svc-auditd revision f89940742f5d14dde79b69b98a414dd7b7f585c7
842ae4bd224140319ae7feec1872b93dfd491143fielding#! /sbin/sh
842ae4bd224140319ae7feec1872b93dfd491143fielding#
842ae4bd224140319ae7feec1872b93dfd491143fielding# CDDL HEADER START
842ae4bd224140319ae7feec1872b93dfd491143fielding#
842ae4bd224140319ae7feec1872b93dfd491143fielding# The contents of this file are subject to the terms of the
842ae4bd224140319ae7feec1872b93dfd491143fielding# Common Development and Distribution License (the "License").
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim# You may not use this file except in compliance with the License.
ce9621257ef9e54c1bbe5ad8a5f445a1f211c2dcnd#
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
ce9621257ef9e54c1bbe5ad8a5f445a1f211c2dcnd# or http://www.opensolaris.org/os/licensing.
ce9621257ef9e54c1bbe5ad8a5f445a1f211c2dcnd# See the License for the specific language governing permissions
ce9621257ef9e54c1bbe5ad8a5f445a1f211c2dcnd# and limitations under the License.
ce9621257ef9e54c1bbe5ad8a5f445a1f211c2dcnd#
ce9621257ef9e54c1bbe5ad8a5f445a1f211c2dcnd# When distributing Covered Code, include this CDDL HEADER in each
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim# If applicable, add the following below this CDDL HEADER, with the
cccd31fa4a72fe23cc3249c06db181b274a55a69gstein# fields enclosed by brackets "[]" replaced with your own identifying
ab5581cc78e9d865b0a6ab1404c53347b3276968rbb# information: Portions Copyright [yyyy] [name of copyright owner]
b6055b7832a0e4d0818416252fff5925aaebae4brbb#
b82089c85a796d6e047ccf2c97e872adec1475d7trawick# CDDL HEADER END
be3223a6a18d9a3a3cf7155d5430a5d92bcddceegstein#
cccd31fa4a72fe23cc3249c06db181b274a55a69gstein
024cd9589e52cf11ce765dfddb5b5f0c6e421a48gstein#
024cd9589e52cf11ce765dfddb5b5f0c6e421a48gstein# Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
024cd9589e52cf11ce765dfddb5b5f0c6e421a48gstein#
024cd9589e52cf11ce765dfddb5b5f0c6e421a48gstein
024cd9589e52cf11ce765dfddb5b5f0c6e421a48gstein. /lib/svc/share/smf_include.sh
024cd9589e52cf11ce765dfddb5b5f0c6e421a48gstein
cccd31fa4a72fe23cc3249c06db181b274a55a69gsteinAUDIT=/usr/sbin/audit
024cd9589e52cf11ce765dfddb5b5f0c6e421a48gsteinAUDITCONFIG=/usr/sbin/auditconfig
024cd9589e52cf11ce765dfddb5b5f0c6e421a48gsteinAUDITD=/usr/sbin/auditd
cccd31fa4a72fe23cc3249c06db181b274a55a69gsteinAWK=/usr/bin/awk
cccd31fa4a72fe23cc3249c06db181b274a55a69gsteinEGREP=/usr/bin/egrep
cccd31fa4a72fe23cc3249c06db181b274a55a69gsteinMV=/usr/bin/mv
3a3d6060948b6fd3a0e127db51177a05a2d7941fjimPKILL=/usr/bin/pkill
546ab7ed4cd7df920aef1b4d6487d95d6036ebc6manojSLEEP=/usr/bin/sleep
3a3d6060948b6fd3a0e127db51177a05a2d7941fjimSVCADM=/usr/sbin/svcadm
3a3d6060948b6fd3a0e127db51177a05a2d7941fjimSVCCFG=/usr/sbin/svccfg
3a3d6060948b6fd3a0e127db51177a05a2d7941fjimSVCS=/usr/bin/svcs
a454c1041a1303a566d19e2c3d0d954635dadbddnd
3a3d6060948b6fd3a0e127db51177a05a2d7941fjimAUDIT_STARTUP=/etc/security/audit_startup
502713e686edb49a826b4dcafb34bd67d27015e8manojAUDITD_FMRI="system/auditd:default"
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim
11f2c481e1d57bedb3f758565307501e9a2730ddtrawick#
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim# main - the execution starts there.
