SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

basic: Move parts of audit-util.{c,h} to libaudit-util.{c,h} in shared/

Browse Source
This commit is contained in:
Daan De Meyer
2025-05-09 11:33:33 +02:00
parent 3b7d332047
commit c992250c24
10 changed files with 137 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/basic/audit-util.c
-83
View File
@@ -1,20 +1,10 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include <errno.h>
#include <linux/audit.h>
#include <linux/netlink.h>
#include <stdio.h>
#include <sys/socket.h>
#include "alloc-util.h"
#include "audit-util.h"
#include "fd-util.h"
#include "fileio.h"
#include "iovec-util.h"
#include "macro.h"
#include "parse-util.h"
#include "process-util.h"
#include "socket-util.h"
#include "stat-util.h"
#include "user-util.h"
#include "virt.h"
@@ -94,76 +84,3 @@ int audit_loginuid_from_pid(const PidRef *pid, uid_t *ret_uid) {
return parse_uid(s, ret_uid);
}
static int try_audit_request(int fd) {
struct iovec iov;
struct msghdr mh;
ssize_t n;
assert(fd >= 0);
struct {
struct nlmsghdr hdr;
struct nlmsgerr err;
} _packed_ msg = {
.hdr.nlmsg_len = NLMSG_LENGTH(0),
.hdr.nlmsg_type = AUDIT_GET_FEATURE,
.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK,
};
iov = IOVEC_MAKE(&msg, msg.hdr.nlmsg_len);
mh = (struct msghdr) {
.msg_iov = &iov,
.msg_iovlen = 1,
};
if (sendmsg(fd, &mh, MSG_NOSIGNAL) < 0)
return -errno;
iov.iov_len = sizeof(msg);
n = recvmsg_safe(fd, &mh, 0);
if (n < 0)
return n;
if (n != NLMSG_LENGTH(sizeof(struct nlmsgerr)))
return -EIO;
if (msg.hdr.nlmsg_type != NLMSG_ERROR)
return -EINVAL;
return msg.err.error;
}
bool use_audit(void) {
static int cached_use = -1;
int r;
if (cached_use >= 0)
return cached_use;
_cleanup_close_ int fd = socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, NETLINK_AUDIT);
if (fd < 0) {
cached_use = !ERRNO_IS_PRIVILEGE(errno) && !ERRNO_IS_NOT_SUPPORTED(errno);
if (cached_use)
log_debug_errno(errno, "Unexpected error while creating audit socket, proceeding with its use: %m");
else
log_debug_errno(errno, "Won't talk to audit, because feature or privilege absent: %m");
} else {
/* If we try and use the audit fd but get -ECONNREFUSED, it is because we are not in the
* initial user namespace, and the kernel does not have support for audit outside of the
* initial user namespace (see
* https://elixir.bootlin.com/linux/latest/C/ident/audit_netlink_ok).
*
* If we receive any other error, do not disable audit because we are not sure that the error
* indicates that audit will not work in general. */
r = try_audit_request(fd);
if (r < 0) {
cached_use = r != -ECONNREFUSED;
log_debug_errno(r, cached_use ?
"Failed to make request on audit fd, ignoring: %m" :
"Won't talk to audit: %m");
} else
cached_use = true;
}
return cached_use;
}
src/basic/audit-util.h
-36
View File
@@ -1,16 +1,9 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#pragma once
#if HAVE_AUDIT
# include <libaudit.h>
#endif
#include <stdbool.h>
#include <stdint.h>
#include <sys/types.h>
#include "errno-util.h"
#include "log.h"
#include "pidref.h"
#define AUDIT_SESSION_INVALID UINT32_MAX
@@ -18,35 +11,6 @@
int audit_session_from_pid(const PidRef *pid, uint32_t *ret_id);
int audit_loginuid_from_pid(const PidRef *pid, uid_t *ret_uid);
bool use_audit(void);
static inline bool audit_session_is_valid(uint32_t id) {
return id > 0 && id != AUDIT_SESSION_INVALID;
}
/* The wrappers for audit_open() and audit_close() are inline functions so that we don't get a spurious
* linkage to libaudit in libbasic, but we also don't need to create a separate source file for two very
* short functions. */
static inline int close_audit_fd(int fd) {
#if HAVE_AUDIT
if (fd >= 0)
audit_close(fd);
#else
assert(fd < 0);
#endif
return -EBADF;
}
static inline int open_audit_fd_or_warn(void) {
int fd = -EBADF;
#if HAVE_AUDIT
/* If the kernel lacks netlink or audit support, don't worry about it. */
fd = audit_open();
if (fd < 0)
return log_full_errno(ERRNO_IS_NOT_SUPPORTED(errno) ? LOG_DEBUG : LOG_WARNING,
errno, "Failed to connect to audit log, ignoring: %m");
#endif
return fd;
}
src/core/audit-fd.c
+1 -1
View File
@@ -7,7 +7,7 @@
#if HAVE_AUDIT
# include <stdbool.h>
# include "audit-util.h"
# include "libaudit-util.h"
# include "capability-util.h"
static bool initialized = false;
src/shared/condition.c
+1 -1
View File
@@ -18,7 +18,6 @@
#include "alloc-util.h"
#include "apparmor-util.h"
#include "architecture.h"
#include "audit-util.h"
#include "battery-util.h"
#include "bitfield.h"
#include "blockdev-util.h"
@@ -44,6 +43,7 @@
#include "id128-util.h"
#include "ima-util.h"
