/* audit.c -- Auditing support

* Gateway between the kernel (e.g., selinux) and the user-space audit daemon.

* System-call specific features have moved to auditsc.c

*

* Copyright 2003-2007 Red Hat Inc., Durham, North Carolina.

* All Rights Reserved.

*

* This program is free software; you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation; either version 2 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program; if not, write to the Free Software

* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA

*

* Written by Rickard E. (Rik) Faith <faith@redhat.com>

*

* Goals: 1) Integrate fully with Security Modules.

* 2) Minimal run-time overhead:

* a) Minimal when syscall auditing is disabled (audit_enable=0).

* b) Small when syscall auditing is enabled and no audit record

* is generated (defer as much work as possible to record

* generation time):

* i) context is allocated,

* ii) names from getname are stored without a copy, and

* iii) inode information stored from path_lookup.

* 3) Ability to disable syscall auditing at boot time (audit=0).

* 4) Usable by other parts of the kernel (if audit_log* is called,

* then a syscall record will be generated automatically for the

* current syscall).

* 5) Netlink interface to user-space.

* 6) Support low-overhead kernel-based filtering to minimize the

* information that must be passed to user-space.

*

* Audit userspace, documentation, tests, and bug/issue trackers:

* https://github.com/linux-audit

*/

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/file.h>

#include <linux/init.h>

#include <linux/types.h>

#include <linux/atomic.h>

#include <linux/mm.h>

#include <linux/export.h>

#include <linux/slab.h>

#include <linux/err.h>

#include <linux/kthread.h>

#include <linux/kernel.h>

#include <linux/syscalls.h>

#include <linux/spinlock.h>

#include <linux/rcupdate.h>

#include <linux/mutex.h>

#include <linux/gfp.h>

#include <linux/pid.h>

#include <linux/audit.h>

#include <net/sock.h>

#include <net/netlink.h>

#include <linux/skbuff.h>

#ifdef CONFIG_SECURITY

#include <linux/security.h>

#endif

#include <linux/freezer.h>

#include <linux/pid_namespace.h>

#include <net/netns/generic.h>

#include "audit.h"

/* No auditing will take place until audit_initialized == AUDIT_INITIALIZED.

* (Initialization happens after skb_init is called.) */

#define AUDIT_DISABLED -1

#define AUDIT_UNINITIALIZED 0

#define AUDIT_INITIALIZED 1

static int audit_initialized;

u32 audit_enabled = AUDIT_OFF;

bool audit_ever_enabled = !!AUDIT_OFF;

EXPORT_SYMBOL_GPL(audit_enabled);

/* Default state when kernel boots without any parameters. */

static u32 audit_default = AUDIT_OFF;

/* If auditing cannot proceed, audit_failure selects what happens. */

static u32 audit_failure = AUDIT_FAIL_PRINTK;

/* private audit network namespace index */

static unsigned int audit_net_id;

/**

* struct audit_net - audit private network namespace data

* @sk: communication socket

*/

struct audit_net {

struct sock *sk;

};

/**

* struct auditd_connection - kernel/auditd connection state

* @pid: auditd PID

* @portid: netlink portid

* @net: the associated network namespace

* @rcu: RCU head

*

* Description:

* This struct is RCU protected; you must either hold the RCU lock for reading

* or the associated spinlock for writing.

*/

static struct auditd_connection {

struct pid *pid;

u32 portid;

struct net *net;

struct rcu_head rcu;

} *auditd_conn = NULL;

static DEFINE_SPINLOCK(auditd_conn_lock);

/* If audit_rate_limit is non-zero, limit the rate of sending audit records

* to that number per second. This prevents DoS attacks, but results in

* audit records being dropped. */

static u32 audit_rate_limit;

/* Number of outstanding audit_buffers allowed.

