1718c8510SRobert Watson /* 2718c8510SRobert Watson * Copyright (c) 1999-2005 Apple Computer, Inc. 3718c8510SRobert Watson * All rights reserved. 4718c8510SRobert Watson * 5718c8510SRobert Watson * Redistribution and use in source and binary forms, with or without 6718c8510SRobert Watson * modification, are permitted provided that the following conditions 7718c8510SRobert Watson * are met: 8718c8510SRobert Watson * 1. Redistributions of source code must retain the above copyright 9718c8510SRobert Watson * notice, this list of conditions and the following disclaimer. 10718c8510SRobert Watson * 2. Redistributions in binary form must reproduce the above copyright 11718c8510SRobert Watson * notice, this list of conditions and the following disclaimer in the 12718c8510SRobert Watson * documentation and/or other materials provided with the distribution. 13718c8510SRobert Watson * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of 14718c8510SRobert Watson * its contributors may be used to endorse or promote products derived 15718c8510SRobert Watson * from this software without specific prior written permission. 16718c8510SRobert Watson * 17718c8510SRobert Watson * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 18718c8510SRobert Watson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19718c8510SRobert Watson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20718c8510SRobert Watson * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 21718c8510SRobert Watson * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22718c8510SRobert Watson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23718c8510SRobert Watson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24718c8510SRobert Watson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25718c8510SRobert Watson * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26718c8510SRobert Watson * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27718c8510SRobert Watson * POSSIBILITY OF SUCH DAMAGE. 28718c8510SRobert Watson * 29718c8510SRobert Watson * $FreeBSD$ 30718c8510SRobert Watson */ 31718c8510SRobert Watson 32718c8510SRobert Watson #include <sys/param.h> 33718c8510SRobert Watson #include <sys/filedesc.h> 34718c8510SRobert Watson #include <sys/ipc.h> 35718c8510SRobert Watson #include <sys/mount.h> 36718c8510SRobert Watson #include <sys/proc.h> 37718c8510SRobert Watson #include <sys/socket.h> 38718c8510SRobert Watson #include <sys/socketvar.h> 39718c8510SRobert Watson #include <sys/protosw.h> 40718c8510SRobert Watson #include <sys/domain.h> 415619113cSRobert Watson #include <sys/sbuf.h> 42718c8510SRobert Watson #include <sys/systm.h> 43718c8510SRobert Watson #include <sys/un.h> 44718c8510SRobert Watson #include <sys/vnode.h> 45718c8510SRobert Watson 46718c8510SRobert Watson #include <netinet/in.h> 47718c8510SRobert Watson #include <netinet/in_pcb.h> 48718c8510SRobert Watson 49718c8510SRobert Watson #include <security/audit/audit.h> 50718c8510SRobert Watson #include <security/audit/audit_private.h> 51718c8510SRobert Watson 52718c8510SRobert Watson /* 53718c8510SRobert Watson * Calls to manipulate elements of the audit record structure from system 54718c8510SRobert Watson * call code. Macro wrappers will prevent this functions from being 55718c8510SRobert Watson * entered if auditing is disabled, avoiding the function call cost. We 56718c8510SRobert Watson * check the thread audit record pointer anyway, as the audit condition 57718c8510SRobert Watson * could change, and pre-selection may not have allocated an audit 58718c8510SRobert Watson * record for this event. 59718c8510SRobert Watson * 60718c8510SRobert Watson * XXXAUDIT: Should we assert, in each case, that this field of the record 61718c8510SRobert Watson * hasn't already been filled in? 62718c8510SRobert Watson */ 63718c8510SRobert Watson void 64718c8510SRobert Watson audit_arg_addr(void * addr) 65718c8510SRobert Watson { 66718c8510SRobert Watson struct kaudit_record *ar; 67718c8510SRobert Watson 68718c8510SRobert Watson ar = currecord(); 69718c8510SRobert Watson if (ar == NULL) 70718c8510SRobert Watson return; 71718c8510SRobert Watson 72718c8510SRobert Watson ar->k_ar.ar_arg_addr = addr; 73718c8510SRobert Watson ARG_SET_VALID(ar, ARG_ADDR); 74718c8510SRobert Watson } 75718c8510SRobert Watson 76718c8510SRobert Watson void 77718c8510SRobert Watson audit_arg_exit(int status, int retval) 78718c8510SRobert Watson { 79718c8510SRobert Watson struct kaudit_record *ar; 80718c8510SRobert Watson 81718c8510SRobert Watson