17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cd2Sjpk * Common Development and Distribution License (the "License").
645916cd2Sjpk * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22*96093503SMarek Pospisil * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
237c478bd9Sstevel@tonic-gate * Use is subject to license terms.
247c478bd9Sstevel@tonic-gate */
257c478bd9Sstevel@tonic-gate
267c478bd9Sstevel@tonic-gate #include <netdb.h>
277c478bd9Sstevel@tonic-gate #include <netinet/in.h>
287c478bd9Sstevel@tonic-gate #include <pwd.h>
297c478bd9Sstevel@tonic-gate #include <sys/errno.h>
307c478bd9Sstevel@tonic-gate #include <sys/mutex.h>
317c478bd9Sstevel@tonic-gate #include <sys/param.h>
327c478bd9Sstevel@tonic-gate #include <sys/socket.h>
337c478bd9Sstevel@tonic-gate #include <sys/stat.h>
347c478bd9Sstevel@tonic-gate #include <sys/types.h>
357c478bd9Sstevel@tonic-gate #include <string.h>
367c478bd9Sstevel@tonic-gate #include <unistd.h>
3767dbe2beSCasper H.S. Dik #include <alloca.h>
387c478bd9Sstevel@tonic-gate #include <stdlib.h>
3945916cd2Sjpk #include <tsol/label.h>
407c478bd9Sstevel@tonic-gate #include <bsm/audit.h>
417c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h>
427c478bd9Sstevel@tonic-gate #include <bsm/audit_uevents.h>
437c478bd9Sstevel@tonic-gate #include <bsm/audit_record.h>
447c478bd9Sstevel@tonic-gate
457c478bd9Sstevel@tonic-gate #define AUC_NEVER -2 /* audit module not loaded */
467c478bd9Sstevel@tonic-gate
477c478bd9Sstevel@tonic-gate /* Private Functions */
487c478bd9Sstevel@tonic-gate static int selected(au_event_t, au_mask_t *, int);
497c478bd9Sstevel@tonic-gate
507c478bd9Sstevel@tonic-gate int aug_selected();
517c478bd9Sstevel@tonic-gate int aug_na_selected();
527c478bd9Sstevel@tonic-gate
537c478bd9Sstevel@tonic-gate /* Global Variables */
547c478bd9Sstevel@tonic-gate static au_id_t aug_auid; /* auid of user writing audit record */
557c478bd9Sstevel@tonic-gate static uid_t aug_uid; /* uid of user writing audit record */
567c478bd9Sstevel@tonic-gate static uid_t aug_euid; /* euid of user writing audit record */
577c478bd9Sstevel@tonic-gate static gid_t aug_gid; /* gid of user writing audit record */
587c478bd9Sstevel@tonic-gate static gid_t aug_egid; /* euid of user writing audit record */
597c478bd9Sstevel@tonic-gate static pid_t aug_pid; /* pid of user writing audit record */
607c478bd9Sstevel@tonic-gate static au_tid_addr_t aug_tid; /* tid of user writing audit record */
617c478bd9Sstevel@tonic-gate static int aug_na; /* 0 if event is attributable */
627c478bd9Sstevel@tonic-gate static au_mask_t aug_namask; /* not attributable flags */
637c478bd9Sstevel@tonic-gate static au_event_t aug_event; /* id of event being audited */
647c478bd9Sstevel@tonic-gate static int aug_sorf; /* success or failure of aug_event */
657c478bd9Sstevel@tonic-gate static char *aug_text; /* misc text to be written to trail */
667c478bd9Sstevel@tonic-gate static char *aug_text1; /* misc text to be written to trail */
677c478bd9Sstevel@tonic-gate static char *aug_text2; /* misc text to be written to trail */
687c478bd9Sstevel@tonic-gate static au_asid_t aug_asid; /* asid of process writing record */
697c478bd9Sstevel@tonic-gate static int (*aug_afunc)(); /* write additional tokens if needed */
707c478bd9Sstevel@tonic-gate static char *aug_path; /* path token */
71*96093503SMarek Pospisil static uint32_t aug_policy; /* kernel audit policy */
727c478bd9Sstevel@tonic-gate
737c478bd9Sstevel@tonic-gate /*
747c478bd9Sstevel@tonic-gate * cannot_audit:
757c478bd9Sstevel@tonic-gate * Return 1 if audit module not loaded.
