audit_inetd.c revision 7c478bd95313f5f23a4c958a745db2134aa03244
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License, Version 1.0 only
* (the "License"). You may not use this file except in compliance
* with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2003 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#pragma ident "%Z%%M% %I% %E% SMI"
#include <sys/types.h>
#include <stdio.h>
#include <bsm/audit.h>
#include <bsm/audit_uevents.h>
#include <bsm/libbsm.h>
#include <bsm/audit_private.h>
#include <netinet/in.h>
#include <generic.h>
#include <pwd.h>
#include <strings.h>
#include <stdlib.h>
#include <unistd.h>
#ifdef C2_DEBUG
#define dprintf(x) {printf x; }
#else
#define dprintf(x)
#endif
static void audit_inetd_session_setup(struct passwd *);
static au_tid_addr_t audit_inetd_tid;
static int auditingisoff;
static au_class_t eventclass;
static int preselected;
static au_mask_t kmask;
int
audit_inetd_config(void)
{
struct au_event_ent *ee;
/*
* If auditing is turned off, then don't do anything.
* Especially don't return an error
*/
if (auditingisoff = cannot_audit(0)) {
return (0);
}
aug_save_event(AUE_inetd_connect);
if (cacheauevent(&ee, AUE_inetd_connect) != 1)
return (1);
eventclass = ee->ae_class;
return (0);
}
/*
* save terminal ID for user level audit record generation
*/
int
audit_inetd_termid(int fd)
{
struct sockaddr_in6 peer;
struct sockaddr_in6 sock;
int peerlen = sizeof (peer);
int socklen = sizeof (sock);
uint_t port;
uint32_t *addr;
auditinfo_addr_t ai;
if (auditingisoff) {
return (0);
}
(void) aug_save_namask();
/* quick preslection */
if (auditon(A_GETKMASK, (caddr_t)&kmask, sizeof (kmask)) < 0) {
/* should generate syslog message here or in inetd.c */
preselected = 0;
return (1);
}
/* now see if we're preselected. Ignore success/failure for now */
if ((kmask.am_success|kmask.am_failure) & eventclass) {
preselected = 1;
} else {
preselected = 0;
return (0);
}
/* get peer name (use local termid if not a socket) */
if (getpeername(fd, (struct sockaddr *)&peer, (socklen_t *)&peerlen)
< 0) {
/* use machine terminal address if unknown ports */
if (auditon(A_GETKAUDIT, (caddr_t)&ai, sizeof (ai)) < 0) {
return (1);
}
/* termid unset, make it legal (0.0.0.0) */
if (ai.ai_termid.at_type == 0)
ai.ai_termid.at_type = AU_IPv4;
audit_inetd_tid = ai.ai_termid;
aug_save_tid_ex(ai.ai_termid.at_port,
(uint32_t *)&ai.ai_termid.at_addr,
(uint32_t)ai.ai_termid.at_type);
return (0);
}
addr = (uint32_t *)&peer.sin6_addr;
/* get sock name (use local termid if not a socket) */
if (getsockname(fd, (struct sockaddr *)&sock, (socklen_t *)&socklen)
< 0) {
/* have everything but local port. make it 0 for now */
bzero(&sock, sizeof (sock));
}
bzero(&audit_inetd_tid, sizeof (audit_inetd_tid));
port = ((peer.sin6_port<<16) | (sock.sin6_port));
audit_inetd_tid.at_port = port;
if (peer.sin6_family == AF_INET6) {
aug_save_tid_ex(port, (uint32_t *)&peer.sin6_addr, AU_IPv6);
audit_inetd_tid.at_type = AU_IPv6;
audit_inetd_tid.at_addr[0] = addr[0];
audit_inetd_tid.at_addr[1] = addr[1];
audit_inetd_tid.at_addr[2] = addr[2];
audit_inetd_tid.at_addr[3] = addr[3];
} else {
struct sockaddr_in *ppeer = (struct sockaddr_in *)&peer;
aug_save_tid(port, (int)ppeer->sin_addr.s_addr);
audit_inetd_tid.at_type = AU_IPv4;
audit_inetd_tid.at_addr[0] = (uint32_t)ppeer->sin_addr.s_addr;
}
return (0);
}
int
audit_inetd_service(
char *service_name, /* name of service */
struct passwd *pwd) /* password */
{
int set_audit = 0; /* flag - set audit characteristics */
auditinfo_addr_t ai;
dprintf(("audit_inetd_service()\n"));
if (auditingisoff)
return (0);
if (preselected == 0)
return (0);
/*
* set default values. We will overwrite them when appropriate.
*/
if (getaudit_addr(&ai, sizeof (ai))) {
perror("inetd");
exit(1);
}
aug_save_auid(ai.ai_auid); /* Audit ID */
aug_save_uid(getuid()); /* User ID */
aug_save_euid(geteuid()); /* Effective User ID */
aug_save_gid(getgid()); /* Group ID */
aug_save_egid(getegid()); /* Effective Group ID */
aug_save_pid(getpid()); /* process ID */
aug_save_asid(getpid()); /* session ID */
/*
* do the best we can. We have no way to determine if the
* request is from a system service or from the root user.
* We will consider all root requests to be system service
* operations for now. We'll readdress this when we devise a
* better algorithm.
*/
if (pwd != NULL && (pwd->pw_uid)) {
aug_save_auid(pwd->pw_uid); /* Audit ID */
aug_save_uid(pwd->pw_uid); /* User ID */
aug_save_euid(pwd->pw_uid); /* Effective User ID */
aug_save_gid(pwd->pw_gid); /* Group ID */
aug_save_egid(pwd->pw_gid); /* Effective Group ID */
set_audit = 1;
}
aug_save_text(service_name);
aug_save_sorf(0);
(void) aug_audit();
/*
* Note that we will only do this if non-attributable auditing set.
* we might want to change things so this is always called.
*/
if (set_audit)
audit_inetd_session_setup(pwd);
return (0);
}
/*
* set the audit characteristics for the inetd started process.
* inetd is setting the uid.
*/
void
audit_inetd_session_setup(struct passwd *pwd)
{
struct auditinfo_addr info;
au_mask_t mask;
info.ai_auid = pwd->pw_uid;
mask.am_success = 0;
mask.am_failure = 0;
(void) au_user_mask(pwd->pw_name, &mask);
info.ai_mask.am_success = mask.am_success;
info.ai_mask.am_failure = mask.am_failure;
info.ai_asid = getpid();
info.ai_termid = audit_inetd_tid;
if (setaudit_addr(&info, sizeof (info)) < 0) {
perror("inetd: setaudit_addr");
exit(1);
}
}