13 argument_list|(
|
|
2143:14 literal|"error in audit_log_task_context"
|
|
2143:47 argument_list|)
|
|
2143:48 expr_stmt|;
|
|
2144:2 return|return
|
|
2144:9 name|error
|
|
2144:14 return|;
|
|
2145:1 block|}
|
|
-:- end_function
|
|
-:- begin_expr_stmt
|
|
2146:1 name|EXPORT_SYMBOL
|
|
2146:14 argument_list|(
|
|
2146:15 name|audit_log_task_context
|
|
2146:37 argument_list|)
|
|
2146:38 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_function
|
|
2148:1 name|void
|
|
2148:6 name|audit_log_d_path_exe
|
|
2148:26 parameter_list|(
|
|
2148:27 name|struct
|
|
2148:34 name|audit_buffer
|
|
2148:47 modifier|*
|
|
2148:48 name|ab
|
|
2148:50 parameter_list|,
|
|
2149:6 name|struct
|
|
2149:13 name|mm_struct
|
|
2149:23 modifier|*
|
|
2149:24 name|mm
|
|
2149:26 parameter_list|)
|
|
2150:1 block|{
|
|
2151:2 name|struct
|
|
2151:9 name|file
|
|
2151:14 modifier|*
|
|
2151:15 name|exe_file
|
|
2151:23 decl_stmt|;
|
|
2153:2 if|if
|
|
2153:5 condition|(
|
|
2153:6 operator|!
|
|
2153:7 name|mm
|
|
2153:9 condition|)
|
|
2154:3 goto|goto
|
|
2154:8 name|out_null
|
|
2154:16 goto|;
|
|
2156:2 name|exe_file
|
|
2156:11 operator|=
|
|
2156:13 name|get_mm_exe_file
|
|
2156:28 argument_list|(
|
|
2156:29 name|mm
|
|
2156:31 argument_list|)
|
|
2156:32 expr_stmt|;
|
|
2157:2 if|if
|
|
2157:5 condition|(
|
|
2157:6 operator|!
|
|
2157:7 name|exe_file
|
|
2157:15 condition|)
|
|
2158:3 goto|goto
|
|
2158:8 name|out_null
|
|
2158:16 goto|;
|
|
2160:2 name|audit_log_d_path
|
|
2160:18 argument_list|(
|
|
2160:19 name|ab
|
|
2160:21 argument_list|,
|
|
2160:23 literal|" exe="
|
|
2160:30 argument_list|,
|
|
2160:32 operator|&
|
|
2160:33 name|exe_file
|
|
2160:41 operator|->
|
|
2160:43 name|f_path
|
|
2160:49 argument_list|)
|
|
2160:50 expr_stmt|;
|
|
2161:2 name|fput
|
|
2161:6 argument_list|(
|
|
2161:7 name|exe_file
|
|
2161:15 argument_list|)
|
|
2161:16 expr_stmt|;
|
|
2162:2 return|return;
|
|
2163:1 name|out_null
|
|
2163:9 label|:
|
|
2164:2 name|audit_log_format
|
|
2164:18 argument_list|(
|
|
2164:19 name|ab
|
|
2164:21 argument_list|,
|
|
2164:23 literal|" exe=(null)"
|
|
2164:36 argument_list|)
|
|
2164:37 expr_stmt|;
|
|
2165:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
2167:1 name|struct
|
|
2167:8 name|tty_struct
|
|
2167:19 modifier|*
|
|
2167:20 name|audit_get_tty
|
|
2167:33 parameter_list|(
|
|
2167:34 name|struct
|
|
2167:41 name|task_struct
|
|
2167:53 modifier|*
|
|
2167:54 name|tsk
|
|
2167:57 parameter_list|)
|
|
2168:1 block|{
|
|
2169:2 name|struct
|
|
2169:9 name|tty_struct
|
|
2169:20 modifier|*
|
|
2169:21 name|tty
|
|
2169:25 init|=
|
|
