1 /* SPDX-License-Identifier: GPL-2.0-or-later */
2 /* audit.h -- Auditing support
3 *
4 * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
5 * All Rights Reserved.
6 *
7 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
8 */
9 #ifndef _LINUX_AUDIT_H_
10 #define _LINUX_AUDIT_H_
11
12 #include <linux/sched.h>
13 #include <linux/ptrace.h>
14 #include <linux/audit_arch.h>
15 #include <uapi/linux/audit.h>
16 #include <uapi/linux/fanotify.h>
17
18 #define AUDIT_STATUS_ALL (AUDIT_STATUS_ENABLED | \
19 AUDIT_STATUS_FAILURE | \
20 AUDIT_STATUS_PID | \
21 AUDIT_STATUS_RATE_LIMIT | \
22 AUDIT_STATUS_BACKLOG_LIMIT | \
23 AUDIT_STATUS_BACKLOG_WAIT_TIME | \
24 AUDIT_STATUS_LOST | \
25 AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL)
26
27 #define AUDIT_INO_UNSET ((u64)-1)
28 #define AUDIT_DEV_UNSET ((dev_t)-1)
29
30 struct audit_sig_info {
31 uid_t uid;
32 pid_t pid;
33 char ctx[];
34 };
35
36 struct audit_buffer;
37 struct audit_context;
38 struct inode;
39 struct netlink_skb_parms;
40 struct path;
41 struct linux_binprm;
42 struct mq_attr;
43 struct mqstat;
44 struct audit_watch;
45 struct audit_tree;
46 struct sk_buff;
47 struct kern_ipc_perm;
48 struct lsm_id;
49 struct lsm_prop;
50
51 struct audit_krule {
52 u32 pflags;
53 u32 flags;
54 u32 listnr;
55 u32 action;
56 u32 mask[AUDIT_BITMASK_SIZE];
57 u32 buflen; /* for data alloc on list rules */
58 u32 field_count;
59 char *filterkey; /* ties events to rules */
60 struct audit_field *fields;
61 struct audit_field *arch_f; /* quick access to arch field */
62 struct audit_field *inode_f; /* quick access to an inode field */
63 struct audit_watch *watch; /* associated watch */
64 struct audit_tree *tree; /* associated watched tree */
65 struct audit_fsnotify_mark *exe;
66 struct list_head rlist; /* entry in audit_{watch,tree}.rules list */
67 struct list_head list; /* for AUDIT_LIST* purposes only */
68 u64 prio;
69 };
70
71 /* Flag to indicate legacy AUDIT_LOGINUID unset usage */
72 #define AUDIT_LOGINUID_LEGACY 0x1
73
74 struct audit_field {
75 u32 type;
76 union {
77 u32 val;
78 kuid_t uid;
79 kgid_t gid;
80 struct {
81 char *lsm_str;
82 void *lsm_rule;
83 };
84 };
85 u32 op;
86 };
87
88 enum audit_ntp_type {
89 AUDIT_NTP_OFFSET,
90 AUDIT_NTP_FREQ,
91 AUDIT_NTP_STATUS,
92 AUDIT_NTP_TAI,
93 AUDIT_NTP_TICK,
94 AUDIT_NTP_ADJUST,
95
96 AUDIT_NTP_NVALS /* count */
97 };
98
99 #ifdef CONFIG_AUDITSYSCALL
100 struct audit_ntp_val {
101 long long oldval, newval;
102 };
103
104 struct audit_ntp_data {
105 struct audit_ntp_val vals[AUDIT_NTP_NVALS];
106 };
107 #else
108 struct audit_ntp_data {};
109 #endif
110
111 enum audit_nfcfgop {
112 AUDIT_XT_OP_REGISTER,
113 AUDIT_XT_OP_REPLACE,
114 AUDIT_XT_OP_UNREGISTER,
115 AUDIT_NFT_OP_TABLE_REGISTER,
116 AUDIT_NFT_OP_TABLE_UNREGISTER,
117 AUDIT_NFT_OP_CHAIN_REGISTER,
118 AUDIT_NFT_OP_CHAIN_UNREGISTER,
119 AUDIT_NFT_OP_RULE_REGISTER,
120 AUDIT_NFT_OP_RULE_UNREGISTER,
121 AUDIT_NFT_OP_SET_REGISTER,
122 AUDIT_NFT_OP_SET_UNREGISTER,
123 AUDIT_NFT_OP_SETELEM_REGISTER,
124 AUDIT_NFT_OP_SETELEM_UNREGISTER,
125 AUDIT_NFT_OP_GEN_REGISTER,
126 AUDIT_NFT_OP_OBJ_REGISTER,
127 AUDIT_NFT_OP_OBJ_UNREGISTER,
128 AUDIT_NFT_OP_OBJ_RESET,
129 AUDIT_NFT_OP_FLOWTABLE_REGISTER,
130 AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
131 AUDIT_NFT_OP_SETELEM_RESET,
132 AUDIT_NFT_OP_RULE_RESET,
133 AUDIT_NFT_OP_INVALID,
134 };
135
136 extern int __init audit_register_class(int class, unsigned *list);
137 extern int audit_classify_syscall(int abi, unsigned syscall);