ar = currecord(); 82718c8510SRobert Watson if (ar == NULL) 83718c8510SRobert Watson return; 84718c8510SRobert Watson 85718c8510SRobert Watson ar->k_ar.ar_arg_exitstatus = status; 86718c8510SRobert Watson ar->k_ar.ar_arg_exitretval = retval; 87718c8510SRobert Watson ARG_SET_VALID(ar, ARG_EXIT); 88718c8510SRobert Watson } 89718c8510SRobert Watson 90718c8510SRobert Watson void 91718c8510SRobert Watson audit_arg_len(int len) 92718c8510SRobert Watson { 93718c8510SRobert Watson struct kaudit_record *ar; 94718c8510SRobert Watson 95718c8510SRobert Watson ar = currecord(); 96718c8510SRobert Watson if (ar == NULL) 97718c8510SRobert Watson return; 98718c8510SRobert Watson 99718c8510SRobert Watson ar->k_ar.ar_arg_len = len; 100718c8510SRobert Watson ARG_SET_VALID(ar, ARG_LEN); 101718c8510SRobert Watson } 102718c8510SRobert Watson 103718c8510SRobert Watson void 104718c8510SRobert Watson audit_arg_fd(int fd) 105718c8510SRobert Watson { 106718c8510SRobert Watson struct kaudit_record *ar; 107718c8510SRobert Watson 108718c8510SRobert Watson ar = currecord(); 109718c8510SRobert Watson if (ar == NULL) 110718c8510SRobert Watson return; 111718c8510SRobert Watson 112718c8510SRobert Watson ar->k_ar.ar_arg_fd = fd; 113718c8510SRobert Watson ARG_SET_VALID(ar, ARG_FD); 114718c8510SRobert Watson } 115718c8510SRobert Watson 116718c8510SRobert Watson void 117718c8510SRobert Watson audit_arg_fflags(int fflags) 118718c8510SRobert Watson { 119718c8510SRobert Watson struct kaudit_record *ar; 120718c8510SRobert Watson 121718c8510SRobert Watson ar = currecord(); 122718c8510SRobert Watson if (ar == NULL) 123718c8510SRobert Watson return; 124718c8510SRobert Watson 125718c8510SRobert Watson ar->k_ar.ar_arg_fflags = fflags; 126718c8510SRobert Watson ARG_SET_VALID(ar, ARG_FFLAGS); 127718c8510SRobert Watson } 128718c8510SRobert Watson 129718c8510SRobert Watson void 130718c8510SRobert Watson audit_arg_gid(gid_t gid) 131718c8510SRobert Watson { 132718c8510SRobert Watson struct kaudit_record *ar; 133718c8510SRobert Watson 134718c8510SRobert Watson ar = currecord(); 135718c8510SRobert Watson if (ar == NULL) 136718c8510SRobert Watson return; 137718c8510SRobert Watson 138718c8510SRobert Watson ar->k_ar.ar_arg_gid = gid; 139718c8510SRobert Watson ARG_SET_VALID(ar, ARG_GID); 140718c8510SRobert Watson } 141718c8510SRobert Watson 142718c8510SRobert Watson void 143718c8510SRobert Watson audit_arg_uid(uid_t uid) 144718c8510SRobert Watson { 145718c8510SRobert Watson struct kaudit_record *ar; 146718c8510SRobert Watson 147718c8510SRobert Watson ar = currecord(); 148718c8510SRobert Watson if (ar == NULL) 149718c8510SRobert Watson return; 150718c8510SRobert Watson 151718c8510SRobert Watson ar->k_ar.ar_arg_uid = uid; 152718c8510SRobert Watson ARG_SET_VALID(ar, ARG_UID); 153718c8510SRobert Watson } 154718c8510SRobert Watson 155718c8510SRobert Watson void 156718c8510SRobert Watson audit_arg_egid(gid_t egid) 157718c8510SRobert Watson { 158718c8510SRobert Watson struct kaudit_record *ar; 159718c8510SRobert Watson 160718c8510SRobert Watson ar = currecord(); 161718c8510SRobert Watson if (ar == NULL) 162718c8510SRobert Watson return; 163718c8510SRobert Watson 164718c8510SRobert Watson ar->k_ar.ar_arg_egid = egid; 165718c8510SRobert Watson ARG_SET_VALID(ar, ARG_EGID); 166718c8510SRobert Watson } 167718c8510SRobert Watson 168718c8510SRobert Watson void 169718c8510SRobert Watson audit_arg_euid(uid_t euid) 170718c8510SRobert Watson { 171718c8510SRobert Watson struct kaudit_record *ar; 172718c8510SRobert Watson 173718c8510SRobert Watson ar = currecord(); 174718c8510SRobert Watson if (ar == NULL) 175718c8510SRobert Watson return; 176718c8510SRobert Watson 177718c8510SRobert Watson ar->k_ar.ar_arg_euid = euid; 178718c8510SRobert Watson ARG_SET_VALID(ar, ARG_EUID); 179718c8510SRobert Watson } 180718c8510SRobert Watson 181718c8510SRobert Watson void 182718c8510SRobert Watson audit_arg_rgid(gid_t rgid) 183718c8510SRobert Watson { 184718c8510SRobert Watson struct kaudit_record *ar; 185718c8510SRobert Watson 186718c8510SRobert Watson ar = currecord(); 187718c8510SRobert Watson if (ar == NULL) 188718c8510SRobert Watson return; 189718c8510SRobert Watson 190718c8510SRobert Watson ar->k_ar.ar_arg_rgid = rgid; 191718c8510SRobert Watson ARG_SET_VALID(ar, ARG_RGID); 192718c8510SRobert Watson } 193718c8510SRobert Watson 194718c8510SRobert Watson void 195718c8510SRobert Watson audit_arg_ruid(uid_t ruid) 196718c8510SRobert Watson { 197718c8510SRobert Watson struct kaudit_record *ar; 198718c8510SRobert Watson 