/* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END */ /* * Copyright 2010 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ /* * Token processing for sysupd; each token function does one * or more operations. All of them bump the buffer pointer * to the next token; some of them extract one or more data * from the token. */ #define DEBUG 0 #if DEBUG #define DPRINT(x) { (void) fprintf x; } #else #define DPRINT(x) #endif #include <locale.h> #include <stdlib.h> #include <stdio.h> #include <string.h> #include <sys/types.h> #include <bsm/libbsm.h> #include <sys/tsol/label.h> #include "toktable.h" /* ../praudit */ #include "sysplugin.h" #include "systoken.h" #include <audit_plugin.h> #if DEBUG static FILE *dbfp; /* debug file */ #endif static void anchor_path(char *); static size_t collapse_path(char *, size_t); static void get_bytes_to_string(parse_context_t *, size_t *, char **, size_t); static void skip_bytes(parse_context_t *); static void skip_string(parse_context_t *); static int xgeneric(parse_context_t *); /* * Process a token in a record to (1) extract data of interest if any * and (2) point to the next token. * * returns 0 if ok. + or - values are of debug value: * * returns -1 if the parsing of the token failed. * * returns +<previous id> if the token is not found. This value * is used to help determine where in the record the problem * occurred. The common failure case is that the parsing of * token M is incorrect and the buffer pointer ends up pointing * to garbage. The positive error value of M *may* be the id of * the incorrectly parsed token. */ int parse_token(parse_context_t *ctx) { char tokenid; static char prev_tokenid = -1; int rc; #if DEBUG static boolean_t first = 1; if (first) { dbfp = __auditd_debug_file_open(); first = 0; } #endif adrm_char(&(ctx->adr), &tokenid, 1); if ((tokenid > 0) && (tokentable[tokenid].func != NOFUNC)) { rc = (*tokentable[tokenid].func)(ctx); prev_tokenid = tokenid; return (rc); } /* here if token id is not in table */ return (prev_tokenid); } /* There should not be any file tokens in the middle of a record */ /* ARGSUSED */ int file_token(parse_context_t *ctx) { return (-1); } /* ARGSUSED */ int file64_token(parse_context_t *ctx) { return (-1); } static void common_header(parse_context_t *ctx) { adrm_u_int32(&(ctx->adr), &(ctx->out.sf_reclen), 1); ctx->adr.adr_now += sizeof (char); /* version number */ adrm_u_short(&(ctx->adr), &(ctx->out.sf_eventid), 1); ctx->adr.adr_now += sizeof (short); /* modifier */ } /* * 32bit header */ int header_token(parse_context_t *ctx) { common_header(ctx); ctx->adr.adr_now += 2 * sizeof (int32_t); /* time */ return (0); } int header32_ex_token(parse_context_t *ctx) { int32_t type; common_header(ctx); adrm_int32(&(ctx->adr), &type, 1); /* tid type */ ctx->adr.adr_now += type * sizeof (char); /* ip address */ ctx->adr.adr_now += 2 * sizeof (int32_t); /* time */ return (0); } int header64_ex_token(parse_context_t *ctx) { int32_t type; common_header(ctx); adrm_int32(&(ctx->adr), &type, 1); /* tid type */ ctx->adr.adr_now += type * sizeof (char); /* ip address */ ctx->adr.adr_now += 2 * sizeof (int64_t); /* time */ return (0); } int header64_token(parse_context_t *ctx) { common_header(ctx); ctx->adr.adr_now += 2 * sizeof (int64_t); /* time */ return (0); } /* * ====================================================== * The following token processing routines return * 0: if parsed ok * -1: can't parse and can't determine location of next token * ====================================================== */ int trailer_token(parse_context_t *ctx) { short magic_number; uint32_t bytes; adrm_u_short(&(ctx->adr), (ushort_t *)&magic_number, 1); if (magic_number != AUT_TRAILER_MAGIC) return (-1); adrm_u_int32(&(ctx->adr), &bytes, 1); return (0); } /* * Format of arbitrary data token: * arbitrary data token id &(ctx->adr) char * how to print adr_char * basic unit adr_char * unit count adr_char, specifying number of units of * data items depends on basic unit * */ int arbitrary_data_token(parse_context_t *ctx) { char basic_unit, unit_count; ctx->adr.adr_now += sizeof (char); /* how to print */ adrm_char(&(ctx->adr), &basic_unit, 1); adrm_char(&(ctx->adr), &unit_count, 1); switch (basic_unit) { case AUR_CHAR: /* same as AUR_BYTE */ ctx->adr.adr_now += unit_count * sizeof (char); break; case AUR_SHORT: ctx->adr.adr_now += unit_count * sizeof (short); break; case AUR_INT32: /* same as AUR_INT */ ctx->adr.adr_now += unit_count * sizeof (int32_t); break; case AUR_INT64: ctx->adr.adr_now += unit_count * sizeof (int64_t); break; default: return (-1); break; } return (0); } /* * Format of opaque token: * opaque token id adr_char * size adr_short * data adr_char, size times * */ int opaque_token(parse_context_t *ctx) { skip_bytes(ctx); return (0); } /* * Format of return32 value token: * return value token id adr_char * error number adr_char * return value adr_u_int32 * */ int return_value32_token(parse_context_t *ctx) { char errnum; adrm_char(&(ctx->adr), &errnum, 1); /* pass / fail */ ctx->adr.adr_now += sizeof (int32_t); /* error code */ ctx->out.sf_pass = (errnum == 0) ? 1 : -1; return (0); } /* * Format of return64 value token: * return value token id adr_char * error number adr_char * return value adr_u_int64 * */ int return_value64_token(parse_context_t *ctx) { char errnum; adrm_char(&(ctx->adr), &errnum, 1); /* pass / fail */ ctx->adr.adr_now += sizeof (int64_t); /* error code */ ctx->out.sf_pass = (errnum == 0) ? 1 : -1; return (0); } /* * Format of sequence token: * sequence token id adr_char * audit_count int32_t * */ int sequence_token(parse_context_t *ctx) { adrm_int32(&(ctx->adr), &(ctx->out.sf_sequence), 1); return (0); } /* * Format of text token: * text token id adr_char * text adr_string */ int text_token(parse_context_t *ctx) { ushort_t len; size_t separator_sz = 0; char *bp; /* pointer to output string */ adrm_u_short(&(ctx->adr), &len, 1); if (ctx->out.sf_textlen > 0) separator_sz = sizeof (AU_TEXT_NAME) - 1; DPRINT((dbfp, "text_token: start length=%d, add length=%d+%d\n", ctx->out.sf_textlen, (size_t)len, separator_sz)); ctx->out.sf_text = realloc(ctx->out.sf_text, ctx->out.sf_textlen + (size_t)len + separator_sz); if (ctx->out.sf_text == NULL) return (-1); bp = ctx->out.sf_text; if (ctx->out.sf_textlen != 0) { /* concatenation? */ bp += ctx->out.sf_textlen; bp += strlcpy(bp, AU_TEXT_NAME, separator_sz + 1); ctx->out.sf_textlen += separator_sz; DPRINT((dbfp, "text_token: l is %d\n%s\n", ctx->out.sf_textlen, ctx->out.sf_text)); } adrm_char(&(ctx->adr), bp, len); len--; /* includes EOS */ *(bp + len) = '\0'; ctx->out.sf_textlen += len; DPRINT((dbfp, "text_token: l=%d\n%s\n", ctx->out.sf_textlen, ctx->out.sf_text)); return (0); } /* * Format of tid token: * ip token id adr_char * terminal type adr_char * terminal type = AU_IPADR: * remote port: ushort * local port: ushort * IP type: int32 -- AU_IPv4 or AU_IPv6 * address: int32 if IPv4, else 4 * int32 */ int tid_token(parse_context_t *ctx) { uchar_t type; int32_t ip_length; adrm_char(&(ctx->adr), (char *)&type, 1); switch (type) { default: return (-1); /* other than IP type is not implemented */ case AU_IPADR: ctx->adr.adr_now += 2 * sizeof (ushort_t); adrm_int32(&(ctx->adr), &ip_length, 1); ctx->adr.adr_now += ip_length; break; } return (0); } /* * Format of ip_addr token: * ip token id adr_char * address adr_int32 * */ int ip_addr_token(parse_context_t *ctx) { ctx->adr.adr_now += sizeof (int32_t); return (0); } /* * Format of ip_addr_ex token: * ip token id adr_char * ip type adr_int32 * address 4*adr_int32 * */ int ip_addr_ex_token(parse_context_t *ctx) { ctx->adr.adr_now += 5 * sizeof (int32_t); return (0); } /* * Format of ip token: * ip header token id adr_char * version adr_char * type of service adr_char * length adr_short * id adr_u_short * offset adr_u_short * ttl adr_char * protocol adr_char * checksum adr_u_short * source address adr_int32 * destination address adr_int32 * */ int ip_token(parse_context_t *ctx) { ctx->adr.adr_now += (2 * sizeof (char)) + (3 * sizeof (short)) + (2 * sizeof (char)) + sizeof (short) + (2 * sizeof (int32_t)); return (0); } /* * Format of iport token: * ip port address token id adr_char * port address adr_short * */ int iport_token(parse_context_t *ctx) { ctx->adr.adr_now += sizeof (short); return (0); } /* * Format of groups token: * group token id adr_char * group list adr_int32, 16 times * */ int group_token(parse_context_t *ctx) { ctx->adr.adr_now += 16 * sizeof (int32_t); return (0); } /* * Format of newgroups token: * group token id adr_char * number of groups adr_short * group list adr_int32, "number" times * */ int newgroup_token(parse_context_t *ctx) { short int number; adrm_short(&(ctx->adr), &number, 1); ctx->adr.adr_now += number * sizeof (int32_t); return (0); } /* * Format of argument32 token: * argument token id adr_char * argument number adr_char * argument value adr_int32 * argument description adr_string * */ int argument32_token(parse_context_t *ctx) { ctx->adr.adr_now += sizeof (char) + sizeof (int32_t); skip_bytes(ctx); return (0); } /* * Format of argument64 token: * argument token id adr_char * argument number adr_char * argument value adr_int64 * argument description adr_string * */ int argument64_token(parse_context_t *ctx) { ctx->adr.adr_now += sizeof (char) + sizeof (int64_t); skip_bytes(ctx); return (0); } /* * Format of acl token: * acl token id adr_char * type adr_u_int32 * value adr_u_int32 * mode adr_u_int32 */ int acl_token(parse_context_t *ctx) { ctx->adr.adr_now += 3 * sizeof (uint32_t); return (0); } /* * Format of ace token: * ace token id adr_char * id adr_u_int32 * access_mask adr_u_int32 * flags adr_u_short * type adr_u_short */ int ace_token(parse_context_t *ctx) { ctx->adr.adr_now += 2 * sizeof (uint32_t) + 2 * sizeof (ushort_t); return (0); } /* * Format of attribute token: (old pre SunOS 5.7 format) * attribute token id adr_char * mode adr_int32 (printed in octal) * uid adr_int32 * gid adr_int32 * file system id adr_int32 * node id adr_int32 * device adr_int32 * */ int attribute_token(parse_context_t *ctx) { ctx->adr.adr_now += 6 * sizeof (int32_t); return (0); } /* * Format of attribute32 token: * attribute token id adr_char * mode adr_int32 (printed in octal) * uid adr_int32 * gid adr_int32 * file system id adr_int32 * node id adr_int64 * device adr_int32 * */ int attribute32_token(parse_context_t *ctx) { ctx->adr.adr_now += (5 * sizeof (int32_t)) + sizeof (int64_t); return (0); } /* * Format of attribute64 token: * attribute token id adr_char * mode adr_int32 (printed in octal) * uid adr_int32 * gid adr_int32 * file system id adr_int32 * node id adr_int64 * device adr_int64 * */ int attribute64_token(parse_context_t *ctx) { ctx->adr.adr_now += (4 * sizeof (int32_t)) + (2 * sizeof (int64_t)); return (0); } /* * Format of command token: * attribute token id adr_char * argc adr_short * argv len adr_short variable amount of argv len * argv text argv len and text * . * . * . * envp count adr_short variable amount of envp len * envp len adr_short and text * envp text envp len * . * . * . * */ int cmd_token(parse_context_t *ctx) { short cnt; short i; adrm_short(&(ctx->adr), &cnt, 1); for (i = 0; i < cnt; i++) skip_bytes(ctx); adrm_short(&(ctx->adr), &cnt, 1); for (i = 0; i < cnt; i++) skip_bytes(ctx); return (0); } /* * Format of exit token: * attribute token id adr_char * return value adr_int32 * errno adr_int32 * */ int exit_token(parse_context_t *ctx) { int32_t retval; adrm_int32(&(ctx->adr), &retval, 1); ctx->adr.adr_now += sizeof (int32_t); ctx->out.sf_pass = (retval == 0) ? 1 : -1; return (0); } /* * Format of exec_args token: * attribute token id adr_char * count value adr_int32 * strings null terminated strings * */ int exec_args_token(parse_context_t *ctx) { int count, i; adrm_int32(&(ctx->adr), (int32_t *)&count, 1); for (i = 1; i <= count; i++) { skip_string(ctx); } return (0); } /* * Format of exec_env token: * attribute token id adr_char * count value adr_int32 * strings null terminated strings * */ int exec_env_token(parse_context_t *ctx) { int count, i; adrm_int32(&(ctx->adr), (int32_t *)&count, 1); for (i = 1; i <= count; i++) skip_string(ctx); return (0); } /* * Format of liaison token: */ int liaison_token(parse_context_t *ctx) { ctx->adr.adr_now += sizeof (int32_t); return (0); } /* * Format of path token: * path adr_string */ int path_token(parse_context_t *ctx) { get_bytes_to_string(ctx, &(ctx->out.sf_pathlen), &(ctx->out.sf_path), 0); if (ctx->out.sf_path == NULL) return (-1); /* * anchor the path because collapse_path needs it */ if (*(ctx->out.sf_path) != '/') { anchor_path(ctx->out.sf_path); ctx->out.sf_pathlen++; } ctx->out.sf_pathlen = collapse_path(ctx->out.sf_path, ctx->out.sf_pathlen); return (0); } /* * path attr token / AUT_XATPATH * * Format of path attr token: * token id adr_char * string count adr_int32 * strings adr_string * * the sequence of strings is converted to a single string with * a blank separator replacing the EOS for all but the last * string. */ int path_attr_token(parse_context_t *ctx) { int count, i; int last_len; size_t offset; char *p; adrm_int32(&(ctx->adr), &count, 1); offset = ctx->out.sf_atpathlen; p = ctx->adr.adr_now; for (i = 0; i <= count; i++) { last_len = strlen(p); ctx->out.sf_atpathlen += last_len + 1; p += last_len + 1; } ctx->out.sf_atpath = realloc(ctx->out.sf_atpath, ctx->out.sf_atpathlen); ctx->out.sf_atpath += offset; p = ctx->out.sf_atpath; /* save for fix up, below */ (void) memcpy(ctx->out.sf_atpath, ctx->adr.adr_now, ctx->out.sf_atpathlen - offset); ctx->out.sf_atpathlen--; /* fix up: replace each eos except the last with ' ' */ for (i = 0; i < count; i++) { while (*p++ != '\0') ; *(p - 1) = ' '; } return (0); } /* * Format of System V IPC permission token: * System V IPC permission token id adr_char * uid adr_int32 * gid adr_int32 * cuid adr_int32 * cgid adr_int32 * mode adr_int32 * seq adr_int32 * key adr_int32 */ int s5_IPC_perm_token(parse_context_t *ctx) { ctx->adr.adr_now += (7 * sizeof (int32_t)); return (0); } static void common_process(parse_context_t *ctx) { int32_t ruid, rgid, egid, pid; uint32_t