2N/A/*
2N/A * CDDL HEADER START
2N/A *
2N/A * The contents of this file are subject to the terms of the
2N/A * Common Development and Distribution License (the "License").
2N/A * You may not use this file except in compliance with the License.
2N/A *
2N/A * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
2N/A * or http://www.opensolaris.org/os/licensing.
2N/A * See the License for the specific language governing permissions
2N/A * and limitations under the License.
2N/A *
2N/A * When distributing Covered Code, include this CDDL HEADER in each
2N/A * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
2N/A * If applicable, add the following below this CDDL HEADER, with the
2N/A * fields enclosed by brackets "[]" replaced with your own identifying
2N/A * information: Portions Copyright [yyyy] [name of copyright owner]
2N/A *
2N/A * CDDL HEADER END
2N/A */
2N/A/*
2N/A * Copyright (c) 1993, 2011, Oracle and/or its affiliates. All rights reserved.
2N/A */
2N/A
2N/A#include <netdb.h>
2N/A#include <netinet/in.h>
2N/A#include <pwd.h>
2N/A#include <sys/errno.h>
2N/A#include <sys/mutex.h>
2N/A#include <sys/param.h>
2N/A#include <sys/socket.h>
2N/A#include <sys/stat.h>
2N/A#include <sys/types.h>
2N/A#include <string.h>
2N/A#include <unistd.h>
2N/A#include <alloca.h>
2N/A#include <stdlib.h>
2N/A#include <tsol/label.h>
2N/A#include <bsm/audit.h>
2N/A#include <bsm/libbsm.h>
2N/A#include <bsm/audit_uevents.h>
2N/A#include <bsm/audit_record.h>
2N/A
2N/A#define AUC_NEVER -2 /* audit module not loaded */
2N/A
2N/A/* Private Functions */
2N/Astatic int selected(au_event_t, au_mask_t *, int);
2N/A
2N/Aint aug_selected();
2N/Aint aug_na_selected();
2N/A
2N/A/* Global Variables */
2N/Astatic au_id_t aug_auid; /* auid of user writing audit record */
2N/Astatic uid_t aug_uid; /* uid of user writing audit record */
2N/Astatic uid_t aug_euid; /* euid of user writing audit record */
2N/Astatic gid_t aug_gid; /* gid of user writing audit record */
2N/Astatic gid_t aug_egid; /* euid of user writing audit record */
2N/Astatic pid_t aug_pid; /* pid of user writing audit record */
2N/Astatic au_tid_addr_t aug_tid; /* tid of user writing audit record */
2N/Astatic int aug_na; /* 0 if event is attributable */
2N/Astatic au_mask_t aug_namask; /* not attributable flags */
2N/Astatic au_event_t aug_event; /* id of event being audited */
2N/Astatic int aug_sorf; /* success or failure of aug_event */
2N/Astatic char *aug_text; /* misc text to be written to trail */
2N/Astatic char *aug_text1; /* misc text to be written to trail */
2N/Astatic char *aug_text2; /* misc text to be written to trail */
2N/Astatic au_asid_t aug_asid; /* asid of process writing record */
2N/Astatic int (*aug_afunc)(); /* write additional tokens if needed */
2N/Astatic char *aug_path; /* path token */
2N/Astatic uint32_t aug_policy; /* kernel audit policy */
2N/A
2N/A/*
2N/A * cannot_audit:
2N/A * Return 1 if audit module not loaded.
2N/A * Return 0 otherwise.
2N/A *
2N/A * The argument, force, should be set to 1 for long-lived processes
2N/A * like some daemons. Force should be set to 0 for most programs.
2N/A */
2N/Aint
2N/Acannot_audit(force)
2N/A int force;
2N/A{
2N/A static int auc = AUC_UNSET;
2N/A int cond = 0;
2N/A
2N/A if (auc == AUC_UNSET || force) {
2N/A if (auditon(A_GETCOND, (caddr_t)&cond, sizeof (cond))) {
2N/A auc = AUC_NEVER;
2N/A } else {
2N/A auc = cond;
2N/A }
2N/A }
2N/A return (auc == AUC_NEVER);
2N/A}
2N/A
2N/A/*
2N/A * aug_init():
2N/A * Initialize global variables.