138 extern int audit_classify_arch(int arch);
139
140 /* audit_names->type values */
141 #define AUDIT_TYPE_UNKNOWN 0 /* we don't know yet */
142 #define AUDIT_TYPE_NORMAL 1 /* a "normal" audit record */
143 #define AUDIT_TYPE_PARENT 2 /* a parent audit record */
144 #define AUDIT_TYPE_CHILD_DELETE 3 /* a child being deleted */
145 #define AUDIT_TYPE_CHILD_CREATE 4 /* a child being created */
146
147 /* maximized args number that audit_socketcall can process */
148 #define AUDITSC_ARGS 6
149
150 /* bit values for ->signal->audit_tty */
151 #define AUDIT_TTY_ENABLE BIT(0)
152 #define AUDIT_TTY_LOG_PASSWD BIT(1)
153
154 /* bit values for audit_cfg_lsm */
155 #define AUDIT_CFG_LSM_SECCTX_SUBJECT BIT(0)
156 #define AUDIT_CFG_LSM_SECCTX_OBJECT BIT(1)
157
158 struct filename;
159
160 #define AUDIT_OFF 0
161 #define AUDIT_ON 1
162 #define AUDIT_LOCKED 2
163 #ifdef CONFIG_AUDIT
164 /* These are defined in audit.c */
165 /* Public API */
166 extern __printf(4, 5)
167 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
168 const char *fmt, ...);
169
170 extern struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type);
171 extern __printf(2, 3)
172 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...);
173 extern void audit_log_end(struct audit_buffer *ab);
174 extern bool audit_string_contains_control(const char *string,
175 size_t len);
176 extern void audit_log_n_hex(struct audit_buffer *ab,
177 const unsigned char *buf,
178 size_t len);
179 extern void audit_log_n_string(struct audit_buffer *ab,
180 const char *buf,
181 size_t n);
182 extern void audit_log_n_untrustedstring(struct audit_buffer *ab,
183 const char *string,
184 size_t n);
185 extern void audit_log_untrustedstring(struct audit_buffer *ab,
186 const char *string);
187 extern void audit_log_d_path(struct audit_buffer *ab,
188 const char *prefix,
189 const struct path *path);
190 extern void audit_log_key(struct audit_buffer *ab,
191 char *key);
192 extern void audit_log_path_denied(int type,
193 const char *operation);
194 extern void audit_log_lost(const char *message);
195
196 extern int audit_log_subj_ctx(struct audit_buffer *ab, struct lsm_prop *prop);
197 extern int audit_log_obj_ctx(struct audit_buffer *ab, struct lsm_prop *prop);
198 extern int audit_log_task_context(struct audit_buffer *ab);
199 extern void audit_log_task_info(struct audit_buffer *ab);
200 extern int audit_log_nf_skb(struct audit_buffer *ab,
201 const struct sk_buff *skb, u8 nfproto);
202
203 extern int audit_update_lsm_rules(void);
204
205 /* Private API (for audit.c only) */
206 extern int audit_rule_change(int type, int seq, void *data, size_t datasz);
207 extern int audit_list_rules_send(struct sk_buff *request_skb, int seq);
208
209 extern int audit_set_loginuid(kuid_t loginuid);
210
audit_get_loginuid(struct task_struct * tsk)211 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
212 {
213 return tsk->loginuid;
214 }
215
audit_get_sessionid(struct task_struct * tsk)216 static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
217 {
218 return tsk->sessionid;
219 }
220
221 extern u32 audit_enabled;
222
223 extern int audit_signal_info(int sig, struct task_struct *t);
224
225 extern void audit_cfg_lsm(const struct lsm_id *lsmid, int flags);
226
227 #else /* CONFIG_AUDIT */
228 static inline __printf(4, 5)
audit_log(struct audit_context * ctx,gfp_t gfp_mask,int type,const char * fmt,...)229 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
230 const char *fmt, ...)