5df8b96f15bc4f4e552cb635681e053f9eff0d3efieldingmain()
6ccc80786ac79c81965d9df753c1c19104954a95rbb{
b0f20a4a26bcfa85724b1c2e5ec6a077f12ef44crbb #
f706ad4ddbeb3b9814f52e83006e505cbb2cf662rbb # Do the basic argument inspection and take the appropriate action.
48c358ffac97bb307302a9aa2e7c799be7556db4sascha case "$SMF_METHOD" in
d41217398f0e1031adbb6f5bd37f45737c805deftrawick start)
d41217398f0e1031adbb6f5bd37f45737c805deftrawick do_common
d41217398f0e1031adbb6f5bd37f45737c805deftrawick do_start
ac40075cd80237c61be9510a940b05debc7bac5etrawick ;;
ac40075cd80237c61be9510a940b05debc7bac5etrawick refresh)
ac40075cd80237c61be9510a940b05debc7bac5etrawick do_common
cccd31fa4a72fe23cc3249c06db181b274a55a69gstein do_refresh
8a83839471ad6ee0fd34db83fab7e7740a231d70manoj ;;
48d7c43629323c8d5ee9f7bd0d194de0a376b391rbb *)
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim if [ -z "$SMF_METHOD" ]; then
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick echo "$0: No SMF method defined."
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick else
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick echo "$0: Unsupported SMF method: $SMF_METHOD."
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick fi
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick exit $SMF_EXIT_ERR_NOSMF
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick ;;
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick esac
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick}
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick#
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick# do_common - executes all the code common to all supported service methods.
1eb1f02a23de724c105b2c6c9fbd469a611059c6trawickdo_common()
1eb1f02a23de724c105b2c6c9fbd469a611059c6trawick{
1eb1f02a23de724c105b2c6c9fbd469a611059c6trawick #
1eb1f02a23de724c105b2c6c9fbd469a611059c6trawick # If the audit state is "disabled" auditconfig returns non-zero exit
1eb1f02a23de724c105b2c6c9fbd469a611059c6trawick # status unless the c2audit module is loaded; if c2audit is loaded,
1eb1f02a23de724c105b2c6c9fbd469a611059c6trawick # "disabled" becomes "noaudit" early in the boot cycle and "auditing"
1eb1f02a23de724c105b2c6c9fbd469a611059c6trawick # only after auditd starts.
1eb1f02a23de724c105b2c6c9fbd469a611059c6trawick AUDITCOND="`$AUDITCONFIG -getcond 2>/dev/null`"
5dce6b6dd8b82af80f9754ec4740ff61477a77b1gregames if [ $? -ne 0 ]; then
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick # The decision whether to start
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick # auditing is driven by bsmconv(1M) / bsmunconv(1M)
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick echo "$0: Unable to get current kernel auditing condition."
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick $SVCADM mark maintenance $AUDITD_FMRI
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick exit $SMF_EXIT_MON_OFFLINE
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawick fi
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim #
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim # In a non-global zone, auditd is started/refreshed only if the
2eb02c330b2c5344755b7e8dd42f5884b700af47brianp # "perzone" audit policy has been set.
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim if smf_is_nonglobalzone; then
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim $AUDITCONFIG -t -getpolicy | \
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim $EGREP "perzone|all" 1>/dev/null 2>&1
1eb1f02a23de724c105b2c6c9fbd469a611059c6trawick if [ $? -eq 1 ]; then
4bd465052c4a0c8d41e573ee7a90c312d980355fchrisd echo "$0: auditd(1M) is not configured to run in"
29a9516d4b69977a36f4c93119ffcbec9809b044trawick echo " a local zone, perzone policy not set" \
55d986c77300fd39420b41f765b08c15b4c6418drbb "(see auditconfig(1M))."
