xref: /freebsd/sys/security/audit/audit_worker.c (revision 2b743a9e9ddc6736208dc8ca1ce06ce64ad20a19)
1 /*
2  * Copyright (c) 1999-2005 Apple Computer, Inc.
3  * Copyright (c) 2006 Robert N. M. Watson
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1.  Redistributions of source code must retain the above copyright
10  *     notice, this list of conditions and the following disclaimer.
11  * 2.  Redistributions in binary form must reproduce the above copyright
12  *     notice, this list of conditions and the following disclaimer in the
13  *     documentation and/or other materials provided with the distribution.
14  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
15  *     its contributors may be used to endorse or promote products derived
16  *     from this software without specific prior written permission.
17  *
18  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
22  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
26  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
27  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28  * POSSIBILITY OF SUCH DAMAGE.
29  *
30  * $FreeBSD$
31  */
32 
33 #include <sys/param.h>
34 #include <sys/condvar.h>
35 #include <sys/conf.h>
36 #include <sys/file.h>
37 #include <sys/filedesc.h>
38 #include <sys/fcntl.h>
39 #include <sys/ipc.h>
40 #include <sys/kernel.h>
41 #include <sys/kthread.h>
42 #include <sys/malloc.h>
43 #include <sys/mount.h>
44 #include <sys/namei.h>
45 #include <sys/proc.h>
46 #include <sys/queue.h>
47 #include <sys/socket.h>
48 #include <sys/socketvar.h>
49 #include <sys/protosw.h>
50 #include <sys/domain.h>
51 #include <sys/sysproto.h>
52 #include <sys/sysent.h>
53 #include <sys/systm.h>
54 #include <sys/ucred.h>
55 #include <sys/uio.h>
56 #include <sys/un.h>
57 #include <sys/unistd.h>
58 #include <sys/vnode.h>
59 
60 #include <bsm/audit.h>
61 #include <bsm/audit_internal.h>
62 #include <bsm/audit_kevents.h>
63 
64 #include <netinet/in.h>
65 #include <netinet/in_pcb.h>
66 
67 #include <security/audit/audit.h>
68 #include <security/audit/audit_private.h>
69 
70 #include <vm/uma.h>
71 
72 /*
73  * Worker thread that will schedule disk I/O, etc.
74  */
75 static struct proc		*audit_thread;
76 
77 /*
78  * When an audit log is rotated, the actual rotation must be performed by the
79  * audit worker thread, as it may have outstanding writes on the current
80  * audit log.  audit_replacement_vp holds the vnode replacing the current
81  * vnode.  We can't let more than one replacement occur at a time, so if more
82  * than one thread requests a replacement, only one can have the replacement
83  * "in progress" at any given moment.  If a thread tries to replace the audit
84  * vnode and discovers a replacement is already in progress (i.e.,
85  * audit_replacement_flag != 0), then it will sleep on audit_replacement_cv
86  * waiting its turn to perform a replacement.  When a replacement is
87  * completed, this cv is signalled by the worker thread so a waiting thread
88  * can start another replacement.  We also store a credential to perform
89  * audit log write operations with.
90  *
91  * The current credential and vnode are thread-local to audit_worker.
92  */
93 static struct cv		audit_replacement_cv;
94 
95 static int			audit_replacement_flag;
96 static struct vnode		*audit_replacement_vp;
97 static struct ucred		*audit_replacement_cred;
98 
99 /*
100  * Flags related to Kernel->user-space communication.
101  */
102 static int			audit_file_rotate_wait;
103 
104 /*
105  * Write an audit record to a file, performed as the last stage after both
106  * preselection and BSM conversion.  Both space management and write failures
107  * are handled in this function.
108  *
109  * No attempt is made to deal with possible failure to deliver a trigger to
110  * the audit daemon, since the message is asynchronous anyway.
