1 /*-
2 * Copyright (c) 2018 Aniket Pandey
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
14 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
17 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * SUCH DAMAGE.
24 */
25
26 /*
27 * Note: open(2) and openat(2) have 12 events each for various values of 'flag'
28 * Please see: contrib/openbsm/etc/audit_event#L261
29 *
30 * 270:AUE_OPENAT_R:openat(2) - read:fr
31 * 271:AUE_OPENAT_RC:openat(2) - read,creat:fc,fr,fa,fm
32 * 272:AUE_OPENAT_RT:openat(2) - read,trunc:fd,fr,fa,fm
33 * 273:AUE_OPENAT_RTC:openat(2) - read,creat,trunc:fc,fd,fr,fa,fm
34 * 274:AUE_OPENAT_W:openat(2) - write:fw
35 * 275:AUE_OPENAT_WC:openat(2) - write,creat:fc,fw,fa,fm
36 * 276:AUE_OPENAT_WT:openat(2) - write,trunc:fd,fw,fa,fm
37 * 277:AUE_OPENAT_WTC:openat(2) - write,creat,trunc:fc,fd,fw,fa,fm
38 * 278:AUE_OPENAT_RW:openat(2) - read,write:fr,fw
39 * 279:AUE_OPENAT_RWC:openat(2) - read,write,create:fc,fw,fr,fa,fm
40 * 280:AUE_OPENAT_RWT:openat(2) - read,write,trunc:fd,fw,fr,fa,fm
41 * 281:AUE_OPENAT_RWTC:openat(2) - read,write,creat,trunc:fc,fd,fw,fr,fa,fm
42 */
43
44 #include <sys/syscall.h>
45
46 #include <atf-c.h>
47 #include <fcntl.h>
48
49 #include "utils.h"
50
51 static struct pollfd fds[1];
52 static mode_t o_mode = 0777;
53 static int filedesc;
54 static char extregex[80];
55 static const char *path = "fileforaudit";
56 static const char *errpath = "adirhasnoname/fileforaudit";
57
58 /*
59 * Define test-cases for success and failure modes of both open(2) and openat(2)
60 */
61 #define OPEN_AT_TC_DEFINE(mode, regex, flag, class) \
62 ATF_TC_WITH_CLEANUP(open_ ## mode ## _success); \
63 ATF_TC_HEAD(open_ ## mode ## _success, tc) \
64 { \
65 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " \
66 "open(2) call with flags = %s", #flag); \
67 } \
68 ATF_TC_BODY(open_ ## mode ## _success, tc) \
69 { \
70 snprintf(extregex, sizeof(extregex), \
71 "open.*%s.*fileforaudit.*return,success", regex); \
72 /* File needs to exist for successful open(2) invocation */ \
73 ATF_REQUIRE((filedesc = open(path, O_CREAT, o_mode)) != -1); \
74 FILE *pipefd = setup(fds, class); \
75 ATF_REQUIRE(syscall(SYS_open, path, flag) != -1); \
76 check_audit(fds, extregex, pipefd); \
77 close(filedesc); \
78 } \
79 ATF_TC_CLEANUP(open_ ## mode ## _success, tc) \
80 { \
81 cleanup(); \
82 } \
83 ATF_TC_WITH_CLEANUP(open_ ## mode ## _failure); \
84 ATF_TC_HEAD(open_ ## mode ## _failure, tc) \
85 { \
86 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " \
87 "open(2) call with flags = %s", #flag); \
88 } \
89 ATF_TC_BODY(open_ ## mode ## _failure, tc) \
90 { \
91 snprintf(extregex, sizeof(extregex), \
92 "open.*%s.*fileforaudit.*return,failure", regex); \
93 FILE *pipefd = setup(fds, class); \
94 ATF_REQUIRE_EQ(-1, syscall(SYS_open, errpath, flag)); \
95 check_audit(fds, extregex, pipefd); \
96 } \
97 ATF_TC_CLEANUP(open_ ## mode ## _failure, tc) \
98 { \
99 cleanup(); \
100 } \
101 ATF_TC_WITH_CLEANUP(openat_ ## mode ## _success); \
102 ATF_TC_HEAD(openat_ ## mode ## _success, tc) \
103 { \
104 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " \
105 "openat(2) call with flags = %s", #flag); \
106 } \
107 ATF_TC_BODY(openat_ ## mode ## _success, tc) \