* When set to zero, this means unlimited. */

static u32 audit_backlog_limit = 64;

#define AUDIT_BACKLOG_WAIT_TIME (60 * HZ)

static u32 audit_backlog_wait_time = AUDIT_BACKLOG_WAIT_TIME;

/* The identity of the user shutting down the audit system. */

kuid_t audit_sig_uid = INVALID_UID;

pid_t audit_sig_pid = -1;

u32 audit_sig_sid = 0;

/* Records can be lost in several ways:

0) [suppressed in audit_alloc]

1) out of memory in audit_log_start [kmalloc of struct audit_buffer]

2) out of memory in audit_log_move [alloc_skb]

3) suppressed due to audit_rate_limit

4) suppressed due to audit_backlog_limit

*/

static atomic_t audit_lost = ATOMIC_INIT(0);

/* Hash for inode-based rules */

struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];

static struct kmem_cache *audit_buffer_cache;

/* queue msgs to send via kauditd_task */

static struct sk_buff_head audit_queue;

/* queue msgs due to temporary unicast send problems */

static struct sk_buff_head audit_retry_queue;

/* queue msgs waiting for new auditd connection */

static struct sk_buff_head audit_hold_queue;

/* queue servicing thread */

static struct task_struct *kauditd_task;

static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);

/* waitqueue for callers who are blocked on the audit backlog */

static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);

static struct audit_features af = {.vers = AUDIT_FEATURE_VERSION,

.mask = -1,

.features = 0,

.lock = 0,};

static char *audit_feature_names[2] = {

"only_unset_loginuid",

"loginuid_immutable",

};

/**

* struct audit_ctl_mutex - serialize requests from userspace

* @lock: the mutex used for locking

* @owner: the task which owns the lock

*

* Description:

* This is the lock struct used to ensure we only process userspace requests

* in an orderly fashion. We can't simply use a mutex/lock here because we

* need to track lock ownership so we don't end up blocking the lock owner in

* audit_log_start() or similar.

*/

static struct audit_ctl_mutex {

struct mutex lock;

void *owner;

} audit_cmd_mutex;

/* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting

* audit records. Since printk uses a 1024 byte buffer, this buffer

* should be at least that large. */

#define AUDIT_BUFSIZ 1024

/* The audit_buffer is used when formatting an audit record. The caller

* locks briefly to get the record off the freelist or to allocate the

* buffer, and locks briefly to send the buffer to the netlink layer or

* to place it on a transmit queue. Multiple audit_buffers can be in

* use simultaneously. */

struct audit_buffer {

struct sk_buff *skb; /* formatted skb ready to send */

struct audit_context *ctx; /* NULL or associated context */

gfp_t gfp_mask;

};

struct audit_reply {

__u32 portid;

struct net *net;

struct sk_buff *skb;

};

/**

* auditd_test_task - Check to see if a given task is an audit daemon

* @task: the task to check

*

* Description:

* Return 1 if the task is a registered audit daemon, 0 otherwise.

*/

int auditd_test_task(struct task_struct *task)

{

int rc;

struct auditd_connection *ac;

rcu_read_lock();

ac = rcu_dereference(auditd_conn);

rc = (ac && ac->pid == task_tgid(task) ? 1 : 0);

rcu_read_unlock();

return rc;

}

/**

* audit_ctl_lock - Take the audit control lock

*/

void audit_ctl_lock(void)

{

mutex_lock(&audit_cmd_mutex.lock);

audit_cmd_mutex.owner = current;

}

/**

* audit_ctl_unlock - Drop the audit control lock

*/

void audit_ctl_unlock(void)

{

audit_cmd_mutex.owner = NULL;

mutex_unlock(&audit_cmd_mutex.lock);

}

/**

* audit_ctl_owner_current - Test to see if the current task owns the lock

*

* Description:

* Return true if the current task owns the audit control lock, false if it

* doesn't own the lock.

*/

static bool audit_ctl_owner_current(void)

{

return (current == audit_cmd_mutex.owner);

}

/**

* auditd_pid_vnr - Return the auditd PID relative to the namespace

*

* Description:

* Returns the PID in relation to the namespace, 0 on failure.

