xref: /linux/security/apparmor/audit.c (revision 8c4b785a86be1219f7d50f7b38266c454d6a9bbc) 
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * AppArmor security module
4  *
5  * This file contains AppArmor auditing functions
6  *
7  * Copyright (C) 1998-2008 Novell/SUSE
8  * Copyright 2009-2010 Canonical Ltd.
9  */
10 
11 #include <linux/audit.h>
12 #include <linux/socket.h>
13 
14 #include "include/apparmor.h"
15 #include "include/audit.h"
16 #include "include/policy.h"
17 #include "include/policy_ns.h"
18 #include "include/secid.h"
19 
20 const char *const audit_mode_names[] = {
21 	"normal",
22 	"quiet_denied",
23 	"quiet",
24 	"noquiet",
25 	"all"
26 };
27 
28 static const char *const aa_audit_type[] = {
29 	"AUDIT",
30 	"ALLOWED",
31 	"DENIED",
32 	"HINT",
33 	"STATUS",
34 	"ERROR",
35 	"KILLED",
36 	"AUTO"
37 };
38 
39 static const char *const aa_class_names[] = {
40 	"none",
41 	"unknown",
42 	"file",
43 	"cap",
44 	"net",
45 	"rlimits",
46 	"domain",
47 	"mount",
48 	"unknown",
49 	"ptrace",
50 	"signal",
51 	"unknown",
52 	"unknown",
53 	"unknown",
54 	"net",
55 	"unknown",
56 	"label",
57 	"lsm",
58 };
59 
60 
61 /*
62  * Currently AppArmor auditing is fed straight into the audit framework.
63  *
64  * TODO:
65  * netlink interface for complain mode
66  * user auditing, - send user auditing to netlink interface
67  * system control of whether user audit messages go to system log
68  */
69 
70 /**
71  * audit_base - core AppArmor function.
72  * @ab: audit buffer to fill (NOT NULL)
73  * @ca: audit structure containing data to audit (NOT NULL)
74  *
75  * Record common AppArmor audit data from @sa
76  */
77 static void audit_pre(struct audit_buffer *ab, void *ca)
78 {
79 	struct common_audit_data *sa = ca;
80 
81 	if (aa_g_audit_header) {
82 		audit_log_format(ab, "apparmor=\"%s\"",
83 				 aa_audit_type[aad(sa)->type]);
84 	}
85 
86 	if (aad(sa)->op) {
87 		audit_log_format(ab, " operation=\"%s\"", aad(sa)->op);
88 	}
89 
90 	if (aad(sa)->class)
91 		audit_log_format(ab, " class=\"%s\"",
92 				 aad(sa)->class <= AA_CLASS_LAST ?
93 				 aa_class_names[aad(sa)->class] :
94 				 "unknown");
95 
96 	if (aad(sa)->info) {
97 		audit_log_format(ab, " info=\"%s\"", aad(sa)->info);
98 		if (aad(sa)->error)
99 			audit_log_format(ab, " error=%d", aad(sa)->error);
100 	}
101 
102 	if (aad(sa)->label) {
103 		struct aa_label *label = aad(sa)->label;
104 
105 		if (label_isprofile(label)) {
106 			struct aa_profile *profile = labels_profile(label);
107 
108 			if (profile->ns != root_ns) {
109 				audit_log_format(ab, " namespace=");
110 				audit_log_untrustedstring(ab,
111 						       profile->ns->base.hname);
112 			}
113 			audit_log_format(ab, " profile=");
114 			audit_log_untrustedstring(ab, profile->base.hname);
115 		} else {
116 			audit_log_format(ab, " label=");
117 			aa_label_xaudit(ab, root_ns, label, FLAG_VIEW_SUBNS,
118 					GFP_ATOMIC);
119 		}
120 	}
121 
122 	if (aad(sa)->name) {
123 		audit_log_format(ab, " name=");
124 		audit_log_untrustedstring(ab, aad(sa)->name);
125 	}
126 }
127 
128 /**
129  * aa_audit_msg - Log a message to the audit subsystem
130  * @sa: audit event structure (NOT NULL)
131  * @cb: optional callback fn for type specific fields (MAYBE NULL)
132  */
133 void aa_audit_msg(int type, struct common_audit_data *sa,
134 		  void (*cb) (struct audit_buffer *, void *))
135 {
136 	aad(sa)->type = type;
137 	common_lsm_audit(sa, audit_pre, cb);
