1 /*- 2 * Copyright (c) 2018 Aniket Pandey 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 17 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * SUCH DAMAGE. 24 * 25 * $FreeBSD$ 26 */ 27 28 #include <sys/param.h> 29 #include <sys/mount.h> 30 #include <sys/reboot.h> 31 #include <sys/stat.h> 32 #include <sys/sysctl.h> 33 #include <sys/time.h> 34 #include <sys/timespec.h> 35 #include <sys/timex.h> 36 37 #include <bsm/audit.h> 38 #include <bsm/audit_kevents.h> 39 #include <ufs/ufs/quota.h> 40 41 #include <atf-c.h> 42 #include <fcntl.h> 43 #include <stdlib.h> 44 #include <time.h> 45 #include <unistd.h> 46 47 #include "utils.h" 48 49 static pid_t pid; 50 static int filedesc; 51 static mode_t mode = 0777; 52 static struct pollfd fds[1]; 53 static char adregex[80]; 54 static const char *auclass = "ad"; 55 static const char *path = "fileforaudit"; 56 static const char *successreg = "fileforaudit.*return,success"; 57 58 59 ATF_TC_WITH_CLEANUP(settimeofday_success); 60 ATF_TC_HEAD(settimeofday_success, tc) 61 { 62 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 63 "settimeofday(2) call"); 64 } 65 66 ATF_TC_BODY(settimeofday_success, tc) 67 { 68 pid = getpid(); 69 snprintf(adregex, sizeof(adregex), "settimeofday.*%d.*success", pid); 70 71 struct timeval tp; 72 struct timezone tzp; 73 ATF_REQUIRE_EQ(0, gettimeofday(&tp, &tzp)); 74 75 FILE *pipefd = setup(fds, auclass); 76 /* Setting the same time as obtained by gettimeofday(2) */ 77 ATF_REQUIRE_EQ(0, settimeofday(&tp, &tzp)); 78 check_audit(fds, adregex, pipefd); 79 } 80 81 ATF_TC_CLEANUP(settimeofday_success, tc) 82 { 83 cleanup(); 84 } 85 86 87 ATF_TC_WITH_CLEANUP(settimeofday_failure); 88 ATF_TC_HEAD(settimeofday_failure, tc) 89 { 90 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 91 "settimeofday(2) call"); 92 } 93 94 ATF_TC_BODY(settimeofday_failure, tc) 95 { 96 pid = getpid(); 97 snprintf(adregex, sizeof(adregex), "settimeofday.*%d.*failure", pid); 98 99 struct timeval tp; 100 struct timezone tzp; 101 ATF_REQUIRE_EQ(0, gettimeofday(&tp, &tzp)); 102 103 FILE *pipefd = setup(fds, auclass); 104 tp.tv_sec = -1; 105 /* Failure reason: Invalid value for tp.tv_sec; */ 106 ATF_REQUIRE_EQ(-1, settimeofday(&tp, &tzp)); 107 check_audit(fds, adregex, pipefd); 108 } 109 110 ATF_TC_CLEANUP(settimeofday_failure, tc) 111 { 112 cleanup(); 113 } 114 115 116 ATF_TC_WITH_CLEANUP(clock_settime_success); 117 ATF_TC_HEAD(clock_settime_success, tc) 118 { 119 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 120 "clock_settime(2) call"); 121 } 122 123 ATF_TC_BODY(clock_settime_success, tc) 124 { 125 pid = getpid(); 126 snprintf(adregex, sizeof(adregex), "clock_settime.*%d.*success", pid); 127 128 struct timespec tp; 129 ATF_REQUIRE_EQ(0, clock_gettime(CLOCK_REALTIME, &tp)); 130 131 FILE *pipefd = setup(fds, auclass); 132 /* Setting the same time as obtained by clock_gettime(2) */ 133 ATF_REQUIRE_EQ(0, clock_settime(CLOCK_REALTIME, &tp)); 134 check_audit(fds, adregex, pipefd); 135 } 136 137 ATF_TC_CLEANUP(clock_settime_success, tc) 138 { 139 cleanup(); 140 } 141 142 143 ATF_TC_WITH_CLEANUP(clock_settime_failure); 144 ATF_TC_HEAD(clock_settime_failure, tc) 145 { 146 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 147 "clock_settime(2) call"); 148 } 149 150 ATF_TC_BODY(clock_settime_failure, tc) 151 { 152 pid = getpid(); 153 snprintf(adregex, sizeof(adregex), "clock_settime.*%d.*failure", pid); 154 155 struct timespec tp; 156 ATF_REQUIRE_EQ(0, clock_gettime(CLOCK_MONOTONIC, &tp)); 157 158 FILE *pipefd = setup(fds, auclass); 159 /* Failure reason: cannot use CLOCK_MONOTONIC to set the system time */ 160 ATF_REQUIRE_EQ(-1, clock_settime(CLOCK_MONOTONIC, &tp)); 161 check_audit(fds, adregex, pipefd); 162 } 163 164 ATF_TC_CLEANUP(clock_settime_failure, tc) 165 { 166 cleanup(); 167 } 168 169 170 ATF_TC_WITH_CLEANUP(adjtime_success); 171 ATF_TC_HEAD(adjtime_success, tc) 172 { 173 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 174 "adjtime(2) call"); 175 } 176 177 ATF_TC_BODY(adjtime_success, tc) 178 { 179 pid = getpid(); 180 snprintf(adregex, sizeof(adregex), "adjtime.*%d.*return,success", pid); 181 182 FILE *pipefd = setup(fds, auclass); 183 /* We don't want to change the system time, hence NULL */ 184 ATF_REQUIRE_EQ(0, adjtime(NULL, NULL)); 185 check_audit(fds, adregex, pipefd); 186 } 187 188 ATF_TC_CLEANUP(adjtime_success, tc) 189 { 190 cleanup(); 191 } 192 193 194 ATF_TC_WITH_CLEANUP(adjtime_failure); 195 ATF_TC_HEAD(adjtime_failure, tc) 196 { 197 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 198 "adjtime(2) call"); 199 } 200 201 ATF_TC_BODY(adjtime_failure, tc) 202 { 203 pid = getpid(); 204 snprintf(adregex, sizeof(adregex), "adjtime.*%d.