767c478bd9Sstevel@tonic-gate * Return 0 otherwise.
777c478bd9Sstevel@tonic-gate *
787c478bd9Sstevel@tonic-gate * The argument, force, should be set to 1 for long-lived processes
797c478bd9Sstevel@tonic-gate * like some daemons. Force should be set to 0 for most programs.
807c478bd9Sstevel@tonic-gate */
817c478bd9Sstevel@tonic-gate int
cannot_audit(force)827c478bd9Sstevel@tonic-gate cannot_audit(force)
837c478bd9Sstevel@tonic-gate int force;
847c478bd9Sstevel@tonic-gate {
857c478bd9Sstevel@tonic-gate static int auc = AUC_UNSET;
867c478bd9Sstevel@tonic-gate int cond = 0;
877c478bd9Sstevel@tonic-gate
887c478bd9Sstevel@tonic-gate if (auc == AUC_UNSET || force) {
897c478bd9Sstevel@tonic-gate if (auditon(A_GETCOND, (caddr_t)&cond, sizeof (cond))) {
907c478bd9Sstevel@tonic-gate auc = AUC_NEVER;
917c478bd9Sstevel@tonic-gate } else {
927c478bd9Sstevel@tonic-gate auc = cond;
937c478bd9Sstevel@tonic-gate }
947c478bd9Sstevel@tonic-gate }
957c478bd9Sstevel@tonic-gate return (auc == AUC_NEVER);
967c478bd9Sstevel@tonic-gate }
977c478bd9Sstevel@tonic-gate
987c478bd9Sstevel@tonic-gate /*
997c478bd9Sstevel@tonic-gate * aug_init():
1007c478bd9Sstevel@tonic-gate * Initialize global variables.
1017c478bd9Sstevel@tonic-gate */
1027c478bd9Sstevel@tonic-gate void
aug_init()1037c478bd9Sstevel@tonic-gate aug_init()
1047c478bd9Sstevel@tonic-gate {
105f48205beScasper aug_auid = (uid_t)-1;
106f48205beScasper aug_uid = (uid_t)-1;
107f48205beScasper aug_euid = (uid_t)-1;
108f48205beScasper aug_gid = (gid_t)-1;
109f48205beScasper aug_egid = (gid_t)-1;
1107c478bd9Sstevel@tonic-gate aug_pid = -1;
1117c478bd9Sstevel@tonic-gate aug_tid.at_port = 0;
1127c478bd9Sstevel@tonic-gate aug_tid.at_type = AU_IPv4;
1137c478bd9Sstevel@tonic-gate aug_tid.at_addr[0] = 0;
1147c478bd9Sstevel@tonic-gate aug_tid.at_addr[1] = 0;
1157c478bd9Sstevel@tonic-gate aug_tid.at_addr[2] = 0;
1167c478bd9Sstevel@tonic-gate aug_tid.at_addr[3] = 0;
1177c478bd9Sstevel@tonic-gate aug_namask.am_success = AU_MASK_ALL;
1187c478bd9Sstevel@tonic-gate aug_namask.am_failure = AU_MASK_ALL;
1197c478bd9Sstevel@tonic-gate aug_event = 0;
1207c478bd9Sstevel@tonic-gate aug_sorf = -2;
1217c478bd9Sstevel@tonic-gate aug_text = NULL;
1227c478bd9Sstevel@tonic-gate aug_text1 = NULL;
1237c478bd9Sstevel@tonic-gate aug_text2 = NULL;
1247c478bd9Sstevel@tonic-gate aug_na = 0;
125d0fa49b7STony Nguyen aug_asid = (au_asid_t)(-1);
1267c478bd9Sstevel@tonic-gate aug_afunc = NULL;
1277c478bd9Sstevel@tonic-gate aug_path = NULL;
1287c478bd9Sstevel@tonic-gate }
1297c478bd9Sstevel@tonic-gate
1307c478bd9Sstevel@tonic-gate /*
1317c478bd9Sstevel@tonic-gate * aug_get_port:
1327c478bd9Sstevel@tonic-gate * Return the raw device number of the port to which the
1337c478bd9Sstevel@tonic-gate * current process is attached (assumed to be attached
1347c478bd9Sstevel@tonic-gate * through file descriptor 0) or 0 if can't stat the port.
