2.2.5 内核审计系统的接口函数

//声明等待队列头，用于等待审计消息被后台进程写入log文件
static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
int type)
{
struct audit_buffer*ab= NULL;
struct timespect;
unsigned intserial;
int reserve;
unsigned long timeout_start = jiffies;   //开始的时间

if (!audit_initialized)//如果已初始化，就直接退出
return NULL;

if (unlikely(audit_filter_type(type)))
return NULL;

if (gfp_mask & __GFP_WAIT)
reserve = 0;
else
reserve = 5; /*允许调用者多出5个条目*/

 //当链表中审计缓冲区数超出上限时，进程等待auditd处理链表中缓冲区
while (audit_backlog_limit
&& skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time
     && time_before(jiffies, timeout_start + audit_backlog_wait_time)) {

/* 等待后台进程auditd从队列中处理部分缓冲区 */
DECLARE_WAITQUEUE(wait, current);
set_current_state(TASK_INTERRUPTIBLE);

                         //设置当前进程的状态为可中断等待状态
add_wait_queue(&audit_backlog_wait, &wait);

                //将当前进程加入等待队列

if (audit_backlog_limit &&
    skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
schedule_timeout(timeout_start + 

                         audit_backlog_wait_time - jiffies);//调度

__set_current_state(TASK_RUNNING);　//设置当前进程为运行状态
remove_wait_queue(&audit_backlog_wait, &wait);
continue;
}
　 //检查每秒发送的记录数不能超过上限，以防止受非法攻击
if (audit_rate_check())
printk(KERN_WARNING
       "audit: audit_backlog=%d > "
       "audit_backlog_limit=%d\n",
       skb_queue_len(&audit_skb_queue),
       audit_backlog_limit);
　
audit_log_lost("backlog limit exceeded");
audit_backlog_wait_time = audit_backlog_wait_overflow;
wake_up(&audit_backlog_wait);
return NULL;
}

ab = audit_buffer_alloc(ctx, gfp_mask, type);　//申请审计缓冲区
if (!ab) {
audit_log_lost("out of memory in audit_log_start");
return NULL;
}
//得到当前时间存入t，计算审计记录的序列号，存入serial
audit_get_stamp(ab->ctx, &t, &serial);
     //将时间戳和序列号写入审计记录
audit_log_format(ab, "audit(%lu.%03lu:%u): ",
 t.tv_sec, t.tv_nsec/1000000, serial);
return ab;
}

static DEFINE_SPINLOCK(audit_freelist_lock);//定义自旋锁，用于锁住链表audit_freelist
static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
gfp_t gfp_mask, int type)
{
unsigned long flags;
struct audit_buffer *ab = NULL;
struct nlmsghdr *nlh;

  //从空闲链表中得到一个缓冲区
spin_lock_irqsave(&audit_freelist_lock, flags);　//加锁
if (!list_empty(&audit_freelist)) {
ab = list_entry(audit_freelist.next,
struct audit_buffer, list);
list_del(&ab->list);
--audit_freelist_count;
}
spin_unlock_irqrestore(&audit_freelist_lock, flags);　//释放锁

  //如果空闲链表中没有空闲缓冲区成员，就分配一个缓冲区
if (!ab) {
ab = kmalloc(sizeof(*ab), gfp_mask);
if (!ab)
goto err;
}

ab->skb = alloc_skb(AUDIT_BUFSIZ, gfp_mask);//分配套接字缓冲区
if (!ab->skb)
goto err;

ab->ctx = ctx;
ab->gfp_mask = gfp_mask;
  //扩展套接字缓冲区skb的已使用数据区，将netlink消息头数据nlmsghdr加到skb
nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0));　
nlh->nlmsg_type = type;
nlh->nlmsg_flags = 0;
nlh->nlmsg_pid = 0;
nlh->nlmsg_seq = 0;
return ab;
err:
audit_buffer_free(ab);
return NULL;
}

void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
{
va_list args;

if (!ab)
return;
va_start(args, fmt);
audit_log_vformat(ab, fmt, args);
va_end(args);
}

static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,　

 va_list args)
{
int len, avail;
struct sk_buff *skb;
va_list args2;

if (!ab)
return;

BUG_ON(!ab->skb);
skb = ab->skb;
avail = skb_tailroom(skb);//计算套接字缓冲区的空闲数据空间
if (avail == 0) {　//如果套接字缓冲区没有空闲数据空间，扩展空间
avail = audit_expand(ab, AUDIT_BUFSIZ);　// AUDIT_BUFSIZ为1024，
if (!avail)
goto out;
}
va_copy(args2, args);
len = vsnprintf(skb->tail, avail, fmt, args);　//将信息写入到缓冲区
if (len >= avail) {　//如果实际信息长度比可用的缓冲区大，扩展空间
/* 由于printk缓冲区是1024，因此，扩展空间最少为1024 */
avail = audit_expand(ab,
max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
if (!avail)
goto out;
len = vsnprintf(skb->tail, avail, fmt, args2);　
                 //将审计信息写入到缓冲区
}
if (len > 0)
skb_put(skb, len); //将写入信息的数据缓冲区附加到skb上
out:
return;
}

static inline int audit_expand(struct audit_buffer *ab, int extra)
{
struct sk_buff *skb = ab->skb;
int ret = pskb_expand_head(skb, skb_headroom(skb), extra,
   ab->gfp_mask);
if (ret < 0) {
audit_log_lost("out of memory in audit_expand");
return 0;
}
return skb_tailroom(skb);//返回可用的缓冲区空间大小
}

void audit_log_end(struct audit_buffer *ab)
{
if (!ab)
return;
if (!audit_rate_check()) {　//检查审计系统的传输速度，

如果netlink机制传输速度超过上限，则返回错误
audit_log_lost("rate limit exceeded");
} else {
if (audit_pid) {　//如果审计后台的进程ID存在，使用netlink机制传输数据
struct nlmsghdr *nlh = (struct nlmsghdr *)ab->skb->data;
nlh->nlmsg_len = ab->skb->len - NLMSG_SPACE(0);
skb_queue_tail(&audit_skb_queue, ab->skb);
ab->skb = NULL;
wake_up_interruptible(&kauditd_wait);　//发送了数据，唤醒等待队列
} else {　//使用printk记录数据
printk(KERN_NOTICE "%s\n", ab->skb->data + NLMSG_SPACE(0));
}
}
audit_buffer_free(ab);
}