17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
51a578a15Spaulson * Common Development and Distribution License (the "License").
61a578a15Spaulson * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22*f8994074SJan Friedel * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bd9Sstevel@tonic-gate */
248f775e0aSJan Friedel
257c478bd9Sstevel@tonic-gate /*
267c478bd9Sstevel@tonic-gate * Threads:
277c478bd9Sstevel@tonic-gate *
287c478bd9Sstevel@tonic-gate * auditd is thread 0 and does signal handling
297c478bd9Sstevel@tonic-gate *
307c478bd9Sstevel@tonic-gate * input() is a door server that receives binary audit records and
317c478bd9Sstevel@tonic-gate * queues them for handling by an instance of process() for conversion to syslog
327c478bd9Sstevel@tonic-gate * message(s). There is one process thread per plugin.
337c478bd9Sstevel@tonic-gate *
347c478bd9Sstevel@tonic-gate * Queues:
357c478bd9Sstevel@tonic-gate *
367c478bd9Sstevel@tonic-gate * Each plugin has a buffer pool and and queue for feeding the
377c478bd9Sstevel@tonic-gate * the process threads. The input thread moves buffers from the pool
387c478bd9Sstevel@tonic-gate * to the queue and the process thread puts them back.
397c478bd9Sstevel@tonic-gate *
407c478bd9Sstevel@tonic-gate * Another pool, b_pool, contains buffers referenced by each of the
417c478bd9Sstevel@tonic-gate * process queues; this is to minimize the number of buffer copies
427c478bd9Sstevel@tonic-gate *
437c478bd9Sstevel@tonic-gate */
447c478bd9Sstevel@tonic-gate
457c478bd9Sstevel@tonic-gate #include <arpa/inet.h>
467c478bd9Sstevel@tonic-gate #include <assert.h>
477c478bd9Sstevel@tonic-gate #include <bsm/adt.h>
487c478bd9Sstevel@tonic-gate #include <dlfcn.h>
497c478bd9Sstevel@tonic-gate #include <errno.h>
507c478bd9Sstevel@tonic-gate #include <fcntl.h>
517c478bd9Sstevel@tonic-gate #include <libintl.h>
527c478bd9Sstevel@tonic-gate #include <pthread.h>
537c478bd9Sstevel@tonic-gate #include <secdb.h>
547c478bd9Sstevel@tonic-gate #include <security/auditd.h>
557c478bd9Sstevel@tonic-gate #include <signal.h>
567c478bd9Sstevel@tonic-gate #include <stdio.h>
577c478bd9Sstevel@tonic-gate #include <stdlib.h>
587c478bd9Sstevel@tonic-gate #include <string.h>
597c478bd9Sstevel@tonic-gate #include <syslog.h>
607c478bd9Sstevel@tonic-gate #include <sys/socket.h>
617c478bd9Sstevel@tonic-gate #include <sys/types.h>
627c478bd9Sstevel@tonic-gate #include <sys/stat.h>
637c478bd9Sstevel@tonic-gate #include <unistd.h>
647c478bd9Sstevel@tonic-gate #include <audit_plugin.h> /* libbsm */
657c478bd9Sstevel@tonic-gate #include "plugin.h"
667c478bd9Sstevel@tonic-gate #include <bsm/audit_door_infc.h>
677c478bd9Sstevel@tonic-gate #include "queue.h"
687c478bd9Sstevel@tonic-gate
697c478bd9Sstevel@tonic-gate #define DEBUG 0
707c478bd9Sstevel@tonic-gate
71dfc7be02SJan Friedel /* gettext() obfuscation routine for lint */
72dfc7be02SJan Friedel #ifdef __lint
73dfc7be02SJan Friedel #define gettext(x) x
74dfc7be02SJan Friedel #endif
757c478bd9Sstevel@tonic-gate
76dfc7be02SJan Friedel #if DEBUG
777c478bd9Sstevel@tonic-gate static FILE *dbfp;
787c478bd9Sstevel@tonic-gate #define DUMP(w, x, y, z) dump_state(w, x, y, z)
797c478bd9Sstevel@tonic-gate #define DPRINT(x) { (void) fprintf x; }
807c478bd9Sstevel@tonic-gate #else
817c478bd9Sstevel@tonic-gate #define DUMP(w, x, y, z)
827c478bd9Sstevel@tonic-gate #define DPRINT(x)
837c478bd9Sstevel@tonic-gate #endif
847c478bd9Sstevel@tonic-gate
857c478bd9Sstevel@tonic-gate #define FATAL_MESSAGE_LEN 256
867c478bd9Sstevel@tonic-gate
877c478bd9Sstevel@tonic-gate #define MIN_RECORD_SIZE (size_t)25