2169:27 name|NULL
|
|
2169:31 decl_stmt|;
|
|
2170:2 name|unsigned
|
|
2170:11 name|long
|
|
2170:16 name|flags
|
|
2170:21 decl_stmt|;
|
|
2172:2 name|spin_lock_irqsave
|
|
2172:19 argument_list|(
|
|
2172:20 operator|&
|
|
2172:21 name|tsk
|
|
2172:24 operator|->
|
|
2172:26 name|sighand
|
|
2172:33 operator|->
|
|
2172:35 name|siglock
|
|
2172:42 argument_list|,
|
|
2172:44 name|flags
|
|
2172:49 argument_list|)
|
|
2172:50 expr_stmt|;
|
|
2173:2 if|if
|
|
2173:5 condition|(
|
|
2173:6 name|tsk
|
|
2173:9 operator|->
|
|
2173:11 name|signal
|
|
2173:17 condition|)
|
|
2174:3 name|tty
|
|
2174:7 operator|=
|
|
2174:9 name|tty_kref_get
|
|
2174:21 argument_list|(
|
|
2174:22 name|tsk
|
|
2174:25 operator|->
|
|
2174:27 name|signal
|
|
2174:33 operator|->
|
|
2174:35 name|tty
|
|
2174:38 argument_list|)
|
|
2174:39 expr_stmt|;
|
|
2175:2 name|spin_unlock_irqrestore
|
|
2175:24 argument_list|(
|
|
2175:25 operator|&
|
|
2175:26 name|tsk
|
|
2175:29 operator|->
|
|
2175:31 name|sighand
|
|
2175:38 operator|->
|
|
2175:40 name|siglock
|
|
2175:47 argument_list|,
|
|
2175:49 name|flags
|
|
2175:54 argument_list|)
|
|
2175:55 expr_stmt|;
|
|
2176:2 return|return
|
|
2176:9 name|tty
|
|
2176:12 return|;
|
|
2177:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
2179:1 name|void
|
|
2179:6 name|audit_put_tty
|
|
2179:19 parameter_list|(
|
|
2179:20 name|struct
|
|
2179:27 name|tty_struct
|
|
2179:38 modifier|*
|
|
2179:39 name|tty
|
|
2179:42 parameter_list|)
|
|
2180:1 block|{
|
|
2181:2 name|tty_kref_put
|
|
2181:14 argument_list|(
|
|
2181:15 name|tty
|
|
2181:18 argument_list|)
|
|
2181:19 expr_stmt|;
|
|
2182:1 block|}
|
|
-:- end_function
|
|
-:- begin_function
|
|
2184:1 name|void
|
|
2184:6 name|audit_log_task_info
|
|
2184:25 parameter_list|(
|
|
2184:26 name|struct
|
|
2184:33 name|audit_buffer
|
|
2184:46 modifier|*
|
|
2184:47 name|ab
|
|
2184:49 parameter_list|,
|
|
2184:51 name|struct
|
|
2184:58 name|task_struct
|
|
2184:70 modifier|*
|
|
2184:71 name|tsk
|
|
2184:74 parameter_list|)
|
|
2185:1 block|{
|
|
2186:2 specifier|const
|
|
2186:8 name|struct
|
|
2186:15 name|cred
|
|
2186:20 modifier|*
|
|
2186:21 name|cred
|
|
2186:25 decl_stmt|;
|
|
2187:2 name|char
|
|
2187:7 name|comm
|
|
2187:11 index|[
|
|
2187:12 sizeof|sizeof
|
|
2187:18 argument_list|(
|
|
2187:19 name|tsk
|
|
2187:22 operator|->
|
|
2187:24 name|comm
|
|
2187:28 argument_list|)
|
|
2187:29 index|]
|
|
2187:30 decl_stmt|;
|
|
2188:2 name|struct
|
|
2188:9 name|tty_struct
|
|
2188:20 modifier|*
|
|
2188:21 name|tty
|
|
2188:24 decl_stmt|;
|
|
2190:2 if|if
|
|
2190:5 condition|(
|
|
2190:6 operator|!
