|
Linux Kernel
3.7.1
|
All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
|
Linux Kernel
3.7.1
|
#include <linux/init.h>#include <asm/types.h>#include <linux/atomic.h>#include <linux/fs.h>#include <linux/namei.h>#include <linux/mm.h>#include <linux/export.h>#include <linux/slab.h>#include <linux/mount.h>#include <linux/socket.h>#include <linux/mqueue.h>#include <linux/audit.h>#include <linux/personality.h>#include <linux/time.h>#include <linux/netlink.h>#include <linux/compiler.h>#include <asm/unistd.h>#include <linux/security.h>#include <linux/list.h>#include <linux/tty.h>#include <linux/binfmts.h>#include <linux/highmem.h>#include <linux/syscalls.h>#include <linux/capability.h>#include <linux/fs_struct.h>#include <linux/compat.h>#include "audit.h"Go to the source code of this file.
Data Structures | |
| struct | audit_cap_data |
| struct | audit_names |
| struct | audit_aux_data |
| struct | audit_aux_data_execve |
| struct | audit_aux_data_pids |
| struct | audit_aux_data_bprm_fcaps |
| struct | audit_aux_data_capset |
| struct | audit_tree_refs |
| struct | audit_context |
Macros | |
| #define | AUDITSC_INVALID 0 |
| #define | AUDITSC_SUCCESS 1 |
| #define | AUDITSC_FAILURE 2 |
| #define | AUDIT_NAMES 5 |
| #define | MAX_EXECVE_AUDIT_LEN 7500 |
| #define | AUDIT_AUX_IPCPERM 0 |
| #define | AUDIT_AUX_PIDS 16 |
Functions | |
| void | audit_filter_inodes (struct task_struct *tsk, struct audit_context *ctx) |
| int | audit_alloc (struct task_struct *tsk) |
| void | audit_log_task_context (struct audit_buffer *ab) |
| EXPORT_SYMBOL (audit_log_task_context) | |
| void | audit_log_task_info (struct audit_buffer *ab, struct task_struct *tsk) |
| EXPORT_SYMBOL (audit_log_task_info) | |
| void | __audit_free (struct task_struct *tsk) |
| void | __audit_syscall_entry (int arch, int major, unsigned long a1, unsigned long a2, unsigned long a3, unsigned long a4) |
| void | __audit_syscall_exit (int success, long return_code) |
| struct filename * | __audit_reusename (const __user char *uptr) |
: name to add | |
| void | __audit_getname (struct filename *name) |
| void | audit_putname (struct filename *name) |
Variables | |
| int | audit_n_rules |
| int | audit_signals |
| int __audit_bprm | ( | struct linux_binprm * | bprm | ) |
| void __audit_free | ( | struct task_struct * | tsk | ) |
| void __audit_inode_child | ( | const struct inode * | parent, |
| const struct dentry * | dentry, | ||
| const unsigned char | type | ||
| ) |
__audit_inode_child - collect inode info for created/removed objects : inode of dentry parent : dentry being audited : AUDIT_TYPE_* value that we're looking for
For syscalls that create or remove filesystem objects, audit_inode can only collect information for the filesystem object's parent. This call updates the audit context with the child's information. Syscalls that create a new filesystem object must be hooked after the object is created. Syscalls that remove a filesystem object must be hooked prior, in order to capture the target inode during unsuccessful attempts.
| void __audit_ipc_obj | ( | struct kern_ipc_perm * | ipcp | ) |
| int __audit_log_bprm_fcaps | ( | struct linux_binprm * | bprm, |
| const struct cred * | new, | ||
| const struct cred * | old | ||
| ) |
__audit_log_bprm_fcaps - store information about a loading bprm and relevant fcaps : pointer to the bprm being processed : the proposed new credentials : the old credentials
Simply check if the proc already has the caps given by the file and if not store the priv escalation info for later auditing at the end of the syscall
-Eric
| void __audit_ptrace | ( | struct task_struct * | t | ) |
audit_reusename - fill out filename with info from existing entry : userland ptr to pathname
Search the audit_names list for the current audit context. If there is an existing entry with a matching "uptr" then return the filename associated with that audit_name. If not, return NULL.
| int __audit_signal_info | ( | int | sig, |
| struct task_struct * | t | ||
| ) |
| void __audit_syscall_entry | ( | int | arch, |
| int | major, | ||
| unsigned long | a1, | ||
| unsigned long | a2, | ||
| unsigned long | a3, | ||
| unsigned long | a4 | ||
| ) |
audit_syscall_entry - fill in an audit record at syscall entry : architecture type : major syscall type (function) : additional syscall register 1 : additional syscall register 2 : additional syscall register 3 : additional syscall register 4
Fill in audit context at syscall entry. This only happens if the audit context was created when the task was created and the state or filters demand the audit context be built. If the state from the per-task filter or from the per-syscall filter is AUDIT_RECORD_CONTEXT, then the record will be written at syscall exit time (otherwise, it will only be written if another part of the kernel requests that it be written).
audit_syscall_exit - deallocate audit context after a system call : success value of the syscall : return value of the syscall
Tear down after system call. If the audit context has been marked as auditable (either because of the AUDIT_RECORD_CONTEXT state from filtering, or because some other part of the kernel wrote an audit message), then write out the syscall information. In call cases, free the names stored from getname().
| int audit_alloc | ( | struct task_struct * | tsk | ) |
| void audit_filter_inodes | ( | struct task_struct * | tsk, |
| struct audit_context * | ctx | ||
| ) |
| void audit_log_task_context | ( | struct audit_buffer * | ab | ) |
| void audit_log_task_info | ( | struct audit_buffer * | ab, |
| struct task_struct * | tsk | ||
| ) |
audit_set_loginuid - set current task's audit_context loginuid : loginuid value
Returns 0.
Called (set) from fs/proc/base.c::proc_loginuid_write().
auditsc_get_stamp - get local copies of audit_context values : audit_context for the task : timespec to store time recorded in the audit_context : serial value that is recorded in the audit_context
Also sets the context as auditable.
| EXPORT_SYMBOL | ( | audit_log_task_context | ) |
| EXPORT_SYMBOL | ( | audit_log_task_info | ) |
| EXPORT_SYMBOL_GPL | ( | __audit_inode_child | ) |
1.8.2