blob: 32898aabcd068a124397a10f22b0b553355c7387 [file] [log] [blame]
Greg Kroah-Hartmane3b3d0f2017-11-06 18:11:51 +01001// SPDX-License-Identifier: GPL-2.0
Miloslav Trmac522ed772007-07-15 23:40:56 -07002/*
3 * Creating audit events from TTY input.
4 *
Greg Kroah-Hartmane5656d42017-11-06 18:11:55 +01005 * Copyright (C) 2007 Red Hat, Inc. All rights reserved.
Miloslav Trmac522ed772007-07-15 23:40:56 -07006 *
7 * Authors: Miloslav Trmac <mitr@redhat.com>
8 */
9
10#include <linux/audit.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090011#include <linux/slab.h>
Miloslav Trmac522ed772007-07-15 23:40:56 -070012#include <linux/tty.h>
13
14struct tty_audit_buf {
Miloslav Trmac522ed772007-07-15 23:40:56 -070015 struct mutex mutex; /* Protects all data below */
Peter Hurley4d240b62016-01-09 22:55:32 -080016 dev_t dev; /* The TTY which the data is from */
Miloslav Trmac522ed772007-07-15 23:40:56 -070017 unsigned icanon:1;
18 size_t valid;
19 unsigned char *data; /* Allocated size N_TTY_BUF_SIZE */
20};
21
Peter Hurley55b63142016-01-09 22:55:39 -080022static struct tty_audit_buf *tty_audit_buf_ref(void)
23{
24 struct tty_audit_buf *buf;
25
26 buf = current->signal->tty_audit_buf;
27 WARN_ON(buf == ERR_PTR(-ESRCH));
28 return buf;
29}
30
Peter Hurleya75c9b02016-01-09 22:55:28 -080031static struct tty_audit_buf *tty_audit_buf_alloc(void)
Miloslav Trmac522ed772007-07-15 23:40:56 -070032{
33 struct tty_audit_buf *buf;
34
Alan Cox66c6cea2008-02-08 04:18:46 -080035 buf = kmalloc(sizeof(*buf), GFP_KERNEL);
Miloslav Trmac522ed772007-07-15 23:40:56 -070036 if (!buf)
37 goto err;
Alan Coxc481c702009-06-11 13:04:27 +010038 buf->data = kmalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
Miloslav Trmac522ed772007-07-15 23:40:56 -070039 if (!buf->data)
40 goto err_buf;
Miloslav Trmac522ed772007-07-15 23:40:56 -070041 mutex_init(&buf->mutex);
Peter Hurley4d240b62016-01-09 22:55:32 -080042 buf->dev = MKDEV(0, 0);
Peter Hurleya75c9b02016-01-09 22:55:28 -080043 buf->icanon = 0;
Miloslav Trmac522ed772007-07-15 23:40:56 -070044 buf->valid = 0;
45 return buf;
46
47err_buf:
48 kfree(buf);
49err:
50 return NULL;
51}
52
53static void tty_audit_buf_free(struct tty_audit_buf *buf)
54{
55 WARN_ON(buf->valid != 0);
Alan Coxc481c702009-06-11 13:04:27 +010056 kfree(buf->data);
Miloslav Trmac522ed772007-07-15 23:40:56 -070057 kfree(buf);
58}
59
Peter Hurley4d240b62016-01-09 22:55:32 -080060static void tty_audit_log(const char *description, dev_t dev,
Eric Paris152f4972013-04-19 13:56:11 -040061 unsigned char *data, size_t size)
Al Viro1e641742008-12-09 09:23:33 +000062{
63 struct audit_buffer *ab;
Paul Moore2a1fe212018-11-26 18:40:07 -050064 pid_t pid = task_pid_nr(current);
65 uid_t uid = from_kuid(&init_user_ns, task_uid(current));
66 uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(current));
67 unsigned int sessionid = audit_get_sessionid(current);
Al Viro1e641742008-12-09 09:23:33 +000068
