Greg Kroah-Hartman | e3b3d0f | 2017-11-06 18:11:51 +0100 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0 |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 2 | /* |
| 3 | * Creating audit events from TTY input. |
| 4 | * |
Greg Kroah-Hartman | e5656d4 | 2017-11-06 18:11:55 +0100 | [diff] [blame] | 5 | * Copyright (C) 2007 Red Hat, Inc. All rights reserved. |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 6 | * |
| 7 | * Authors: Miloslav Trmac <mitr@redhat.com> |
| 8 | */ |
| 9 | |
| 10 | #include <linux/audit.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 11 | #include <linux/slab.h> |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 12 | #include <linux/tty.h> |
| 13 | |
| 14 | struct tty_audit_buf { |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 15 | struct mutex mutex; /* Protects all data below */ |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 16 | dev_t dev; /* The TTY which the data is from */ |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 17 | unsigned icanon:1; |
| 18 | size_t valid; |
| 19 | unsigned char *data; /* Allocated size N_TTY_BUF_SIZE */ |
| 20 | }; |
| 21 | |
Peter Hurley | 55b6314 | 2016-01-09 22:55:39 -0800 | [diff] [blame] | 22 | static struct tty_audit_buf *tty_audit_buf_ref(void) |
| 23 | { |
| 24 | struct tty_audit_buf *buf; |
| 25 | |
| 26 | buf = current->signal->tty_audit_buf; |
| 27 | WARN_ON(buf == ERR_PTR(-ESRCH)); |
| 28 | return buf; |
| 29 | } |
| 30 | |
Peter Hurley | a75c9b0 | 2016-01-09 22:55:28 -0800 | [diff] [blame] | 31 | static struct tty_audit_buf *tty_audit_buf_alloc(void) |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 32 | { |
| 33 | struct tty_audit_buf *buf; |
| 34 | |
Alan Cox | 66c6cea | 2008-02-08 04:18:46 -0800 | [diff] [blame] | 35 | buf = kmalloc(sizeof(*buf), GFP_KERNEL); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 36 | if (!buf) |
| 37 | goto err; |
Alan Cox | c481c70 | 2009-06-11 13:04:27 +0100 | [diff] [blame] | 38 | buf->data = kmalloc(N_TTY_BUF_SIZE, GFP_KERNEL); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 39 | if (!buf->data) |
| 40 | goto err_buf; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 41 | mutex_init(&buf->mutex); |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 42 | buf->dev = MKDEV(0, 0); |
Peter Hurley | a75c9b0 | 2016-01-09 22:55:28 -0800 | [diff] [blame] | 43 | buf->icanon = 0; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 44 | buf->valid = 0; |
| 45 | return buf; |
| 46 | |
| 47 | err_buf: |
| 48 | kfree(buf); |
| 49 | err: |
| 50 | return NULL; |
| 51 | } |
| 52 | |
| 53 | static void tty_audit_buf_free(struct tty_audit_buf *buf) |
| 54 | { |
| 55 | WARN_ON(buf->valid != 0); |
Alan Cox | c481c70 | 2009-06-11 13:04:27 +0100 | [diff] [blame] | 56 | kfree(buf->data); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 57 | kfree(buf); |
| 58 | } |
| 59 | |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 60 | static void tty_audit_log(const char *description, dev_t dev, |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 61 | unsigned char *data, size_t size) |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 62 | { |
| 63 | struct audit_buffer *ab; |
Paul Moore | 2a1fe21 | 2018-11-26 18:40:07 -0500 | [diff] [blame] | 64 | pid_t pid = task_pid_nr(current); |
| 65 | uid_t uid = from_kuid(&init_user_ns, task_uid(current)); |
| 66 | uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(current)); |
| 67 | unsigned int sessionid = audit_get_sessionid(current); |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 68 | |
Richard Guy Briggs | 18f5c1d5 | 2019-02-05 17:19:06 -0500 | [diff] [blame] | 69 | ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_TTY); |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 70 | if (ab) { |
