1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #include <netdb.h> 27 #include <netinet/in.h> 28 #include <pwd.h> 29 #include <sys/errno.h> 30 #include <sys/mutex.h> 31 #include <sys/param.h> 32 #include <sys/socket.h> 33 #include <sys/stat.h> 34 #include <sys/types.h> 35 #include <string.h> 36 #include <unistd.h> 37 #include <alloca.h> 38 #include <stdlib.h> 39 #include <tsol/label.h> 40 #include <bsm/audit.h> 41 #include <bsm/libbsm.h> 42 #include <bsm/audit_uevents.h> 43 #include <bsm/audit_record.h> 44 45 #define AUC_NEVER -2 /* audit module not loaded */ 46 47 /* Private Functions */ 48 static int selected(au_event_t, au_mask_t *, int); 49 50 int aug_selected(); 51 int aug_na_selected(); 52 53 /* Global Variables */ 54 static au_id_t aug_auid; /* auid of user writing audit record */ 55 static uid_t aug_uid; /* uid of user writing audit record */ 56 static uid_t aug_euid; /* euid of user writing audit record */ 57 static gid_t aug_gid; /* gid of user writing audit record */ 58 static gid_t aug_egid; /* euid of user writing audit record */ 59 static pid_t aug_pid; /* pid of user writing audit record */ 60 static au_tid_addr_t aug_tid; /* tid of user writing audit record */ 61 static int aug_na; /* 0 if event is attributable */ 62 static au_mask_t aug_namask; /* not attributable flags */ 63 static au_event_t aug_event; /* id of event being audited */ 64 static int aug_sorf; /* success or failure of aug_event */ 65 static char *aug_text; /* misc text to be written to trail */ 66 static char *aug_text1; /* misc text to be written to trail */ 67 static char *aug_text2; /* misc text to be written to trail */ 68 static au_asid_t aug_asid; /* asid of process writing record */ 69 static int (*aug_afunc)(); /* write additional tokens if needed */ 70 static char *aug_path; /* path token */ 71 static uint32_t aug_policy; /* kernel audit policy */ 72 73 /* 74 * cannot_audit: 75 * Return 1 if audit module not loaded. 76 * Return 0 otherwise. 77 * 78 * The argument, force, should be set to 1 for long-lived processes 79 * like some daemons. Force should be set to 0 for most programs. 80 */ 81 int 82 cannot_audit(force) 83 int force; 84 { 85 static int auc = AUC_UNSET; 86 int cond = 0; 87 88 if (auc == AUC_UNSET || force) { 89 if (auditon(A_GETCOND, (caddr_t)&cond, sizeof (cond))) { 90 auc = AUC_NEVER; 91 } else { 92 auc = cond; 93 } 94 } 95 return (auc == AUC_NEVER); 96 } 97 98 /* 99 * aug_init(): 100 * Initialize global variables. 101 */ 102 void 103 aug_init() 104 { 105 aug_auid = (uid_t)-1; 106 aug_uid = (uid_t)-1; 107 aug_euid = (uid_t)-1; 108 aug_gid = (gid_t)-1; 109 aug_egid = (gid_t)-1; 110 aug_pid = -1; 111 aug_tid.at_port = 0; 112 aug_tid.at_type = AU_IPv4; 113 aug_tid.at_addr[0] = 0; 114 aug_tid.at_addr[1] = 0; 115 aug_tid.at_addr[2] = 0; 116 aug_tid.at_addr[3] = 0; 117 aug_namask.am_success = AU_MASK_ALL; 118 aug_namask.am_failure = AU_MASK_ALL; 119 aug_event = 0; 120 aug_sorf = -2; 121 aug_text = NULL; 122 aug_text1 = NULL; 123 aug_text2 = NULL; 124 aug_na = 0; 125 aug_asid = (au_asid_t)(-1); 126 aug_afunc = NULL; 127 aug_path = NULL; 128 } 129 130 /* 131 * aug_get_port: 132 * Return the raw device number of the port to which the 133 * current process is attached (assumed to be attached 134 * through file descriptor 0) or 0 if can't stat the port. 135 */ 136 dev_t 137 aug_get_port() 138 { 139 int rc; 140 char *ttyn; 141 struct stat sb; 142 143 ttyn = ttyname(0); 144 if (ttyn == 0 || *ttyn == '\0') { 145 return (0); 146 } 147 148 rc = stat(ttyn, &sb); 149 if (rc < 0) { 150 perror("stat"); 151 return (0); 152 } 153 154 return ((dev_t)sb.st_rdev); 155 } 156 157 /* 158 * aug_get_machine: 159 * Return internet address of host hostname, 160 * or 0 if can't do lookup. 