231 { }
audit_log_start(struct audit_context * ctx,gfp_t gfp_mask,int type)232 static inline struct audit_buffer *audit_log_start(struct audit_context *ctx,
233 gfp_t gfp_mask, int type)
234 {
235 return NULL;
236 }
237 static inline __printf(2, 3)
audit_log_format(struct audit_buffer * ab,const char * fmt,...)238 void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
239 { }
audit_log_end(struct audit_buffer * ab)240 static inline void audit_log_end(struct audit_buffer *ab)
241 { }
audit_log_n_hex(struct audit_buffer * ab,const unsigned char * buf,size_t len)242 static inline void audit_log_n_hex(struct audit_buffer *ab,
243 const unsigned char *buf, size_t len)
244 { }
audit_log_n_string(struct audit_buffer * ab,const char * buf,size_t n)245 static inline void audit_log_n_string(struct audit_buffer *ab,
246 const char *buf, size_t n)
247 { }
audit_log_n_untrustedstring(struct audit_buffer * ab,const char * string,size_t n)248 static inline void audit_log_n_untrustedstring(struct audit_buffer *ab,
249 const char *string, size_t n)
250 { }
audit_log_untrustedstring(struct audit_buffer * ab,const char * string)251 static inline void audit_log_untrustedstring(struct audit_buffer *ab,
252 const char *string)
253 { }
audit_log_d_path(struct audit_buffer * ab,const char * prefix,const struct path * path)254 static inline void audit_log_d_path(struct audit_buffer *ab,
255 const char *prefix,
256 const struct path *path)
257 { }
audit_log_key(struct audit_buffer * ab,char * key)258 static inline void audit_log_key(struct audit_buffer *ab, char *key)
259 { }
audit_log_path_denied(int type,const char * operation)260 static inline void audit_log_path_denied(int type, const char *operation)
261 { }
audit_log_subj_ctx(struct audit_buffer * ab,struct lsm_prop * prop)262 static inline int audit_log_subj_ctx(struct audit_buffer *ab,
263 struct lsm_prop *prop)
264 {
265 return 0;
266 }
audit_log_obj_ctx(struct audit_buffer * ab,struct lsm_prop * prop)267 static inline int audit_log_obj_ctx(struct audit_buffer *ab,
268 struct lsm_prop *prop)
269 {
270 return 0;
271 }
audit_log_task_context(struct audit_buffer * ab)272 static inline int audit_log_task_context(struct audit_buffer *ab)
273 {
274 return 0;
275 }
audit_log_task_info(struct audit_buffer * ab)276 static inline void audit_log_task_info(struct audit_buffer *ab)
277 { }
278
audit_log_nf_skb(struct audit_buffer * ab,const struct sk_buff * skb,u8 nfproto)279 static inline int audit_log_nf_skb(struct audit_buffer *ab,
280 const struct sk_buff *skb, u8 nfproto)
281 {
282 return 0;
283 }
284
audit_get_loginuid(struct task_struct * tsk)285 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
286 {
287 return INVALID_UID;
288 }
289
audit_get_sessionid(struct task_struct * tsk)290 static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
291 {