Paul Moore | 2a1fe21 | 2018-11-26 18:40:07 -0500 | [diff] [blame] | 71 | char name[sizeof(current->comm)]; |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 72 | |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 73 | audit_log_format(ab, "%s pid=%u uid=%u auid=%u ses=%u major=%d" |
Richard Guy Briggs | f1dc486 | 2013-12-11 13:52:26 -0500 | [diff] [blame] | 74 | " minor=%d comm=", description, pid, uid, |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 75 | loginuid, sessionid, MAJOR(dev), MINOR(dev)); |
Paul Moore | 2a1fe21 | 2018-11-26 18:40:07 -0500 | [diff] [blame] | 76 | get_task_comm(name, current); |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 77 | audit_log_untrustedstring(ab, name); |
| 78 | audit_log_format(ab, " data="); |
| 79 | audit_log_n_hex(ab, data, size); |
| 80 | audit_log_end(ab); |
| 81 | } |
| 82 | } |
| 83 | |
Lee Jones | ffb5d9c | 2020-11-04 19:35:28 +0000 | [diff] [blame] | 84 | /* |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 85 | * tty_audit_buf_push - Push buffered data out |
| 86 | * |
| 87 | * Generate an audit message from the contents of @buf, which is owned by |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 88 | * the current task. @buf->mutex must be locked. |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 89 | */ |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 90 | static void tty_audit_buf_push(struct tty_audit_buf *buf) |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 91 | { |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 92 | if (buf->valid == 0) |
| 93 | return; |
Richard Guy Briggs | f785959 | 2018-06-05 19:20:39 -0400 | [diff] [blame] | 94 | if (audit_enabled == AUDIT_OFF) { |
Xiaotian Feng | 00bff39 | 2011-03-03 18:08:24 +0800 | [diff] [blame] | 95 | buf->valid = 0; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 96 | return; |
Xiaotian Feng | 00bff39 | 2011-03-03 18:08:24 +0800 | [diff] [blame] | 97 | } |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 98 | tty_audit_log("tty", buf->dev, buf->data, buf->valid); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 99 | buf->valid = 0; |
| 100 | } |
| 101 | |
| 102 | /** |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 103 | * tty_audit_exit - Handle a task exit |
| 104 | * |
| 105 | * Make sure all buffered data is written out and deallocate the buffer. |
| 106 | * Only needs to be called if current->signal->tty_audit_buf != %NULL. |
Peter Hurley | 5493090 | 2016-01-09 22:55:35 -0800 | [diff] [blame] | 107 | * |
| 108 | * The process is single-threaded at this point; no other threads share |
| 109 | * current->signal. |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 110 | */ |
| 111 | void tty_audit_exit(void) |
| 112 | { |
| 113 | struct tty_audit_buf *buf; |
| 114 | |
Peter Hurley | 55b6314 | 2016-01-09 22:55:39 -0800 | [diff] [blame] | 115 | buf = xchg(¤t->signal->tty_audit_buf, ERR_PTR(-ESRCH)); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 116 | if (!buf) |
| 117 | return; |
| 118 | |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 119 | tty_audit_buf_push(buf); |
Peter Hurley | 5493090 | 2016-01-09 22:55:35 -0800 | [diff] [blame] | 120 | tty_audit_buf_free(buf); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 121 | } |
| 122 | |
Lee Jones | ffb5d9c | 2020-11-04 19:35:28 +0000 | [diff] [blame] | 123 | /* |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 124 | * tty_audit_fork - Copy TTY audit state for a new task |
| 125 | * |
| 126 | * Set up TTY audit state in @sig from current. @sig needs no locking. |
| 127 | */ |
| 128 | void tty_audit_fork(struct signal_struct *sig) |
| 129 | { |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 130 | sig->audit_tty = current->signal->audit_tty; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 131 | } |