161 */ 162 163 int 164 aug_get_machine(const char *hostname, uint32_t *buf, uint32_t *type) 165 { 166 struct addrinfo *ai; 167 int err; 168 void *p; 169 170 err = getaddrinfo(hostname, NULL, NULL, &ai); 171 if (err != 0) 172 return (0); 173 174 switch (ai->ai_family) { 175 case AF_INET: 176 /* LINTED */ 177 p = &((struct sockaddr_in *)ai->ai_addr)->sin_addr, 178 (void) memcpy(buf, p, 179 sizeof (((struct sockaddr_in *)0)->sin_addr)); 180 *type = AU_IPv4; 181 break; 182 case AF_INET6: 183 /* LINTED */ 184 p = &((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr, 185 (void) memcpy(buf, p, 186 sizeof (((struct sockaddr_in6 *)0)->sin6_addr)); 187 *type = AU_IPv6; 188 break; 189 default: 190 return (0); 191 } 192 193 freeaddrinfo(ai); 194 195 return (1); 196 } 197 198 void 199 aug_save_auid(au_id_t id) 200 { 201 aug_auid = id; 202 } 203 204 void 205 aug_save_uid(uid_t id) 206 { 207 aug_uid = id; 208 } 209 210 void 211 aug_save_euid(uid_t id) 212 { 213 aug_euid = id; 214 } 215 216 void 217 aug_save_gid(gid_t id) 218 { 219 aug_gid = id; 220 } 221 222 void 223 aug_save_egid(gid_t id) 224 { 225 aug_egid = id; 226 } 227 228 void 229 aug_save_pid(pid_t id) 230 { 231 aug_pid = id; 232 } 233 234 void 235 aug_save_asid(au_asid_t id) 236 { 237 aug_asid = id; 238 } 239 240 void 241 aug_save_afunc(int (*afunc)()) 242 { 243 aug_afunc = afunc; 244 } 245 246 void 247 aug_save_tid(dev_t port, int machine) 248 { 249 aug_tid.at_port = port; 250 aug_tid.at_type = AU_IPv4; 251 aug_tid.at_addr[0] = machine; 252 } 253 254 void 255 aug_save_tid_ex(dev_t port, uint32_t *machine, uint32_t type) 256 { 257 int i; 258 259 aug_tid.at_port = port; 260 if ((type != AU_IPv4) && (type != AU_IPv6)) 261 type = AU_IPv4; 262 263 aug_tid.at_type = type; 264 for (i = 0; i < (type/4); i++) 265 aug_tid.at_addr[i] = machine[i]; 266 } 267 268 int 269 aug_save_me(void) 270 { 271 auditinfo_addr_t ai; 272 273 if (getaudit_addr(&ai, sizeof (ai))) 274 return (-1); 275 276 aug_save_auid(ai.ai_auid); 277 aug_save_euid(geteuid()); 278 aug_save_egid(getegid()); 279 aug_save_uid(getuid()); 280 aug_save_gid(getgid()); 281 aug_save_pid(getpid()); 282 aug_save_asid(ai.ai_asid); 283 aug_save_tid_ex(ai.ai_termid.at_port, 284 ai.ai_termid.at_addr, 285 ai.ai_termid.at_type); 286 return (0); 287 } 288 289 /* 290 * aug_save_namask(): 291 * Save the namask using the naflags entry in the audit_control file. 292 * Return 0 if successful. 293 * Return -1, and don't change the namask, if failed. 294 * Side Effect: Sets aug_na to -1 if error, 1 if successful. 295 */ 296 int 297 aug_save_namask() 298 { 299 au_mask_t mask; 300 301 aug_na = -1; 302 303 /* 304 * get non-attributable system event mask from kernel. 