1357c478bd9Sstevel@tonic-gate */
1367c478bd9Sstevel@tonic-gate dev_t
aug_get_port()1377c478bd9Sstevel@tonic-gate aug_get_port()
1387c478bd9Sstevel@tonic-gate {
1397c478bd9Sstevel@tonic-gate int rc;
1407c478bd9Sstevel@tonic-gate char *ttyn;
1417c478bd9Sstevel@tonic-gate struct stat sb;
1427c478bd9Sstevel@tonic-gate
1437c478bd9Sstevel@tonic-gate ttyn = ttyname(0);
1447c478bd9Sstevel@tonic-gate if (ttyn == 0 || *ttyn == '\0') {
1457c478bd9Sstevel@tonic-gate return (0);
1467c478bd9Sstevel@tonic-gate }
1477c478bd9Sstevel@tonic-gate
1487c478bd9Sstevel@tonic-gate rc = stat(ttyn, &sb);
1497c478bd9Sstevel@tonic-gate if (rc < 0) {
1507c478bd9Sstevel@tonic-gate perror("stat");
1517c478bd9Sstevel@tonic-gate return (0);
1527c478bd9Sstevel@tonic-gate }
1537c478bd9Sstevel@tonic-gate
1547c478bd9Sstevel@tonic-gate return ((dev_t)sb.st_rdev);
1557c478bd9Sstevel@tonic-gate }
1567c478bd9Sstevel@tonic-gate
1577c478bd9Sstevel@tonic-gate /*
1587c478bd9Sstevel@tonic-gate * aug_get_machine:
1597c478bd9Sstevel@tonic-gate * Return internet address of host hostname,
1607c478bd9Sstevel@tonic-gate * or 0 if can't do lookup.
1617c478bd9Sstevel@tonic-gate */
1627c478bd9Sstevel@tonic-gate
1637c478bd9Sstevel@tonic-gate int
aug_get_machine(const char * hostname,uint32_t * buf,uint32_t * type)1647c478bd9Sstevel@tonic-gate aug_get_machine(const char *hostname, uint32_t *buf, uint32_t *type)
1657c478bd9Sstevel@tonic-gate {
1667c478bd9Sstevel@tonic-gate struct addrinfo *ai;
1677c478bd9Sstevel@tonic-gate int err;
1687c478bd9Sstevel@tonic-gate void *p;
1697c478bd9Sstevel@tonic-gate
1707c478bd9Sstevel@tonic-gate err = getaddrinfo(hostname, NULL, NULL, &ai);
1717c478bd9Sstevel@tonic-gate if (err != 0)
1727c478bd9Sstevel@tonic-gate return (0);
1737c478bd9Sstevel@tonic-gate
1747c478bd9Sstevel@tonic-gate switch (ai->ai_family) {
1757c478bd9Sstevel@tonic-gate case AF_INET:
1767c478bd9Sstevel@tonic-gate /* LINTED */
1777c478bd9Sstevel@tonic-gate p = &((struct sockaddr_in *)ai->ai_addr)->sin_addr,
1787c478bd9Sstevel@tonic-gate (void) memcpy(buf, p,
1797c478bd9Sstevel@tonic-gate sizeof (((struct sockaddr_in *)0)->sin_addr));
1807c478bd9Sstevel@tonic-gate *type = AU_IPv4;
1817c478bd9Sstevel@tonic-gate break;
1827c478bd9Sstevel@tonic-gate case AF_INET6:
1837c478bd9Sstevel@tonic-gate /* LINTED */
1847c478bd9Sstevel@tonic-gate p = &((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr,
1857c478bd9Sstevel@tonic-gate (void) memcpy(buf, p,
1867c478bd9Sstevel@tonic-gate sizeof (((struct sockaddr_in6 *)0)->sin6_addr));
1877c478bd9Sstevel@tonic-gate *type = AU_IPv6;
1887c478bd9Sstevel@tonic-gate break;
1897c478bd9Sstevel@tonic-gate default:
