1 /*- 2 * Copyright (c) 2018 Aniket Pandey 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 17 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * SUCH DAMAGE. 24 * 25 * $FreeBSD$ 26 */ 27 28 #include <sys/param.h> 29 #include <sys/mount.h> 30 #include <sys/reboot.h> 31 #include <sys/stat.h> 32 #include <sys/sysctl.h> 33 #include <sys/time.h> 34 #include <sys/timespec.h> 35 #include <sys/timex.h> 36 37 #include <bsm/audit.h> 38 #include <bsm/audit_kevents.h> 39 #include <ufs/ufs/quota.h> 40 41 #include <atf-c.h> 42 #include <fcntl.h> 43 #include <stdlib.h> 44 #include <time.h> 45 #include <unistd.h> 46 47 #include "utils.h" 48 49 static pid_t pid; 50 static int filedesc; 51 static mode_t mode = 0777; 52 static struct pollfd fds[1]; 53 static char adregex[80]; 54 static const char *auclass = "ad"; 55 static const char *path = "fileforaudit"; 56 static const char *successreg = "fileforaudit.*return,success"; 57 58 59 ATF_TC_WITH_CLEANUP(settimeofday_success); 60 ATF_TC_HEAD(settimeofday_success, tc) 61 { 62 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 63 "settimeofday(2) call"); 64 } 65 66 ATF_TC_BODY(settimeofday_success, tc) 67 { 68 pid = getpid(); 69 snprintf(adregex, sizeof(adregex), "settimeofday.*%d.*success", pid); 70 71 struct timeval tp; 72 struct timezone tzp; 73 ATF_REQUIRE_EQ(0, gettimeofday(&tp, &tzp)); 74 75 FILE *pipefd = setup(fds, auclass); 76 /* Setting the same time as obtained by gettimeofday(2) */ 77 ATF_REQUIRE_EQ(0, settimeofday(&tp, &tzp)); 78 check_audit(fds, adregex, pipefd); 79 } 80 81 ATF_TC_CLEANUP(settimeofday_success, tc) 82 { 83 cleanup(); 84 } 85 86 87 ATF_TC_WITH_CLEANUP(settimeofday_failure); 88 ATF_TC_HEAD(settimeofday_failure, tc) 89 { 90 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 91 "settimeofday(2) call"); 92 } 93 94 ATF_TC_BODY(settimeofday_failure, tc) 95 { 96 pid = getpid(); 97 snprintf(adregex, sizeof(adregex), "settimeofday.*%d.*failure", pid); 98 99 struct timeval tp; 100 struct timezone tzp; 101 ATF_REQUIRE_EQ(0, gettimeofday(&tp, &tzp)); 102 103 FILE *pipefd = setup(fds, auclass); 104 tp.tv_sec = -1; 105 /* Failure reason: Invalid value for tp.tv_sec; */ 106 ATF_REQUIRE_EQ(-1, settimeofday(&tp, &tzp)); 107 check_audit(fds, adregex, pipefd); 108 } 109 110 ATF_TC_CLEANUP(settimeofday_failure, tc) 111 { 112 cleanup(); 113 } 114 115 116 ATF_TC_WITH_CLEANUP(clock_settime_success); 117 ATF_TC_HEAD(clock_settime_success, tc) 118 { 119 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 120 "clock_settime(2) call"); 121 } 122 123 ATF_TC_BODY(clock_settime_success, tc) 124 { 125 pid = getpid(); 126 snprintf(adregex, sizeof(adregex), "clock_settime.*%d.*success", pid); 127 128 struct timespec tp; 129 ATF_REQUIRE_EQ(0, clock_gettime(CLOCK_REALTIME, &tp)); 130 131 FILE *pipefd = setup(fds, auclass); 132 /* Setting the same time as obtained by clock_gettime(2) */ 133 ATF_REQUIRE_EQ(0, clock_settime(CLOCK_REALTIME, &tp)); 134 check_audit(fds, adregex, pipefd); 135 } 136 137 ATF_TC_CLEANUP(clock_settime_success, tc) 138 { 139 cleanup(); 140 } 141 142 143 ATF_TC_WITH_CLEANUP(clock_settime_failure); 144 ATF_TC_HEAD(clock_settime_failure, tc) 145 { 146 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 147 "clock_settime(2) call"); 148 } 149 150 ATF_TC_BODY(clock_settime_failure, tc) 151 { 152 pid = getpid(); 153 snprintf(adregex, sizeof(adregex), "clock_settime.