*return,failure", pid); 205 206 FILE *pipefd = setup(fds, auclass); 207 ATF_REQUIRE_EQ(-1, adjtime((struct timeval *)(-1), NULL)); 208 check_audit(fds, adregex, pipefd); 209 } 210 211 ATF_TC_CLEANUP(adjtime_failure, tc) 212 { 213 cleanup(); 214 } 215 216 217 ATF_TC_WITH_CLEANUP(ntp_adjtime_success); 218 ATF_TC_HEAD(ntp_adjtime_success, tc) 219 { 220 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 221 "ntp_adjtime(2) call"); 222 } 223 224 ATF_TC_BODY(ntp_adjtime_success, tc) 225 { 226 struct timex timebuff; 227 bzero(&timebuff, sizeof(timebuff)); 228 229 pid = getpid(); 230 snprintf(adregex, sizeof(adregex), "ntp_adjtime.*%d.*success", pid); 231 232 FILE *pipefd = setup(fds, auclass); 233 ATF_REQUIRE(ntp_adjtime(&timebuff) != -1); 234 check_audit(fds, adregex, pipefd); 235 } 236 237 ATF_TC_CLEANUP(ntp_adjtime_success, tc) 238 { 239 cleanup(); 240 } 241 242 243 ATF_TC_WITH_CLEANUP(ntp_adjtime_failure); 244 ATF_TC_HEAD(ntp_adjtime_failure, tc) 245 { 246 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 247 "ntp_adjtime(2) call"); 248 } 249 250 ATF_TC_BODY(ntp_adjtime_failure, tc) 251 { 252 pid = getpid(); 253 snprintf(adregex, sizeof(adregex), "ntp_adjtime.*%d.*failure", pid); 254 255 FILE *pipefd = setup(fds, auclass); 256 ATF_REQUIRE_EQ(-1, ntp_adjtime(NULL)); 257 check_audit(fds, adregex, pipefd); 258 } 259 260 ATF_TC_CLEANUP(ntp_adjtime_failure, tc) 261 { 262 cleanup(); 263 } 264 265 266 ATF_TC_WITH_CLEANUP(nfs_getfh_success); 267 ATF_TC_HEAD(nfs_getfh_success, tc) 268 { 269 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 270 "getfh(2) call"); 271 } 272 273 ATF_TC_BODY(nfs_getfh_success, tc) 274 { 275 fhandle_t fhp; 276 pid = getpid(); 277 snprintf(adregex, sizeof(adregex), "nfs_getfh.*%d.*ret.*success", pid); 278 279 /* File needs to exist to call getfh(2) */ 280 ATF_REQUIRE((filedesc = open(path, O_CREAT, mode)) != -1); 281 FILE *pipefd = setup(fds, auclass); 282 ATF_REQUIRE_EQ(0, getfh(path, &fhp)); 283 check_audit(fds, adregex, pipefd); 284 close(filedesc); 285 } 286 287 ATF_TC_CLEANUP(nfs_getfh_success, tc) 288 { 289 cleanup(); 290 } 291 292 293 ATF_TC_WITH_CLEANUP(nfs_getfh_failure); 294 ATF_TC_HEAD(nfs_getfh_failure, tc) 295 { 296 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 297 "getfh(2) call"); 298 } 299 300 ATF_TC_BODY(nfs_getfh_failure, tc) 301 { 302 pid = getpid(); 303 snprintf(adregex, sizeof(adregex), "nfs_getfh.*%d.*ret.*failure", pid); 304 305 FILE *pipefd = setup(fds, auclass); 306 /* Failure reason: file does not exist */ 307 ATF_REQUIRE_EQ(-1, getfh(path, NULL)); 308 check_audit(fds, adregex, pipefd); 309 } 310 311 ATF_TC_CLEANUP(nfs_getfh_failure, tc) 312 { 313 cleanup(); 314 } 315 316 317 ATF_TC_WITH_CLEANUP(auditctl_success); 318 ATF_TC_HEAD(auditctl_success, tc) 319 { 320 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 321 "auditctl(2) call"); 322 } 323 324 ATF_TC_BODY(auditctl_success, tc) 325 { 326 /* File needs to exist in order to call auditctl(2) */ 327 ATF_REQUIRE((filedesc = open(path, O_CREAT | O_WRONLY, mode)) != -1); 328 FILE *pipefd = setup(fds, auclass); 329 ATF_REQUIRE_EQ(0, auditctl(path)); 330 check_audit(fds, successreg, pipefd); 331 close(filedesc); 332 } 333 334 ATF_TC_CLEANUP(auditctl_success, tc) 335 { 336 /* 337 * auditctl(2) disables audit log at /var/audit and initiates auditing 338 * at the configured path. To reset this, we need to stop and start the 339 * auditd(8) again. Here, we check if auditd(8) was running already 340 * before the test started. If so, we stop and start it again. 341 */ 342 system("service auditd onestop > /dev/null 2>&1"); 343 if (!atf_utils_file_exists("started_auditd")) 344 system("service auditd onestart > /dev/null 2>&1"); 345 } 346 347 348 ATF_TC_WITH_CLEANUP(auditctl_failure); 349 ATF_TC_HEAD(auditctl_failure, tc) 350 { 351 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 352 "auditctl(2) call"); 353 } 354 355 ATF_TC_BODY(auditctl_failure, tc) 356 { 357 pid = getpid(); 358 snprintf(adregex, sizeof(adregex), "auditctl.*%d.*return,failure", pid); 359 360 FILE *pipefd = setup(fds, auclass); 361 /* Failure reason: file does not exist */ 362 ATF_REQUIRE_EQ(-1, auditctl(NULL)); 363 check_audit(fds, adregex, pipefd); 364 } 365 366 ATF_TC_CLEANUP(auditctl_failure, tc) 367 { 368 cleanup(); 369 } 370 371 372 ATF_TC_WITH_CLEANUP(acct_success); 373 ATF_TC_HEAD(acct_success, tc) 374 { 375 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 376 "acct(2) call"); 377 } 378 379 ATF_TC_BODY(acct_success, tc) 380 { 381 int acctinfo, filedesc2; 382 size_t len = sizeof(acctinfo); 383 const char *acctname = "kern.acct_configured"; 384 ATF_REQUIRE_EQ(0, sysctlbyname(acctname, &acctinfo, &len, NULL, 0)); 385 386 /* File needs to exist to start system accounting */ 387 ATF_REQUIRE((filedesc = open(path, O_CREAT | O_RDWR, mode)) != -1); 388 389 /* 390 * acctinfo = 0: System accounting was disabled 391 * acctinfo = 1: System accounting was enabled 392 */ 393 if (acctinfo) { 394 ATF_REQUIRE((filedesc2 = open("acct_ok", O_CREAT, mode)) != -1); 395 close(filedesc2); 396 } 397 398 pid = getpid(); 399 snprintf(adregex, sizeof(adregex), 400 "acct.