1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 /* 27 * This file contains the audit hook support code for auditing. 28 */ 29 30 #include <sys/types.h> 31 #include <sys/proc.h> 32 #include <sys/vnode.h> 33 #include <sys/vfs.h> 34 #include <sys/file.h> 35 #include <sys/user.h> 36 #include <sys/stropts.h> 37 #include <sys/systm.h> 38 #include <sys/pathname.h> 39 #include <sys/syscall.h> 40 #include <sys/fcntl.h> 41 #include <sys/ipc_impl.h> 42 #include <sys/msg_impl.h> 43 #include <sys/sem_impl.h> 44 #include <sys/shm_impl.h> 45 #include <sys/kmem.h> /* for KM_SLEEP */ 46 #include <sys/socket.h> 47 #include <sys/cmn_err.h> /* snprintf... */ 48 #include <sys/debug.h> 49 #include <sys/thread.h> 50 #include <netinet/in.h> 51 #include <c2/audit.h> /* needs to be included before user.h */ 52 #include <c2/audit_kernel.h> /* for M_DONTWAIT */ 53 #include <c2/audit_kevents.h> 54 #include <c2/audit_record.h> 55 #include <sys/strsubr.h> 56 #include <sys/tihdr.h> 57 #include <sys/tiuser.h> 58 #include <sys/timod.h> 59 #include <sys/model.h> /* for model_t */ 60 #include <sys/disp.h> /* for servicing_interrupt() */ 61 #include <sys/devpolicy.h> 62 #include <sys/crypto/ioctladmin.h> 63 #include <sys/cred_impl.h> 64 #include <inet/kssl/kssl.h> 65 #include <net/pfpolicy.h> 66 67 static void add_return_token(caddr_t *, unsigned int scid, int err, int rval); 68 69 static void audit_pathbuild(struct pathname *pnp); 70 71 /* 72 * ROUTINE: AUDIT_NEWPROC 73 * PURPOSE: initialize the child p_audit_data structure 74 * CALLBY: GETPROC 75 * NOTE: All threads for the parent process are locked at this point. 76 * We are essentially running singled threaded for this reason. 77 * GETPROC is called when system creates a new process. 78 * By the time AUDIT_NEWPROC is called, the child proc 79 * structure has already been initialized. What we need 80 * to do is to allocate the child p_audit_data and 81 * initialize it with the content of current parent process. 82 */ 83 84 void 85 audit_newproc(struct proc *cp) /* initialized child proc structure */ 86 { 87 p_audit_data_t *pad; /* child process audit data */ 88 p_audit_data_t *opad; /* parent process audit data */ 89 90 pad = kmem_cache_alloc(au_pad_cache, KM_SLEEP); 91 92 P2A(cp) = pad; 93 94 opad = P2A(curproc); 95 96 /* 97 * copy the audit data. Note that all threads of current 98 * process have been "held". Thus there is no race condition 99 * here with mutiple threads trying to alter the cwrd 100 * structure (such as releasing it). 101 * 102 * The audit context in the cred is "duplicated" for the new 103 * proc by elsewhere crhold'ing the parent's cred which it shares. 104 * 105 * We still want to hold things since auditon() [A_SETUMASK, 106 * A_SETSMASK] could be walking through the processes to 107 * update things. 108 */ 109 mutex_enter(&opad->pad_lock); /* lock opad structure during copy */ 110 pad->pad_data = opad->pad_data; /* copy parent's process audit data */ 111 au_pathhold(pad->pad_root); 112 au_pathhold(pad->pad_cwd); 113 mutex_exit(&opad->pad_lock); /* current proc will keep cwrd open */ 114 115 /* 116 * finish auditing of parent here so that it will be done 117 * before child has a chance to run. We include the child 118 * pid since the return value in the return token is a dummy 119 * one and contains no useful information (it is included to 120 * make the audit record structure consistant). 121 * 122 * tad_flag is set if auditing is on 123 */ 124 if (((t_audit_data_t *)T2A(curthread))->tad_flag) 125 au_uwrite(au_to_arg32(0, "child PID", (uint32_t)cp->p_pid)); 126 127 /* 128 * finish up audit record generation here because child process 129 * is set to run before parent process. We distinguish here 130 * between FORK, FORK1, or VFORK by the saved system call ID. 131 */ 132 audit_finish(0, ((t_audit_data_t *)T2A(curthread))->tad_scid, 0, 0); 133 } 134 135 /* 136 * ROUTINE: AUDIT_PFREE 137 * PURPOSE: deallocate the per-process udit data structure 138 * CALLBY: EXIT 139 * FORK_FAIL 140 * NOTE: all lwp except current one have stopped in SEXITLWPS 141 * why we are single threaded? 142 * . all lwp except current one have stopped in SEXITLWPS. 143 */ 144 void 145 audit_pfree(struct proc *p) /* proc structure to be freed */ 146 147 { /* AUDIT_PFREE */ 148 149 p_audit_data_t *pad; 150 151 pad = P2A(p); 152 153 /* better be a per process audit data structure */ 154 ASSERT(pad != (p_audit_data_t *)0); 155 156 if (pad == pad0) { 157 return; 158 } 159 160 /* deallocate all auditing resources for this process */ 161 au_pathrele(pad->pad_root); 162 au_pathrele(pad->pad_cwd); 163 164 /* 165 * Since the pad structure is completely overwritten after alloc, 166 * we don't bother to clear it. 167 */ 168 169 kmem_cache_free(au_pad_cache, pad); 170 } 171 172 /* 173 * ROUTINE: AUDIT_THREAD_CREATE 174 * PURPOSE: allocate per-process thread audit data structure 175 * CALLBY: THREAD_CREATE 176 * NOTE: This is called just after *t was bzero'd. 177 * We are single threaded in this routine. 178 * TODO: 179 * QUESTION: 180 */ 181 182 void 183 audit_thread_create(kthread_id_t t) 184 { 185 t_audit_data_t *tad; /* per-thread audit data */ 186 187 tad = kmem_zalloc(sizeof (struct t_audit_data), KM_SLEEP); 188 189 T2A(t) = tad; /* set up thread audit data ptr */ 190 tad->tad_thread = t; /* back ptr to thread: DEBUG */ 191 } 192 193 /* 194 * ROUTINE: AUDIT_THREAD_FREE 195 * PURPOSE: free the per-thread audit data structure 196 * CALLBY: THREAD_FREE 197 * NOTE: most thread data is clear after return 198 */ 199 void 200 audit_thread_free(kthread_t *t) 201 { 202 t_audit_data_t *tad; 203 au_defer_info_t *attr; 204 205 tad = T2A(t); 206 207 /* thread audit data must still be set */ 208 209 if (tad == tad0) { 210 return; 211 } 212 213 if (tad == NULL) { 214 return; 215 } 216 217 t->t_audit_data = 0; 218 219 /* must not have any audit record residual */ 220 ASSERT(tad->tad_ad == NULL); 221 222 /* saved path must be empty */ 223 ASSERT(tad->tad_aupath == NULL); 224 225 if (tad->tad_atpath) 226 au_pathrele(tad->tad_atpath); 227 228 attr = tad->tad_defer_head; 229 while (attr != NULL) { 230 au_defer_info_t *tmp_attr = attr; 231 232 au_free_rec(attr->audi_ad); 233 234 attr = attr->audi_next; 235 kmem_free(tmp_attr, sizeof (au_defer_info_t)); 236 } 237 238 kmem_free(tad, sizeof (*tad)); 239 } 240 241 /* 242 * ROUTINE: AUDIT_SAVEPATH 243 * PURPOSE: 244 * CALLBY: LOOKUPPN 245 * 246 * NOTE: We have reached the end of a path in fs/lookup.c. 247 * We get two pieces of information here: 248 * the vnode of the last component (vp) and 249 * the status of the last access (flag). 250 * TODO: 251 * QUESTION: 252 */ 253 254 /*ARGSUSED*/ 255 int 256 audit_savepath( 257 struct pathname *pnp, /* pathname to lookup */ 258 struct vnode *vp, /* vnode of the last component */ 259 int flag, /* status of the last access */ 260 cred_t *cr) /* cred of requestor */ 261 { 262 263 t_audit_data_t *tad; /* current thread */ 264 au_kcontext_t *kctx = GET_KCTX_PZ; 265 266 tad = U2A(u); 267 268 /* 269 * this event being audited or do we need path information 270 * later? This might be for a chdir/chroot or open (add path 271 * to file pointer. If the path has already been found for an 272 * open/creat then we don't need to process the path. 273 * 274 * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with 275 * chroot, chdir, open, creat system call processing. It determines 276 * if audit_savepath() will discard the path or we need it later. 277 * PAD_PATHFND means path already included in this audit record. It 278 * is used in cases where multiple path lookups are done per 279 * system call. The policy flag, AUDIT_PATH, controls if multiple 280 * paths are allowed. 281 * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with 282 * exit processing to inhibit any paths that may be added due to 283 * closes. 284 */ 285 if ((tad->tad_flag == 0 && !(tad->tad_ctrl & PAD_SAVPATH)) || 286 ((tad->tad_ctrl & PAD_PATHFND) && 287 !