|
|
2190:7 name|ab
|
|
2190:9 condition|)
|
|
2191:3 return|return;
|
|
2193:2 comment|/* tsk == current */
|
|
2194:2 name|cred
|
|
2194:7 operator|=
|
|
2194:9 name|current_cred
|
|
2194:21 argument_list|()
|
|
2194:23 expr_stmt|;
|
|
2195:2 name|tty
|
|
2195:6 operator|=
|
|
2195:8 name|audit_get_tty
|
|
2195:21 argument_list|(
|
|
2195:22 name|tsk
|
|
2195:25 argument_list|)
|
|
2195:26 expr_stmt|;
|
|
2196:2 name|audit_log_format
|
|
2196:18 argument_list|(
|
|
2196:19 name|ab
|
|
2196:21 argument_list|,
|
|
2197:5 literal|" ppid=%d pid=%d auid=%u uid=%u gid=%u"
|
|
2198:5 literal|" euid=%u suid=%u fsuid=%u"
|
|
2199:5 literal|" egid=%u sgid=%u fsgid=%u tty=%s ses=%u"
|
|
2199:46 argument_list|,
|
|
2200:5 name|task_ppid_nr
|
|
2200:17 argument_list|(
|
|
2200:18 name|tsk
|
|
2200:21 argument_list|)
|
|
2200:22 argument_list|,
|
|
2201:5 name|task_tgid_nr
|
|
2201:17 argument_list|(
|
|
2201:18 name|tsk
|
|
2201:21 argument_list|)
|
|
2201:22 argument_list|,
|
|
2202:5 name|from_kuid
|
|
2202:14 argument_list|(
|
|
2202:15 operator|&
|
|
2202:16 name|init_user_ns
|
|
2202:28 argument_list|,
|
|
2202:30 name|audit_get_loginuid
|
|
2202:48 argument_list|(
|
|
2202:49 name|tsk
|
|
2202:52 argument_list|)
|
|
2202:53 argument_list|)
|
|
2202:54 argument_list|,
|
|
2203:5 name|from_kuid
|
|
2203:14 argument_list|(
|
|
2203:15 operator|&
|
|
2203:16 name|init_user_ns
|
|
2203:28 argument_list|,
|
|
2203:30 name|cred
|
|
2203:34 operator|->
|
|
2203:36 name|uid
|
|
2203:39 argument_list|)
|
|
2203:40 argument_list|,
|
|
2204:5 name|from_kgid
|
|
2204:14 argument_list|(
|
|
2204:15 operator|&
|
|
2204:16 name|init_user_ns
|
|
2204:28 argument_list|,
|
|
2204:30 name|cred
|
|
2204:34 operator|->
|
|
2204:36 name|gid
|
|
2204:39 argument_list|)
|
|
2204:40 argument_list|,
|
|
2205:5 name|from_kuid
|
|
2205:14 argument_list|(
|
|
2205:15 operator|&
|
|
2205:16 name|init_user_ns
|
|
2205:28 argument_list|,
|
|
2205:30 name|cred
|
|
2205:34 operator|->
|
|
2205:36 name|euid
|
|
2205:40 argument_list|)
|
|
2205:41 argument_list|,
|
|
2206:5 name|from_kuid
|
|
2206:14 argument_list|(
|
|
2206:15 operator|&
|
|
2206:16 name|init_user_ns
|
|
2206:28 argument_list|,
|
|
2206:30 name|cred
|
|
2206:34 operator|->
|
|
2206:36 name|suid
|
|
2206:40 argument_list|)
|
|
2206:41 argument_list|,
|
|
2207:5 name|from_kuid
|
|
2207:14 argument_list|(
|
|
2207:15 operator|&
|
|
2207:16 name|init_user_ns
|
|
2207:28 argument_list|,
|
|
2207:30 name|cred
|
|
2207:34 operator|->
|
|
2207:36 name|fsuid
|
|
2207:41 argument_list|)
|
|
2207:42 argument_list|,
|
|
2208:5 name|from_kgid
|
|
2208:14 argument_list|(
|
|
2208:15 operator|&
|
|
2208:16 name|init_user_ns
|
|
2208:28 argument_list|,
|
|
2208:30 name|cred
|
|
2208:34 operator|->
|
|
2208:36 name|egid
|
|
2208:40 argument_list|)
|
|
2208:41 argument_list|,
|
|
2209:5 name|from_kgid
|
|
2209:14 argument_list|(
|
|
2209:15 operator|&
|
|
2209:16 name|init_user_ns
|
|
2209:28 argument_list|,
|
|
2209:30 name|cred
|
|
2209:34 operator|->
|
|
2209:36 name|sgid
|
|
2209:40 argument_list|)
|
|
2209:41 argument_list|,
|
|
2210:5 name|from_kgid
|
|
2210:14 argument_list|(
|
|
2210:15 operator|&
|
|
2210:16 name|init_user_ns
|
|
2210:28 argument_list|,
|
|
2210:30 name|cred
|
|
2210:34 operator|->
|
|
2210:36 name|fsgid
|
|
2210:41 argument_list|)
|
|
2210:42 argument_list|,
|
|
2211:5 name|tty
|
|
2211:9 condition|?