1907c478bd9Sstevel@tonic-gate return (0);
1917c478bd9Sstevel@tonic-gate }
1927c478bd9Sstevel@tonic-gate
1937c478bd9Sstevel@tonic-gate freeaddrinfo(ai);
1947c478bd9Sstevel@tonic-gate
1957c478bd9Sstevel@tonic-gate return (1);
1967c478bd9Sstevel@tonic-gate }
1977c478bd9Sstevel@tonic-gate
1987c478bd9Sstevel@tonic-gate void
aug_save_auid(au_id_t id)1997c478bd9Sstevel@tonic-gate aug_save_auid(au_id_t id)
2007c478bd9Sstevel@tonic-gate {
2017c478bd9Sstevel@tonic-gate aug_auid = id;
2027c478bd9Sstevel@tonic-gate }
2037c478bd9Sstevel@tonic-gate
2047c478bd9Sstevel@tonic-gate void
aug_save_uid(uid_t id)2057c478bd9Sstevel@tonic-gate aug_save_uid(uid_t id)
2067c478bd9Sstevel@tonic-gate {
2077c478bd9Sstevel@tonic-gate aug_uid = id;
2087c478bd9Sstevel@tonic-gate }
2097c478bd9Sstevel@tonic-gate
2107c478bd9Sstevel@tonic-gate void
aug_save_euid(uid_t id)2117c478bd9Sstevel@tonic-gate aug_save_euid(uid_t id)
2127c478bd9Sstevel@tonic-gate {
2137c478bd9Sstevel@tonic-gate aug_euid = id;
2147c478bd9Sstevel@tonic-gate }
2157c478bd9Sstevel@tonic-gate
2167c478bd9Sstevel@tonic-gate void
aug_save_gid(gid_t id)2177c478bd9Sstevel@tonic-gate aug_save_gid(gid_t id)
2187c478bd9Sstevel@tonic-gate {
2197c478bd9Sstevel@tonic-gate aug_gid = id;
2207c478bd9Sstevel@tonic-gate }
2217c478bd9Sstevel@tonic-gate
2227c478bd9Sstevel@tonic-gate void
aug_save_egid(gid_t id)2237c478bd9Sstevel@tonic-gate aug_save_egid(gid_t id)
2247c478bd9Sstevel@tonic-gate {
2257c478bd9Sstevel@tonic-gate aug_egid = id;
2267c478bd9Sstevel@tonic-gate }
2277c478bd9Sstevel@tonic-gate
2287c478bd9Sstevel@tonic-gate void
aug_save_pid(pid_t id)2297c478bd9Sstevel@tonic-gate aug_save_pid(pid_t id)
2307c478bd9Sstevel@tonic-gate {
2317c478bd9Sstevel@tonic-gate aug_pid = id;
2327c478bd9Sstevel@tonic-gate }
2337c478bd9Sstevel@tonic-gate
2347c478bd9Sstevel@tonic-gate void
aug_save_asid(au_asid_t id)2357c478bd9Sstevel@tonic-gate aug_save_asid(au_asid_t id)
2367c478bd9Sstevel@tonic-gate {
2377c478bd9Sstevel@tonic-gate aug_asid = id;
2387c478bd9Sstevel@tonic-gate }
2397c478bd9Sstevel@tonic-gate
2407c478bd9Sstevel@tonic-gate void
aug_save_afunc(int (* afunc)())2417c478bd9Sstevel@tonic-gate aug_save_afunc(int (*afunc)())
2427c478bd9Sstevel@tonic-gate {
2437c478bd9Sstevel@tonic-gate aug_afunc = afunc;
2447c478bd9Sstevel@tonic-gate }
2457c478bd9Sstevel@tonic-gate
2467c478bd9Sstevel@tonic-gate void
aug_save_tid(dev_t port,int machine)2477c478bd9Sstevel@tonic-gate aug_save_tid(dev_t port, int machine)
2487c478bd9Sstevel@tonic-gate {
2497c478bd9Sstevel@tonic-gate aug_tid.at_port = port;
2507c478bd9Sstevel@tonic-gate aug_tid.at_type = AU_IPv4;
2517c478bd9Sstevel@tonic-gate aug_tid.at_addr[0] = machine;
