xref: /titanic_41/usr/src/uts/common/c2/audit.h (revision 6a634c9dca3093f3922e4b7ab826d7bdf17bf78e)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
23  */
24 
25 /*
26  * This file contains the declarations of the various data structures
27  * used by the auditing module(s).
28  */
29 
30 #ifndef	_BSM_AUDIT_H
31 #define	_BSM_AUDIT_H
32 
33 #ifdef __cplusplus
34 extern "C" {
35 #endif
36 
37 
38 #include <sys/shm.h>	/* for shmid_ds structure */
39 #include <sys/sem.h>	/* for semid_ds structure */
40 #include <sys/msg.h>	/* for msqid_ds structure */
41 #include <sys/atomic.h>	/* using atomics */
42 
43 /*
44  * Audit conditions, statements reguarding what's to be done with
45  * audit records.  None of the "global state" is returned by an
46  * auditconfig -getcond call.  AUC_NOSPACE no longer seems used.
47  */
48 /* global state */
49 #define	AUC_UNSET	0	/* on/off hasn't been decided */
50 #define	AUC_ENABLED	1	/* loaded and enabled */
51 /* pseudo state used in libbsm */
52 #define	AUC_DISABLED	0x100	/* c2audit module is excluded */
53 /* local zone state */
54 #define	AUC_AUDITING	0x1	/* audit daemon is active */
55 #define	AUC_NOAUDIT	0x2	/* audit daemon is not active */
56 #define	AUC_INIT_AUDIT	0x4	/* audit ready but auditd has not run */
57 #define	AUC_NOSPACE	0x8	/* audit enabled, no space for audit records */
58 
59 /*
60  * The user id -2 is never audited - in fact, a setauid(AU_NOAUDITID)
61  * will turn off auditing.
62  */
63 #define	AU_NOAUDITID	((au_id_t)-2)
64 
65 /*
66  * success/failure bits for asynchronous events
67  */
68 
69 #define	AUM_SUCC	1	/* use the system success preselection mask */
70 #define	AUM_FAIL	2	/* use the system failure preselection mask */
71 
72 
73 /*
74  * Defines for event modifier field
75  */
76 #define	PAD_READ	0x0001		/* object read */
77 #define	PAD_WRITE	0x0002		/* object write */
78 #define	PAD_NONATTR	0x4000		/* non-attributable event */
79 #define	PAD_FAILURE	0x8000		/* fail audit event */
80 #define	PAD_SPRIVUSE	0x0080		/* successfully used privileged */
81 #define	PAD_FPRIVUSE	0x0100		/* failed use of privileged */
82 
83 /*
84  * Some typedefs for the fundamentals
85  */
86 typedef uint_t au_asid_t;
87 typedef uint_t  au_class_t;
88 typedef ushort_t au_event_t;
89 typedef ushort_t au_emod_t;
90 typedef uid_t au_id_t;
91 
92 /*
93  * An audit event mask.
