xref: /freebsd/contrib/openbsm/libbsm/bsm_notify.c (revision 1e413cf93298b5b97441a21d9a50fdcd0ee9945e)
1 /*
2  * Copyright (c) 2004 Apple Computer, Inc.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1.  Redistributions of source code must retain the above copyright
9  *     notice, this list of conditions and the following disclaimer.
10  * 2.  Redistributions in binary form must reproduce the above copyright
11  *     notice, this list of conditions and the following disclaimer in the
12  *     documentation and/or other materials provided with the distribution.
13  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
14  *     its contributors may be used to endorse or promote products derived
15  *     from this software without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27  * POSSIBILITY OF SUCH DAMAGE.
28  *
29  * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_notify.c#13 $
30  */
31 
32 /*
33  * Based on sample code from Marc Majka.
34  */
35 #include <sys/types.h>
36 
37 #include <config/config.h>
38 #ifdef HAVE_FULL_QUEUE_H
39 #include <sys/queue.h>
40 #else /* !HAVE_FULL_QUEUE_H */
41 #include <compat/queue.h>
42 #endif /* !HAVE_FULL_QUEUE_H */
43 
44 #include <bsm/audit_internal.h>
45 #include <bsm/libbsm.h>
46 
47 #include <errno.h>
48 #include <inttypes.h>
49 #include <stdarg.h>
50 #include <string.h>
51 #include <syslog.h>
52 
53 
54 #ifdef __APPLE__
55 #include <notify.h>
56 /* If 1, assumes a kernel that sends the right notification. */
57 #define	AUDIT_NOTIFICATION_ENABLED	1
58 
59 #if AUDIT_NOTIFICATION_ENABLED
60 static int	token = 0;
61 #endif	/* AUDIT_NOTIFICATION_ENABLED */
62 
63 static long	au_cond = AUC_UNSET;	/* <bsm/audit.h> */
64 
65 uint32_t
66 au_notify_initialize(void)
67 {
68 #if AUDIT_NOTIFICATION_ENABLED
69 	uint32_t status;
70 	int ignore_first;
71 
72 	status = notify_register_check(__BSM_INTERNAL_NOTIFY_KEY, &token);
73 	if (status != NOTIFY_STATUS_OK)
74 		return (status);
75 	status = notify_check(token, &ignore_first);
76 	if (status != NOTIFY_STATUS_OK)
77 		return (status);
78 #endif
79 
80 	if (auditon(A_GETCOND, &au_cond, sizeof(long)) < 0) {
81 		syslog(LOG_ERR, "Initial audit status check failed (%s)",
82 		    strerror(errno));
83 		if (errno == ENOSYS)	/* auditon() unimplemented. */
84 			return (AU_UNIMPL);
85 		return (NOTIFY_STATUS_FAILED);	/* Is there a better code? */
86 	}
87 	return (NOTIFY_STATUS_OK);
88 }
89 
90 int
91 au_notify_terminate(void)
92 {
93 
94 #if AUDIT_NOTIFICATION_ENABLED
95 	return ((notify_cancel(token) == NOTIFY_STATUS_OK) ? 0 : -1);
96 #else
97 	return (0);
98 #endif
99 }
100 
101 /*
102  * On error of any notify(3) call, reset 'au_cond' to ensure we re-run
103  * au_notify_initialize() next time 'round--but assume auditing is on.  This
104  * is a slight performance hit if auditing is off, but at least the system
105  * will behave correctly.  The notification calls are unlikely to fail,
106  * anyway.
107  */
108 int
109 au_get_state(void)
110 {
111 #if AUDIT_NOTIFICATION_ENABLED
112 	int did_notify;
113 #endif
114 	int status;
115 
116 	/*
117 	 * Don't make the client initialize this set of routines, but take the
118 	 * slight performance hit by checking ourselves every time.
119 	 */
120 	if (au_cond == AUC_UNSET) {
121 		status = au_notify_initialize();
122 		if (status != NOTIFY_STATUS_OK) {
123 			if (status == AU_UNIMPL)
124 				return (AU_UNIMPL);
125 			return (AUC_AUDITING);
126 		} else
127 			return (au_cond);
128 	}
129 #if AUDIT_NOTIFICATION_ENABLED
130 	status = notify_check(token, &did_notify);
131 	if (status != NOTIFY_STATUS_OK) {
132 		au_cond = AUC_UNSET;
133 		return (AUC_AUDITING);
134 	}
135 
136 	if (did_notify == 0)
137 		return (au_cond);
138 #endif
139 
140 	if (auditon(A_GETCOND, &au_cond, sizeof(long)) < 0) {
141 		/* XXX Reset au_cond to AUC_UNSET? */
142 		syslog(LOG_ERR, "Audit status check failed (%s)",
143 		    strerror(errno));
144 		if (errno == ENOSYS)	/* Function unimplemented. */
145 			return (AU_UNIMPL);
146 		return (errno);
147 	}
148 
149 	switch (au_cond) {
150 	case AUC_NOAUDIT:	/* Auditing suspended. */
151 	case AUC_DISABLED:	/* Auditing shut off. */
152 		return (AUC_NOAUDIT);
153 
154 	case AUC_UNSET:		/* Uninitialized; shouldn't get here. */
155 	case AUC_AUDITING:	/* Audit on. */
156 	default:
157 		return (AUC_AUDITING);
158 	}
159 }
160 #endif	/* !__APPLE__ */
161 
162 int
163 cannot_audit(int val __unused)
164 {
165 #ifdef __APPLE__
166 	return (!(au_get_state() == AUC_AUDITING));
167 #else
168 	unsigned long au_cond;
169 
170 	if (auditon(A_GETCOND, &au_cond, sizeof(long)) < 0) {
171 		if (errno != ENOSYS) {
172 			syslog(LOG_ERR, "Audit status check failed (%s)",
173 			    strerror(errno));
174 		}
175 		return (1);
176 	}
177 	if (au_cond == AUC_NOAUDIT || au_cond == AUC_DISABLED)
178 		return (1);
179 	return (0);
180 #endif	/* !__APPLE__ */
181 }
182