111  */
112 static void
113 audit_record_write(struct vnode *vp, struct ucred *cred, struct thread *td,
114     void *data, size_t len)
115 {
116 	static struct timeval last_lowspace_trigger;
117 	static struct timeval last_fail;
118 	static int cur_lowspace_trigger;
119 	struct statfs *mnt_stat;
120 	int error, vfslocked;
121 	static int cur_fail;
122 	struct vattr vattr;
123 	long temp;
124 
125 	if (vp == NULL)
126 		return;
127 
128  	mnt_stat = &vp->v_mount->mnt_stat;
129 	vfslocked = VFS_LOCK_GIANT(vp->v_mount);
130 
131 	/*
132 	 * First, gather statistics on the audit log file and file system so
133 	 * that we know how we're doing on space.  Consider failure of these
134 	 * operations to indicate a future inability to write to the file.
135 	 */
136 	error = VFS_STATFS(vp->v_mount, mnt_stat, td);
137 	if (error)
138 		goto fail;
139 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
140 	error = VOP_GETATTR(vp, &vattr, cred, td);
141 	VOP_UNLOCK(vp, 0, td);
142 	if (error)
143 		goto fail;
144 	audit_fstat.af_currsz = vattr.va_size;
145 
146 	/*
147 	 * We handle four different space-related limits:
148 	 *
149 	 * - A fixed (hard) limit on the minimum free blocks we require on
150 	 *   the file system, and results in record loss, a trigger, and
151 	 *   possible fail stop due to violating invariants.
152 	 *
153 	 * - An administrative (soft) limit, which when fallen below, results
154 	 *   in the kernel notifying the audit daemon of low space.
155 	 *
156 	 * - An audit trail size limit, which when gone above, results in the
157 	 *   kernel notifying the audit daemon that rotation is desired.
158 	 *
159 	 * - The total depth of the kernel audit record exceeding free space,
160 	 *   which can lead to possible fail stop (with drain), in order to
161 	 *   prevent violating invariants.  Failure here doesn't halt
162 	 *   immediately, but prevents new records from being generated.
163 	 *
164 	 * Possibly, the last of these should be handled differently, always
165 	 * allowing a full queue to be lost, rather than trying to prevent
166 	 * loss.
167 	 *
168 	 * First, handle the hard limit, which generates a trigger and may
169 	 * fail stop.  This is handled in the same manner as ENOSPC from
170 	 * VOP_WRITE, and results in record loss.
171 	 */
172 	if (mnt_stat->f_bfree < AUDIT_HARD_LIMIT_FREE_BLOCKS) {
173 		error = ENOSPC;
174 		goto fail_enospc;
175 	}
176 
177 	/*
178 	 * Second, handle falling below the soft limit, if defined; we send
179 	 * the daemon a trigger and continue processing the record.  Triggers
180 	 * are limited to 1/sec.
181 	 */
182 	if (audit_qctrl.aq_minfree != 0) {
183 		/*
184 		 * XXXAUDIT: Check math and block size calculations here.
185 		 */
186 		temp = mnt_stat->f_blocks / (100 / audit_qctrl.aq_minfree);
187 		if (mnt_stat->f_bfree < temp) {
188 			if (ppsratecheck(&last_lowspace_trigger,
189 			    &cur_lowspace_trigger, 1)) {
190 				(void)send_trigger(AUDIT_TRIGGER_LOW_SPACE);
191 				printf("Warning: audit space low\n");
192 			}
193 		}
194 	}
195 
196 	/*
197 	 * If the current file is getting full, generate a rotation trigger
198 	 * to the daemon.  This is only approximate, which is fine as more
199 	 * records may be generated before the daemon rotates the file.