*%d.*failure", pid); 154 155 struct timespec tp; 156 ATF_REQUIRE_EQ(0, clock_gettime(CLOCK_MONOTONIC, &tp)); 157 158 FILE *pipefd = setup(fds, auclass); 159 /* Failure reason: cannot use CLOCK_MONOTONIC to set the system time */ 160 ATF_REQUIRE_EQ(-1, clock_settime(CLOCK_MONOTONIC, &tp)); 161 check_audit(fds, adregex, pipefd); 162 } 163 164 ATF_TC_CLEANUP(clock_settime_failure, tc) 165 { 166 cleanup(); 167 } 168 169 170 ATF_TC_WITH_CLEANUP(adjtime_success); 171 ATF_TC_HEAD(adjtime_success, tc) 172 { 173 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 174 "adjtime(2) call"); 175 } 176 177 ATF_TC_BODY(adjtime_success, tc) 178 { 179 pid = getpid(); 180 snprintf(adregex, sizeof(adregex), "adjtime.*%d.*return,success", pid); 181 182 FILE *pipefd = setup(fds, auclass); 183 /* We don't want to change the system time, hence NULL */ 184 ATF_REQUIRE_EQ(0, adjtime(NULL, NULL)); 185 check_audit(fds, adregex, pipefd); 186 } 187 188 ATF_TC_CLEANUP(adjtime_success, tc) 189 { 190 cleanup(); 191 } 192 193 194 ATF_TC_WITH_CLEANUP(adjtime_failure); 195 ATF_TC_HEAD(adjtime_failure, tc) 196 { 197 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 198 "adjtime(2) call"); 199 } 200 201 ATF_TC_BODY(adjtime_failure, tc) 202 { 203 pid = getpid(); 204 snprintf(adregex, sizeof(adregex), "adjtime.*%d.*return,failure", pid); 205 206 FILE *pipefd = setup(fds, auclass); 207 ATF_REQUIRE_EQ(-1, adjtime((struct timeval *)(-1), NULL)); 208 check_audit(fds, adregex, pipefd); 209 } 210 211 ATF_TC_CLEANUP(adjtime_failure, tc) 212 { 213 cleanup(); 214 } 215 216 217 ATF_TC_WITH_CLEANUP(ntp_adjtime_success); 218 ATF_TC_HEAD(ntp_adjtime_success, tc) 219 { 220 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 221 "ntp_adjtime(2) call"); 222 } 223 224 ATF_TC_BODY(ntp_adjtime_success, tc) 225 { 226 struct timex timebuff; 227 bzero(&timebuff, sizeof(timebuff)); 228 229 pid = getpid(); 230 snprintf(adregex, sizeof(adregex), "ntp_adjtime.*%d.*success", pid); 231 232 FILE *pipefd = setup(fds, auclass); 233 ATF_REQUIRE(ntp_adjtime(&timebuff) != -1); 234 check_audit(fds, adregex, pipefd); 235 } 236 237 ATF_TC_CLEANUP(ntp_adjtime_success, tc) 238 { 239 cleanup(); 240 } 241 242 243 ATF_TC_WITH_CLEANUP(ntp_adjtime_failure); 244 ATF_TC_HEAD(ntp_adjtime_failure, tc) 245 { 246 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 247 "ntp_adjtime(2) call"); 248 } 249 250 ATF_TC_BODY(ntp_adjtime_failure, tc) 251 { 252 pid = getpid(); 253 snprintf(adregex, sizeof(adregex), "ntp_adjtime.*%d.