199718c8510SRobert Watson ar = currecord(); 200718c8510SRobert Watson if (ar == NULL) 201718c8510SRobert Watson return; 202718c8510SRobert Watson 203718c8510SRobert Watson ar->k_ar.ar_arg_ruid = ruid; 204718c8510SRobert Watson ARG_SET_VALID(ar, ARG_RUID); 205718c8510SRobert Watson } 206718c8510SRobert Watson 207718c8510SRobert Watson void 208718c8510SRobert Watson audit_arg_sgid(gid_t sgid) 209718c8510SRobert Watson { 210718c8510SRobert Watson struct kaudit_record *ar; 211718c8510SRobert Watson 212718c8510SRobert Watson ar = currecord(); 213718c8510SRobert Watson if (ar == NULL) 214718c8510SRobert Watson return; 215718c8510SRobert Watson 216718c8510SRobert Watson ar->k_ar.ar_arg_sgid = sgid; 217718c8510SRobert Watson ARG_SET_VALID(ar, ARG_SGID); 218718c8510SRobert Watson } 219718c8510SRobert Watson 220718c8510SRobert Watson void 221718c8510SRobert Watson audit_arg_suid(uid_t suid) 222718c8510SRobert Watson { 223718c8510SRobert Watson struct kaudit_record *ar; 224718c8510SRobert Watson 225718c8510SRobert Watson ar = currecord(); 226718c8510SRobert Watson if (ar == NULL) 227718c8510SRobert Watson return; 228718c8510SRobert Watson 229718c8510SRobert Watson ar->k_ar.ar_arg_suid = suid; 230718c8510SRobert Watson ARG_SET_VALID(ar, ARG_SUID); 231718c8510SRobert Watson } 232718c8510SRobert Watson 233718c8510SRobert Watson void 234718c8510SRobert Watson audit_arg_groupset(gid_t *gidset, u_int gidset_size) 235718c8510SRobert Watson { 236718c8510SRobert Watson int i; 237718c8510SRobert Watson struct kaudit_record *ar; 238718c8510SRobert Watson 239718c8510SRobert Watson ar = currecord(); 240718c8510SRobert Watson if (ar == NULL) 241718c8510SRobert Watson return; 242718c8510SRobert Watson 243718c8510SRobert Watson for (i = 0; i < gidset_size; i++) 244718c8510SRobert Watson ar->k_ar.ar_arg_groups.gidset[i] = gidset[i]; 245718c8510SRobert Watson ar->k_ar.ar_arg_groups.gidset_size = gidset_size; 246718c8510SRobert Watson ARG_SET_VALID(ar, ARG_GROUPSET); 247718c8510SRobert Watson } 248718c8510SRobert Watson 249718c8510SRobert Watson void 250718c8510SRobert Watson audit_arg_login(char *login) 251718c8510SRobert Watson { 252718c8510SRobert Watson struct kaudit_record *ar; 253718c8510SRobert Watson 254718c8510SRobert Watson ar = currecord(); 255718c8510SRobert Watson if (ar == NULL) 256718c8510SRobert Watson return; 257718c8510SRobert Watson 258718c8510SRobert Watson strlcpy(ar->k_ar.ar_arg_login, login, MAXLOGNAME); 259718c8510SRobert Watson ARG_SET_VALID(ar, ARG_LOGIN); 260718c8510SRobert Watson } 261718c8510SRobert Watson 262718c8510SRobert Watson void 263718c8510SRobert Watson audit_arg_ctlname(int *name, int namelen) 264718c8510SRobert Watson { 265718c8510SRobert Watson struct kaudit_record *ar; 266718c8510SRobert Watson 267718c8510SRobert Watson ar = currecord(); 268718c8510SRobert Watson if (ar == NULL) 269718c8510SRobert Watson return; 270718c8510SRobert Watson 271718c8510SRobert Watson bcopy(name, &ar->k_ar.ar_arg_ctlname, namelen * sizeof(int)); 272718c8510SRobert Watson ar->k_ar.ar_arg_len = namelen; 273718c8510SRobert Watson ARG_SET_VALID(ar, ARG_CTLNAME | ARG_LEN); 274718c8510SRobert Watson } 275718c8510SRobert Watson 276718c8510SRobert Watson void 277718c8510SRobert Watson audit_arg_mask(int mask) 278718c8510SRobert Watson { 279718c8510SRobert Watson struct kaudit_record *ar; 280718c8510SRobert Watson 281718c8510SRobert Watson ar = currecord(); 282718c8510SRobert Watson if (ar == NULL) 283718c8510SRobert Watson return; 284718c8510SRobert Watson 285718c8510SRobert Watson ar->k_ar.ar_arg_mask = mask; 286718c8510SRobert Watson ARG_SET_VALID(ar, ARG_MASK); 287718c8510SRobert Watson } 288718c8510SRobert Watson 289718c8510SRobert Watson void 290718c8510SRobert Watson audit_arg_mode(mode_t mode) 291718c8510SRobert Watson { 292718c8510SRobert Watson struct kaudit_record *ar; 293718c8510SRobert Watson 294718c8510SRobert Watson ar = currecord(); 295718c8510SRobert Watson if (ar == NULL) 296718c8510SRobert Watson return; 297718c8510SRobert Watson 298718c8510SRobert Watson ar->k_ar.ar_arg_mode = mode; 299718c8510SRobert Watson ARG_SET_VALID(ar, ARG_MODE); 300718c8510SRobert Watson } 301718c8510SRobert Watson 302718c8510SRobert Watson void 303718c8510SRobert Watson audit_arg_dev(int dev) 304718c8510SRobert Watson { 305718c8510SRobert Watson struct kaudit_record *ar; 306718c8510SRobert Watson 307718c8510SRobert Watson ar = currecord(); 308718c8510SRobert Watson if (ar == NULL) 309718c8510SRobert Watson return; 310718c8510SRobert Watson 311718c8510SRobert