(kctx->auk_policy & AUDIT_PATH)) || 288 (tad->tad_ctrl & PAD_NOPATH)) { 289 return (0); 290 } 291 292 tad->tad_ctrl |= PAD_NOPATH; /* prevent possible reentry */ 293 294 audit_pathbuild(pnp); 295 tad->tad_vn = vp; 296 297 /* 298 * are we auditing only if error, or if it is not open or create 299 * otherwise audit_setf will do it 300 */ 301 302 if (tad->tad_flag) { 303 if (flag && (tad->tad_scid == SYS_open || 304 tad->tad_scid == SYS_open64 || 305 tad->tad_scid == SYS_creat || 306 tad->tad_scid == SYS_creat64 || 307 tad->tad_scid == SYS_fsat)) { 308 tad->tad_ctrl |= PAD_TRUE_CREATE; 309 } 310 311 /* add token to audit record for this name */ 312 au_uwrite(au_to_path(tad->tad_aupath)); 313 314 /* add the attributes of the object */ 315 if (vp) { 316 /* 317 * only capture attributes when there is no error 318 * lookup will not return the vnode of the failing 319 * component. 320 * 321 * if there was a lookup error, then don't add 322 * attribute. if lookup in vn_create(), 323 * then don't add attribute, 324 * it will be added at end of vn_create(). 325 */ 326 if (!flag && !(tad->tad_ctrl & PAD_NOATTRB)) 327 audit_attributes(vp); 328 } 329 } 330 331 /* free up space if we're not going to save path (open, crate) */ 332 if ((tad->tad_ctrl & PAD_SAVPATH) == 0) { 333 if (tad->tad_aupath != NULL) { 334 au_pathrele(tad->tad_aupath); 335 tad->tad_aupath = NULL; 336 tad->tad_vn = NULL; 337 } 338 } 339 if (tad->tad_ctrl & PAD_MLD) 340 tad->tad_ctrl |= PAD_PATHFND; 341 342 tad->tad_ctrl &= ~PAD_NOPATH; /* restore */ 343 return (0); 344 } 345 346 static void 347 audit_pathbuild(struct pathname *pnp) 348 { 349 char *pp; /* pointer to path */ 350 int len; /* length of incoming segment */ 351 int newsect; /* path requires a new section */ 352 struct audit_path *pfxapp; /* prefix for path */ 353 struct audit_path *newapp; /* new audit_path */ 354 t_audit_data_t *tad; /* current thread */ 355 p_audit_data_t *pad; /* current process */ 356 357 tad = U2A(u); 358 ASSERT(tad != NULL); 359 pad = P2A(curproc); 360 ASSERT(pad != NULL); 361 362 len = (pnp->pn_path - pnp->pn_buf) + 1; /* +1 for terminator */ 363 ASSERT(len > 0); 364 365 /* adjust for path prefix: tad_aupath, ATPATH, CRD, or CWD */ 366 mutex_enter(&pad->pad_lock); 367 if (tad->tad_aupath != NULL) { 368 pfxapp = tad->tad_aupath; 369 } else if (tad->tad_scid == SYS_fsat && pnp->pn_buf[0] != '/') { 370 ASSERT(tad->tad_atpath != NULL); 371 pfxapp = tad->tad_atpath; 372 } else if (tad->tad_ctrl & PAD_ABSPATH) { 373 pfxapp = pad->pad_root; 374 } else { 375 pfxapp = pad->pad_cwd; 376 } 377 au_pathhold(pfxapp); 378 mutex_exit(&pad->pad_lock); 379 380 /* get an expanded buffer to hold the anchored path */ 381 newsect = tad->tad_ctrl & PAD_ATPATH; 382 newapp = au_pathdup(pfxapp, newsect, len); 383 au_pathrele(pfxapp); 384 385 pp = newapp->audp_sect[newapp->audp_cnt] - len; 386 if (!newsect) { 387 /* overlay previous NUL terminator */ 388 *(pp - 1) = '/'; 389 } 390 391 /* now add string of processed path */ 392 bcopy(pnp->pn_buf, pp, len); 393 pp[len - 1] = '\0'; 394 395 /* perform path simplification as necessary */ 396 audit_fixpath(newapp, len); 397 398 if (tad->tad_aupath) 399 au_pathrele(tad->tad_aupath); 400 tad->tad_aupath = newapp; 401 402 /* for case where multiple lookups in one syscall (rename) */ 403 tad->tad_ctrl &= ~(PAD_ABSPATH | PAD_ATPATH); 404 } 405 406 407 408 /*ARGSUSED*/ 409 410 /* 411 * ROUTINE: AUDIT_ADDCOMPONENT 412 * PURPOSE: extend the path by the component accepted 413 * CALLBY: LOOKUPPN 414 * NOTE: This function is called only when there is an error in 415 * parsing a path component 416 * TODO: Add the error component to audit record 417 * QUESTION: what is this for 418 */ 419 420 void 421 audit_addcomponent(struct pathname *pnp) 422 { 423 au_kcontext_t *kctx = GET_KCTX_PZ; 424 t_audit_data_t *tad; 425 426 tad = U2A(u); 427 /* 428 * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with 429 * chroot, chdir, open, creat system call processing. It determines 430 * if audit_savepath() will discard the path or we need it later. 431 * PAD_PATHFND means path already included in this audit record. It 432 * is used in cases where multiple path lookups are done per 433 * system call. The policy flag, AUDIT_PATH, controls if multiple 434 * paths are allowed. 435 * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with 436 * exit processing to inhibit any paths that may be added due to 437 * closes. 438 */ 439 if ((tad->tad_flag == 0 && !(tad->tad_ctrl & PAD_SAVPATH)) || 440 ((tad->tad_ctrl & PAD_PATHFND) && 441 !(kctx->auk_policy & AUDIT_PATH)) || 442 (tad->tad_ctrl & PAD_NOPATH)) { 443 return; 444 } 445 446 return; 447 448 } /* AUDIT_ADDCOMPONENT */ 449 450 451 452 453 454 455 456 457 /* 458 * ROUTINE: AUDIT_ANCHORPATH 459 * PURPOSE: 460 * CALLBY: LOOKUPPN 461 * NOTE: 462 * anchor path at "/". We have seen a symbolic link or entering for the 463 * first time we will throw away any saved path if path is anchored. 464 * 465 * flag = 0, path is relative. 466 * flag = 1, path is absolute. Free any saved path and set flag to PAD_ABSPATH. 467 * 468 * If the (new) path is absolute, then we have to throw away whatever we have 469 * already accumulated since it is being superseded by new path which is 470 * anchored at the root. 471 * Note that if the path is relative, this function does nothing 472 * TODO: 473 * QUESTION: 474 */ 475 /*ARGSUSED*/ 476 void 477 audit_anchorpath(struct pathname *pnp, int flag) 478 { 479 au_kcontext_t *kctx = GET_KCTX_PZ; 480 t_audit_data_t *tad; 481 482 tad = U2A(u); 483 484 /* 485 * this event being audited or do we need path information 486 * later? This might be for a chdir/chroot or open (add path 487 * to file pointer. If the path has already been found for an 488 * open/creat then we don't need to process the path. 489 * 490 * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with 491 * chroot, chdir, open, creat system call processing. It determines 492 * if audit_savepath() will discard the path or we need it later. 493 * PAD_PATHFND means path already included in this audit record. It 494 * is used in cases where multiple path lookups are done per 495 * system call. The policy flag, AUDIT_PATH, controls if multiple 496 * paths are allowed. 497 * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with 498 * exit processing to inhibit any paths that may be added due to 499 * closes. 500 */ 501 if ((tad->tad_flag == 0 && !(tad->tad_ctrl & PAD_SAVPATH)) || 502 ((tad->tad_ctrl & PAD_PATHFND) && 503 !(kctx->auk_policy & AUDIT_PATH)) || 504 (tad->tad_ctrl & PAD_NOPATH)) { 505 return; 506 } 507 508 if (flag) { 509 tad->tad_ctrl |= PAD_ABSPATH; 510 if (tad->tad_aupath != NULL) { 511 au_pathrele(tad->tad_aupath); 512 tad->tad_aupath = NULL; 513 tad->tad_vn = NULL; 514 } 515 } 516 } 517 518 519 /* 520 * symbolic link. Save previous components. 521 * 522 * the path seen so far looks like this 523 * 524 * +-----------------------+----------------+ 525 * | path processed so far | remaining path | 526 * +-----------------------+----------------+ 527 * \-----------------------/ 528 * save this string if 529 * symbolic link relative 530 * (but don't include symlink component) 531 */ 532 533 /*ARGSUSED*/ 534 535 536 /* 537 * ROUTINE: AUDIT_SYMLINK 538 * PURPOSE: 539 * CALLBY: LOOKUPPN 540 * NOTE: 541 * TODO: 542 * QUESTION: 543 */ 544 void 545 audit_symlink(struct pathname *pnp, struct pathname *sympath) 546 { 547 char *sp; /* saved initial pp */ 548 char *cp; /* start of symlink path */ 549 uint_t len_path; /* processed path before symlink */ 550 t_audit_data_t *tad; 551 au_kcontext_t *kctx = GET_KCTX_PZ; 552 553 tad = U2A(u); 554 555 /* 556 * this event being audited or do we need path information 557 * later? This might be for a chdir/chroot or open (add path 558 * to file pointer. If the path has already been found for an 559 * open/creat then we don't need to process the path. 560 * 561 * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with 562 * chroot, chdir, open, creat system call processing. It determines 563 * if audit_savepath() will discard the path or we need it later. 