xref: /freebsd/sys/security/audit/audit_arg.c (revision 1dfcff294e44d4b45813288ef4095c36abb22f0e)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1999-2005 Apple Inc.
5  * Copyright (c) 2016-2017 Robert N. M. Watson
6  * All rights reserved.
7  *
8  * Portions of this software were developed by BAE Systems, the University of
9  * Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL
10  * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent
11  * Computing (TC) research program.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1.  Redistributions of source code must retain the above copyright
17  *     notice, this list of conditions and the following disclaimer.
18  * 2.  Redistributions in binary form must reproduce the above copyright
19  *     notice, this list of conditions and the following disclaimer in the
20  *     documentation and/or other materials provided with the distribution.
21  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
22  *     its contributors may be used to endorse or promote products derived
23  *     from this software without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
29  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
33  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
34  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 #include <sys/cdefs.h>
39 __FBSDID("$FreeBSD$");
40 
41 #include <sys/param.h>
42 #include <sys/filedesc.h>
43 #include <sys/capsicum.h>
44 #include <sys/ipc.h>
45 #include <sys/mount.h>
46 #include <sys/proc.h>
47 #include <sys/socket.h>
48 #include <sys/socketvar.h>
49 #include <sys/protosw.h>
50 #include <sys/domain.h>
51 #include <sys/sbuf.h>
52 #include <sys/systm.h>
53 #include <sys/un.h>
54 #include <sys/vnode.h>
55 
56 #include <netinet/in.h>
57 #include <netinet/in_pcb.h>
58 
59 #include <security/audit/audit.h>
60 #include <security/audit/audit_private.h>
61 
62 /*
63  * Calls to manipulate elements of the audit record structure from system
64  * call code.  Macro wrappers will prevent this functions from being entered
65  * if auditing is disabled, avoiding the function call cost.  We check the
66  * thread audit record pointer anyway, as the audit condition could change,
67  * and pre-selection may not have allocated an audit record for this event.
68  *
69  * XXXAUDIT: Should we assert, in each case, that this field of the record
70  * hasn't already been filled in?
71  */
72 void
73 audit_arg_addr(void *addr)
74 {
75 	struct kaudit_record *ar;
76 
77 	ar = currecord();
78 	if (ar == NULL)
79 		return;
80 
81 	ar->k_ar.ar_arg_addr = addr;
82 	ARG_SET_VALID(ar, ARG_ADDR);
83 }
84 
85 void
86 audit_arg_exit(int status, int retval)
87 {
88 	struct kaudit_record *ar;
89 
90 	ar = currecord();
91 	if (ar == NULL)
92 		return;
93 
94 	ar->k_ar.ar_arg_exitstatus = status;
95 	ar->k_ar.ar_arg_exitretval = retval;
96 	ARG_SET_VALID(ar, ARG_EXIT);
97 }
98 
99 void
100 audit_arg_len(int len)
101 {
102 	struct kaudit_record *ar;
103 
104 	ar = currecord();
105 	if (ar == NULL)
106 		return;
107 