|
|
2211:11 name|tty_name
|
|
2211:19 argument_list|(
|
|
2211:20 name|tty
|
|
2211:23 argument_list|)
|
|
2211:25 else|:
|
|
2211:27 literal|"(none)"
|
|
2211:35 argument_list|,
|
|
2212:5 name|audit_get_sessionid
|
|
2212:24 argument_list|(
|
|
2212:25 name|tsk
|
|
2212:28 argument_list|)
|
|
2212:29 argument_list|)
|
|
2212:30 expr_stmt|;
|
|
2213:2 name|audit_put_tty
|
|
2213:15 argument_list|(
|
|
2213:16 name|tty
|
|
2213:19 argument_list|)
|
|
2213:20 expr_stmt|;
|
|
2214:2 name|audit_log_format
|
|
2214:18 argument_list|(
|
|
2214:19 name|ab
|
|
2214:21 argument_list|,
|
|
2214:23 literal|" comm="
|
|
2214:31 argument_list|)
|
|
2214:32 expr_stmt|;
|
|
2215:2 name|audit_log_untrustedstring
|
|
2215:27 argument_list|(
|
|
2215:28 name|ab
|
|
2215:30 argument_list|,
|
|
2215:32 name|get_task_comm
|
|
2215:45 argument_list|(
|
|
2215:46 name|comm
|
|
2215:50 argument_list|,
|
|
2215:52 name|tsk
|
|
2215:55 argument_list|)
|
|
2215:56 argument_list|)
|
|
2215:57 expr_stmt|;
|
|
2216:2 name|audit_log_d_path_exe
|
|
2216:22 argument_list|(
|
|
2216:23 name|ab
|
|
2216:25 argument_list|,
|
|
2216:27 name|tsk
|
|
2216:30 operator|->
|
|
2216:32 name|mm
|
|
2216:34 argument_list|)
|
|
2216:35 expr_stmt|;
|
|
2217:2 name|audit_log_task_context
|
|
2217:24 argument_list|(
|
|
2217:25 name|ab
|
|
2217:27 argument_list|)
|
|
2217:28 expr_stmt|;
|
|
2218:1 block|}
|
|
-:- end_function
|
|
-:- begin_expr_stmt
|
|
2219:1 name|EXPORT_SYMBOL
|
|
2219:14 argument_list|(
|
|
2219:15 name|audit_log_task_info
|
|
2219:34 argument_list|)
|
|
2219:35 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_comment
|
|
2221:1 comment|/** * audit_log_link_denied - report a link restriction denial * @operation: specific link operation * @link: the path that triggered the restriction */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
2226:1 name|void
|
|
2226:6 name|audit_log_link_denied
|
|
2226:27 parameter_list|(
|
|
2226:28 specifier|const
|
|
2226:34 name|char
|
|
2226:39 modifier|*
|
|
2226:40 name|operation
|
|
2226:49 parameter_list|,
|
|
2226:51 specifier|const
|
|
2226:57 name|struct
|
|
2226:64 name|path
|
|
2226:69 modifier|*
|
|
2226:70 name|link
|
|
2226:74 parameter_list|)
|
|
2227:1 block|{
|
|
2228:2 name|struct
|
|
2228:9 name|audit_buffer
|
|
2228:22 modifier|*
|
|
2228:23 name|ab
|
|
2228:25 decl_stmt|;
|
|
2229:2 name|struct
|
|
2229:9 name|audit_names
|
|
2229:21 modifier|*
|
|
2229:22 name|name
|
|
2229:26 decl_stmt|;
|
|
2231:2 name|name
|
|
2231:7 operator|=
|
|
2231:9 name|kzalloc
|
|
2231:16 argument_list|(
|
|
2231:17 sizeof|sizeof
|
|
2231:23 argument_list|(
|
|
2231:24 operator|*
|
|
2231:25 name|name
|
|
2231:29 argument_list|)
|
|
2231:30 argument_list|,
|
|
2231:32 name|GFP_NOFS
|
|
2231:40 argument_list|)
|
|
2231:41 expr_stmt|;
|
|
2232:2 if|if
|
|
2232:5 condition|(
|
|
2232:6 operator|!
