xref: /titanic_41/usr/src/lib/libbsm/common/au_preselect.c (revision 5707ed5dae2bfdea4300de098ba2fa4d22d86f41)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  * au_preselect.c
29  */
30 
31 #include <sys/types.h>
32 #include <stdio.h>
33 #include <stdlib.h>
34 #include <bsm/audit.h>
35 #include <bsm/libbsm.h>
36 #include <synch.h>
37 
38 #define	ALLOC_INIT (600)	/* initially allocate ALLOC_INIT map entries */
39 #define	ALLOC_INCR (100)	/* if more map entries are needed, realloc */
40 				/* in ALLOC_INCR increments */
41 
42 static int alloc_map();
43 static int load_map();
44 static int realloc_map();
45 
46 typedef struct event_map {
47 	au_event_t event;	/* audit event number */
48 	au_class_t class;	/* audit event class mask */
49 } event_map_t;
50 
51 static event_map_t *event_map;	/* the map */
52 static uint_t alloc_count;	/* number of entries currently allocated */
53 static uint_t event_count;	/* number of entries in map */
54 static mutex_t mutex_au_preselect = DEFAULTMUTEX;
55 
56 /*
57  * au_preselect:
58  *
59  * Keep a dynamic array of event<-->class mappings.
60  * Refresh the map when the value of flag is AU_PRS_REREAD.
61  * Return:
62  *	1: The event is preselected.
63  *	0: The event is not preselected.
64  *	-1: There was an error:
65  *		Couldn't allocate memory.
66  *		Couldn't find event.
67  */
68 int
au_preselect(au_event_t au_event,au_mask_t * au_mask_p,int sorf,int flag)69 au_preselect(au_event_t au_event, au_mask_t *au_mask_p, int sorf, int flag)
70 {
71 	static char been_here_before;  /* we cache the map */
72 	register int i;
73 	register au_class_t comp_class;
74 
75 	(void) mutex_lock(&mutex_au_preselect);
76 	if (!been_here_before) {
77 		if (alloc_map() == -1) {
78 			(void) mutex_unlock(&mutex_au_preselect);
79 			return (-1);
80 		}
81 
82 		if (load_map() == -1) {
83 			(void) mutex_unlock(&mutex_au_preselect);
84 			return (-1);
85 		}
86 
87 		been_here_before = 1;
88 	}
89 
90 	/*
91 	 * Don't use the cache. Re-read the audit_event(5) db every time
92 	 */
93 	if (flag == AU_PRS_REREAD) {
94 		if (load_map() == -1) {
95 			(void) mutex_unlock(&mutex_au_preselect);
96 			return (-1);
97 		}
98 	}
99 
100 	/* Determine what portion of the preselection mask to check. */
101 	if (sorf == AU_PRS_SUCCESS)
102 		comp_class = au_mask_p->am_success;
103 	else if (sorf == AU_PRS_FAILURE)
104 		comp_class = au_mask_p->am_failure;
105 	else
106 		comp_class = au_mask_p->am_success | au_mask_p->am_failure;
107 
108 	for (i = 0; i < event_count; i++) {
109 		if (event_map[i].event == au_event) {
110 			if (event_map[i].class & comp_class) {
111 				(void) mutex_unlock(&mutex_au_preselect);
112 				return (1);
113 			} else {
114 				(void) mutex_unlock(&mutex_au_preselect);
115 				return (0);
116 			}
117 		}
118 	}
119 
120 	(void) mutex_unlock(&mutex_au_preselect);
121 	return (-1);	/* could not find event in the table */
122 }
123 
124 /*
125  * Initially allocate about as many map entries as are there
126  * are audit events shipped with the system. For sites
127  * that don't add audit events, this should be enough.
128  */
129 static int
alloc_map()130 alloc_map()
131 {
132 	if ((event_map = (event_map_t *)
133 	    calloc(ALLOC_INIT, (size_t)sizeof (event_map_t))) ==
134 	    (event_map_t *)NULL)
135 		return (-1);
136 	else
137 		alloc_count = ALLOC_INIT;
138 
139 	return (0);
140 }
141 
142 /*
143  * load the event<->class map into memory
144  */
145 static int
load_map()146 load_map()
147 {
148 	register au_event_ent_t *evp;
149 
150 	event_count = 0;
151 	setauevent();
152 	while ((evp = getauevent()) != (au_event_ent_t *)NULL) {
153 		if (event_count > alloc_count)
154 			if (realloc_map() == -1) {
155 				endauevent();
156 				return (-1);
157 			}
158 		event_map[event_count].event = evp->ae_number;
159 		event_map[event_count].class = evp->ae_class;
160 		++event_count;
161 	}
162 	endauevent();
163 
164 	return (0);
165 }
166 
167 /*
168  * realloc the event map in ALLOC_INCR increments
169  */
170 static int
realloc_map()171 realloc_map()
172 {
173 	register size_t rsize;
174 	rsize = sizeof (event_map_t) * (alloc_count + ALLOC_INCR);
175 
176 	if ((event_map = (event_map_t *)
177 	    realloc(event_map, rsize)) == (event_map_t *)NULL)
178 		return (-1);
179 
180 	return (0);
181 }
182