Watson ar->k_ar.ar_arg_dev = dev; 312718c8510SRobert Watson ARG_SET_VALID(ar, ARG_DEV); 313718c8510SRobert Watson } 314718c8510SRobert Watson 315718c8510SRobert Watson void 316718c8510SRobert Watson audit_arg_value(long value) 317718c8510SRobert Watson { 318718c8510SRobert Watson struct kaudit_record *ar; 319718c8510SRobert Watson 320718c8510SRobert Watson ar = currecord(); 321718c8510SRobert Watson if (ar == NULL) 322718c8510SRobert Watson return; 323718c8510SRobert Watson 324718c8510SRobert Watson ar->k_ar.ar_arg_value = value; 325718c8510SRobert Watson ARG_SET_VALID(ar, ARG_VALUE); 326718c8510SRobert Watson } 327718c8510SRobert Watson 328718c8510SRobert Watson void 329718c8510SRobert Watson audit_arg_owner(uid_t uid, gid_t gid) 330718c8510SRobert Watson { 331718c8510SRobert Watson struct kaudit_record *ar; 332718c8510SRobert Watson 333718c8510SRobert Watson ar = currecord(); 334718c8510SRobert Watson if (ar == NULL) 335718c8510SRobert Watson return; 336718c8510SRobert Watson 337718c8510SRobert Watson ar->k_ar.ar_arg_uid = uid; 338718c8510SRobert Watson ar->k_ar.ar_arg_gid = gid; 339718c8510SRobert Watson ARG_SET_VALID(ar, ARG_UID | ARG_GID); 340718c8510SRobert Watson } 341718c8510SRobert Watson 342718c8510SRobert Watson void 343718c8510SRobert Watson audit_arg_pid(pid_t pid) 344718c8510SRobert Watson { 345718c8510SRobert Watson struct kaudit_record *ar; 346718c8510SRobert Watson 347718c8510SRobert Watson ar = currecord(); 348718c8510SRobert Watson if (ar == NULL) 349718c8510SRobert Watson return; 350718c8510SRobert Watson 351718c8510SRobert Watson ar->k_ar.ar_arg_pid = pid; 352718c8510SRobert Watson ARG_SET_VALID(ar, ARG_PID); 353718c8510SRobert Watson } 354718c8510SRobert Watson 355718c8510SRobert Watson void 356718c8510SRobert Watson audit_arg_process(struct proc *p) 357718c8510SRobert Watson { 358718c8510SRobert Watson struct kaudit_record *ar; 359718c8510SRobert Watson 360814fe9e9SRobert Watson KASSERT(p != NULL, ("audit_arg_process: p == NULL")); 361814fe9e9SRobert Watson 362814fe9e9SRobert Watson PROC_LOCK_ASSERT(p, MA_OWNED); 363814fe9e9SRobert Watson 364718c8510SRobert Watson ar = currecord(); 365814fe9e9SRobert Watson if (ar == NULL) 366718c8510SRobert Watson return; 367718c8510SRobert Watson 368718c8510SRobert Watson ar->k_ar.ar_arg_auid = p->p_au->ai_auid; 369718c8510SRobert Watson ar->k_ar.ar_arg_euid = p->p_ucred->cr_uid; 370718c8510SRobert Watson ar->k_ar.ar_arg_egid = p->p_ucred->cr_groups[0]; 371718c8510SRobert Watson ar->k_ar.ar_arg_ruid = p->p_ucred->cr_ruid; 372718c8510SRobert Watson ar->k_ar.ar_arg_rgid = p->p_ucred->cr_rgid; 373718c8510SRobert Watson ar->k_ar.ar_arg_asid = p->p_au->ai_asid; 374718c8510SRobert Watson ar->k_ar.ar_arg_termid = p->p_au->ai_termid; 3755619113cSRobert Watson ar->k_ar.ar_arg_pid = p->p_pid; 376718c8510SRobert Watson ARG_SET_VALID(ar, ARG_AUID | ARG_EUID | ARG_EGID | ARG_RUID | 3775619113cSRobert Watson ARG_RGID | ARG_ASID | ARG_TERMID | ARG_PID | ARG_PROCESS); 378718c8510SRobert Watson } 379718c8510SRobert Watson 380718c8510SRobert Watson void 381718c8510SRobert Watson audit_arg_signum(u_int signum) 382718c8510SRobert Watson { 383718c8510SRobert Watson struct kaudit_record *ar; 384718c8510SRobert Watson 385718c8510SRobert Watson ar = currecord(); 386718c8510SRobert Watson if (ar == NULL) 387718c8510SRobert Watson return; 388718c8510SRobert Watson 389718c8510SRobert Watson ar->k_ar.ar_arg_signum = signum; 390718c8510SRobert Watson ARG_SET_VALID(ar, ARG_SIGNUM); 391718c8510SRobert Watson } 392718c8510SRobert Watson 393718c8510SRobert Watson void 394718c8510SRobert Watson audit_arg_socket(int sodomain, int sotype, int soprotocol) 395718c8510SRobert Watson { 396718c8510SRobert Watson struct kaudit_record *ar; 397718c8510SRobert Watson 398718c8510SRobert Watson ar = currecord(); 399718c8510SRobert Watson if (ar == NULL) 400718c8510SRobert Watson return; 401718c8510SRobert Watson 402718c8510SRobert Watson ar->k_ar.ar_arg_sockinfo.so_domain = sodomain; 403718c8510SRobert Watson ar->k_ar.ar_arg_sockinfo.so_type = sotype; 404718c8510SRobert Watson ar->k_ar.ar_arg_sockinfo.so_protocol = soprotocol; 405718c8510SRobert Watson ARG_SET_VALID(ar, ARG_SOCKINFO); 406718c8510SRobert Watson } 407718c8510SRobert Watson 408718c8510SRobert Watson void 409814fe9e9SRobert Watson audit_arg_sockaddr(struct thread *td, struct sockaddr *sa) 410718c8510SRobert Watson { 411718c8510SRobert Watson struct kaudit_record *ar; 412718c8510SRobert Watson 413814fe9e9SRobert Watson KASSERT(td != NULL, ("audit_arg_sockaddr: td == NULL")); 414814fe9e9SRobert Watson KASSERT(sa != NULL, ("audit_arg_sockaddr: sa == NULL")); 415814fe9e9SRobert Watson 416718c8510SRobert Watson ar = currecord(); 417814fe9e9SRobert Watson if (ar == NULL) 418718c8510SRobert Watson return; 419718c8510SRobert Watson 420814fe9e9SRobert Watson bcopy(sa, &ar->k_ar.ar_arg_sockaddr, 421814fe9e9SRobert Watson sizeof(ar->k_ar.ar_arg_sockaddr)); 422814fe9e9SRobert Watson switch (sa->sa_family) { 423718c8510SRobert Watson case AF_INET: 424718c8510SRobert Watson ARG_SET_VALID(ar, ARG_SADDRINET); 425718c8510SRobert Watson break; 426718c8510SRobert Watson 427718c8510SRobert Watson case AF_INET6: 428718c8510SRobert Watson ARG_SET_VALID(ar, ARG_SADDRINET6); 429718c8510SRobert Watson break; 430718c8510SRobert Watson 431718c8510SRobert Watson case AF_UNIX: 432814fe9e9SRobert Watson audit_arg_upath(td, ((struct sockaddr_un *)sa)->sun_path, 433718c8510SRobert Watson ARG_UPATH1); 434718c8510SRobert Watson ARG_SET_VALID(ar, ARG_SADDRUNIX); 435718c8510SRobert Watson break; 436718c8510SRobert Watson /* XXXAUDIT: default:? */ 437718c8510SRobert Watson } 438718c8510SRobert Watson } 439718c8510SRobert Watson 440718c8510SRobert Watson void 441718c8510SRobert Watson audit_arg_auid(uid_t auid) 442718c8510SRobert Watson { 443718c8510SRobert Watson struct kaudit_record *ar; 444718c8510SRobert Watson 445718c8510SRobert Watson ar = currecord(); 446718c8510SRobert Watson if (ar == NULL) 447718c8510SRobert Watson return; 448718c8510SRobert Watson 449718c8510SRobert Watson ar->k_ar.ar_arg_auid = auid; 450718c8510SRobert Watson ARG_SET_VALID(ar, ARG_AUID); 451718c8510SRobert Watson } 452718c8510SRobert Watson 453718c8510SRobert Watson void 454718c8510SRobert Watson audit_arg_auditinfo(struct auditinfo *au_info) 455718c8510SRobert Watson { 456718c8510SRobert Watson struct kaudit_record *ar; 457718c8510SRobert Watson 458718c8510SRobert Watson ar = currecord(); 459718c8510SRobert Watson if (ar == NULL) 460718c8510SRobert Watson return; 461718c8510SRobert Watson 462718c8510SRobert Watson ar->k_ar.ar_arg_auid = au_info->ai_auid; 463718c8510SRobert Watson ar->k_ar.ar_arg_asid = au_info->ai_asid; 464718c8510SRobert Watson ar->k_ar.ar_arg_amask.am_success = au_info->ai_mask.am_success; 465718c8510SRobert Watson ar->k_ar.ar_arg_amask.am_failure = au_info->ai_mask.am_failure; 466718c8510SRobert Watson ar->k_ar.ar_arg_termid.port = au_info->ai_termid.port; 467718c8510SRobert Watson ar->k_ar.ar_arg_termid.machine = au_info->ai_termid.machine; 468718c8510SRobert Watson ARG_SET_VALID(ar, ARG_AUID | ARG_ASID | ARG_AMASK | ARG_TERMID); 469718c8510SRobert Watson } 470718c8510SRobert Watson 471718c8510SRobert Watson void 472718c8510SRobert Watson audit_arg_text(char *text) 473718c8510SRobert Watson { 474718c8510SRobert Watson struct kaudit_record *ar; 475718c8510SRobert Watson 476814fe9e9SRobert Watson KASSERT(text != NULL, ("audit_arg_text: text == NULL")); 477814fe9e9SRobert Watson 478718c8510SRobert Watson ar = currecord(); 479718c8510SRobert Watson if (ar == NULL) 480718c8510SRobert Watson return; 481718c8510SRobert Watson 482718c8510SRobert Watson /* Invalidate the text string */ 483718c8510SRobert Watson ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_TEXT); 484718c8510SRobert Watson 485718c8510SRobert Watson if (ar->k_ar.ar_arg_text == NULL) 486718c8510SRobert Watson ar->k_ar.ar_arg_text = malloc(MAXPATHLEN, M_AUDITTEXT, 487718c8510SRobert Watson M_WAITOK); 488718c8510SRobert Watson 489718c8510SRobert Watson strncpy(ar->k_ar.ar_arg_text, text, MAXPATHLEN); 490718c8510SRobert Watson ARG_SET_VALID(ar, ARG_TEXT); 491718c8510SRobert Watson } 492718c8510SRobert Watson 493718c8510SRobert Watson void 494718c8510SRobert Watson audit_arg_cmd(int cmd) 495718c8510SRobert Watson { 496718c8510SRobert Watson struct kaudit_record *ar; 497718c8510SRobert Watson 498718c8510SRobert Watson ar = currecord(); 499718c8510SRobert Watson if (ar == NULL) 500718c8510SRobert Watson return; 501718c8510SRobert Watson 502718c8510SRobert Watson ar->k_ar.ar_arg_cmd = cmd; 503718c8510SRobert Watson ARG_SET_VALID(ar, ARG_CMD); 504718c8510SRobert Watson } 505718c8510SRobert Watson 506718c8510SRobert Watson void 507718c8510SRobert Watson audit_arg_svipc_cmd(int cmd) 508718c8510SRobert Watson { 509718c8510SRobert Watson struct kaudit_record *ar; 510718c8510SRobert Watson 511718c8510SRobert Watson ar = currecord(); 512718c8510SRobert Watson if (ar == NULL) 513718c8510SRobert Watson return; 514718c8510SRobert Watson 515718c8510SRobert Watson