*%s.*%d.*return,success", path, pid); 401 402 /* 403 * We temporarily switch the accounting record to a file at 404 * our own configured path in order to confirm acct(2)'s successful 405 * auditing. Then we set everything back to its original state. 406 */ 407 FILE *pipefd = setup(fds, auclass); 408 ATF_REQUIRE_EQ(0, acct(path)); 409 check_audit(fds, adregex, pipefd); 410 close(filedesc); 411 } 412 413 ATF_TC_CLEANUP(acct_success, tc) 414 { 415 /* Reset accounting configured path */ 416 ATF_REQUIRE_EQ(0, system("service accounting onestop")); 417 if (atf_utils_file_exists("acct_ok")) { 418 ATF_REQUIRE_EQ(0, system("service accounting onestart")); 419 } 420 cleanup(); 421 } 422 423 424 ATF_TC_WITH_CLEANUP(acct_failure); 425 ATF_TC_HEAD(acct_failure, tc) 426 { 427 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 428 "acct(2) call"); 429 } 430 431 ATF_TC_BODY(acct_failure, tc) 432 { 433 pid = getpid(); 434 snprintf(adregex, sizeof(adregex), "acct.*%d.*return,failure", pid); 435 436 FILE *pipefd = setup(fds, auclass); 437 /* Failure reason: File does not exist */ 438 ATF_REQUIRE_EQ(-1, acct(path)); 439 check_audit(fds, adregex, pipefd); 440 } 441 442 ATF_TC_CLEANUP(acct_failure, tc) 443 { 444 cleanup(); 445 } 446 447 448 ATF_TC_WITH_CLEANUP(getauid_success); 449 ATF_TC_HEAD(getauid_success, tc) 450 { 451 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 452 "getauid(2) call"); 453 } 454 455 ATF_TC_BODY(getauid_success, tc) 456 { 457 au_id_t auid; 458 pid = getpid(); 459 snprintf(adregex, sizeof(adregex), "getauid.*%d.*return,success", pid); 460 461 FILE *pipefd = setup(fds, auclass); 462 ATF_REQUIRE_EQ(0, getauid(&auid)); 463 check_audit(fds, adregex, pipefd); 464 } 465 466 ATF_TC_CLEANUP(getauid_success, tc) 467 { 468 cleanup(); 469 } 470 471 472 ATF_TC_WITH_CLEANUP(getauid_failure); 473 ATF_TC_HEAD(getauid_failure, tc) 474 { 475 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 476 "getauid(2) call"); 477 } 478 479 ATF_TC_BODY(getauid_failure, tc) 480 { 481 pid = getpid(); 482 snprintf(adregex, sizeof(adregex), "getauid.*%d.*return,failure", pid); 483 484 FILE *pipefd = setup(fds, auclass); 485 /* Failure reason: Bad address */ 486 ATF_REQUIRE_EQ(-1, getauid(NULL)); 487 check_audit(fds, adregex, pipefd); 488 } 489 490 ATF_TC_CLEANUP(getauid_failure, tc) 491 { 492 cleanup(); 493 } 494 495 496 ATF_TC_WITH_CLEANUP(setauid_success); 497 ATF_TC_HEAD(setauid_success, tc) 498 { 499 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 500 "setauid(2) call"); 501 } 502 503 ATF_TC_BODY(setauid_success, tc) 504 { 505 au_id_t auid; 506 pid = getpid(); 507 snprintf(adregex, sizeof(adregex), "setauid.*%d.*return,success", pid); 508 ATF_REQUIRE_EQ(0, getauid(&auid)); 509 510 FILE *pipefd = setup(fds, auclass); 511 ATF_REQUIRE_EQ(0, setauid(&auid)); 512 check_audit(fds, adregex, pipefd); 513 } 514 515 ATF_TC_CLEANUP(setauid_success, tc) 516 { 517 cleanup(); 518 } 519 520 521 ATF_TC_WITH_CLEANUP(setauid_failure); 522 ATF_TC_HEAD(setauid_failure, tc) 523 { 524 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 525 "setauid(2) call"); 526 } 527 528 ATF_TC_BODY(setauid_failure, tc) 529 { 530 pid = getpid(); 531 snprintf(adregex, sizeof(adregex), "setauid.*%d.*return,failure", pid); 532 533 FILE *pipefd = setup(fds, auclass); 534 /* Failure reason: Bad address */ 535 ATF_REQUIRE_EQ(-1, setauid(NULL)); 536 check_audit(fds, adregex, pipefd); 537 } 538 539 ATF_TC_CLEANUP(setauid_failure, tc) 540 { 541 cleanup(); 542 } 543 544 545 ATF_TC_WITH_CLEANUP(getaudit_success); 546 ATF_TC_HEAD(getaudit_success, tc) 547 { 548 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 549 "getaudit(2) call"); 550 } 551 552 ATF_TC_BODY(getaudit_success, tc) 553 { 554 pid = getpid(); 555 auditinfo_t auditinfo; 556 snprintf(adregex, sizeof(adregex), "getaudit.*%d.*return,success", pid); 557 558 FILE *pipefd = setup(fds, auclass); 559 ATF_REQUIRE_EQ(0, getaudit(&auditinfo)); 560 check_audit(fds, adregex, pipefd); 561 } 562 563 ATF_TC_CLEANUP(getaudit_success, tc) 564 { 565 cleanup(); 566 } 567 568 569 ATF_TC_WITH_CLEANUP(getaudit_failure); 570 ATF_TC_HEAD(getaudit_failure, tc) 571 { 572 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 573 "getaudit(2) call"); 574 } 575 576 ATF_TC_BODY(getaudit_failure, tc) 577 { 578 pid = getpid(); 579 snprintf(adregex, sizeof(adregex), "getaudit.*%d.