1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 /* 27 * This file contains the declarations of the various data structures 28 * used by the auditing module(s). 29 */ 30 31 #ifndef _BSM_AUDIT_H 32 #define _BSM_AUDIT_H 33 34 #ifdef __cplusplus 35 extern "C" { 36 #endif 37 38 39 #include <sys/shm.h> /* for shmid_ds structure */ 40 #include <sys/sem.h> /* for semid_ds structure */ 41 #include <sys/msg.h> /* for msqid_ds structure */ 42 #include <sys/atomic.h> /* using atomics */ 43 44 /* 45 * Audit conditions, statements reguarding what's to be done with 46 * audit records. Neither AUC_ENABLED, AUC_DISABLED, nor AUC_UNSET 47 * are returned on an auditconfig -getcond call. 48 */ 49 /* global state */ 50 #define AUC_DISABLED -1 /* audit module loaded but not enabled */ 51 #define AUC_UNSET 0 /* on/off hasn't been decided */ 52 #define AUC_ENABLED 1 /* loaded and enabled */ 53 /* local zone state */ 54 #define AUC_INIT_AUDIT 0x4 /* c2audit is ready but auditd has not run */ 55 #define AUC_AUDITING 0x1 /* auditing is being done */ 56 #define AUC_NOAUDIT 0x2 /* auditing is not being done */ 57 #define AUC_NOSPACE 0x8 /* audit enabled, no space for audit records */ 58 59 /* 60 * The user id -2 is never audited - in fact, a setauid(AU_NOAUDITID) 61 * will turn off auditing. 62 */ 63 #define AU_NOAUDITID ((au_id_t)-2) 64 65 /* 66 * success/failure bits for asynchronous events 67 */ 68 69 #define AUM_SUCC 1 /* use the system success preselection mask */ 70 #define AUM_FAIL 2 /* use the system failure preselection mask */ 71 72 73 /* 74 * Defines for event modifier field 75 */ 76 #define PAD_READ 0x0001 /* object read */ 77 #define PAD_WRITE 0x0002 /* object write */ 78 #define PAD_NONATTR 0x4000 /* non-attributable event */ 79 #define PAD_FAILURE 0x8000 /* fail audit event */ 80 #define PAD_SPRIVUSE 0x0080 /* successfully used privileged */ 81 #define PAD_FPRIVUSE 0x0100 /* failed use of privileged */ 82 83 /* 84 * Some typedefs for the fundamentals 85 */ 86 typedef uint_t au_asid_t; 87 typedef uint_t au_class_t; 88 typedef ushort_t au_event_t; 89 typedef ushort_t au_emod_t; 90 typedef uid_t au_id_t; 91 92 /* 93 * An audit event mask. 94 */ 95 #define AU_MASK_ALL 0xFFFFFFFF /* all bits on for unsigned int */ 96 #define AU_MASK_NONE 0x0 /* all bits off = no:invalid class */ 97 98 struct au_mask { 99 unsigned int am_success; /* success bits */ 100 unsigned int am_failure; /* failure bits */ 101 }; 102 typedef struct au_mask au_mask_t; 103 #define as_success am_success 104 #define as_failure am_failure 105 106 /* 107 * The structure of the terminal ID (ipv4) 108 */ 109 struct au_tid { 110 dev_t port; 111 uint_t machine; 112 }; 113 114 #if defined(_SYSCALL32) 115 struct au_tid32 { 116 uint_t port; 117 uint_t machine; 118 }; 119 120 typedef struct au_tid32 au_tid32_t; 121 #endif 122 123 typedef struct au_tid au_tid_t; 124 125 /* 126 * The structure of the terminal ID (ipv6) 127 */ 128 struct au_tid_addr { 129 dev_t at_port; 130 uint_t at_type; 131 uint_t at_addr[4]; 132 }; 