1 /*- 2 * Copyright (c) 2018 Aniket Pandey 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 17 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * SUCH DAMAGE. 24 * 25 * $FreeBSD$ 26 */ 27 28 /* 29 * Note: open(2) and openat(2) have 12 events each for various values of 'flag' 30 * Please see: contrib/openbsm/etc/audit_event#L261 31 * 32 * 270:AUE_OPENAT_R:openat(2) - read:fr 33 * 271:AUE_OPENAT_RC:openat(2) - read,creat:fc,fr,fa,fm 34 * 272:AUE_OPENAT_RT:openat(2) - read,trunc:fd,fr,fa,fm 35 * 273:AUE_OPENAT_RTC:openat(2) - read,creat,trunc:fc,fd,fr,fa,fm 36 * 274:AUE_OPENAT_W:openat(2) - write:fw 37 * 275:AUE_OPENAT_WC:openat(2) - write,creat:fc,fw,fa,fm 38 * 276:AUE_OPENAT_WT:openat(2) - write,trunc:fd,fw,fa,fm 39 * 277:AUE_OPENAT_WTC:openat(2) - write,creat,trunc:fc,fd,fw,fa,fm 40 * 278:AUE_OPENAT_RW:openat(2) - read,write:fr,fw 41 * 279:AUE_OPENAT_RWC:openat(2) - read,write,create:fc,fw,fr,fa,fm 42 * 280:AUE_OPENAT_RWT:openat(2) - read,write,trunc:fd,fw,fr,fa,fm 43 * 281:AUE_OPENAT_RWTC:openat(2) - read,write,creat,trunc:fc,fd,fw,fr,fa,fm 44 */ 45 46 #include <sys/syscall.h> 47 48 #include <atf-c.h> 49 #include <fcntl.h> 50 51 #include "utils.h" 52 53 static struct pollfd fds[1]; 54 static mode_t o_mode = 0777; 55 static int filedesc; 56 static char extregex[80]; 57 static const char *path = "fileforaudit"; 58 static const char *errpath = "adirhasnoname/fileforaudit"; 59 60 /* 61 * Define test-cases for success and failure modes of both open(2) and openat(2) 62 */ 63 #define OPEN_AT_TC_DEFINE(mode, regex, flag, class) \ 64 ATF_TC_WITH_CLEANUP(open_ ## mode ## _success); \ 65 ATF_TC_HEAD(open_ ## mode ## _success, tc) \ 66 { \ 67 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " \ 68 "open(2) call with flags = %s", #flag); \ 69 } \ 70 ATF_TC_BODY(open_ ## mode ## _success, tc) \ 71 { \ 72 snprintf(extregex, sizeof(extregex), \ 73 "open.*%s.*fileforaudit.*return,success", regex); \ 74 /* File needs to exist for successful open(2) invocation */ \ 75 ATF_REQUIRE((filedesc = open(path, O_CREAT, o_mode)) != -1); \ 76 FILE *pipefd = setup(fds, class); \ 77 ATF_REQUIRE(syscall(SYS_open, path, flag) != -1); \ 78 check_audit(fds, extregex, pipefd); \ 79 close(filedesc); \ 80 } \ 81 ATF_TC_CLEANUP(open_ ## mode ## _success, tc) \ 82 { \ 83 cleanup(); \ 84 } \ 85 ATF_TC_WITH_CLEANUP(open_ ## mode ## _failure); \ 86 ATF_TC_HEAD(open_ ## mode ## _failure, tc) \ 87 { \ 88 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " \ 89 "open(2) call with flags = %s", #flag); \ 90 } \ 91 ATF_TC_BODY(open_ ## mode ## _failure, tc) \ 92 { \ 93 snprintf(extregex, sizeof(extregex), \ 94 "open.*%s.*fileforaudit.*return,failure", regex); \ 95 FILE *pipefd = setup(fds, class); \ 96 ATF_REQUIRE_EQ(-1, syscall(SYS_open, errpath, flag)); \ 97 check_audit(fds, extregex, pipefd); \ 98 } \ 99 ATF_TC_CLEANUP(open_ ## mode ## _failure, tc) \ 100 { \ 101 cleanup(); \ 102 } \ 103 ATF_TC_WITH_CLEANUP(openat_ ## mode ## _success); \ 104 ATF_TC_HEAD(openat_ ## mode ## _success, tc) \ 105 { \ 106 atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " \ 107 "openat(2) call with flags = %s", #flag); \ 108 } \ 109 ATF_TC_BODY(openat_ ## mode ## _success, tc) \ 110 { \ 111 int filedesc2; \ 112 snprintf(extregex, sizeof(extregex), \ 113 "openat.