*failure", pid); 254 255 FILE *pipefd = setup(fds, auclass); 256 ATF_REQUIRE_EQ(-1, ntp_adjtime(NULL)); 257 check_audit(fds, adregex, pipefd); 258 } 259 260 ATF_TC_CLEANUP(ntp_adjtime_failure, tc) 261 { 262 cleanup(); 263 } 264 265 266 ATF_TC_WITH_CLEANUP(nfs_getfh_success); 267 ATF_TC_HEAD(nfs_getfh_success, tc) 268 { 269 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 270 "getfh(2) call"); 271 } 272 273 ATF_TC_BODY(nfs_getfh_success, tc) 274 { 275 fhandle_t fhp; 276 pid = getpid(); 277 snprintf(adregex, sizeof(adregex), "nfs_getfh.*%d.*ret.*success", pid); 278 279 /* File needs to exist to call getfh(2) */ 280 ATF_REQUIRE((filedesc = open(path, O_CREAT, mode)) != -1); 281 FILE *pipefd = setup(fds, auclass); 282 ATF_REQUIRE_EQ(0, getfh(path, &fhp)); 283 check_audit(fds, adregex, pipefd); 284 close(filedesc); 285 } 286 287 ATF_TC_CLEANUP(nfs_getfh_success, tc) 288 { 289 cleanup(); 290 } 291 292 293 ATF_TC_WITH_CLEANUP(nfs_getfh_failure); 294 ATF_TC_HEAD(nfs_getfh_failure, tc) 295 { 296 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 297 "getfh(2) call"); 298 } 299 300 ATF_TC_BODY(nfs_getfh_failure, tc) 301 { 302 pid = getpid(); 303 snprintf(adregex, sizeof(adregex), "nfs_getfh.*%d.*ret.*failure", pid); 304 305 FILE *pipefd = setup(fds, auclass); 306 /* Failure reason: file does not exist */ 307 ATF_REQUIRE_EQ(-1, getfh(path, NULL)); 308 check_audit(fds, adregex, pipefd); 309 } 310 311 ATF_TC_CLEANUP(nfs_getfh_failure, tc) 312 { 313 cleanup(); 314 } 315 316 317 ATF_TC_WITH_CLEANUP(auditctl_success); 318 ATF_TC_HEAD(auditctl_success, tc) 319 { 320 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 321 "auditctl(2) call"); 322 } 323 324 ATF_TC_BODY(auditctl_success, tc) 325 { 326 /* File needs to exist in order to call auditctl(2) */ 327 ATF_REQUIRE((filedesc = open(path, O_CREAT | O_WRONLY, mode)) != -1); 328 FILE *pipefd = setup(fds, auclass); 329 ATF_REQUIRE_EQ(0, auditctl(path)); 330 check_audit(fds, successreg, pipefd); 331 close(filedesc); 332 } 333 334 ATF_TC_CLEANUP(auditctl_success, tc) 335 { 336 /* 337 * auditctl(2) disables audit log at /var/audit and initiates auditing 338 * at the configured path. To reset this, we need to stop and start the 339 * auditd(8) again. Here, we check if auditd(8) was running already 340 * before the test started. If so, we stop and start it again. 341 */ 342 system("service auditd onestop > /dev/null 2>&1"); 343 if (!atf_utils_file_exists("started_auditd")) 344 system("service auditd onestart > /dev/null 2>&1"); 345 } 346 347 348 ATF_TC_WITH_CLEANUP(auditctl_failure); 349 ATF_TC_HEAD(auditctl_failure, tc) 350 { 351 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 352 "auditctl(2) call"); 353 } 354 355 ATF_TC_BODY(auditctl_failure, tc) 356 { 357 pid = getpid(); 358 snprintf(adregex, sizeof(adregex), "auditctl.*%d.*return,failure", pid); 359 360 FILE *pipefd = setup(fds, auclass); 361 /* Failure reason: file does not exist */ 362 ATF_REQUIRE_EQ(-1, auditctl(NULL)); 363 check_audit(fds, adregex, pipefd); 364 } 365 366 ATF_TC_CLEANUP(auditctl_failure, tc) 367 { 368 cleanup(); 369 } 370 371 372 ATF_TC_WITH_CLEANUP(auditon_success); 373 ATF_TC_HEAD(auditon_success, tc) 374 { 375 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 376 "auditon(2) call"); 377 } 378 379 ATF_TC_BODY(auditon_success, tc) 380 { 381 pid = getpid(); 382 au_evclass_map_t evclass; 383 snprintf(adregex, sizeof(adregex), "auditon.