Richard Guy Briggs18f5c1d52019-02-05 17:19:06 -050069 ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_TTY);
Al Viro1e641742008-12-09 09:23:33 +000070 if (ab) {
Paul Moore2a1fe212018-11-26 18:40:07 -050071 char name[sizeof(current->comm)];
Al Viro1e641742008-12-09 09:23:33 +000072
Eric Paris152f4972013-04-19 13:56:11 -040073 audit_log_format(ab, "%s pid=%u uid=%u auid=%u ses=%u major=%d"
Richard Guy Briggsf1dc4862013-12-11 13:52:26 -050074 " minor=%d comm=", description, pid, uid,
Peter Hurley4d240b62016-01-09 22:55:32 -080075 loginuid, sessionid, MAJOR(dev), MINOR(dev));
Paul Moore2a1fe212018-11-26 18:40:07 -050076 get_task_comm(name, current);
Al Viro1e641742008-12-09 09:23:33 +000077 audit_log_untrustedstring(ab, name);
78 audit_log_format(ab, " data=");
79 audit_log_n_hex(ab, data, size);
80 audit_log_end(ab);
81 }
82}
83
Lee Jonesffb5d9c2020-11-04 19:35:28 +000084/*
Miloslav Trmac522ed772007-07-15 23:40:56 -070085 * tty_audit_buf_push - Push buffered data out
86 *
87 * Generate an audit message from the contents of @buf, which is owned by
Eric Paris152f4972013-04-19 13:56:11 -040088 * the current task. @buf->mutex must be locked.
Miloslav Trmac522ed772007-07-15 23:40:56 -070089 */
Eric Paris152f4972013-04-19 13:56:11 -040090static void tty_audit_buf_push(struct tty_audit_buf *buf)
Miloslav Trmac522ed772007-07-15 23:40:56 -070091{
Miloslav Trmac522ed772007-07-15 23:40:56 -070092 if (buf->valid == 0)
93 return;
Richard Guy Briggsf7859592018-06-05 19:20:39 -040094 if (audit_enabled == AUDIT_OFF) {
Xiaotian Feng00bff392011-03-03 18:08:24 +080095 buf->valid = 0;
Miloslav Trmac522ed772007-07-15 23:40:56 -070096 return;
Xiaotian Feng00bff392011-03-03 18:08:24 +080097 }
Peter Hurley4d240b62016-01-09 22:55:32 -080098 tty_audit_log("tty", buf->dev, buf->data, buf->valid);
Miloslav Trmac522ed772007-07-15 23:40:56 -070099 buf->valid = 0;
100}
101
102/**
Miloslav Trmac522ed772007-07-15 23:40:56 -0700103 * tty_audit_exit - Handle a task exit
104 *
105 * Make sure all buffered data is written out and deallocate the buffer.
106 * Only needs to be called if current->signal->tty_audit_buf != %NULL.
Peter Hurley54930902016-01-09 22:55:35 -0800107 *
108 * The process is single-threaded at this point; no other threads share
109 * current->signal.
Miloslav Trmac522ed772007-07-15 23:40:56 -0700110 */
111void tty_audit_exit(void)
112{
113 struct tty_audit_buf *buf;
114
Peter Hurley55b63142016-01-09 22:55:39 -0800115 buf = xchg(&current->signal->tty_audit_buf, ERR_PTR(-ESRCH));
Miloslav Trmac522ed772007-07-15 23:40:56 -0700116 if (!buf)
117 return;
118
Eric Paris152f4972013-04-19 13:56:11 -0400119 tty_audit_buf_push(buf);
Peter Hurley54930902016-01-09 22:55:35 -0800120 tty_audit_buf_free(buf);
Miloslav Trmac522ed772007-07-15 23:40:56 -0700121}
122
Lee Jonesffb5d9c2020-11-04 19:35:28 +0000123/*
Miloslav Trmac522ed772007-07-15 23:40:56 -0700124 * tty_audit_fork - Copy TTY audit state for a new task
125 *
126 * Set up TTY audit state in @sig from current. @sig needs no locking.