292 return AUDIT_SID_UNSET;
293 }
294
295 #define audit_enabled AUDIT_OFF
296
audit_signal_info(int sig,struct task_struct * t)297 static inline int audit_signal_info(int sig, struct task_struct *t)
298 {
299 return 0;
300 }
301
audit_cfg_lsm(const struct lsm_id * lsmid,int flags)302 static inline void audit_cfg_lsm(const struct lsm_id *lsmid, int flags)
303 { }
304
305 #endif /* CONFIG_AUDIT */
306
307 #ifdef CONFIG_AUDIT_COMPAT_GENERIC
308 #define audit_is_compat(arch) (!((arch) & __AUDIT_ARCH_64BIT))
309 #else
310 #define audit_is_compat(arch) false
311 #endif
312
313 #define AUDIT_INODE_PARENT 1 /* dentry represents the parent */
314 #define AUDIT_INODE_HIDDEN 2 /* audit record should be hidden */
315 #define AUDIT_INODE_NOEVAL 4 /* audit record incomplete */
316
317 #ifdef CONFIG_AUDITSYSCALL
318 #include <asm/syscall.h> /* for syscall_get_arch() */
319
320 /* These are defined in auditsc.c */
321 /* Public API */
322 extern int audit_alloc(struct task_struct *task);
323 extern void __audit_free(struct task_struct *task);
324 extern void __audit_uring_entry(u8 op);
325 extern void __audit_uring_exit(int success, long code);
326 extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
327 unsigned long a2, unsigned long a3);
328 extern void __audit_syscall_exit(int ret_success, long ret_value);
329 extern void __audit_getname(struct filename *name);
330 extern void __audit_inode(struct filename *name, const struct dentry *dentry,
331 unsigned int flags);
332 extern void __audit_file(const struct file *);
333 extern void __audit_inode_child(struct inode *parent,
334 const struct dentry *dentry,
335 const unsigned char type);
336 extern void audit_seccomp(unsigned long syscall, long signr, int code);
337 extern void audit_seccomp_actions_logged(const char *names,
338 const char *old_names, int res);
339 extern void __audit_ptrace(struct task_struct *t);
340
audit_set_context(struct task_struct * task,struct audit_context * ctx)341 static inline void audit_set_context(struct task_struct *task, struct audit_context *ctx)
342 {
343 task->audit_context = ctx;
344 }
345
audit_context(void)346 static inline struct audit_context *audit_context(void)
347 {
348 return current->audit_context;
349 }
350
audit_dummy_context(void)351 static inline bool audit_dummy_context(void)
352 {
353 void *p = audit_context();
354 return !p || *(int *)p;
355 }
audit_free(struct task_struct * task)356 static inline void audit_free(struct task_struct *task)
357 {
358 if (unlikely(task->audit_context))
359 __audit_free(task);
360 }
audit_uring_entry(u8 op)361 static inline void audit_uring_entry(u8 op)
362 {
363 /*
364 * We intentionally check audit_context() before audit_enabled as most
365 * Linux systems (as of ~2021) rely on systemd which forces audit to
366 * be enabled regardless of the user's audit configuration.