2N/A */
2N/Avoid
2N/Aaug_init()
2N/A{
2N/A aug_auid = (uid_t)-1;
2N/A aug_uid = (uid_t)-1;
2N/A aug_euid = (uid_t)-1;
2N/A aug_gid = (gid_t)-1;
2N/A aug_egid = (gid_t)-1;
2N/A aug_pid = -1;
2N/A aug_tid.at_port = 0;
2N/A aug_tid.at_type = AU_IPv4;
2N/A aug_tid.at_addr[0] = 0;
2N/A aug_tid.at_addr[1] = 0;
2N/A aug_tid.at_addr[2] = 0;
2N/A aug_tid.at_addr[3] = 0;
2N/A aug_namask.am_success = AU_MASK_ALL;
2N/A aug_namask.am_failure = AU_MASK_ALL;
2N/A aug_event = 0;
2N/A aug_sorf = -2;
2N/A aug_text = NULL;
2N/A aug_text1 = NULL;
2N/A aug_text2 = NULL;
2N/A aug_na = 0;
2N/A aug_asid = (au_asid_t)(-1);
2N/A aug_afunc = NULL;
2N/A aug_path = NULL;
2N/A}
2N/A
2N/A/*
2N/A * aug_get_port:
2N/A * Return the raw device number of the port to which the
2N/A * current process is attached (assumed to be attached
2N/A * through file descriptor 0) or 0 if can't stat the port.
2N/A */
2N/Adev_t
2N/Aaug_get_port()
2N/A{
2N/A int rc;
2N/A char *ttyn;
2N/A struct stat sb;
2N/A
2N/A ttyn = ttyname(0);
2N/A if (ttyn == 0 || *ttyn == '\0') {
2N/A return (0);
2N/A }
2N/A
2N/A rc = stat(ttyn, &sb);
2N/A if (rc < 0) {
2N/A perror("stat");
2N/A return (0);
2N/A }
2N/A
2N/A return ((dev_t)sb.st_rdev);
2N/A}
2N/A
2N/A/*
2N/A * aug_get_machine:
2N/A * Return internet address of host hostname,
2N/A * or 0 if can't do lookup.
2N/A */
2N/A
2N/Aint
2N/Aaug_get_machine(const char *hostname, uint32_t *buf, uint32_t *type)
2N/A{
2N/A struct addrinfo *ai;
2N/A int err;
2N/A void *p;
2N/A
2N/A err = getaddrinfo(hostname, NULL, NULL, &ai);
2N/A if (err != 0)
2N/A return (0);
2N/A
2N/A switch (ai->ai_family) {
2N/A case AF_INET:
2N/A /* LINTED */
2N/A p = &((struct sockaddr_in *)ai->ai_addr)->sin_addr,
2N/A (void) memcpy(buf, p,
2N/A sizeof (((struct sockaddr_in *)0)->sin_addr));
2N/A *type = AU_IPv4;
2N/A break;
2N/A case AF_INET6:
2N/A /* LINTED */
2N/A p = &((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr,
2N/A (void) memcpy(buf, p,
2N/A sizeof (((struct sockaddr_in6 *)0)->sin6_addr));
2N/A *type = AU_IPv6;
2N/A break;
2N/A default:
2N/A return (0);
2N/A }
2N/A
2N/A freeaddrinfo(ai);
2N/A
2N/A return (1);
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_auid(au_id_t id)
2N/A{
2N/A aug_auid = id;
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_uid(uid_t id)
2N/A{
2N/A aug_uid = id;
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_euid(uid_t id)
2N/A{
2N/A aug_euid = id;
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_gid(gid_t id)
2N/A{
2N/A aug_gid = id;
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_egid(gid_t id)
2N/A{
2N/A aug_egid = id;
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_pid(pid_t id)
2N/A{
2N/A aug_pid = id;
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_asid(au_asid_t id)
2N/A{
2N/A aug_asid = id;
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_afunc(int (*afunc)())
2N/A{
2N/A aug_afunc = afunc;
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_tid(dev_t port, int machine)
