xref: /freebsd/sys/bsm/audit_record.h (revision 13014ca04aad1931d41958b56f71a2c65b9a7a2c)
1 /*
2  * Copyright (c) 2005 Apple Inc.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *
9  * 1.  Redistributions of source code must retain the above copyright
10  *     notice, this list of conditions and the following disclaimer.
11  * 2.  Redistributions in binary form must reproduce the above copyright
12  *     notice, this list of conditions and the following disclaimer in the
13  *     documentation and/or other materials provided with the distribution.
14  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
15  *     its contributors may be used to endorse or promote products derived
16  *     from this software without specific prior written permission.
17  *
18  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
19  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
20  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
22  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
25  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28  *
29  * P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_record.h#26
30  * $FreeBSD$
31  */
32 
33 #ifndef _BSM_AUDIT_RECORD_H_
34 #define _BSM_AUDIT_RECORD_H_
35 
36 #include <sys/time.h>			/* struct timeval */
37 
38 /*
39  * Token type identifiers.
40  */
41 #define	AUT_INVALID		0x00
42 #define	AUT_OTHER_FILE32	0x11
43 #define	AUT_OHEADER		0x12
44 #define	AUT_TRAILER		0x13
45 #define	AUT_HEADER32		0x14
46 #define	AUT_HEADER32_EX		0x15
47 #define	AUT_DATA		0x21
48 #define	AUT_IPC			0x22
49 #define	AUT_PATH		0x23
50 #define	AUT_SUBJECT32		0x24
51 #define	AUT_SERVER32		0x25
52 #define	AUT_PROCESS32		0x26
53 #define	AUT_RETURN32		0x27
54 #define	AUT_TEXT		0x28
55 #define	AUT_OPAQUE		0x29
56 #define	AUT_IN_ADDR		0x2a
57 #define	AUT_IP			0x2b
58 #define	AUT_IPORT		0x2c
59 #define	AUT_ARG32		0x2d
60 #define	AUT_SOCKET		0x2e
61 #define	AUT_SEQ			0x2f
62 #define	AUT_ACL			0x30
63 #define	AUT_ATTR		0x31
64 #define	AUT_IPC_PERM		0x32
65 #define	AUT_LABEL		0x33
66 #define	AUT_GROUPS		0x34
67 #define	AUT_ILABEL		0x35
68 #define	AUT_SLABEL		0x36
69 #define	AUT_CLEAR		0x37
70 #define	AUT_PRIV		0x38
71 #define	AUT_UPRIV		0x39
72 #define	AUT_LIAISON		0x3a
73 #define	AUT_NEWGROUPS		0x3b
74 #define	AUT_EXEC_ARGS		0x3c
75 #define	AUT_EXEC_ENV		0x3d
76 #define	AUT_ATTR32		0x3e
77 /* #define	AUT_????	0x3f */
78 #define	AUT_XATOM		0x40
79 #define	AUT_XOBJ		0x41
80 #define	AUT_XPROTO		0x42
81 #define	AUT_XSELECT		0x43
82 /* XXXRW: Additional X11 tokens not defined? */
83 #define	AUT_CMD			0x51
84 #define	AUT_EXIT		0x52
85 #define	AUT_ZONENAME		0x60
86 /* XXXRW: OpenBSM AUT_HOST 0x70? */
87 #define	AUT_ARG64		0x71
88 #define	AUT_RETURN64		0x72
89 #define	AUT_ATTR64		0x73
90 #define	AUT_HEADER64		0x74
91 #define	AUT_SUBJECT64		0x75
92 #define	AUT_SERVER64		0x76
93 #define	AUT_PROCESS64		0x77
94 #define	AUT_OTHER_FILE64	0x78
95 #define	AUT_HEADER64_EX		0x79
96 #define	AUT_SUBJECT32_EX	0x7a
97 #define	AUT_PROCESS32_EX	0x7b
98 #define	AUT_SUBJECT64_EX	0x7c
99 #define	AUT_PROCESS64_EX	0x7d
100 #define	AUT_IN_ADDR_EX		0x7e
101 #define	AUT_SOCKET_EX		0x7f
102 
103 /*
104  * Pre-64-bit BSM, 32-bit tokens weren't explicitly named as '32'.  We have
105  * compatibility defines.