*%d.*return,success", pid); 384 385 /* Initialize evclass to get the event-class mapping for auditon(2) */ 386 evclass.ec_number = AUE_AUDITON; 387 evclass.ec_class = 0; 388 FILE *pipefd = setup(fds, auclass); 389 ATF_REQUIRE_EQ(0, auditon(A_GETCLASS, &evclass, sizeof(&evclass))); 390 check_audit(fds, adregex, pipefd); 391 } 392 393 ATF_TC_CLEANUP(auditon_success, tc) 394 { 395 cleanup(); 396 } 397 398 399 ATF_TC_WITH_CLEANUP(auditon_failure); 400 ATF_TC_HEAD(auditon_failure, tc) 401 { 402 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 403 "auditon(2) call"); 404 } 405 406 ATF_TC_BODY(auditon_failure, tc) 407 { 408 pid = getpid(); 409 snprintf(adregex, sizeof(adregex), "auditon.*%d.*return,failure", pid); 410 411 FILE *pipefd = setup(fds, auclass); 412 /* Failure reason: Invalid au_evclass_map_t structure */ 413 ATF_REQUIRE_EQ(-1, auditon(A_GETCLASS, NULL, 0)); 414 check_audit(fds, adregex, pipefd); 415 } 416 417 ATF_TC_CLEANUP(auditon_failure, tc) 418 { 419 cleanup(); 420 } 421 422 423 ATF_TC_WITH_CLEANUP(acct_success); 424 ATF_TC_HEAD(acct_success, tc) 425 { 426 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 427 "acct(2) call"); 428 } 429 430 ATF_TC_BODY(acct_success, tc) 431 { 432 int acctinfo, filedesc2; 433 size_t len = sizeof(acctinfo); 434 const char *acctname = "kern.acct_configured"; 435 ATF_REQUIRE_EQ(0, sysctlbyname(acctname, &acctinfo, &len, NULL, 0)); 436 437 /* File needs to exist to start system accounting */ 438 ATF_REQUIRE((filedesc = open(path, O_CREAT | O_RDWR, mode)) != -1); 439 440 /* 441 * acctinfo = 0: System accounting was disabled 442 * acctinfo = 1: System accounting was enabled 443 */ 444 if (acctinfo) { 445 ATF_REQUIRE((filedesc2 = open("acct_ok", O_CREAT, mode)) != -1); 446 close(filedesc2); 447 } 448 449 pid = getpid(); 450 snprintf(adregex, sizeof(adregex), 451 "acct.*%s.*%d.*return,success", path, pid); 452 453 /* 454 * We temporarily switch the accounting record to a file at 455 * our own configured path in order to confirm acct(2)'s successful 456 * auditing. Then we set everything back to its original state. 457 */ 458 FILE *pipefd = setup(fds, auclass); 459 ATF_REQUIRE_EQ(0, acct(path)); 460 check_audit(fds, adregex, pipefd); 461 close(filedesc); 462 } 463 464 ATF_TC_CLEANUP(acct_success, tc) 465 { 466 /* Reset accounting configured path */ 467 ATF_REQUIRE_EQ(0, system("service accounting onestop")); 468 if (atf_utils_file_exists("acct_ok")) { 469 ATF_REQUIRE_EQ(0, system("service accounting onestart")); 470 } 471 cleanup(); 472 } 473 474 475 ATF_TC_WITH_CLEANUP(acct_failure); 476 ATF_TC_HEAD(acct_failure, tc) 477 { 478 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 479 "acct(2) call"); 480 } 481 482 ATF_TC_BODY(acct_failure, tc) 483 { 484 pid = getpid(); 485 snprintf(adregex, sizeof(adregex), "acct.*%d.