|
|
2232:7 name|name
|
|
2232:11 condition|)
|
|
2233:3 return|return;
|
|
2235:2 comment|/* Generate AUDIT_ANOM_LINK with subject, operation, outcome. */
|
|
2236:2 name|ab
|
|
2236:5 operator|=
|
|
2236:7 name|audit_log_start
|
|
2236:22 argument_list|(
|
|
2236:23 name|current
|
|
2236:30 operator|->
|
|
2236:32 name|audit_context
|
|
2236:45 argument_list|,
|
|
2236:47 name|GFP_KERNEL
|
|
2236:57 argument_list|,
|
|
2237:9 name|AUDIT_ANOM_LINK
|
|
2237:24 argument_list|)
|
|
2237:25 expr_stmt|;
|
|
2238:2 if|if
|
|
2238:5 condition|(
|
|
2238:6 operator|!
|
|
2238:7 name|ab
|
|
2238:9 condition|)
|
|
2239:3 goto|goto
|
|
2239:8 name|out
|
|
2239:11 goto|;
|
|
2240:2 name|audit_log_format
|
|
2240:18 argument_list|(
|
|
2240:19 name|ab
|
|
2240:21 argument_list|,
|
|
2240:23 literal|"op=%s"
|
|
2240:30 argument_list|,
|
|
2240:32 name|operation
|
|
2240:41 argument_list|)
|
|
2240:42 expr_stmt|;
|
|
2241:2 name|audit_log_task_info
|
|
2241:21 argument_list|(
|
|
2241:22 name|ab
|
|
2241:24 argument_list|,
|
|
2241:26 name|current
|
|
2241:33 argument_list|)
|
|
2241:34 expr_stmt|;
|
|
2242:2 name|audit_log_format
|
|
2242:18 argument_list|(
|
|
2242:19 name|ab
|
|
2242:21 argument_list|,
|
|
2242:23 literal|" res=0"
|
|
2242:31 argument_list|)
|
|
2242:32 expr_stmt|;
|
|
2243:2 name|audit_log_end
|
|
2243:15 argument_list|(
|
|
2243:16 name|ab
|
|
2243:18 argument_list|)
|
|
2243:19 expr_stmt|;
|
|
2245:2 comment|/* Generate AUDIT_PATH record with object. */
|
|
2246:2 name|name
|
|
2246:6 operator|->
|
|
2246:8 name|type
|
|
2246:13 operator|=
|
|
2246:15 name|AUDIT_TYPE_NORMAL
|
|
2246:32 expr_stmt|;
|
|
2247:2 name|audit_copy_inode
|
|
2247:18 argument_list|(
|
|
2247:19 name|name
|
|
2247:23 argument_list|,
|
|
2247:25 name|link
|
|
2247:29 operator|->
|
|
2247:31 name|dentry
|
|
2247:37 argument_list|,
|
|
2247:39 name|d_backing_inode
|
|
2247:54 argument_list|(
|
|
2247:55 name|link
|
|
2247:59 operator|->
|
|
2247:61 name|dentry
|
|
2247:67 argument_list|)
|
|
2247:68 argument_list|)
|
|
2247:69 expr_stmt|;
|
|
2248:2 name|audit_log_name
|
|
2248:16 argument_list|(
|
|
2248:17 name|current
|
|
2248:24 operator|->
|
|
2248:26 name|audit_context
|
|
2248:39 argument_list|,
|
|
2248:41 name|name
|
|
2248:45 argument_list|,
|
|
2248:47 name|link
|
|
2248:51 argument_list|,
|
|
2248:53 literal|0
|
|
2248:54 argument_list|,
|
|
2248:56 name|NULL
|
|
2248:60 argument_list|)
|
|
2248:61 expr_stmt|;
|
|
2249:1 name|out
|
|
2249:4 label|:
|
|
2250:2 name|kfree
|
|
2250:7 argument_list|(
|
|
2250:8 name|name
|
|
2250:12 argument_list|)
|
|
2250:13 expr_stmt|;
|
|
2251:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