2N/A{
2N/A aug_tid.at_port = port;
2N/A aug_tid.at_type = AU_IPv4;
2N/A aug_tid.at_addr[0] = machine;
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_tid_ex(dev_t port, uint32_t *machine, uint32_t type)
2N/A{
2N/A int i;
2N/A
2N/A aug_tid.at_port = port;
2N/A if ((type != AU_IPv4) && (type != AU_IPv6))
2N/A type = AU_IPv4;
2N/A
2N/A aug_tid.at_type = type;
2N/A for (i = 0; i < (type/4); i++)
2N/A aug_tid.at_addr[i] = machine[i];
2N/A}
2N/A
2N/Aint
2N/Aaug_save_me(void)
2N/A{
2N/A auditinfo_addr_t ai;
2N/A
2N/A if (getaudit_addr(&ai, sizeof (ai)))
2N/A return (-1);
2N/A
2N/A aug_save_auid(ai.ai_auid);
2N/A aug_save_euid(geteuid());
2N/A aug_save_egid(getegid());
2N/A aug_save_uid(getuid());
2N/A aug_save_gid(getgid());
2N/A aug_save_pid(getpid());
2N/A aug_save_asid(ai.ai_asid);
2N/A aug_save_tid_ex(ai.ai_termid.at_port,
2N/A ai.ai_termid.at_addr,
2N/A ai.ai_termid.at_type);
2N/A return (0);
2N/A}
2N/A
2N/A/*
2N/A * aug_save_namask():
2N/A * Save the namask using the naflags entry in the audit_control file.
2N/A * Return 0 if successful.
2N/A * Return -1, and don't change the namask, if failed.
2N/A * Side Effect: Sets aug_na to -1 if error, 1 if successful.
2N/A */
2N/Aint
2N/Aaug_save_namask()
2N/A{
2N/A au_mask_t mask;
2N/A
2N/A aug_na = -1;
2N/A
2N/A /*
2N/A * get non-attributable system event mask from kernel.
2N/A */
2N/A if (auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask)) != 0) {
2N/A return (-1);
2N/A }
2N/A
2N/A aug_namask.am_success = mask.am_success;
2N/A aug_namask.am_failure = mask.am_failure;
2N/A aug_na = 1;
2N/A return (0);
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_event(au_event_t id)
2N/A{
2N/A aug_event = id;
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_sorf(int sorf)
2N/A{
2N/A aug_sorf = sorf;
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_text(char *s)
2N/A{
2N/A if (aug_text != NULL)
2N/A free(aug_text);
2N/A if (s == NULL)
2N/A aug_text = NULL;
2N/A else
2N/A aug_text = strdup(s);
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_text1(char *s)
2N/A{
2N/A if (aug_text1 != NULL)
2N/A free(aug_text1);
2N/A if (s == NULL)
2N/A aug_text1 = NULL;
2N/A else
2N/A aug_text1 = strdup(s);
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_text2(char *s)
2N/A{
2N/A if (aug_text2 != NULL)
2N/A free(aug_text2);
2N/A if (s == NULL)
2N/A aug_text2 = NULL;
2N/A else
2N/A aug_text2 = strdup(s);
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_na(int flag)
2N/A{
2N/A aug_na = flag;
2N/A}
2N/A
2N/Avoid
2N/Aaug_save_path(char *s)
2N/A{
2N/A if (aug_path != NULL)
2N/A free(aug_path);
2N/A if (s == NULL)
2N/A aug_path = NULL;
2N/A aug_path = strdup(s);
2N/A}
2N/A
2N/Aint
2N/Aaug_save_policy()
2N/A{
2N/A uint32_t policy;
2N/A
2N/A if (auditon(A_GETPOLICY, (caddr_t)&policy, sizeof (policy))) {
2N/A return (-1);
2N/A }
2N/A aug_policy = policy;
2N/A return (0);
2N/A}
2N/A
2N/A/*
2N/A * aug_audit:
2N/A * Cut and audit record if it is selected.
