xref: /freebsd/sys/security/audit/audit_private.h (revision 08e57af45b017063650fb576449bd345696e9046)
1 /*
2  * Copyright (c) 1999-2005 Apple Computer, Inc.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1.  Redistributions of source code must retain the above copyright
9  *     notice, this list of conditions and the following disclaimer.
10  * 2.  Redistributions in binary form must reproduce the above copyright
11  *     notice, this list of conditions and the following disclaimer in the
12  *     documentation and/or other materials provided with the distribution.
13  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
14  *     its contributors may be used to endorse or promote products derived
15  *     from this software without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27  * POSSIBILITY OF SUCH DAMAGE.
28  *
29  * $FreeBSD$
30  */
31 
32 /*
33  * This include file contains function prototypes and type definitions used
34  * within the audit implementation.
35  */
36 
37 #ifndef _SECURITY_AUDIT_PRIVATE_H_
38 #define	_SECURITY_AUDIT_PRIVATE_H_
39 
40 #ifndef _KERNEL
41 #error "no user-serviceable parts inside"
42 #endif
43 
44 #include <sys/ipc.h>
45 #include <sys/socket.h>
46 #include <sys/ucred.h>
47 
48 #ifdef MALLOC_DECLARE
49 MALLOC_DECLARE(M_AUDITBSM);
50 MALLOC_DECLARE(M_AUDITDATA);
51 MALLOC_DECLARE(M_AUDITPATH);
52 MALLOC_DECLARE(M_AUDITTEXT);
53 #endif
54 
55 /*
56  * The AUDIT_EXCESSIVELY_VERBOSE define enables a number of gratuitously
57  * noisy printf's to the console.  Due to the volume, it should be left off
58  * unless you want your system to churn a lot whenever the audit record flow
59  * gets high.
60  */
61 //#define	AUDIT_EXCESSIVELY_VERBOSE
62 #ifdef AUDIT_EXCESSIVELY_VERBOSE
63 #define	AUDIT_PRINTF(x)	printf x
64 #else
65 #define	AUDIT_PRINTF(x)
66 #endif
67 
68 /*
69  * Audit control variables that are usually set/read via system calls
70  * and used to control various aspects of auditing.
71  */
72 extern struct au_qctrl		audit_qctrl;
73 extern struct audit_fstat	audit_fstat;
74 extern struct au_mask		audit_nae_mask;
75 extern int			audit_panic_on_write_fail;
76 extern int			audit_fail_stop;
77 
78 /*
79  * Success/failure conditions for the conversion of a kernel audit record to
80  * BSM format.
81  */
82 #define	BSM_SUCCESS		0
83 #define	BSM_FAILURE		1
84 #define	BSM_NOAUDIT		2
85 
86 /*
87  * Defines for the kernel audit record k_ar_commit field.
88  */
89 #define	AR_COMMIT_KERNEL	0x00000001U
90 #define	AR_COMMIT_USER		0x00000010U
91 
92 /*
93  * Audit data is generated as a stream of struct audit_record structures,
94  * linked by struct kaudit_record, and contain storage for possible audit so
95  * that it will not need to be allocated during the processing of a system
96  * call, both improving efficiency and avoiding sleeping at untimely moments.
97  * This structure is converted to BSM format before being written to disk.