106  */
107 #define	AUT_HEADER		AUT_HEADER32
108 #define	AUT_ARG			AUT_ARG32
109 #define	AUT_RETURN		AUT_RETURN32
110 #define	AUT_SUBJECT		AUT_SUBJECT32
111 #define	AUT_SERVER		AUT_SERVER32
112 #define	AUT_PROCESS		AUT_PROCESS32
113 #define	AUT_OTHER_FILE		AUT_OTHER_FILE32
114 
115 /*
116  * Darwin's bsm distribution uses the following non-BSM token name defines.
117  * We provide them for a single OpenBSM release for compatibility reasons.
118  */
119 #define	AU_FILE_TOKEN		AUT_OTHER_FILE32
120 #define	AU_TRAILER_TOKEN	AUT_TRAILER
121 #define	AU_HEADER_32_TOKEN	AUT_HEADER32
122 #define	AU_DATA_TOKEN		AUT_DATA
123 #define	AU_ARB_TOKEN		AUT_DATA
124 #define	AU_IPC_TOKEN		AUT_IPC
125 #define	AU_PATH_TOKEN		AUT_PATH
126 #define	AU_SUBJECT_32_TOKEN	AUT_SUBJECT32
127 #define	AU_PROCESS_32_TOKEN	AUT_PROCESS32
128 #define	AU_RETURN_32_TOKEN	AUT_RETURN32
129 #define	AU_TEXT_TOKEN		AUT_TEXT
130 #define	AU_OPAQUE_TOKEN		AUT_OPAQUE
131 #define	AU_IN_ADDR_TOKEN	AUT_IN_ADDR
132 #define	AU_IP_TOKEN		AUT_IP
133 #define	AU_IPORT_TOKEN		AUT_IPORT
134 #define	AU_ARG32_TOKEN		AUT_ARG32
135 #define	AU_SOCK_TOKEN		AUT_SOCKET
136 #define	AU_SEQ_TOKEN		AUT_SEQ
137 #define	AU_ATTR_TOKEN		AUT_ATTR
138 #define	AU_IPCPERM_TOKEN	AUT_IPC_PERM
139 #define	AU_NEWGROUPS_TOKEN	AUT_NEWGROUPS
140 #define	AU_EXEC_ARG_TOKEN	AUT_EXEC_ARGS
141 #define	AU_EXEC_ENV_TOKEN	AUT_EXEC_ENV
142 #define	AU_ATTR32_TOKEN		AUT_ATTR32
143 #define	AU_CMD_TOKEN		AUT_CMD
144 #define	AU_EXIT_TOKEN		AUT_EXIT
145 #define	AU_ARG64_TOKEN		AUT_ARG64
146 #define	AU_RETURN_64_TOKEN	AUT_RETURN64
147 #define	AU_ATTR64_TOKEN		AUT_ATTR64
148 #define	AU_HEADER_64_TOKEN	AUT_HEADER64
149 #define	AU_SUBJECT_64_TOKEN	AUT_SUBJECT64
150 #define	AU_PROCESS_64_TOKEN	AUT_PROCESS64
151 #define	AU_HEADER_64_EX_TOKEN	AUT_HEADER64_EX
152 #define	AU_SUBJECT_32_EX_TOKEN	AUT_SUBJECT32_EX
153 #define	AU_PROCESS_32_EX_TOKEN	AUT_PROCESS32_EX
154 #define	AU_SUBJECT_64_EX_TOKEN	AUT_SUBJECT64_EX
155 #define	AU_PROCESS_64_EX_TOKEN	AUT_PROCESS64_EX
156 #define	AU_IN_ADDR_EX_TOKEN	AUT_IN_ADDR_EX
157 #define	AU_SOCK_32_EX_TOKEN	AUT_SOCKET_EX
158 
159 /*
160  * The values for the following token ids are not defined by BSM.