133 134 struct au_port_s { 135 uint32_t at_major; /* major # */ 136 uint32_t at_minor; /* minor # */ 137 }; 138 typedef struct au_port_s au_port_t; 139 140 struct au_tid_addr64 { 141 au_port_t at_port; 142 uint_t at_type; 143 uint_t at_addr[4]; 144 }; 145 typedef struct au_tid_addr64 au_tid64_addr_t; 146 147 #if defined(_SYSCALL32) 148 struct au_tid_addr32 { 149 uint_t at_port; 150 uint_t at_type; 151 uint_t at_addr[4]; 152 }; 153 154 typedef struct au_tid_addr32 au_tid32_addr_t; 155 #endif 156 157 typedef struct au_tid_addr au_tid_addr_t; 158 159 struct au_ip { 160 uint16_t at_r_port; /* remote port */ 161 uint16_t at_l_port; /* local port */ 162 uint32_t at_type; /* AU_IPv4,... */ 163 uint32_t at_addr[4]; /* remote IP */ 164 }; 165 typedef struct au_ip au_ip_t; 166 167 /* 168 * Generic network address structure 169 */ 170 struct au_generic_tid { 171 uchar_t gt_type; /* AU_IPADR, AU_DEVICE,... */ 172 union { 173 au_ip_t at_ip; 174 au_port_t at_dev; 175 } gt_adr; 176 }; 177 typedef struct au_generic_tid au_generic_tid_t; 178 179 /* 180 * au_generic_tid_t gt_type values 181 * 0 is reserved for uninitialized data 182 */ 183 #define AU_IPADR 1 184 #define AU_ETHER 2 185 #define AU_DEVICE 3 186 187 /* 188 * at_type values - address length used to identify address type 189 */ 190 #define AU_IPv4 4 /* ipv4 type IP address */ 191 #define AU_IPv6 16 /* ipv6 type IP address */ 192 193 /* 194 * Compatability with SunOS 4.x BSM module 195 * 196 * New code should not contain audit_state_t, 197 * au_state_t, nor au_termid as these types 198 * may go away in future releases. 199 * 200 * typedef new-5.x-bsm-name old-4.x-bsm-name 201 */ 202 203 typedef au_class_t au_state_t; 204 typedef au_mask_t audit_state_t; 205 typedef au_id_t auid_t; 206 #define ai_state ai_mask; 207 208 /* 209 * Opcodes for bsm system calls 210 */ 211 212 #define BSM_GETAUID 19 213 #define BSM_SETAUID 20 214 #define BSM_GETAUDIT 21 215 #define BSM_SETAUDIT 22 216 /* 23 OBSOLETE */ 217 /* 24 OBSOLETE */ 218 #define BSM_AUDIT 25 219 /* 26 OBSOLETE */ 220 /* 27 EOL announced for Sol 10 */ 221 /* 28 OBSOLETE */ 222 #define BSM_AUDITCTL 29 223 /* 30 OBSOLETE */ 224 /* 31 OBSOLETE */ 225 /* 32 OBSOLETE */ 226 /* 33 OBSOLETE */ 227 /* 34 OBSOLETE */ 228 #define BSM_GETAUDIT_ADDR 35 229 #define BSM_SETAUDIT_ADDR 36 230 #define BSM_AUDITDOOR 37 231 232 /* 233 * Auditctl(2) commands 234 */ 235 #define A_GETPOLICY 2 /* get audit policy */ 236 #define A_SETPOLICY 3 /* set audit policy */ 237 #define A_GETKMASK 4 /* get kernel event preselection mask */ 238 #define A_SETKMASK 5 /* set kernel event preselection mask */ 239 #define A_GETQCTRL 6 /* get kernel audit queue ctrl parameters */ 240 #define A_SETQCTRL 7 /* set kernel audit queue ctrl parameters */ 241 #define A_GETCWD 8 /* get process current working directory */ 242 #define A_GETCAR 9 /* get process current active root */ 243 #define A_GETSTAT 12 /* get audit statistics */ 244 #define A_SETSTAT 13 /* (re)set audit statistics */ 245 #define A_SETUMASK 14 /* set