98  */
99 struct vnode_au_info {
100 	mode_t		vn_mode;
101 	uid_t		vn_uid;
102 	gid_t		vn_gid;
103 	dev_t		vn_dev;
104 	long		vn_fsid;
105 	long		vn_fileid;
106 	long		vn_gen;
107 };
108 
109 struct groupset {
110 	gid_t	gidset[NGROUPS];
111 	u_int	gidset_size;
112 };
113 
114 struct socket_au_info {
115 	int 		so_domain;
116 	int		so_type;
117 	int		so_protocol;
118 	in_addr_t	so_raddr;	/* remote address if INET socket */
119 	in_addr_t	so_laddr;	/* local address if INET socket */
120 	u_short		so_rport;	/* remote port */
121 	u_short		so_lport;	/* local port */
122 };
123 
124 union auditon_udata {
125 	char			*au_path;
126 	long			au_cond;
127 	long			au_flags;
128 	long			au_policy;
129 	int			au_trigger;
130 	au_evclass_map_t	au_evclass;
131 	au_mask_t		au_mask;
132 	auditinfo_t		au_auinfo;
133 	auditpinfo_t		au_aupinfo;
134 	auditpinfo_addr_t	au_aupinfo_addr;
135 	au_qctrl_t		au_qctrl;
136 	au_stat_t		au_stat;
137 	au_fstat_t		au_fstat;
138 };
139 
140 struct posix_ipc_perm {
141 	uid_t			pipc_uid;
142 	gid_t			pipc_gid;
143 	mode_t			pipc_mode;
144 };
145 
146 struct audit_record {
147 	/* Audit record header. */
148 	u_int32_t		ar_magic;
149 	int			ar_event;
150 	int			ar_retval; /* value returned to the process */
151 	int			ar_errno;  /* return status of system call */
152 	struct timespec		ar_starttime;
153 	struct timespec		ar_endtime;
154 	u_int64_t		ar_valid_arg;  /* Bitmask of valid arguments */
155 
156 	/* Audit subject information. */
157 	struct xucred			ar_subj_cred;
158 	uid_t				ar_subj_ruid;
159 	gid_t				ar_subj_rgid;
160 	gid_t				ar_subj_egid;
161 	uid_t				ar_subj_auid; /* Audit user ID */
162 	pid_t				ar_subj_asid; /* Audit session ID */
163 	pid_t				ar_subj_pid;
164 	struct au_tid			ar_subj_term;
165 	char				ar_subj_comm[MAXCOMLEN + 1];
166 	struct au_mask			ar_subj_amask;
167 
168 	/* Operation arguments. */
169 	uid_t				ar_arg_euid;
170 	uid_t				ar_arg_ruid;
171 	uid_t				ar_arg_suid;
172 	gid_t				ar_arg_egid;
173 	gid_t				ar_arg_rgid;
174 	gid_t				ar_arg_sgid;
175 	pid_t				ar_arg_pid;
176 	pid_t				ar_arg_asid;
177 	struct au_tid			ar_arg_termid;
178 	uid_t				ar_arg_uid;
179 	uid_t				ar_arg_auid;
180 	gid_t				ar_arg_gid;
181 	struct groupset			ar_arg_groups;
182 	int				ar_arg_fd;
183 	int				ar_arg_fflags;
184 	mode_t				ar_arg_mode;
185 	int				ar_arg_dev;
186 	long				ar_arg_value;
187 	void *				ar_arg_addr;
188 	int				ar_arg_len;
189 	int				ar_arg_mask;
190 	u_int				ar_arg_signum;
191 	char				ar_arg_login[MAXLOGNAME];
192 	int				ar_arg_ctlname[CTL_MAXNAME];
193 	struct sockaddr			ar_arg_sockaddr;
194 	struct socket_au_info		ar_arg_sockinfo;
195 	char				*ar_arg_upath1;
196 	char				*ar_arg_upath2;
197 	char				*ar_arg_text;
198 	struct au_mask			ar_arg_amask;
199 	struct vnode_au_info		ar_arg_vnode1;
200 	struct vnode_au_info		ar_arg_vnode2;
201 	int				ar_arg_cmd;
202 	int				ar_arg_svipc_cmd;
203 	struct ipc_perm			ar_arg_svipc_perm;
204 	int				ar_arg_svipc_id;
205 	void *				ar_arg_svipc_addr;
206 	struct posix_ipc_perm		ar_arg_pipc_perm;
207 	union auditon_udata		ar_arg_auditon;
208 	int				ar_arg_exitstatus;
209 	int				ar_arg_exitretval;
210 };
211 
212 /*
213  * Arguments in the audit record are initially not defined; flags are set to
214  * indicate if they are present so they can be included in the audit log
215  * stream only if defined.
216  */
217 #define	ARG_IS_VALID(kar, arg)	((kar)->k_ar.ar_valid_arg & (arg))
218 #define	ARG_SET_VALID(kar, arg) do {					\
219 	(kar)->k_ar.ar_valid_arg |= (arg);				\
220 } while (0)
221 
222 /*
223  * In-kernel version of audit record; the basic record plus queue meta-data.