*return,failure", pid); 580 581 FILE *pipefd = setup(fds, auclass); 582 /* Failure reason: Bad address */ 583 ATF_REQUIRE_EQ(-1, getaudit(NULL)); 584 check_audit(fds, adregex, pipefd); 585 } 586 587 ATF_TC_CLEANUP(getaudit_failure, tc) 588 { 589 cleanup(); 590 } 591 592 593 ATF_TC_WITH_CLEANUP(setaudit_success); 594 ATF_TC_HEAD(setaudit_success, tc) 595 { 596 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 597 "setaudit(2) call"); 598 } 599 600 ATF_TC_BODY(setaudit_success, tc) 601 { 602 pid = getpid(); 603 auditinfo_t auditinfo; 604 snprintf(adregex, sizeof(adregex), "setaudit.*%d.*return,success", pid); 605 ATF_REQUIRE_EQ(0, getaudit(&auditinfo)); 606 607 FILE *pipefd = setup(fds, auclass); 608 ATF_REQUIRE_EQ(0, setaudit(&auditinfo)); 609 check_audit(fds, adregex, pipefd); 610 } 611 612 ATF_TC_CLEANUP(setaudit_success, tc) 613 { 614 cleanup(); 615 } 616 617 618 ATF_TC_WITH_CLEANUP(setaudit_failure); 619 ATF_TC_HEAD(setaudit_failure, tc) 620 { 621 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 622 "setaudit(2) call"); 623 } 624 625 ATF_TC_BODY(setaudit_failure, tc) 626 { 627 pid = getpid(); 628 snprintf(adregex, sizeof(adregex), "setaudit.*%d.*return,failure", pid); 629 630 FILE *pipefd = setup(fds, auclass); 631 /* Failure reason: Bad address */ 632 ATF_REQUIRE_EQ(-1, setaudit(NULL)); 633 check_audit(fds, adregex, pipefd); 634 } 635 636 ATF_TC_CLEANUP(setaudit_failure, tc) 637 { 638 cleanup(); 639 } 640 641 642 ATF_TC_WITH_CLEANUP(getaudit_addr_success); 643 ATF_TC_HEAD(getaudit_addr_success, tc) 644 { 645 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 646 "getaudit_addr(2) call"); 647 } 648 649 ATF_TC_BODY(getaudit_addr_success, tc) 650 { 651 pid = getpid(); 652 auditinfo_addr_t auditinfo; 653 snprintf(adregex, sizeof(adregex), 654 "getaudit_addr.*%d.*return,success", pid); 655 656 FILE *pipefd = setup(fds, auclass); 657 ATF_REQUIRE_EQ(0, getaudit_addr(&auditinfo, sizeof(auditinfo))); 658 check_audit(fds, adregex, pipefd); 659 } 660 661 ATF_TC_CLEANUP(getaudit_addr_success, tc) 662 { 663 cleanup(); 664 } 665 666 667 ATF_TC_WITH_CLEANUP(getaudit_addr_failure); 668 ATF_TC_HEAD(getaudit_addr_failure, tc) 669 { 670 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 671 "getaudit_addr(2) call"); 672 } 673 674 ATF_TC_BODY(getaudit_addr_failure, tc) 675 { 676 pid = getpid(); 677 snprintf(adregex, sizeof(adregex), 678 "getaudit_addr.*%d.*return,failure", pid); 679 680 FILE *pipefd = setup(fds, auclass); 681 /* Failure reason: Bad address */ 682 ATF_REQUIRE_EQ(-1, getaudit_addr(NULL, 0)); 683 check_audit(fds, adregex, pipefd); 684 } 685 686 ATF_TC_CLEANUP(getaudit_addr_failure, tc) 687 { 688 cleanup(); 689 } 690 691 692 ATF_TC_WITH_CLEANUP(setaudit_addr_success); 693 ATF_TC_HEAD(setaudit_addr_success, tc) 694 { 695 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 696 "setaudit_addr(2) call"); 697 } 698 699 ATF_TC_BODY(setaudit_addr_success, tc) 700 { 701 pid = getpid(); 702 auditinfo_addr_t auditinfo; 703 snprintf(adregex, sizeof(adregex), 704 "setaudit_addr.*%d.*return,success", pid); 705 706 ATF_REQUIRE_EQ(0, getaudit_addr(&auditinfo, sizeof(auditinfo))); 707 FILE *pipefd = setup(fds, auclass); 708 ATF_REQUIRE_EQ(0, setaudit_addr(&auditinfo, sizeof(auditinfo))); 709 check_audit(fds, adregex, pipefd); 710 } 711 712 ATF_TC_CLEANUP(setaudit_addr_success, tc) 713 { 714 cleanup(); 715 } 716 717 718 ATF_TC_WITH_CLEANUP(setaudit_addr_failure); 719 ATF_TC_HEAD(setaudit_addr_failure, tc) 720 { 721 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 722 "setaudit_addr(2) call"); 723 } 724 725 ATF_TC_BODY(setaudit_addr_failure, tc) 726 { 727 pid = getpid(); 728 snprintf(adregex, sizeof(adregex), 729 "setaudit_addr.*%d.*return,failure", pid); 730 731 FILE *pipefd = setup(fds, auclass); 732 /* Failure reason: Bad address */ 733 ATF_REQUIRE_EQ(-1, setaudit_addr(NULL, 0)); 734 check_audit(fds, adregex, pipefd); 735 } 736 737 ATF_TC_CLEANUP(setaudit_addr_failure, tc) 738 { 739 cleanup(); 740 } 741 742 743 ATF_TC_WITH_CLEANUP(auditon_getpolicy_success); 744 ATF_TC_HEAD(auditon_getpolicy_success, tc) 745 { 746 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 747 "auditon(2) call for cmd: A_GETPOLICY"); 748 } 749 750 ATF_TC_BODY(auditon_getpolicy_success, tc) 751 { 752 int aupolicy; 753 pid = getpid(); 754 snprintf(adregex, sizeof(adregex), "GPOLICY command.*%d.*success", pid); 755 756 FILE *pipefd = setup(fds, auclass); 757 ATF_REQUIRE_EQ(0, auditon(A_GETPOLICY, &aupolicy, sizeof(aupolicy))); 758 check_audit(fds, adregex, pipefd); 759 } 760 761 ATF_TC_CLEANUP(auditon_getpolicy_success, tc) 762 { 763 cleanup(); 764 } 765 766 767 ATF_TC_WITH_CLEANUP(auditon_getpolicy_failure); 768 ATF_TC_HEAD(auditon_getpolicy_failure, tc) 769 { 770 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 771 "auditon(2) call for cmd: A_GETPOLICY"); 772 } 773 774 ATF_TC_BODY(auditon_getpolicy_failure, tc) 775 { 776 pid = getpid(); 777 snprintf(adregex, sizeof(adregex), "GPOLICY command.*%d.