*/

static pid_t auditd_pid_vnr(void)

{

pid_t pid;

const struct auditd_connection *ac;

rcu_read_lock();

ac = rcu_dereference(auditd_conn);

if (!ac || !ac->pid)

pid = 0;

else

pid = pid_vnr(ac->pid);

rcu_read_unlock();

return pid;

}

/**

* audit_get_sk - Return the audit socket for the given network namespace

* @net: the destination network namespace

*

* Description:

* Returns the sock pointer if valid, NULL otherwise. The caller must ensure

* that a reference is held for the network namespace while the sock is in use.

*/

static struct sock *audit_get_sk(const struct net *net)

{

struct audit_net *aunet;

if (!net)

return NULL;

aunet = net_generic(net, audit_net_id);

return aunet->sk;

}

void audit_panic(const char *message)

{

switch (audit_failure) {

case AUDIT_FAIL_SILENT:

break;

case AUDIT_FAIL_PRINTK:

if (printk_ratelimit())

pr_err("%s\n", message);

break;

case AUDIT_FAIL_PANIC:

panic("audit: %s\n", message);

break;

}

}

static inline int audit_rate_check(void)

{

static unsigned long last_check = 0;

static int messages = 0;

static DEFINE_SPINLOCK(lock);

unsigned long flags;

unsigned long now;

unsigned long elapsed;

int retval = 0;

if (!audit_rate_limit) return 1;

spin_lock_irqsave(&lock, flags);

if (++messages < audit_rate_limit) {

retval = 1;

} else {

now = jiffies;

elapsed = now - last_check;

if (elapsed > HZ) {

last_check = now;

messages = 0;

retval = 1;

}

}

spin_unlock_irqrestore(&lock, flags);

return retval;

}

/**

* audit_log_lost - conditionally log lost audit message event

* @message: the message stating reason for lost audit message

*

* Emit at least 1 message per second, even if audit_rate_check is

* throttling.

* Always increment the lost messages counter.

*/

void audit_log_lost(const char *message)

{

static unsigned long last_msg = 0;

static DEFINE_SPINLOCK(lock);

unsigned long flags;

unsigned long now;

int print;

atomic_inc(&audit_lost);

print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);

if (!print) {

spin_lock_irqsave(&lock, flags);

now = jiffies;

if (now - last_msg > HZ) {

print = 1;

last_msg = now;

}

spin_unlock_irqrestore(&lock, flags);

}

if (print) {

if (printk_ratelimit())

pr_warn("audit_lost=%u audit_rate_limit=%u audit_backlog_limit=%u\n",

atomic_read(&audit_lost),

audit_rate_limit,

audit_backlog_limit);

audit_panic(message);

}

}

static int audit_log_config_change(char *function_name, u32 new, u32 old,

int allow_changes)

{

struct audit_buffer *ab;

int rc = 0;

ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONFIG_CHANGE);

if (unlikely(!ab))

return rc;

audit_log_format(ab, "op=set %s=%u old=%u ", function_name, new, old);

audit_log_session_info(ab);

rc = audit_log_task_context(ab);

if (rc)

allow_changes = 0; /* Something weird, deny request */

audit_log_format(ab, " res=%d", allow_changes);

audit_log_end(ab);

return rc;

}

static int audit_do_config_change(char *function_name, u32 *to_change, u32 new)

{

int allow_changes, rc = 0;

u32 old = *to_change;

/* check if we are locked */

if (audit_enabled == AUDIT_LOCKED)

allow_changes = 0;

else

allow_changes = 1;

if (audit_enabled != AUDIT_OFF) {

rc = audit_log_config_change(function_name, new, old, allow_changes);

if (rc)

allow_changes = 0;

}

/* If we are allowed, make the change */

if (allow_changes == 1)

*to_change = new;

/* Not allowed, update reason */

else if (rc == 0)

rc = -EPERM;

return rc;

}

static int audit_set_rate_limit(u32 limit)

{

return audit_do_config_change("audit_rate_limit", &audit_rate_limit, limit);

}

static int audit_set_backlog_limit(u32 limit)

{

return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit, limit);

