1 /*- 2 * Copyright (c) 2004-2009 Apple Inc. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of 14 * its contributors may be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 /* 31 * Based on sample code from Marc Majka. 32 */ 33 #include <sys/types.h> 34 35 #include <config/config.h> 36 #ifdef HAVE_FULL_QUEUE_H 37 #include <sys/queue.h> 38 #else /* !HAVE_FULL_QUEUE_H */ 39 #include <compat/queue.h> 40 #endif /* !HAVE_FULL_QUEUE_H */ 41 42 #include <bsm/audit_internal.h> 43 #include <bsm/libbsm.h> 44 45 #include <errno.h> 46 #include <inttypes.h> 47 #include <stdarg.h> 48 #include <string.h> 49 #include <syslog.h> 50 51 52 #ifdef __APPLE__ 53 #include <notify.h> 54 /* If 1, assumes a kernel that sends the right notification. */ 55 #define AUDIT_NOTIFICATION_ENABLED 1 56 57 #if AUDIT_NOTIFICATION_ENABLED 58 static int token = 0; 59 #endif /* AUDIT_NOTIFICATION_ENABLED */ 60 61 static int au_cond = AUC_UNSET; /* <bsm/audit.h> */ 62 63 uint32_t 64 au_notify_initialize(void) 65 { 66 #if AUDIT_NOTIFICATION_ENABLED 67 uint32_t status; 68 int ignore_first; 69 70 status = notify_register_check(__BSM_INTERNAL_NOTIFY_KEY, &token); 71 if (status != NOTIFY_STATUS_OK) 72 return (status); 73 status = notify_check(token, &ignore_first); 74 if (status != NOTIFY_STATUS_OK) 75 return (status); 76 #endif 77 78 if (audit_get_cond(&au_cond) != 0) { 79 syslog(LOG_ERR, "Initial audit status check failed (%s)", 80 strerror(errno)); 81 if (errno == ENOSYS) /* auditon() unimplemented. */ 82 return (AU_UNIMPL); 83 return (NOTIFY_STATUS_FAILED); /* Is there a better code? */ 84 } 85 return (NOTIFY_STATUS_OK); 86 } 87 88 int 89 au_notify_terminate(void) 90 { 91 92 #if AUDIT_NOTIFICATION_ENABLED 93 return ((notify_cancel(token) == NOTIFY_STATUS_OK) ? 0 : -1); 94 #else 95 return (0); 96 #endif 97 } 98 99 /* 100 * On error of any notify(3) call, reset 'au_cond' to ensure we re-run 101 * au_notify_initialize() next time 'round--but assume auditing is on. This 102 * is a slight performance hit if auditing is off, but at least the system 103 * will behave correctly. The notification calls are unlikely to fail, 104 * anyway. 105 */ 106 int 107 au_get_state(void) 108 { 109 #if AUDIT_NOTIFICATION_ENABLED 110 int did_notify; 111 #endif 112 int status; 113 114 /* 115 * Don't make the client initialize this set of routines, but take the 116 * slight performance hit by checking ourselves every time. 117 */ 118 if (au_cond == AUC_UNSET) { 119 status = au_notify_initialize(); 120 if (status != NOTIFY_STATUS_OK) { 121 if (status == AU_UNIMPL) 122 return (AU_UNIMPL); 123 return (AUC_AUDITING); 124 } else 125 return (au_cond); 126 } 127 #if AUDIT_NOTIFICATION_ENABLED 128 status = notify_check(token, &did_notify); 129 if (status != NOTIFY_STATUS_OK) { 130 au_cond = AUC_UNSET; 131 return (AUC_AUDITING); 132 } 133 134 if (did_notify == 0) 135 return (au_cond); 136 #endif 137 138 if (audit_get_cond(&au_cond) != 0) { 139 /* XXX Reset au_cond to AUC_UNSET? */ 140 syslog(LOG_ERR, "Audit status check failed (%s)", 141 strerror(errno)); 142 if (errno == ENOSYS) /* Function unimplemented. */ 143 return (AU_UNIMPL); 144 return (errno); 145 } 146 147 switch (au_cond) { 148 case AUC_NOAUDIT: /* Auditing suspended. */ 149 case AUC_DISABLED: /* Auditing shut off. */ 150 return (AUC_NOAUDIT); 151 152 case AUC_UNSET: /* Uninitialized; shouldn't get here. */ 153 case AUC_AUDITING: /* Audit on. */ 154 default: 155 return (AUC_AUDITING); 156 } 157 } 158 #endif /* !__APPLE__ */ 159 160 int 161 cannot_audit(int val __unused) 162 { 163 #ifdef __APPLE__ 164 return (!(au_get_state() == AUC_AUDITING)); 165 #else 166 int cond; 167 168 if (audit_get_cond(&cond) != 0) { 169 if (errno != ENOSYS) { 170 syslog(LOG_ERR, "Audit status check failed (%s)", 171 strerror(errno)); 172 } 173 return (1); 174 } 175 if (cond == AUC_NOAUDIT || cond == AUC_DISABLED) 176 return (1); 177 return (0); 178 #endif /* !__APPLE__ */ 179 } 180