305 */ 306 if (auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask)) != 0) { 307 return (-1); 308 } 309 310 aug_namask.am_success = mask.am_success; 311 aug_namask.am_failure = mask.am_failure; 312 aug_na = 1; 313 return (0); 314 } 315 316 void 317 aug_save_event(au_event_t id) 318 { 319 aug_event = id; 320 } 321 322 void 323 aug_save_sorf(int sorf) 324 { 325 aug_sorf = sorf; 326 } 327 328 void 329 aug_save_text(char *s) 330 { 331 if (aug_text != NULL) 332 free(aug_text); 333 if (s == NULL) 334 aug_text = NULL; 335 else 336 aug_text = strdup(s); 337 } 338 339 void 340 aug_save_text1(char *s) 341 { 342 if (aug_text1 != NULL) 343 free(aug_text1); 344 if (s == NULL) 345 aug_text1 = NULL; 346 else 347 aug_text1 = strdup(s); 348 } 349 350 void 351 aug_save_text2(char *s) 352 { 353 if (aug_text2 != NULL) 354 free(aug_text2); 355 if (s == NULL) 356 aug_text2 = NULL; 357 else 358 aug_text2 = strdup(s); 359 } 360 361 void 362 aug_save_na(int flag) 363 { 364 aug_na = flag; 365 } 366 367 void 368 aug_save_path(char *s) 369 { 370 if (aug_path != NULL) 371 free(aug_path); 372 if (s == NULL) 373 aug_path = NULL; 374 aug_path = strdup(s); 375 } 376 377 int 378 aug_save_policy() 379 { 380 uint32_t policy; 381 382 if (auditon(A_GETPOLICY, (caddr_t)&policy, sizeof (policy))) { 383 return (-1); 384 } 385 aug_policy = policy; 386 return (0); 387 } 388 389 /* 390 * aug_audit: 391 * Cut and audit record if it is selected. 392 * Return 0, if successfully written. 393 * Return 0, if not written, and not expected to write. 394 * Return -1, if not written because of unexpected error. 395 */ 396 int 397 aug_audit(void) 398 { 399 int ad; 400 401 if (cannot_audit(0)) { 402 return (0); 403 } 404 405 if (aug_na) { 406 if (!aug_na_selected()) { 407 return (0); 408 } 409 } else if (!aug_selected()) { 410 return (0); 411 } 412 413 if ((ad = au_open()) == -1) { 414 return (-1); 415 } 416 417 (void) au_write(ad, au_to_subject_ex(aug_auid, aug_euid, aug_egid, 418 aug_uid, aug_gid, aug_pid, aug_asid, &aug_tid)); 419 if (is_system_labeled()) 420 (void) au_write(ad, au_to_mylabel()); 421 if (aug_policy & AUDIT_GROUP) { 422 int ng; 423 int maxgrp = getgroups(0, NULL); 424 gid_t *grplst = alloca(maxgrp * sizeof (gid_t)); 425 426 if ((ng = getgroups(maxgrp, grplst)) > 0) { 427 (void) au_write(ad, au_to_newgroups(ng, grplst)); 428 } 429 } 430 if (aug_text != NULL) { 431 (void) au_write(ad, au_to_text(aug_text)); 432 } 433 if (aug_text1 != NULL) { 434 (void) au_write(ad, au_to_text(aug_text1)); 435 } 436 if (aug_text2 != NULL) { 437 (void) au_write(ad, au_to_text(aug_text2)); 438 } 439 if (aug_path != NULL) { 440 (void) au_write(ad, au_to_path(aug_path)); 441 } 442 if (aug_afunc != NULL) { 443 (*aug_afunc)(ad); 444 } 445 #ifdef _LP64 446 (void) au_write(ad, au_to_return64((aug_sorf == 0) ? 0 : -1, 447 (int64_t)aug_sorf)); 448 #else 449 (void) au_write(ad, au_to_return32((aug_sorf == 0) ? 0 : -1, 450 (int32_t)aug_sorf)); 451 #endif 452 if (au_close(ad, 1, aug_event) < 0) { 453 (void) au_close(ad, 0, 0); 454 return (-1); 455 } 456 457 return (0); 458 } 459 460 int 461 aug_na_selected() 462 { 463 if (aug_na == -1) { 464 return (-1); 465 } 466 467 return (selected(aug_event, &aug_namask, aug_sorf)); 468 } 469 470 int 471 aug_selected() 472 { 473 auditinfo_addr_t mask; 474 475 if (aug_uid > MAXEPHUID) { 476 (void) aug_save_namask(); 477 return (aug_na_selected()); 478 } 479 if (getaudit_addr(&mask, sizeof (mask))) { 480 return (-1); 481 } 482 483 return (selected(aug_event, &mask.ai_mask, aug_sorf)); 484 } 485 486 static int 487 selected(au_event_t e, au_mask_t *m, int sorf) 488 { 489 int prs_sorf; 490 491 if (sorf == 0) { 492 prs_sorf = AU_PRS_SUCCESS; 493 } else if (sorf == -1) { 494 prs_sorf = AU_PRS_FAILURE; 495 } else { 496 prs_sorf = AU_PRS_BOTH; 497 } 498 499 return (au_preselect(e, m, prs_sorf, AU_PRS_REREAD)); 500 } 501