108 	ar->k_ar.ar_arg_len = len;
109 	ARG_SET_VALID(ar, ARG_LEN);
110 }
111 
112 void
113 audit_arg_atfd1(int atfd)
114 {
115 	struct kaudit_record *ar;
116 
117 	ar = currecord();
118 	if (ar == NULL)
119 		return;
120 
121 	ar->k_ar.ar_arg_atfd1 = atfd;
122 	ARG_SET_VALID(ar, ARG_ATFD1);
123 }
124 
125 void
126 audit_arg_atfd2(int atfd)
127 {
128 	struct kaudit_record *ar;
129 
130 	ar = currecord();
131 	if (ar == NULL)
132 		return;
133 
134 	ar->k_ar.ar_arg_atfd2 = atfd;
135 	ARG_SET_VALID(ar, ARG_ATFD2);
136 }
137 
138 void
139 audit_arg_fd(int fd)
140 {
141 	struct kaudit_record *ar;
142 
143 	ar = currecord();
144 	if (ar == NULL)
145 		return;
146 
147 	ar->k_ar.ar_arg_fd = fd;
148 	ARG_SET_VALID(ar, ARG_FD);
149 }
150 
151 void
152 audit_arg_fflags(int fflags)
153 {
154 	struct kaudit_record *ar;
155 
156 	ar = currecord();
157 	if (ar == NULL)
158 		return;
159 
160 	ar->k_ar.ar_arg_fflags = fflags;
161 	ARG_SET_VALID(ar, ARG_FFLAGS);
162 }
163 
164 void
165 audit_arg_gid(gid_t gid)
166 {
167 	struct kaudit_record *ar;
168 
169 	ar = currecord();
170 	if (ar == NULL)
171 		return;
172 
173 	ar->k_ar.ar_arg_gid = gid;
174 	ARG_SET_VALID(ar, ARG_GID);
175 }
176 
177 void
178 audit_arg_uid(uid_t uid)
179 {
180 	struct kaudit_record *ar;
181 
182 	ar = currecord();
183 	if (ar == NULL)
184 		return;
185 
186 	ar->k_ar.ar_arg_uid = uid;
187 	ARG_SET_VALID(ar, ARG_UID);
188 }
189 
190 void
191 audit_arg_egid(gid_t egid)
192 {
193 	struct kaudit_record *ar;
194 
195 	ar = currecord();
196 	if (ar == NULL)
197 		return;
198 
199 	ar->k_ar.ar_arg_egid = egid;
200 	ARG_SET_VALID(ar, ARG_EGID);
201 }
202 
203 void
204 audit_arg_euid(uid_t euid)
205 {
206 	struct kaudit_record *ar;
207 
208 	ar = currecord();
209 	if (ar == NULL)
210 		return;
211 
212 	ar->k_ar.ar_arg_euid = euid;
213 	ARG_SET_VALID(ar, ARG_EUID);
214 }
215 
216 void
217 audit_arg_rgid(gid_t rgid)
218 {
219 	struct kaudit_record *ar;
220 
221 	ar = currecord();
222 	if (ar == NULL)
223 		return;
224 
225 	ar->k_ar.ar_arg_rgid = rgid;
226 	ARG_SET_VALID(ar, ARG_RGID);
227 }
228 
229 void
230 audit_arg_ruid(uid_t ruid)
231 {
232 	struct kaudit_record *ar;
233 
234 	ar = currecord();
235 	if (ar == NULL)
236 		return;
237 
238 	ar->k_ar.ar_arg_ruid = ruid;
239 	ARG_SET_VALID(ar, ARG_RUID);
240 }
241 
242 void
243 audit_arg_sgid(gid_t sgid)
244 {
245 	struct kaudit_record *ar;
246 
247 	ar = currecord();
248 	if (ar == NULL)
249 		return;
250 
251 	ar->k_ar.ar_arg_sgid = sgid;
252 	ARG_SET_VALID(ar, ARG_SGID);
253 }
254 
255 void
256 audit_arg_suid(uid_t suid)
257 {
258 	struct kaudit_record *ar;
259 
260 	ar = currecord();
261 	if (ar == NULL)
262 		return;
263 
264 	ar->k_ar.ar_arg_suid = suid;
265 	ARG_SET_VALID(ar, ARG_SUID);
266 }
267 
268 void
269 audit_arg_groupset(gid_t *gidset, u_int gidset_size)
270 {
271 	u_int i;
272 	struct kaudit_record *ar;
273 
274 	KASSERT(gidset_size <= ngroups_max + 1,
275 	    ("audit_arg_groupset: gidset_size > (kern.ngroups + 1)"));
276 
277 	ar = currecord();
278 	if (ar == NULL)
279 		return;
280 