55d986c77300fd39420b41f765b08c15b4c6418drbb $SVCADM disable $AUDITD_FMRI
9543daa1bf345c36853642d45b2b64bf0a6b6dddtrawick $SLEEP 5 &
9543daa1bf345c36853642d45b2b64bf0a6b6dddtrawick exit $SMF_EXIT_OK
9543daa1bf345c36853642d45b2b64bf0a6b6dddtrawick fi
9543daa1bf345c36853642d45b2b64bf0a6b6dddtrawick fi
9543daa1bf345c36853642d45b2b64bf0a6b6dddtrawick #
9543daa1bf345c36853642d45b2b64bf0a6b6dddtrawick # Validate the audit service configuration
9543daa1bf345c36853642d45b2b64bf0a6b6dddtrawick val_err="`$AUDIT -v 2>&1`"
efc81fe729a2b7401028387da184b4a98f0b854atrawick if [ $? -ne 0 ]; then
efc81fe729a2b7401028387da184b4a98f0b854atrawick echo "$0: audit service misconfiguration detected (${val_err})"
efc81fe729a2b7401028387da184b4a98f0b854atrawick $SVCADM mark maintenance $AUDITD_FMRI
efc81fe729a2b7401028387da184b4a98f0b854atrawick exit $SMF_EXIT_MON_OFFLINE
efc81fe729a2b7401028387da184b4a98f0b854atrawick fi
efc81fe729a2b7401028387da184b4a98f0b854atrawick}
efc81fe729a2b7401028387da184b4a98f0b854atrawick
efc81fe729a2b7401028387da184b4a98f0b854atrawick#
efc81fe729a2b7401028387da184b4a98f0b854atrawick# do_start - service start method helper.
efc81fe729a2b7401028387da184b4a98f0b854atrawickdo_start()
efc81fe729a2b7401028387da184b4a98f0b854atrawick{
efc81fe729a2b7401028387da184b4a98f0b854atrawick #
efc81fe729a2b7401028387da184b4a98f0b854atrawick # The transition of the audit_startup(1M) has to be performed.
efc81fe729a2b7401028387da184b4a98f0b854atrawick if [ -f "$AUDIT_STARTUP" ]; then
efc81fe729a2b7401028387da184b4a98f0b854atrawick
efc81fe729a2b7401028387da184b4a98f0b854atrawick if [ -x "$AUDIT_STARTUP" ]; then
efc81fe729a2b7401028387da184b4a98f0b854atrawick $AUDIT_STARTUP
efc81fe729a2b7401028387da184b4a98f0b854atrawick else
efc81fe729a2b7401028387da184b4a98f0b854atrawick echo "$0: Unable to execute $AUDIT_STARTUP"
efc81fe729a2b7401028387da184b4a98f0b854atrawick $SVCADM mark maintenance $AUDITD_FMRI
9543daa1bf345c36853642d45b2b64bf0a6b6dddtrawick exit $SMF_EXIT_MON_OFFLINE
9543daa1bf345c36853642d45b2b64bf0a6b6dddtrawick fi
9543daa1bf345c36853642d45b2b64bf0a6b6dddtrawick
dd028aa8111afb6534fece555e8c2d408894671etrawick echo "$0: Transition of audit_startup(1M) started."
dd028aa8111afb6534fece555e8c2d408894671etrawick
d6a93816bfaa5b3de5f2e6cb0d172cbe20dd056ejerenkrantz $MV $AUDIT_STARTUP $AUDIT_STARTUP._transitioned_
d6a93816bfaa5b3de5f2e6cb0d172cbe20dd056ejerenkrantz if [ $? -ne 0 ]; then
d6a93816bfaa5b3de5f2e6cb0d172cbe20dd056ejerenkrantz # Unable to perform the backup of $AUDIT_STARTUP
d6a93816bfaa5b3de5f2e6cb0d172cbe20dd056ejerenkrantz echo "$0: The $AUDIT_STARTUP was not moved to"
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim echo " $AUDIT_STARTUP._transitioned_"
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim fi
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim #
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim # Refreshing service to make the newly created properties
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim # available for any other consequent svcprop(1).