ar->k_ar.ar_arg_svipc_cmd = cmd; 516718c8510SRobert Watson ARG_SET_VALID(ar, ARG_SVIPC_CMD); 517718c8510SRobert Watson } 518718c8510SRobert Watson 519718c8510SRobert Watson void 520718c8510SRobert Watson audit_arg_svipc_perm(struct ipc_perm *perm) 521718c8510SRobert Watson { 522718c8510SRobert Watson struct kaudit_record *ar; 523718c8510SRobert Watson 524718c8510SRobert Watson ar = currecord(); 525718c8510SRobert Watson if (ar == NULL) 526718c8510SRobert Watson return; 527718c8510SRobert Watson 528718c8510SRobert Watson bcopy(perm, &ar->k_ar.ar_arg_svipc_perm, 529718c8510SRobert Watson sizeof(ar->k_ar.ar_arg_svipc_perm)); 530718c8510SRobert Watson ARG_SET_VALID(ar, ARG_SVIPC_PERM); 531718c8510SRobert Watson } 532718c8510SRobert Watson 533718c8510SRobert Watson void 534718c8510SRobert Watson audit_arg_svipc_id(int id) 535718c8510SRobert Watson { 536718c8510SRobert Watson struct kaudit_record *ar; 537718c8510SRobert Watson 538718c8510SRobert Watson ar = currecord(); 539718c8510SRobert Watson if (ar == NULL) 540718c8510SRobert Watson return; 541718c8510SRobert Watson 542718c8510SRobert Watson ar->k_ar.ar_arg_svipc_id = id; 543718c8510SRobert Watson ARG_SET_VALID(ar, ARG_SVIPC_ID); 544718c8510SRobert Watson } 545718c8510SRobert Watson 546718c8510SRobert Watson void 547718c8510SRobert Watson audit_arg_svipc_addr(void * addr) 548718c8510SRobert Watson { 549718c8510SRobert Watson struct kaudit_record *ar; 550718c8510SRobert Watson 551718c8510SRobert Watson ar = currecord(); 552718c8510SRobert Watson if (ar == NULL) 553718c8510SRobert Watson return; 554718c8510SRobert Watson 555718c8510SRobert Watson ar->k_ar.ar_arg_svipc_addr = addr; 556718c8510SRobert Watson ARG_SET_VALID(ar, ARG_SVIPC_ADDR); 557718c8510SRobert Watson } 558718c8510SRobert Watson 559718c8510SRobert Watson void 560718c8510SRobert Watson audit_arg_posix_ipc_perm(uid_t uid, gid_t gid, mode_t mode) 561718c8510SRobert Watson { 562718c8510SRobert Watson struct kaudit_record *ar; 563718c8510SRobert Watson 564718c8510SRobert Watson ar = currecord(); 565718c8510SRobert Watson if (ar == NULL) 566718c8510SRobert Watson return; 567718c8510SRobert Watson 568718c8510SRobert Watson ar->k_ar.ar_arg_pipc_perm.pipc_uid = uid; 569718c8510SRobert Watson ar->k_ar.ar_arg_pipc_perm.pipc_gid = gid; 570718c8510SRobert Watson ar->k_ar.ar_arg_pipc_perm.pipc_mode = mode; 571718c8510SRobert Watson ARG_SET_VALID(ar, ARG_POSIX_IPC_PERM); 572718c8510SRobert Watson } 573718c8510SRobert Watson 574718c8510SRobert Watson void 575718c8510SRobert Watson audit_arg_auditon(union auditon_udata *udata) 576718c8510SRobert Watson { 577718c8510SRobert Watson struct kaudit_record *ar; 578718c8510SRobert Watson 579718c8510SRobert Watson ar = currecord(); 580718c8510SRobert Watson if (ar == NULL) 581718c8510SRobert Watson return; 582718c8510SRobert Watson 583718c8510SRobert Watson bcopy((void *)udata, &ar->k_ar.ar_arg_auditon, 584718c8510SRobert Watson sizeof(ar->k_ar.ar_arg_auditon)); 585718c8510SRobert Watson ARG_SET_VALID(ar, ARG_AUDITON); 586718c8510SRobert Watson } 587718c8510SRobert Watson 588718c8510SRobert Watson /* 589718c8510SRobert Watson * Audit information about a file, either the file's vnode info, or its 590718c8510SRobert Watson * socket address info. 591718c8510SRobert Watson */ 592718c8510SRobert Watson void 593718c8510SRobert Watson audit_arg_file(struct proc *p, struct file *fp) 594718c8510SRobert Watson { 595718c8510SRobert Watson struct kaudit_record *ar; 596718c8510SRobert Watson struct socket *so; 597718c8510SRobert Watson struct inpcb *pcb; 598718c8510SRobert Watson struct vnode *vp; 599718c8510SRobert Watson int vfslocked; 600718c8510SRobert Watson 601814fe9e9SRobert Watson ar = currecord(); 602814fe9e9SRobert Watson if (ar == NULL) 603814fe9e9SRobert Watson return; 604814fe9e9SRobert Watson 605718c8510SRobert Watson switch (fp->f_type) { 606718c8510SRobert Watson case DTYPE_VNODE: 607718c8510SRobert Watson case DTYPE_FIFO: 608718c8510SRobert Watson /* 609718c8510SRobert Watson * XXXAUDIT: Only possibly to record as first vnode? 