}

static int audit_set_backlog_wait_time(u32 timeout)

{

return audit_do_config_change("audit_backlog_wait_time",

&audit_backlog_wait_time, timeout);

}

static int audit_set_enabled(u32 state)

{

int rc;

if (state > AUDIT_LOCKED)

return -EINVAL;

rc = audit_do_config_change("audit_enabled", &audit_enabled, state);

if (!rc)

audit_ever_enabled |= !!state;

return rc;

}

static int audit_set_failure(u32 state)

{

if (state != AUDIT_FAIL_SILENT

&& state != AUDIT_FAIL_PRINTK

&& state != AUDIT_FAIL_PANIC)

return -EINVAL;

return audit_do_config_change("audit_failure", &audit_failure, state);

}

/**

* auditd_conn_free - RCU helper to release an auditd connection struct

* @rcu: RCU head

*

* Description:

* Drop any references inside the auditd connection tracking struct and free

* the memory.

*/

static void auditd_conn_free(struct rcu_head *rcu)

{

struct auditd_connection *ac;

ac = container_of(rcu, struct auditd_connection, rcu);

put_pid(ac->pid);

put_net(ac->net);

kfree(ac);

}

/**

* auditd_set - Set/Reset the auditd connection state

* @pid: auditd PID

* @portid: auditd netlink portid

* @net: auditd network namespace pointer

*

* Description:

* This function will obtain and drop network namespace references as

* necessary. Returns zero on success, negative values on failure.

*/

static int auditd_set(struct pid *pid, u32 portid, struct net *net)

{

unsigned long flags;

struct auditd_connection *ac_old, *ac_new;

if (!pid || !net)

return -EINVAL;

ac_new = kzalloc(sizeof(*ac_new), GFP_KERNEL);

if (!ac_new)

return -ENOMEM;

ac_new->pid = get_pid(pid);

ac_new->portid = portid;

ac_new->net = get_net(net);

spin_lock_irqsave(&auditd_conn_lock, flags);

ac_old = rcu_dereference_protected(auditd_conn,

lockdep_is_held(&auditd_conn_lock));

rcu_assign_pointer(auditd_conn, ac_new);

spin_unlock_irqrestore(&auditd_conn_lock, flags);

if (ac_old)

call_rcu(&ac_old->rcu, auditd_conn_free);

return 0;

}

/**

* kauditd_print_skb - Print the audit record to the ring buffer

* @skb: audit record

*

* Whatever the reason, this packet may not make it to the auditd connection

* so write it via printk so the information isn't completely lost.

*/

static void kauditd_printk_skb(struct sk_buff *skb)

{

struct nlmsghdr *nlh = nlmsg_hdr(skb);

char *data = nlmsg_data(nlh);

if (nlh->nlmsg_type != AUDIT_EOE && printk_ratelimit())

pr_notice("type=%d %s\n", nlh->nlmsg_type, data);

}

/**

* kauditd_rehold_skb - Handle a audit record send failure in the hold queue

* @skb: audit record

*

* Description:

* This should only be used by the kauditd_thread when it fails to flush the

* hold queue.

*/

static void kauditd_rehold_skb(struct sk_buff *skb)

{

/* put the record back in the queue at the same place */

skb_queue_head(&audit_hold_queue, skb);

}

/**

* kauditd_hold_skb - Queue an audit record, waiting for auditd

* @skb: audit record

*

* Description:

* Queue the audit record, waiting for an instance of auditd. When this

* function is called we haven't given up yet on sending the record, but things

* are not looking good. The first thing we want to do is try to write the

* record via printk and then see if we want to try and hold on to the record

* and queue it, if we have room. If we want to hold on to the record, but we

* don't have room, record a record lost message.