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim $SVCCFG -s $AUDITD_FMRI refresh
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim if [ $? -ne 0 ]; then
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim echo "$0: Refresh of $AUDITD_FMRI configuration failed."
a454c1041a1303a566d19e2c3d0d954635dadbddnd $SVCADM mark maintenance $AUDITD_FMRI
a454c1041a1303a566d19e2c3d0d954635dadbddnd exit $SMF_EXIT_ERR_CONFIG
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim fi
a454c1041a1303a566d19e2c3d0d954635dadbddnd
f4434a8c7b59509850470dfc3ebe2b79c9548649gregames echo "$0: Transition of audit_startup(1M) finished."
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim fi
55d986c77300fd39420b41f765b08c15b4c6418drbb
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim #
e8f95a682820a599fe41b22977010636be5c2717jim # Daemon forks, parent exits when child says it's ready.
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim exec $AUDITD
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim}
8f9e3d3dc602155a189ed2f30ad4707af56a8368striker
8f9e3d3dc602155a189ed2f30ad4707af56a8368striker#
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim# do_refresh - service refresh method helper.
3a3d6060948b6fd3a0e127db51177a05a2d7941fjimdo_refresh()
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim{
e8f95a682820a599fe41b22977010636be5c2717jim #
e8f95a682820a599fe41b22977010636be5c2717jim # The refresh capability is available only for those systems
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim # with already transformed audit_startup(1M) into $AUDITD_FMRI
d44472957ac24ca210655dc3255257bf0534bf90rbb # service properties. See do_start() for more information.
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim if [ ! -f "$AUDIT_STARTUP" ]; then
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim #
d44472957ac24ca210655dc3255257bf0534bf90rbb # Find the contract_id.
783334f576bfb7ef44623faf7af44a65cf13b9b4jim contract_id=`$SVCS -l $AUDITD_FMRI | \
a454c1041a1303a566d19e2c3d0d954635dadbddnd $AWK '/^contract_id/ {print $2}'`
a454c1041a1303a566d19e2c3d0d954635dadbddnd if [ -z "${contract_id}" ]; then
a454c1041a1303a566d19e2c3d0d954635dadbddnd echo "$0: Service $AUDITD_FMRI has no associated" \
783334f576bfb7ef44623faf7af44a65cf13b9b4jim "contract. Service cannot be refreshed."
a454c1041a1303a566d19e2c3d0d954635dadbddnd exit $SMF_EXIT_ERR_FATAL
783334f576bfb7ef44623faf7af44a65cf13b9b4jim fi
a454c1041a1303a566d19e2c3d0d954635dadbddnd #
a18a308d7a942230edcde1bf00d7ae9b4b143c90trawick # signal to auditd(1M):
a18a308d7a942230edcde1bf00d7ae9b4b143c90trawick $PKILL -HUP -c ${contract_id}
a18a308d7a942230edcde1bf00d7ae9b4b143c90trawick if [ $? -ne 0 ]; then
a454c1041a1303a566d19e2c3d0d954635dadbddnd echo "$0: SIGHUP was not successfully delivered to" \
a454c1041a1303a566d19e2c3d0d954635dadbddnd "the related contract (${contract_id}/err:$?)."
a454c1041a1303a566d19e2c3d0d954635dadbddnd $SVCADM mark maintenance $AUDITD_FMRI
a454c1041a1303a566d19e2c3d0d954635dadbddnd exit $SMF_EXIT_ERR_FATAL
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim fi
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim $SLEEP 5 &
a454c1041a1303a566d19e2c3d0d954635dadbddnd else
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim echo "$0: Service refresh method not supported on systems" \
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim "without converted audit_startup(1M) into auditd service" \
0f101a4a0aecdcb213cdad2d80664d342f8e9222dougm "SMF configuration. Clear the service (svcadm(1M))."
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim $SVCADM mark maintenance $AUDITD_FMRI
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim exit $SMF_EXIT_ERR_CONFIG
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim fi
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim}
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim#
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim# Call main() to start the own script execution.
3a3d6060948b6fd3a0e127db51177a05a2d7941fjimmain
3a3d6060948b6fd3a0e127db51177a05a2d7941fjim