17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cd2Sjpk * Common Development and Distribution License (the "License").
645916cd2Sjpk * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22*f8994074SJan Friedel * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bd9Sstevel@tonic-gate */
247c478bd9Sstevel@tonic-gate
257c478bd9Sstevel@tonic-gate #include <sys/types.h>
26f48205beScasper #include <sys/param.h>
277c478bd9Sstevel@tonic-gate #include <stdio.h>
287c478bd9Sstevel@tonic-gate #include <sys/fcntl.h>
297c478bd9Sstevel@tonic-gate #include <bsm/audit.h>
307c478bd9Sstevel@tonic-gate #include <bsm/audit_record.h>
317c478bd9Sstevel@tonic-gate #include <bsm/audit_uevents.h>
327c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h>
337c478bd9Sstevel@tonic-gate #include <bsm/audit_private.h>
347c478bd9Sstevel@tonic-gate #include <stdlib.h>
357c478bd9Sstevel@tonic-gate #include <string.h>
367c478bd9Sstevel@tonic-gate #include <syslog.h>
377c478bd9Sstevel@tonic-gate #include <netinet/in.h>
3845916cd2Sjpk #include <tsol/label.h>
397c478bd9Sstevel@tonic-gate #include <locale.h>
407c478bd9Sstevel@tonic-gate #include <unistd.h>
417c478bd9Sstevel@tonic-gate #include <generic.h>
427c478bd9Sstevel@tonic-gate
437c478bd9Sstevel@tonic-gate static au_event_t rshd_event; /* audit event number */
447c478bd9Sstevel@tonic-gate static uint32_t rshd_addr[4]; /* peer address */
457c478bd9Sstevel@tonic-gate
467c478bd9Sstevel@tonic-gate static void generate_record(char *, char *, char *, int, char *);
477c478bd9Sstevel@tonic-gate static void setup_session(char *);
487c478bd9Sstevel@tonic-gate static int selected(uid_t, char *, au_event_t, int);
497c478bd9Sstevel@tonic-gate
507c478bd9Sstevel@tonic-gate int
audit_rshd_setup()517c478bd9Sstevel@tonic-gate audit_rshd_setup()
527c478bd9Sstevel@tonic-gate {
537c478bd9Sstevel@tonic-gate rshd_event = AUE_rshd;
547c478bd9Sstevel@tonic-gate return (0);
557c478bd9Sstevel@tonic-gate }
567c478bd9Sstevel@tonic-gate
577c478bd9Sstevel@tonic-gate /* ARGSUSED */
587c478bd9Sstevel@tonic-gate int
audit_rshd_fail(msg,hostname,remuser,locuser,cmdbuf)597c478bd9Sstevel@tonic-gate audit_rshd_fail(msg, hostname, remuser, locuser, cmdbuf)
607c478bd9Sstevel@tonic-gate char *msg; /* message containing failure information */
617c478bd9Sstevel@tonic-gate char *hostname; /* hostname of machine requesting service */
627c478bd9Sstevel@tonic-gate char *remuser; /* username at machine requesting service */
637c478bd9Sstevel@tonic-gate char *locuser; /* username of local machine */
647c478bd9Sstevel@tonic-gate char *cmdbuf; /* command line to be executed locally */
657c478bd9Sstevel@tonic-gate {
667c478bd9Sstevel@tonic-gate if (cannot_audit(0)) {
677c478bd9Sstevel@tonic-gate return (0);
687c478bd9Sstevel@tonic-gate }
697c478bd9Sstevel@tonic-gate generate_record(remuser, locuser, cmdbuf, -1, msg);
707c478bd9Sstevel@tonic-gate return (0);
