audit_record.h revision a7746f662862b6ac0a85751d8adbc897743a83e1
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2007 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#ifndef _BSM_AUDIT_RECORD_H
#define _BSM_AUDIT_RECORD_H
#pragma ident "%Z%%M% %I% %E% SMI"
#ifdef _KERNEL
#else
#include <priv.h>
#endif
#ifdef __cplusplus
extern "C" {
#endif
/*
* Version of audit attributes
*
* OS Release Version Number Comments
* ========== ============== ========
* SunOS 5.1 2 Unbundled Package
* SunOS 5.3 2 Bundled into the base OS
* SunOS 5.4-5.x 2
* Trusted Solaris 2.5 3 To distinguish potential new tokens
* Trusted Solaris 7-8 4 Redefine X tokens that overlap with
* SunOS 5.7
*/
#define TOKEN_VERSION 2
/*
* Audit record token type codes
*/
/*
* Control token types
*/
#define AUT_INVALID ((char)0x00)
#define AUT_OTHER_FILE ((char)0x11)
#define AUT_OTHER_FILE32 AUT_OTHER_FILE
#define AUT_OHEADER ((char)0x12)
#define AUT_TRAILER ((char)0x13)
#define AUT_HEADER ((char)0x14)
#define AUT_HEADER32 AUT_HEADER
#define AUT_HEADER32_EX ((char)0x15)
#define AUT_TRAILER_MAGIC ((short)0xB105)
/*
* Data token types
*/
#define AUT_FMRI ((char)0x20)
#define AUT_DATA ((char)0x21)
#define AUT_IPC ((char)0x22)
#define AUT_PATH ((char)0x23)
#define AUT_SUBJECT ((char)0x24)
#define AUT_SUBJECT32 AUT_SUBJECT
#define AUT_XATPATH ((char)0x25)
#define AUT_PROCESS ((char)0x26)
#define AUT_PROCESS32 AUT_PROCESS
#define AUT_RETURN ((char)0x27)
#define AUT_RETURN32 AUT_RETURN
#define AUT_TEXT ((char)0x28)
#define AUT_OPAQUE ((char)0x29)
#define AUT_IN_ADDR ((char)0x2A)
#define AUT_IP ((char)0x2B)
#define AUT_IPORT ((char)0x2C)
#define AUT_ARG ((char)0x2D)
#define AUT_SOCKET ((char)0x2E)
#define AUT_SEQ ((char)0x2F)
#define AUT_TID ((char)0x61)
/*
* Modifier token types
*/
#define AUT_ACL ((char)0x30)
#define AUT_ATTR ((char)0x31)
#define AUT_IPC_PERM ((char)0x32)
#define AUT_LABEL ((char)0x33)
#define AUT_GROUPS ((char)0x34)
#define AUT_ACE ((char)0x35)
/*
* 0x36, 0x37 unused
*/
#define AUT_PRIV ((char)0x38)
#define AUT_UPRIV ((char)0x39)
#define AUT_LIAISON ((char)0x3A)
#define AUT_NEWGROUPS ((char)0x3B)
#define AUT_EXEC_ARGS ((char)0x3C)
#define AUT_EXEC_ENV ((char)0x3D)
#define AUT_ATTR32 ((char)0x3E)
#define AUT_UAUTH ((char)0x3F)
#define AUT_ZONENAME ((char)0x60)
/*
* X windows token types
*/
#define AUT_XATOM ((char)0x40)
#define AUT_XOBJ ((char)0x41)
#define AUT_XPROTO ((char)0x42)
#define AUT_XSELECT ((char)0x43)
#if TOKEN_VERSION != 3
#define AUT_XCOLORMAP ((char)0x44)
#define AUT_XCURSOR ((char)0x45)
#define AUT_XFONT ((char)0x46)
#define AUT_XGC ((char)0x47)
#define AUT_XPIXMAP ((char)0x48)
#define AUT_XPROPERTY ((char)0x49)
#define AUT_XWINDOW ((char)0x4A)
#define AUT_XCLIENT ((char)0x4B)
#else /* TOKEN_VERSION == 3 */
#define AUT_XCOLORMAP ((char)0x74)
#define AUT_XCURSOR ((char)0x75)
#define AUT_XFONT ((char)0x76)
#define AUT_XGC ((char)0x77)
#define AUT_XPIXMAP ((char)0x78)
#define AUT_XPROPERTY ((char)0x79)
#define AUT_XWINDOW ((char)0x7A)
#define AUT_XCLIENT ((char)0x7B)
#endif /* TOKEN_VERSION != 3 */
/*
* Command token types
*/
#define AUT_CMD ((char)0x51)
#define AUT_EXIT ((char)0x52)
/*
* Miscellaneous token types
*/
#define AUT_HOST ((char)0x70)
/*
* Solaris64 token types
*/
#define AUT_ARG64 ((char)0x71)
#define AUT_RETURN64 ((char)0x72)
#define AUT_ATTR64 ((char)0x73)
#define AUT_HEADER64 ((char)0x74)
#define AUT_SUBJECT64 ((char)0x75)
#define AUT_PROCESS64 ((char)0x77)
#define AUT_OTHER_FILE64 ((char)0x78)
/*
* Extended network address token types
*/
#define AUT_HEADER64_EX ((char)0x79)
#define AUT_SUBJECT32_EX ((char)0x7a)
#define AUT_PROCESS32_EX ((char)0x7b)
#define AUT_SUBJECT64_EX ((char)0x7c)
#define AUT_PROCESS64_EX ((char)0x7d)
#define AUT_IN_ADDR_EX ((char)0x7e)
#define AUT_SOCKET_EX ((char)0x7f)
/*
* Audit print suggestion types.
