xref: /titanic_41/usr/src/cmd/audit_warn/audit_warn.sh (revision a970c705050f9e90c4b6d7982a9b3211719353fb)
1#! /bin/sh
2#
3# CDDL HEADER START
4#
5# The contents of this file are subject to the terms of the
6# Common Development and Distribution License (the "License").
7# You may not use this file except in compliance with the License.
8#
9# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10# or http://www.opensolaris.org/os/licensing.
11# See the License for the specific language governing permissions
12# and limitations under the License.
13#
14# When distributing Covered Code, include this CDDL HEADER in each
15# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16# If applicable, add the following below this CDDL HEADER, with the
17# fields enclosed by brackets "[]" replaced with your own identifying
18# information: Portions Copyright [yyyy] [name of copyright owner]
19#
20# CDDL HEADER END
21#
22#
23# Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
24#
25
26# This shell script warns the administrator when there are problems or
27# potential problems with the audit daemon.  The default script sends
28# a message to the machine console in the case where there
29# is no audit space available.  It has comments in a few places where
30# additional actions might be appropriate (eg. clearing some space).
31#
32#---------------------------------------------------------------------------
33# send mail and generate syslog output
34#
35# $MESSAGE and $SUBJECT are set by the caller
36#
37# edit this function to omit syslog or mail output.
38#---------------------------------------------------------------------------
39send_msg() {
40	MAILER=/usr/bin/mailx
41	SED=/usr/bin/sed
42	LOGCMD="$LOGGER -p daemon.alert"
43
44	ADDRESS=audit_warn		# standard alias for audit alerts
45
46	# turn off redirect to /dev/null to see sendmail output
47	/usr/lib/sendmail -bv $ADDRESS > /dev/null
48
49	if [ $? -ne 0 ]
50	then
51		$LOGCMD "The $ADDRESS mail alias is not defined"
52		ADDRESS=root
53	fi
54
55	if [ -z "$COUNT" -o "0$COUNT" -eq 1 ]
56	then
57		echo "$0: $MESSAGE" | $MAILER -s "$SUBJECT" $ADDRESS
58	fi
59
60	STRIPPEDMSG=`echo "$MESSAGE" | $SED -e "s/\n/ /g"`
61	$LOGCMD $STRIPPEDMSG
62}
63
64# If you change this script, script debug should first be done via the
65# command line, so input errors are output via "echo," but syslog
66# debug messages are better for testing from auditd since the echo
67# output would be lost.  For testing with auditd, replace
68# 'DEBUG_OUT="echo"' with 'DEBUG_OUT="$LOGGER -p daemon.debug"'
69
70LOGGER="/usr/bin/logger"
71DEBUG_OUT="echo"
72
73# Check usage
74if [ "$#" -lt "1" -o "$#" -gt "5" ]
75then
76	$DEBUG_OUT "Usage: $0 <option> [<args>]"
77	exit 1
78fi
79
80# Process args
81while [ -n "$1" ]
82do
83
84	SUBJECT="AUDIT DAEMON WARNING ($1)"
85
86	case "$1" in
87
88	"soft" )	# Check soft arg
89			# One audit filesystem has filled to the soft limit
90			# that is configured in the audit service.
91
92			if [ ! -n "$2" ]
93			then
94				$DEBUG_OUT "$0: Need filename arg with 'soft'!"
95				exit 1
96			else
97				FILE=$2
98			fi
99
100			# Set message
101			MESSAGE="Soft limit exceeded in file $FILE."
102			send_msg
103
104			break
105			;;
106
107	"allsoft" )	# Check all soft arg
108			# All the audit filesystems have filled to the soft
109			# limit set up in the audit service configuration.
110
111			# Set message
112			MESSAGE="Soft limit exceeded on all filesystems."
113			send_msg
114
115			break
116			;;
117
118	"hard" )	# Check hard arg
119			# One audit filesystem has filled completely.
120
121			if [ ! -n "$2" ]
122			then
123				$DEBUG_OUT "$0: Need filename arg with 'hard'!"
124				exit 1
125			else
126				FILE=$2
127			fi
128
129			# Set message
130			MESSAGE="Hard limit exceeded in file $FILE."
131			send_msg
132
133			break
134			;;
135
136	"allhard" )	# Check all hard arg
137			# All the audit filesystems have filled completely.
138			# The audit daemon will remain in a loop sleeping
139			# and checking for space until some space is freed.