*/

static void kauditd_hold_skb(struct sk_buff *skb)

{

/* at this point it is uncertain if we will ever send this to auditd so

* try to send the message via printk before we go any further */

kauditd_printk_skb(skb);

/* can we just silently drop the message? */

if (!audit_default) {

kfree_skb(skb);

return;

}

/* if we have room, queue the message */

if (!audit_backlog_limit ||

skb_queue_len(&audit_hold_queue) < audit_backlog_limit) {

skb_queue_tail(&audit_hold_queue, skb);

return;

}

/* we have no other options - drop the message */

audit_log_lost("kauditd hold queue overflow");

kfree_skb(skb);

}

/**

* kauditd_retry_skb - Queue an audit record, attempt to send again to auditd

* @skb: audit record

*

* Description:

* Not as serious as kauditd_hold_skb() as we still have a connected auditd,

* but for some reason we are having problems sending it audit records so

* queue the given record and attempt to resend.

*/

static void kauditd_retry_skb(struct sk_buff *skb)

{

/* NOTE: because records should only live in the retry queue for a

* short period of time, before either being sent or moved to the hold

* queue, we don't currently enforce a limit on this queue */

skb_queue_tail(&audit_retry_queue, skb);

}

/**

* auditd_reset - Disconnect the auditd connection

* @ac: auditd connection state

*

* Description:

* Break the auditd/kauditd connection and move all the queued records into the

* hold queue in case auditd reconnects. It is important to note that the @ac

* pointer should never be dereferenced inside this function as it may be NULL

* or invalid, you can only compare the memory address! If @ac is NULL then

* the connection will always be reset.

*/

static void auditd_reset(const struct auditd_connection *ac)

{

unsigned long flags;

struct sk_buff *skb;

struct auditd_connection *ac_old;

/* if it isn't already broken, break the connection */

spin_lock_irqsave(&auditd_conn_lock, flags);

ac_old = rcu_dereference_protected(auditd_conn,

lockdep_is_held(&auditd_conn_lock));

if (ac && ac != ac_old) {

/* someone already registered a new auditd connection */

spin_unlock_irqrestore(&auditd_conn_lock, flags);

return;

}

rcu_assign_pointer(auditd_conn, NULL);

spin_unlock_irqrestore(&auditd_conn_lock, flags);

if (ac_old)

call_rcu(&ac_old->rcu, auditd_conn_free);

/* flush the retry queue to the hold queue, but don't touch the main

* queue since we need to process that normally for multicast */

while ((skb = skb_dequeue(&audit_retry_queue)))

kauditd_hold_skb(skb);

}

/**

* auditd_send_unicast_skb - Send a record via unicast to auditd

* @skb: audit record

*

* Description:

* Send a skb to the audit daemon, returns positive/zero values on success and

* negative values on failure; in all cases the skb will be consumed by this

* function. If the send results in -ECONNREFUSED the connection with auditd

* will be reset. This function may sleep so callers should not hold any locks

* where this would cause a problem.

*/

static int auditd_send_unicast_skb(struct sk_buff *skb)

{

int rc;

u32 portid;

struct net *net;

struct sock *sk;

struct auditd_connection *ac;

/* NOTE: we can't call netlink_unicast while in the RCU section so

* take a reference to the network namespace and grab local

* copies of the namespace, the sock, and the portid; the

* namespace and sock aren't going to go away while we hold a

* reference and if the portid does become invalid after the RCU

* section netlink_unicast() should safely return an error */

rcu_read_lock();

ac = rcu_dereference(auditd_conn);

if (!ac) {

rcu_read_unlock();

kfree_skb(skb);

rc = -ECONNREFUSED;

goto err;

}

net = get_net(ac->net);

sk = audit_get_sk(net);

portid = ac->portid;

rcu_read_unlock();

rc = netlink_unicast(sk, skb, portid, 0);

put_net(net);

if (rc < 0)

goto err;

return rc;

err:

if (ac && rc == -ECONNREFUSED)

auditd_reset(ac);

return rc;

}

/**

* kauditd_send_queue - Helper for kauditd_thread to flush skb queues

* @sk: the sending sock

* @portid: the netlink destination

* @queue: the skb queue to process

* @retry_limit: limit on number of netlink unicast failures

* @skb_hook: per-skb hook for additional processing

* @err_hook: hook called if the skb fails the netlink unicast send

*

* Description:

* Run through the given queue and attempt to send the audit records to auditd,

* returns zero on success, negative values on failure. It is up to the caller

* to ensure that the @sk is valid for the duration of this function.