2527c478bd9Sstevel@tonic-gate }
2537c478bd9Sstevel@tonic-gate
2547c478bd9Sstevel@tonic-gate void
aug_save_tid_ex(dev_t port,uint32_t * machine,uint32_t type)2557c478bd9Sstevel@tonic-gate aug_save_tid_ex(dev_t port, uint32_t *machine, uint32_t type)
2567c478bd9Sstevel@tonic-gate {
2577c478bd9Sstevel@tonic-gate int i;
2587c478bd9Sstevel@tonic-gate
2597c478bd9Sstevel@tonic-gate aug_tid.at_port = port;
2607c478bd9Sstevel@tonic-gate if ((type != AU_IPv4) && (type != AU_IPv6))
2617c478bd9Sstevel@tonic-gate type = AU_IPv4;
2627c478bd9Sstevel@tonic-gate
2637c478bd9Sstevel@tonic-gate aug_tid.at_type = type;
2647c478bd9Sstevel@tonic-gate for (i = 0; i < (type/4); i++)
2657c478bd9Sstevel@tonic-gate aug_tid.at_addr[i] = machine[i];
2667c478bd9Sstevel@tonic-gate }
2677c478bd9Sstevel@tonic-gate
2687c478bd9Sstevel@tonic-gate int
aug_save_me(void)2697c478bd9Sstevel@tonic-gate aug_save_me(void)
2707c478bd9Sstevel@tonic-gate {
2717c478bd9Sstevel@tonic-gate auditinfo_addr_t ai;
2727c478bd9Sstevel@tonic-gate
2737c478bd9Sstevel@tonic-gate if (getaudit_addr(&ai, sizeof (ai)))
2747c478bd9Sstevel@tonic-gate return (-1);
2757c478bd9Sstevel@tonic-gate
2767c478bd9Sstevel@tonic-gate aug_save_auid(ai.ai_auid);
2777c478bd9Sstevel@tonic-gate aug_save_euid(geteuid());
2787c478bd9Sstevel@tonic-gate aug_save_egid(getegid());
2797c478bd9Sstevel@tonic-gate aug_save_uid(getuid());
2807c478bd9Sstevel@tonic-gate aug_save_gid(getgid());
2817c478bd9Sstevel@tonic-gate aug_save_pid(getpid());
2827c478bd9Sstevel@tonic-gate aug_save_asid(ai.ai_asid);
2837c478bd9Sstevel@tonic-gate aug_save_tid_ex(ai.ai_termid.at_port,
2847c478bd9Sstevel@tonic-gate ai.ai_termid.at_addr,
2857c478bd9Sstevel@tonic-gate ai.ai_termid.at_type);
2867c478bd9Sstevel@tonic-gate return (0);
2877c478bd9Sstevel@tonic-gate }
2887c478bd9Sstevel@tonic-gate
2897c478bd9Sstevel@tonic-gate /*
2907c478bd9Sstevel@tonic-gate * aug_save_namask():
2917c478bd9Sstevel@tonic-gate * Save the namask using the naflags entry in the audit_control file.
2927c478bd9Sstevel@tonic-gate * Return 0 if successful.
2937c478bd9Sstevel@tonic-gate * Return -1, and don't change the namask, if failed.
2947c478bd9Sstevel@tonic-gate * Side Effect: Sets aug_na to -1 if error, 1 if successful.
2957c478bd9Sstevel@tonic-gate */
2967c478bd9Sstevel@tonic-gate int
aug_save_namask()2977c478bd9Sstevel@tonic-gate aug_save_namask()
2987c478bd9Sstevel@tonic-gate {
2997c478bd9Sstevel@tonic-gate au_mask_t mask;
3007c478bd9Sstevel@tonic-gate
3017c478bd9Sstevel@tonic-gate aug_na = -1;
3027c478bd9Sstevel@tonic-gate
3037c478bd9Sstevel@tonic-gate /*
3047c478bd9Sstevel@tonic-gate * get non-attributable system event mask from kernel.