140
141			if [ ! -n "$2" ]
142			then
143				$DEBUG_OUT "$0: Need count arg with 'allhard'!"
144				exit 1
145			else
146				COUNT=$2
147			fi
148
149			# Set message
150			MESSAGE="Hard limit exceeded on all filesystems. (count=$COUNT)"
151
152			send_msg
153
154			# This might be a place to make space in the
155			# audit file systems.
156
157			break
158			;;
159
160	"ebusy" )	# Check ebusy arg
161			# The audit daemon is already running and can not
162			# be started more than once.
163
164			# Set message
165			MESSAGE="The audit daemon is already running on this system."
166			send_msg
167
168			break
169			;;
170
171	"tmpfile" )	# Check tmpfile arg
172			# The tmpfile used by the audit daemon (binfile) could
173			# not be opened even unlinked or symlinked.
174			# This error will cause the audit daemon to exit at
175			# start.  If it occurs later the audit daemon will
176			# attempt to carry on.
177
178			if [ ! -n "$2" ]
179			then
180				$DEBUG_OUT "$0: Need error string arg with 'tmpfile'!"
181				exit 1
182			else
183				ERROR=$2
184			fi
185			# Set message
186			MESSAGE="The audit daemon is unable to update /var/run, error=$ERROR.\n This implies a serious problem."
187
188			send_msg
189
190			break
191			;;
192
193	"nostart" )	# Check no start arg
194
195			# auditd attempts to set the audit state; if
196			# it fails, it exits with a "nostart" code.
197			# The most likely cause is that the kernel
198			# audit module did not load due to a
199			# configuration error.  auditd is not running.
200			#
201			# The audit daemon can not be started until
202			# the error is corrected and the system is
203			# rebooted.
204
205			MESSAGE="audit failed to start because it cannot read or\
206 write the system's audit state. This may be due to a configuration error.\n\n\
207Must reboot to start auditing!"
208
209			send_msg
210
211			break
212			;;
213
214	"auditoff" )	# Check audit off arg
215			# Someone besides the audit daemon called the
216			# system call auditon to "turn auditing off"
217			# by setting the state to AUC_NOAUDIT.  This
218			# will cause the audit daemon to exit.
219
220			# Set message
221			MESSAGE="Auditing has been turned off unexpectedly."
222			send_msg
223
224			break
225			;;
226
227	"postsigterm" )	# Check post sigterm arg
228			# While the audit daemon was trying to shutdown
229			# in an orderly fashion (corresponding to audit -t)
230			# it got another signal or an error.  Some records
231			# may not have been written.
232
233			# Set message
234			MESSAGE="Received some signal or error while writing\
235 audit records after SIGTERM.  Some audit records may have been lost."
236			send_msg
237
238			break
239			;;
240
241	"plugin" )	# Check plugin arg
242
243			# There is a problem loading a plugin or a plugin
244			# has reported a serious error.
245			# Output from the plugin is either blocked or halted.
246
247			if [ ! -n "$2" ]
248			then
249				$DEBUG_OUT "$0: Need plugin name arg with 'plugin'!"
250				exit 1
251			else
252				PLUGNAME=$2
253			fi
254
255			if [ ! -n "$3" ]
256			then
257				$DEBUG_OUT "$0: Need error arg with 'plugin'!"
258				exit 1
259			else
260				ERROR=$3
261			fi
262
263			if [ ! -n "$4" ]
264			then
265				$DEBUG_OUT "$0: Need text arg with 'plugin'!"
266				exit 1
267			else
268				TEXT=$4
269			fi
270
271			if [ ! -n "$5" ]
272			then
273				$DEBUG_OUT "$0: Need count arg with 'plugin'!"
274				exit 1
275			else
276				COUNT=$5
277				if [ $COUNT -eq 1 ]; then
278					S=""
279				else
280					S="s"
281				fi
282			fi
283
284			# Set message
285			MESSAGE="The audit daemon has experienced the\
286 following problem with loading or executing plugins:\n\n\
287$PLUGNAME: $ERROR\n\
288$TEXT\n\
289This message has been displayed $COUNT time$S."
290			send_msg
291			break
292			;;
293
294	* )		# Check other args
295			$DEBUG_OUT "$0: Arg not recognized: $1"
296			exit 1
297			;;
298
299	esac
300
301	shift
302done
303
304exit 0
305