2253:1 comment|/** * audit_log_end - end one audit record * @ab: the audit_buffer * * We can not do a netlink send inside an irq context because it blocks (last * arg, flags, is not set to MSG_DONTWAIT), so the audit buffer is placed on a * queue and a tasklet is scheduled to remove them from the queue outside the * irq context. May be called in any context. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
2262:1 name|void
|
|
2262:6 name|audit_log_end
|
|
2262:19 parameter_list|(
|
|
2262:20 name|struct
|
|
2262:27 name|audit_buffer
|
|
2262:40 modifier|*
|
|
2262:41 name|ab
|
|
2262:43 parameter_list|)
|
|
2263:1 block|{
|
|
2264:2 name|struct
|
|
2264:9 name|sk_buff
|
|
2264:17 modifier|*
|
|
2264:18 name|skb
|
|
2264:21 decl_stmt|;
|
|
2265:2 name|struct
|
|
2265:9 name|nlmsghdr
|
|
2265:18 modifier|*
|
|
2265:19 name|nlh
|
|
2265:22 decl_stmt|;
|
|
2267:2 if|if
|
|
2267:5 condition|(
|
|
2267:6 operator|!
|
|
2267:7 name|ab
|
|
2267:9 condition|)
|
|
2268:3 return|return;
|
|
2270:2 if|if
|
|
2270:5 condition|(
|
|
2270:6 name|audit_rate_check
|
|
2270:22 argument_list|()
|
|
2270:24 condition|)
|
|
2270:26 block|{
|
|
2271:3 name|skb
|
|
2271:7 operator|=
|
|
2271:9 name|ab
|
|
2271:11 operator|->
|
|
2271:13 name|skb
|
|
2271:16 expr_stmt|;
|
|
2272:3 name|ab
|
|
2272:5 operator|->
|
|
2272:7 name|skb
|
|
2272:11 operator|=
|
|
2272:13 name|NULL
|
|
2272:17 expr_stmt|;
|
|
2274:3 comment|/* setup the netlink header, see the comments in * kauditd_send_multicast_skb() for length quirks */
|
|
2276:3 name|nlh
|
|
2276:7 operator|=
|
|
2276:9 name|nlmsg_hdr
|
|
2276:18 argument_list|(
|
|
2276:19 name|skb
|
|
2276:22 argument_list|)
|
|
2276:23 expr_stmt|;
|
|
2277:3 name|nlh
|
|
2277:6 operator|->
|
|
2277:8 name|nlmsg_len
|
|
2277:18 operator|=
|
|
2277:20 name|skb
|
|
2277:23 operator|->
|
|
2277:25 name|len
|
|
2277:29 operator|-
|
|
2277:31 name|NLMSG_HDRLEN
|
|
2277:43 expr_stmt|;
|
|
2279:3 comment|/* queue the netlink packet and poke the kauditd thread */
|
|
2280:3 name|skb_queue_tail
|
|
2280:17 argument_list|(
|
|
2280:18 operator|&
|
|
2280:19 name|audit_queue
|
|
2280:30 argument_list|,
|
|
2280:32 name|skb
|
|
2280:35 argument_list|)
|
|
2280:36 expr_stmt|;
|
|
2281:3 name|wake_up_interruptible
|
|
2281:24 argument_list|(
|
|
2281:25 operator|&
|
|
2281:26 name|kauditd_wait
|
|
2281:38 argument_list|)
|
|
2281:39 expr_stmt|;
|
|
2282:2 block|}
|
|
2282:4 else|else
|
|
2283:3 name|audit_log_lost
|
|
2283:17 argument_list|(
|
|
2283:18 literal|"rate limit exceeded"
|
|
2283:39 argument_list|)
|
|
2283:40 expr_stmt|;
|
|
2285:2 name|audit_buffer_free
|
|
2285:19 argument_list|(
|
|
2285:20 name|ab
|
|
2285:22 argument_list|)
|
|
2285:23 expr_stmt|;
|
|
2286:1 block|}
|
|
-:- end_function
|
|
-:- begin_comment
|
|