| 132 | |
Lee Jones | ffb5d9c | 2020-11-04 19:35:28 +0000 | [diff] [blame] | 133 | /* |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 134 | * tty_audit_tiocsti - Log TIOCSTI |
| 135 | */ |
| 136 | void tty_audit_tiocsti(struct tty_struct *tty, char ch) |
| 137 | { |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 138 | dev_t dev; |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 139 | |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 140 | dev = MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index; |
Peter Hurley | 82b5c93 | 2016-01-09 22:55:38 -0800 | [diff] [blame] | 141 | if (tty_audit_push()) |
| 142 | return; |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 143 | |
Sudip Mukherjee | 5455591 | 2016-02-24 16:45:09 +0530 | [diff] [blame] | 144 | if (audit_enabled) |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 145 | tty_audit_log("ioctl=TIOCSTI", dev, &ch, 1); |
Al Viro | 1e64174 | 2008-12-09 09:23:33 +0000 | [diff] [blame] | 146 | } |
| 147 | |
Lee Jones | ffb5d9c | 2020-11-04 19:35:28 +0000 | [diff] [blame] | 148 | /* |
Peter Hurley | 37282a7 | 2016-01-09 22:55:31 -0800 | [diff] [blame] | 149 | * tty_audit_push - Flush current's pending audit data |
Thomas Gleixner | 3c80fe4 | 2009-12-09 14:19:31 +0000 | [diff] [blame] | 150 | * |
Peter Hurley | 37282a7 | 2016-01-09 22:55:31 -0800 | [diff] [blame] | 151 | * Returns 0 if success, -EPERM if tty audit is disabled |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 152 | */ |
Peter Hurley | 37282a7 | 2016-01-09 22:55:31 -0800 | [diff] [blame] | 153 | int tty_audit_push(void) |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 154 | { |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 155 | struct tty_audit_buf *buf; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 156 | |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 157 | if (~current->signal->audit_tty & AUDIT_TTY_ENABLE) |
| 158 | return -EPERM; |
| 159 | |
Peter Hurley | 55b6314 | 2016-01-09 22:55:39 -0800 | [diff] [blame] | 160 | buf = tty_audit_buf_ref(); |
| 161 | if (!IS_ERR_OR_NULL(buf)) { |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 162 | mutex_lock(&buf->mutex); |
| 163 | tty_audit_buf_push(buf); |
| 164 | mutex_unlock(&buf->mutex); |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 165 | } |
Thomas Gleixner | 3c80fe4 | 2009-12-09 14:19:31 +0000 | [diff] [blame] | 166 | return 0; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 167 | } |
| 168 | |
Lee Jones | ffb5d9c | 2020-11-04 19:35:28 +0000 | [diff] [blame] | 169 | /* |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 170 | * tty_audit_buf_get - Get an audit buffer. |
| 171 | * |
Peter Hurley | a75c9b0 | 2016-01-09 22:55:28 -0800 | [diff] [blame] | 172 | * Get an audit buffer, allocate it if necessary. Return %NULL |
Peter Hurley | 55b6314 | 2016-01-09 22:55:39 -0800 | [diff] [blame] | 173 | * if out of memory or ERR_PTR(-ESRCH) if tty_audit_exit() has already |
| 174 | * occurred. Otherwise, return a new reference to the buffer. |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 175 | */ |
Peter Hurley | a75c9b0 | 2016-01-09 22:55:28 -0800 | [diff] [blame] | 176 | static struct tty_audit_buf *tty_audit_buf_get(void) |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 177 | { |
Peter Hurley | fbaa1227 | 2016-01-09 22:55:36 -0800 | [diff] [blame] | 178 | struct tty_audit_buf *buf; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 179 | |
Peter Hurley | 55b6314 | 2016-01-09 22:55:39 -0800 | [diff] [blame] | 180 | buf = tty_audit_buf_ref(); |
Peter Hurley | 5493090 | 2016-01-09 22:55:35 -0800 | [diff] [blame] | 181 | if (buf) |
| 182 | return buf; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 183 | |