*/
#define AUP_BINARY ((char)0)
#define AUP_OCTAL ((char)1)
#define AUP_DECIMAL ((char)2)
#define AUP_HEX ((char)3)
#define AUP_STRING ((char)4)
/*
* Audit data member types.
*/
#define AUR_BYTE ((char)0)
#define AUR_CHAR ((char)0)
#define AUR_SHORT ((char)1)
#define AUR_INT ((char)2)
#define AUR_INT32 ((char)2)
#define AUR_INT64 ((char)3)
/*
* Adr structures
*/
struct adr_s {
char *adr_stream; /* The base of the stream */
char *adr_now; /* The location within the stream */
};
#ifdef _KERNEL
#include <sys/ipc_impl.h>
#include <netinet/in_systm.h>
/*
* au_close flag arguments
*/
/*
* Audit token type is really an au_membuf pointer
*/
/*
* token generation functions
*/
void au_free_rec(au_buff_t *);
token_t *au_to_data(char, char, char, char *);
token_t *au_to_text(const char *);
/* token_t *au_to_tid(au_generic_tid_t *); no kernel implementation */
token_t *au_to_trailer(int);
token_t *au_to_uauth(char *);
token_t *au_to_socket_ex(short, short, char *, char *);
void au_uwrite();
timestruc_t *);
void au_free_rec(au_buff_t *);
void au_mem_init(void);
void au_zone_setup();
int au_doorio(au_kcontext_t *);
int au_token_size(token_t *);
int au_append_buf(const char *, int, au_buff_t *);
#else /* !_KERNEL */
#include <limits.h>
#include <netinet/in_systm.h>
struct token_s {
short tt_size; /* Size of data */
char *tt_data; /* The data */
};
struct au_arg32_tok {
char *data;
};
typedef struct au_arg32_tok au_arg32_tok_t;
struct au_acl_tok {
};
typedef struct au_acl_tok au_acl_tok_t;
struct au_arg64_tok {
char *data;
};
typedef struct au_arg64_tok au_arg64_tok_t;
struct au_attr_tok {
int fs;
};
typedef struct au_attr_tok au_attr_tok_t;
struct au_attr32_tok {
int fs;
};
typedef struct au_attr32_tok au_attr32_tok_t;
struct au_attr64_tok {
int fs;
};
typedef struct au_attr64_tok au_attr64_tok_t;
struct au_data_tok {
char *data;
};
typedef struct au_data_tok au_data_tok_t;
struct au_exit_tok {
int status;
int retval;
};
typedef struct au_exit_tok au_exit_tok_t;
struct au_file32_tok {
/* really struct timeval from gettimeofday() */
char *fname;
};
typedef struct au_file32_tok au_file32_tok_t;
struct au_file64_tok {
/* really struct timeval */
char *fname;
};
typedef struct au_file64_tok au_file64_tok_t;
struct au_groups_tok {
};
typedef struct au_groups_tok au_groups_tok_t;
struct au_header32_tok {
/* really timestruct_t (struct timespec) from hrestime */
};
typedef struct au_header32_tok au_header32_tok_t;
struct au_header64_tok {
/* really timestruct_t (struct timespec) from hrestime */
};
typedef struct au_header64_tok au_header64_tok_t;
struct au_inaddr_tok {
};
typedef struct au_inaddr_tok au_inaddr_tok_t;
struct au_ip_tok {
};
typedef struct au_ip_tok au_ip_tok_t;
struct au_ipc_tok {
};
typedef struct au_ipc_tok au_ipc_tok_t;
struct au_ipc_perm_tok {
};
typedef struct au_ipc_perm_tok au_ipc_perm_tok_t;
struct au_iport_tok {
};
typedef struct au_iport_tok au_iport_tok_t;
struct au_invalid_tok {
char *data;
};
typedef struct au_invalid_tok au_invalid_tok_t;
struct au_opaque_tok {
char *data;
};
typedef struct au_opaque_tok au_opaque_tok_t;
struct au_path_tok {
char *name;
};
typedef struct au_path_tok au_path_tok_t;
struct au_tid32 {
};
typedef struct au_tid32 au_tid32_t;
struct au_tid64 {
};
typedef struct au_tid64 au_tid64_t;