94  */
95 #define	AU_MASK_ALL	0xFFFFFFFF	/* all bits on for unsigned int */
96 #define	AU_MASK_NONE	0x0		/* all bits off = no:invalid class */
97 
98 struct au_mask {
99 	unsigned int	am_success;	/* success bits */
100 	unsigned int	am_failure;	/* failure bits */
101 };
102 typedef struct au_mask au_mask_t;
103 #define	as_success am_success
104 #define	as_failure am_failure
105 
106 /*
107  * The structure of the terminal ID (ipv4)
108  */
109 struct au_tid {
110 	dev_t port;
111 	uint_t machine;
112 };
113 
114 #if defined(_SYSCALL32)
115 struct au_tid32 {
116 	uint_t port;
117 	uint_t machine;
118 };
119 
120 typedef struct au_tid32 au_tid32_t;
121 #endif
122 
123 typedef struct au_tid au_tid_t;
124 
125 /*
126  * The structure of the terminal ID (ipv6)
127  */
128 struct au_tid_addr {
129 	dev_t  at_port;
130 	uint_t at_type;
131 	uint_t at_addr[4];
132 };
133 
134 struct au_port_s {
135 	uint32_t at_major;	/* major # */
136 	uint32_t at_minor;	/* minor # */
137 };
138 typedef struct au_port_s au_port_t;
139 
140 struct au_tid_addr64 {
141 	au_port_t	at_port;
142 	uint_t		at_type;
143 	uint_t		at_addr[4];
144 };
145 typedef struct au_tid_addr64 au_tid64_addr_t;
146 
147 #if defined(_SYSCALL32)
148 struct au_tid_addr32 {
149 	uint_t at_port;
150 	uint_t at_type;
151 	uint_t at_addr[4];
152 };
153 
154 typedef struct au_tid_addr32 au_tid32_addr_t;
155 #endif
156 
157 typedef struct au_tid_addr au_tid_addr_t;
158 
159 struct au_ip {
160 	uint16_t	at_r_port;	/* remote port */
161 	uint16_t	at_l_port;	/* local port */
162 	uint32_t	at_type;	/* AU_IPv4,... */
163 	uint32_t	at_addr[4];	/* remote IP */
164 };
165 typedef struct au_ip au_ip_t;
166 
167 /*
168  * Generic network address structure
169  */
170 struct au_generic_tid {
171 	uchar_t	gt_type;	/* AU_IPADR, AU_DEVICE,... */
172 	union {
173 		au_ip_t		at_ip;
174 		au_port_t	at_dev;
175 	} gt_adr;
176 };
177 typedef struct au_generic_tid au_generic_tid_t;
178 
179 /*
180  * au_generic_tid_t gt_type values
181  * 0 is reserved for uninitialized data
182  */
183 #define	AU_IPADR	1
184 #define	AU_ETHER	2
185 #define	AU_DEVICE	3
186 
187 /*
188  * at_type values - address length used to identify address type
189  */
190 #define	AU_IPv4 4	/* ipv4 type IP address */
191 #define	AU_IPv6 16	/* ipv6 type IP address */
192 
193 /*
194  * Compatability with SunOS 4.x BSM module
195  *
196  * New code should not contain audit_state_t,
197  * au_state_t, nor au_termid as these types
198  * may go away in future releases.
199  *
200  * typedef new-5.x-bsm-name old-4.x-bsm-name
201  */
202 
203 typedef au_class_t au_state_t;
204 typedef au_mask_t audit_state_t;
205 typedef au_id_t auid_t;
206 #define	ai_state ai_mask;
207 
208 /*
209  * Opcodes for bsm system calls
210  */
211 
212 #define	BSM_GETAUID		19
213 #define	BSM_SETAUID		20
214 #define	BSM_GETAUDIT		21
215 #define	BSM_SETAUDIT		22
216 /*				23	OBSOLETE */
217 /*				24	OBSOLETE */
218 #define	BSM_AUDIT		25
219 /* 				26	OBSOLETE */
220 /* 				27	EOL announced for Sol 10 */
221 /*				28	OBSOLETE */
222 #define	BSM_AUDITCTL		29
223 /*				30	OBSOLETE */
224 /*				31	OBSOLETE */
225 /*				32	OBSOLETE */
226 /*				33	OBSOLETE */
227 /*				34	OBSOLETE */
228 #define	BSM_GETAUDIT_ADDR	35
229 #define	BSM_SETAUDIT_ADDR	36