*failure", pid); 778 779 FILE *pipefd = setup(fds, auclass); 780 /* Failure reason: Invalid argument */ 781 ATF_REQUIRE_EQ(-1, auditon(A_GETPOLICY, NULL, 0)); 782 check_audit(fds, adregex, pipefd); 783 } 784 785 ATF_TC_CLEANUP(auditon_getpolicy_failure, tc) 786 { 787 cleanup(); 788 } 789 790 791 ATF_TC_WITH_CLEANUP(auditon_setpolicy_success); 792 ATF_TC_HEAD(auditon_setpolicy_success, tc) 793 { 794 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 795 "auditon(2) call for cmd: A_SETPOLICY"); 796 } 797 798 ATF_TC_BODY(auditon_setpolicy_success, tc) 799 { 800 int aupolicy; 801 pid = getpid(); 802 snprintf(adregex, sizeof(adregex), "SPOLICY command.*%d.*success", pid); 803 804 /* Retrieve the current auditing policy, to be used with A_SETPOLICY */ 805 ATF_REQUIRE_EQ(0, auditon(A_GETPOLICY, &aupolicy, sizeof(aupolicy))); 806 FILE *pipefd = setup(fds, auclass); 807 ATF_REQUIRE_EQ(0, auditon(A_SETPOLICY, &aupolicy, sizeof(aupolicy))); 808 check_audit(fds, adregex, pipefd); 809 } 810 811 ATF_TC_CLEANUP(auditon_setpolicy_success, tc) 812 { 813 cleanup(); 814 } 815 816 817 ATF_TC_WITH_CLEANUP(auditon_setpolicy_failure); 818 ATF_TC_HEAD(auditon_setpolicy_failure, tc) 819 { 820 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 821 "auditon(2) call for cmd: A_SETPOLICY"); 822 } 823 824 ATF_TC_BODY(auditon_setpolicy_failure, tc) 825 { 826 pid = getpid(); 827 snprintf(adregex, sizeof(adregex), "SPOLICY command.*%d.*failure", pid); 828 829 FILE *pipefd = setup(fds, auclass); 830 /* Failure reason: Invalid argument */ 831 ATF_REQUIRE_EQ(-1, auditon(A_SETPOLICY, NULL, 0)); 832 check_audit(fds, adregex, pipefd); 833 } 834 835 ATF_TC_CLEANUP(auditon_setpolicy_failure, tc) 836 { 837 cleanup(); 838 } 839 840 841 ATF_TC_WITH_CLEANUP(auditon_getkmask_success); 842 ATF_TC_HEAD(auditon_getkmask_success, tc) 843 { 844 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 845 "auditon(2) call for cmd: A_GETKMASK"); 846 } 847 848 ATF_TC_BODY(auditon_getkmask_success, tc) 849 { 850 pid = getpid(); 851 au_mask_t evmask; 852 snprintf(adregex, sizeof(adregex), "get kernel mask.*%d.*success", pid); 853 854 bzero(&evmask, sizeof(evmask)); 855 FILE *pipefd = setup(fds, auclass); 856 ATF_REQUIRE_EQ(0, auditon(A_GETKMASK, &evmask, sizeof(evmask))); 857 check_audit(fds, adregex, pipefd); 858 } 859 860 ATF_TC_CLEANUP(auditon_getkmask_success, tc) 861 { 862 cleanup(); 863 } 864 865 866 ATF_TC_WITH_CLEANUP(auditon_getkmask_failure); 867 ATF_TC_HEAD(auditon_getkmask_failure, tc) 868 { 869 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 870 "auditon(2) call for cmd: A_GETKMASK"); 871 } 872 873 ATF_TC_BODY(auditon_getkmask_failure, tc) 874 { 875 pid = getpid(); 876 snprintf(adregex, sizeof(adregex), "get kernel mask.*%d.*failure", pid); 877 878 FILE *pipefd = setup(fds, auclass); 879 /* Failure reason: Invalid au_mask_t structure */ 880 ATF_REQUIRE_EQ(-1, auditon(A_GETKMASK, NULL, 0)); 881 check_audit(fds, adregex, pipefd); 882 } 883 884 ATF_TC_CLEANUP(auditon_getkmask_failure, tc) 885 { 886 cleanup(); 887 } 888 889 890 ATF_TC_WITH_CLEANUP(auditon_setkmask_success); 891 ATF_TC_HEAD(auditon_setkmask_success, tc) 892 { 893 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 894 "auditon(2) call for cmd: A_SETKMASK"); 895 } 896 897 ATF_TC_BODY(auditon_setkmask_success, tc) 898 { 899 pid = getpid(); 900 au_mask_t evmask; 901 snprintf(adregex, sizeof(adregex), "set kernel mask.*%d.*success", pid); 902 903 /* Retrieve the current audit mask to be used with A_SETKMASK */ 904 bzero(&evmask, sizeof(evmask)); 905 ATF_REQUIRE_EQ(0, auditon(A_GETKMASK, &evmask, sizeof(evmask))); 906 907 FILE *pipefd = setup(fds, auclass); 908 ATF_REQUIRE_EQ(0, auditon(A_SETKMASK, &evmask, sizeof(evmask))); 909 check_audit(fds, adregex, pipefd); 910 } 911 912 ATF_TC_CLEANUP(auditon_setkmask_success, tc) 913 { 914 cleanup(); 915 } 916 917 918 ATF_TC_WITH_CLEANUP(auditon_setkmask_failure); 919 ATF_TC_HEAD(auditon_setkmask_failure, tc) 920 { 921 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 922 "auditon(2) call for cmd: A_SETKMASK"); 923 } 924 925 ATF_TC_BODY(auditon_setkmask_failure, tc) 926 { 927 pid = getpid(); 928 snprintf(adregex, sizeof(adregex), "set kernel mask.*%d.*failure", pid); 929 930 FILE *pipefd = setup(fds, auclass); 931 /* Failure reason: Invalid au_mask_t structure */ 932 ATF_REQUIRE_EQ(-1, auditon(A_SETKMASK, NULL, 0)); 933 check_audit(fds, adregex, pipefd); 934 } 935 936 ATF_TC_CLEANUP(auditon_setkmask_failure, tc) 937 { 938 cleanup(); 939 } 940 941 942 ATF_TC_WITH_CLEANUP(auditon_getqctrl_success); 943 ATF_TC_HEAD(auditon_getqctrl_success, tc) 944 { 945 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 946 "auditon(2) call for cmd: A_GETQCTRL"); 947 } 948 949 ATF_TC_BODY(auditon_getqctrl_success, tc) 950 { 951 pid = getpid(); 952 au_qctrl_t evqctrl; 953 snprintf(adregex, sizeof(adregex), "GQCTRL command.*%d.