#include "initrd-util.h"
#include "libaudit-util.h"
#include "limits-util.h"
#include "list.h"
#include "macro.h"
src/shared/libaudit-util.c
+113
View File
@@ -0,0 +1,113 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include <errno.h>
#include <linux/audit.h>
#include <linux/netlink.h>
#include <stdio.h>
#include <sys/socket.h>
#if HAVE_AUDIT
# include <libaudit.h>
#endif
#include "fd-util.h"
#include "iovec-util.h"
#include "libaudit-util.h"
#include "log.h"
#include "socket-util.h"
static int try_audit_request(int fd) {
struct iovec iov;
struct msghdr mh;
ssize_t n;
assert(fd >= 0);
struct {
struct nlmsghdr hdr;
struct nlmsgerr err;
} _packed_ msg = {
.hdr.nlmsg_len = NLMSG_LENGTH(0),
.hdr.nlmsg_type = AUDIT_GET_FEATURE,
.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK,
};
iov = IOVEC_MAKE(&msg, msg.hdr.nlmsg_len);
mh = (struct msghdr) {
.msg_iov = &iov,
.msg_iovlen = 1,
};
if (sendmsg(fd, &mh, MSG_NOSIGNAL) < 0)
return -errno;
iov.iov_len = sizeof(msg);
n = recvmsg_safe(fd, &mh, 0);
if (n < 0)
return n;
if (n != NLMSG_LENGTH(sizeof(struct nlmsgerr)))
return -EIO;
if (msg.hdr.nlmsg_type != NLMSG_ERROR)
return -EINVAL;
return msg.err.error;
}
bool use_audit(void) {
static int cached_use = -1;
int r;
if (cached_use >= 0)
return cached_use;
_cleanup_close_ int fd = socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, NETLINK_AUDIT);
if (fd < 0) {
cached_use = !ERRNO_IS_PRIVILEGE(errno) && !ERRNO_IS_NOT_SUPPORTED(errno);
if (cached_use)
log_debug_errno(errno, "Unexpected error while creating audit socket, proceeding with its use: %m");
else
log_debug_errno(errno, "Won't talk to audit, because feature or privilege absent: %m");
} else {
/* If we try and use the audit fd but get -ECONNREFUSED, it is because we are not in the
* initial user namespace, and the kernel does not have support for audit outside of the
* initial user namespace (see
* https://elixir.bootlin.com/linux/latest/C/ident/audit_netlink_ok).
*
* If we receive any other error, do not disable audit because we are not sure that the error
* indicates that audit will not work in general. */
r = try_audit_request(fd);
if (r < 0) {
cached_use = r != -ECONNREFUSED;
log_debug_errno(r, cached_use ?
"Failed to make request on audit fd, ignoring: %m" :
"Won't talk to audit: %m");
} else
cached_use = true;
}
return cached_use;
}
int close_audit_fd(int fd) {
#if HAVE_AUDIT
if (fd >= 0)
audit_close(fd);
#else
assert(fd < 0);
#endif
return -EBADF;
}
int open_audit_fd_or_warn(void) {
int fd = -EBADF;
#if HAVE_AUDIT
/* If the kernel lacks netlink or audit support, don't worry about it. */
fd = audit_open();
if (fd < 0)
return log_full_errno(ERRNO_IS_NOT_SUPPORTED(errno) ? LOG_DEBUG : LOG_WARNING,
errno, "Failed to connect to audit log, ignoring: %m");
#endif
return fd;
}
src/shared/libaudit-util.h
+9
View File
@@ -0,0 +1,9 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#pragma once
#include <stdbool.h>
bool use_audit(void);
int close_audit_fd(int fd);
int open_audit_fd_or_warn(void);
src/shared/meson.build
+2
View File
@@ -106,6 +106,7 @@ shared_sources = files(
'killall.c',
'label-util.c',
'libarchive-util.c',
'libaudit-util.c',
'libcrypt-util.c',
'libfido2-util.c',
'libmount-util.c',
@@ -332,6 +333,7 @@ libshared_name = 'systemd-shared-@0@'.format(shared_lib_tag)
libshared_deps = [threads,
libacl,
libaudit,
libblkid,
libcap,
libcrypt,
src/sysusers/sysusers.c
+5 -1
View File
@@ -2,8 +2,11 @@
#include <getopt.h>
#if HAVE_AUDIT
# include <libaudit.h>
#endif
#include "alloc-util.h"
#include "audit-util.h"
#include "build.h"
#include "chase.h"
#include "conf-files.h"
@@ -18,6 +21,7 @@
#include "fs-util.h"
#include "hashmap.h"
#include "image-policy.h"
#include "libaudit-util.h"
#include "libcrypt-util.h"
#include "main-func.h"
#include "memory-util.h"
src/test/test-condition.c
+1 -1
View File
@@ -11,7 +11,6 @@
#include "alloc-util.h"
#include "apparmor-util.h"
#include "architecture.h"
#include "audit-util.h"
#include "battery-util.h"
#include "cgroup-util.h"
#include "condition.h"
@@ -26,6 +25,7 @@
#include "hostname-util.h"
#include "id128-util.h"
#include "ima-util.h"
#include "libaudit-util.h"
#include "limits-util.h"
#include "log.h"
#include "macro.h"
src/update-utmp/update-utmp.c
+5 -1
View File
@@ -5,14 +5,18 @@
#include <sys/types.h>
#include <unistd.h>
#if HAVE_AUDIT
# include <libaudit.h>
#endif
#include "sd-bus.h"
#include "alloc-util.h"
#include "audit-util.h"
#include "bus-error.h"
#include "bus-locator.h"
#include "bus-util.h"
#include "format-util.h"
#include "libaudit-util.h"
#include "log.h"
#include "macro.h"
#include "main-func.h"