281 	if (ar->k_ar.ar_arg_groups.gidset == NULL)
282 		ar->k_ar.ar_arg_groups.gidset = malloc(
283 		    sizeof(gid_t) * gidset_size, M_AUDITGIDSET, M_WAITOK);
284 
285 	for (i = 0; i < gidset_size; i++)
286 		ar->k_ar.ar_arg_groups.gidset[i] = gidset[i];
287 	ar->k_ar.ar_arg_groups.gidset_size = gidset_size;
288 	ARG_SET_VALID(ar, ARG_GROUPSET);
289 }
290 
291 void
292 audit_arg_login(char *login)
293 {
294 	struct kaudit_record *ar;
295 
296 	ar = currecord();
297 	if (ar == NULL)
298 		return;
299 
300 	strlcpy(ar->k_ar.ar_arg_login, login, MAXLOGNAME);
301 	ARG_SET_VALID(ar, ARG_LOGIN);
302 }
303 
304 void
305 audit_arg_ctlname(int *name, int namelen)
306 {
307 	struct kaudit_record *ar;
308 
309 	ar = currecord();
310 	if (ar == NULL)
311 		return;
312 
313 	bcopy(name, &ar->k_ar.ar_arg_ctlname, namelen * sizeof(int));
314 	ar->k_ar.ar_arg_len = namelen;
315 	ARG_SET_VALID(ar, ARG_CTLNAME | ARG_LEN);
316 }
317 
318 void
319 audit_arg_mask(int mask)
320 {
321 	struct kaudit_record *ar;
322 
323 	ar = currecord();
324 	if (ar == NULL)
325 		return;
326 
327 	ar->k_ar.ar_arg_mask = mask;
328 	ARG_SET_VALID(ar, ARG_MASK);
329 }
330 
331 void
332 audit_arg_mode(mode_t mode)
333 {
334 	struct kaudit_record *ar;
335 
336 	ar = currecord();
337 	if (ar == NULL)
338 		return;
339 
340 	ar->k_ar.ar_arg_mode = mode;
341 	ARG_SET_VALID(ar, ARG_MODE);
342 }
343 
344 void
345 audit_arg_dev(int dev)
346 {
347 	struct kaudit_record *ar;
348 
349 	ar = currecord();
350 	if (ar == NULL)
351 		return;
352 
353 	ar->k_ar.ar_arg_dev = dev;
354 	ARG_SET_VALID(ar, ARG_DEV);
355 }
356 
357 void
358 audit_arg_value(long value)
359 {
360 	struct kaudit_record *ar;
361 
362 	ar = currecord();
363 	if (ar == NULL)
364 		return;
365 
366 	ar->k_ar.ar_arg_value = value;
367 	ARG_SET_VALID(ar, ARG_VALUE);
368 }
369 
370 void
371 audit_arg_owner(uid_t uid, gid_t gid)
372 {
373 	struct kaudit_record *ar;
374 
375 	ar = currecord();
376 	if (ar == NULL)
377 		return;
378 
379 	ar->k_ar.ar_arg_uid = uid;
380 	ar->k_ar.ar_arg_gid = gid;
381 	ARG_SET_VALID(ar, ARG_UID | ARG_GID);
382 }
383 
384 void
385 audit_arg_pid(pid_t pid)
386 {
387 	struct kaudit_record *ar;
388 
389 	ar = currecord();
390 	if (ar == NULL)
391 		return;
392 
393 	ar->k_ar.ar_arg_pid = pid;
394 	ARG_SET_VALID(ar, ARG_PID);
395 }
396 
397 void
398 audit_arg_process(struct proc *p)
399 {
400 	struct kaudit_record *ar;
401 	struct ucred *cred;
402 
403 	KASSERT(p != NULL, ("audit_arg_process: p == NULL"));
404 
405 	PROC_LOCK_ASSERT(p, MA_OWNED);
406 
407 	ar = currecord();
408 	if (ar == NULL)
409 		return;
410 
411 	cred = p->p_ucred;
412 	ar->k_ar.ar_arg_auid = cred->cr_audit.ai_auid;
413 	ar->k_ar.ar_arg_euid = cred->cr_uid;
414 	ar->k_ar.ar_arg_egid = cred->cr_groups[0];
415 	ar->k_ar.ar_arg_ruid = cred->cr_ruid;
416 	ar->k_ar.ar_arg_rgid = cred->cr_rgid;
417 	ar->k_ar.ar_arg_asid = cred->cr_audit.ai_asid;
418 	ar->k_ar.ar_arg_termid_addr = cred->cr_audit.ai_termid;
419 	ar->k_ar.ar_arg_pid = p->p_pid;
420 	ARG_SET_VALID(ar, ARG_AUID | ARG_EUID | ARG_EGID | ARG_RUID |