230 #define	BSM_AUDITDOOR		37
231 
232 /*
233  * auditon(2) commands
234  */
235 #define	A_GETPOLICY	2	/* get audit policy */
236 #define	A_SETPOLICY	3	/* set audit policy */
237 #define	A_GETKMASK	4	/* get non-attributable event audit mask */
238 #define	A_SETKMASK	5	/* set non-attributable event audit mask */
239 #define	A_GETQCTRL	6	/* get kernel audit queue ctrl parameters */
240 #define	A_SETQCTRL	7	/* set kernel audit queue ctrl parameters */
241 #define	A_GETCWD	8	/* get process current working directory */
242 #define	A_GETCAR	9	/* get process current active root */
243 #define	A_GETSTAT	12	/* get audit statistics */
244 #define	A_SETSTAT	13	/* (re)set audit statistics */
245 #define	A_SETUMASK	14	/* set preselection mask for procs with auid */
246 #define	A_SETSMASK	15	/* set preselection mask for procs with asid */
247 #define	A_GETCOND	20	/* get audit system on/off condition */
248 #define	A_SETCOND	21	/* set audit system on/off condition */
249 #define	A_GETCLASS	22	/* get audit event to class mapping */
250 #define	A_SETCLASS	23	/* set audit event to class mapping */
251 #define	A_GETPINFO	24	/* get audit info for an arbitrary pid */
252 #define	A_SETPMASK	25	/* set preselection mask for an given pid */
253 #define	A_GETPINFO_ADDR	28	/* get audit info for an arbitrary pid */
254 #define	A_GETKAUDIT	29	/* get kernel audit characteristics */
255 #define	A_SETKAUDIT	30	/* set kernel audit characteristics */
256 #define	A_GETAMASK	31	/* set user default audit event mask */
257 #define	A_SETAMASK	32	/* get user default audit event mask */
258 
259 /*
260  * Audit Policy parameters (32 bits)
261  */
262 #define	AUDIT_CNT	0x0001	/* do NOT sleep undelivered synch events */
263 #define	AUDIT_AHLT	0x0002	/* HALT machine on undelivered async event */
264 #define	AUDIT_ARGV	0x0004	/* include argv with execv system call events */
265 #define	AUDIT_ARGE	0x0008	/* include arge with execv system call events */
266 #define	AUDIT_SEQ	0x0010	/* include sequence attribute */
267 #define	AUDIT_GROUP	0x0040	/* include group attribute with each record */
268 #define	AUDIT_TRAIL	0x0080	/* include trailer token */
269 #define	AUDIT_PATH	0x0100	/* allow multiple paths per event */
270 #define	AUDIT_SCNT	0x0200	/* sleep user events but not kernel events */
271 #define	AUDIT_PUBLIC	0x0400	/* audit even "public" files */
272 #define	AUDIT_ZONENAME	0x0800	/* emit zonename token */
273 #define	AUDIT_PERZONE	0x1000	/* auditd and audit queue for each zone */
274 #define	AUDIT_WINDATA_DOWN	0x2000	/* include paste downgraded data */
275 #define	AUDIT_WINDATA_UP	0x4000	/* include paste upgraded data */
276 
277 /*
278  * If AUDIT_GLOBAL changes, corresponding changes are required in
279  * audit_syscalls.c's setpolicy().
280  */
281 #define	AUDIT_GLOBAL	(AUDIT_AHLT | AUDIT_PERZONE)
282 #define	AUDIT_LOCAL	(AUDIT_CNT | AUDIT_ARGV | AUDIT_ARGE |\
283 			AUDIT_SEQ | AUDIT_GROUP | AUDIT_TRAIL | AUDIT_PATH |\
284 			AUDIT_PUBLIC | AUDIT_SCNT | AUDIT_ZONENAME |\
285 			AUDIT_WINDATA_DOWN | AUDIT_WINDATA_UP)
286 
287 /*
288  * Kernel audit queue control parameters
289  *
290  *	audit record recording blocks at hiwater # undelived records
291  *	audit record recording resumes at lowwater # undelivered audit records