887c478bd9Sstevel@tonic-gate
897c478bd9Sstevel@tonic-gate #define INPUT_MIN 2
907c478bd9Sstevel@tonic-gate #define THRESHOLD_PCT 75
917c478bd9Sstevel@tonic-gate #define DEFAULT_BUF_SZ (size_t)250
927c478bd9Sstevel@tonic-gate #define BASE_PRIORITY 10 /* 0 - 20 valid for user, time share */
937c478bd9Sstevel@tonic-gate #define HIGH_PRIORITY BASE_PRIORITY - 1
947c478bd9Sstevel@tonic-gate
957c478bd9Sstevel@tonic-gate static thr_data_t in_thr; /* input thread locks and data */
967c478bd9Sstevel@tonic-gate static int doorfd = -1;
977c478bd9Sstevel@tonic-gate
987c478bd9Sstevel@tonic-gate static int largest_queue = INPUT_MIN;
997c478bd9Sstevel@tonic-gate static au_queue_t b_pool;
1007c478bd9Sstevel@tonic-gate static int b_allocated = 0;
1017c478bd9Sstevel@tonic-gate static pthread_mutex_t b_alloc_lock;
1027c478bd9Sstevel@tonic-gate static pthread_mutex_t b_refcnt_lock;
1037c478bd9Sstevel@tonic-gate
1047c478bd9Sstevel@tonic-gate static void input(void *, void *, int, door_desc_t *, int);
1057c478bd9Sstevel@tonic-gate static void process(plugin_t *);
1067c478bd9Sstevel@tonic-gate
1077c478bd9Sstevel@tonic-gate static audit_q_t *qpool_withdraw(plugin_t *);
1087c478bd9Sstevel@tonic-gate static void qpool_init(plugin_t *, int);
1097c478bd9Sstevel@tonic-gate static void qpool_return(plugin_t *, audit_q_t *);
1107c478bd9Sstevel@tonic-gate static void qpool_close(plugin_t *);
1117c478bd9Sstevel@tonic-gate
1127c478bd9Sstevel@tonic-gate static audit_rec_t *bpool_withdraw(char *, size_t, size_t);
1137c478bd9Sstevel@tonic-gate static void bpool_init();
1147c478bd9Sstevel@tonic-gate static void bpool_return(audit_rec_t *);
1157c478bd9Sstevel@tonic-gate
1167c478bd9Sstevel@tonic-gate /*
1177c478bd9Sstevel@tonic-gate * warn_or_fatal() -- log daemon error and (optionally) exit
1187c478bd9Sstevel@tonic-gate */
1197c478bd9Sstevel@tonic-gate static void
warn_or_fatal(int fatal,char * parting_shot)1207c478bd9Sstevel@tonic-gate warn_or_fatal(int fatal, char *parting_shot)
1217c478bd9Sstevel@tonic-gate {
1227c478bd9Sstevel@tonic-gate char *severity;
1237c478bd9Sstevel@tonic-gate char message[512];
1247c478bd9Sstevel@tonic-gate
1257c478bd9Sstevel@tonic-gate if (fatal)
1267c478bd9Sstevel@tonic-gate severity = gettext("fatal error");
1277c478bd9Sstevel@tonic-gate else
1287c478bd9Sstevel@tonic-gate severity = gettext("warning");
1297c478bd9Sstevel@tonic-gate
1307c478bd9Sstevel@tonic-gate (void) snprintf(message, 512, "%s: %s", severity, parting_shot);
1317c478bd9Sstevel@tonic-gate
1327c478bd9Sstevel@tonic-gate __audit_syslog("auditd", LOG_PID | LOG_ODELAY | LOG_CONS,
1337c478bd9Sstevel@tonic-gate LOG_DAEMON, LOG_ALERT, message);
1347c478bd9Sstevel@tonic-gate
1357c478bd9Sstevel@tonic-gate DPRINT((dbfp, "auditd warn_or_fatal %s: %s\n", severity, parting_shot));
1367c478bd9Sstevel@tonic-gate if (fatal)
1377c478bd9Sstevel@tonic-gate auditd_exit(1);
1387c478bd9Sstevel@tonic-gate }
1397c478bd9Sstevel@tonic-gate
1407c478bd9Sstevel@tonic-gate /* Internal to doorway.c errors... */
1417c478bd9Sstevel@tonic-gate #define INTERNAL_LOAD_ERROR -1
1427c478bd9Sstevel@tonic-gate #define INTERNAL_SYS_ERROR -2
1437c478bd9Sstevel@tonic-gate #define INTERNAL_CONFIG_ERROR -3
1447c478bd9Sstevel@tonic-gate
1457c478bd9Sstevel@tonic-gate /*
1467c478bd9Sstevel@tonic-gate * report_error -- handle errors returned by plugin
1477c478bd9Sstevel@tonic-gate *
1487c478bd9Sstevel@tonic-gate * rc is plugin's return code if it is a non-negative value,
1497c478bd9Sstevel@tonic-gate * otherwise it is a doorway.c code about a plugin.