*success", pid); 954 955 bzero(&evqctrl, sizeof(evqctrl)); 956 FILE *pipefd = setup(fds, auclass); 957 ATF_REQUIRE_EQ(0, auditon(A_GETQCTRL, &evqctrl, sizeof(evqctrl))); 958 check_audit(fds, adregex, pipefd); 959 } 960 961 ATF_TC_CLEANUP(auditon_getqctrl_success, tc) 962 { 963 cleanup(); 964 } 965 966 967 ATF_TC_WITH_CLEANUP(auditon_getqctrl_failure); 968 ATF_TC_HEAD(auditon_getqctrl_failure, tc) 969 { 970 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 971 "auditon(2) call for cmd: A_GETQCTRL"); 972 } 973 974 ATF_TC_BODY(auditon_getqctrl_failure, tc) 975 { 976 pid = getpid(); 977 snprintf(adregex, sizeof(adregex), "GQCTRL command.*%d.*failure", pid); 978 979 FILE *pipefd = setup(fds, auclass); 980 /* Failure reason: Invalid au_qctrl_t structure */ 981 ATF_REQUIRE_EQ(-1, auditon(A_GETQCTRL, NULL, 0)); 982 check_audit(fds, adregex, pipefd); 983 } 984 985 ATF_TC_CLEANUP(auditon_getqctrl_failure, tc) 986 { 987 cleanup(); 988 } 989 990 991 ATF_TC_WITH_CLEANUP(auditon_setqctrl_success); 992 ATF_TC_HEAD(auditon_setqctrl_success, tc) 993 { 994 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 995 "auditon(2) call for cmd: A_SETKMASK"); 996 } 997 998 ATF_TC_BODY(auditon_setqctrl_success, tc) 999 { 1000 pid = getpid(); 1001 au_qctrl_t evqctrl; 1002 snprintf(adregex, sizeof(adregex), "SQCTRL command.*%d.*success", pid); 1003 1004 /* Retrieve the current audit mask to be used with A_SETQCTRL */ 1005 bzero(&evqctrl, sizeof(evqctrl)); 1006 ATF_REQUIRE_EQ(0, auditon(A_GETQCTRL, &evqctrl, sizeof(evqctrl))); 1007 1008 FILE *pipefd = setup(fds, auclass); 1009 ATF_REQUIRE_EQ(0, auditon(A_SETQCTRL, &evqctrl, sizeof(evqctrl))); 1010 check_audit(fds, adregex, pipefd); 1011 } 1012 1013 ATF_TC_CLEANUP(auditon_setqctrl_success, tc) 1014 { 1015 cleanup(); 1016 } 1017 1018 1019 ATF_TC_WITH_CLEANUP(auditon_setqctrl_failure); 1020 ATF_TC_HEAD(auditon_setqctrl_failure, tc) 1021 { 1022 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 1023 "auditon(2) call for cmd: A_SETKMASK"); 1024 } 1025 1026 ATF_TC_BODY(auditon_setqctrl_failure, tc) 1027 { 1028 pid = getpid(); 1029 snprintf(adregex, sizeof(adregex), "SQCTRL command.*%d.*failure", pid); 1030 1031 FILE *pipefd = setup(fds, auclass); 1032 /* Failure reason: Invalid au_qctrl_t structure */ 1033 ATF_REQUIRE_EQ(-1, auditon(A_SETQCTRL, NULL, 0)); 1034 check_audit(fds, adregex, pipefd); 1035 } 1036 1037 ATF_TC_CLEANUP(auditon_setqctrl_failure, tc) 1038 { 1039 cleanup(); 1040 } 1041 1042 1043 ATF_TC_WITH_CLEANUP(auditon_getclass_success); 1044 ATF_TC_HEAD(auditon_getclass_success, tc) 1045 { 1046 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 1047 "auditon(2) call for cmd: A_GETCLASS"); 1048 } 1049 1050 ATF_TC_BODY(auditon_getclass_success, tc) 1051 { 1052 pid = getpid(); 1053 au_evclass_map_t evclass; 1054 snprintf(adregex, sizeof(adregex), "get event class.*%d.*success", pid); 1055 1056 /* Initialize evclass to get the event-class mapping for auditon(2) */ 1057 evclass.ec_number = AUE_AUDITON; 1058 evclass.ec_class = 0; 1059 FILE *pipefd = setup(fds, auclass); 1060 ATF_REQUIRE_EQ(0, auditon(A_GETCLASS, &evclass, sizeof(evclass))); 1061 check_audit(fds, adregex, pipefd); 1062 } 1063 1064 ATF_TC_CLEANUP(auditon_getclass_success, tc) 1065 { 1066 cleanup(); 1067 } 1068 1069 1070 ATF_TC_WITH_CLEANUP(auditon_getclass_failure); 1071 ATF_TC_HEAD(auditon_getclass_failure, tc) 1072 { 1073 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 1074 "auditon(2) call for cmd: A_GETCLASS"); 1075 } 1076 1077 ATF_TC_BODY(auditon_getclass_failure, tc) 1078 { 1079 pid = getpid(); 1080 snprintf(adregex, sizeof(adregex), "get event class.*%d.*failure", pid); 1081 1082 FILE *pipefd = setup(fds, auclass); 1083 /* Failure reason: Invalid au_evclass_map_t structure */ 1084 ATF_REQUIRE_EQ(-1, auditon(A_GETCLASS, NULL, 0)); 1085 check_audit(fds, adregex, pipefd); 1086 } 1087 1088 ATF_TC_CLEANUP(auditon_getclass_failure, tc) 1089 { 1090 cleanup(); 1091 } 1092 1093 1094 ATF_TC_WITH_CLEANUP(auditon_setclass_success); 1095 ATF_TC_HEAD(auditon_setclass_success, tc) 1096 { 1097 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 1098 "auditon(2) call for cmd: A_SETCLASS"); 1099 } 1100 1101 ATF_TC_BODY(auditon_setclass_success, tc) 1102 { 1103 pid = getpid(); 1104 au_evclass_map_t evclass; 1105 snprintf(adregex, sizeof(adregex), "set event class.*%d.*success", pid); 1106 1107 /* Initialize evclass and get the event-class mapping for auditon(2) */ 1108 evclass.ec_number = AUE_AUDITON; 1109 evclass.ec_class = 0; 1110 ATF_REQUIRE_EQ(0, auditon(A_GETCLASS, &evclass, sizeof(evclass))); 1111 1112 FILE *pipefd = setup(fds, auclass); 1113 ATF_REQUIRE_EQ(0, auditon(A_SETCLASS, &evclass, sizeof(evclass))); 1114 check_audit(fds, adregex, pipefd); 1115 } 1116 1117 ATF_TC_CLEANUP(auditon_setclass_success, tc) 1118 { 1119 cleanup(); 1120 } 1121 1122 1123 ATF_TC_WITH_CLEANUP(auditon_setclass_failure); 1124 ATF_TC_HEAD(auditon_setclass_failure, tc) 1125 { 1126 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 1127 "auditon(2) call for cmd: A_SETCLASS"); 1128 } 1129 1130 ATF_TC_BODY(auditon_setclass_failure, tc) 1131 { 1132 pid = getpid(); 1133 snprintf(adregex, sizeof(adregex), "set event class.