200 	 */
201 	if ((audit_fstat.af_filesz != 0) && (audit_file_rotate_wait == 0) &&
202 	    (vattr.va_size >= audit_fstat.af_filesz)) {
203 		audit_file_rotate_wait = 1;
204 		(void)send_trigger(AUDIT_TRIGGER_ROTATE_KERNEL);
205 	}
206 
207 	/*
208 	 * If the estimated amount of audit data in the audit event queue
209 	 * (plus records allocated but not yet queued) has reached the amount
210 	 * of free space on the disk, then we need to go into an audit fail
211 	 * stop state, in which we do not permit the allocation/committing of
212 	 * any new audit records.  We continue to process records but don't
213 	 * allow any activities that might generate new records.  In the
214 	 * future, we might want to detect when space is available again and
215 	 * allow operation to continue, but this behavior is sufficient to
216 	 * meet fail stop requirements in CAPP.
217 	 */
218 	if (audit_fail_stop) {
219 		if ((unsigned long)((audit_q_len + audit_pre_q_len + 1) *
220 		    MAX_AUDIT_RECORD_SIZE) / mnt_stat->f_bsize >=
221 		    (unsigned long)(mnt_stat->f_bfree)) {
222 			if (ppsratecheck(&last_fail, &cur_fail, 1))
223 				printf("audit_record_write: free space "
224 				    "below size of audit queue, failing "
225 				    "stop\n");
226 			audit_in_failure = 1;
227 		} else if (audit_in_failure) {
228 			/*
229 			 * Note: if we want to handle recovery, this is the
230 			 * spot to do it: unset audit_in_failure, and issue a
231 			 * wakeup on the cv.
232 			 */
233 		}
234 	}
235 
236 	error = vn_rdwr(UIO_WRITE, vp, data, len, (off_t)0, UIO_SYSSPACE,
237 	    IO_APPEND|IO_UNIT, cred, NULL, NULL, td);
238 	if (error == ENOSPC)
239 		goto fail_enospc;
240 	else if (error)
241 		goto fail;
242 
243 	/*
244 	 * Catch completion of a queue drain here; if we're draining and the
245 	 * queue is now empty, fail stop.  That audit_fail_stop is implicitly
246 	 * true, since audit_in_failure can only be set of audit_fail_stop is
247 	 * set.
248 	 *
249 	 * Note: if we handle recovery from audit_in_failure, then we need to
250 	 * make panic here conditional.
251 	 */
252 	if (audit_in_failure) {
253 		if (audit_q_len == 0 && audit_pre_q_len == 0) {
254 			VOP_LOCK(vp, LK_DRAIN | LK_INTERLOCK, td);
255 			(void)VOP_FSYNC(vp, MNT_WAIT, td);
256 			VOP_UNLOCK(vp, 0, td);
257 			panic("Audit store overflow; record queue drained.");
258 		}
259 	}
260 
261 	VFS_UNLOCK_GIANT(vfslocked);
262 	return;
263 
264 fail_enospc:
265 	/*
266 	 * ENOSPC is considered a special case with respect to failures, as
267 	 * this can reflect either our preemptive detection of insufficient
268 	 * space, or ENOSPC returned by the vnode write call.
269 	 */
270 	if (audit_fail_stop) {
271 		VOP_LOCK(vp, LK_DRAIN | LK_INTERLOCK, td);
272 		(void)VOP_FSYNC(vp, MNT_WAIT, td);
273 		VOP_UNLOCK(vp, 0, td);
274 		panic("Audit log space exhausted and fail-stop set.");
275 	}
276 	(void)send_trigger(AUDIT_TRIGGER_NO_SPACE);
277 	audit_suspended = 1;
278 
279 	/* FALLTHROUGH */
280 fail:
281 	/*
282 	 * We have failed to write to the file, so the current record is
283 	 * lost, which may require an immediate system halt.
284 	 */
285 	if (audit_panic_on_write_fail) {
286 		VOP_LOCK(vp, LK_DRAIN | LK_INTERLOCK, td);
287 		(void)VOP_FSYNC(vp, MNT_WAIT, td);
288 		VOP_UNLOCK(vp, 0, td);
289 		panic("audit_worker: write error %d\n", error);
290 	} else if (ppsratecheck(&last_fail, &cur_fail, 1))
291 		printf("audit_worker: write error %d\n", error);
292 	VFS_UNLOCK_GIANT(vfslocked);
293 }
294 
295 /*
296  * If an appropriate signal has been received rotate the audit log based on
297  * the global replacement variables.  Signal consumers as needed that the
298  * rotation has taken place.