421 	    ARG_RGID | ARG_ASID | ARG_TERMID_ADDR | ARG_PID | ARG_PROCESS);
422 }
423 
424 void
425 audit_arg_signum(u_int signum)
426 {
427 	struct kaudit_record *ar;
428 
429 	ar = currecord();
430 	if (ar == NULL)
431 		return;
432 
433 	ar->k_ar.ar_arg_signum = signum;
434 	ARG_SET_VALID(ar, ARG_SIGNUM);
435 }
436 
437 void
438 audit_arg_socket(int sodomain, int sotype, int soprotocol)
439 {
440 	struct kaudit_record *ar;
441 
442 	ar = currecord();
443 	if (ar == NULL)
444 		return;
445 
446 	ar->k_ar.ar_arg_sockinfo.so_domain = sodomain;
447 	ar->k_ar.ar_arg_sockinfo.so_type = sotype;
448 	ar->k_ar.ar_arg_sockinfo.so_protocol = soprotocol;
449 	ARG_SET_VALID(ar, ARG_SOCKINFO);
450 }
451 
452 void
453 audit_arg_sockaddr(struct thread *td, int dirfd, struct sockaddr *sa)
454 {
455 	struct kaudit_record *ar;
456 
457 	KASSERT(td != NULL, ("audit_arg_sockaddr: td == NULL"));
458 	KASSERT(sa != NULL, ("audit_arg_sockaddr: sa == NULL"));
459 
460 	ar = currecord();
461 	if (ar == NULL)
462 		return;
463 
464 	bcopy(sa, &ar->k_ar.ar_arg_sockaddr, sa->sa_len);
465 	switch (sa->sa_family) {
466 	case AF_INET:
467 		ARG_SET_VALID(ar, ARG_SADDRINET);
468 		break;
469 
470 	case AF_INET6:
471 		ARG_SET_VALID(ar, ARG_SADDRINET6);
472 		break;
473 
474 	case AF_UNIX:
475 		if (dirfd != AT_FDCWD)
476 			audit_arg_atfd1(dirfd);
477 		audit_arg_upath1(td, dirfd,
478 		    ((struct sockaddr_un *)sa)->sun_path);
479 		ARG_SET_VALID(ar, ARG_SADDRUNIX);
480 		break;
481 	/* XXXAUDIT: default:? */
482 	}
483 }
484 
485 void
486 audit_arg_auid(uid_t auid)
487 {
488 	struct kaudit_record *ar;
489 
490 	ar = currecord();
491 	if (ar == NULL)
492 		return;
493 
494 	ar->k_ar.ar_arg_auid = auid;
495 	ARG_SET_VALID(ar, ARG_AUID);
496 }
497 
498 void
499 audit_arg_auditinfo(struct auditinfo *au_info)
500 {
501 	struct kaudit_record *ar;
502 
503 	ar = currecord();
504 	if (ar == NULL)
505 		return;
506 
507 	ar->k_ar.ar_arg_auid = au_info->ai_auid;
508 	ar->k_ar.ar_arg_asid = au_info->ai_asid;
509 	ar->k_ar.ar_arg_amask.am_success = au_info->ai_mask.am_success;
510 	ar->k_ar.ar_arg_amask.am_failure = au_info->ai_mask.am_failure;
511 	ar->k_ar.ar_arg_termid.port = au_info->ai_termid.port;
512 	ar->k_ar.ar_arg_termid.machine = au_info->ai_termid.machine;
513 	ARG_SET_VALID(ar, ARG_AUID | ARG_ASID | ARG_AMASK | ARG_TERMID);
514 }
515 
516 void
517 audit_arg_auditinfo_addr(struct auditinfo_addr *au_info)
518 {
519 	struct kaudit_record *ar;
520 
521 	ar = currecord();
522 	if (ar == NULL)
523 		return;
524 
525 	ar->k_ar.ar_arg_auid = au_info->ai_auid;
526 	ar->k_ar.ar_arg_asid = au_info->ai_asid;
527 	ar->k_ar.ar_arg_amask.am_success = au_info->ai_mask.am_success;
528 	ar->k_ar.ar_arg_amask.am_failure = au_info->ai_mask.am_failure;
529 	ar->k_ar.ar_arg_termid_addr.at_type = au_info->ai_termid.at_type;
530 	ar->k_ar.ar_arg_termid_addr.at_port = au_info->ai_termid.at_port;
531 	ar->k_ar.ar_arg_termid_addr.at_addr[0] = au_info->ai_termid.at_addr[0];
532 	ar->k_ar.ar_arg_termid_addr.at_addr[1] = au_info->ai_termid.at_addr[1];