564 * PAD_PATHFND means path already included in this audit record. It 565 * is used in cases where multiple path lookups are done per 566 * system call. The policy flag, AUDIT_PATH, controls if multiple 567 * paths are allowed. 568 * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with 569 * exit processing to inhibit any paths that may be added due to 570 * closes. 571 */ 572 if ((tad->tad_flag == 0 && 573 !(tad->tad_ctrl & PAD_SAVPATH)) || 574 ((tad->tad_ctrl & PAD_PATHFND) && 575 !(kctx->auk_policy & AUDIT_PATH)) || 576 (tad->tad_ctrl & PAD_NOPATH)) { 577 return; 578 } 579 580 /* 581 * if symbolic link is anchored at / then do nothing. 582 * When we cycle back to begin: in lookuppn() we will 583 * call audit_anchorpath() with a flag indicating if the 584 * path is anchored at / or is relative. We will release 585 * any saved path at that point. 586 * 587 * Note In the event that an error occurs in pn_combine then 588 * we want to remain pointing at the component that caused the 589 * path to overflow the pnp structure. 590 */ 591 if (sympath->pn_buf[0] == '/') 592 return; 593 594 /* backup over last component */ 595 sp = cp = pnp->pn_path; 596 while (*--cp != '/' && cp > pnp->pn_buf) 597 ; 598 599 len_path = cp - pnp->pn_buf; 600 601 /* is there anything to save? */ 602 if (len_path) { 603 pnp->pn_path = pnp->pn_buf; 604 audit_pathbuild(pnp); 605 pnp->pn_path = sp; 606 } 607 } 608 609 /* 610 * file_is_public : determine whether events for the file (corresponding to 611 * the specified file attr) should be audited or ignored. 612 * 613 * returns: 1 - if audit policy and file attributes indicate that 614 * file is effectively public. read events for 615 * the file should not be audited. 616 * 0 - otherwise 617 * 618 * The required attributes to be considered a public object are: 619 * - owned by root, AND 620 * - world-readable (permissions for other include read), AND 621 * - NOT world-writeable (permissions for other don't 622 * include write) 623 * (mode doesn't need to be checked for symlinks) 624 */ 625 int 626 file_is_public(struct vattr *attr) 627 { 628 au_kcontext_t *kctx = GET_KCTX_PZ; 629 630 if (!(kctx->auk_policy & AUDIT_PUBLIC) && (attr->va_uid == 0) && 631 ((attr->va_type == VLNK) || 632 ((attr->va_mode & (VREAD>>6)) != 0) && 633 ((attr->va_mode & (VWRITE>>6)) == 0))) { 634 return (1); 635 } 636 return (0); 637 } 638 639 640 /* 641 * ROUTINE: AUDIT_ATTRIBUTES 642 * PURPOSE: Audit the attributes so we can tell why the error occurred 643 * CALLBY: AUDIT_SAVEPATH 644 * AUDIT_VNCREATE_FINISH 645 * AUS_FCHOWN...audit_event.c...audit_path.c 646 * NOTE: 647 * TODO: 648 * QUESTION: 649 */ 650 void 651 audit_attributes(struct vnode *vp) 652 { 653 struct vattr attr; 654 struct t_audit_data *tad; 655 656 tad = U2A(u); 657 658 if (vp) { 659 attr.va_mask = AT_ALL; 660 if (VOP_GETATTR(vp, &attr, 0, CRED(), NULL) != 0) 661 return; 662 663 if (file_is_public(&attr) && (tad->tad_ctrl & PAD_PUBLIC_EV)) { 664 /* 665 * This is a public object and a "public" event 666 * (i.e., read only) -- either by definition 667 * (e.g., stat, access...) or by virtue of write access 668 * not being requested (e.g. mmap). 669 * Flag it in the tad to prevent this audit at the end. 670 */ 671 tad->tad_ctrl |= PAD_NOAUDIT; 672 } else { 673 au_uwrite(au_to_attr(&attr)); 674 audit_sec_attributes(&(u_ad), vp); 675 } 676 } 677 } 678 679 680 /* 681 * ROUTINE: AUDIT_FALLOC 682 * PURPOSE: allocating a new file structure 683 * CALLBY: FALLOC 684 * NOTE: file structure already initialized 685 * TODO: 686 * QUESTION: 687 */ 688 689 void 690 audit_falloc(struct file *fp) 691 { /* AUDIT_FALLOC */ 692 693 f_audit_data_t *fad; 694 695 /* allocate per file audit structure if there a'int any */ 696 ASSERT(F2A(fp) == NULL); 697 698 fad = kmem_zalloc(sizeof (struct f_audit_data), KM_SLEEP); 699 700 F2A(fp) = fad; 701 702 fad->fad_thread = curthread; /* file audit data back ptr; DEBUG */ 703 } 704 705 /* 706 * ROUTINE: AUDIT_UNFALLOC 707 * PURPOSE: deallocate file audit data structure 708 * CALLBY: CLOSEF 709 * UNFALLOC 710 * NOTE: 711 * TODO: 712 * QUESTION: 713 */ 714 715 void 716 audit_unfalloc(struct file *fp) 717 { 718 f_audit_data_t *fad; 719 720 fad = F2A(fp); 721 722 if (!fad) { 723 return; 724 } 725 if (fad->fad_aupath != NULL) { 726 au_pathrele(fad->fad_aupath); 727 } 728 fp->f_audit_data = 0; 729 kmem_free(fad, sizeof (struct f_audit_data)); 730 } 731 732 /* 733 * ROUTINE: AUDIT_EXIT 734 * PURPOSE: 735 * CALLBY: EXIT 736 * NOTE: 737 * TODO: 738 * QUESTION: why cmw code as offset by 2 but not here 739 */ 740 /* ARGSUSED */ 741 void 742 audit_exit(int code, int what) 743 { 744 struct t_audit_data *tad; 745 tad = U2A(u); 746 747 /* 748 * tad_scid will be set by audit_start even if we are not auditing 749 * the event. 750 */ 751 if (tad->tad_scid == SYS_exit) { 752 /* 753 * if we are auditing the exit system call, then complete 754 * audit record generation (no return from system call). 755 */ 756 if (tad->tad_flag && tad->tad_event == AUE_EXIT) 757 audit_finish(0, SYS_exit, 0, 0); 758 return; 759 } 760 761 /* 762 * Anyone auditing the system call that was aborted? 763 */ 764 if (tad->tad_flag) { 765 au_uwrite(au_to_text("event aborted")); 766 audit_finish(0, tad->tad_scid, 0, 0); 767 } 768 769 /* 770 * Generate an audit record for process exit if preselected. 771 */ 772 (void) audit_start(0, SYS_exit, 0, 0); 773 audit_finish(0, SYS_exit, 0, 0); 774 } 775 776 /* 777 * ROUTINE: AUDIT_CORE_START 778 * PURPOSE: 779 * CALLBY: PSIG 780 * NOTE: 781 * TODO: 782 */ 783 void 784 audit_core_start(int sig) 785 { 786 au_event_t event; 787 au_state_t estate; 788 t_audit_data_t *tad; 789 au_kcontext_t *kctx; 790 791 tad = U2A(u); 792 793 ASSERT(tad != (t_audit_data_t *)0); 794 795 ASSERT(tad->tad_scid == 0); 796 ASSERT(tad->tad_event == 0); 797 ASSERT(tad->tad_evmod == 0); 798 ASSERT(tad->tad_ctrl == 0); 799 ASSERT(tad->tad_flag == 0); 800 ASSERT(tad->tad_aupath == NULL); 801 802 kctx = GET_KCTX_PZ; 803 804 /* get basic event for system call */ 805 event = AUE_CORE; 806 estate = kctx->auk_ets[event]; 807 808 if ((tad->tad_flag = auditme(kctx, tad, estate)) == 0) 809 return; 810 811 /* reset the flags for non-user attributable events */ 812 tad->tad_ctrl = PAD_CORE; 813 tad->tad_scid = 0; 814 815 /* if auditing not enabled, then don't generate an audit record */ 816 817 if (!((kctx->auk_auditstate == AUC_AUDITING || 818 kctx->auk_auditstate == AUC_INIT_AUDIT) || 819 kctx->auk_auditstate == AUC_NOSPACE)) { 820 tad->tad_flag = 0; 821 tad->tad_ctrl = 0; 822 return; 823 } 824 825 tad->tad_event = event; 826 tad->tad_evmod = 0; 827 828 ASSERT(tad->tad_ad == NULL); 829 830 au_write(&(u_ad), au_to_arg32(1, "signal", (uint32_t)sig)); 831 } 832 833 /* 834 * ROUTINE: AUDIT_CORE_FINISH 835 * PURPOSE: 836 * CALLBY: PSIG 837 * NOTE: 838 * TODO: 839 * QUESTION: 840 */ 841 842 /*ARGSUSED*/ 843 void 844 audit_core_finish(int code) 845 { 846 int flag; 847 t_audit_data_t *tad; 848 au_kcontext_t *kctx; 849 850 tad = U2A(u); 851 852 ASSERT(tad != (t_audit_data_t *)0); 853 854 if ((flag = tad->tad_flag) == 0) { 855 tad->tad_event = 0; 856 tad->tad_evmod = 0; 857 tad->tad_ctrl = 0; 858 ASSERT(tad->tad_aupath == NULL); 859 return; 860 } 861 tad->tad_flag = 0; 862 863 kctx = GET_KCTX_PZ; 864 865 /* kludge for error 0, should use `code==CLD_DUMPED' instead */ 866 if (flag = audit_success(kctx, tad, 0, NULL)) { 867 cred_t *cr = CRED(); 868 const auditinfo_addr_t *ainfo = crgetauinfo(cr); 869 870 ASSERT(ainfo != NULL); 871 872 /* 873 * Add subject information (no locks since our private copy of 874 * credential 875 */ 876 AUDIT_SETSUBJ(&(u_ad), cr, ainfo, kctx); 877 878 /* Add a return token (should use f argument) */ 879 add_return_token((caddr_t *)&(u_ad), tad->tad_scid, 0, 0); 880 881 AS_INC(as_generated, 1, kctx); 882 AS_INC(as_kernel, 1, kctx); 883 } 884 885 /* Close up everything */ 886 au_close(kctx, &(u_ad), flag, tad->tad_event, tad->tad_evmod); 887 888 /* free up any space remaining with the path's */ 889 if (tad->tad_aupath != NULL) { 890 au_pathrele(tad->tad_aupath); 891 tad->tad_aupath = NULL; 892 tad->tad_vn = NULL; 893 } 894 tad->tad_event = 0; 895 tad->tad_evmod = 0; 896 tad->tad_ctrl = 0; 897 } 898 899 /*ARGSUSED*/ 900 void 901 audit_stropen(struct vnode *vp, dev_t *devp, int flag, cred_t *crp) 902 { 903 } 904 905 /*ARGSUSED*/ 906 void 907 audit_strclose(struct vnode *vp, int flag, cred_t *crp) 908 { 909 } 910 911 /*ARGSUSED*/ 912 void 913 audit_strioctl(struct vnode *vp, int cmd, intptr_t arg, int flag, 914 int copyflag, cred_t *crp, int *rvalp) 915 { 916 } 917 918 919 /*ARGSUSED*/ 920 void 921 audit_strgetmsg(struct vnode *vp, struct strbuf *mctl, struct strbuf *mdata, 922 unsigned char *pri, int *flag, int fmode) 923 { 924 struct stdata *stp; 925 t_audit_data_t *tad = U2A(u); 926 927 ASSERT(tad != (t_audit_data_t *)0); 928 929 stp = vp->v_stream; 930 931 /* lock stdata from audit_sock */ 932 mutex_enter(&stp->sd_lock); 933 934 /* proceed ONLY if user is being audited */ 935 if (!tad->tad_flag) { 936 /* 937 * this is so we will not add audit data onto 938 * a thread that is not being audited. 