138 }
139 
140 /**
141  * aa_audit - Log a profile based audit event to the audit subsystem
142  * @type: audit type for the message
143  * @profile: profile to check against (NOT NULL)
144  * @sa: audit event (NOT NULL)
145  * @cb: optional callback fn for type specific fields (MAYBE NULL)
146  *
147  * Handle default message switching based off of audit mode flags
148  *
149  * Returns: error on failure
150  */
151 int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa,
152 	     void (*cb) (struct audit_buffer *, void *))
153 {
154 	AA_BUG(!profile);
155 
156 	if (type == AUDIT_APPARMOR_AUTO) {
157 		if (likely(!aad(sa)->error)) {
158 			if (AUDIT_MODE(profile) != AUDIT_ALL)
159 				return 0;
160 			type = AUDIT_APPARMOR_AUDIT;
161 		} else if (COMPLAIN_MODE(profile))
162 			type = AUDIT_APPARMOR_ALLOWED;
163 		else
164 			type = AUDIT_APPARMOR_DENIED;
165 	}
166 	if (AUDIT_MODE(profile) == AUDIT_QUIET ||
167 	    (type == AUDIT_APPARMOR_DENIED &&
168 	     AUDIT_MODE(profile) == AUDIT_QUIET_DENIED))
169 		return aad(sa)->error;
170 
171 	if (KILL_MODE(profile) && type == AUDIT_APPARMOR_DENIED)
172 		type = AUDIT_APPARMOR_KILL;
173 
174 	aad(sa)->label = &profile->label;
175 
176 	aa_audit_msg(type, sa, cb);
177 
178 	if (aad(sa)->type == AUDIT_APPARMOR_KILL)
179 		(void)send_sig_info(SIGKILL, NULL,
180 			sa->type == LSM_AUDIT_DATA_TASK && sa->u.tsk ?
181 				    sa->u.tsk : current);
182 
183 	if (aad(sa)->type == AUDIT_APPARMOR_ALLOWED)
184 		return complain_error(aad(sa)->error);
185 
186 	return aad(sa)->error;
187 }
188 
189 struct aa_audit_rule {
190 	struct aa_label *label;
191 };
192 
193 void aa_audit_rule_free(void *vrule)
194 {
195 	struct aa_audit_rule *rule = vrule;
196 
197 	if (rule) {
198 		if (!IS_ERR(rule->label))
199 			aa_put_label(rule->label);
200 		kfree(rule);
201 	}
202 }
203 
204 int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
205 {
206 	struct aa_audit_rule *rule;
207 
208 	switch (field) {
209 	case AUDIT_SUBJ_ROLE:
210 		if (op != Audit_equal && op != Audit_not_equal)
211 			return -EINVAL;
212 		break;
213 	default:
214 		return -EINVAL;
215 	}
216 
217 	rule = kzalloc(sizeof(struct aa_audit_rule), GFP_KERNEL);
218 
219 	if (!rule)
220 		return -ENOMEM;
221 
222 	/* Currently rules are treated as coming from the root ns */
223 	rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
224 				     GFP_KERNEL, true, false);
225 	if (IS_ERR(rule->label)) {
226 		int err = PTR_ERR(rule->label);
227 		aa_audit_rule_free(rule);
228 		return err;
229 	}
230 
231 	*vrule = rule;
232 	return 0;
233 }
234 
235 int aa_audit_rule_known(struct audit_krule *rule)
236 {
237 	int i;
238 
239 	for (i = 0; i < rule->field_count; i++) {
240 		struct audit_field *f = &rule->fields[i];
241 
242 		switch (f->type) {
243 		case AUDIT_SUBJ_ROLE:
244 			return 1;
245 		}
246 	}
247 
248 	return 0;
249 }
250 
251 int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule)
252 {
253 	struct aa_audit_rule *rule = vrule;
254 	struct aa_label *label;
255 	int found = 0;
256 
257 	label = aa_secid_to_label(sid);
258 
259 	if (!label)
260 		return -ENOENT;
261 
262 	if (aa_label_is_subset(label, rule->label))
263 		found = 1;
264 
265 	switch (field) {
266 	case AUDIT_SUBJ_ROLE:
267 		switch (op) {
268 		case Audit_equal:
269 			return found;
270 		case Audit_not_equal:
271 			return !found;
272 		}
273 	}
274 	return 0;
275 }
276