367 */
368 if (unlikely(audit_context() && audit_enabled))
369 __audit_uring_entry(op);
370 }
audit_uring_exit(int success,long code)371 static inline void audit_uring_exit(int success, long code)
372 {
373 if (unlikely(audit_context()))
374 __audit_uring_exit(success, code);
375 }
audit_syscall_entry(int major,unsigned long a0,unsigned long a1,unsigned long a2,unsigned long a3)376 static inline void audit_syscall_entry(int major, unsigned long a0,
377 unsigned long a1, unsigned long a2,
378 unsigned long a3)
379 {
380 if (unlikely(audit_context()))
381 __audit_syscall_entry(major, a0, a1, a2, a3);
382 }
audit_syscall_exit(void * pt_regs)383 static inline void audit_syscall_exit(void *pt_regs)
384 {
385 if (unlikely(audit_context())) {
386 int success = is_syscall_success(pt_regs);
387 long return_code = regs_return_value(pt_regs);
388
389 __audit_syscall_exit(success, return_code);
390 }
391 }
audit_getname(struct filename * name)392 static inline void audit_getname(struct filename *name)
393 {
394 if (unlikely(!audit_dummy_context()))
395 __audit_getname(name);
396 }
audit_inode(struct filename * name,const struct dentry * dentry,unsigned int aflags)397 static inline void audit_inode(struct filename *name,
398 const struct dentry *dentry,
399 unsigned int aflags) {
400 if (unlikely(!audit_dummy_context()))
401 __audit_inode(name, dentry, aflags);
402 }
audit_file(struct file * file)403 static inline void audit_file(struct file *file)
404 {
405 if (unlikely(!audit_dummy_context()))
406 __audit_file(file);
407 }
audit_inode_parent_hidden(struct filename * name,const struct dentry * dentry)408 static inline void audit_inode_parent_hidden(struct filename *name,
409 const struct dentry *dentry)
410 {
411 if (unlikely(!audit_dummy_context()))
412 __audit_inode(name, dentry,
413 AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN);
414 }
audit_inode_child(struct inode * parent,const struct dentry * dentry,const unsigned char type)415 static inline void audit_inode_child(struct inode *parent,
416 const struct dentry *dentry,
417 const unsigned char type) {
418 if (unlikely(!audit_dummy_context()))
419 __audit_inode_child(parent, dentry, type);
420 }
421 void audit_core_dumps(long signr);
422
audit_ptrace(struct task_struct * t)423 static inline void audit_ptrace(struct task_struct *t)
424 {
425 if (unlikely(!audit_dummy_context()))
426 __audit_ptrace(t);
427 }
428
429 /* Private API (for audit.c only) */
430 extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);
431 extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode);
432 extern void __audit_bprm(struct linux_binprm *bprm);
433 extern int __audit_socketcall(int nargs, unsigned long *args);
434 extern int __audit_sockaddr(int len, void *addr);
435 extern void __audit_fd_pair(int fd1, int fd2);
436 extern void __audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr);
437 extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec64 *abs_timeout);
438 extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification);
439 extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat);
440 extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
441 const struct cred *new,
442 const struct cred *old);
443 extern void __audit_log_capset(const struct cred *new, const struct cred *old);
444 extern void __audit_mmap_fd(int fd, int flags);
445 extern void __audit_openat2_how(struct open_how *how);
446 extern void __audit_log_kern_module(const char *name);
447 extern void __audit_fanotify(u32 response, struct fanotify_response_info_audit_rule *friar);
448 extern void __audit_tk_injoffset(struct timespec64 offset);
449 extern void __audit_ntp_log(const struct audit_ntp_data *ad);
450 extern void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
451 enum audit_nfcfgop op, gfp_t gfp);
452
audit_ipc_obj(struct kern_ipc_perm * ipcp)453 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