3057c478bd9Sstevel@tonic-gate */
3067c478bd9Sstevel@tonic-gate if (auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask)) != 0) {
3077c478bd9Sstevel@tonic-gate return (-1);
3087c478bd9Sstevel@tonic-gate }
3097c478bd9Sstevel@tonic-gate
3107c478bd9Sstevel@tonic-gate aug_namask.am_success = mask.am_success;
3117c478bd9Sstevel@tonic-gate aug_namask.am_failure = mask.am_failure;
3127c478bd9Sstevel@tonic-gate aug_na = 1;
3137c478bd9Sstevel@tonic-gate return (0);
3147c478bd9Sstevel@tonic-gate }
3157c478bd9Sstevel@tonic-gate
3167c478bd9Sstevel@tonic-gate void
aug_save_event(au_event_t id)3177c478bd9Sstevel@tonic-gate aug_save_event(au_event_t id)
3187c478bd9Sstevel@tonic-gate {
3197c478bd9Sstevel@tonic-gate aug_event = id;
3207c478bd9Sstevel@tonic-gate }
3217c478bd9Sstevel@tonic-gate
3227c478bd9Sstevel@tonic-gate void
aug_save_sorf(int sorf)3237c478bd9Sstevel@tonic-gate aug_save_sorf(int sorf)
3247c478bd9Sstevel@tonic-gate {
3257c478bd9Sstevel@tonic-gate aug_sorf = sorf;
3267c478bd9Sstevel@tonic-gate }
3277c478bd9Sstevel@tonic-gate
3287c478bd9Sstevel@tonic-gate void
aug_save_text(char * s)3297c478bd9Sstevel@tonic-gate aug_save_text(char *s)
3307c478bd9Sstevel@tonic-gate {
3317c478bd9Sstevel@tonic-gate if (aug_text != NULL)
3327c478bd9Sstevel@tonic-gate free(aug_text);
3337c478bd9Sstevel@tonic-gate if (s == NULL)
3347c478bd9Sstevel@tonic-gate aug_text = NULL;
3357c478bd9Sstevel@tonic-gate else
3367c478bd9Sstevel@tonic-gate aug_text = strdup(s);
3377c478bd9Sstevel@tonic-gate }
3387c478bd9Sstevel@tonic-gate
3397c478bd9Sstevel@tonic-gate void
aug_save_text1(char * s)3407c478bd9Sstevel@tonic-gate aug_save_text1(char *s)
3417c478bd9Sstevel@tonic-gate {
3427c478bd9Sstevel@tonic-gate if (aug_text1 != NULL)
3437c478bd9Sstevel@tonic-gate free(aug_text1);
3447c478bd9Sstevel@tonic-gate if (s == NULL)
3457c478bd9Sstevel@tonic-gate aug_text1 = NULL;
3467c478bd9Sstevel@tonic-gate else
3477c478bd9Sstevel@tonic-gate aug_text1 = strdup(s);
3487c478bd9Sstevel@tonic-gate }
3497c478bd9Sstevel@tonic-gate
3507c478bd9Sstevel@tonic-gate void
aug_save_text2(char * s)3517c478bd9Sstevel@tonic-gate aug_save_text2(char *s)
3527c478bd9Sstevel@tonic-gate {
3537c478bd9Sstevel@tonic-gate if (aug_text2 != NULL)
3547c478bd9Sstevel@tonic-gate free(aug_text2);
3557c478bd9Sstevel@tonic-gate if (s == NULL)
3567c478bd9Sstevel@tonic-gate aug_text2 = NULL;
3577c478bd9Sstevel@tonic-gate else
3587c478bd9Sstevel@tonic-gate aug_text2 = strdup(s);
3597c478bd9Sstevel@tonic-gate }
3607c478bd9Sstevel@tonic-gate
3617c478bd9Sstevel@tonic-gate void
aug_save_na(int flag)3627c478bd9Sstevel@tonic-gate aug_save_na(int flag)
3637c478bd9Sstevel@tonic-gate {
3647c478bd9Sstevel@tonic-gate aug_na = flag;
3657c478bd9Sstevel@tonic-gate }
3667c478bd9Sstevel@tonic-gate
3677c478bd9Sstevel@tonic-gate void
aug_save_path(char * s)3687c478bd9Sstevel@tonic-gate aug_save_path(char *s)
3697c478bd9Sstevel@tonic-gate {
3707c478bd9Sstevel@tonic-gate if (aug_path != NULL)
3717c478bd9Sstevel@tonic-gate free(aug_path);
3727c478bd9Sstevel@tonic-gate if (s == NULL)
3737c478bd9Sstevel@tonic-gate aug_path = NULL;
3747c478bd9Sstevel@tonic-gate aug_path = strdup(s);
3757c478bd9Sstevel@tonic-gate }
3767c478bd9Sstevel@tonic-gate
3777c478bd9Sstevel@tonic-gate int
aug_save_policy()3787c478bd9Sstevel@tonic-gate aug_save_policy()
3797c478bd9Sstevel@tonic-gate {
380*96093503SMarek Pospisil uint32_t policy;
3817c478bd9Sstevel@tonic-gate
3827c478bd9Sstevel@tonic-gate if (auditon(A_GETPOLICY, (caddr_t)&policy, sizeof (policy))) {
3837c478bd9Sstevel@tonic-gate return (-1);
3847c478bd9Sstevel@tonic-gate }
3857c478bd9Sstevel@tonic-gate aug_policy = policy;
3867c478bd9Sstevel@tonic-gate return (0);
3877c478bd9Sstevel@tonic-gate }
3887c478bd9Sstevel@tonic-gate
3897c478bd9Sstevel@tonic-gate /*
3907c478bd9Sstevel@tonic-gate * aug_audit:
3917c478bd9Sstevel@tonic-gate * Cut and audit record if it is selected.