*return,failure", pid); 486 487 FILE *pipefd = setup(fds, auclass); 488 /* Failure reason: File does not exist */ 489 ATF_REQUIRE_EQ(-1, acct(path)); 490 check_audit(fds, adregex, pipefd); 491 } 492 493 ATF_TC_CLEANUP(acct_failure, tc) 494 { 495 cleanup(); 496 } 497 498 499 ATF_TC_WITH_CLEANUP(getauid_success); 500 ATF_TC_HEAD(getauid_success, tc) 501 { 502 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 503 "getauid(2) call"); 504 } 505 506 ATF_TC_BODY(getauid_success, tc) 507 { 508 au_id_t auid; 509 pid = getpid(); 510 snprintf(adregex, sizeof(adregex), "getauid.*%d.*return,success", pid); 511 512 FILE *pipefd = setup(fds, auclass); 513 ATF_REQUIRE_EQ(0, getauid(&auid)); 514 check_audit(fds, adregex, pipefd); 515 } 516 517 ATF_TC_CLEANUP(getauid_success, tc) 518 { 519 cleanup(); 520 } 521 522 523 ATF_TC_WITH_CLEANUP(getauid_failure); 524 ATF_TC_HEAD(getauid_failure, tc) 525 { 526 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 527 "getauid(2) call"); 528 } 529 530 ATF_TC_BODY(getauid_failure, tc) 531 { 532 pid = getpid(); 533 snprintf(adregex, sizeof(adregex), "getauid.*%d.*return,failure", pid); 534 535 FILE *pipefd = setup(fds, auclass); 536 /* Failure reason: Bad address */ 537 ATF_REQUIRE_EQ(-1, getauid(NULL)); 538 check_audit(fds, adregex, pipefd); 539 } 540 541 ATF_TC_CLEANUP(getauid_failure, tc) 542 { 543 cleanup(); 544 } 545 546 547 ATF_TC_WITH_CLEANUP(setauid_success); 548 ATF_TC_HEAD(setauid_success, tc) 549 { 550 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 551 "setauid(2) call"); 552 } 553 554 ATF_TC_BODY(setauid_success, tc) 555 { 556 au_id_t auid; 557 pid = getpid(); 558 snprintf(adregex, sizeof(adregex), "setauid.*%d.*return,success", pid); 559 ATF_REQUIRE_EQ(0, getauid(&auid)); 560 561 FILE *pipefd = setup(fds, auclass); 562 ATF_REQUIRE_EQ(0, setauid(&auid)); 563 check_audit(fds, adregex, pipefd); 564 } 565 566 ATF_TC_CLEANUP(setauid_success, tc) 567 { 568 cleanup(); 569 } 570 571 572 ATF_TC_WITH_CLEANUP(setauid_failure); 573 ATF_TC_HEAD(setauid_failure, tc) 574 { 575 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 576 "setauid(2) call"); 577 } 578 579 ATF_TC_BODY(setauid_failure, tc) 580 { 581 pid = getpid(); 582 snprintf(adregex, sizeof(adregex), "setauid.*%d.*return,failure", pid); 583 584 FILE *pipefd = setup(fds, auclass); 585 /* Failure reason: Bad address */ 586 ATF_REQUIRE_EQ(-1, setauid(NULL)); 587 check_audit(fds, adregex, pipefd); 588 } 589 590 ATF_TC_CLEANUP(setauid_failure, tc) 591 { 592 cleanup(); 593 } 594 595 596 ATF_TC_WITH_CLEANUP(getaudit_success); 597 ATF_TC_HEAD(getaudit_success, tc) 598 { 599 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 600 "getaudit(2) call"); 601 } 602 603 ATF_TC_BODY(getaudit_success, tc) 604 { 605 pid = getpid(); 606 auditinfo_t auditinfo; 607 snprintf(adregex, sizeof(adregex), "getaudit.*%d.*return,success", pid); 608 609 FILE *pipefd = setup(fds, auclass); 610 ATF_REQUIRE_EQ(0, getaudit(&auditinfo)); 611 check_audit(fds, adregex, pipefd); 612 } 613 614 ATF_TC_CLEANUP(getaudit_success, tc) 615 { 616 cleanup(); 617 } 618 619 620 ATF_TC_WITH_CLEANUP(getaudit_failure); 621 ATF_TC_HEAD(getaudit_failure, tc) 622 { 623 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 624 "getaudit(2) call"); 625 } 626 627 ATF_TC_BODY(getaudit_failure, tc) 628 { 629 pid = getpid(); 630 snprintf(adregex, sizeof(adregex), "getaudit.