2288:1 comment|/** * audit_log - Log an audit record * @ctx: audit context * @gfp_mask: type of allocation * @type: audit message type * @fmt: format string to use * @...: variable parameters matching the format string * * This is a convenience function that calls audit_log_start, * audit_log_vformat, and audit_log_end. It may be called * in any context. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
2300:1 name|void
|
|
2300:6 name|audit_log
|
|
2300:15 parameter_list|(
|
|
2300:16 name|struct
|
|
2300:23 name|audit_context
|
|
2300:37 modifier|*
|
|
2300:38 name|ctx
|
|
2300:41 parameter_list|,
|
|
2300:43 name|gfp_t
|
|
2300:49 name|gfp_mask
|
|
2300:57 parameter_list|,
|
|
2300:59 name|int
|
|
2300:63 name|type
|
|
2300:67 parameter_list|,
|
|
2301:9 specifier|const
|
|
2301:15 name|char
|
|
2301:20 modifier|*
|
|
2301:21 name|fmt
|
|
2301:24 parameter_list|,
|
|
2301:26 modifier|...
|
|
2301:29 parameter_list|)
|
|
2302:1 block|{
|
|
2303:2 name|struct
|
|
2303:9 name|audit_buffer
|
|
2303:22 modifier|*
|
|
2303:23 name|ab
|
|
2303:25 decl_stmt|;
|
|
2304:2 name|va_list
|
|
2304:10 name|args
|
|
2304:14 decl_stmt|;
|
|
2306:2 name|ab
|
|
2306:5 operator|=
|
|
2306:7 name|audit_log_start
|
|
2306:22 argument_list|(
|
|
2306:23 name|ctx
|
|
2306:26 argument_list|,
|
|
2306:28 name|gfp_mask
|
|
2306:36 argument_list|,
|
|
2306:38 name|type
|
|
2306:42 argument_list|)
|
|
2306:43 expr_stmt|;
|
|
2307:2 if|if
|
|
2307:5 condition|(
|
|
2307:6 name|ab
|
|
2307:8 condition|)
|
|
2307:10 block|{
|
|
2308:3 name|va_start
|
|
2308:11 argument_list|(
|
|
2308:12 name|args
|
|
2308:16 argument_list|,
|
|
2308:18 name|fmt
|
|
2308:21 argument_list|)
|
|
2308:22 expr_stmt|;
|
|
2309:3 name|audit_log_vformat
|
|
2309:20 argument_list|(
|
|
2309:21 name|ab
|
|
2309:23 argument_list|,
|
|
2309:25 name|fmt
|
|
2309:28 argument_list|,
|
|
2309:30 name|args
|
|
2309:34 argument_list|)
|
|
2309:35 expr_stmt|;
|
|
2310:3 name|va_end
|
|
2310:9 argument_list|(
|
|
2310:10 name|args
|
|
2310:14 argument_list|)
|
|
2310:15 expr_stmt|;
|
|
2311:3 name|audit_log_end
|
|
2311:16 argument_list|(
|
|
2311:17 name|ab
|
|
2311:19 argument_list|)
|
|
2311:20 expr_stmt|;
|
|
2312:2 block|}
|
|
2313:1 block|}
|
|
-:- end_function
|
|
-:- begin_ifdef
|
|
2315:1 ifdef|#
|
|
2315:2 directive|ifdef
|
|
2315:8 name|CONFIG_SECURITY
|
|
-:- end_ifdef
|
|
-:- begin_comment
|
|
2316:1 comment|/** * audit_log_secctx - Converts and logs SELinux context * @ab: audit_buffer * @secid: security number * * This is a helper function that calls security_secid_to_secctx to convert * secid to secctx and then adds the (converted) SELinux context to the audit * log by calling audit_log_format, thus also preventing leak of internal secid * to userspace. If secid cannot be converted audit_panic is called. */
