1 /*- 2 * Copyright 2018 Aniket Pandey 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 17 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * SUCH DAMAGE. 24 * 25 * $FreeBSD$ 26 */ 27 28 #include <sys/ioctl.h> 29 30 #include <time.h> 31 #include <errno.h> 32 #include <fcntl.h> 33 #include <atf-c.h> 34 #include <string.h> 35 #include <stdlib.h> 36 #include <unistd.h> 37 #include <bsm/libbsm.h> 38 #include <security/audit/audit_ioctl.h> 39 40 #include "utils.h" 41 42 /* 43 * Checks the presence of "auditregex" in auditpipe(4) after the 44 * corresponding system call has been triggered. 45 */ 46 static bool 47 get_records(const char *auditregex, FILE *pipestream) 48 { 49 uint8_t *buff; 50 tokenstr_t token; 51 ssize_t size = 1024; 52 char membuff[size]; 53 char del[] = ","; 54 int reclen, bytes = 0; 55 FILE *memstream; 56 57 /* 58 * Open a stream on 'membuff' (address to memory buffer) for storing 59 * the audit records in the default mode.'reclen' is the length of the 60 * available records from auditpipe which is passed to the functions 61 * au_fetch_tok(3) and au_print_flags_tok(3) for further use. 62 */ 63 ATF_REQUIRE((memstream = fmemopen(membuff, size, "w")) != NULL); 64 ATF_REQUIRE((reclen = au_read_rec(pipestream, &buff)) != -1); 65 66 /* 67 * Iterate through each BSM token, extracting the bits that are 68 * required to start processing the token sequences. 69 */ 70 while (bytes < reclen) { 71 if (au_fetch_tok(&token, buff + bytes, reclen - bytes) == -1) { 72 perror("au_read_rec"); 73 atf_tc_fail("Incomplete Audit Record"); 74 } 75 76 /* Print the tokens as they are obtained, in the default form */ 77 au_print_flags_tok(memstream, &token, del, AU_OFLAG_NONE); 78 bytes += token.len; 79 } 80 81 free(buff); 82 fclose(memstream); 83 return (atf_utils_grep_string("%s", membuff, auditregex)); 84 } 85 86 /* 87 * Override the system-wide audit mask settings in /etc/security/audit_control 88 * and set the auditpipe's maximum allowed queue length limit 89 */ 90 static void 91 set_preselect_mode(int filedesc, au_mask_t *fmask) 92 { 93 int qlimit_max; 94 int fmode = AUDITPIPE_PRESELECT_MODE_LOCAL; 95 96 /* Set local preselection mode for auditing */ 97 if (ioctl(filedesc, AUDITPIPE_SET_PRESELECT_MODE, &fmode) < 0) 98 atf_tc_fail("Preselection mode: %s", strerror(errno)); 99 100 /* Set local preselection flag corresponding to the audit_event */ 101 if (ioctl(filedesc, AUDITPIPE_SET_PRESELECT_FLAGS, fmask) < 0) 102 atf_tc_fail("Preselection flag: %s", strerror(errno)); 103 104 /* Set local preselection flag for non-attributable audit_events */ 105 if (ioctl(filedesc, AUDITPIPE_SET_PRESELECT_NAFLAGS, fmask) < 0) 106 atf_tc_fail("Preselection naflag: %s", strerror(errno)); 107 108 /* Query the maximum possible queue length limit for auditpipe */ 109 if (ioctl(filedesc, AUDITPIPE_GET_QLIMIT_MAX, &qlimit_max) < 0) 110 atf_tc_fail("Query max-limit: %s", strerror(errno)); 111 112 /* Set the queue length limit as obtained from previous step */ 113 if (ioctl(filedesc, AUDITPIPE_SET_QLIMIT, &qlimit_max) < 0) 114 atf_tc_fail("Set max-qlimit: %s", strerror(errno)); 115 116 /* This removes any outstanding record on the auditpipe */ 117 if (ioctl(filedesc, AUDITPIPE_FLUSH) < 0) 118 atf_tc_fail("Auditpipe flush: %s", strerror(errno)); 119 } 120 