*%d.*return,failure", pid); 631 632 FILE *pipefd = setup(fds, auclass); 633 /* Failure reason: Bad address */ 634 ATF_REQUIRE_EQ(-1, getaudit(NULL)); 635 check_audit(fds, adregex, pipefd); 636 } 637 638 ATF_TC_CLEANUP(getaudit_failure, tc) 639 { 640 cleanup(); 641 } 642 643 644 ATF_TC_WITH_CLEANUP(setaudit_success); 645 ATF_TC_HEAD(setaudit_success, tc) 646 { 647 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 648 "setaudit(2) call"); 649 } 650 651 ATF_TC_BODY(setaudit_success, tc) 652 { 653 pid = getpid(); 654 auditinfo_t auditinfo; 655 snprintf(adregex, sizeof(adregex), "setaudit.*%d.*return,success", pid); 656 ATF_REQUIRE_EQ(0, getaudit(&auditinfo)); 657 658 FILE *pipefd = setup(fds, auclass); 659 ATF_REQUIRE_EQ(0, setaudit(&auditinfo)); 660 check_audit(fds, adregex, pipefd); 661 } 662 663 ATF_TC_CLEANUP(setaudit_success, tc) 664 { 665 cleanup(); 666 } 667 668 669 ATF_TC_WITH_CLEANUP(setaudit_failure); 670 ATF_TC_HEAD(setaudit_failure, tc) 671 { 672 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 673 "setaudit(2) call"); 674 } 675 676 ATF_TC_BODY(setaudit_failure, tc) 677 { 678 pid = getpid(); 679 snprintf(adregex, sizeof(adregex), "setaudit.*%d.*return,failure", pid); 680 681 FILE *pipefd = setup(fds, auclass); 682 /* Failure reason: Bad address */ 683 ATF_REQUIRE_EQ(-1, setaudit(NULL)); 684 check_audit(fds, adregex, pipefd); 685 } 686 687 ATF_TC_CLEANUP(setaudit_failure, tc) 688 { 689 cleanup(); 690 } 691 692 693 ATF_TC_WITH_CLEANUP(getaudit_addr_success); 694 ATF_TC_HEAD(getaudit_addr_success, tc) 695 { 696 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 697 "getaudit_addr(2) call"); 698 } 699 700 ATF_TC_BODY(getaudit_addr_success, tc) 701 { 702 pid = getpid(); 703 auditinfo_addr_t auditinfo; 704 snprintf(adregex, sizeof(adregex), 705 "getaudit_addr.*%d.*return,success", pid); 706 707 FILE *pipefd = setup(fds, auclass); 708 ATF_REQUIRE_EQ(0, getaudit_addr(&auditinfo, sizeof(auditinfo))); 709 check_audit(fds, adregex, pipefd); 710 } 711 712 ATF_TC_CLEANUP(getaudit_addr_success, tc) 713 { 714 cleanup(); 715 } 716 717 718 ATF_TC_WITH_CLEANUP(getaudit_addr_failure); 719 ATF_TC_HEAD(getaudit_addr_failure, tc) 720 { 721 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 722 "getaudit_addr(2) call"); 723 } 724 725 ATF_TC_BODY(getaudit_addr_failure, tc) 726 { 727 pid = getpid(); 728 snprintf(adregex, sizeof(adregex), 729 "getaudit_addr.*%d.*return,failure", pid); 730 731 FILE *pipefd = setup(fds, auclass); 732 /* Failure reason: Bad address */ 733 ATF_REQUIRE_EQ(-1, getaudit_addr(NULL, 0)); 734 check_audit(fds, adregex, pipefd); 735 } 736 737 ATF_TC_CLEANUP(getaudit_addr_failure, tc) 738 { 739 cleanup(); 740 } 741 742 743 ATF_TC_WITH_CLEANUP(setaudit_addr_success); 744 ATF_TC_HEAD(setaudit_addr_success, tc) 745 { 746 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " 747 "setaudit_addr(2) call"); 748 } 749 750 ATF_TC_BODY(setaudit_addr_success, tc) 751 { 752 pid = getpid(); 753 auditinfo_addr_t auditinfo; 754 snprintf(adregex, sizeof(adregex), 755 "setaudit_addr.