/* SPDX-License-Identifier: GPL-2.0-or-later */ /* audit -- definition of audit_context structure and supporting types * * Copyright 2003-2004 Red Hat, Inc. * Copyright 2005 Hewlett-Packard Development Company, L.P. * Copyright 2005 IBM Corporation */ #ifndef _KERNEL_AUDIT_H_ #define _KERNEL_AUDIT_H_ #include <linux/fs.h> #include <linux/audit.h> #include <linux/skbuff.h> #include <uapi/linux/mqueue.h> #include <linux/tty.h> #include <uapi/linux/openat2.h> // struct open_how /* AUDIT_NAMES is the number of slots we reserve in the audit_context * for saving names from getname(). If we get more names we will allocate * a name dynamically and also add those to the list anchored by names_list. */ #define AUDIT_NAMES … /* At task start time, the audit_state is set in the audit_context using a per-task filter. At syscall entry, the audit_state is augmented by the syscall filter. */ enum audit_state { … }; /* Rule lists */ struct audit_watch; struct audit_fsnotify_mark; struct audit_tree; struct audit_chunk; struct audit_entry { … }; struct audit_cap_data { … }; /* When fs/namei.c:getname() is called, we store the pointer in name and bump * the refcnt in the associated filename struct. * * Further, in fs/namei.c:path_lookup() we store the inode and device. */ struct audit_names { … }; struct audit_proctitle { … }; /* The per-task audit context. */ struct audit_context { … }; extern bool audit_ever_enabled; extern void audit_log_session_info(struct audit_buffer *ab); extern int auditd_test_task(struct task_struct *task); #define AUDIT_INODE_BUCKETS … extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; static inline int audit_hash_ino(u32 ino) { … } /* Indicates that audit should log the full pathname. */ #define AUDIT_NAME_FULL … extern int audit_match_class(int class, unsigned syscall); extern int audit_comparator(const u32 left, const u32 op, const u32 right); extern int audit_uid_comparator(kuid_t left, u32 op, kuid_t right); extern int audit_gid_comparator(kgid_t left, u32 op, kgid_t right); extern int parent_len(const char *path); extern int audit_compare_dname_path(const struct qstr *dname, const char *path, int plen); extern struct sk_buff *audit_make_reply(int seq, int type, int done, int multi, const void *payload, int size); extern void audit_panic(const char *message); struct audit_netlink_list { … }; int audit_send_list_thread(void *_dest); extern struct mutex audit_filter_mutex; extern int audit_del_rule(struct audit_entry *entry); extern void audit_free_rule_rcu(struct rcu_head *head); extern struct list_head audit_filter_list[]; extern struct audit_entry *audit_dupe_rule(struct audit_krule *old); extern void audit_log_d_path_exe(struct audit_buffer *ab, struct mm_struct *mm); extern struct tty_struct *audit_get_tty(void); extern void audit_put_tty(struct tty_struct *tty); /* audit watch/mark/tree functions */ extern unsigned int audit_serial(void); #ifdef CONFIG_AUDITSYSCALL extern int auditsc_get_stamp(struct audit_context *ctx, struct timespec64 *t, unsigned int *serial); extern void audit_put_watch(struct audit_watch *watch); extern void audit_get_watch(struct audit_watch *watch); extern int audit_to_watch(struct audit_krule *krule, char *path, int len, u32 op); extern int audit_add_watch(struct audit_krule *krule, struct list_head **list); extern void audit_remove_watch_rule(struct audit_krule *krule); extern char *audit_watch_path(struct audit_watch *watch); extern int audit_watch_compare(struct audit_watch *watch, unsigned long ino, dev_t dev); extern struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pathname, int len); extern char *audit_mark_path(struct audit_fsnotify_mark *mark); extern void audit_remove_mark(struct audit_fsnotify_mark *audit_mark); extern void audit_remove_mark_rule(struct audit_krule *krule); extern int audit_mark_compare(struct audit_fsnotify_mark *mark, unsigned long ino, dev_t dev); extern int audit_dupe_exe(struct audit_krule *new, struct audit_krule *old); extern int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark); extern struct audit_chunk *audit_tree_lookup(const struct inode *inode); extern void audit_put_chunk(struct audit_chunk *chunk); extern bool audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree); extern int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op); extern int audit_add_tree_rule(struct audit_krule *rule); extern int audit_remove_tree_rule(struct audit_krule *rule); extern void audit_trim_trees(void); extern int audit_tag_tree(char *old, char *new); extern const char *audit_tree_path(struct audit_tree *tree); extern void audit_put_tree(struct audit_tree *tree); extern void audit_kill_trees(struct audit_context *context); extern int audit_signal_info_syscall(struct task_struct *t); extern void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx); extern struct list_head *audit_killed_trees(void); #else /* CONFIG_AUDITSYSCALL */ #define auditsc_get_stamp … #define audit_put_watch … #define audit_get_watch … #define audit_to_watch … #define audit_add_watch … #define audit_remove_watch_rule … #define audit_watch_path … #define audit_watch_compare … #define audit_alloc_mark … #define audit_mark_path … #define audit_remove_mark … #define audit_remove_mark_rule … #define audit_mark_compare … #define audit_exe_compare … #define audit_dupe_exe … #define audit_remove_tree_rule … #define audit_add_tree_rule … #define audit_make_tree … #define audit_trim_trees … #define audit_put_tree … #define audit_tag_tree … #define audit_tree_path … #define audit_kill_trees … static inline int audit_signal_info_syscall(struct task_struct *t) { return 0; } #define audit_filter_inodes … #endif /* CONFIG_AUDITSYSCALL */ extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len); extern int audit_filter(int msgtype, unsigned int listtype); extern void audit_ctl_lock(void); extern void audit_ctl_unlock(void); #endif
Codebase Browser
linux