299  *
300  * The global variables and CVs used to signal the audit_worker to perform a
301  * rotation are essentially a message queue of depth 1.  It would be much
302  * nicer to actually use a message queue.
303  */
304 static void
305 audit_worker_rotate(struct ucred **audit_credp, struct vnode **audit_vpp,
306     struct thread *audit_td)
307 {
308 	int do_replacement_signal, vfslocked;
309 	struct ucred *old_cred;
310 	struct vnode *old_vp;
311 
312 	mtx_assert(&audit_mtx, MA_OWNED);
313 
314 	do_replacement_signal = 0;
315 	while (audit_replacement_flag != 0) {
316 		old_cred = *audit_credp;
317 		old_vp = *audit_vpp;
318 		*audit_credp = audit_replacement_cred;
319 		*audit_vpp = audit_replacement_vp;
320 		audit_replacement_cred = NULL;
321 		audit_replacement_vp = NULL;
322 		audit_replacement_flag = 0;
323 
324 		audit_enabled = (*audit_vpp != NULL);
325 
326 		if (old_vp != NULL) {
327 			AUDIT_PRINTF(("Closing old audit file\n"));
328 			mtx_unlock(&audit_mtx);
329 			vfslocked = VFS_LOCK_GIANT(old_vp->v_mount);
330 			vn_close(old_vp, AUDIT_CLOSE_FLAGS, old_cred,
331 			    audit_td);
332 			VFS_UNLOCK_GIANT(vfslocked);
333 			crfree(old_cred);
334 			mtx_lock(&audit_mtx);
335 			old_cred = NULL;
336 			old_vp = NULL;
337 			AUDIT_PRINTF(("Audit file closed\n"));
338 		}
339 		if (*audit_vpp != NULL) {
340 			AUDIT_PRINTF(("Opening new audit file\n"));
341 		}
342 		do_replacement_signal = 1;
343 	}
344 
345 	/*
346 	 * Signal that replacement have occurred to wake up and
347 	 * start any other replacements started in parallel.  We can
348 	 * continue about our business in the mean time.  We
349 	 * broadcast so that both new replacements can be inserted,
350 	 * but also so that the source(s) of replacement can return
351 	 * successfully.
352 	 */
353 	if (do_replacement_signal)
354 		cv_broadcast(&audit_replacement_cv);
355 }
356 
357 /*
358  * Given a kernel audit record, process as required.  Kernel audit records
359  * are converted to one, or possibly two, BSM records, depending on whether
360  * there is a user audit record present also.  Kernel records need be
361  * converted to BSM before they can be written out.  Both types will be
362  * written to disk, and audit pipes.
363  */
364 static void
365 audit_worker_process_record(struct vnode *audit_vp, struct ucred *audit_cred,
366     struct thread *audit_td, struct kaudit_record *ar)
367 {
368 	struct au_record *bsm;
369 	au_class_t class;
370 	au_event_t event;
371 	au_id_t auid;
372 	int error, sorf;
373 
374 	/*
375 	 * First, handle the user record, if any: commit to the system trail
376 	 * and audit pipes as selected.