|
|
-:- end_comment
|
|
-:- begin_function
|
|
2326:1 name|void
|
|
2326:6 name|audit_log_secctx
|
|
2326:22 parameter_list|(
|
|
2326:23 name|struct
|
|
2326:30 name|audit_buffer
|
|
2326:43 modifier|*
|
|
2326:44 name|ab
|
|
2326:46 parameter_list|,
|
|
2326:48 name|u32
|
|
2326:52 name|secid
|
|
2326:57 parameter_list|)
|
|
2327:1 block|{
|
|
2328:2 name|u32
|
|
2328:6 name|len
|
|
2328:9 decl_stmt|;
|
|
2329:2 name|char
|
|
2329:7 modifier|*
|
|
2329:8 name|secctx
|
|
2329:14 decl_stmt|;
|
|
2331:2 if|if
|
|
2331:5 condition|(
|
|
2331:6 name|security_secid_to_secctx
|
|
2331:30 argument_list|(
|
|
2331:31 name|secid
|
|
2331:36 argument_list|,
|
|
2331:38 operator|&
|
|
2331:39 name|secctx
|
|
2331:45 argument_list|,
|
|
2331:47 operator|&
|
|
2331:48 name|len
|
|
2331:51 argument_list|)
|
|
2331:52 condition|)
|
|
2331:54 block|{
|
|
2332:3 name|audit_panic
|
|
2332:14 argument_list|(
|
|
2332:15 literal|"Cannot convert secid to context"
|
|
2332:48 argument_list|)
|
|
2332:49 expr_stmt|;
|
|
2333:2 block|}
|
|
2333:4 else|else
|
|
2333:9 block|{
|
|
2334:3 name|audit_log_format
|
|
2334:19 argument_list|(
|
|
2334:20 name|ab
|
|
2334:22 argument_list|,
|
|
2334:24 literal|" obj=%s"
|
|
2334:33 argument_list|,
|
|
2334:35 name|secctx
|
|
2334:41 argument_list|)
|
|
2334:42 expr_stmt|;
|
|
2335:3 name|security_release_secctx
|
|
2335:26 argument_list|(
|
|
2335:27 name|secctx
|
|
2335:33 argument_list|,
|
|
2335:35 name|len
|
|
2335:38 argument_list|)
|
|
2335:39 expr_stmt|;
|
|
2336:2 block|}
|
|
2337:1 block|}
|
|
-:- end_function
|
|
-:- begin_expr_stmt
|
|
2338:1 name|EXPORT_SYMBOL
|
|
2338:14 argument_list|(
|
|
2338:15 name|audit_log_secctx
|
|
2338:31 argument_list|)
|
|
2338:32 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_endif
|
|
2339:1 endif|#
|
|
2339:2 directive|endif
|
|
-:- end_endif
|
|
-:- begin_expr_stmt
|
|
2341:1 name|EXPORT_SYMBOL
|
|
2341:14 argument_list|(
|
|
2341:15 name|audit_log_start
|
|
2341:30 argument_list|)
|
|
2341:31 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_expr_stmt
|
|
2342:1 name|EXPORT_SYMBOL
|
|
2342:14 argument_list|(
|
|
2342:15 name|audit_log_end
|
|
2342:28 argument_list|)
|
|
2342:29 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_expr_stmt
|
|
2343:1 name|EXPORT_SYMBOL
|
|
2343:14 argument_list|(
|
|
2343:15 name|audit_log_format
|
|
2343:31 argument_list|)
|
|
2343:32 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- begin_expr_stmt
|
|
2344:1 name|EXPORT_SYMBOL
|
|
2344:14 argument_list|(
|
|
2344:15 name|audit_log
|
|
2344:24 argument_list|)
|
|
2344:25 expr_stmt|;
|
|
-:- end_expr_stmt
|
|
-:- end_unit
|