161  *
162  * XXXRW: Not sure how to handle these in OpenBSM yet, but I'll give them
163  * names more consistent with Sun's BSM.  These originally came from Apple's
164  * BSM.
165  */
166 #define	AUT_SOCKINET32		0x80		/* XXX */
167 #define	AUT_SOCKINET128		0x81		/* XXX */
168 #define	AUT_SOCKUNIX		0x82		/* XXX */
169 #define	AU_SOCK_INET_32_TOKEN	AUT_SOCKINET32
170 #define	AU_SOCK_INET_128_TOKEN	AUT_SOCKINET128
171 #define	AU_SOCK_UNIX_TOKEN	AUT_SOCKUNIX
172 
173 /* print values for the arbitrary token */
174 #define AUP_BINARY      0
175 #define AUP_OCTAL       1
176 #define AUP_DECIMAL     2
177 #define AUP_HEX         3
178 #define AUP_STRING      4
179 
180 /* data-types for the arbitrary token */
181 #define AUR_BYTE        0
182 #define AUR_CHAR        AUR_BYTE
183 #define AUR_SHORT       1
184 #define AUR_INT32       2
185 #define AUR_INT         AUR_INT32
186 #define AUR_INT64       3
187 
188 /* ... and their sizes */
189 #define AUR_BYTE_SIZE       sizeof(u_char)
190 #define AUR_CHAR_SIZE       AUR_BYTE_SIZE
191 #define AUR_SHORT_SIZE      sizeof(uint16_t)
192 #define AUR_INT32_SIZE      sizeof(uint32_t)
193 #define AUR_INT_SIZE        AUR_INT32_SIZE
194 #define AUR_INT64_SIZE      sizeof(uint64_t)
195 
196 /* Modifiers for the header token */
197 #define PAD_NOTATTR  0x4000   /* nonattributable event */
198 #define PAD_FAILURE  0x8000   /* fail audit event */
199 
200 #define AUDIT_MAX_GROUPS      16
201 
202 /*
203  * A number of BSM versions are floating around and defined.  Here are
204  * constants for them.  OpenBSM uses the same token types, etc, used in the
205  * Solaris BSM version, but has a separate version number in order to
206  * identify a potentially different event identifier name space.
207  */
208 #define	AUDIT_HEADER_VERSION_OLDDARWIN	1	/* In retrospect, a mistake. */
209 #define	AUDIT_HEADER_VERSION_SOLARIS	2
210 #define	AUDIT_HEADER_VERSION_TSOL25	3
211 #define	AUDIT_HEADER_VERSION_TSOL	4
212 #define	AUDIT_HEADER_VERSION_OPENBSM	10
213 
214 /*
215  * BSM define is AUT_TRAILER_MAGIC; Apple BSM define is TRAILER_PAD_MAGIC; we
216  * split the difference, will remove the Apple define for the next release.