127 */
128void tty_audit_fork(struct signal_struct *sig)
129{
Miloslav Trmac522ed772007-07-15 23:40:56 -0700130 sig->audit_tty = current->signal->audit_tty;
Miloslav Trmac522ed772007-07-15 23:40:56 -0700131}
132
Lee Jonesffb5d9c2020-11-04 19:35:28 +0000133/*
Al Viro1e641742008-12-09 09:23:33 +0000134 * tty_audit_tiocsti - Log TIOCSTI
135 */
136void tty_audit_tiocsti(struct tty_struct *tty, char ch)
137{
Peter Hurley4d240b62016-01-09 22:55:32 -0800138 dev_t dev;
Al Viro1e641742008-12-09 09:23:33 +0000139
Peter Hurley4d240b62016-01-09 22:55:32 -0800140 dev = MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
Peter Hurley82b5c932016-01-09 22:55:38 -0800141 if (tty_audit_push())
142 return;
Al Viro1e641742008-12-09 09:23:33 +0000143
Sudip Mukherjee54555912016-02-24 16:45:09 +0530144 if (audit_enabled)
Peter Hurley4d240b62016-01-09 22:55:32 -0800145 tty_audit_log("ioctl=TIOCSTI", dev, &ch, 1);
Al Viro1e641742008-12-09 09:23:33 +0000146}
147
Lee Jonesffb5d9c2020-11-04 19:35:28 +0000148/*
Peter Hurley37282a72016-01-09 22:55:31 -0800149 * tty_audit_push - Flush current's pending audit data
Thomas Gleixner3c80fe42009-12-09 14:19:31 +0000150 *
Peter Hurley37282a72016-01-09 22:55:31 -0800151 * Returns 0 if success, -EPERM if tty audit is disabled
Miloslav Trmac522ed772007-07-15 23:40:56 -0700152 */
Peter Hurley37282a72016-01-09 22:55:31 -0800153int tty_audit_push(void)
Miloslav Trmac522ed772007-07-15 23:40:56 -0700154{
Peter Hurley2e28d382016-01-09 22:55:33 -0800155 struct tty_audit_buf *buf;
Miloslav Trmac522ed772007-07-15 23:40:56 -0700156
Peter Hurley2e28d382016-01-09 22:55:33 -0800157 if (~current->signal->audit_tty & AUDIT_TTY_ENABLE)
158 return -EPERM;
159
Peter Hurley55b63142016-01-09 22:55:39 -0800160 buf = tty_audit_buf_ref();
161 if (!IS_ERR_OR_NULL(buf)) {
Peter Hurley2e28d382016-01-09 22:55:33 -0800162 mutex_lock(&buf->mutex);
163 tty_audit_buf_push(buf);
164 mutex_unlock(&buf->mutex);
Peter Hurley2e28d382016-01-09 22:55:33 -0800165 }
Thomas Gleixner3c80fe42009-12-09 14:19:31 +0000166 return 0;
Miloslav Trmac522ed772007-07-15 23:40:56 -0700167}
168
Lee Jonesffb5d9c2020-11-04 19:35:28 +0000169/*
Miloslav Trmac522ed772007-07-15 23:40:56 -0700170 * tty_audit_buf_get - Get an audit buffer.
171 *
Peter Hurleya75c9b02016-01-09 22:55:28 -0800172 * Get an audit buffer, allocate it if necessary. Return %NULL
Peter Hurley55b63142016-01-09 22:55:39 -0800173 * if out of memory or ERR_PTR(-ESRCH) if tty_audit_exit() has already
174 * occurred. Otherwise, return a new reference to the buffer.