224  * This record can also have a pointer set to some opaque data that will
225  * be passed through to the audit writing mechanism.
226  */
227 struct kaudit_record {
228 	struct audit_record		k_ar;
229 	u_int32_t			k_ar_commit;
230 	void 				*k_udata;    /* user data */
231 	u_int				k_ulen;     /* user data length */
232 	struct uthread			*k_uthread; /* thread we are auditing */
233 	TAILQ_ENTRY(kaudit_record)	k_q;
234 };
235 TAILQ_HEAD(kaudit_queue, kaudit_record);
236 
237 /*
238  * Functions to manage the allocation, release, and commit of kernel audit
239  * records.
240  */
241 void			 audit_abort(struct kaudit_record *ar);
242 void			 audit_commit(struct kaudit_record *ar, int error,
243 			    int retval);
244 struct kaudit_record	*audit_new(int event, struct thread *td);
245 
246 /*
247  * Functions relating to the conversion of internal kernel audit records to
248  * the BSM file format.
249  */
250 struct au_record;
251 int			 kaudit_to_bsm(struct kaudit_record *kar,
252 			    struct au_record **pau);
253 int			 bsm_rec_verify(void *rec);
254 
255 /*
256  * Kernel versions of the libbsm audit record functions.
257  */
258 void			 kau_free(struct au_record *rec);
259 void			 kau_init(void);
260 
261 /*
262  * Return values for pre-selection and post-selection decisions.
263  */
264 #define	AU_PRS_SUCCESS		1
265 #define	AU_PRS_FAILURE		2
266 #define	AU_PRS_BOTH		(AU_PRS_SUCCESS|AU_PRS_FAILURE)
267 
268 /*
269  * Data structures relating to the kernel audit queue.  Ideally, these might
270  * be abstracted so that only accessor methods are exposed.
271  */
272 extern struct mtx			audit_mtx;
273 extern struct cv			audit_commit_cv;
274 extern struct cv			audit_cv;
275 extern struct kaudit_queue		audit_q;
276 extern int				audit_q_len;
277 extern int				audit_pre_q_len;
278 extern int				audit_in_failure;
279 
280 /*
281  * Flags to use on audit files when opening and closing.
282  */
283 #define	AUDIT_OPEN_FLAGS	(FWRITE | O_APPEND)
284 #define	AUDIT_CLOSE_FLAGS	(FWRITE | O_APPEND)
285 
286 #include <sys/fcntl.h>
287 #include <sys/kernel.h>
288 #include <sys/malloc.h>
289 
290 /*
291  * Some of the BSM tokenizer functions take different parameters in the
292  * kernel implementations in order to save the copying of large kernel
293  * data structures. The prototypes of these functions are declared here.
294  */
295 token_t		*kau_to_socket(struct socket_au_info *soi);
296 
297 /*
298  * audit_klib prototypes
299  */
300 int		 au_preselect(au_event_t event, au_mask_t *mask_p, int sorf);
301 au_event_t	 flags_and_error_to_openevent(int oflags, int error);
302 void		 au_evclassmap_init(void);
303 void		 au_evclassmap_insert(au_event_t event, au_class_t class);
304 au_class_t	 au_event_class(au_event_t event);
305 au_event_t	 ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
306 int		 auditon_command_event(int cmd);
307 int		 msgctl_to_event(int cmd);
308 int		 semctl_to_event(int cmr);
309 void		 canon_path(struct thread *td, char *path, char *cpath);
310 
311 /*
312  * Audit trigger events notify user space of kernel audit conditions
313  * asynchronously.
314  */
315 void		 audit_trigger_init(void);
316 int		 send_trigger(unsigned int trigger);
317 
318 /*
319  * General audit related functions.
320  */
321 struct kaudit_record	*currecord(void);
322 void			 audit_free(struct kaudit_record *ar);
323 void			 audit_shutdown(void *arg, int howto);
324 void			 audit_rotate_vnode(struct ucred *cred,
325 			    struct vnode *vp);
326 void			 audit_worker_init(void);
327 
328 /*
329  * Audit pipe functions.
330  */
331 void			 audit_pipe_submit(void *record, u_int record_len);
332 
333 #endif /* ! _SECURITY_AUDIT_PRIVATE_H_ */
334