610718c8510SRobert Watson */ 611718c8510SRobert Watson vp = fp->f_vnode; 612718c8510SRobert Watson vfslocked = VFS_LOCK_GIANT(vp->v_mount); 613718c8510SRobert Watson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, curthread); 614718c8510SRobert Watson audit_arg_vnode(vp, ARG_VNODE1); 615718c8510SRobert Watson VOP_UNLOCK(vp, 0, curthread); 616718c8510SRobert Watson VFS_UNLOCK_GIANT(vfslocked); 617718c8510SRobert Watson break; 618718c8510SRobert Watson 619718c8510SRobert Watson case DTYPE_SOCKET: 620718c8510SRobert Watson so = (struct socket *)fp->f_data; 621814fe9e9SRobert Watson SOCK_LOCK(so); 622718c8510SRobert Watson if (INP_CHECK_SOCKAF(so, PF_INET)) { 623718c8510SRobert Watson if (so->so_pcb == NULL) 624718c8510SRobert Watson return; 625718c8510SRobert Watson ar->k_ar.ar_arg_sockinfo.so_type = 626718c8510SRobert Watson so->so_type; 627718c8510SRobert Watson ar->k_ar.ar_arg_sockinfo.so_domain = 628718c8510SRobert Watson INP_SOCKAF(so); 629718c8510SRobert Watson ar->k_ar.ar_arg_sockinfo.so_protocol = 630718c8510SRobert Watson so->so_proto->pr_protocol; 631718c8510SRobert Watson pcb = (struct inpcb *)so->so_pcb; 632718c8510SRobert Watson ar->k_ar.ar_arg_sockinfo.so_raddr = 633718c8510SRobert Watson pcb->inp_faddr.s_addr; 634718c8510SRobert Watson ar->k_ar.ar_arg_sockinfo.so_laddr = 635718c8510SRobert Watson pcb->inp_laddr.s_addr; 636718c8510SRobert Watson ar->k_ar.ar_arg_sockinfo.so_rport = 637718c8510SRobert Watson pcb->inp_fport; 638718c8510SRobert Watson ar->k_ar.ar_arg_sockinfo.so_lport = 639718c8510SRobert Watson pcb->inp_lport; 640718c8510SRobert Watson ARG_SET_VALID(ar, ARG_SOCKINFO); 641718c8510SRobert Watson } 642814fe9e9SRobert Watson SOCK_UNLOCK(so); 643718c8510SRobert Watson break; 644718c8510SRobert Watson 645718c8510SRobert Watson default: 646718c8510SRobert Watson /* XXXAUDIT: else? */ 647718c8510SRobert Watson break; 648718c8510SRobert Watson } 649718c8510SRobert Watson 650718c8510SRobert Watson } 651718c8510SRobert Watson 652718c8510SRobert Watson /* 653718c8510SRobert Watson * Store a path as given by the user process for auditing into the audit 654871499feSRobert Watson * record stored on the user thread. This function will allocate the memory 655871499feSRobert Watson * to store the path info if not already available. This memory will be freed 656871499feSRobert Watson * when the audit record is freed. 657718c8510SRobert Watson * 658718c8510SRobert Watson * XXXAUDIT: Possibly assert that the memory isn't already allocated? 659718c8510SRobert Watson */ 660718c8510SRobert Watson void 661718c8510SRobert Watson audit_arg_upath(struct thread *td, char *upath, u_int64_t flag) 662718c8510SRobert Watson { 663718c8510SRobert Watson struct kaudit_record *ar; 664718c8510SRobert Watson char **pathp; 665718c8510SRobert Watson 666814fe9e9SRobert Watson KASSERT(td != NULL, ("audit_arg_upath: td == NULL")); 667814fe9e9SRobert Watson KASSERT(upath != NULL, ("audit_arg_upath: upath == NULL")); 668814fe9e9SRobert Watson 669814fe9e9SRobert Watson ar = currecord(); 670814fe9e9SRobert Watson if (ar == NULL) 671814fe9e9SRobert Watson return; 672718c8510SRobert Watson 673718c8510SRobert Watson /* 674718c8510SRobert Watson * XXXAUDIT: Witness warning for possible sleep here? 675718c8510SRobert Watson */ 676718c8510SRobert Watson KASSERT((flag == ARG_UPATH1) || (flag == ARG_UPATH2), 677fac3e318SRobert Watson ("audit_arg_upath: flag %llu", (unsigned long long)flag)); 678718c8510SRobert Watson KASSERT((flag != ARG_UPATH1) || (flag != ARG_UPATH2), 679fac3e318SRobert Watson ("audit_arg_upath: flag %llu", (unsigned long long)flag)); 680718c8510SRobert Watson 681718c8510SRobert Watson if (flag == ARG_UPATH1) 682718c8510SRobert Watson pathp = &ar->k_ar.ar_arg_upath1; 683718c8510SRobert Watson else 684718c8510SRobert Watson pathp = &ar->k_ar.ar_arg_upath2; 685718c8510SRobert Watson 686718c8510SRobert Watson if (*pathp == NULL) 687718c8510SRobert Watson *pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK); 688718c8510SRobert Watson 689718c8510SRobert Watson canon_path(td, upath, *pathp); 690718c8510SRobert Watson 691718c8510SRobert Watson ARG_SET_VALID(ar, flag); 692718c8510SRobert Watson } 693718c8510SRobert Watson 694718c8510SRobert Watson /* 695718c8510SRobert Watson * Function to save the path and vnode attr information into the audit 696718c8510SRobert Watson * record. 697718c8510SRobert Watson * 698718c8510SRobert Watson * It is assumed that the caller will hold any vnode locks necessary to 699718c8510SRobert Watson * perform a VOP_GETATTR() on the passed vnode. 700718c8510SRobert Watson * 701718c8510SRobert Watson * XXX: The attr code is very similar to vfs_vnops.c:vn_stat(), but 702718c8510SRobert Watson * always provides access to the generation number as we need that 703718c8510SRobert Watson * to construct the BSM file ID. 704718c8510SRobert Watson * XXX: We should accept the process argument from the caller, since 705718c8510SRobert Watson * it's very likely they already have a reference. 