Peter Hurley | fbaa1227 | 2016-01-09 22:55:36 -0800 | [diff] [blame] | 184 | buf = tty_audit_buf_alloc(); |
| 185 | if (buf == NULL) { |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 186 | audit_log_lost("out of memory in TTY auditing"); |
| 187 | return NULL; |
| 188 | } |
| 189 | |
Peter Hurley | fbaa1227 | 2016-01-09 22:55:36 -0800 | [diff] [blame] | 190 | /* Race to use this buffer, free it if another wins */ |
| 191 | if (cmpxchg(¤t->signal->tty_audit_buf, NULL, buf) != NULL) |
| 192 | tty_audit_buf_free(buf); |
Peter Hurley | 55b6314 | 2016-01-09 22:55:39 -0800 | [diff] [blame] | 193 | return tty_audit_buf_ref(); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 194 | } |
| 195 | |
Lee Jones | ffb5d9c | 2020-11-04 19:35:28 +0000 | [diff] [blame] | 196 | /* |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 197 | * tty_audit_add_data - Add data for TTY auditing. |
| 198 | * |
| 199 | * Audit @data of @size from @tty, if necessary. |
| 200 | */ |
Peter Hurley | 309426a | 2016-01-09 22:55:27 -0800 | [diff] [blame] | 201 | void tty_audit_add_data(struct tty_struct *tty, const void *data, size_t size) |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 202 | { |
| 203 | struct tty_audit_buf *buf; |
Peter Hurley | 309426a | 2016-01-09 22:55:27 -0800 | [diff] [blame] | 204 | unsigned int icanon = !!L_ICANON(tty); |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 205 | unsigned int audit_tty; |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 206 | dev_t dev; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 207 | |
Peter Hurley | f17c366 | 2016-01-09 22:55:37 -0800 | [diff] [blame] | 208 | audit_tty = READ_ONCE(current->signal->audit_tty); |
| 209 | if (~audit_tty & AUDIT_TTY_ENABLE) |
| 210 | return; |
| 211 | |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 212 | if (unlikely(size == 0)) |
| 213 | return; |
| 214 | |
Peter Hurley | d7c0ba4 | 2016-01-09 22:55:25 -0800 | [diff] [blame] | 215 | if (tty->driver->type == TTY_DRIVER_TYPE_PTY |
| 216 | && tty->driver->subtype == PTY_TYPE_MASTER) |
| 217 | return; |
| 218 | |
Peter Hurley | 2e28d38 | 2016-01-09 22:55:33 -0800 | [diff] [blame] | 219 | if ((~audit_tty & AUDIT_TTY_LOG_PASSWD) && icanon && !L_ECHO(tty)) |
Richard Guy Briggs | 46e959e | 2013-05-03 14:03:50 -0400 | [diff] [blame] | 220 | return; |
| 221 | |
Peter Hurley | a75c9b0 | 2016-01-09 22:55:28 -0800 | [diff] [blame] | 222 | buf = tty_audit_buf_get(); |
Peter Hurley | 55b6314 | 2016-01-09 22:55:39 -0800 | [diff] [blame] | 223 | if (IS_ERR_OR_NULL(buf)) |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 224 | return; |
| 225 | |
| 226 | mutex_lock(&buf->mutex); |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 227 | dev = MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index; |
| 228 | if (buf->dev != dev || buf->icanon != icanon) { |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 229 | tty_audit_buf_push(buf); |
Peter Hurley | 4d240b6 | 2016-01-09 22:55:32 -0800 | [diff] [blame] | 230 | buf->dev = dev; |
Jiri Slaby | 6c633f2 | 2012-10-18 22:26:37 +0200 | [diff] [blame] | 231 | buf->icanon = icanon; |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 232 | } |
| 233 | do { |
| 234 | size_t run; |
| 235 | |
| 236 | run = N_TTY_BUF_SIZE - buf->valid; |
| 237 | if (run > size) |
| 238 | run = size; |
| 239 | memcpy(buf->data + buf->valid, data, run); |
| 240 | buf->valid += run; |
| 241 | data += run; |
| 242 | size -= run; |
| 243 | if (buf->valid == N_TTY_BUF_SIZE) |
Eric Paris | 152f497 | 2013-04-19 13:56:11 -0400 | [diff] [blame] | 244 | tty_audit_buf_push(buf); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 245 | } while (size != 0); |
| 246 | mutex_unlock(&buf->mutex); |
Miloslav Trmac | 522ed77 | 2007-07-15 23:40:56 -0700 | [diff] [blame] | 247 | } |