533 	ar->k_ar.ar_arg_termid_addr.at_addr[2] = au_info->ai_termid.at_addr[2];
534 	ar->k_ar.ar_arg_termid_addr.at_addr[3] = au_info->ai_termid.at_addr[3];
535 	ARG_SET_VALID(ar, ARG_AUID | ARG_ASID | ARG_AMASK | ARG_TERMID_ADDR);
536 }
537 
538 void
539 audit_arg_text(const char *text)
540 {
541 	struct kaudit_record *ar;
542 
543 	KASSERT(text != NULL, ("audit_arg_text: text == NULL"));
544 
545 	ar = currecord();
546 	if (ar == NULL)
547 		return;
548 
549 	/* Invalidate the text string */
550 	ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_TEXT);
551 
552 	if (ar->k_ar.ar_arg_text == NULL)
553 		ar->k_ar.ar_arg_text = malloc(MAXPATHLEN, M_AUDITTEXT,
554 		    M_WAITOK);
555 
556 	strncpy(ar->k_ar.ar_arg_text, text, MAXPATHLEN);
557 	ARG_SET_VALID(ar, ARG_TEXT);
558 }
559 
560 void
561 audit_arg_cmd(int cmd)
562 {
563 	struct kaudit_record *ar;
564 
565 	ar = currecord();
566 	if (ar == NULL)
567 		return;
568 
569 	ar->k_ar.ar_arg_cmd = cmd;
570 	ARG_SET_VALID(ar, ARG_CMD);
571 }
572 
573 void
574 audit_arg_svipc_cmd(int cmd)
575 {
576 	struct kaudit_record *ar;
577 
578 	ar = currecord();
579 	if (ar == NULL)
580 		return;
581 
582 	ar->k_ar.ar_arg_svipc_cmd = cmd;
583 	ARG_SET_VALID(ar, ARG_SVIPC_CMD);
584 }
585 
586 void
587 audit_arg_svipc_perm(struct ipc_perm *perm)
588 {
589 	struct kaudit_record *ar;
590 
591 	ar = currecord();
592 	if (ar == NULL)
593 		return;
594 
595 	bcopy(perm, &ar->k_ar.ar_arg_svipc_perm,
596 	    sizeof(ar->k_ar.ar_arg_svipc_perm));
597 	ARG_SET_VALID(ar, ARG_SVIPC_PERM);
598 }
599 
600 void
601 audit_arg_svipc_id(int id)
602 {
603 	struct kaudit_record *ar;
604 
605 	ar = currecord();
606 	if (ar == NULL)
607 		return;
608 
609 	ar->k_ar.ar_arg_svipc_id = id;
610 	ARG_SET_VALID(ar, ARG_SVIPC_ID);
611 }
612 
613 void
614 audit_arg_svipc_addr(void * addr)
615 {
616 	struct kaudit_record *ar;
617 
618 	ar = currecord();
619 	if (ar == NULL)
620 		return;
621 
622 	ar->k_ar.ar_arg_svipc_addr = addr;
623 	ARG_SET_VALID(ar, ARG_SVIPC_ADDR);
624 }
625 
626 void
627 audit_arg_svipc_which(int which)
628 {
629 	struct kaudit_record *ar;
630 
631 	ar = currecord();
632 	if (ar == NULL)
633 		return;
634 
635 	ar->k_ar.ar_arg_svipc_which = which;
636 	ARG_SET_VALID(ar, ARG_SVIPC_WHICH);
637 }
638 
639 void
640 audit_arg_posix_ipc_perm(uid_t uid, gid_t gid, mode_t mode)
641 {
642 	struct kaudit_record *ar;
643 
644 	ar = currecord();
645 	if (ar == NULL)
646 		return;
647 
648 	ar->k_ar.ar_arg_pipc_perm.pipc_uid = uid;
649 	ar->k_ar.ar_arg_pipc_perm.pipc_gid = gid;
650 	ar->k_ar.ar_arg_pipc_perm.pipc_mode = mode;
651 	ARG_SET_VALID(ar, ARG_POSIX_IPC_PERM);
652 }
653 
654 void
655 audit_arg_auditon(union auditon_udata *udata)
656 {
657 	struct kaudit_record *ar;
658 
659 	ar = currecord();
660 	if (ar == NULL)
661 		return;
662 
663 	bcopy((void *)udata, &ar->k_ar.ar_arg_auditon,
664 	    sizeof(ar->k_ar.ar_arg_auditon));
665 	ARG_SET_VALID(ar, ARG_AUDITON);
666 }
667 
668 /*
669  * Audit information about a file, either the file's vnode info, or its
670  * socket address info.