717c478bd9Sstevel@tonic-gate }
727c478bd9Sstevel@tonic-gate
737c478bd9Sstevel@tonic-gate /* ARGSUSED */
747c478bd9Sstevel@tonic-gate int
audit_rshd_success(hostname,remuser,locuser,cmdbuf)757c478bd9Sstevel@tonic-gate audit_rshd_success(hostname, remuser, locuser, cmdbuf)
767c478bd9Sstevel@tonic-gate char *hostname; /* hostname of machine requesting service */
777c478bd9Sstevel@tonic-gate char *remuser; /* username at machine requesting service */
787c478bd9Sstevel@tonic-gate char *locuser; /* username at local machine */
797c478bd9Sstevel@tonic-gate char *cmdbuf; /* command line to be executed locally */
807c478bd9Sstevel@tonic-gate {
817c478bd9Sstevel@tonic-gate if (cannot_audit(0)) {
827c478bd9Sstevel@tonic-gate return (0);
837c478bd9Sstevel@tonic-gate }
847c478bd9Sstevel@tonic-gate generate_record(remuser, locuser, cmdbuf, 0, "");
857c478bd9Sstevel@tonic-gate setup_session(locuser);
867c478bd9Sstevel@tonic-gate return (0);
877c478bd9Sstevel@tonic-gate }
887c478bd9Sstevel@tonic-gate
897c478bd9Sstevel@tonic-gate
907c478bd9Sstevel@tonic-gate #include <pwd.h>
917c478bd9Sstevel@tonic-gate
927c478bd9Sstevel@tonic-gate static void
generate_record(char * remuser,char * locuser,char * cmdbuf,int sf_flag,char * msg)937c478bd9Sstevel@tonic-gate generate_record(char *remuser, /* username at machine requesting service */
947c478bd9Sstevel@tonic-gate char *locuser, /* username of local machine */
957c478bd9Sstevel@tonic-gate char *cmdbuf, /* command line to be executed locally */
967c478bd9Sstevel@tonic-gate int sf_flag, /* success (0) or failure (-1) flag */
977c478bd9Sstevel@tonic-gate char *msg) /* message containing failure information */
987c478bd9Sstevel@tonic-gate {
997c478bd9Sstevel@tonic-gate int rd; /* audit record descriptor */
1007c478bd9Sstevel@tonic-gate char buf[256]; /* temporary buffer */
1017c478bd9Sstevel@tonic-gate char *tbuf; /* temporary buffer */
1027c478bd9Sstevel@tonic-gate int tlen;
1037c478bd9Sstevel@tonic-gate const char *gtxt;
1047c478bd9Sstevel@tonic-gate uid_t uid;
1057c478bd9Sstevel@tonic-gate gid_t gid;
1067c478bd9Sstevel@tonic-gate pid_t pid;
1077c478bd9Sstevel@tonic-gate struct passwd *pwd;
1087c478bd9Sstevel@tonic-gate struct auditinfo_addr info;
1097c478bd9Sstevel@tonic-gate
1107c478bd9Sstevel@tonic-gate if (cannot_audit(0)) {
1117c478bd9Sstevel@tonic-gate return;
1127c478bd9Sstevel@tonic-gate }
1137c478bd9Sstevel@tonic-gate
1147c478bd9Sstevel@tonic-gate pwd = getpwnam(locuser);
1157c478bd9Sstevel@tonic-gate if (pwd == NULL) {
116f48205beScasper uid = (uid_t)-1;
117f48205beScasper gid = (gid_t)-1;
1187c478bd9Sstevel@tonic-gate } else {
1197c478bd9Sstevel@tonic-gate uid = pwd->pw_uid;
1207c478bd9Sstevel@tonic-gate gid = pwd->pw_gid;
1217c478bd9Sstevel@tonic-gate }
1227c478bd9Sstevel@tonic-gate
1237c478bd9Sstevel@tonic-gate if (!selected(uid, locuser, rshd_event, sf_flag))
1247c478bd9Sstevel@tonic-gate return;