preselection mask for procs with auid */ 246 #define A_SETSMASK 15 /* set preselection mask for procs with asid */ 247 #define A_GETCOND 20 /* get audit system on/off condition */ 248 #define A_SETCOND 21 /* set audit system on/off condition */ 249 #define A_GETCLASS 22 /* get audit event to class mapping */ 250 #define A_SETCLASS 23 /* set audit event to class mapping */ 251 #define A_GETPINFO 24 /* get audit info for an arbitrary pid */ 252 #define A_SETPMASK 25 /* set preselection mask for an given pid */ 253 #define A_GETPINFO_ADDR 28 /* get audit info for an arbitrary pid */ 254 #define A_GETKAUDIT 29 /* get kernel audit characteristics */ 255 #define A_SETKAUDIT 30 /* set kernel audit characteristics */ 256 257 /* 258 * Audit Policy parameters (32 bits) 259 */ 260 #define AUDIT_CNT 0x0001 /* do NOT sleep undelivered synch events */ 261 #define AUDIT_AHLT 0x0002 /* HALT machine on undelivered async event */ 262 #define AUDIT_ARGV 0x0004 /* include argv with execv system call events */ 263 #define AUDIT_ARGE 0x0008 /* include arge with execv system call events */ 264 #define AUDIT_SEQ 0x0010 /* include sequence attribute */ 265 #define AUDIT_GROUP 0x0040 /* include group attribute with each record */ 266 #define AUDIT_TRAIL 0x0080 /* include trailer token */ 267 #define AUDIT_PATH 0x0100 /* allow multiple paths per event */ 268 #define AUDIT_SCNT 0x0200 /* sleep user events but not kernel events */ 269 #define AUDIT_PUBLIC 0x0400 /* audit even "public" files */ 270 #define AUDIT_ZONENAME 0x0800 /* emit zonename token */ 271 #define AUDIT_PERZONE 0x1000 /* auditd and audit queue for each zone */ 272 #define AUDIT_WINDATA_DOWN 0x2000 /* include paste downgraded data */ 273 #define AUDIT_WINDATA_UP 0x4000 /* include paste upgraded data */ 274 275 /* 276 * If AUDIT_GLOBAL changes, corresponding changes are required in 277 * audit_syscalls.c's setpolicy(). 278 */ 279 #define AUDIT_GLOBAL (AUDIT_AHLT | AUDIT_PERZONE) 280 #define AUDIT_LOCAL (AUDIT_CNT | AUDIT_ARGV | AUDIT_ARGE |\ 281 AUDIT_SEQ | AUDIT_GROUP | AUDIT_TRAIL | AUDIT_PATH |\ 282 AUDIT_PUBLIC | AUDIT_SCNT | AUDIT_ZONENAME |\ 283 AUDIT_WINDATA_DOWN | AUDIT_WINDATA_UP) 284 285 /* 286 * Kernel audit queue control parameters 287 * 288 * audit record recording blocks at hiwater # undelived records 289 * audit record recording resumes at lowwater # undelivered audit records 290 * bufsz determines how big the data xfers will be to the audit trail 291 */ 292 struct au_qctrl { 293 size_t aq_hiwater; /* kernel audit queue, high water mark */ 294 size_t aq_lowater; /* kernel audit queue, low water mark */ 295 size_t aq_bufsz; /* kernel audit queue, write size to trail */ 296 clock_t aq_delay; /* delay before flushing audit queue */ 297 }; 298 299 #if defined(_SYSCALL32) 300 struct au_qctrl32 { 301 size32_t aq_hiwater; 302 size32_t aq_lowater; 303 size32_t aq_bufsz; 304 clock32_t aq_delay; 305 }; 306 #endif 307 308 309 /* 310 * default values of hiwater and lowater (note hi > lo) 311 */ 312 #define AQ_HIWATER 100 313 #define AQ_MAXHIGH 100000 314 #define AQ_LOWATER 10 315 #define AQ_BUFSZ 8192 316 #define AQ_MAXBUFSZ 1048576 317 #define AQ_DELAY 20 318 #define AQ_MAXDELAY 20000 319 320 struct auditinfo { 321 au_id_t ai_auid; 322 au_mask_t ai_mask; 323 au_tid_t ai_termid; 324 au_asid_t ai_asid; 325 }; 326 327 #if defined(_SYSCALL32) 328 struct auditinfo32 { 329 au_id_t ai_auid; 330 au_mask_t ai_mask; 331 au_tid32_t ai_termid; 332 au_asid_t ai_asid; 333 }; 334 335 typedef struct auditinfo32 auditinfo32_t; 336 #endif 337 338 typedef struct auditinfo auditinfo_t; 339 340 struct auditinfo_addr { 341 au_id_t ai_auid; 342 au_mask_t ai_mask; 343 au_tid_addr_t ai_termid; 344 au_asid_t ai_asid; 345 }; 346 347 struct auditinfo_addr64 { 348 au_id_t ai_auid; 349 au_mask_t ai_mask; 350 au_tid64_addr_t ai_termid; 351 au_asid_t ai_asid; 352 }; 353 typedef struct auditinfo_addr64 auditinfo64_addr_t; 354 355 #if defined(_SYSCALL32) 356 struct auditinfo_addr32 { 357 au_id_t ai_auid; 358 au_mask_t ai_mask; 359 au_tid32_addr_t ai_termid; 360 au_asid_t ai_asid; 361 }; 362 363 typedef struct auditinfo_addr32 auditinfo32_addr_t; 364 #endif 365 366 typedef struct auditinfo_addr auditinfo_addr_t; 367 368 struct auditpinfo { 369 pid_t ap_pid; 370 au_id_t ap_auid; 371 au_mask_t ap_mask; 372 au_tid_t ap_termid; 373 au_asid_t ap_asid; 374 }; 375 376 #if defined(_SYSCALL32) 377 struct auditpinfo32 { 378 pid_t ap_pid; 379 au_id_t ap_auid; 380 au_mask_t ap_mask; 381 au_tid32_t ap_termid; 382 au_asid_t ap_asid; 383 }; 384 #endif 385 386 387 struct auditpinfo_addr { 388 pid_t ap_pid; 389 au_id_t ap_auid; 390 au_mask_t ap_mask; 391 au_tid_addr_t ap_termid; 392 au_asid_t ap_asid; 393 }; 394 395 #if defined(_SYSCALL32) 396 struct auditpinfo_addr32 { 397 pid_t ap_pid; 398 au_id_t ap_auid; 399 au_mask_t ap_mask; 400 au_tid32_addr_t ap_termid; 401 au_asid_t ap_asid; 402 }; 403 #endif 404 405 406 struct au_evclass_map { 407 au_event_t ec_number; 408 au_class_t ec_class; 409 }; 410 typedef struct au_evclass_map au_evclass_map_t; 411 412 /* 413 * Audit stat structures (used to be in audit_stat.h 414 */ 415 416 struct audit_stat { 417 unsigned int as_version; /* version of kernel audit code */ 418 unsigned int as_numevent; /* number of kernel audit events */ 419 uint32_t as_generated; /* # records processed */ 420 uint32_t as_nonattrib; /* # non-attributed records produced */ 421 uint32_t as_kernel; /* # records produced by kernel */ 422 uint32_t as_audit; /* # records processed by audit(2) */ 423 uint32_t as_auditctl; /* # records processed by auditctl(2) */ 424 uint32_t as_enqueue; /* # records put onto audit queue */ 425 uint32_t as_written; /* # records written to audit trail */ 426 uint32_t as_wblocked; /* # times write blked on audit queue */ 427 uint32_t as_rblocked; /* # times read blked on audit queue */ 428 uint32_t as_dropped; /* # of dropped audit records */ 429 uint32_t as_totalsize; /* total number bytes of audit data */ 430 uint32_t as_memused; /* no longer used */ 431 }; 432 typedef struct audit_stat au_stat_t; 433 434 /* get kernel audit context dependent on AUDIT_PERZONE policy */ 435 #define GET_KCTX_PZ (audit_policy & AUDIT_PERZONE) ?