struct au_proc32_tok {
};
typedef struct au_proc32_tok au_proc32_tok_t;
struct au_proc64_tok {
};
typedef struct au_proc64_tok au_proc64_tok_t;
struct au_ret32_tok {
};
typedef struct au_ret32_tok au_ret32_tok_t;
struct au_ret64_tok {
};
typedef struct au_ret64_tok au_ret64_tok_t;
struct au_seq_tok {
};
typedef struct au_seq_tok au_seq_tok_t;
struct au_socket_tok {
short type;
};
typedef struct au_socket_tok au_socket_tok_t;
struct au_subj32_tok {
};
typedef struct au_subj32_tok au_subj32_tok_t;
struct au_subj64_tok {
};
typedef struct au_subj64_tok au_subj64_tok_t;
struct au_server_tok {
};
typedef struct au_server_tok au_server_tok_t;
struct au_text_tok {
char *data;
};
typedef struct au_text_tok au_text_tok_t;
struct au_trailer_tok {
};
typedef struct au_trailer_tok au_trailer_tok_t;
struct au_uauth_tok {
char *data;
};
typedef struct au_uauth_tok au_uauth_tok_t;
struct au_token {
char id;
char *data;
union {
} un;
};
typedef struct au_token au_token_t;
/*
* Old socket structure definition, formerly in <sys/socketvar.h>
*/
struct oldsocket {
short so_options; /* from socket call, see socket.h */
short so_linger; /* time to linger while closing */
short so_state; /* internal state flags SS_*, below */
/*
* Variables for connection queueing.
* Socket where accepts occur is so_head in all subsidiary sockets.
* If so_head is 0, socket is not related to an accept.
* For head socket so_q0 queues partially completed connections,
* while so_q is a queue of connections ready to be accepted.
* If a connection is aborted and it has so_head set, then
* it has to be pulled out of either so_q0 or so_q.
* We allow connections to queue up based on current queue lengths
* and limit on number of queued connections for this socket.
*/
short so_q0len; /* partials on so_q0 */
short so_qlen; /* number of connections on so_q */
short so_qlimit; /* max number queued connections */
short so_timeo; /* connection timeout */
short so_pgrp; /* pgrp for signals */
/*
* Variables for socket buffering.
*/
struct sockbuf {
short sb_timeo; /* timeout (not used yet) */
short sb_flags; /* flags, see below */
/*
* Hooks for alternative wakeup strategies.
* These are used by kernel subsystems wishing to access the socket
* abstraction. If so_wupfunc is nonnull, it is called in place of
* wakeup any time that wakeup would otherwise be called with an
* argument whose value is an address lying within a socket structure.
*/
};
extern token_t *au_to_data(char, char, char, char *);
extern token_t *au_to_exec_args(char **);
extern token_t *au_to_exec_env(char **);
extern token_t *au_to_exit(int, int);
extern token_t *au_to_fmri(char *);
extern token_t *au_to_groups(int *);
extern token_t *au_to_mylabel(void);
extern token_t *au_to_opaque(char *, short);
extern token_t *au_to_path(char *);
extern token_t *au_to_text(char *);
extern token_t *au_to_trailer(void);
extern token_t *au_to_uauth(char *);
extern token_t *au_to_upriv(char, char *);
extern token_t *au_to_xatom(char *);
extern token_t *au_to_xselect(char *, char *, char *);
extern token_t *au_to_zonename(char *);
#endif /* _KERNEL */
#ifdef _KERNEL
char *adr_getchar(adr_t *, char *);
char *adr_getshort(adr_t *, short *);
#endif /* _KERNEL */
#ifdef __cplusplus
}
#endif
#endif /* _BSM_AUDIT_RECORD_H */