121 /* 122 * Get the corresponding audit_mask for class-name "name" then set the 123 * success and failure bits for fmask to be used as the ioctl argument 124 */ 125 static au_mask_t 126 get_audit_mask(const char *name) 127 { 128 au_mask_t fmask; 129 au_class_ent_t *class; 130 131 ATF_REQUIRE((class = getauclassnam(name)) != NULL); 132 fmask.am_success = class->ac_class; 133 fmask.am_failure = class->ac_class; 134 return (fmask); 135 } 136 137 /* 138 * Loop until the auditpipe returns something, check if it is what 139 * we want, else repeat the procedure until ppoll(2) times out. 140 */ 141 static void 142 check_auditpipe(struct pollfd fd[], const char *auditregex, FILE *pipestream) 143 { 144 struct timespec currtime, endtime, timeout; 145 146 /* Set the expire time for poll(2) while waiting for syscall audit */ 147 ATF_REQUIRE_EQ(0, clock_gettime(CLOCK_MONOTONIC, &endtime)); 148 endtime.tv_sec += 10; 149 timeout.tv_nsec = endtime.tv_nsec; 150 151 for (;;) { 152 /* Update the time left for auditpipe to return any event */ 153 ATF_REQUIRE_EQ(0, clock_gettime(CLOCK_MONOTONIC, &currtime)); 154 timeout.tv_sec = endtime.tv_sec - currtime.tv_sec; 155 156 switch (ppoll(fd, 1, &timeout, NULL)) { 157 /* ppoll(2) returns, check if it's what we want */ 158 case 1: 159 if (fd[0].revents & POLLIN) { 160 if (get_records(auditregex, pipestream)) 161 return; 162 } else { 163 atf_tc_fail("Auditpipe returned an " 164 "unknown event %#x", fd[0].revents); 165 } 166 break; 167 168 /* poll(2) timed out */ 169 case 0: 170 atf_tc_fail("%s not found in auditpipe within the " 171 "time limit", auditregex); 172 break; 173 174 /* poll(2) standard error */ 175 case -1: 176 atf_tc_fail("Poll: %s", strerror(errno)); 177 break; 178 179 default: 180 atf_tc_fail("Poll returned too many file descriptors"); 181 } 182 } 183 } 184 185 /* 186 * Wrapper functions around static "check_auditpipe" 187 */ 188 static void 189 check_audit_startup(struct pollfd fd[], const char *auditrgx, FILE *pipestream){ 190 check_auditpipe(fd, auditrgx, pipestream); 191 } 192 193 void 194 check_audit(struct pollfd fd[], const char *auditrgx, FILE *pipestream) { 195 check_auditpipe(fd, auditrgx, pipestream); 196 197 /* Cleanup */ 198 fclose(pipestream); 199 close(fd[0].fd); 200 } 201 202 FILE 203 *setup(struct pollfd fd[], const char *name) 204 { 205 au_mask_t fmask, nomask; 206 fmask = get_audit_mask(name); 207 nomask = get_audit_mask("no"); 208 FILE *pipestream; 209 210 fd[0].fd = open("/dev/auditpipe", O_RDONLY); 211 fd[0].events = POLLIN; 212 pipestream = fdopen(fd[0].fd, "r"); 213 214 /* Set local preselection audit_class as "no" for audit startup */ 215 set_preselect_mode(fd[0].fd, &nomask); 216 ATF_REQUIRE_EQ(0, system("service auditd onestatus || \ 217 { service auditd onestart && touch started_auditd ; }")); 218 219 /* If 'started_auditd' exists, that means we started auditd(8) */ 220 if (atf_utils_file_exists("started_auditd")) 221 check_audit_startup(fd, "audit startup", pipestream); 222 223 /* Set local preselection parameters specific to "name" audit_class */ 224 set_preselect_mode(fd[0].fd, &fmask); 225 return (pipestream); 226 } 227 228 void 229 cleanup(void) 230 { 231 if (atf_utils_file_exists("started_auditd")) 232 system("service auditd onestop > /dev/null 2>&1"); 233 } 234