671  */
672 void
673 audit_arg_file(struct proc *p, struct file *fp)
674 {
675 	struct kaudit_record *ar;
676 	struct socket *so;
677 	struct inpcb *pcb;
678 	struct vnode *vp;
679 
680 	ar = currecord();
681 	if (ar == NULL)
682 		return;
683 
684 	switch (fp->f_type) {
685 	case DTYPE_VNODE:
686 	case DTYPE_FIFO:
687 		/*
688 		 * XXXAUDIT: Only possibly to record as first vnode?
689 		 */
690 		vp = fp->f_vnode;
691 		vn_lock(vp, LK_SHARED | LK_RETRY);
692 		audit_arg_vnode1(vp);
693 		VOP_UNLOCK(vp);
694 		break;
695 
696 	case DTYPE_SOCKET:
697 		so = (struct socket *)fp->f_data;
698 		if (INP_CHECK_SOCKAF(so, PF_INET)) {
699 			SOCK_LOCK(so);
700 			ar->k_ar.ar_arg_sockinfo.so_type =
701 			    so->so_type;
702 			ar->k_ar.ar_arg_sockinfo.so_domain =
703 			    INP_SOCKAF(so);
704 			ar->k_ar.ar_arg_sockinfo.so_protocol =
705 			    so->so_proto->pr_protocol;
706 			SOCK_UNLOCK(so);
707 			pcb = (struct inpcb *)so->so_pcb;
708 			INP_RLOCK(pcb);
709 			ar->k_ar.ar_arg_sockinfo.so_raddr =
710 			    pcb->inp_faddr.s_addr;
711 			ar->k_ar.ar_arg_sockinfo.so_laddr =
712 			    pcb->inp_laddr.s_addr;
713 			ar->k_ar.ar_arg_sockinfo.so_rport =
714 			    pcb->inp_fport;
715 			ar->k_ar.ar_arg_sockinfo.so_lport =
716 			    pcb->inp_lport;
717 			INP_RUNLOCK(pcb);
718 			ARG_SET_VALID(ar, ARG_SOCKINFO);
719 		}
720 		break;
721 
722 	default:
723 		/* XXXAUDIT: else? */
724 		break;
725 	}
726 }
727 
728 /*
729  * Store a path as given by the user process for auditing into the audit
730  * record stored on the user thread.  This function will allocate the memory
731  * to store the path info if not already available.  This memory will be
732  * freed when the audit record is freed.  The path is canonlicalised with
733  * respect to the thread and directory descriptor passed.