292  *	bufsz determines how big the data xfers will be to the audit trail
293  */
294 struct au_qctrl {
295 	size_t	aq_hiwater;	/* kernel audit queue, high water mark */
296 	size_t	aq_lowater;	/* kernel audit queue, low  water mark */
297 	size_t	aq_bufsz;	/* kernel audit queue, write size to trail */
298 	clock_t	aq_delay;	/* delay before flushing audit queue */
299 };
300 
301 #if defined(_SYSCALL32)
302 struct au_qctrl32 {
303 	size32_t	aq_hiwater;
304 	size32_t	aq_lowater;
305 	size32_t	aq_bufsz;
306 	clock32_t	aq_delay;
307 };
308 #endif
309 
310 
311 /*
312  * default values of hiwater and lowater (note hi > lo)
313  */
314 #define	AQ_HIWATER  100
315 #define	AQ_MAXHIGH  100000
316 #define	AQ_LOWATER  10
317 #define	AQ_BUFSZ    8192
318 #define	AQ_MAXBUFSZ 1048576
319 #define	AQ_DELAY    20
320 #define	AQ_MAXDELAY 20000
321 
322 struct auditinfo {
323 	au_id_t		ai_auid;
324 	au_mask_t	ai_mask;
325 	au_tid_t	ai_termid;
326 	au_asid_t	ai_asid;
327 };
328 
329 #if defined(_SYSCALL32)
330 struct auditinfo32 {
331 	au_id_t		ai_auid;
332 	au_mask_t	ai_mask;
333 	au_tid32_t	ai_termid;
334 	au_asid_t	ai_asid;
335 };
336 
337 typedef struct auditinfo32 auditinfo32_t;
338 #endif
339 
340 typedef struct auditinfo auditinfo_t;
341 
342 struct k_auditinfo_addr {
343 	au_id_t		ai_auid;
344 	au_mask_t	ai_amask;	/* user default preselection mask */
345 	au_mask_t	ai_namask;	/* non-attributable mask */
346 	au_tid_addr_t	ai_termid;
347 	au_asid_t	ai_asid;
348 };
349 typedef struct k_auditinfo_addr k_auditinfo_addr_t;
350 
351 struct auditinfo_addr {
352 	au_id_t		ai_auid;
353 	au_mask_t	ai_mask;
354 	au_tid_addr_t	ai_termid;
355 	au_asid_t	ai_asid;
356 };
357 
358 struct auditinfo_addr64 {
359 	au_id_t		ai_auid;
360 	au_mask_t	ai_mask;
361 	au_tid64_addr_t	ai_termid;
362 	au_asid_t	ai_asid;
363 };
364 typedef struct auditinfo_addr64 auditinfo64_addr_t;
365 
366 #if defined(_SYSCALL32)
367 struct auditinfo_addr32 {
368 	au_id_t		ai_auid;
369 	au_mask_t	ai_mask;
370 	au_tid32_addr_t	ai_termid;
371 	au_asid_t	ai_asid;
372 };
373 
374 typedef struct auditinfo_addr32 auditinfo32_addr_t;
375 #endif
376 
377 typedef struct auditinfo_addr auditinfo_addr_t;
378 
379 struct auditpinfo {
380 	pid_t		ap_pid;
381 	au_id_t		ap_auid;
382 	au_mask_t	ap_mask;
383 	au_tid_t	ap_termid;
384 	au_asid_t	ap_asid;
385 };
386 
387 #if defined(_SYSCALL32)
388 struct auditpinfo32 {
389 	pid_t		ap_pid;
390 	au_id_t		ap_auid;
391 	au_mask_t	ap_mask;
392 	au_tid32_t	ap_termid;
393 	au_asid_t	ap_asid;
394 };
395 #endif
396 
397 
398 struct auditpinfo_addr {
399 	pid_t		ap_pid;
400 	au_id_t		ap_auid;
401 	au_mask_t	ap_mask;
402 	au_tid_addr_t	ap_termid;
403 	au_asid_t	ap_asid;
404 };
405 
406 #if defined(_SYSCALL32)
407 struct auditpinfo_addr32 {
408 	pid_t		ap_pid;
409 	au_id_t		ap_auid;
410 	au_mask_t	ap_mask;
411 	au_tid32_addr_t	ap_termid;
412 	au_asid_t	ap_asid;
413 };
414 #endif
415 
416 
417 struct au_evclass_map {
418 	au_event_t	ec_number;
419 	au_class_t	ec_class;
420 };
421 typedef struct au_evclass_map au_evclass_map_t;
422 
423 /*
424  * Audit stat structures (used to be in audit_stat.h
425  */
426 
427 struct audit_stat {
428 	unsigned int as_version;	/* version of kernel audit code */