1257c478bd9Sstevel@tonic-gate
1267c478bd9Sstevel@tonic-gate pid = getpid();
1277c478bd9Sstevel@tonic-gate
1287c478bd9Sstevel@tonic-gate /* see if terminal id already set */
1297c478bd9Sstevel@tonic-gate if (getaudit_addr(&info, sizeof (info)) < 0) {
1307c478bd9Sstevel@tonic-gate perror("getaudit");
1317c478bd9Sstevel@tonic-gate }
1327c478bd9Sstevel@tonic-gate rd = au_open();
1337c478bd9Sstevel@tonic-gate
1347c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_subject_ex(uid, uid, gid, uid, gid, pid, pid,
1357c478bd9Sstevel@tonic-gate &info.ai_termid));
13645916cd2Sjpk if (is_system_labeled())
13745916cd2Sjpk (void) au_write(rd, au_to_mylabel());
1387c478bd9Sstevel@tonic-gate
1397c478bd9Sstevel@tonic-gate gtxt = dgettext(bsm_dom, "cmd %s");
1407c478bd9Sstevel@tonic-gate tlen = strlen(gtxt) + strlen(cmdbuf) + 1;
1417c478bd9Sstevel@tonic-gate if ((tbuf = malloc(tlen)) == NULL) {
1427c478bd9Sstevel@tonic-gate (void) au_close(rd, 0, 0);
1437c478bd9Sstevel@tonic-gate return;
1447c478bd9Sstevel@tonic-gate }
1457c478bd9Sstevel@tonic-gate (void) snprintf(tbuf, tlen, gtxt, cmdbuf);
1467c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_text(tbuf));
1477c478bd9Sstevel@tonic-gate (void) free(tbuf);
1487c478bd9Sstevel@tonic-gate
1497c478bd9Sstevel@tonic-gate if (strcmp(remuser, locuser) != 0) {
1507c478bd9Sstevel@tonic-gate (void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
1517c478bd9Sstevel@tonic-gate "remote user %s"), remuser);
1527c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_text(buf));
1537c478bd9Sstevel@tonic-gate }
1547c478bd9Sstevel@tonic-gate
1557c478bd9Sstevel@tonic-gate if (sf_flag == -1) {
1567c478bd9Sstevel@tonic-gate (void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
1577c478bd9Sstevel@tonic-gate "local user %s"), locuser);
1587c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_text(buf));
1597c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_text(msg));
1607c478bd9Sstevel@tonic-gate }
1617c478bd9Sstevel@tonic-gate
1627c478bd9Sstevel@tonic-gate #ifdef _LP64
1637c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_return64(sf_flag, (int64_t)0));
1647c478bd9Sstevel@tonic-gate #else
1657c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_return32(sf_flag, (int32_t)0));
1667c478bd9Sstevel@tonic-gate #endif
1677c478bd9Sstevel@tonic-gate
1687c478bd9Sstevel@tonic-gate if (au_close(rd, 1, rshd_event) < 0) {
1697c478bd9Sstevel@tonic-gate (void) au_close(rd, 0, 0);
1707c478bd9Sstevel@tonic-gate }
1717c478bd9Sstevel@tonic-gate }
1727c478bd9Sstevel@tonic-gate
1737c478bd9Sstevel@tonic-gate static int
selected(uid_t uid,char * locuser,au_event_t event,int sf)1747c478bd9Sstevel@tonic-gate selected(uid_t uid, char *locuser, au_event_t event, int sf)
1757c478bd9Sstevel@tonic-gate {
176*f8994074SJan Friedel int sorf;
1777c478bd9Sstevel@tonic-gate struct au_mask mask;
1787c478bd9Sstevel@tonic-gate