706718c8510SRobert Watson * XXX: Error handling in this function is poor. 707718c8510SRobert Watson * 708718c8510SRobert Watson * XXXAUDIT: Possibly KASSERT the path pointer is NULL? 709718c8510SRobert Watson */ 710718c8510SRobert Watson void 711718c8510SRobert Watson audit_arg_vnode(struct vnode *vp, u_int64_t flags) 712718c8510SRobert Watson { 713718c8510SRobert Watson struct kaudit_record *ar; 714718c8510SRobert Watson struct vattr vattr; 715718c8510SRobert Watson int error; 716718c8510SRobert Watson struct vnode_au_info *vnp; 717718c8510SRobert Watson 718814fe9e9SRobert Watson KASSERT(vp != NULL, ("audit_arg_vnode: vp == NULL")); 719814fe9e9SRobert Watson KASSERT((flags == ARG_VNODE1) || (flags == ARG_VNODE2), 720814fe9e9SRobert Watson ("audit_arg_vnode: flags %jd", (intmax_t)flags)); 721718c8510SRobert Watson 722718c8510SRobert Watson /* 723718c8510SRobert Watson * Assume that if the caller is calling audit_arg_vnode() on a 724718c8510SRobert Watson * non-MPSAFE vnode, then it will have acquired Giant. 725718c8510SRobert Watson */ 726718c8510SRobert Watson VFS_ASSERT_GIANT(vp->v_mount); 727718c8510SRobert Watson ASSERT_VOP_LOCKED(vp, "audit_arg_vnode"); 728718c8510SRobert Watson 729718c8510SRobert Watson ar = currecord(); 730871499feSRobert Watson if (ar == NULL) 731718c8510SRobert Watson return; 732718c8510SRobert Watson 733718c8510SRobert Watson /* 734718c8510SRobert Watson * XXXAUDIT: The below clears, and then resets the flags for valid 735718c8510SRobert Watson * arguments. Ideally, either the new vnode is used, or the old one 736718c8510SRobert Watson * would be. 737718c8510SRobert Watson */ 738718c8510SRobert Watson if (flags & ARG_VNODE1) { 739718c8510SRobert Watson ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_VNODE1); 740718c8510SRobert Watson vnp = &ar->k_ar.ar_arg_vnode1; 741718c8510SRobert Watson } else { 742718c8510SRobert Watson ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_VNODE2); 743718c8510SRobert Watson vnp = &ar->k_ar.ar_arg_vnode2; 744718c8510SRobert Watson } 745718c8510SRobert Watson 746814fe9e9SRobert Watson error = VOP_GETATTR(vp, &vattr, curthread->td_ucred, curthread); 747718c8510SRobert Watson if (error) { 748718c8510SRobert Watson /* XXX: How to handle this case? */ 749718c8510SRobert Watson return; 750718c8510SRobert Watson } 751718c8510SRobert Watson 752718c8510SRobert Watson vnp->vn_mode = vattr.va_mode; 753718c8510SRobert Watson vnp->vn_uid = vattr.va_uid; 754718c8510SRobert Watson vnp->vn_gid = vattr.va_gid; 755718c8510SRobert Watson vnp->vn_dev = vattr.va_rdev; 756718c8510SRobert Watson vnp->vn_fsid = vattr.va_fsid; 757718c8510SRobert Watson vnp->vn_fileid = vattr.va_fileid; 758718c8510SRobert Watson vnp->vn_gen = vattr.va_gen; 759718c8510SRobert Watson if (flags & ARG_VNODE1) 760718c8510SRobert Watson ARG_SET_VALID(ar, ARG_VNODE1); 761718c8510SRobert Watson else 762718c8510SRobert Watson ARG_SET_VALID(ar, ARG_VNODE2); 763718c8510SRobert Watson } 764718c8510SRobert Watson 765718c8510SRobert Watson /* 766871499feSRobert Watson * The close() system call uses it's own audit call to capture the path/vnode 767871499feSRobert Watson * information because those pieces are not easily obtained within the system 768871499feSRobert Watson * call itself. 769718c8510SRobert Watson */ 770718c8510SRobert Watson void 771718c8510SRobert Watson audit_sysclose(struct thread *td, int fd) 772718c8510SRobert Watson { 773814fe9e9SRobert Watson struct kaudit_record *ar; 774718c8510SRobert Watson struct vnode *vp; 775718c8510SRobert Watson struct file *fp; 776718c8510SRobert Watson int vfslocked; 777718c8510SRobert Watson 778814fe9e9SRobert Watson KASSERT(td != NULL, ("audit_sysclose: td == NULL")); 779814fe9e9SRobert Watson 780814fe9e9SRobert Watson ar = currecord(); 781814fe9e9SRobert Watson if (ar == NULL) 782814fe9e9SRobert Watson return; 783814fe9e9SRobert Watson 784718c8510SRobert Watson audit_arg_fd(fd); 785718c8510SRobert Watson 786718c8510SRobert Watson if (getvnode(td->td_proc->p_fd, fd, &fp) != 0) 787718c8510SRobert Watson return; 788718c8510SRobert Watson 789718c8510SRobert Watson vp = fp->f_vnode; 790718c8510SRobert Watson vfslocked = VFS_LOCK_GIANT(vp->v_mount); 791718c8510SRobert Watson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 792718c8510SRobert Watson audit_arg_vnode(vp, ARG_VNODE1); 793718c8510SRobert Watson VOP_UNLOCK(vp, 0, td); 794718c8510SRobert Watson VFS_UNLOCK_GIANT(vfslocked); 795718c8510SRobert Watson fdrop(fp, td); 796718c8510SRobert Watson } 797