108 { \
109 int filedesc2; \
110 snprintf(extregex, sizeof(extregex), \
111 "openat.*%s.*fileforaudit.*return,success", regex); \
112 /* File needs to exist for successful openat(2) invocation */ \
113 ATF_REQUIRE((filedesc = open(path, O_CREAT, o_mode)) != -1); \
114 FILE *pipefd = setup(fds, class); \
115 ATF_REQUIRE((filedesc2 = openat(AT_FDCWD, path, flag)) != -1); \
116 check_audit(fds, extregex, pipefd); \
117 close(filedesc2); \
118 close(filedesc); \
119 } \
120 ATF_TC_CLEANUP(openat_ ## mode ## _success, tc) \
121 { \
122 cleanup(); \
123 } \
124 ATF_TC_WITH_CLEANUP(openat_ ## mode ## _failure); \
125 ATF_TC_HEAD(openat_ ## mode ## _failure, tc) \
126 { \
127 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " \
128 "openat(2) call with flags = %s", #flag); \
129 } \
130 ATF_TC_BODY(openat_ ## mode ## _failure, tc) \
131 { \
132 snprintf(extregex, sizeof(extregex), \
133 "openat.*%s.*fileforaudit.*return,failure", regex); \
134 FILE *pipefd = setup(fds, class); \
135 ATF_REQUIRE_EQ(-1, openat(AT_FDCWD, errpath, flag)); \
136 check_audit(fds, extregex, pipefd); \
137 } \
138 ATF_TC_CLEANUP(openat_ ## mode ## _failure, tc) \
139 { \
140 cleanup(); \
141 }
142
143 /*
144 * Add both success and failure modes of open(2) and openat(2)
145 */
146 #define OPEN_AT_TC_ADD(tp, mode) \
147 do { \
148 ATF_TP_ADD_TC(tp, open_ ## mode ## _success); \
149 ATF_TP_ADD_TC(tp, open_ ## mode ## _failure); \
150 ATF_TP_ADD_TC(tp, openat_ ## mode ## _success); \
151 ATF_TP_ADD_TC(tp, openat_ ## mode ## _failure); \
152 } while (0)
153
154
155 /*
156 * Each of the 12 OPEN_AT_TC_DEFINE statement is a group of 4 test-cases
157 * corresponding to separate audit events for open(2) and openat(2)
158 */
159 OPEN_AT_TC_DEFINE(read, "read", O_RDONLY, "fr")
160 OPEN_AT_TC_DEFINE(read_creat, "read,creat", O_RDONLY | O_CREAT, "fr")
161 OPEN_AT_TC_DEFINE(read_trunc, "read,trunc", O_RDONLY | O_TRUNC, "fr")
162 OPEN_AT_TC_DEFINE(read_creat_trunc, "read,creat,trunc", O_RDONLY | O_CREAT
163 | O_TRUNC, "fr")
164 OPEN_AT_TC_DEFINE(write, "write", O_WRONLY, "fw")
165 OPEN_AT_TC_DEFINE(write_creat, "write,creat", O_WRONLY | O_CREAT, "fw")
166 OPEN_AT_TC_DEFINE(write_trunc, "write,trunc", O_WRONLY | O_TRUNC, "fw")
167 OPEN_AT_TC_DEFINE(write_creat_trunc, "write,creat,trunc", O_WRONLY | O_CREAT
168 | O_TRUNC, "fw")
169 OPEN_AT_TC_DEFINE(read_write, "read,write", O_RDWR, "fr")
170 OPEN_AT_TC_DEFINE(read_write_creat, "read,write,creat", O_RDWR | O_CREAT, "fw")
171 OPEN_AT_TC_DEFINE(read_write_trunc, "read,write,trunc", O_RDWR | O_TRUNC, "fr")
172 OPEN_AT_TC_DEFINE(read_write_creat_trunc, "read,write,creat,trunc", O_RDWR |
173 O_CREAT | O_TRUNC, "fw")
174
175
ATF_TP_ADD_TCS(tp)176 ATF_TP_ADD_TCS(tp)
177 {
178 OPEN_AT_TC_ADD(tp, read);
179 OPEN_AT_TC_ADD(tp, read_creat);
180 OPEN_AT_TC_ADD(tp, read_trunc);
181 OPEN_AT_TC_ADD(tp, read_creat_trunc);
182
183 OPEN_AT_TC_ADD(tp, write);
184 OPEN_AT_TC_ADD(tp, write_creat);
185 OPEN_AT_TC_ADD(tp, write_trunc);
186 OPEN_AT_TC_ADD(tp, write_creat_trunc);
187
188 OPEN_AT_TC_ADD(tp, read_write);
189 OPEN_AT_TC_ADD(tp, read_write_creat);
190 OPEN_AT_TC_ADD(tp, read_write_trunc);
191 OPEN_AT_TC_ADD(tp, read_write_creat_trunc);
192
193 return (atf_no_error());
194 }
195