1797c478bd9Sstevel@tonic-gate mask.am_success = mask.am_failure = 0;
180f48205beScasper if (uid > MAXEPHUID) {
181*f8994074SJan Friedel /* get non-attrib flags */
182*f8994074SJan Friedel (void) auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask));
1837c478bd9Sstevel@tonic-gate } else {
184*f8994074SJan Friedel (void) au_user_mask(locuser, &mask);
1857c478bd9Sstevel@tonic-gate }
1867c478bd9Sstevel@tonic-gate
187*f8994074SJan Friedel if (sf == 0) {
1887c478bd9Sstevel@tonic-gate sorf = AU_PRS_SUCCESS;
189*f8994074SJan Friedel } else if (sf == -1) {
1907c478bd9Sstevel@tonic-gate sorf = AU_PRS_FAILURE;
191*f8994074SJan Friedel } else {
1927c478bd9Sstevel@tonic-gate sorf = AU_PRS_BOTH;
193*f8994074SJan Friedel }
194*f8994074SJan Friedel
195*f8994074SJan Friedel return (au_preselect(event, &mask, sorf, AU_PRS_REREAD));
1967c478bd9Sstevel@tonic-gate }
1977c478bd9Sstevel@tonic-gate
1987c478bd9Sstevel@tonic-gate static void
setup_session(char * locuser)1997c478bd9Sstevel@tonic-gate setup_session(char *locuser)
2007c478bd9Sstevel@tonic-gate {
2017c478bd9Sstevel@tonic-gate int rc;
2027c478bd9Sstevel@tonic-gate struct auditinfo_addr info;
2037c478bd9Sstevel@tonic-gate au_mask_t mask;
2047c478bd9Sstevel@tonic-gate uid_t uid;
2057c478bd9Sstevel@tonic-gate struct passwd *pwd;
2067c478bd9Sstevel@tonic-gate
2077c478bd9Sstevel@tonic-gate pwd = getpwnam(locuser);
2087c478bd9Sstevel@tonic-gate if (pwd == NULL)
209f48205beScasper uid = (uid_t)-1;
2107c478bd9Sstevel@tonic-gate else
2117c478bd9Sstevel@tonic-gate uid = pwd->pw_uid;
2127c478bd9Sstevel@tonic-gate
2137c478bd9Sstevel@tonic-gate /* see if terminal id already set */
2147c478bd9Sstevel@tonic-gate if (getaudit_addr(&info, sizeof (info)) < 0) {
2157c478bd9Sstevel@tonic-gate perror("getaudit");
2167c478bd9Sstevel@tonic-gate }
2177c478bd9Sstevel@tonic-gate
2187c478bd9Sstevel@tonic-gate info.ai_auid = uid;
2197c478bd9Sstevel@tonic-gate info.ai_asid = getpid();
2207c478bd9Sstevel@tonic-gate
2217c478bd9Sstevel@tonic-gate mask.am_success = 0;
2227c478bd9Sstevel@tonic-gate mask.am_failure = 0;
2237c478bd9Sstevel@tonic-gate (void) au_user_mask(locuser, &mask);
2247c478bd9Sstevel@tonic-gate
2257c478bd9Sstevel@tonic-gate info.ai_mask.am_success = mask.am_success;
2267c478bd9Sstevel@tonic-gate info.ai_mask.am_failure = mask.am_failure;
2277c478bd9Sstevel@tonic-gate
2287c478bd9Sstevel@tonic-gate rshd_addr[0] = info.ai_termid.at_addr[0];
2297c478bd9Sstevel@tonic-gate rshd_addr[1] = info.ai_termid.at_addr[1];
2307c478bd9Sstevel@tonic-gate rshd_addr[2] = info.ai_termid.at_addr[2];
2317c478bd9Sstevel@tonic-gate rshd_addr[3] = info.ai_termid.at_addr[3];
2327c478bd9Sstevel@tonic-gate
2337c478bd9Sstevel@tonic-gate rc = setaudit_addr(&info, sizeof (info));
2347c478bd9Sstevel@tonic-gate if (rc < 0) {
2357c478bd9Sstevel@tonic-gate perror("setaudit");
2367c478bd9Sstevel@tonic-gate }
2377c478bd9Sstevel@tonic-gate }
238