939 */ 940 stp->sd_t_audit_data = NULL; 941 mutex_exit(&stp->sd_lock); 942 return; 943 } 944 945 stp->sd_t_audit_data = (caddr_t)curthread; 946 mutex_exit(&stp->sd_lock); 947 } 948 949 /*ARGSUSED*/ 950 void 951 audit_strputmsg(struct vnode *vp, struct strbuf *mctl, struct strbuf *mdata, 952 unsigned char pri, int flag, int fmode) 953 { 954 struct stdata *stp; 955 t_audit_data_t *tad = U2A(u); 956 957 ASSERT(tad != (t_audit_data_t *)0); 958 959 stp = vp->v_stream; 960 961 /* lock stdata from audit_sock */ 962 mutex_enter(&stp->sd_lock); 963 964 /* proceed ONLY if user is being audited */ 965 if (!tad->tad_flag) { 966 /* 967 * this is so we will not add audit data onto 968 * a thread that is not being audited. 969 */ 970 stp->sd_t_audit_data = NULL; 971 mutex_exit(&stp->sd_lock); 972 return; 973 } 974 975 stp->sd_t_audit_data = (caddr_t)curthread; 976 mutex_exit(&stp->sd_lock); 977 } 978 979 /* 980 * ROUTINE: AUDIT_CLOSEF 981 * PURPOSE: 982 * CALLBY: CLOSEF 983 * NOTE: 984 * release per file audit resources when file structure is being released. 985 * 986 * IMPORTANT NOTE: Since we generate an audit record here, we may sleep 987 * on the audit queue if it becomes full. This means 988 * audit_closef can not be called when f_count == 0. Since 989 * f_count == 0 indicates the file structure is free, another 990 * process could attempt to use the file while we were still 991 * asleep waiting on the audit queue. This would cause the 992 * per file audit data to be corrupted when we finally do 993 * wakeup. 994 * TODO: 995 * QUESTION: 996 */ 997 998 void 999 audit_closef(struct file *fp) 1000 { /* AUDIT_CLOSEF */ 1001 f_audit_data_t *fad; 1002 t_audit_data_t *tad; 1003 int success; 1004 au_state_t estate; 1005 struct vnode *vp; 1006 token_t *ad = NULL; 1007 struct vattr attr; 1008 short evmod = 0; 1009 const auditinfo_addr_t *ainfo; 1010 int getattr_ret; 1011 cred_t *cr; 1012 au_kcontext_t *kctx = GET_KCTX_PZ; 1013 1014 fad = F2A(fp); 1015 estate = kctx->auk_ets[AUE_CLOSE]; 1016 tad = U2A(u); 1017 cr = CRED(); 1018 1019 /* audit record already generated by system call envelope */ 1020 if (tad->tad_event == AUE_CLOSE) { 1021 /* so close audit event will have bits set */ 1022 tad->tad_evmod |= (short)fad->fad_flags; 1023 return; 1024 } 1025 1026 /* if auditing not enabled, then don't generate an audit record */ 1027 if (!((kctx->auk_auditstate == AUC_AUDITING || 1028 kctx->auk_auditstate == AUC_INIT_AUDIT) || 1029 kctx->auk_auditstate == AUC_NOSPACE)) 1030 return; 1031 1032 ainfo = crgetauinfo(cr); 1033 if (ainfo == NULL) 1034 return; 1035 1036 success = ainfo->ai_mask.as_success & estate; 1037 1038 /* not selected for this event */ 1039 if (success == 0) 1040 return; 1041 1042 /* 1043 * can't use audit_attributes here since we use a private audit area 1044 * to build the audit record instead of the one off the thread. 1045 */ 1046 if ((vp = fp->f_vnode) != NULL) { 1047 attr.va_mask = AT_ALL; 1048 getattr_ret = VOP_GETATTR(vp, &attr, 0, CRED(), NULL); 1049 } 1050 1051 /* 1052 * When write was not used and the file can be considered public, 1053 * then skip the audit. 1054 */ 1055 if ((getattr_ret == 0) && ((fp->f_flag & FWRITE) == 0)) { 1056 if (file_is_public(&attr)) { 1057 return; 1058 } 1059 } 1060 1061 evmod = (short)fad->fad_flags; 1062 if (fad->fad_aupath != NULL) { 1063 au_write((caddr_t *)&(ad), au_to_path(fad->fad_aupath)); 1064 } else { 1065 #ifdef _LP64 1066 au_write((caddr_t *)&(ad), au_to_arg64( 1067 1, "no path: fp", (uint64_t)fp)); 1068 #else 1069 au_write((caddr_t *)&(ad), au_to_arg32( 1070 1, "no path: fp", (uint32_t)fp)); 1071 #endif 1072 } 1073 1074 if (getattr_ret == 0) { 1075 au_write((caddr_t *)&(ad), au_to_attr(&attr)); 1076 audit_sec_attributes((caddr_t *)&(ad), vp); 1077 } 1078 1079 /* Add subject information */ 1080 AUDIT_SETSUBJ((caddr_t *)&(ad), cr, ainfo, kctx); 1081 1082 /* add a return token */ 1083 add_return_token((caddr_t *)&(ad), tad->tad_scid, 0, 0); 1084 1085 AS_INC(as_generated, 1, kctx); 1086 AS_INC(as_kernel, 1, kctx); 1087 1088 /* 1089 * Close up everything 1090 * Note: path space recovery handled by normal system 1091 * call envelope if not at last close. 1092 * Note there is no failure at this point since 1093 * this represents closes due to exit of process, 1094 * thus we always indicate successful closes. 1095 */ 1096 au_close(kctx, (caddr_t *)&(ad), AU_OK | AU_DEFER, 1097 AUE_CLOSE, evmod); 1098 } 1099 1100 /* 1101 * ROUTINE: AUDIT_SET 1102 * PURPOSE: Audit the file path and file attributes. 1103 * CALLBY: SETF 1104 * NOTE: SETF associate a file pointer with user area's open files. 1105 * TODO: 1106 * call audit_finish directly ??? 1107 * QUESTION: 1108 */ 1109 1110 /*ARGSUSED*/ 1111 void 1112 audit_setf(file_t *fp, int fd) 1113 { 1114 f_audit_data_t *fad; 1115 t_audit_data_t *tad; 1116 1117 if (fp == NULL) 1118 return; 1119 1120 tad = T2A(curthread); 1121 fad = F2A(fp); 1122 1123 if (!(tad->tad_scid == SYS_open || tad->tad_scid == SYS_creat || 1124 tad->tad_scid == SYS_open64 || tad->tad_scid == SYS_creat64 || 1125 tad->tad_scid == SYS_fsat)) 1126 return; 1127 1128 /* no path */ 1129 if (tad->tad_aupath == 0) 1130 return; 1131 1132 /* 1133 * assign path information associated with file audit data 1134 * use tad hold 1135 */ 1136 fad->fad_aupath = tad->tad_aupath; 1137 tad->tad_aupath = NULL; 1138 tad->tad_vn = NULL; 1139 1140 if (!(tad->tad_ctrl & PAD_TRUE_CREATE)) { 1141 /* adjust event type */ 1142 switch (tad->tad_event) { 1143 case AUE_OPEN_RC: 1144 tad->tad_event = AUE_OPEN_R; 1145 tad->tad_ctrl |= PAD_PUBLIC_EV; 1146 break; 1147 case AUE_OPEN_RTC: 1148 tad->tad_event = AUE_OPEN_RT; 1149 break; 1150 case AUE_OPEN_WC: 1151 tad->tad_event = AUE_OPEN_W; 1152 break; 1153 case AUE_OPEN_WTC: 1154 tad->tad_event = AUE_OPEN_WT; 1155 break; 1156 case AUE_OPEN_RWC: 1157 tad->tad_event = AUE_OPEN_RW; 1158 break; 1159 case AUE_OPEN_RWTC: 1160 tad->tad_event = AUE_OPEN_RWT; 1161 break; 1162 default: 1163 break; 1164 } 1165 } 1166 } 1167 1168 1169 /* 1170 * ROUTINE: AUDIT_COPEN 1171 * PURPOSE: 1172 * CALLBY: COPEN 1173 * NOTE: 1174 * TODO: 1175 * QUESTION: 1176 */ 1177 /*ARGSUSED*/ 1178 void 1179 audit_copen(int fd, file_t *fp, vnode_t *vp) 1180 { 1181 } 1182 1183 void 1184 audit_ipc(int type, int id, void *vp) 1185 { 1186 /* if not auditing this event, then do nothing */ 1187 if (ad_flag == 0) 1188 return; 1189 1190 switch (type) { 1191 case AT_IPC_MSG: 1192 au_uwrite(au_to_ipc(AT_IPC_MSG, id)); 1193 au_uwrite(au_to_ipc_perm(&(((kmsqid_t *)vp)->msg_perm))); 1194 break; 1195 case AT_IPC_SEM: 1196 au_uwrite(au_to_ipc(AT_IPC_SEM, id)); 1197 au_uwrite(au_to_ipc_perm(&(((ksemid_t *)vp)->sem_perm))); 1198 break; 1199 case AT_IPC_SHM: 1200 au_uwrite(au_to_ipc(AT_IPC_SHM, id)); 1201 au_uwrite(au_to_ipc_perm(&(((kshmid_t *)vp)->shm_perm))); 1202 break; 1203 } 1204 } 1205 1206 void 1207 audit_ipcget(int type, void *vp) 1208 { 1209 /* if not auditing this event, then do nothing */ 1210 if (ad_flag == 0) 1211 return; 1212 1213 switch (type) { 1214 case NULL: 1215 au_uwrite(au_to_ipc_perm((struct kipc_perm *)vp)); 1216 break; 1217 case AT_IPC_MSG: 1218 au_uwrite(au_to_ipc_perm(&(((kmsqid_t *)vp)->msg_perm))); 1219 break; 1220 case AT_IPC_SEM: 1221 au_uwrite(au_to_ipc_perm(&(((ksemid_t *)vp)->sem_perm))); 1222 break; 1223 case AT_IPC_SHM: 1224 au_uwrite(au_to_ipc_perm(&(((kshmid_t *)vp)->shm_perm))); 1225 break; 1226 } 1227 } 1228 1229 /* 1230 * ROUTINE: AUDIT_REBOOT 1231 * PURPOSE: 1232 * CALLBY: 1233 * NOTE: 1234 * At this point we know that the system call reboot will not return. We thus 1235 * have to complete the audit record generation and put it onto the queue. 