*%d.*failure", pid); 1134 1135 FILE *pipefd = setup(fds, auclass); 1136 /* Failure reason: Invalid au_evclass_map_t structure */ 1137 ATF_REQUIRE_EQ(-1, auditon(A_SETCLASS, NULL, 0)); 1138 check_audit(fds, adregex, pipefd); 1139 } 1140 1141 ATF_TC_CLEANUP(auditon_setclass_failure, tc) 1142 { 1143 cleanup(); 1144 } 1145 1146 1147 ATF_TC_WITH_CLEANUP(auditon_getcond_success); 1148 ATF_TC_HEAD(auditon_getcond_success, tc) 1149 { 1150 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 1151 "auditon(2) call for cmd: A_GETCOND"); 1152 } 1153 1154 ATF_TC_BODY(auditon_getcond_success, tc) 1155 { 1156 int auditcond; 1157 pid = getpid(); 1158 snprintf(adregex, sizeof(adregex), "get audit state.*%d.*success", pid); 1159 1160 FILE *pipefd = setup(fds, auclass); 1161 ATF_REQUIRE_EQ(0, auditon(A_GETCOND, &auditcond, sizeof(auditcond))); 1162 check_audit(fds, adregex, pipefd); 1163 } 1164 1165 ATF_TC_CLEANUP(auditon_getcond_success, tc) 1166 { 1167 cleanup(); 1168 } 1169 1170 1171 ATF_TC_WITH_CLEANUP(auditon_getcond_failure); 1172 ATF_TC_HEAD(auditon_getcond_failure, tc) 1173 { 1174 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 1175 "auditon(2) call for cmd: A_GETCOND"); 1176 } 1177 1178 ATF_TC_BODY(auditon_getcond_failure, tc) 1179 { 1180 pid = getpid(); 1181 snprintf(adregex, sizeof(adregex), "get audit state.*%d.*failure", pid); 1182 1183 FILE *pipefd = setup(fds, auclass); 1184 /* Failure reason: Invalid argument */ 1185 ATF_REQUIRE_EQ(-1, auditon(A_GETCOND, NULL, 0)); 1186 check_audit(fds, adregex, pipefd); 1187 } 1188 1189 ATF_TC_CLEANUP(auditon_getcond_failure, tc) 1190 { 1191 cleanup(); 1192 } 1193 1194 1195 ATF_TC_WITH_CLEANUP(auditon_setcond_success); 1196 ATF_TC_HEAD(auditon_setcond_success, tc) 1197 { 1198 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 1199 "auditon(2) call for cmd: A_SETCOND"); 1200 } 1201 1202 ATF_TC_BODY(auditon_setcond_success, tc) 1203 { 1204 int auditcond = AUC_AUDITING; 1205 pid = getpid(); 1206 snprintf(adregex, sizeof(adregex), "set audit state.*%d.*success", pid); 1207 1208 FILE *pipefd = setup(fds, auclass); 1209 /* At this point auditd is running, so the audit state is AUC_AUDITING */ 1210 ATF_REQUIRE_EQ(0, auditon(A_SETCOND, &auditcond, sizeof(auditcond))); 1211 check_audit(fds, adregex, pipefd); 1212 } 1213 1214 ATF_TC_CLEANUP(auditon_setcond_success, tc) 1215 { 1216 cleanup(); 1217 } 1218 1219 1220 ATF_TC_WITH_CLEANUP(auditon_setcond_failure); 1221 ATF_TC_HEAD(auditon_setcond_failure, tc) 1222 { 1223 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 1224 "auditon(2) call for cmd: A_SETCOND"); 1225 } 1226 1227 ATF_TC_BODY(auditon_setcond_failure, tc) 1228 { 1229 pid = getpid(); 1230 snprintf(adregex, sizeof(adregex), "set audit state.*%d.*failure", pid); 1231 1232 FILE *pipefd = setup(fds, auclass); 1233 /* Failure reason: Invalid argument */ 1234 ATF_REQUIRE_EQ(-1, auditon(A_SETCOND, NULL, 0)); 1235 check_audit(fds, adregex, pipefd); 1236 } 1237 1238 ATF_TC_CLEANUP(auditon_setcond_failure, tc) 1239 { 1240 cleanup(); 1241 } 1242 1243 1244 /* 1245 * Audit of reboot(2) cannot be tested in normal conditions as we don't want 1246 * to reboot the system while running the tests 1247 */ 1248 1249 1250 ATF_TC_WITH_CLEANUP(reboot_failure); 1251 ATF_TC_HEAD(reboot_failure, tc) 1252 { 1253 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 1254 "reboot(2) call"); 1255 } 1256 1257 ATF_TC_BODY(reboot_failure, tc) 1258 { 1259 pid = getpid(); 1260 snprintf(adregex, sizeof(adregex), "reboot.*%d.*return,failure", pid); 1261 1262 FILE *pipefd = setup(fds, auclass); 1263 ATF_REQUIRE_EQ(-1, reboot(-1)); 1264 check_audit(fds, adregex, pipefd); 1265 } 1266 1267 ATF_TC_CLEANUP(reboot_failure, tc) 1268 { 1269 cleanup(); 1270 } 1271 1272 1273 /* 1274 * Audit of quotactl(2) cannot be tested in normal conditions as we don't want 1275 * to tamper with filesystem quotas 1276 */ 1277 1278 1279 ATF_TC_WITH_CLEANUP(quotactl_failure); 1280 ATF_TC_HEAD(quotactl_failure, tc) 1281 { 1282 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 1283 "quotactl(2) call"); 1284 } 1285 1286 ATF_TC_BODY(quotactl_failure, tc) 1287 { 1288 pid = getpid(); 1289 snprintf(adregex, sizeof(adregex), "quotactl.*%d.