734  */
735 static void
736 audit_arg_upath(struct thread *td, int dirfd, char *upath, char **pathp)
737 {
738 
739 	if (*pathp == NULL)
740 		*pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
741 	audit_canon_path(td, dirfd, upath, *pathp);
742 }
743 
744 void
745 audit_arg_upath1(struct thread *td, int dirfd, char *upath)
746 {
747 	struct kaudit_record *ar;
748 
749 	ar = currecord();
750 	if (ar == NULL)
751 		return;
752 
753 	audit_arg_upath(td, dirfd, upath, &ar->k_ar.ar_arg_upath1);
754 	ARG_SET_VALID(ar, ARG_UPATH1);
755 }
756 
757 void
758 audit_arg_upath2(struct thread *td, int dirfd, char *upath)
759 {
760 	struct kaudit_record *ar;
761 
762 	ar = currecord();
763 	if (ar == NULL)
764 		return;
765 
766 	audit_arg_upath(td, dirfd, upath, &ar->k_ar.ar_arg_upath2);
767 	ARG_SET_VALID(ar, ARG_UPATH2);
768 }
769 
770 static void
771 audit_arg_upath_vp(struct thread *td, struct vnode *rdir, struct vnode *cdir,
772     char *upath, char **pathp)
773 {
774 
775 	if (*pathp == NULL)
776 		*pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
777 	audit_canon_path_vp(td, rdir, cdir, upath, *pathp);
778 }
779 
780 void
781 audit_arg_upath1_vp(struct thread *td, struct vnode *rdir, struct vnode *cdir,
782     char *upath)
783 {
784 	struct kaudit_record *ar;
785 
786 	ar = currecord();
787 	if (ar == NULL)
788 		return;
789 
790 	audit_arg_upath_vp(td, rdir, cdir, upath, &ar->k_ar.ar_arg_upath1);
791 	ARG_SET_VALID(ar, ARG_UPATH1);
792 }
793 
794 void
795 audit_arg_upath2_vp(struct thread *td, struct vnode *rdir, struct vnode *cdir,
796     char *upath)
797 {
798 	struct kaudit_record *ar;
799 
800 	ar = currecord();
801 	if (ar == NULL)
802 		return;
803 
804 	audit_arg_upath_vp(td, rdir, cdir, upath, &ar->k_ar.ar_arg_upath2);
805 	ARG_SET_VALID(ar, ARG_UPATH2);
806 }
807 
808 /*
809  * Variants on path auditing that do not canonicalise the path passed in;
810  * these are for use with filesystem-like subsystems that employ string names,
811  * but do not support a hierarchical namespace -- for example, POSIX IPC
812  * objects.  The subsystem should have performed any necessary
813  * canonicalisation required to make the paths useful to audit analysis.
814  */
815 static void
816 audit_arg_upath_canon(char *upath, char **pathp)
817 {
818 
819 	if (*pathp == NULL)
820 		*pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
821 	(void)snprintf(*pathp, MAXPATHLEN, "%s", upath);
822 }
823 
824 void
825 audit_arg_upath1_canon(char *upath)
826 {
827 	struct kaudit_record *ar;
828 
829 	ar = currecord();
830 	if (ar == NULL)
831 		return;
832 
833 	audit_arg_upath_canon(upath, &ar->k_ar.ar_arg_upath1);
834 	ARG_SET_VALID(ar, ARG_UPATH1);
835 }
836 
837 void
838 audit_arg_upath2_canon(char *upath)
839 {
840 	struct kaudit_record *ar;
841 
842 	ar = currecord();
843 	if (ar == NULL)
844 		return;
845 
846 	audit_arg_upath_canon(upath, &ar->k_ar.ar_arg_upath2);
847 	ARG_SET_VALID(ar, ARG_UPATH2);
848 }
849 
850 /*
851  * Function to save the path and vnode attr information into the audit
852  * record.
853  *
854  * It is assumed that the caller will hold any vnode locks necessary to
855  * perform a VOP_GETATTR() on the passed vnode.
856  *
857  * XXX: The attr code is very similar to vfs_default.c:vop_stdstat(), but always
858  * provides access to the generation number as we need that to construct the
859  * BSM file ID.
860  *
861  * XXX: We should accept the process argument from the caller, since it's
862  * very likely they already have a reference.
863  *
864  * XXX: Error handling in this function is poor.
865  *
866  * XXXAUDIT: Possibly KASSERT the path pointer is NULL?