*

*/

static int kauditd_send_queue(struct sock *sk, u32 portid,

struct sk_buff_head *queue,

unsigned int retry_limit,

void (*skb_hook)(struct sk_buff *skb),

void (*err_hook)(struct sk_buff *skb))

{

int rc = 0;

struct sk_buff *skb;

static unsigned int failed = 0;

/* NOTE: kauditd_thread takes care of all our locking, we just use

* the netlink info passed to us (e.g. sk and portid) */

while ((skb = skb_dequeue(queue))) {

/* call the skb_hook for each skb we touch */

if (skb_hook)

(*skb_hook)(skb);

/* can we send to anyone via unicast? */

if (!sk) {

if (err_hook)

(*err_hook)(skb);

continue;

}

/* grab an extra skb reference in case of error */

skb_get(skb);

rc = netlink_unicast(sk, skb, portid, 0);

if (rc < 0) {

/* fatal failure for our queue flush attempt? */

if (++failed >= retry_limit ||

rc == -ECONNREFUSED || rc == -EPERM) {

/* yes - error processing for the queue */

sk = NULL;

if (err_hook)

(*err_hook)(skb);

if (!skb_hook)

goto out;

/* keep processing with the skb_hook */

continue;

} else

/* no - requeue to preserve ordering */

skb_queue_head(queue, skb);

} else {

/* it worked - drop the extra reference and continue */

consume_skb(skb);

failed = 0;

}

}

out:

return (rc >= 0 ? 0 : rc);

}

/*

* kauditd_send_multicast_skb - Send a record to any multicast listeners

* @skb: audit record

*

* Description:

* Write a multicast message to anyone listening in the initial network

* namespace. This function doesn't consume an skb as might be expected since

* it has to copy it anyways.

*/

static void kauditd_send_multicast_skb(struct sk_buff *skb)

{

struct sk_buff *copy;

struct sock *sock = audit_get_sk(&init_net);

struct nlmsghdr *nlh;

/* NOTE: we are not taking an additional reference for init_net since

* we don't have to worry about it going away */

if (!netlink_has_listeners(sock, AUDIT_NLGRP_READLOG))

return;

/*

* The seemingly wasteful skb_copy() rather than bumping the refcount

* using skb_get() is necessary because non-standard mods are made to

* the skb by the original kaudit unicast socket send routine. The

* existing auditd daemon assumes this breakage. Fixing this would

* require co-ordinating a change in the established protocol between

* the kaudit kernel subsystem and the auditd userspace code. There is

* no reason for new multicast clients to continue with this

* non-compliance.

*/

copy = skb_copy(skb, GFP_KERNEL);

if (!copy)

return;

nlh = nlmsg_hdr(copy);

nlh->nlmsg_len = skb->len;

nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, GFP_KERNEL);

}

/**

* kauditd_thread - Worker thread to send audit records to userspace

* @dummy: unused

*/

static int kauditd_thread(void *dummy)

{

int rc;

u32 portid = 0;

struct net *net = NULL;

struct sock *sk = NULL;

struct auditd_connection *ac;

#define UNICAST_RETRIES 5

set_freezable();

while (!kthread_should_stop()) {

/* NOTE: see the lock comments in auditd_send_unicast_skb() */

rcu_read_lock();

ac = rcu_dereference(auditd_conn);

if (!ac) {

rcu_read_unlock();

goto main_queue;

}

net = get_net(ac->net);

sk = audit_get_sk(net);

portid = ac->portid;

rcu_read_unlock();

/* attempt to flush the hold queue */

rc = kauditd_send_queue(sk, portid,

&audit_hold_queue, UNICAST_RETRIES,

NULL, kauditd_rehold_skb);

if (ac && rc < 0) {

sk = NULL;

auditd_reset(ac);

goto main_queue;