2N/A * Return 0, if successfully written.
2N/A * Return 0, if not written, and not expected to write.
2N/A * Return -1, if not written because of unexpected error.
2N/A */
2N/Aint
2N/Aaug_audit(void)
2N/A{
2N/A int ad;
2N/A
2N/A if (cannot_audit(0)) {
2N/A return (0);
2N/A }
2N/A
2N/A if (aug_na) {
2N/A if (!aug_na_selected()) {
2N/A return (0);
2N/A }
2N/A } else if (!aug_selected()) {
2N/A return (0);
2N/A }
2N/A
2N/A if ((ad = au_open()) == -1) {
2N/A return (-1);
2N/A }
2N/A
2N/A (void) au_write(ad, au_to_subject_ex(aug_auid, aug_euid, aug_egid,
2N/A aug_uid, aug_gid, aug_pid, aug_asid, &aug_tid));
2N/A if (is_system_labeled())
2N/A (void) au_write(ad, au_to_mylabel());
2N/A if (aug_policy & AUDIT_GROUP) {
2N/A int ng;
2N/A int maxgrp = getgroups(0, NULL);
2N/A gid_t *grplst = alloca(maxgrp * sizeof (gid_t));
2N/A
2N/A if ((ng = getgroups(maxgrp, grplst)) > 0) {
2N/A (void) au_write(ad, au_to_newgroups(ng, grplst));
2N/A }
2N/A }
2N/A if (aug_text != NULL) {
2N/A (void) au_write(ad, au_to_text(aug_text));
2N/A }
2N/A if (aug_text1 != NULL) {
2N/A (void) au_write(ad, au_to_text(aug_text1));
2N/A }
2N/A if (aug_text2 != NULL) {
2N/A (void) au_write(ad, au_to_text(aug_text2));
2N/A }
2N/A if (aug_path != NULL) {
2N/A (void) au_write(ad, au_to_path(aug_path));
2N/A }
2N/A if (aug_afunc != NULL) {
2N/A (*aug_afunc)(ad);
2N/A }
2N/A#ifdef _LP64
2N/A (void) au_write(ad, au_to_return64((aug_sorf == 0) ? 0 : -1,
2N/A (int64_t)aug_sorf));
2N/A#else
2N/A (void) au_write(ad, au_to_return32((aug_sorf == 0) ? 0 : -1,
2N/A (int32_t)aug_sorf));
2N/A#endif
2N/A if (au_close(ad, AU_TO_WRITE, aug_event,
2N/A (aug_sorf == 0) ? 0 : PAD_FAILURE) < 0) {
2N/A (void) au_close(ad, AU_TO_NO_WRITE, 0, 0);
2N/A return (-1);
2N/A }
2N/A
2N/A return (0);
2N/A}
2N/A
2N/Aint
2N/Aaug_na_selected()
2N/A{
2N/A if (aug_na == -1) {
2N/A return (-1);
2N/A }
2N/A
2N/A return (selected(aug_event, &aug_namask, aug_sorf));
2N/A}
2N/A
2N/Aint
2N/Aaug_selected()
2N/A{
2N/A auditinfo_addr_t mask;
2N/A
2N/A if (aug_uid > MAXEPHUID) {
2N/A (void) aug_save_namask();
2N/A return (aug_na_selected());
2N/A }
2N/A if (getaudit_addr(&mask, sizeof (mask))) {
2N/A return (-1);
2N/A }
2N/A
2N/A return (selected(aug_event, &mask.ai_mask, aug_sorf));
2N/A}
2N/A
2N/Astatic int
2N/Aselected(au_event_t e, au_mask_t *m, int sorf)
2N/A{
2N/A int prs_sorf;
2N/A
2N/A if (sorf == 0) {
2N/A prs_sorf = AU_PRS_SUCCESS;
2N/A } else if (sorf == -1) {
2N/A prs_sorf = AU_PRS_FAILURE;
2N/A } else {
2N/A prs_sorf = AU_PRS_BOTH;
2N/A }
2N/A
2N/A return (au_preselect(e, m, prs_sorf, AU_PRS_REREAD));
2N/A}