\ 436 curproc->p_zone->zone_audit_kctxt :\ 437 global_zone->zone_audit_kctxt 438 /* get kernel audit context of global zone */ 439 #define GET_KCTX_GZ global_zone->zone_audit_kctxt 440 /* get kernel audit context of non-global zone */ 441 #define GET_KCTX_NGZ curproc->p_zone->zone_audit_kctxt 442 443 #define AS_INC(a, b, c) atomic_add_32(&(c->auk_statistics.a), (b)) 444 #define AS_DEC(a, b, c) atomic_add_32(&(c->auk_statistics.a), -(b)) 445 446 /* 447 * audit token IPC types (shm, sem, msg) [for ipc attribute] 448 */ 449 450 #define AT_IPC_MSG ((char)1) /* message IPC id */ 451 #define AT_IPC_SEM ((char)2) /* semaphore IPC id */ 452 #define AT_IPC_SHM ((char)3) /* shared memory IPC id */ 453 454 #if defined(_KERNEL) 455 456 #ifdef __cplusplus 457 } 458 #endif 459 460 #include <sys/types.h> 461 #include <sys/model.h> 462 #include <sys/proc.h> 463 #include <sys/stream.h> 464 #include <sys/stropts.h> 465 #include <sys/file.h> 466 #include <sys/pathname.h> 467 #include <sys/vnode.h> 468 #include <sys/systm.h> 469 #include <netinet/in.h> 470 #include <c2/audit_door_infc.h> 471 #include <sys/crypto/ioctladmin.h> 472 #include <sys/netstack.h> 473 #include <sys/zone.h> 474 475 #ifdef __cplusplus 476 extern "C" { 477 #endif 478 479 struct fcntla; 480 struct t_audit_data; 481 struct audit_path; 482 struct priv_set; 483 struct devplcysys; 484 485 struct auditcalls { 486 long code; 487 long a1; 488 long a2; 489 long a3; 490 long a4; 491 long a5; 492 }; 493 494 int audit(caddr_t, int); 495 int auditsys(struct auditcalls *, union rval *); /* fake stub */ 496 void audit_cryptoadm(int, char *, crypto_mech_name_t *, 497 uint_t, uint_t, uint32_t, int); 498 void audit_init(void); 499 void audit_init_module(void); 500 void audit_newproc(struct proc *); 501 void audit_pfree(struct proc *); 502 void audit_thread_create(kthread_id_t); 503 void audit_thread_free(kthread_id_t); 504 int audit_savepath(struct pathname *, struct vnode *, int, cred_t *); 505 void audit_addcomponent(struct pathname *); 506 void audit_anchorpath(struct pathname *, int); 507 void audit_symlink(struct pathname *, struct pathname *); 508 void audit_symlink_create(struct vnode *, char *, char *, int); 509 int file_is_public(struct vattr *); 510 void audit_attributes(struct vnode *); 511 void audit_falloc(struct file *); 512 void audit_unfalloc(struct file *); 513 void audit_exit(int, int); 514 void audit_core_start(int); 515 void audit_core_finish(int); 516 void audit_stropen(struct vnode *, dev_t *, int, struct cred *); 517 void audit_strclose(struct vnode *, int, struct cred *); 518 void audit_strioctl(struct vnode *, int, intptr_t, int, int, struct cred *, 519 int *); 520 void audit_strgetmsg(struct vnode *, struct strbuf *, struct strbuf *, 521 unsigned char *, int *, int); 522 void audit_strputmsg(struct vnode *, struct strbuf *, struct strbuf *, 523 unsigned char, int, int); 524 