377 	 */
378 	if ((ar->k_ar_commit & AR_COMMIT_USER) &&
379 	    (ar->k_ar_commit & AR_PRESELECT_USER_TRAIL))
380 		audit_record_write(audit_vp, audit_cred, audit_td,
381 		    ar->k_udata, ar->k_ulen);
382 
383 	if ((ar->k_ar_commit & AR_COMMIT_USER) &&
384 	    (ar->k_ar_commit & AR_PRESELECT_USER_PIPE))
385 		audit_pipe_submit_user(ar->k_udata, ar->k_ulen);
386 
387 	if (!(ar->k_ar_commit & AR_COMMIT_KERNEL) ||
388 	    ((ar->k_ar_commit & AR_PRESELECT_PIPE) == 0 &&
389 	    (ar->k_ar_commit & AR_PRESELECT_TRAIL) == 0))
390 		return;
391 
392 	auid = ar->k_ar.ar_subj_auid;
393 	event = ar->k_ar.ar_event;
394 	class = au_event_class(event);
395 	if (ar->k_ar.ar_errno == 0)
396 		sorf = AU_PRS_SUCCESS;
397 	else
398 		sorf = AU_PRS_FAILURE;
399 
400 	error = kaudit_to_bsm(ar, &bsm);
401 	switch (error) {
402 	case BSM_NOAUDIT:
403 		return;
404 
405 	case BSM_FAILURE:
406 		printf("audit_worker_process_record: BSM_FAILURE\n");
407 		return;
408 
409 	case BSM_SUCCESS:
410 		break;
411 
412 	default:
413 		panic("kaudit_to_bsm returned %d", error);
414 	}
415 
416 	if (ar->k_ar_commit & AR_PRESELECT_TRAIL)
417 		audit_record_write(audit_vp, audit_cred, audit_td, bsm->data,
418 		    bsm->len);
419 
420 	if (ar->k_ar_commit & AR_PRESELECT_PIPE)
421 		audit_pipe_submit(auid, event, class, sorf,
422 		    ar->k_ar_commit & AR_PRESELECT_TRAIL, bsm->data,
423 		    bsm->len);
424 
425 	kau_free(bsm);
426 }
427 
428 /*
429  * The audit_worker thread is responsible for watching the event queue,
430  * dequeueing records, converting them to BSM format, and committing them to
431  * disk.  In order to minimize lock thrashing, records are dequeued in sets
432  * to a thread-local work queue.  In addition, the audit_work performs the
433  * actual exchange of audit log vnode pointer, as audit_vp is a thread-local
434  * variable.
435  */
436 static void
437 audit_worker(void *arg)
438 {
439 	struct kaudit_queue ar_worklist;
440 	struct kaudit_record *ar;
441 	struct ucred *audit_cred;
442 	struct thread *audit_td;
443 	struct vnode *audit_vp;
444 	int lowater_signal;
445 
446 	AUDIT_PRINTF(("audit_worker starting\n"));
447 
448 	/*
449 	 * These are thread-local variables requiring no synchronization.
450 	 */
451 	TAILQ_INIT(&ar_worklist);
452 	audit_cred = NULL;
453 	audit_td = curthread;
454 	audit_vp = NULL;
455 
456 	mtx_lock(&audit_mtx);
457 	while (1) {
458 		mtx_assert(&audit_mtx, MA_OWNED);
459 
460 		/*
461 		 * Wait for record or rotation events.
462 		 */
463 		while (!audit_replacement_flag && TAILQ_EMPTY(&audit_q)) {
464 			AUDIT_PRINTF(("audit_worker waiting\n"));
465 			cv_wait(&audit_worker_cv, &audit_mtx);
466 			AUDIT_PRINTF(("audit_worker woken up\n"));
467 			AUDIT_PRINTF(("audit_worker: new vp = %p; value of "
468 			    "flag %d\n", audit_replacement_vp,
469 			    audit_replacement_flag));
470 		}
471 
472 		/*
473 		 * First priority: replace the audit log target if requested.
474 		 */
475 		audit_worker_rotate(&audit_cred, &audit_vp, audit_td);
476 
477 		/*
478 		 * If there are records in the global audit record queue,
479 		 * transfer them to a thread-local queue and process them
480 		 * one by one.  If we cross the low watermark threshold,
481 		 * signal any waiting processes that they may wake up and
482 		 * continue generating records.