217  */
218 #define	AUT_TRAILER_MAGIC	0xb105
219 #define	TRAILER_PAD_MAGIC	AUT_TRAILER_MAGIC
220 
221 /* BSM library calls */
222 
223 __BEGIN_DECLS
224 
225 struct in_addr;
226 struct in6_addr;
227 struct ip;
228 struct ipc_perm;
229 struct kevent;
230 struct sockaddr_in;
231 struct sockaddr_in6;
232 struct sockaddr_un;
233 #if defined(_KERNEL) || defined(KERNEL)
234 struct vnode_au_info;
235 #endif
236 
237 int	 au_open(void);
238 int	 au_write(int d, token_t *m);
239 int	 au_close(int d, int keep, short event);
240 int	 au_close_buffer(int d, short event, u_char *buffer, size_t *buflen);
241 int	 au_close_token(token_t *tok, u_char *buffer, size_t *buflen);
242 
243 token_t	*au_to_file(char *file, struct timeval tm);
244 
245 token_t	*au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
246 	    struct timeval tm);
247 token_t	*au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
248 	    struct timeval tm);
249 #if !defined(KERNEL) && !defined(_KERNEL)
250 token_t	*au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod);
251 token_t	*au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod);
252 token_t	*au_to_header64(int rec_size, au_event_t e_type, au_emod_t e_mod);
253 #endif
254 
255 token_t	*au_to_me(void);
256 token_t	*au_to_arg(char n, char *text, uint32_t v);
257 token_t	*au_to_arg32(char n, char *text, uint32_t v);
258 token_t	*au_to_arg64(char n, char *text, uint64_t v);
259 
260 #if defined(_KERNEL) || defined(KERNEL)
261 token_t	*au_to_attr(struct vnode_au_info *vni);
262 token_t	*au_to_attr32(struct vnode_au_info *vni);
263 token_t	*au_to_attr64(struct vnode_au_info *vni);
264 #endif
265 
266 token_t	*au_to_data(char unit_print, char unit_type, char unit_count,
267 	    char *p);
268 token_t	*au_to_exit(int retval, int err);
269 token_t	*au_to_groups(int *groups);
270 token_t	*au_to_newgroups(uint16_t n, gid_t *groups);
271 token_t	*au_to_in_addr(struct in_addr *internet_addr);
272 token_t	*au_to_in_addr_ex(struct in6_addr *internet_addr);
273 token_t	*au_to_ip(struct ip *ip);
274 token_t	*au_to_ipc(char type, int id);
275 token_t	*au_to_ipc_perm(struct ipc_perm *perm);
276 token_t	*au_to_iport(uint16_t iport);
277 token_t	*au_to_opaque(char *data, uint16_t bytes);
278 token_t	*au_to_path(char *path);
279 token_t	*au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
280 	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
281 token_t	*au_to_process32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
282 	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
283 token_t	*au_to_process64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
284 	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
285 token_t	*au_to_process_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
286 	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
287 token_t	*au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid,
288 	    uid_t ruid, gid_t rgid, pid_t pid, au_asid_t sid,
289 	    au_tid_addr_t *tid);
290 token_t	*au_to_process64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
291 	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
292 token_t	*au_to_return(char status, uint32_t ret);
293 token_t	*au_to_return32(char status, uint32_t ret);
294 token_t	*au_to_return64(char status, uint64_t ret);
295 token_t	*au_to_seq(long audit_count);
296 
297 #if defined(_KERNEL) || defined(KERNEL)
298 token_t	*au_to_socket(struct socket *so);
299 token_t	*au_to_socket_ex_32(uint16_t lp, uint16_t rp, struct sockaddr *la,
300 	    struct sockaddr *ta);
301 token_t	*au_to_socket_ex_128(uint16_t lp, uint16_t rp, struct sockaddr *la,
302 	    struct sockaddr *ta);
303 #endif
304 
305 token_t	*au_to_sock_inet(struct sockaddr_in *so);
306 token_t	*au_to_sock_inet32(struct sockaddr_in *so);
307 token_t	*au_to_sock_inet128(struct sockaddr_in6 *so);
308 token_t	*au_to_sock_unix(struct sockaddr_un *so);
309 token_t	*au_to_subject(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
310 	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
311 token_t	*au_to_subject32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
312 	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
313 token_t	*au_to_subject64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
314 	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
315 token_t	*au_to_subject_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
316 	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
317 token_t	*au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
318 	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
319 token_t	*au_to_subject64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
320 	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
321 #if defined(_KERNEL) || defined(KERNEL)
322 token_t	*au_to_exec_args(char *args, int argc);
323 token_t	*au_to_exec_env(char *envs, int envc);
324 #else
325 token_t	*au_to_exec_args(char **argv);
326 token_t	*au_to_exec_env(char **envp);
327 #endif
328 token_t	*au_to_text(char *text);
329 token_t	*au_to_kevent(struct kevent *kev);
330 token_t	*au_to_trailer(int rec_size);
331 token_t	*au_to_zonename(char *zonename);
332 
333 __END_DECLS
334 
335 #endif /* ! _BSM_AUDIT_RECORD_H_ */
336