1236 * This might be fairly useless if the auditing daemon is already dead.... 1237 * TODO: 1238 * QUESTION: who calls audit_reboot 1239 */ 1240 1241 void 1242 audit_reboot(void) 1243 { 1244 int flag; 1245 t_audit_data_t *tad; 1246 au_kcontext_t *kctx = GET_KCTX_PZ; 1247 1248 tad = U2A(u); 1249 1250 /* if not auditing this event, then do nothing */ 1251 if (tad->tad_flag == 0) 1252 return; 1253 1254 /* do preselection on success/failure */ 1255 if (flag = audit_success(kctx, tad, 0, NULL)) { 1256 /* add a process token */ 1257 1258 cred_t *cr = CRED(); 1259 const auditinfo_addr_t *ainfo = crgetauinfo(cr); 1260 1261 if (ainfo == NULL) 1262 return; 1263 1264 /* Add subject information */ 1265 AUDIT_SETSUBJ(&(u_ad), cr, ainfo, kctx); 1266 1267 /* add a return token */ 1268 add_return_token((caddr_t *)&(u_ad), tad->tad_scid, 0, 0); 1269 1270 AS_INC(as_generated, 1, kctx); 1271 AS_INC(as_kernel, 1, kctx); 1272 } 1273 1274 /* 1275 * Flow control useless here since we're going 1276 * to drop everything in the queue anyway. Why 1277 * block and wait. There aint anyone left alive to 1278 * read the records remaining anyway. 1279 */ 1280 1281 /* Close up everything */ 1282 au_close(kctx, &(u_ad), flag | AU_DONTBLOCK, 1283 tad->tad_event, tad->tad_evmod); 1284 } 1285 1286 void 1287 audit_setfsat_path(int argnum) 1288 { 1289 klwp_id_t clwp = ttolwp(curthread); 1290 struct file *fp; 1291 uint32_t fd; 1292 t_audit_data_t *tad; 1293 struct f_audit_data *fad; 1294 p_audit_data_t *pad; /* current process */ 1295 struct a { 1296 long id; 1297 long arg1; 1298 long arg2; 1299 long arg3; 1300 long arg4; 1301 long arg5; 1302 } *uap; 1303 struct b { 1304 long arg1; 1305 long arg2; 1306 long arg3; 1307 long arg4; 1308 long arg5; 1309 } *uap1; 1310 1311 if (clwp == NULL) 1312 return; 1313 uap1 = (struct b *)&clwp->lwp_ap[1]; 1314 uap = (struct a *)clwp->lwp_ap; 1315 1316 tad = U2A(u); 1317 1318 ASSERT(tad != NULL); 1319 1320 if (tad->tad_scid != SYS_fsat) 1321 return; 1322 1323 switch (argnum) { 1324 case 1: 1325 fd = (uint32_t)uap1->arg1; 1326 break; 1327 case 2: 1328 fd = (uint32_t)uap1->arg2; 1329 break; 1330 case 3: 1331 fd = (uint32_t)uap1->arg3; 1332 break; 1333 case 4: 1334 fd = (uint32_t)uap1->arg4; 1335 break; 1336 case 5: 1337 fd = (uint32_t)uap1->arg5; 1338 break; 1339 default: 1340 return; 1341 } 1342 1343 if (uap->id == 9 && tad->tad_atpath != NULL) { /* openattrdir */ 1344 tad->tad_ctrl |= PAD_ATPATH; 1345 return; 1346 } 1347 if (tad->tad_atpath != NULL) { 1348 au_pathrele(tad->tad_atpath); 1349 tad->tad_atpath = NULL; 1350 } 1351 if (fd != AT_FDCWD) { 1352 if ((fp = getf(fd)) == NULL) 1353 return; 1354 1355 fad = F2A(fp); 1356 ASSERT(fad); 1357 au_pathhold(fad->fad_aupath); 1358 tad->tad_atpath = fad->fad_aupath; 1359 releasef(fd); 1360 } else { 1361 pad = P2A(curproc); 1362 mutex_enter(&pad->pad_lock); 1363 au_pathhold(pad->pad_cwd); 1364 tad->tad_atpath = pad->pad_cwd; 1365 mutex_exit(&pad->pad_lock); 1366 } 1367 } 1368 1369 void 1370 audit_symlink_create(vnode_t *dvp, char *sname, char *target, int error) 1371 { 1372 t_audit_data_t *tad; 1373 vnode_t *vp; 1374 1375 tad = U2A(u); 1376 1377 /* if not auditing this event, then do nothing */ 1378 if (tad->tad_flag == 0) 1379 return; 1380 1381 au_uwrite(au_to_text(target)); 1382 1383 if (error) 1384 return; 1385 1386 error = VOP_LOOKUP(dvp, sname, &vp, NULL, 0, NULL, CRED(), 1387 NULL, NULL, NULL); 1388 if (error == 0) { 1389 audit_attributes(vp); 1390 VN_RELE(vp); 1391 } 1392 } 1393 1394 /* 1395 * ROUTINE: AUDIT_VNCREATE_START 1396 * PURPOSE: set flag so path name lookup in create will not add attribute 1397 * CALLBY: VN_CREATE 1398 * NOTE: 1399 * TODO: 1400 * QUESTION: 1401 */ 1402 1403 void 1404 audit_vncreate_start() 1405 { 1406 t_audit_data_t *tad; 1407 1408 tad = U2A(u); 1409 tad->tad_ctrl |= PAD_NOATTRB; 1410 } 1411 1412 /* 1413 * ROUTINE: AUDIT_VNCREATE_FINISH 1414 * PURPOSE: 1415 * CALLBY: VN_CREATE 1416 * NOTE: 1417 * TODO: 1418 * QUESTION: 1419 */ 1420 void 1421 audit_vncreate_finish(struct vnode *vp, int error) 1422 { 1423 t_audit_data_t *tad; 1424 1425 if (error) 1426 return; 1427 1428 tad = U2A(u); 1429 1430 /* if not auditing this event, then do nothing */ 1431 if (tad->tad_flag == 0) 1432 return; 1433 1434 if (tad->tad_ctrl & PAD_TRUE_CREATE) { 1435 audit_attributes(vp); 1436 } 1437 1438 if (tad->tad_ctrl & PAD_CORE) { 1439 audit_attributes(vp); 1440 tad->tad_ctrl &= ~PAD_CORE; 1441 } 1442 1443 if (!error && ((tad->tad_event == AUE_MKNOD) || 1444 (tad->tad_event == AUE_MKDIR))) { 1445 audit_attributes(vp); 1446 } 1447 1448 /* for case where multiple lookups in one syscall (rename) */ 1449 tad->tad_ctrl &= ~PAD_NOATTRB; 1450 } 1451 1452 1453 1454 1455 1456 1457 1458 1459 /* 1460 * ROUTINE: AUDIT_EXEC 1461 * PURPOSE: Records the function arguments and environment variables 1462 * CALLBY: EXEC_ARGS 1463 * NOTE: 1464 * TODO: 1465 * QUESTION: 1466 */ 1467 1468 /*ARGSUSED*/ 1469 void 1470 audit_exec( 1471 const char *argstr, /* argument strings */ 1472 const char *envstr, /* environment strings */ 1473 ssize_t argc, /* total # arguments */ 1474 ssize_t envc) /* total # environment variables */ 1475 { 1476 t_audit_data_t *tad; 1477 au_kcontext_t *kctx = GET_KCTX_PZ; 1478 1479 tad = U2A(u); 1480 1481 /* if not auditing this event, then do nothing */ 1482 if (!tad->tad_flag) 1483 return; 1484 1485 /* return if not interested in argv or environment variables */ 1486 if (!(kctx->auk_policy & (AUDIT_ARGV|AUDIT_ARGE))) 1487 return; 1488 1489 if (kctx->auk_policy & AUDIT_ARGV) { 1490 au_uwrite(au_to_exec_args(argstr, argc)); 1491 } 1492 1493 if (kctx->auk_policy & AUDIT_ARGE) { 1494 au_uwrite(au_to_exec_env(envstr, envc)); 1495 } 1496 } 1497 1498 /* 1499 * ROUTINE: AUDIT_ENTERPROM 1500 * PURPOSE: 1501 * CALLBY: KBDINPUT 1502 * ZSA_XSINT 1503 * NOTE: 1504 * TODO: 1505 * QUESTION: 1506 */ 1507 void 1508 audit_enterprom(int flg) 1509 { 1510 token_t *rp = NULL; 1511 int sorf; 1512 1513 if (flg) 1514 sorf = AUM_SUCC; 1515 else 1516 sorf = AUM_FAIL; 1517 1518 AUDIT_ASYNC_START(rp, AUE_ENTERPROM, sorf); 1519 1520 au_write((caddr_t *)&(rp), au_to_text("kmdb")); 1521 1522 if (flg) 1523 au_write((caddr_t *)&(rp), au_to_return32(0, 0)); 1524 else 1525 au_write((caddr_t *)&(rp), au_to_return32(ECANCELED, 0)); 1526 1527 AUDIT_ASYNC_FINISH(rp, AUE_ENTERPROM, NULL); 1528 } 1529 1530 1531 /* 1532 * ROUTINE: AUDIT_EXITPROM 1533 * PURPOSE: 1534 * CALLBY: KBDINPUT 1535 * ZSA_XSINT 1536 * NOTE: 1537 * TODO: 1538 * QUESTION: 1539 */ 1540 void 1541 audit_exitprom(int flg) 1542 { 1543 int sorf; 1544 token_t *rp = NULL; 1545 1546 if (flg) 1547 sorf = AUM_SUCC; 1548 else 1549 sorf = AUM_FAIL; 1550 1551 AUDIT_ASYNC_START(rp, AUE_EXITPROM, sorf); 1552 1553 au_write((caddr_t *)&(rp), au_to_text("kmdb")); 1554 1555 if (flg) 1556 au_write((caddr_t *)&(rp), au_to_return32(0, 0)); 1557 else 1558 au_write((caddr_t *)&(rp), au_to_return32(ECANCELED, 0)); 1559 1560 AUDIT_ASYNC_FINISH(rp, AUE_EXITPROM, NULL); 1561 } 1562 1563 struct fcntla { 1564 int fdes; 1565 int cmd; 1566 intptr_t arg; 1567 }; 1568 1569 /* 1570 * ROUTINE: AUDIT_C2_REVOKE 1571 * PURPOSE: 1572 * CALLBY: FCNTL 1573 * NOTE: 1574 * TODO: 1575 * QUESTION: are we keeping this func 1576 */ 1577 1578 /*ARGSUSED*/ 1579 int 1580 audit_c2_revoke(struct fcntla *uap, rval_t *rvp) 1581 { 1582 return (0); 1583 } 1584 1585 1586 /* 1587 * ROUTINE: AUDIT_CHDIREC 1588 * PURPOSE: 1589 * CALLBY: CHDIREC 1590 * NOTE: The main function of CHDIREC 1591 * TODO: Move the audit_chdirec hook above the VN_RELE in vncalls.c 1592 * QUESTION: 1593 */ 1594 