483 		 */
484 		lowater_signal = 0;
485 		while ((ar = TAILQ_FIRST(&audit_q))) {
486 			TAILQ_REMOVE(&audit_q, ar, k_q);
487 			audit_q_len--;
488 			if (audit_q_len == audit_qctrl.aq_lowater)
489 				lowater_signal++;
490 			TAILQ_INSERT_TAIL(&ar_worklist, ar, k_q);
491 		}
492 		if (lowater_signal)
493 			cv_broadcast(&audit_watermark_cv);
494 
495 		mtx_unlock(&audit_mtx);
496 		while ((ar = TAILQ_FIRST(&ar_worklist))) {
497 			TAILQ_REMOVE(&ar_worklist, ar, k_q);
498 			audit_worker_process_record(audit_vp, audit_cred,
499 			    audit_td, ar);
500 			audit_free(ar);
501 		}
502 		mtx_lock(&audit_mtx);
503 	}
504 }
505 
506 /*
507  * audit_rotate_vnode() is called by a user or kernel thread to configure or
508  * de-configure auditing on a vnode.  The arguments are the replacement
509  * credential and vnode to substitute for the current credential and vnode,
510  * if any.  If either is set to NULL, both should be NULL, and this is used
511  * to indicate that audit is being disabled.  The real work is done in the
512  * audit_worker thread, but audit_rotate_vnode() waits synchronously for that
513  * to complete.
514  *
515  * The vnode should be referenced and opened by the caller.  The credential
516  * should be referenced.  audit_rotate_vnode() will own both references as of
517  * this call, so the caller should not release either.
518  *
519  * XXXAUDIT: Review synchronize communication logic.  Really, this is a
520  * message queue of depth 1.  We are essentially acquiring ownership of the
521  * communications queue, inserting our message, and waiting for an
522  * acknowledgement.
523  */
524 void
525 audit_rotate_vnode(struct ucred *cred, struct vnode *vp)
526 {
527 
528 	/*
529 	 * If other parallel log replacements have been requested, we wait
530 	 * until they've finished before continuing.
531 	 */
532 	mtx_lock(&audit_mtx);
533 	while (audit_replacement_flag != 0) {
534 		AUDIT_PRINTF(("audit_rotate_vnode: sleeping to wait for "
535 		    "flag\n"));
536 		cv_wait(&audit_replacement_cv, &audit_mtx);
537 		AUDIT_PRINTF(("audit_rotate_vnode: woken up (flag %d)\n",
538 		    audit_replacement_flag));
539 	}
540 	audit_replacement_cred = cred;
541 	audit_replacement_flag = 1;
542 	audit_replacement_vp = vp;
543 
544 	/*
545 	 * Wake up the audit worker to perform the exchange once we
546 	 * release the mutex.
547 	 */
548 	cv_signal(&audit_worker_cv);
549 
550 	/*
551 	 * Wait for the audit_worker to broadcast that a replacement has
552 	 * taken place; we know that once this has happened, our vnode
553 	 * has been replaced in, so we can return successfully.
554 	 */
555 	AUDIT_PRINTF(("audit_rotate_vnode: waiting for news of "
556 	    "replacement\n"));
557 	cv_wait(&audit_replacement_cv, &audit_mtx);
558 	AUDIT_PRINTF(("audit_rotate_vnode: change acknowledged by "
559 	    "audit_worker (flag " "now %d)\n", audit_replacement_flag));
560 	mtx_unlock(&audit_mtx);
561 
562 	audit_file_rotate_wait = 0; /* We can now request another rotation */
563 }
564 
565 void
566 audit_worker_init(void)
567 {
568 	int error;
569 
570 	cv_init(&audit_replacement_cv, "audit_replacement_cv");
571 	error = kthread_create(audit_worker, NULL, &audit_thread, RFHIGHPID,
572 	    0, "audit_worker");
573 	if (error)
574 		panic("audit_worker_init: kthread_create returned %d", error);
575 }
576