Miloslav Trmac522ed772007-07-15 23:40:56 -0700175 */
Peter Hurleya75c9b02016-01-09 22:55:28 -0800176static struct tty_audit_buf *tty_audit_buf_get(void)
Miloslav Trmac522ed772007-07-15 23:40:56 -0700177{
Peter Hurleyfbaa12272016-01-09 22:55:36 -0800178 struct tty_audit_buf *buf;
Miloslav Trmac522ed772007-07-15 23:40:56 -0700179
Peter Hurley55b63142016-01-09 22:55:39 -0800180 buf = tty_audit_buf_ref();
Peter Hurley54930902016-01-09 22:55:35 -0800181 if (buf)
182 return buf;
Miloslav Trmac522ed772007-07-15 23:40:56 -0700183
Peter Hurleyfbaa12272016-01-09 22:55:36 -0800184 buf = tty_audit_buf_alloc();
185 if (buf == NULL) {
Miloslav Trmac522ed772007-07-15 23:40:56 -0700186 audit_log_lost("out of memory in TTY auditing");
187 return NULL;
188 }
189
Peter Hurleyfbaa12272016-01-09 22:55:36 -0800190 /* Race to use this buffer, free it if another wins */
191 if (cmpxchg(&current->signal->tty_audit_buf, NULL, buf) != NULL)
192 tty_audit_buf_free(buf);
Peter Hurley55b63142016-01-09 22:55:39 -0800193 return tty_audit_buf_ref();
Miloslav Trmac522ed772007-07-15 23:40:56 -0700194}
195
Lee Jonesffb5d9c2020-11-04 19:35:28 +0000196/*
Miloslav Trmac522ed772007-07-15 23:40:56 -0700197 * tty_audit_add_data - Add data for TTY auditing.
198 *
199 * Audit @data of @size from @tty, if necessary.
200 */
Peter Hurley309426a2016-01-09 22:55:27 -0800201void tty_audit_add_data(struct tty_struct *tty, const void *data, size_t size)
Miloslav Trmac522ed772007-07-15 23:40:56 -0700202{
203 struct tty_audit_buf *buf;
Peter Hurley309426a2016-01-09 22:55:27 -0800204 unsigned int icanon = !!L_ICANON(tty);
Peter Hurley2e28d382016-01-09 22:55:33 -0800205 unsigned int audit_tty;
Peter Hurley4d240b62016-01-09 22:55:32 -0800206 dev_t dev;
Miloslav Trmac522ed772007-07-15 23:40:56 -0700207
Peter Hurleyf17c3662016-01-09 22:55:37 -0800208 audit_tty = READ_ONCE(current->signal->audit_tty);
209 if (~audit_tty & AUDIT_TTY_ENABLE)
210 return;
211
Miloslav Trmac522ed772007-07-15 23:40:56 -0700212 if (unlikely(size == 0))
213 return;
214
Peter Hurleyd7c0ba42016-01-09 22:55:25 -0800215 if (tty->driver->type == TTY_DRIVER_TYPE_PTY
216 && tty->driver->subtype == PTY_TYPE_MASTER)
217 return;
218
Peter Hurley2e28d382016-01-09 22:55:33 -0800219 if ((~audit_tty & AUDIT_TTY_LOG_PASSWD) && icanon && !L_ECHO(tty))
Richard Guy Briggs46e959e2013-05-03 14:03:50 -0400220 return;
221
Peter Hurleya75c9b02016-01-09 22:55:28 -0800222 buf = tty_audit_buf_get();
Peter Hurley55b63142016-01-09 22:55:39 -0800223 if (IS_ERR_OR_NULL(buf))
Miloslav Trmac522ed772007-07-15 23:40:56 -0700224 return;
225
226 mutex_lock(&buf->mutex);
Peter Hurley4d240b62016-01-09 22:55:32 -0800227 dev = MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
228 if (buf->dev != dev || buf->icanon != icanon) {
Eric Paris152f4972013-04-19 13:56:11 -0400229 tty_audit_buf_push(buf);
Peter Hurley4d240b62016-01-09 22:55:32 -0800230 buf->dev = dev;
Jiri Slaby6c633f22012-10-18 22:26:37 +0200231 buf->icanon = icanon;
Miloslav Trmac522ed772007-07-15 23:40:56 -0700232 }
233 do {
234 size_t run;
235
236 run = N_TTY_BUF_SIZE - buf->valid;
237 if (run > size)
238 run = size;
239 memcpy(buf->data + buf->valid, data, run);
240 buf->valid += run;
241 data += run;
242 size -= run;
243 if (buf->valid == N_TTY_BUF_SIZE)
Eric Paris152f4972013-04-19 13:56:11 -0400244 tty_audit_buf_push(buf);
Miloslav Trmac522ed772007-07-15 23:40:56 -0700245 } while (size != 0);
246 mutex_unlock(&buf->mutex);
Miloslav Trmac522ed772007-07-15 23:40:56 -0700247}