1595 /*ARGSUSED*/ 1596 void 1597 audit_chdirec(vnode_t *vp, vnode_t **vpp) 1598 { 1599 int chdir; 1600 int fchdir; 1601 struct audit_path **appp; 1602 struct file *fp; 1603 f_audit_data_t *fad; 1604 p_audit_data_t *pad = P2A(curproc); 1605 t_audit_data_t *tad = T2A(curthread); 1606 1607 struct a { 1608 long fd; 1609 } *uap = (struct a *)ttolwp(curthread)->lwp_ap; 1610 1611 if ((tad->tad_scid == SYS_chdir) || (tad->tad_scid == SYS_chroot)) { 1612 chdir = tad->tad_scid == SYS_chdir; 1613 if (tad->tad_aupath) { 1614 mutex_enter(&pad->pad_lock); 1615 if (chdir) 1616 appp = &(pad->pad_cwd); 1617 else 1618 appp = &(pad->pad_root); 1619 au_pathrele(*appp); 1620 /* use tad hold */ 1621 *appp = tad->tad_aupath; 1622 tad->tad_aupath = NULL; 1623 mutex_exit(&pad->pad_lock); 1624 } 1625 } else if ((tad->tad_scid == SYS_fchdir) || 1626 (tad->tad_scid == SYS_fchroot)) { 1627 fchdir = tad->tad_scid == SYS_fchdir; 1628 if ((fp = getf(uap->fd)) == NULL) 1629 return; 1630 fad = F2A(fp); 1631 if (fad->fad_aupath) { 1632 au_pathhold(fad->fad_aupath); 1633 mutex_enter(&pad->pad_lock); 1634 if (fchdir) 1635 appp = &(pad->pad_cwd); 1636 else 1637 appp = &(pad->pad_root); 1638 au_pathrele(*appp); 1639 *appp = fad->fad_aupath; 1640 mutex_exit(&pad->pad_lock); 1641 if (tad->tad_flag) { 1642 au_uwrite(au_to_path(fad->fad_aupath)); 1643 audit_attributes(fp->f_vnode); 1644 } 1645 } 1646 releasef(uap->fd); 1647 } 1648 } 1649 1650 /* 1651 * ROUTINE: AUDIT_GETF 1652 * PURPOSE: 1653 * CALLBY: GETF_INTERNAL 1654 * NOTE: The main function of GETF_INTERNAL is to associate a given 1655 * file descriptor with a file structure and increment the 1656 * file pointer reference count. 1657 * TODO: remove pass in of fpp. 1658 * increment a reference count so that even if a thread with same process delete 1659 * the same object, it will not panic our system 1660 * QUESTION: 1661 * where to decrement the f_count????????????????? 1662 * seems like I need to set a flag if f_count incremented through audit_getf 1663 */ 1664 1665 /*ARGSUSED*/ 1666 int 1667 audit_getf(int fd) 1668 { 1669 #ifdef NOTYET 1670 t_audit_data_t *tad; 1671 1672 tad = T2A(curthread); 1673 1674 if (!(tad->tad_scid == SYS_open || tad->tad_scid == SYS_creat)) 1675 return; 1676 #endif 1677 return (0); 1678 } 1679 1680 /* 1681 * Audit hook for stream based socket and tli request. 1682 * Note that we do not have user context while executing 1683 * this code so we had to record them earlier during the 1684 * putmsg/getmsg to figure out which user we are dealing with. 1685 */ 1686 1687 /*ARGSUSED*/ 1688 void 1689 audit_sock( 1690 int type, /* type of tihdr.h header requests */ 1691 queue_t *q, /* contains the process and thread audit data */ 1692 mblk_t *mp, /* contains the tihdr.h header structures */ 1693 int from) /* timod or sockmod request */ 1694 { 1695 int32_t len; 1696 int32_t offset; 1697 struct sockaddr_in *sock_data; 1698 struct T_conn_req *conn_req; 1699 struct T_conn_ind *conn_ind; 1700 struct T_unitdata_req *unitdata_req; 1701 struct T_unitdata_ind *unitdata_ind; 1702 au_state_t estate; 1703 t_audit_data_t *tad; 1704 caddr_t saved_thread_ptr; 1705 au_mask_t amask; 1706 const auditinfo_addr_t *ainfo; 1707 au_kcontext_t *kctx; 1708 1709 if (q->q_stream == NULL) 1710 return; 1711 mutex_enter(&q->q_stream->sd_lock); 1712 /* are we being audited */ 1713 saved_thread_ptr = q->q_stream->sd_t_audit_data; 1714 /* no pointer to thread, nothing to do */ 1715 if (saved_thread_ptr == NULL) { 1716 mutex_exit(&q->q_stream->sd_lock); 1717 return; 1718 } 1719 /* only allow one addition of a record token */ 1720 q->q_stream->sd_t_audit_data = NULL; 1721 /* 1722 * thread is not the one being audited, then nothing to do 1723 * This could be the stream thread handling the module 1724 * service routine. In this case, the context for the audit 1725 * record can no longer be assumed. Simplest to just drop 1726 * the operation. 1727 */ 1728 if (curthread != (kthread_id_t)saved_thread_ptr) { 1729 mutex_exit(&q->q_stream->sd_lock); 1730 return; 1731 } 1732 if (curthread->t_sysnum >= SYS_so_socket && 1733 curthread->t_sysnum <= SYS_sockconfig) { 1734 mutex_exit(&q->q_stream->sd_lock); 1735 return; 1736 } 1737 mutex_exit(&q->q_stream->sd_lock); 1738 /* 1739 * we know that the thread that did the put/getmsg is the 1740 * one running. Now we can get the TAD and see if we should 1741 * add an audit token. 1742 */ 1743 tad = U2A(u); 1744 1745 kctx = GET_KCTX_PZ; 1746 1747 /* proceed ONLY if user is being audited */ 1748 if (!tad->tad_flag) 1749 return; 1750 1751 ainfo = crgetauinfo(CRED()); 1752 if (ainfo == NULL) 1753 return; 1754 amask = ainfo->ai_mask; 1755 1756 /* 1757 * Figure out the type of stream networking request here. 1758 * Note that getmsg and putmsg are always preselected 1759 * because during the beginning of the system call we have 1760 * not yet figure out which of the socket or tli request 1761 * we are looking at until we are here. So we need to check 1762 * against that specific request and reset the type of event. 1763 */ 1764 switch (type) { 1765 case T_CONN_REQ: /* connection request */ 1766 conn_req = (struct T_conn_req *)mp->b_rptr; 1767 if (conn_req->DEST_offset < sizeof (struct T_conn_req)) 1768 return; 1769 offset = conn_req->DEST_offset; 1770 len = conn_req->DEST_length; 1771 estate = kctx->auk_ets[AUE_SOCKCONNECT]; 1772 if (amask.as_success & estate || amask.as_failure & estate) { 1773 tad->tad_event = AUE_SOCKCONNECT; 1774 break; 1775 } else { 1776 return; 1777 } 1778 case T_CONN_IND: /* connectionless receive request */ 1779 conn_ind = (struct T_conn_ind *)mp->b_rptr; 1780 if (conn_ind->SRC_offset < sizeof (struct T_conn_ind)) 1781 return; 1782 offset = conn_ind->SRC_offset; 1783 len = conn_ind->SRC_length; 1784 estate = kctx->auk_ets[AUE_SOCKACCEPT]; 1785 if (amask.as_success & estate || amask.as_failure & estate) { 1786 tad->tad_event = AUE_SOCKACCEPT; 1787 break; 1788 } else { 1789 return; 1790 } 1791 case T_UNITDATA_REQ: /* connectionless send request */ 1792 unitdata_req = (struct T_unitdata_req *)mp->b_rptr; 1793 if (unitdata_req->DEST_offset < sizeof (struct T_unitdata_req)) 1794 return; 1795 offset = unitdata_req->DEST_offset; 1796 len = unitdata_req->DEST_length; 1797 estate = kctx->auk_ets[AUE_SOCKSEND]; 1798 if (amask.as_success & estate || amask.as_failure & estate) { 1799 tad->tad_event = AUE_SOCKSEND; 1800 break; 1801 } else { 1802 return; 1803 } 1804 case T_UNITDATA_IND: /* connectionless receive request */ 1805 unitdata_ind = (struct T_unitdata_ind *)mp->b_rptr; 1806 if (unitdata_ind->SRC_offset < sizeof (struct T_unitdata_ind)) 1807 return; 1808 offset = unitdata_ind->SRC_offset; 1809 len = unitdata_ind->SRC_length; 1810 estate = kctx->auk_ets[AUE_SOCKRECEIVE]; 1811 if (amask.as_success & estate || amask.as_failure & estate) { 1812 tad->tad_event = AUE_SOCKRECEIVE; 1813 break; 1814 } else { 1815 return; 1816 } 1817 default: 1818 return; 1819 } 1820 1821 /* 1822 * we are only interested in tcp stream connections, 1823 * not unix domain stuff 1824 */ 1825 if ((len < 0) || (len > sizeof (struct sockaddr_in))) { 1826 tad->tad_event = AUE_GETMSG; 1827 return; 1828 } 1829 /* skip over TPI header and point to the ip address */ 1830 sock_data = (struct sockaddr_in *)((char *)mp->b_rptr + offset); 1831 1832 switch (sock_data->sin_family) { 1833 case AF_INET: 1834 au_write(&(tad->tad_ad), au_to_sock_inet(sock_data)); 1835 break; 1836 default: /* reset to AUE_PUTMSG if not a inet request */ 1837 tad->tad_event = AUE_GETMSG; 1838 break; 1839 } 1840 } 1841 1842 void 1843 audit_lookupname() 1844 { 1845 } 1846 1847 /*ARGSUSED*/ 1848 int 1849 audit_pathcomp(struct pathname *pnp, vnode_t *cvp, cred_t *cr) 1850 { 1851 return (0); 1852 } 1853 1854 static void 1855 add_return_token(caddr_t *ad, unsigned int scid, int err, int rval) 1856 { 1857 unsigned int sy_flags; 1858 1859 #ifdef _SYSCALL32_IMPL 1860 /* 1861 * Guard against t_lwp being NULL when this function is called 1862 * from a kernel queue instead of from a direct system call. 1863 * In that case, assume the running kernel data model. 