*%d.*return,success", pid); 756 757 ATF_REQUIRE_EQ(0, getaudit_addr(&auditinfo, sizeof(auditinfo))); 758 FILE *pipefd = setup(fds, auclass); 759 ATF_REQUIRE_EQ(0, setaudit_addr(&auditinfo, sizeof(auditinfo))); 760 check_audit(fds, adregex, pipefd); 761 } 762 763 ATF_TC_CLEANUP(setaudit_addr_success, tc) 764 { 765 cleanup(); 766 } 767 768 769 ATF_TC_WITH_CLEANUP(setaudit_addr_failure); 770 ATF_TC_HEAD(setaudit_addr_failure, tc) 771 { 772 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 773 "setaudit_addr(2) call"); 774 } 775 776 ATF_TC_BODY(setaudit_addr_failure, tc) 777 { 778 pid = getpid(); 779 snprintf(adregex, sizeof(adregex), 780 "setaudit_addr.*%d.*return,failure", pid); 781 782 FILE *pipefd = setup(fds, auclass); 783 /* Failure reason: Bad address */ 784 ATF_REQUIRE_EQ(-1, setaudit_addr(NULL, 0)); 785 check_audit(fds, adregex, pipefd); 786 } 787 788 ATF_TC_CLEANUP(setaudit_addr_failure, tc) 789 { 790 cleanup(); 791 } 792 793 794 /* 795 * Audit of reboot(2) cannot be tested in normal conditions as we don't want 796 * to reboot the system while running the tests 797 */ 798 799 800 ATF_TC_WITH_CLEANUP(reboot_failure); 801 ATF_TC_HEAD(reboot_failure, tc) 802 { 803 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 804 "reboot(2) call"); 805 } 806 807 ATF_TC_BODY(reboot_failure, tc) 808 { 809 pid = getpid(); 810 snprintf(adregex, sizeof(adregex), "reboot.*%d.*return,failure", pid); 811 812 FILE *pipefd = setup(fds, auclass); 813 ATF_REQUIRE_EQ(-1, reboot(-1)); 814 check_audit(fds, adregex, pipefd); 815 } 816 817 ATF_TC_CLEANUP(reboot_failure, tc) 818 { 819 cleanup(); 820 } 821 822 823 /* 824 * Audit of quotactl(2) cannot be tested in normal conditions as we don't want 825 * to tamper with filesystem quotas 826 */ 827 828 829 ATF_TC_WITH_CLEANUP(quotactl_failure); 830 ATF_TC_HEAD(quotactl_failure, tc) 831 { 832 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 833 "quotactl(2) call"); 834 } 835 836 ATF_TC_BODY(quotactl_failure, tc) 837 { 838 pid = getpid(); 839 snprintf(adregex, sizeof(adregex), "quotactl.*%d.*return,failure", pid); 840 841 FILE *pipefd = setup(fds, auclass); 842 ATF_REQUIRE_EQ(-1, quotactl(NULL, 0, 0, NULL)); 843 check_audit(fds, adregex, pipefd); 844 } 845 846 ATF_TC_CLEANUP(quotactl_failure, tc) 847 { 848 cleanup(); 849 } 850 851 852 ATF_TC_WITH_CLEANUP(mount_failure); 853 ATF_TC_HEAD(mount_failure, tc) 854 { 855 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 856 "mount(2) call"); 857 } 858 859 ATF_TC_BODY(mount_failure, tc) 860 { 861 pid = getpid(); 862 snprintf(adregex, sizeof(adregex), "mount.*%d.*return,failure", pid); 863 864 FILE *pipefd = setup(fds, auclass); 865 ATF_REQUIRE_EQ(-1, mount(NULL, NULL, 0, NULL)); 866 check_audit(fds, adregex, pipefd); 867 } 868 869 ATF_TC_CLEANUP(mount_failure, tc) 870 { 871 cleanup(); 872 } 873 874 875 ATF_TC_WITH_CLEANUP(nmount_failure); 876 ATF_TC_HEAD(nmount_failure, tc) 877 { 878 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 879 "nmount(2) call"); 880 } 881 882 ATF_TC_BODY(nmount_failure, tc) 883 { 884 pid = getpid(); 885 snprintf(adregex, sizeof(adregex), "nmount.