454 {
455 if (unlikely(!audit_dummy_context()))
456 __audit_ipc_obj(ipcp);
457 }
audit_fd_pair(int fd1,int fd2)458 static inline void audit_fd_pair(int fd1, int fd2)
459 {
460 if (unlikely(!audit_dummy_context()))
461 __audit_fd_pair(fd1, fd2);
462 }
audit_ipc_set_perm(unsigned long qbytes,uid_t uid,gid_t gid,umode_t mode)463 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode)
464 {
465 if (unlikely(!audit_dummy_context()))
466 __audit_ipc_set_perm(qbytes, uid, gid, mode);
467 }
audit_bprm(struct linux_binprm * bprm)468 static inline void audit_bprm(struct linux_binprm *bprm)
469 {
470 if (unlikely(!audit_dummy_context()))
471 __audit_bprm(bprm);
472 }
audit_socketcall(int nargs,unsigned long * args)473 static inline int audit_socketcall(int nargs, unsigned long *args)
474 {
475 if (unlikely(!audit_dummy_context()))
476 return __audit_socketcall(nargs, args);
477 return 0;
478 }
479
audit_socketcall_compat(int nargs,u32 * args)480 static inline int audit_socketcall_compat(int nargs, u32 *args)
481 {
482 unsigned long a[AUDITSC_ARGS];
483 int i;
484
485 if (audit_dummy_context())
486 return 0;
487
488 for (i = 0; i < nargs; i++)
489 a[i] = (unsigned long)args[i];
490 return __audit_socketcall(nargs, a);
491 }
492
audit_sockaddr(int len,void * addr)493 static inline int audit_sockaddr(int len, void *addr)
494 {
495 if (unlikely(!audit_dummy_context()))
496 return __audit_sockaddr(len, addr);
497 return 0;
498 }
audit_mq_open(int oflag,umode_t mode,struct mq_attr * attr)499 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
500 {
501 if (unlikely(!audit_dummy_context()))
502 __audit_mq_open(oflag, mode, attr);
503 }
audit_mq_sendrecv(mqd_t mqdes,size_t msg_len,unsigned int msg_prio,const struct timespec64 * abs_timeout)504 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec64 *abs_timeout)
505 {
506 if (unlikely(!audit_dummy_context()))
507 __audit_mq_sendrecv(mqdes, msg_len, msg_prio, abs_timeout);
508 }
audit_mq_notify(mqd_t mqdes,const struct sigevent * notification)509 static inline void audit_mq_notify(mqd_t mqdes, const struct sigevent *notification)
510 {
511 if (unlikely(!audit_dummy_context()))
512 __audit_mq_notify(mqdes, notification);
513 }
audit_mq_getsetattr(mqd_t mqdes,struct mq_attr * mqstat)514 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
515 {
516 if (unlikely(!audit_dummy_context()))
517 __audit_mq_getsetattr(mqdes, mqstat);
518 }
519
audit_log_bprm_fcaps(struct linux_binprm * bprm,const struct cred * new,const struct cred * old)520 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
521 const struct cred *new,
522 const struct cred *old)
523 {
524 if (unlikely(!audit_dummy_context()))
525 return __audit_log_bprm_fcaps(bprm, new, old);
526 return 0;
527 }
528
audit_log_capset(const struct cred * new,const struct cred * old)529 static inline void audit_log_capset(const struct cred *new,
530 const struct cred *old)
531 {
532 if (unlikely(!audit_dummy_context()))
533 __audit_log_capset(new, old);
534 }
535
audit_mmap_fd(int fd,int flags)536 static inline void audit_mmap_fd(int fd, int flags)
537 {
538 if (unlikely(!audit_dummy_context()))
539 __audit_mmap_fd(fd, flags);
540 }
541
audit_openat2_how(struct open_how * how)542 static inline void audit_openat2_how(struct open_how *how)
543 {
544 if (unlikely(!audit_dummy_context()))
545 __audit_openat2_how(how);
546 }
547
audit_log_kern_module(const char * name)548 static inline void audit_log_kern_module(const char *name)
549 {
550 if (!audit_dummy_context())
551 __audit_log_kern_module(name);
552 }
553
audit_fanotify(u32 response,struct fanotify_response_info_audit_rule * friar)554 static inline void audit_fanotify(u32 response, struct fanotify_response_info_audit_rule *friar)
555 {
556 if (audit_enabled)
557 __audit_fanotify(response, friar);
558 }
559
audit_tk_injoffset(struct timespec64 offset)560 static inline void audit_tk_injoffset(struct timespec64 offset)