3927c478bd9Sstevel@tonic-gate * Return 0, if successfully written.
3937c478bd9Sstevel@tonic-gate * Return 0, if not written, and not expected to write.
3947c478bd9Sstevel@tonic-gate * Return -1, if not written because of unexpected error.
3957c478bd9Sstevel@tonic-gate */
3967c478bd9Sstevel@tonic-gate int
aug_audit(void)3977c478bd9Sstevel@tonic-gate aug_audit(void)
3987c478bd9Sstevel@tonic-gate {
3997c478bd9Sstevel@tonic-gate int ad;
4007c478bd9Sstevel@tonic-gate
4017c478bd9Sstevel@tonic-gate if (cannot_audit(0)) {
4027c478bd9Sstevel@tonic-gate return (0);
4037c478bd9Sstevel@tonic-gate }
4047c478bd9Sstevel@tonic-gate
4057c478bd9Sstevel@tonic-gate if (aug_na) {
4067c478bd9Sstevel@tonic-gate if (!aug_na_selected()) {
4077c478bd9Sstevel@tonic-gate return (0);
4087c478bd9Sstevel@tonic-gate }
4097c478bd9Sstevel@tonic-gate } else if (!aug_selected()) {
4107c478bd9Sstevel@tonic-gate return (0);
4117c478bd9Sstevel@tonic-gate }
4127c478bd9Sstevel@tonic-gate
4137c478bd9Sstevel@tonic-gate if ((ad = au_open()) == -1) {
4147c478bd9Sstevel@tonic-gate return (-1);
4157c478bd9Sstevel@tonic-gate }
4167c478bd9Sstevel@tonic-gate
4177c478bd9Sstevel@tonic-gate (void) au_write(ad, au_to_subject_ex(aug_auid, aug_euid, aug_egid,
4187c478bd9Sstevel@tonic-gate aug_uid, aug_gid, aug_pid, aug_asid, &aug_tid));
419c7bb2ee8Sgww if (is_system_labeled())
420c7bb2ee8Sgww (void) au_write(ad, au_to_mylabel());
4217c478bd9Sstevel@tonic-gate if (aug_policy & AUDIT_GROUP) {
4227c478bd9Sstevel@tonic-gate int ng;
42367dbe2beSCasper H.S. Dik int maxgrp = getgroups(0, NULL);
42467dbe2beSCasper H.S. Dik gid_t *grplst = alloca(maxgrp * sizeof (gid_t));
4257c478bd9Sstevel@tonic-gate
42667dbe2beSCasper H.S. Dik if ((ng = getgroups(maxgrp, grplst)) > 0) {
4277c478bd9Sstevel@tonic-gate (void) au_write(ad, au_to_newgroups(ng, grplst));
4287c478bd9Sstevel@tonic-gate }
4297c478bd9Sstevel@tonic-gate }
4307c478bd9Sstevel@tonic-gate if (aug_text != NULL) {
4317c478bd9Sstevel@tonic-gate (void) au_write(ad, au_to_text(aug_text));
4327c478bd9Sstevel@tonic-gate }
4337c478bd9Sstevel@tonic-gate if (aug_text1 != NULL) {
4347c478bd9Sstevel@tonic-gate (void) au_write(ad, au_to_text(aug_text1));
4357c478bd9Sstevel@tonic-gate }
4367c478bd9Sstevel@tonic-gate if (aug_text2 != NULL) {
4377c478bd9Sstevel@tonic-gate (void) au_write(ad, au_to_text(aug_text2));
4387c478bd9Sstevel@tonic-gate }
4397c478bd9Sstevel@tonic-gate if (aug_path != NULL) {
4407c478bd9Sstevel@tonic-gate (void) au_write(ad, au_to_path(aug_path));
4417c478bd9Sstevel@tonic-gate }
4427c478bd9Sstevel@tonic-gate if (aug_afunc != NULL) {
4437c478bd9Sstevel@tonic-gate (*aug_afunc)(ad);
4447c478bd9Sstevel@tonic-gate }