429 	unsigned int as_numevent;	/* number of kernel audit events */
430 	uint32_t as_generated;		/* # records processed */
431 	uint32_t as_nonattrib;		/* # non-attributed records produced */
432 	uint32_t as_kernel;		/* # records produced by kernel */
433 	uint32_t as_audit;		/* # records processed by audit(2) */
434 	uint32_t as_auditctl;		/* # records processed by auditctl(2) */
435 	uint32_t as_enqueue;		/* # records put onto audit queue */
436 	uint32_t as_written;		/* # records written to audit trail */
437 	uint32_t as_wblocked;		/* # times write blked on audit queue */
438 	uint32_t as_rblocked;		/* # times read blked on audit queue */
439 	uint32_t as_dropped;		/* # of dropped audit records */
440 	uint32_t as_totalsize;		/* total number bytes of audit data */
441 	uint32_t as_memused;		/* no longer used */
442 };
443 typedef struct audit_stat au_stat_t;
444 
445 /* get kernel audit context dependent on AUDIT_PERZONE policy */
446 #define	GET_KCTX_PZ	(audit_policy & AUDIT_PERZONE) ?\
447 			    curproc->p_zone->zone_audit_kctxt :\
448 			    global_zone->zone_audit_kctxt
449 /* get kernel audit context of global zone */
450 #define	GET_KCTX_GZ	global_zone->zone_audit_kctxt
451 /* get kernel audit context of non-global zone */
452 #define	GET_KCTX_NGZ	curproc->p_zone->zone_audit_kctxt
453 
454 #define	AS_INC(a, b, c) atomic_add_32(&(c->auk_statistics.a), (b))
455 #define	AS_DEC(a, b, c) atomic_add_32(&(c->auk_statistics.a), -(b))
456 
457 /*
458  * audit token IPC types (shm, sem, msg) [for ipc attribute]
459  */
460 
461 #define	AT_IPC_MSG	((char)1)		/* message IPC id */
462 #define	AT_IPC_SEM	((char)2)		/* semaphore IPC id */
463 #define	AT_IPC_SHM	((char)3)		/* shared memory IPC id */
464 
465 #if defined(_KERNEL)
466 
467 #ifdef __cplusplus
468 }
469 #endif
470 
471 #include <sys/types.h>
472 #include <sys/model.h>
473 #include <sys/proc.h>
474 #include <sys/stream.h>
475 #include <sys/stropts.h>
476 #include <sys/file.h>
477 #include <sys/pathname.h>
478 #include <sys/vnode.h>
479 #include <sys/systm.h>
480 #include <netinet/in.h>
481 #include <c2/audit_door_infc.h>
482 #include <sys/crypto/ioctladmin.h>
483 #include <sys/netstack.h>
484 #include <sys/zone.h>
485 
486 #ifdef __cplusplus
487 extern "C" {
488 #endif
489 
490 struct fcntla;
491 struct t_audit_data;
492 struct audit_path;
493 struct priv_set;
494 struct devplcysys;
495 
496 struct auditcalls {
497 	long	code;
498 	long	a1;
499 	long	a2;
500 	long	a3;
501 	long	a4;
502 	long	a5;
503 };
504 
505 int	audit(caddr_t, int);
506 int	auditsys(struct auditcalls *, union rval *); /* fake stub */
507 void	audit_cryptoadm(int, char *, crypto_mech_name_t *,
508 	    uint_t, uint_t, uint32_t, int);
509 void	audit_init(void);
510 void	audit_init_module(void);
511 void	audit_newproc(struct proc *);
512 void	audit_pfree(struct proc *);
513 void	audit_thread_create(kthread_id_t);
514 void	audit_thread_free(kthread_id_t);
515 int	audit_savepath(struct pathname *, struct vnode *, struct vnode *,
516 		int, cred_t *);
517 void	audit_anchorpath(struct pathname *, int);
518 void	audit_symlink(struct pathname *, struct pathname *);
519 void	audit_symlink_create(struct vnode *, char *, char *, int);
520 int	object_is_public(struct vattr *);
521 void	audit_attributes(struct vnode *);
