17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5dfc7be02SJan Friedel * Common Development and Distribution License (the "License").
6dfc7be02SJan Friedel * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22*1b2d1c94SMarek Pospisil * Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bd9Sstevel@tonic-gate */
247c478bd9Sstevel@tonic-gate
257c478bd9Sstevel@tonic-gate #include <sys/types.h>
267c478bd9Sstevel@tonic-gate #include <stdio.h>
277c478bd9Sstevel@tonic-gate #include <unistd.h>
287c478bd9Sstevel@tonic-gate #include <sys/fcntl.h>
297c478bd9Sstevel@tonic-gate #include <bsm/audit.h>
307c478bd9Sstevel@tonic-gate #include <bsm/audit_record.h>
317c478bd9Sstevel@tonic-gate #include <bsm/audit_uevents.h>
327c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h>
337c478bd9Sstevel@tonic-gate #include <bsm/audit_private.h>
347c478bd9Sstevel@tonic-gate #include <stdlib.h>
357c478bd9Sstevel@tonic-gate #include <string.h>
367c478bd9Sstevel@tonic-gate #include <syslog.h>
377c478bd9Sstevel@tonic-gate #include <netinet/in.h>
387c478bd9Sstevel@tonic-gate #include <libgen.h>
397c478bd9Sstevel@tonic-gate #include <generic.h>
407c478bd9Sstevel@tonic-gate
417c478bd9Sstevel@tonic-gate #ifdef C2_DEBUG
42dfc7be02SJan Friedel #define dprintf(x) { (void) printf x; }
437c478bd9Sstevel@tonic-gate #else
447c478bd9Sstevel@tonic-gate #define dprintf(x)
457c478bd9Sstevel@tonic-gate #endif
467c478bd9Sstevel@tonic-gate
477c478bd9Sstevel@tonic-gate static int audit_halt_generic(int);
487c478bd9Sstevel@tonic-gate
497c478bd9Sstevel@tonic-gate /* ARGSUSED */
507c478bd9Sstevel@tonic-gate int
audit_halt_setup(int argc,char ** argv)517c478bd9Sstevel@tonic-gate audit_halt_setup(int argc, char **argv)
527c478bd9Sstevel@tonic-gate {
537c478bd9Sstevel@tonic-gate char *cmdname;
547c478bd9Sstevel@tonic-gate
557c478bd9Sstevel@tonic-gate dprintf(("audit_halt_setup()\n"));
567c478bd9Sstevel@tonic-gate
577c478bd9Sstevel@tonic-gate if (cannot_audit(0)) {
587c478bd9Sstevel@tonic-gate return (0);
597c478bd9Sstevel@tonic-gate }
607c478bd9Sstevel@tonic-gate
617c478bd9Sstevel@tonic-gate cmdname = basename(*argv);
627c478bd9Sstevel@tonic-gate
637c478bd9Sstevel@tonic-gate aug_init();
647c478bd9Sstevel@tonic-gate
657c478bd9Sstevel@tonic-gate if (strcmp(cmdname, "halt") == 0)
667c478bd9Sstevel@tonic-gate aug_save_event(AUE_halt_solaris);
677c478bd9Sstevel@tonic-gate else if (strcmp(cmdname, "poweroff") == 0)
687c478bd9Sstevel@tonic-gate aug_save_event(AUE_poweroff_solaris);
697c478bd9Sstevel@tonic-gate else
707c478bd9Sstevel@tonic-gate exit(1);
717c478bd9Sstevel@tonic-gate (void) aug_save_me();
727c478bd9Sstevel@tonic-gate return (0);
737c478bd9Sstevel@tonic-gate }
747c478bd9Sstevel@tonic-gate
757c478bd9Sstevel@tonic-gate int
audit_halt_fail()767c478bd9Sstevel@tonic-gate audit_halt_fail()
777c478bd9Sstevel@tonic-gate {
787c478bd9Sstevel@tonic-gate return (audit_halt_generic(-1));
797c478bd9Sstevel@tonic-gate }
807c478bd9Sstevel@tonic-gate
817c478bd9Sstevel@tonic-gate int
audit_halt_success()827c478bd9Sstevel@tonic-gate audit_halt_success()
837c478bd9Sstevel@tonic-gate {
847c478bd9Sstevel@tonic-gate int res = 0;
857c478bd9Sstevel@tonic-gate
867c478bd9Sstevel@tonic-gate (void) audit_halt_generic(0);
877c478bd9Sstevel@tonic-gate
887c478bd9Sstevel@tonic-gate /* wait for audit daemon to put halt message onto audit trail */
897c478bd9Sstevel@tonic-gate if (!cannot_audit(0)) {
907c478bd9Sstevel@tonic-gate int cond = AUC_NOAUDIT;
917c478bd9Sstevel@tonic-gate int canaudit;
927c478bd9Sstevel@tonic-gate
937c478bd9Sstevel@tonic-gate (void) sleep(1);
947c478bd9Sstevel@tonic-gate
957c478bd9Sstevel@tonic-gate /* find out if audit daemon is running */
967c478bd9Sstevel@tonic-gate (void) auditon(A_GETCOND, (caddr_t)&cond, sizeof (cond));
977c478bd9Sstevel@tonic-gate canaudit = ((cond == AUC_AUDITING) || (cond == AUC_NOSPACE));
987c478bd9Sstevel@tonic-gate
997c478bd9Sstevel@tonic-gate /* turn off audit daemon and try to flush audit queue */
100*1b2d1c94SMarek Pospisil if (canaudit && system("/usr/sbin/audit -T"))
1017c478bd9Sstevel@tonic-gate res = -1;
1027c478bd9Sstevel@tonic-gate else
1037c478bd9Sstevel@tonic-gate /* give a chance for syslogd to do the job */
1047c478bd9Sstevel@tonic-gate (void) sleep(5);
1057c478bd9Sstevel@tonic-gate }
1067c478bd9Sstevel@tonic-gate
1077c478bd9Sstevel@tonic-gate return (res);
1087c478bd9Sstevel@tonic-gate }
1097c478bd9Sstevel@tonic-gate
1107c478bd9Sstevel@tonic-gate int
audit_halt_generic(sorf)1117c478bd9Sstevel@tonic-gate audit_halt_generic(sorf)
1127c478bd9Sstevel@tonic-gate int sorf;
1137c478bd9Sstevel@tonic-gate {
1147c478bd9Sstevel@tonic-gate int r;
1157c478bd9Sstevel@tonic-gate
1167c478bd9Sstevel@tonic-gate dprintf(("audit_halt_generic(%d)\n", sorf));
1177c478bd9Sstevel@tonic-gate
1187c478bd9Sstevel@tonic-gate if (cannot_audit(0)) {
1197c478bd9Sstevel@tonic-gate return (0);
1207c478bd9Sstevel@tonic-gate }
1217c478bd9Sstevel@tonic-gate
1227c478bd9Sstevel@tonic-gate aug_save_sorf(sorf);
1237c478bd9Sstevel@tonic-gate r = aug_audit();
1247c478bd9Sstevel@tonic-gate
1257c478bd9Sstevel@tonic-gate return (r);
1267c478bd9Sstevel@tonic-gate }
127