561 {
562 /* ignore no-op events */
563 if (offset.tv_sec == 0 && offset.tv_nsec == 0)
564 return;
565
566 if (!audit_dummy_context())
567 __audit_tk_injoffset(offset);
568 }
569
audit_ntp_init(struct audit_ntp_data * ad)570 static inline void audit_ntp_init(struct audit_ntp_data *ad)
571 {
572 memset(ad, 0, sizeof(*ad));
573 }
574
audit_ntp_set_old(struct audit_ntp_data * ad,enum audit_ntp_type type,long long val)575 static inline void audit_ntp_set_old(struct audit_ntp_data *ad,
576 enum audit_ntp_type type, long long val)
577 {
578 ad->vals[type].oldval = val;
579 }
580
audit_ntp_set_new(struct audit_ntp_data * ad,enum audit_ntp_type type,long long val)581 static inline void audit_ntp_set_new(struct audit_ntp_data *ad,
582 enum audit_ntp_type type, long long val)
583 {
584 ad->vals[type].newval = val;
585 }
586
audit_ntp_log(const struct audit_ntp_data * ad)587 static inline void audit_ntp_log(const struct audit_ntp_data *ad)
588 {
589 if (!audit_dummy_context())
590 __audit_ntp_log(ad);
591 }
592
audit_log_nfcfg(const char * name,u8 af,unsigned int nentries,enum audit_nfcfgop op,gfp_t gfp)593 static inline void audit_log_nfcfg(const char *name, u8 af,
594 unsigned int nentries,
595 enum audit_nfcfgop op, gfp_t gfp)
596 {
597 if (audit_enabled)
598 __audit_log_nfcfg(name, af, nentries, op, gfp);
599 }
600
601 extern int audit_n_rules;
602 extern int audit_signals;
603 #else /* CONFIG_AUDITSYSCALL */
audit_alloc(struct task_struct * task)604 static inline int audit_alloc(struct task_struct *task)
605 {
606 return 0;
607 }
audit_free(struct task_struct * task)608 static inline void audit_free(struct task_struct *task)
609 { }
audit_uring_entry(u8 op)610 static inline void audit_uring_entry(u8 op)
611 { }
audit_uring_exit(int success,long code)612 static inline void audit_uring_exit(int success, long code)
613 { }
audit_syscall_entry(int major,unsigned long a0,unsigned long a1,unsigned long a2,unsigned long a3)614 static inline void audit_syscall_entry(int major, unsigned long a0,
615 unsigned long a1, unsigned long a2,
616 unsigned long a3)
617 { }
audit_syscall_exit(void * pt_regs)618 static inline void audit_syscall_exit(void *pt_regs)
619 { }
audit_dummy_context(void)620 static inline bool audit_dummy_context(void)
621 {
622 return true;
623 }
audit_set_context(struct task_struct * task,struct audit_context * ctx)624 static inline void audit_set_context(struct task_struct *task, struct audit_context *ctx)
625 { }
audit_context(void)626 static inline struct audit_context *audit_context(void)
627 {
628 return NULL;
629 }
audit_getname(struct filename * name)630 static inline void audit_getname(struct filename *name)
631 { }
audit_inode(struct filename * name,const struct dentry * dentry,unsigned int aflags)632 static inline void audit_inode(struct filename *name,
633 const struct dentry *dentry,
634 unsigned int aflags)
635 { }
audit_file(struct file * file)636 static inline void audit_file(struct file *file)
637 {
638 }
audit_inode_parent_hidden(struct filename * name,const struct dentry * dentry)639 static inline void audit_inode_parent_hidden(struct filename *name,
640 const struct dentry *dentry)
641 { }
audit_inode_child(struct inode * parent,const struct dentry * dentry,const unsigned char type)642 static inline void audit_inode_child(struct inode *parent,
643 const struct dentry *dentry,
644 const unsigned char type)
645 { }
audit_core_dumps(long signr)646 static inline void audit_core_dumps(long signr)
647 { }
audit_seccomp(unsigned long syscall,long signr,int code)648 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
649 { }
audit_seccomp_actions_logged(const char * names,const char * old_names,int res)650 static inline void audit_seccomp_actions_logged(const char *names,
651 const char *old_names, int res)
652 { }
