[linux-2.6-block.git] / kernel / audit.h

/* audit -- definition of audit_context structure and supporting types 
 *
 * Copyright 2003-2004 Red Hat, Inc.
 * Copyright 2005 Hewlett-Packard Development Company, L.P.
 * Copyright 2005 IBM Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */

#include <linux/mutex.h>
#include <linux/fs.h>
#include <linux/audit.h>

/* 0 = no checking
   1 = put_count checking
   2 = verbose put_count checking
*/
#define AUDIT_DEBUG 0

/* At task start time, the audit_state is set in the audit_context using
   a per-task filter.  At syscall entry, the audit_state is augmented by
   the syscall filter. */
enum audit_state {
	AUDIT_DISABLED,		/* Do not create per-task audit_context.
				 * No syscall-specific audit records can
				 * be generated. */
	AUDIT_SETUP_CONTEXT,	/* Create the per-task audit_context,
				 * but don't necessarily fill it in at
				 * syscall entry time (i.e., filter
				 * instead). */
	AUDIT_BUILD_CONTEXT,	/* Create the per-task audit_context,
				 * and always fill it in at syscall
				 * entry time.  This makes a full
				 * syscall record available if some
				 * other part of the kernel decides it
				 * should be recorded. */
	AUDIT_RECORD_CONTEXT	/* Create the per-task audit_context,
				 * always fill it in at syscall entry
				 * time, and always write out the audit
				 * record at syscall exit time.  */
};

/* Rule lists */
struct audit_field {
	u32			type;
	u32			val;
	u32			op;
};

struct audit_krule {
	int			vers_ops;
	u32			flags;
	u32			listnr;
	u32			action;
	u32			mask[AUDIT_BITMASK_SIZE];
	u32			buflen; /* for data alloc on list rules */
	u32			field_count;
	struct audit_field	*fields;
};

struct audit_entry {
	struct list_head	list;
	struct rcu_head		rcu;
	struct audit_krule	rule;
};


extern int audit_pid;
extern int audit_comparator(const u32 left, const u32 op, const u32 right);

extern void		    audit_send_reply(int pid, int seq, int type,
					     int done, int multi,
					     void *payload, int size);
extern void		    audit_log_lost(const char *message);
extern void		    audit_panic(const char *message);
extern struct mutex audit_netlink_mutex;
Commit	Line	Data
fe7752ba DW	1	/* audit -- definition of audit_context structure and supporting types
	2	*
	3	* Copyright 2003-2004 Red Hat, Inc.
	4	* Copyright 2005 Hewlett-Packard Development Company, L.P.
	5	* Copyright 2005 IBM Corporation
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License as published by
	9	* the Free Software Foundation; either version 2 of the License, or
	10	* (at your option) any later version.
	11	*
	12	* This program is distributed in the hope that it will be useful,
	13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	15	* GNU General Public License for more details.
	16	*
	17	* You should have received a copy of the GNU General Public License
	18	* along with this program; if not, write to the Free Software
	19	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	20	*/
	21
5a0bbce5	22	#include <linux/mutex.h>
fe7752ba DW	23	#include <linux/fs.h>
	24	#include <linux/audit.h>
	25
	26	/* 0 = no checking
	27	1 = put_count checking
	28	2 = verbose put_count checking
	29	*/
	30	#define AUDIT_DEBUG 0
	31
	32	/* At task start time, the audit_state is set in the audit_context using
	33	a per-task filter. At syscall entry, the audit_state is augmented by
	34	the syscall filter. */
	35	enum audit_state {
	36	AUDIT_DISABLED, /* Do not create per-task audit_context.
	37	* No syscall-specific audit records can
	38	* be generated. */
	39	AUDIT_SETUP_CONTEXT, /* Create the per-task audit_context,
	40	* but don't necessarily fill it in at
	41	* syscall entry time (i.e., filter
	42	* instead). */
	43	AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context,
	44	* and always fill it in at syscall
	45	* entry time. This makes a full
	46	* syscall record available if some
	47	* other part of the kernel decides it
	48	* should be recorded. */
	49	AUDIT_RECORD_CONTEXT /* Create the per-task audit_context,
	50	* always fill it in at syscall entry
	51	* time, and always write out the audit
	52	* record at syscall exit time. */
	53	};
	54
	55	/* Rule lists */
93315ed6 AG	56	struct audit_field {
	57	u32 type;
	58	u32 val;
	59	u32 op;
	60	};
	61
	62	struct audit_krule {
	63	int vers_ops;
	64	u32 flags;
	65	u32 listnr;
	66	u32 action;
	67	u32 mask[AUDIT_BITMASK_SIZE];
	68	u32 buflen; /* for data alloc on list rules */
	69	u32 field_count;
	70	struct audit_field *fields;
	71	};
	72
fe7752ba	73	struct audit_entry {
93315ed6 AG	74	struct list_head list;
	75	struct rcu_head rcu;
	76	struct audit_krule rule;
fe7752ba DW	77	};
	78
	79
	80	extern int audit_pid;
	81	extern int audit_comparator(const u32 left, const u32 op, const u32 right);
	82
	83	extern void audit_send_reply(int pid, int seq, int type,
	84	int done, int multi,
	85	void *payload, int size);
	86	extern void audit_log_lost(const char *message);
	87	extern void audit_panic(const char *message);
5a0bbce5	88	extern struct mutex audit_netlink_mutex;