1864 */ 1865 if ((curthread->t_lwp == NULL) || (lwp_getdatamodel( 1866 ttolwp(curthread)) == DATAMODEL_NATIVE)) 1867 sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK; 1868 else 1869 sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK; 1870 #else 1871 sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK; 1872 #endif 1873 1874 if (sy_flags == SE_64RVAL) 1875 au_write(ad, au_to_return64(err, rval)); 1876 else 1877 au_write(ad, au_to_return32(err, rval)); 1878 1879 } 1880 1881 /*ARGSUSED*/ 1882 void 1883 audit_fdsend(fd, fp, error) 1884 int fd; 1885 struct file *fp; 1886 int error; /* ignore for now */ 1887 { 1888 t_audit_data_t *tad; /* current thread */ 1889 f_audit_data_t *fad; /* per file audit structure */ 1890 struct vnode *vp; /* for file attributes */ 1891 1892 /* is this system call being audited */ 1893 tad = U2A(u); 1894 ASSERT(tad != (t_audit_data_t *)0); 1895 if (!tad->tad_flag) 1896 return; 1897 1898 fad = F2A(fp); 1899 1900 /* add path and file attributes */ 1901 if (fad != NULL && fad->fad_aupath != NULL) { 1902 au_uwrite(au_to_arg32(0, "send fd", (uint32_t)fd)); 1903 au_uwrite(au_to_path(fad->fad_aupath)); 1904 } else { 1905 au_uwrite(au_to_arg32(0, "send fd", (uint32_t)fd)); 1906 #ifdef _LP64 1907 au_uwrite(au_to_arg64(0, "no path", (uint64_t)fp)); 1908 #else 1909 au_uwrite(au_to_arg32(0, "no path", (uint32_t)fp)); 1910 #endif 1911 } 1912 vp = fp->f_vnode; /* include vnode attributes */ 1913 audit_attributes(vp); 1914 } 1915 1916 /* 1917 * Record privileges successfully used and we attempted to use but 1918 * didn't have. 1919 */ 1920 void 1921 audit_priv(int priv, const priv_set_t *set, int flag) 1922 { 1923 t_audit_data_t *tad; 1924 int sbit; 1925 priv_set_t *target; 1926 1927 /* Make sure this isn't being called in an interrupt context */ 1928 ASSERT(servicing_interrupt() == 0); 1929 1930 tad = U2A(u); 1931 1932 if (tad->tad_flag == 0) 1933 return; 1934 1935 target = flag ? &tad->tad_sprivs : &tad->tad_fprivs; 1936 sbit = flag ? PAD_SPRIVUSE : PAD_FPRIVUSE; 1937 1938 /* Tell audit_success() and audit_finish() that we saw this case */ 1939 if (!(tad->tad_evmod & sbit)) { 1940 /* Clear set first time around */ 1941 priv_emptyset(target); 1942 tad->tad_evmod |= sbit; 1943 } 1944 1945 /* Save the privileges in the tad */ 1946 if (priv == PRIV_ALL) { 1947 priv_fillset(target); 1948 } else { 1949 ASSERT(set != NULL || priv != PRIV_NONE); 1950 if (set != NULL) 1951 priv_union(set, target); 1952 if (priv != PRIV_NONE) 1953 priv_addset(target, priv); 1954 } 1955 } 1956 1957 /* 1958 * Audit the setpriv() system call; the operation, the set name and 1959 * the current value as well as the set argument are put in the 1960 * audit trail. 1961 */ 1962 void 1963 audit_setppriv(int op, int set, const priv_set_t *newpriv, const cred_t *ocr) 1964 { 1965 t_audit_data_t *tad; 1966 const priv_set_t *oldpriv; 1967 priv_set_t report; 1968 const char *setname; 1969 1970 tad = U2A(u); 1971 1972 if (tad->tad_flag == 0) 1973 return; 1974 1975 oldpriv = priv_getset(ocr, set); 1976 1977 /* Generate the actual record, include the before and after */ 1978 au_uwrite(au_to_arg32(2, "op", op)); 1979 setname = priv_getsetbynum(set); 1980 1981 switch (op) { 1982 case PRIV_OFF: 1983 /* Report privileges actually switched off */ 1984 report = *oldpriv; 1985 priv_intersect(newpriv, &report); 1986 au_uwrite(au_to_privset(setname, &report, AUT_PRIV, 0)); 1987 break; 1988 case PRIV_ON: 1989 /* Report privileges actually switched on */ 1990 report = *oldpriv; 1991 priv_inverse(&report); 1992 priv_intersect(newpriv, &report); 1993 au_uwrite(au_to_privset(setname, &report, AUT_PRIV, 0)); 1994 break; 1995 case PRIV_SET: 1996 /* Report before and after */ 1997 au_uwrite(au_to_privset(setname, oldpriv, AUT_PRIV, 0)); 1998 au_uwrite(au_to_privset(setname, newpriv, AUT_PRIV, 0)); 1999 break; 2000 } 2001 } 2002 2003 /* 2004 * Dump the full device policy setting in the audit trail. 2005 */ 2006 void 2007 audit_devpolicy(int nitems, const devplcysys_t *items) 2008 { 2009 t_audit_data_t *tad; 2010 int i; 2011 2012 tad = U2A(u); 2013 2014 if (tad->tad_flag == 0) 2015 return; 2016 2017 for (i = 0; i < nitems; i++) { 2018 au_uwrite(au_to_arg32(2, "major", items[i].dps_maj)); 2019 if (items[i].dps_minornm[0] == '\0') { 2020 au_uwrite(au_to_arg32(2, "lomin", items[i].dps_lomin)); 2021 au_uwrite(au_to_arg32(2, "himin", items[i].dps_himin)); 2022 } else 2023 au_uwrite(au_to_text(items[i].dps_minornm)); 2024 2025 au_uwrite(au_to_privset("read", &items[i].dps_rdp, 2026 AUT_PRIV, 0)); 2027 au_uwrite(au_to_privset("write", &items[i].dps_wrp, 2028 AUT_PRIV, 0)); 2029 } 2030 } 2031 2032 /*ARGSUSED*/ 2033 void 2034 audit_fdrecv(fd, fp) 2035 int fd; 2036 struct file *fp; 2037 { 2038 t_audit_data_t *tad; /* current thread */ 2039 f_audit_data_t *fad; /* per file audit structure */ 2040 struct vnode *vp; /* for file attributes */ 2041 2042 /* is this system call being audited */ 2043 tad = U2A(u); 2044 ASSERT(tad != (t_audit_data_t *)0); 2045 if (!tad->tad_flag) 2046 return; 2047 2048 fad = F2A(fp); 2049 2050 /* add path and file attributes */ 2051 if (fad != NULL && fad->fad_aupath != NULL) { 2052 au_uwrite(au_to_arg32(0, "recv fd", (uint32_t)fd)); 2053 au_uwrite(au_to_path(fad->fad_aupath)); 2054 } else { 2055 au_uwrite(au_to_arg32(0, "recv fd", (uint32_t)fd)); 2056 #ifdef _LP64 2057 au_uwrite(au_to_arg64(0, "no path", (uint64_t)fp)); 2058 #else 2059 au_uwrite(au_to_arg32(0, "no path", (uint32_t)fp)); 2060 #endif 2061 } 2062 vp = fp->f_vnode; /* include vnode attributes */ 2063 audit_attributes(vp); 2064 } 2065 2066 /* 2067 * ROUTINE: AUDIT_CRYPTOADM 2068 * PURPOSE: Records arguments to administrative ioctls on /dev/cryptoadm 2069 * CALLBY: CRYPTO_LOAD_DEV_DISABLED, CRYPTO_LOAD_SOFT_DISABLED, 2070 * CRYPTO_UNLOAD_SOFT_MODULE, CRYPTO_LOAD_SOFT_CONFIG, 2071 * CRYPTO_POOL_CREATE, CRYPTO_POOL_WAIT, CRYPTO_POOL_RUN, 2072 * CRYPTO_LOAD_DOOR 2073 * NOTE: 2074 * TODO: 2075 * QUESTION: 2076 */ 2077 2078 void 2079 audit_cryptoadm(int cmd, char *module_name, crypto_mech_name_t *mech_names, 2080 uint_t mech_count, uint_t device_instance, uint32_t rv, int error) 2081 { 2082 boolean_t mech_list_required = B_FALSE; 2083 cred_t *cr = CRED(); 2084 t_audit_data_t *tad; 2085 token_t *ad = NULL; 2086 const auditinfo_addr_t *ainfo = crgetauinfo(cr); 2087 char buffer[MAXNAMELEN * 2]; 2088 au_kcontext_t *kctx = GET_KCTX_PZ; 2089 2090 tad = U2A(u); 2091 if (tad == NULL) 2092 return; 2093 2094 if (ainfo == NULL) 2095 return; 2096 2097 tad->tad_event = AUE_CRYPTOADM; 2098 2099 if (audit_success(kctx, tad, error, NULL) != AU_OK) 2100 return; 2101 2102 /* Add subject information */ 2103 AUDIT_SETSUBJ((caddr_t *)&(ad), cr, ainfo, kctx); 2104 2105 switch (cmd) { 2106 case CRYPTO_LOAD_DEV_DISABLED: 2107 if (error == 0 && rv == CRYPTO_SUCCESS) { 2108 (void) snprintf(buffer, sizeof (buffer), 2109 "op=CRYPTO_LOAD_DEV_DISABLED, module=%s," 2110 " dev_instance=%d", 2111 module_name, device_instance); 2112 mech_list_required = B_TRUE; 2113 } else { 2114 (void) snprintf(buffer, sizeof (buffer), 2115 "op=CRYPTO_LOAD_DEV_DISABLED, return_val=%d", rv); 2116 } 2117 break; 2118 2119 case CRYPTO_LOAD_SOFT_DISABLED: 2120 if (error == 0 && rv == CRYPTO_SUCCESS) { 2121 (void) snprintf(buffer, sizeof (buffer), 2122 "op=CRYPTO_LOAD_SOFT_DISABLED, module=%s", 2123 module_name); 2124 mech_list_required = B_TRUE; 2125 } else { 2126 (void) snprintf(buffer, sizeof (buffer), 2127 "op=CRYPTO_LOAD_SOFT_DISABLED, return_val=%d", rv); 2128 } 2129 break; 2130 2131 case CRYPTO_UNLOAD_SOFT_MODULE: 2132 if (error == 0 && rv == CRYPTO_SUCCESS) { 2133 (void) snprintf(buffer, sizeof (buffer), 2134 "op=CRYPTO_UNLOAD_SOFT_MODULE, module=%s", 2135 module_name); 2136 } else { 2137 (void) snprintf(buffer, sizeof (buffer), 2138 "op=CRYPTO_UNLOAD_SOFT_MODULE, return_val=%d", rv); 2139 } 2140 break; 2141 2142 case CRYPTO_LOAD_SOFT_CONFIG: 2143 if (error == 0 && rv == CRYPTO_SUCCESS) { 2144 (void) snprintf(buffer, sizeof (buffer), 2145 "op=CRYPTO_LOAD_SOFT_CONFIG, module=%s", 2146 module_name); 2147 mech_list_required = B_TRUE; 2148 } else { 2149 (void) snprintf(buffer, sizeof (buffer), 2150 "op=CRYPTO_LOAD_SOFT_CONFIG, return_val=%d", rv); 2151 } 2152 break; 2153 2154 case CRYPTO_POOL_CREATE: 2155 (void) snprintf(buffer, sizeof (buffer), 2156 "op=CRYPTO_POOL_CREATE"); 2157 break; 2158 2159 case CRYPTO_POOL_WAIT: 2160 (void) snprintf(buffer, sizeof (buffer), "op=CRYPTO_POOL_WAIT"); 2161 break; 2162 2163 case CRYPTO_POOL_RUN: 2164 (void) snprintf(buffer, sizeof (buffer), "op=CRYPTO_POOL_RUN"); 2165 break; 2166 2167 case CRYPTO_LOAD_DOOR: 2168 if (error == 0 && rv == CRYPTO_SUCCESS) 2169 (void) snprintf(buffer, sizeof (buffer), 2170 "op=CRYPTO_LOAD_DOOR"); 2171 else 2172 (void) snprintf(buffer, sizeof (buffer), 2173 "op=CRYPTO_LOAD_DOOR, return_val=%d", rv); 2174 break; 2175 2176 default: 2177 return; 2178 } 2179 2180 au_write((caddr_t *)&ad, au_to_text(buffer)); 2181 2182 if (mech_list_required) { 2183 int i; 2184 2185 if (mech_count == 0) { 2186 au_write((caddr_t *)&ad, au_to_text("mech=list empty")); 2187 } else { 2188 char *pb = buffer; 2189 size_t l = sizeof (buffer); 2190 size_t n; 2191 char space[2] = ":"; 2192 2193 n = snprintf(pb, l, "mech="); 2194 2195 for (i = 0; i < mech_count; i++) { 2196 pb += n; 2197 l -= n; 2198 if (l < 0) 2199 l = 0; 2200 2201 if (i == mech_count - 1) 2202 (void) strcpy(space, ""); 2203 2204 n = snprintf(pb, l, "%s%s", mech_names[i], 2205 space); 2206 } 2207 au_write((caddr_t *)&ad, au_to_text(buffer)); 2208 } 2209 } 2210 2211 /* add a return token */ 2212 if (error || (rv != CRYPTO_SUCCESS)) 2213 add_return_token((caddr_t *)&ad, tad->tad_scid, -1, error); 2214 else 2215 add_return_token((caddr_t *)&ad, tad->tad_scid, 0, rv); 2216 2217 AS_INC(as_generated, 1, kctx); 2218 AS_INC(as_kernel, 1, kctx); 2219 2220 au_close(kctx, (caddr_t *)&ad, AU_OK, AUE_CRYPTOADM, 0); 2221 } 2222 2223 /* 2224 * Audit the kernel SSL administration command. The address and the 2225 * port number for the SSL instance, and the proxy port are put in the 2226 * audit trail. 2227 */ 2228 void 2229 audit_kssl(int cmd, void *params, int error) 2230 { 2231 cred_t *cr = CRED(); 2232 t_audit_data_t *tad; 2233 token_t *ad = NULL; 2234 const auditinfo_addr_t *ainfo = crgetauinfo(cr); 2235 au_kcontext_t *kctx = GET_KCTX_PZ; 2236 2237 tad = U2A(u); 2238 2239 if (ainfo == NULL) 2240 return; 2241 2242 tad->tad_event = AUE_CONFIGKSSL; 2243 2244 if (audit_success(kctx, tad, error, NULL) != AU_OK) 2245 return; 2246 2247 /* Add subject information */ 2248 AUDIT_SETSUBJ((caddr_t *)&ad, cr, ainfo, kctx); 2249 2250 switch (cmd) { 2251 case KSSL_ADD_ENTRY: { 2252 char buf[32]; 2253 kssl_params_t *kp = (kssl_params_t *)params; 2254 struct sockaddr_in *saddr = &(kp->kssl_addr); 2255 2256 au_write((caddr_t *)&ad, au_to_text("op=KSSL_ADD_ENTRY")); 2257 au_write((caddr_t *)&ad, au_to_in_addr(&(saddr->sin_addr))); 2258 (void) snprintf(buf, sizeof (buf), "SSL port=%d", 2259 saddr->sin_port); 2260 au_write((caddr_t *)&ad, au_to_text(buf)); 2261 2262 (void) snprintf(buf, sizeof (buf), "proxy port=%d", 2263 kp->kssl_proxy_port); 2264 au_write((caddr_t *)&ad, au_to_text(buf)); 2265 break; 2266 } 2267 2268 case KSSL_DELETE_ENTRY: { 2269 char buf[32]; 2270 struct sockaddr_in *saddr = (struct sockaddr_in *)params; 2271 2272 au_write((caddr_t *)&ad, au_to_text("op=KSSL_DELETE_ENTRY")); 2273 au_write((caddr_t *)&ad, au_to_in_addr(&(saddr->sin_addr))); 2274 (void) snprintf(buf, sizeof (buf), "SSL port=%d", 2275 saddr->sin_port); 2276 au_write((caddr_t *)&ad, au_to_text(buf)); 2277 break; 2278 } 2279 2280 default: 2281 return; 2282 } 2283 2284 /* add a return token */ 2285 add_return_token((caddr_t *)&ad, tad->tad_scid, error, 0); 2286 2287 AS_INC(as_generated, 1, kctx); 2288 AS_INC(as_kernel, 1, kctx); 2289 2290 au_close(kctx, (caddr_t *)&ad, AU_OK, AUE_CONFIGKSSL, 0); 2291 } 2292 2293 /* 2294 * Audit the kernel PF_POLICY administration commands. Record command, 2295 * zone, policy type (global or tunnel, active or inactive) 2296 */ 2297 /* 2298 * ROUTINE: AUDIT_PF_POLICY 2299 * PURPOSE: Records arguments to administrative ioctls on PF_POLICY socket 2300 * CALLBY: SPD_ADDRULE, SPD_DELETERULE, SPD_FLUSH, SPD_UPDATEALGS, 2301 * SPD_CLONE, SPD_FLIP 2302 * NOTE: 2303 * TODO: 2304 * QUESTION: 2305 */ 2306 2307 void 2308 audit_pf_policy(int cmd, cred_t *cred, netstack_t *ns, char *tun, 2309 boolean_t active, int error, pid_t pid) 2310 { 2311 const auditinfo_addr_t *ainfo; 2312 t_audit_data_t *tad; 2313 token_t *ad = NULL; 2314 au_kcontext_t *kctx = GET_KCTX_PZ; 2315 char buf[80]; 2316 int flag; 2317 2318 tad = U2A(u); 2319 if (tad == NULL) 2320 return; 2321 2322 ainfo = crgetauinfo((cred != NULL) ? cred : CRED()); 2323 if (ainfo == NULL) 2324 return; 2325 2326 /* 2327 * Initialize some variables since these are only set 2328 * with system calls. 2329 */ 2330 2331 switch (cmd) { 2332 case SPD_ADDRULE: { 2333 tad->tad_event = AUE_PF_POLICY_ADDRULE; 2334 break; 2335 } 2336 2337 case SPD_DELETERULE: { 2338 tad->tad_event = AUE_PF_POLICY_DELRULE; 2339 break; 2340 } 2341 2342 case SPD_FLUSH: { 2343 tad->tad_event = AUE_PF_POLICY_FLUSH; 2344 break; 2345 } 2346 2347 case SPD_UPDATEALGS: { 2348 tad->tad_event = AUE_PF_POLICY_ALGS; 2349 break; 2350 } 2351 2352 case SPD_CLONE: { 2353 tad->tad_event = AUE_PF_POLICY_CLONE; 2354 break; 2355 } 2356 2357 case SPD_FLIP: { 2358 tad->tad_event = AUE_PF_POLICY_FLIP; 2359 break; 2360 } 2361 2362 default: 2363 tad->tad_event = AUE_NULL; 2364 } 2365 2366 tad->tad_evmod = 0; 2367 2368 if (flag = audit_success(kctx, tad, error, cred)) { 2369 zone_t *nszone; 2370 2371 /* 2372 * For now, just audit that an event happened, 2373 * along with the error code. 2374 */ 2375 au_write((caddr_t *)&ad, 2376 au_to_arg32(1, "Policy Active?", (uint32_t)active)); 2377 au_write((caddr_t *)&ad, 2378 au_to_arg32(2, "Policy Global?", (uint32_t)(tun == NULL))); 2379 2380 /* Supplemental data */ 2381 2382 /* 2383 * Generate this zone token if the target zone differs 2384 * from the administrative zone. If netstacks are expanded 2385 * to something other than a 1-1 relationship with zones, 2386 * the auditing framework should create a new token type 2387 * and audit it as a netstack instead. 2388 * Turn on general zone auditing to get the administrative zone. 2389 */ 2390 2391 nszone = zone_find_by_id(netstackid_to_zoneid( 2392 ns->netstack_stackid)); 2393 if (nszone != NULL) { 2394 if (strncmp(cred->cr_zone->zone_name, nszone->zone_name, 2395 ZONENAME_MAX) != 0) { 2396 token_t *ztoken; 2397 2398 ztoken = au_to_zonename(0, nszone); 2399 au_write((caddr_t *)&ad, ztoken); 2400 } 2401 zone_rele(nszone); 2402 } 2403 2404 if (tun != NULL) { 2405 /* write tunnel name - tun is bounded */ 2406 (void) snprintf(buf, sizeof (buf), "tunnel_name:%s", 2407 tun); 2408 au_write((caddr_t *)&ad, au_to_text(buf)); 2409 } 2410 2411 /* Add subject information */ 2412 AUDIT_SETSUBJ_GENERIC((caddr_t *)&ad, 2413 ((cred != NULL) ? cred : CRED()), ainfo, kctx, pid); 2414 2415 /* add a return token */ 2416 add_return_token((caddr_t *)&ad, 0, error, 0); 2417 2418 AS_INC(as_generated, 1, kctx); 2419 AS_INC(as_kernel, 1, kctx); 2420 2421 } 2422 au_close(kctx, (caddr_t *)&ad, flag, tad->tad_event, 0); 2423 2424 /* 2425 * clear the ctrl flag so that we don't have spurious collection of 2426 * audit information. 2427 */ 2428 tad->tad_scid = 0; 2429 tad->tad_event = 0; 2430 tad->tad_evmod = 0; 2431 tad->tad_ctrl = 0; 2432 } 2433 2434 /* 2435 * ROUTINE: AUDIT_SEC_ATTRIBUTES 2436 * PURPOSE: Add security attributes 2437 * CALLBY: AUDIT_ATTRIBUTES 2438 * AUDIT_CLOSEF 2439 * AUS_CLOSE 2440 * NOTE: 2441 * TODO: 2442 * QUESTION: 2443 */ 2444 2445 void 2446 audit_sec_attributes(caddr_t *ad, struct vnode *vp) 2447 { 2448 /* Dump the SL */ 2449 if (is_system_labeled()) { 2450 ts_label_t *tsl; 2451 bslabel_t *bsl; 2452 2453 tsl = getflabel(vp); 2454 if (tsl == NULL) 2455 return; /* nothing else to do */ 2456 2457 bsl = label2bslabel(tsl); 2458 if (bsl == NULL) 2459 return; /* nothing else to do */ 2460 au_write(ad, au_to_label(bsl)); 2461 label_rele(tsl); 2462 } 2463 2464 } /* AUDIT_SEC_ATTRIBUTES */ 2465