audit_ipc_obj(struct kern_ipc_perm * ipcp)653 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
654 { }
audit_ipc_set_perm(unsigned long qbytes,uid_t uid,gid_t gid,umode_t mode)655 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,
656 gid_t gid, umode_t mode)
657 { }
audit_bprm(struct linux_binprm * bprm)658 static inline void audit_bprm(struct linux_binprm *bprm)
659 { }
audit_socketcall(int nargs,unsigned long * args)660 static inline int audit_socketcall(int nargs, unsigned long *args)
661 {
662 return 0;
663 }
664
audit_socketcall_compat(int nargs,u32 * args)665 static inline int audit_socketcall_compat(int nargs, u32 *args)
666 {
667 return 0;
668 }
669
audit_fd_pair(int fd1,int fd2)670 static inline void audit_fd_pair(int fd1, int fd2)
671 { }
audit_sockaddr(int len,void * addr)672 static inline int audit_sockaddr(int len, void *addr)
673 {
674 return 0;
675 }
audit_mq_open(int oflag,umode_t mode,struct mq_attr * attr)676 static inline void audit_mq_open(int oflag, umode_t mode, struct mq_attr *attr)
677 { }
audit_mq_sendrecv(mqd_t mqdes,size_t msg_len,unsigned int msg_prio,const struct timespec64 * abs_timeout)678 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len,
679 unsigned int msg_prio,
680 const struct timespec64 *abs_timeout)
681 { }
audit_mq_notify(mqd_t mqdes,const struct sigevent * notification)682 static inline void audit_mq_notify(mqd_t mqdes,
683 const struct sigevent *notification)
684 { }
audit_mq_getsetattr(mqd_t mqdes,struct mq_attr * mqstat)685 static inline void audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
686 { }
audit_log_bprm_fcaps(struct linux_binprm * bprm,const struct cred * new,const struct cred * old)687 static inline int audit_log_bprm_fcaps(struct linux_binprm *bprm,
688 const struct cred *new,
689 const struct cred *old)
690 {
691 return 0;
692 }
audit_log_capset(const struct cred * new,const struct cred * old)693 static inline void audit_log_capset(const struct cred *new,
694 const struct cred *old)
695 { }
audit_mmap_fd(int fd,int flags)696 static inline void audit_mmap_fd(int fd, int flags)
697 { }
698
audit_openat2_how(struct open_how * how)699 static inline void audit_openat2_how(struct open_how *how)
700 { }
701
audit_log_kern_module(const char * name)702 static inline void audit_log_kern_module(const char *name)
703 { }
704
audit_fanotify(u32 response,struct fanotify_response_info_audit_rule * friar)705 static inline void audit_fanotify(u32 response, struct fanotify_response_info_audit_rule *friar)
706 { }
707
audit_tk_injoffset(struct timespec64 offset)708 static inline void audit_tk_injoffset(struct timespec64 offset)
709 { }
710
audit_ntp_init(struct audit_ntp_data * ad)711 static inline void audit_ntp_init(struct audit_ntp_data *ad)
712 { }
713
audit_ntp_set_old(struct audit_ntp_data * ad,enum audit_ntp_type type,long long val)714 static inline void audit_ntp_set_old(struct audit_ntp_data *ad,
715 enum audit_ntp_type type, long long val)
716 { }
717
audit_ntp_set_new(struct audit_ntp_data * ad,enum audit_ntp_type type,long long val)718 static inline void audit_ntp_set_new(struct audit_ntp_data *ad,
719 enum audit_ntp_type type, long long val)
720 { }
721
audit_ntp_log(const struct audit_ntp_data * ad)722 static inline void audit_ntp_log(const struct audit_ntp_data *ad)
723 { }
724
audit_ptrace(struct task_struct * t)725 static inline void audit_ptrace(struct task_struct *t)
726 { }
727
audit_log_nfcfg(const char * name,u8 af,unsigned int nentries,enum audit_nfcfgop op,gfp_t gfp)728 static inline void audit_log_nfcfg(const char *name, u8 af,
729 unsigned int nentries,
730 enum audit_nfcfgop op, gfp_t gfp)
731 { }
732
733 #define audit_n_rules 0
734 #define audit_signals 0
735 #endif /* CONFIG_AUDITSYSCALL */
736
audit_loginuid_set(struct task_struct * tsk)737 static inline bool audit_loginuid_set(struct task_struct *tsk)
738 {
739 return uid_valid(audit_get_loginuid(tsk));
740 }
741
742 #endif
743