*return,failure", pid); 1290 1291 FILE *pipefd = setup(fds, auclass); 1292 ATF_REQUIRE_EQ(-1, quotactl(NULL, 0, 0, NULL)); 1293 check_audit(fds, adregex, pipefd); 1294 } 1295 1296 ATF_TC_CLEANUP(quotactl_failure, tc) 1297 { 1298 cleanup(); 1299 } 1300 1301 1302 ATF_TC_WITH_CLEANUP(mount_failure); 1303 ATF_TC_HEAD(mount_failure, tc) 1304 { 1305 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 1306 "mount(2) call"); 1307 } 1308 1309 ATF_TC_BODY(mount_failure, tc) 1310 { 1311 pid = getpid(); 1312 snprintf(adregex, sizeof(adregex), "mount.*%d.*return,failure", pid); 1313 1314 FILE *pipefd = setup(fds, auclass); 1315 ATF_REQUIRE_EQ(-1, mount(NULL, NULL, 0, NULL)); 1316 check_audit(fds, adregex, pipefd); 1317 } 1318 1319 ATF_TC_CLEANUP(mount_failure, tc) 1320 { 1321 cleanup(); 1322 } 1323 1324 1325 ATF_TC_WITH_CLEANUP(nmount_failure); 1326 ATF_TC_HEAD(nmount_failure, tc) 1327 { 1328 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 1329 "nmount(2) call"); 1330 } 1331 1332 ATF_TC_BODY(nmount_failure, tc) 1333 { 1334 pid = getpid(); 1335 snprintf(adregex, sizeof(adregex), "nmount.*%d.*return,failure", pid); 1336 1337 FILE *pipefd = setup(fds, auclass); 1338 ATF_REQUIRE_EQ(-1, nmount(NULL, 0, 0)); 1339 check_audit(fds, adregex, pipefd); 1340 } 1341 1342 ATF_TC_CLEANUP(nmount_failure, tc) 1343 { 1344 cleanup(); 1345 } 1346 1347 1348 ATF_TC_WITH_CLEANUP(swapon_failure); 1349 ATF_TC_HEAD(swapon_failure, tc) 1350 { 1351 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 1352 "swapon(2) call"); 1353 } 1354 1355 ATF_TC_BODY(swapon_failure, tc) 1356 { 1357 pid = getpid(); 1358 snprintf(adregex, sizeof(adregex), "swapon.*%d.*return,failure", pid); 1359 1360 FILE *pipefd = setup(fds, auclass); 1361 /* Failure reason: Block device required */ 1362 ATF_REQUIRE_EQ(-1, swapon(path)); 1363 check_audit(fds, adregex, pipefd); 1364 } 1365 1366 ATF_TC_CLEANUP(swapon_failure, tc) 1367 { 1368 cleanup(); 1369 } 1370 1371 1372 ATF_TC_WITH_CLEANUP(swapoff_failure); 1373 ATF_TC_HEAD(swapoff_failure, tc) 1374 { 1375 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 1376 "swapoff(2) call"); 1377 } 1378 1379 ATF_TC_BODY(swapoff_failure, tc) 1380 { 1381 pid = getpid(); 1382 snprintf(adregex, sizeof(adregex), "swapoff.*%d.*return,failure", pid); 1383 1384 FILE *pipefd = setup(fds, auclass); 1385 /* Failure reason: Block device required */ 1386 ATF_REQUIRE_EQ(-1, swapoff(path)); 1387 check_audit(fds, adregex, pipefd); 1388 } 1389 1390 ATF_TC_CLEANUP(swapoff_failure, tc) 1391 { 1392 cleanup(); 1393 } 1394 1395 1396 ATF_TP_ADD_TCS(tp) 1397 { 1398 ATF_TP_ADD_TC(tp, settimeofday_success); 1399 ATF_TP_ADD_TC(tp, settimeofday_failure); 1400 ATF_TP_ADD_TC(tp, clock_settime_success); 1401 ATF_TP_ADD_TC(tp, clock_settime_failure); 1402 ATF_TP_ADD_TC(tp, adjtime_success); 1403 ATF_TP_ADD_TC(tp, adjtime_failure); 1404 ATF_TP_ADD_TC(tp, ntp_adjtime_success); 1405 ATF_TP_ADD_TC(tp, ntp_adjtime_failure); 1406 1407 ATF_TP_ADD_TC(tp, nfs_getfh_success); 1408 ATF_TP_ADD_TC(tp, nfs_getfh_failure); 1409 ATF_TP_ADD_TC(tp, acct_success); 1410 ATF_TP_ADD_TC(tp, acct_failure); 1411 ATF_TP_ADD_TC(tp, auditctl_success); 1412 ATF_TP_ADD_TC(tp, auditctl_failure); 1413 1414 ATF_TP_ADD_TC(tp, getauid_success); 1415 ATF_TP_ADD_TC(tp, getauid_failure); 1416 ATF_TP_ADD_TC(tp, setauid_success); 1417 ATF_TP_ADD_TC(tp, setauid_failure); 1418 1419 ATF_TP_ADD_TC(tp, getaudit_success); 1420 ATF_TP_ADD_TC(tp, getaudit_failure); 1421 ATF_TP_ADD_TC(tp, setaudit_success); 1422 ATF_TP_ADD_TC(tp, setaudit_failure); 1423 1424 ATF_TP_ADD_TC(tp, getaudit_addr_success); 1425 ATF_TP_ADD_TC(tp, getaudit_addr_failure); 1426 ATF_TP_ADD_TC(tp, setaudit_addr_success); 1427 ATF_TP_ADD_TC(tp, setaudit_addr_failure); 1428 1429 ATF_TP_ADD_TC(tp, auditon_getpolicy_success); 1430 ATF_TP_ADD_TC(tp, auditon_getpolicy_failure); 1431 ATF_TP_ADD_TC(tp, auditon_setpolicy_success); 1432 ATF_TP_ADD_TC(tp, auditon_setpolicy_failure); 1433 1434 ATF_TP_ADD_TC(tp, auditon_getkmask_success); 1435 ATF_TP_ADD_TC(tp, auditon_getkmask_failure); 1436 ATF_TP_ADD_TC(tp, auditon_setkmask_success); 1437 ATF_TP_ADD_TC(tp, auditon_setkmask_failure); 1438 1439 ATF_TP_ADD_TC(tp, auditon_getqctrl_success); 1440 ATF_TP_ADD_TC(tp, auditon_getqctrl_failure); 1441 ATF_TP_ADD_TC(tp, auditon_setqctrl_success); 1442 ATF_TP_ADD_TC(tp, auditon_setqctrl_failure); 1443 1444 ATF_TP_ADD_TC(tp, auditon_getclass_success); 1445 ATF_TP_ADD_TC(tp, auditon_getclass_failure); 1446 ATF_TP_ADD_TC(tp, auditon_setclass_success); 1447 ATF_TP_ADD_TC(tp, auditon_setclass_failure); 1448 1449 ATF_TP_ADD_TC(tp, auditon_getcond_success); 1450 ATF_TP_ADD_TC(tp, auditon_getcond_failure); 1451 ATF_TP_ADD_TC(tp, auditon_setcond_success); 1452 ATF_TP_ADD_TC(tp, auditon_setcond_failure); 1453 1454 ATF_TP_ADD_TC(tp, reboot_failure); 1455 ATF_TP_ADD_TC(tp, quotactl_failure); 1456 ATF_TP_ADD_TC(tp, mount_failure); 1457 ATF_TP_ADD_TC(tp, nmount_failure); 1458 ATF_TP_ADD_TC(tp, swapon_failure); 1459 ATF_TP_ADD_TC(tp, swapoff_failure); 1460 1461 return (atf_no_error()); 1462 } 1463