522 void	audit_falloc(struct file *);
523 void	audit_unfalloc(struct file *);
524 void	audit_exit(int, int);
525 void	audit_core_start(int);
526 void	audit_core_finish(int);
527 void	audit_strgetmsg(struct vnode *, struct strbuf *, struct strbuf *,
528 		unsigned char *, int *, int);
529 void	audit_strputmsg(struct vnode *, struct strbuf *, struct strbuf *,
530 		unsigned char, int, int);
531 void	audit_closef(struct file *);
532 void	audit_setf(struct file *, int);
533 void	audit_reboot(void);
534 void	audit_vncreate_start(void);
535 void	audit_setfsat_path(int argnum);
536 void	audit_vncreate_finish(struct vnode *, int);
537 void	audit_exec(const char *, const char *, ssize_t, ssize_t, cred_t *);
538 void	audit_enterprom(int);
539 void	audit_exitprom(int);
540 void	audit_chdirec(struct vnode *, struct vnode **);
541 void	audit_sock(int, struct queue *, struct msgb *, int);
542 int	audit_start(unsigned int, unsigned int, uint32_t, int, klwp_t *);
543 void	audit_finish(unsigned int, unsigned int, int, union rval *);
544 int	audit_async_start(label_t *, au_event_t, int);
545 void	audit_async_finish(caddr_t *, au_event_t, au_emod_t, timestruc_t *);
546 void	audit_async_discard_backend(void *);
547 void	audit_async_done(caddr_t *, int);
548 void	audit_async_drop(caddr_t *, int);
549 
550 #ifndef AUK_CONTEXT_T
551 #define	AUK_CONTEXT_T
552 typedef struct au_kcontext au_kcontext_t;
553 #endif
554 
555 /* Zone audit context setup routine */
556 void au_zone_setup(void);
557 
558 /*
559  * c2audit module states
560  */
561 #define	C2AUDIT_DISABLED    0	/* c2audit module excluded in /etc/system */
562 #define	C2AUDIT_UNLOADED    1	/* c2audit module not loaded */
563 #define	C2AUDIT_LOADED	    2	/* c2audit module loaded */
564 
565 uint32_t    audit_getstate(void);
566 int	    au_zone_getstate(const au_kcontext_t *);
567 
568 /* The audit mask defining in which case is auditing enabled */
569 #define	AU_AUDIT_MASK	(AUC_AUDITING | AUC_NOSPACE)
570 
571 /*
572  * Get the given zone audit status. zcontext != NULL serves
573  * as a protection when c2audit module is not loaded.
574  */
575 #define	AU_ZONE_AUDITING(zcontext)	    \
576 	(audit_active == C2AUDIT_LOADED &&  \
577 	    ((AU_AUDIT_MASK) & au_zone_getstate((zcontext))))
578 
579 /*
580  * Get auditing status
581  */
582 #define	AU_AUDITING() (audit_getstate())
583 
584 int	audit_success(au_kcontext_t *, struct t_audit_data *, int, cred_t *);
585 int	auditme(au_kcontext_t *, struct t_audit_data *, au_state_t);
586 void	audit_fixpath(struct audit_path *, int);
587 void	audit_ipc(int, int, void *);
588 void	audit_ipcget(int, void *);
589 void	audit_fdsend(int, struct file *, int);
590 void	audit_fdrecv(int, struct file *);
591 void	audit_priv(int, const struct priv_set *, int);
592 void	audit_setppriv(int, int, const struct priv_set *, const cred_t *);
593 void	audit_devpolicy(int, const struct devplcysys *);
594 void	audit_update_context(proc_t *, cred_t *);
595 void	audit_kssl(int, void *, int);
596 void	audit_pf_policy(int, cred_t *, netstack_t *, char *, boolean_t, int,
597     pid_t);
598 void	audit_sec_attributes(caddr_t *, struct vnode *);
599 
600 #endif
601 
602 #ifdef __cplusplus
603 }
604 #endif
605 
606 #endif /* _BSM_AUDIT_H */
607