}

/* attempt to flush the retry queue */

rc = kauditd_send_queue(sk, portid,

&audit_retry_queue, UNICAST_RETRIES,

NULL, kauditd_hold_skb);

if (ac && rc < 0) {

sk = NULL;

auditd_reset(ac);

goto main_queue;

}

main_queue:

/* process the main queue - do the multicast send and attempt

* unicast, dump failed record sends to the retry queue; if

* sk == NULL due to previous failures we will just do the

* multicast send and move the record to the hold queue */

rc = kauditd_send_queue(sk, portid, &audit_queue, 1,

kauditd_send_multicast_skb,

(sk ?

kauditd_retry_skb : kauditd_hold_skb));

if (ac && rc < 0)

auditd_reset(ac);

sk = NULL;

/* drop our netns reference, no auditd sends past this line */

if (net) {

put_net(net);

net = NULL;

}

/* we have processed all the queues so wake everyone */

wake_up(&audit_backlog_wait);

/* NOTE: we want to wake up if there is anything on the queue,

* regardless of if an auditd is connected, as we need to

* do the multicast send and rotate records from the

* main queue to the retry/hold queues */

wait_event_freezable(kauditd_wait,

(skb_queue_len(&audit_queue) ? 1 : 0));

}

return 0;

}

int audit_send_list(void *_dest)

{

struct audit_netlink_list *dest = _dest;

struct sk_buff *skb;

struct sock *sk = audit_get_sk(dest->net);

/* wait for parent to finish and send an ACK */

audit_ctl_lock();

audit_ctl_unlock();

while ((skb = __skb_dequeue(&dest->q)) != NULL)

netlink_unicast(sk, skb, dest->portid, 0);

put_net(dest->net);

kfree(dest);

return 0;

}

struct sk_buff *audit_make_reply(int seq, int type, int done,

int multi, const void *payload, int size)

{

struct sk_buff *skb;

struct nlmsghdr *nlh;

void *data;

int flags = multi ? NLM_F_MULTI : 0;

int t = done ? NLMSG_DONE : type;

skb = nlmsg_new(size, GFP_KERNEL);

if (!skb)

return NULL;

nlh = nlmsg_put(skb, 0, seq, t, size, flags);

if (!nlh)

goto out_kfree_skb;

data = nlmsg_data(nlh);

memcpy(data, payload, size);

return skb;

out_kfree_skb:

kfree_skb(skb);

return NULL;

}

static int audit_send_reply_thread(void *arg)

{

struct audit_reply *reply = (struct audit_reply *)arg;

struct sock *sk = audit_get_sk(reply->net);

audit_ctl_lock();

audit_ctl_unlock();

/* Ignore failure. It'll only happen if the sender goes away,

because our timeout is set to infinite. */

netlink_unicast(sk, reply->skb, reply->portid, 0);

put_net(reply->net);

kfree(reply);

return 0;

}

/**

* audit_send_reply - send an audit reply message via netlink

* @request_skb: skb of request we are replying to (used to target the reply)

* @seq: sequence number

* @type: audit message type

* @done: done (last) flag

* @multi: multi-part message flag

* @payload: payload data

* @size: payload size

*

* Allocates an skb, builds the netlink message, and sends it to the port id.

* No failure notifications.

*/

static void audit_send_reply(struct sk_buff *request_skb, int seq, int type, int done,

int multi, const void *payload, int size)

{

struct net *net = sock_net(NETLINK_CB(request_skb).sk);

struct sk_buff *skb;

struct task_struct *tsk;

struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),

GFP_KERNEL);

if (!reply)

return;

skb = audit_make_reply(seq, type, done, multi, payload, size);

if (!skb)

goto out;

reply->net = get_net(net);

reply->portid = NETLINK_CB(request_skb).portid;

reply->skb = skb;

tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");

if (!IS_ERR(tsk))

return;

kfree_skb(skb);

out:

kfree(reply);

}

/*

* Check for appropriate CAP_AUDIT_ capabilities on incoming audit

* control messages.

*/

static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)