*%d.*return,failure", pid); 886 887 FILE *pipefd = setup(fds, auclass); 888 ATF_REQUIRE_EQ(-1, nmount(NULL, 0, 0)); 889 check_audit(fds, adregex, pipefd); 890 } 891 892 ATF_TC_CLEANUP(nmount_failure, tc) 893 { 894 cleanup(); 895 } 896 897 898 ATF_TC_WITH_CLEANUP(swapon_failure); 899 ATF_TC_HEAD(swapon_failure, tc) 900 { 901 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 902 "swapon(2) call"); 903 } 904 905 ATF_TC_BODY(swapon_failure, tc) 906 { 907 pid = getpid(); 908 snprintf(adregex, sizeof(adregex), "swapon.*%d.*return,failure", pid); 909 910 FILE *pipefd = setup(fds, auclass); 911 /* Failure reason: Block device required */ 912 ATF_REQUIRE_EQ(-1, swapon(path)); 913 check_audit(fds, adregex, pipefd); 914 } 915 916 ATF_TC_CLEANUP(swapon_failure, tc) 917 { 918 cleanup(); 919 } 920 921 922 ATF_TC_WITH_CLEANUP(swapoff_failure); 923 ATF_TC_HEAD(swapoff_failure, tc) 924 { 925 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " 926 "swapoff(2) call"); 927 } 928 929 ATF_TC_BODY(swapoff_failure, tc) 930 { 931 pid = getpid(); 932 snprintf(adregex, sizeof(adregex), "swapoff.*%d.*return,failure", pid); 933 934 FILE *pipefd = setup(fds, auclass); 935 /* Failure reason: Block device required */ 936 ATF_REQUIRE_EQ(-1, swapoff(path)); 937 check_audit(fds, adregex, pipefd); 938 } 939 940 ATF_TC_CLEANUP(swapoff_failure, tc) 941 { 942 cleanup(); 943 } 944 945 946 ATF_TP_ADD_TCS(tp) 947 { 948 ATF_TP_ADD_TC(tp, settimeofday_success); 949 ATF_TP_ADD_TC(tp, settimeofday_failure); 950 ATF_TP_ADD_TC(tp, clock_settime_success); 951 ATF_TP_ADD_TC(tp, clock_settime_failure); 952 ATF_TP_ADD_TC(tp, adjtime_success); 953 ATF_TP_ADD_TC(tp, adjtime_failure); 954 ATF_TP_ADD_TC(tp, ntp_adjtime_success); 955 ATF_TP_ADD_TC(tp, ntp_adjtime_failure); 956 957 ATF_TP_ADD_TC(tp, nfs_getfh_success); 958 ATF_TP_ADD_TC(tp, nfs_getfh_failure); 959 ATF_TP_ADD_TC(tp, acct_success); 960 ATF_TP_ADD_TC(tp, acct_failure); 961 962 ATF_TP_ADD_TC(tp, auditctl_success); 963 ATF_TP_ADD_TC(tp, auditctl_failure); 964 ATF_TP_ADD_TC(tp, auditon_success); 965 ATF_TP_ADD_TC(tp, auditon_failure); 966 967 ATF_TP_ADD_TC(tp, getauid_success); 968 ATF_TP_ADD_TC(tp, getauid_failure); 969 ATF_TP_ADD_TC(tp, setauid_success); 970 ATF_TP_ADD_TC(tp, setauid_failure); 971 972 ATF_TP_ADD_TC(tp, getaudit_success); 973 ATF_TP_ADD_TC(tp, getaudit_failure); 974 ATF_TP_ADD_TC(tp, setaudit_success); 975 ATF_TP_ADD_TC(tp, setaudit_failure); 976 977 ATF_TP_ADD_TC(tp, getaudit_addr_success); 978 ATF_TP_ADD_TC(tp, getaudit_addr_failure); 979 ATF_TP_ADD_TC(tp, setaudit_addr_success); 980 ATF_TP_ADD_TC(tp, setaudit_addr_failure); 981 982 ATF_TP_ADD_TC(tp, reboot_failure); 983 ATF_TP_ADD_TC(tp, quotactl_failure); 984 ATF_TP_ADD_TC(tp, mount_failure); 985 ATF_TP_ADD_TC(tp, nmount_failure); 986 ATF_TP_ADD_TC(tp, swapon_failure); 987 ATF_TP_ADD_TC(tp, swapoff_failure); 988 989 return (atf_no_error()); 990 } 991