*%s.*fileforaudit.*return,success", regex); \ 114 /* File needs to exist for successful openat(2) invocation */ \ 115 ATF_REQUIRE((filedesc = open(path, O_CREAT, o_mode)) != -1); \ 116 FILE *pipefd = setup(fds, class); \ 117 ATF_REQUIRE((filedesc2 = openat(AT_FDCWD, path, flag)) != -1); \ 118 check_audit(fds, extregex, pipefd); \ 119 close(filedesc2); \ 120 close(filedesc); \ 121 } \ 122 ATF_TC_CLEANUP(openat_ ## mode ## _success, tc) \ 123 { \ 124 cleanup(); \ 125 } \ 126 ATF_TC_WITH_CLEANUP(openat_ ## mode ## _failure); \ 127 ATF_TC_HEAD(openat_ ## mode ## _failure, tc) \ 128 { \ 129 atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " \ 130 "openat(2) call with flags = %s", #flag); \ 131 } \ 132 ATF_TC_BODY(openat_ ## mode ## _failure, tc) \ 133 { \ 134 snprintf(extregex, sizeof(extregex), \ 135 "openat.*%s.*fileforaudit.*return,failure", regex); \ 136 FILE *pipefd = setup(fds, class); \ 137 ATF_REQUIRE_EQ(-1, openat(AT_FDCWD, errpath, flag)); \ 138 check_audit(fds, extregex, pipefd); \ 139 } \ 140 ATF_TC_CLEANUP(openat_ ## mode ## _failure, tc) \ 141 { \ 142 cleanup(); \ 143 } 144 145 /* 146 * Add both success and failure modes of open(2) and openat(2) 147 */ 148 #define OPEN_AT_TC_ADD(tp, mode) \ 149 do { \ 150 ATF_TP_ADD_TC(tp, open_ ## mode ## _success); \ 151 ATF_TP_ADD_TC(tp, open_ ## mode ## _failure); \ 152 ATF_TP_ADD_TC(tp, openat_ ## mode ## _success); \ 153 ATF_TP_ADD_TC(tp, openat_ ## mode ## _failure); \ 154 } while (0) 155 156 157 /* 158 * Each of the 12 OPEN_AT_TC_DEFINE statement is a group of 4 test-cases 159 * corresponding to separate audit events for open(2) and openat(2) 160 */ 161 OPEN_AT_TC_DEFINE(read, "read", O_RDONLY, "fr") 162 OPEN_AT_TC_DEFINE(read_creat, "read,creat", O_RDONLY | O_CREAT, "fr") 163 OPEN_AT_TC_DEFINE(read_trunc, "read,trunc", O_RDONLY | O_TRUNC, "fr") 164 OPEN_AT_TC_DEFINE(read_creat_trunc, "read,creat,trunc", O_RDONLY | O_CREAT 165 | O_TRUNC, "fr") 166 OPEN_AT_TC_DEFINE(write, "write", O_WRONLY, "fw") 167 OPEN_AT_TC_DEFINE(write_creat, "write,creat", O_WRONLY | O_CREAT, "fw") 168 OPEN_AT_TC_DEFINE(write_trunc, "write,trunc", O_WRONLY | O_TRUNC, "fw") 169 OPEN_AT_TC_DEFINE(write_creat_trunc, "write,creat,trunc", O_WRONLY | O_CREAT 170 | O_TRUNC, "fw") 171 OPEN_AT_TC_DEFINE(read_write, "read,write", O_RDWR, "fr") 172 OPEN_AT_TC_DEFINE(read_write_creat, "read,write,creat", O_RDWR | O_CREAT, "fw") 173 OPEN_AT_TC_DEFINE(read_write_trunc, "read,write,trunc", O_RDWR | O_TRUNC, "fr") 174 OPEN_AT_TC_DEFINE(read_write_creat_trunc, "read,write,creat,trunc", O_RDWR | 175 O_CREAT | O_TRUNC, "fw") 176 177 178 ATF_TP_ADD_TCS(tp) 179 { 180 OPEN_AT_TC_ADD(tp, read); 181 OPEN_AT_TC_ADD(tp, read_creat); 182 OPEN_AT_TC_ADD(tp, read_trunc); 183 OPEN_AT_TC_ADD(tp, read_creat_trunc); 184 185 OPEN_AT_TC_ADD(tp, write); 186 OPEN_AT_TC_ADD(tp, write_creat); 187 OPEN_AT_TC_ADD(tp, write_trunc); 188 OPEN_AT_TC_ADD(tp, write_creat_trunc); 189 190 OPEN_AT_TC_ADD(tp, read_write); 191 OPEN_AT_TC_ADD(tp, read_write_creat); 192 OPEN_AT_TC_ADD(tp, read_write_trunc); 193 OPEN_AT_TC_ADD(tp, read_write_creat_trunc); 194 195 return (atf_no_error()); 196 } 197