4457c478bd9Sstevel@tonic-gate #ifdef _LP64
4467c478bd9Sstevel@tonic-gate (void) au_write(ad, au_to_return64((aug_sorf == 0) ? 0 : -1,
4477c478bd9Sstevel@tonic-gate (int64_t)aug_sorf));
4487c478bd9Sstevel@tonic-gate #else
4497c478bd9Sstevel@tonic-gate (void) au_write(ad, au_to_return32((aug_sorf == 0) ? 0 : -1,
4507c478bd9Sstevel@tonic-gate (int32_t)aug_sorf));
4517c478bd9Sstevel@tonic-gate #endif
4527c478bd9Sstevel@tonic-gate if (au_close(ad, 1, aug_event) < 0) {
4537c478bd9Sstevel@tonic-gate (void) au_close(ad, 0, 0);
4547c478bd9Sstevel@tonic-gate return (-1);
4557c478bd9Sstevel@tonic-gate }
4567c478bd9Sstevel@tonic-gate
4577c478bd9Sstevel@tonic-gate return (0);
4587c478bd9Sstevel@tonic-gate }
4597c478bd9Sstevel@tonic-gate
4607c478bd9Sstevel@tonic-gate int
aug_na_selected()4617c478bd9Sstevel@tonic-gate aug_na_selected()
4627c478bd9Sstevel@tonic-gate {
4637c478bd9Sstevel@tonic-gate if (aug_na == -1) {
4647c478bd9Sstevel@tonic-gate return (-1);
4657c478bd9Sstevel@tonic-gate }
4667c478bd9Sstevel@tonic-gate
4677c478bd9Sstevel@tonic-gate return (selected(aug_event, &aug_namask, aug_sorf));
4687c478bd9Sstevel@tonic-gate }
4697c478bd9Sstevel@tonic-gate
4707c478bd9Sstevel@tonic-gate int
aug_selected()4717c478bd9Sstevel@tonic-gate aug_selected()
4727c478bd9Sstevel@tonic-gate {
4737c478bd9Sstevel@tonic-gate auditinfo_addr_t mask;
4747c478bd9Sstevel@tonic-gate
475f48205beScasper if (aug_uid > MAXEPHUID) {
4767c478bd9Sstevel@tonic-gate (void) aug_save_namask();
4777c478bd9Sstevel@tonic-gate return (aug_na_selected());
4787c478bd9Sstevel@tonic-gate }
4797c478bd9Sstevel@tonic-gate if (getaudit_addr(&mask, sizeof (mask))) {
4807c478bd9Sstevel@tonic-gate return (-1);
4817c478bd9Sstevel@tonic-gate }
4827c478bd9Sstevel@tonic-gate
4837c478bd9Sstevel@tonic-gate return (selected(aug_event, &mask.ai_mask, aug_sorf));
4847c478bd9Sstevel@tonic-gate }
4857c478bd9Sstevel@tonic-gate
4867c478bd9Sstevel@tonic-gate static int
selected(au_event_t e,au_mask_t * m,int sorf)4877c478bd9Sstevel@tonic-gate selected(au_event_t e, au_mask_t *m, int sorf)
4887c478bd9Sstevel@tonic-gate {
4897c478bd9Sstevel@tonic-gate int prs_sorf;
4907c478bd9Sstevel@tonic-gate
4917c478bd9Sstevel@tonic-gate if (sorf == 0) {
4927c478bd9Sstevel@tonic-gate prs_sorf = AU_PRS_SUCCESS;
4937c478bd9Sstevel@tonic-gate } else if (sorf == -1) {
4947c478bd9Sstevel@tonic-gate prs_sorf = AU_PRS_FAILURE;
4957c478bd9Sstevel@tonic-gate } else {
4967c478bd9Sstevel@tonic-gate prs_sorf = AU_PRS_BOTH;
4977c478bd9Sstevel@tonic-gate }
4987c478bd9Sstevel@tonic-gate
4997c478bd9Sstevel@tonic-gate return (au_preselect(e, m, prs_sorf, AU_PRS_REREAD));
5007c478bd9Sstevel@tonic-gate }
501