asid; adrm_u_int32(&(ctx->adr), (uint32_t *)&(ctx->out.sf_pauid), 1); adrm_u_int32(&(ctx->adr), (uint32_t *)&(ctx->out.sf_peuid), 1); adrm_int32(&(ctx->adr), &egid, 1); adrm_int32(&(ctx->adr), &ruid, 1); adrm_int32(&(ctx->adr), &rgid, 1); adrm_int32(&(ctx->adr), &pid, 1); adrm_u_int32(&(ctx->adr), &asid, 1); } /* * Format of process32 token: * process token id adr_char * auid adr_int32 * euid adr_int32 * egid adr_int32 * ruid adr_int32 * rgid adr_int32 * pid adr_int32 * sid adr_int32 * termid adr_int32*2 * */ int process32_token(parse_context_t *ctx) { int32_t port, machine; common_process(ctx); adrm_int32(&(ctx->adr), &port, 1); adrm_int32(&(ctx->adr), &machine, 1); return (0); } /* * Format of process32_ex token: * process token id adr_char * auid adr_int32 * euid adr_int32 * egid adr_int32 * ruid adr_int32 * rgid adr_int32 * pid adr_int32 * sid adr_int32 * termid adr_int32*6 * */ int process32_ex_token(parse_context_t *ctx) { int32_t port, type, addr[4]; common_process(ctx); adrm_int32(&(ctx->adr), &port, 1); adrm_int32(&(ctx->adr), &type, 1); adrm_int32(&(ctx->adr), &addr[0], 4); return (0); } /* * Format of process64 token: * process token id adr_char * auid adr_int32 * euid adr_int32 * egid adr_int32 * ruid adr_int32 * rgid adr_int32 * pid adr_int32 * sid adr_int32 * termid adr_int64+adr_int32 * */ int process64_token(parse_context_t *ctx) { int64_t port; int32_t machine; common_process(ctx); adrm_int64(&(ctx->adr), &port, 1); adrm_int32(&(ctx->adr), &machine, 1); return (0); } /* * Format of process64 token: * process token id adr_char * auid adr_int32 * euid adr_int32 * egid adr_int32 * ruid adr_int32 * rgid adr_int32 * pid adr_int32 * sid adr_int32 * termid adr_int64+5*adr_int32 * */ int process64_ex_token(parse_context_t *ctx) { int64_t port; int32_t type, addr[4]; common_process(ctx); adrm_int64(&(ctx->adr), &port, 1); adrm_int32(&(ctx->adr), &type, 1); adrm_int32(&(ctx->adr), &addr[0], 4); return (0); } /* * Format of System V IPC token: * System V IPC token id adr_char * System V IPC type adr_char * object id adr_int32 * */ int s5_IPC_token(parse_context_t *ctx) { ctx->adr.adr_now += sizeof (char); ctx->adr.adr_now += sizeof (int32_t); return (0); } /* * Format of socket token: * socket_type adrm_short * remote_port adrm_short * remote_inaddr adrm_int32 * */ int socket_token(parse_context_t *ctx) { ctx->adr.adr_now += (2 * sizeof (short)) + sizeof (int32_t); return (0); } /* * Format of socket token: * */ int socket_ex_token(parse_context_t *ctx) { short ip_size; ctx->adr.adr_now += (2 * sizeof (short)); adrm_short(&(ctx->adr), &ip_size, 1); ctx->adr.adr_now += sizeof (short) + (ip_size * sizeof (char)) + sizeof (short) + (ip_size * sizeof (char)); return (0); } static void common_subject(parse_context_t *ctx) { int32_t ruid, rgid, pid; adrm_u_int32(&(ctx->adr), (uint32_t *)&(ctx->out.sf_auid), 1); adrm_u_int32(&(ctx->adr), (uint32_t *)&(ctx->out.sf_euid), 1); adrm_u_int32(&(ctx->adr), (uint32_t *)&(ctx->out.sf_egid), 1); adrm_int32(&(ctx->adr), &ruid, 1); adrm_int32(&(ctx->adr), &rgid, 1); adrm_int32(&(ctx->adr), &pid, 1); adrm_u_int32(&(ctx->adr), (uint32_t *)&(ctx->out.sf_asid), 1); } /* * Format of subject32 token: * subject token id adr_char * auid adr_int32 * euid adr_int32 * egid adr_int32 * ruid adr_int32 * rgid adr_int32 * pid adr_int32 * sid adr_int32 * termid adr_int32*2 * */ int subject32_token(parse_context_t *ctx) { int32_t port; /* not used in output */ common_subject(ctx); adrm_int32(&(ctx->adr), &port, 1); ctx->out.sf_tid.at_type = AU_IPv4; adrm_u_char(&(ctx->adr), (uchar_t *)&(ctx->out.sf_tid.at_addr[0]), 4); return (0); } /* * Format of subject32_ex token: * subject token id adr_char * auid adr_int32 * euid adr_int32 * egid adr_int32 * ruid adr_int32 * rgid adr_int32 * pid adr_int32 * sid adr_int32 * termid_addr adr_int32*6 * */ int subject32_ex_token(parse_context_t *ctx) { int32_t port; /* not used in output */ common_subject(ctx); adrm_int32(&(ctx->adr), &port, 1); adrm_u_int32(&(ctx->adr), &(ctx->out.sf_tid.at_type), 1); adrm_u_char(&(ctx->adr), (uchar_t *)&(ctx->out.sf_tid.at_addr[0]), 16); return (0); } /* * Format of subject64 token: * subject token id adr_char * auid adr_int32 * euid adr_int32 * egid adr_int32 * ruid adr_int32 * rgid adr_int32 * pid adr_int32 * sid adr_int32 * termid adr_int64+adr_int32 * */ int subject64_token(parse_context_t *ctx) { int64_t port; common_subject(ctx); adrm_int64(&(ctx->adr), &port, 1); ctx->out.sf_tid.at_type = AU_IPv4; adrm_u_char(&(ctx->adr), (uchar_t *)&(ctx->out.sf_tid.at_addr[0]), 4); return (0); } /* * Format of subject64 token: * subject token id adr_char * auid adr_int32 * euid adr_int32 * egid adr_int32 * ruid adr_int32 * rgid adr_int32 * pid adr_int32 * sid adr_int32 * termid adr_int64+5*adr_int32 * */ int subject64_ex_token(parse_context_t *ctx) { int64_t port; common_subject(ctx); adrm_u_int32(&(ctx->adr), (uint32_t *)&(ctx->out.sf_asid), 1); adrm_int64(&(ctx->adr), &port, 1); adrm_u_int32(&(ctx->adr), &(ctx->out.sf_tid.at_type), 1); adrm_u_char(&(ctx->adr), (uchar_t *)&(ctx->out.sf_tid.at_addr[0]), 16); return (0); } int xatom_token(parse_context_t *ctx) { skip_bytes(ctx); return (0); } int xselect_token(parse_context_t *ctx) { skip_bytes(ctx); skip_bytes(ctx); skip_bytes(ctx); return (0); } /* * anchor a path name with a slash * assume we have enough space */ static void anchor_path(char *path) { (void) memmove((void *)(path + 1), (void *)path, strlen(path) + 1); *path = '/'; } /* * copy path to collapsed path. * collapsed path does not contain: * successive slashes * instances of dot-slash * instances of dot-dot-slash * passed path must be anchored with a '/' */ static size_t collapse_path(char *s, size_t ls) { int id; /* index of where we are in destination string */ int is; /* index of where we are in source string */ int slashseen; /* have we seen a slash */ ls++; /* source length including '\0' */ slashseen = 0; for (is = 0, id = 0; is < ls; is++) { if (s[is] == '\0') { if (id > 1 && s[id-1] == '/') { --id; } s[id++] = '\0'; break; } /* previous character was a / */ if (slashseen) { if (s[is] == '/') continue; /* another slash, ignore it */ } else if (s[is] == '/') { /* we see a /, just copy it and try again */ slashseen = 1; s[id++] = '/'; continue; } /* /./ seen */ if (s[is] == '.' && s[is+1] == '/') { is += 1; continue; } /* XXX/. seen */ if (s[is] == '.' && s[is+1] == '\0') { if (id > 1) id--; continue; } /* XXX/.. seen */ if (s[is] == '.' && s[is+1] == '.' && s[is+2] == '\0') { is += 1; if (id > 0) id--; while (id > 0 && s[--id] != '/') ; id++; continue; } /* XXX/../ seen */ if (s[is] == '.' && s[is+1] == '.' && s[is+2] == '/') { is += 2; if (id > 0) id--; while (id > 0 && s[--id] != '/') ; id++; continue; } while (is < ls && (s[id++] = s[is++]) != '/') ; is--; } return ((size_t)id - 1); } /* * for tokens with sub-fields that include a length, this * skips the sub-field. */ static void skip_bytes(parse_context_t *ctx) { ushort_t c; adrm_u_short(&(ctx->adr), &c, 1); ctx->adr.adr_now += c; } static void skip_string(parse_context_t *ctx) { char c; do { adrm_char(&(ctx->adr), &c, 1); } while (c != (char)0); } /* * add a byte to specified length so there can be a prefix of * '/' added (if needed for paths). Another is added for '\0' * * if offset is zero, new data overwrites old, if any. Otherwise * new data is appended to the end. */ static void get_bytes_to_string(parse_context_t *ctx, size_t *l, char **p, size_t offset) { ushort_t len; char *bp; adrm_u_short(&(ctx->adr), &len, 1); len++; /* in case need to add '/' prefix */ *p = realloc(*p, 1 + (size_t)len + offset); if (*p == NULL) { perror("audit_sysudp.so"); return; } if (offset > 0) offset--; /* overwrite end of string */ *l = (size_t)len - 2 + offset; bp = *p + offset; adrm_char(&(ctx->adr), bp, len - 1); *(bp + len - 1) = '\0'; } /* * Format of host token: * host adr_uint32 */ int host_token(parse_context_t *ctx) { ctx->adr.adr_now += sizeof (int32_t); return (0); } /* * Format of useofauth token: * uauth token id adr_char * uauth adr_string * */ int useofauth_token(parse_context_t *ctx) { get_bytes_to_string(ctx, &(ctx->out.sf_uauthlen), &(ctx->out.sf_uauth), 0); return (0); } /* * Format of zonename token: * zonename token id adr_char * zonename adr_string * */ int zonename_token(parse_context_t *ctx) { get_bytes_to_string(ctx, &(ctx->out.sf_zonelen), &(ctx->out.sf_zonename), 0); return (0); } /* * Format of fmri token: * fmri token id adr_char * fmri adr_string */ int fmri_token(parse_context_t *ctx) { skip_bytes(ctx); return (0); } int xcolormap_token(parse_context_t *ctx) { return (xgeneric(ctx)); } int xcursor_token(parse_context_t *ctx) { return (xgeneric(ctx)); } int xfont_token(parse_context_t *ctx) { return (xgeneric(ctx)); } int xgc_token(parse_context_t *ctx) { return (xgeneric(ctx)); } int xpixmap_token(parse_context_t *ctx) { return (xgeneric(ctx)); } int xwindow_token(parse_context_t *ctx) { return (xgeneric(ctx)); } /* * Format of xgeneric token: * XID adr_int32 * creator UID adr_int32 * * Includes: xcolormap, xcursor, xfont, xgc, xpixmap, and xwindow */ static int xgeneric(parse_context_t *ctx) { ctx->adr.adr_now += 2 * sizeof (int32_t); return (0); } /* * Format of xproperty token: * XID adr_int32 * creator UID adr_int32 * atom string adr_string */ int xproperty_token(parse_context_t *ctx) { ctx->adr.adr_now += 2 * sizeof (int32_t); return (0); } /* * Format of xclient token: * xclient id adr_int32 */ int xclient_token(parse_context_t *ctx) { ctx->adr.adr_now += sizeof (int32_t); return (0); } /* * ----------------------------------------------------------------------- * privilege_token() : Process privilege token and display contents * * Format of privilege token: * privilege token id adr_char * privilege type adr_string * privilege adr_string * ----------------------------------------------------------------------- */ int privilege_token(parse_context_t *ctx) { skip_bytes(ctx); skip_bytes(ctx); return (0); } /* * Format of label token: * label ID 1 byte * compartment length 1 byte * classification 2 bytes * compartment words <compartment length> * 4 bytes */ int label_token(parse_context_t *ctx) { char c; ctx->adr.adr_now += sizeof (char); /* label ID */ adrm_char(&(ctx->adr), &c, 1); ctx->adr.adr_now += sizeof (ushort_t); /* classification */ ctx->adr.adr_now += 4 * c; /* compartments */ return (0); } /* * Format of useofpriv token: * priv_type adr_char * priv_set_t adr_short * priv_set adr_char*(sizeof (priv_set_t)) */ int useofpriv_token(parse_context_t *ctx) { ctx->adr.adr_now += sizeof (char); /* success / fail */ skip_bytes(ctx); return (0); }