867  */
868 static int
869 audit_arg_vnode(struct vnode *vp, struct vnode_au_info *vnp)
870 {
871 	struct vattr vattr;
872 	int error;
873 
874 	ASSERT_VOP_LOCKED(vp, "audit_arg_vnode");
875 
876 	VATTR_NULL(&vattr);
877 	error = VOP_GETATTR(vp, &vattr, curthread->td_ucred);
878 	if (error) {
879 		/* XXX: How to handle this case? */
880 		return (error);
881 	}
882 
883 	vnp->vn_mode = vattr.va_mode;
884 	vnp->vn_uid = vattr.va_uid;
885 	vnp->vn_gid = vattr.va_gid;
886 	vnp->vn_dev = vattr.va_rdev;
887 	vnp->vn_fsid = vattr.va_fsid;
888 	vnp->vn_fileid = vattr.va_fileid;
889 	vnp->vn_gen = vattr.va_gen;
890 	return (0);
891 }
892 
893 void
894 audit_arg_vnode1(struct vnode *vp)
895 {
896 	struct kaudit_record *ar;
897 	int error;
898 
899 	ar = currecord();
900 	if (ar == NULL)
901 		return;
902 
903 	ARG_CLEAR_VALID(ar, ARG_VNODE1);
904 	error = audit_arg_vnode(vp, &ar->k_ar.ar_arg_vnode1);
905 	if (error == 0)
906 		ARG_SET_VALID(ar, ARG_VNODE1);
907 }
908 
909 void
910 audit_arg_vnode2(struct vnode *vp)
911 {
912 	struct kaudit_record *ar;
913 	int error;
914 
915 	ar = currecord();
916 	if (ar == NULL)
917 		return;
918 
919 	ARG_CLEAR_VALID(ar, ARG_VNODE2);
920 	error = audit_arg_vnode(vp, &ar->k_ar.ar_arg_vnode2);
921 	if (error == 0)
922 		ARG_SET_VALID(ar, ARG_VNODE2);
923 }
924 
925 /*
926  * Audit the argument strings passed to exec.
927  */
928 void
929 audit_arg_argv(char *argv, int argc, int length)
930 {
931 	struct kaudit_record *ar;
932 
933 	if (audit_argv == 0)
934 		return;
935 
936 	ar = currecord();
937 	if (ar == NULL)
938 		return;
939 
940 	ar->k_ar.ar_arg_argv = malloc(length, M_AUDITTEXT, M_WAITOK);
941 	bcopy(argv, ar->k_ar.ar_arg_argv, length);
942 	ar->k_ar.ar_arg_argc = argc;
943 	ARG_SET_VALID(ar, ARG_ARGV);
944 }
945 
946 /*
947  * Audit the environment strings passed to exec.
948  */
949 void
950 audit_arg_envv(char *envv, int envc, int length)
951 {
952 	struct kaudit_record *ar;
953 
954 	if (audit_arge == 0)
955 		return;
956 
957 	ar = currecord();
958 	if (ar == NULL)
959 		return;
960 
961 	ar->k_ar.ar_arg_envv = malloc(length, M_AUDITTEXT, M_WAITOK);
962 	bcopy(envv, ar->k_ar.ar_arg_envv, length);
963 	ar->k_ar.ar_arg_envc = envc;
964 	ARG_SET_VALID(ar, ARG_ENVV);
965 }
966 
967 void
968 audit_arg_rights(cap_rights_t *rightsp)
969 {
970 	struct kaudit_record *ar;
971 
972 	ar = currecord();
973 	if (ar == NULL)
974 		return;
975 
976 	ar->k_ar.ar_arg_rights = *rightsp;
977 	ARG_SET_VALID(ar, ARG_RIGHTS);
978 }
979 
980 void
981 audit_arg_fcntl_rights(uint32_t fcntlrights)
982 {
983 	struct kaudit_record *ar;
984 
985 	ar = currecord();
986 	if (ar == NULL)
987 		return;
988 
989 	ar->k_ar.ar_arg_fcntl_rights = fcntlrights;
990 	ARG_SET_VALID(ar, ARG_FCNTL_RIGHTS);
991 }
992 
993 /*
994  * The close() system call uses it's own audit call to capture the path/vnode
995  * information because those pieces are not easily obtained within the system
996  * call itself.
997  */
998 void
999 audit_sysclose(struct thread *td, int fd, struct file *fp)
1000 {
1001 	struct kaudit_record *ar;
1002 	struct vnode *vp;
1003 
1004 	KASSERT(td != NULL, ("audit_sysclose: td == NULL"));
1005 
1006 	ar = currecord();
1007 	if (ar == NULL)
1008 		return;
1009 
1010 	audit_arg_fd(fd);
1011 
1012 	vp = fp->f_vnode;
1013 	if (vp == NULL)
1014 		return;
1015 	vn_lock(vp, LK_SHARED | LK_RETRY);
1016 	audit_arg_vnode1(vp);
1017 	VOP_UNLOCK(vp);
1018 }
1019