void audit_closef(struct file *); 525 int audit_getf(int); 526 void audit_setf(struct file *, int); 527 void audit_copen(int, struct file *, struct vnode *); 528 void audit_reboot(void); 529 void audit_vncreate_start(void); 530 void audit_setfsat_path(int argnum); 531 void audit_vncreate_finish(struct vnode *, int); 532 void audit_exec(const char *, const char *, ssize_t, ssize_t); 533 void audit_enterprom(int); 534 void audit_exitprom(int); 535 void audit_chdirec(struct vnode *, struct vnode **); 536 void audit_sock(int, struct queue *, struct msgb *, int); 537 int audit_start(unsigned int, unsigned int, uint32_t, int, klwp_t *); 538 void audit_finish(unsigned int, unsigned int, int, union rval *); 539 int audit_async_start(label_t *, au_event_t, int); 540 void audit_async_finish(caddr_t *, au_event_t, au_emod_t, timestruc_t *); 541 void audit_async_discard_backend(void *); 542 void audit_async_done(caddr_t *, int); 543 void audit_async_drop(caddr_t *, int); 544 545 #ifndef AUK_CONTEXT_T 546 #define AUK_CONTEXT_T 547 typedef struct au_kcontext au_kcontext_t; 548 #endif 549 550 /* Zone audit context setup routine */ 551 void au_zone_setup(void); 552 553 /* 554 * c2audit module states 555 */ 556 #define C2AUDIT_DISABLED 0 /* c2audit module excluded in /etc/system */ 557 #define C2AUDIT_UNLOADED 1 /* c2audit module not loaded */ 558 #define C2AUDIT_LOADED 2 /* c2audit module loaded */ 559 560 uint32_t audit_getstate(void); 561 int au_zone_getstate(const au_kcontext_t *); 562 563 /* The audit mask defining in which case is auditing enabled */ 564 #define AU_AUDIT_MASK (AUC_AUDITING | AUC_NOSPACE) 565 566 /* 567 * Get the given zone audit status. zcontext != NULL serves 568 * as a protection when c2audit module is not loaded. 569 */ 570 #define AU_ZONE_AUDITING(zcontext) \ 571 (audit_active == C2AUDIT_LOADED && \ 572 ((AU_AUDIT_MASK) & au_zone_getstate((zcontext)))) 573 574 /* 575 * Get auditing status 576 */ 577 #define AU_AUDITING() (audit_getstate()) 578 579 int audit_success(au_kcontext_t *, struct t_audit_data *, int, cred_t *); 580 int auditme(au_kcontext_t *, struct t_audit_data *, au_state_t); 581 void audit_fixpath(struct audit_path *, int); 582 void audit_ipc(int, int, void *); 583 void audit_ipcget(int, void *); 584 void audit_lookupname(); 585 int audit_pathcomp(struct pathname *, vnode_t *, cred_t *); 586 void audit_fdsend(int, struct file *, int); 587 void audit_fdrecv(int, struct file *); 588 int audit_c2_revoke(struct fcntla *, rval_t *); 589 void audit_priv(int, const struct priv_set *, int); 590 void audit_setppriv(int, int, const struct priv_set *, const cred_t *); 591 void audit_devpolicy(int, const struct devplcysys *); 592 void audit_update_context(proc_t *, cred_t *); 593 void audit_kssl(int, void *, int); 594 void audit_pf_policy(int, cred_t *, netstack_t *, char *, boolean_t, int, 595 pid_t); 596 void audit_sec_attributes(caddr_t *, struct vnode *); 597 598 #endif 599 600 #ifdef __cplusplus 601 } 602 #endif 603 604 #endif /* _BSM_AUDIT_H */ 605