1507c478bd9Sstevel@tonic-gate */
1517c478bd9Sstevel@tonic-gate static void
report_error(auditd_rc_t rc,char * error_text,char * plugin_path)1527c478bd9Sstevel@tonic-gate report_error(auditd_rc_t rc, char *error_text, char *plugin_path)
1537c478bd9Sstevel@tonic-gate {
1547c478bd9Sstevel@tonic-gate int warn = 0;
1557c478bd9Sstevel@tonic-gate char rcbuf[100]; /* short error name string */
1567c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
1577c478bd9Sstevel@tonic-gate int bad_count = 0;
1587c478bd9Sstevel@tonic-gate char *name;
1597c478bd9Sstevel@tonic-gate char empty[] = "..";
1607c478bd9Sstevel@tonic-gate
1617c478bd9Sstevel@tonic-gate static int no_plug = 0;
1627c478bd9Sstevel@tonic-gate static int no_load = 0;
1637c478bd9Sstevel@tonic-gate static int no_thread;
1647c478bd9Sstevel@tonic-gate static int no_memory = 0;
1657c478bd9Sstevel@tonic-gate static int invalid = 0;
1667c478bd9Sstevel@tonic-gate static int retry = 0;
1677c478bd9Sstevel@tonic-gate static int fail = 0;
1687c478bd9Sstevel@tonic-gate
1697c478bd9Sstevel@tonic-gate name = plugin_path;
1707c478bd9Sstevel@tonic-gate if (error_text == NULL)
1717c478bd9Sstevel@tonic-gate error_text = empty;
1727c478bd9Sstevel@tonic-gate if (name == NULL)
1737c478bd9Sstevel@tonic-gate name = empty;
1747c478bd9Sstevel@tonic-gate
1757c478bd9Sstevel@tonic-gate switch (rc) {
1767c478bd9Sstevel@tonic-gate case INTERNAL_LOAD_ERROR:
1777c478bd9Sstevel@tonic-gate warn = 1;
1787c478bd9Sstevel@tonic-gate bad_count = ++no_load;
1797c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "load_error");
1807c478bd9Sstevel@tonic-gate break;
1817c478bd9Sstevel@tonic-gate case INTERNAL_SYS_ERROR:
1827c478bd9Sstevel@tonic-gate warn = 1;
1837c478bd9Sstevel@tonic-gate bad_count = ++no_thread;
1847c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "sys_error");
1857c478bd9Sstevel@tonic-gate break;
1867c478bd9Sstevel@tonic-gate case INTERNAL_CONFIG_ERROR:
1877c478bd9Sstevel@tonic-gate warn = 1;
1887c478bd9Sstevel@tonic-gate bad_count = ++no_plug;
1897c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "config_error");
1907c478bd9Sstevel@tonic-gate name = strdup("--");
1917c478bd9Sstevel@tonic-gate break;
1927c478bd9Sstevel@tonic-gate case AUDITD_SUCCESS:
1937c478bd9Sstevel@tonic-gate break;
1947c478bd9Sstevel@tonic-gate case AUDITD_NO_MEMORY: /* no_memory */
1957c478bd9Sstevel@tonic-gate warn = 1;
1967c478bd9Sstevel@tonic-gate bad_count = ++no_memory;
1977c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "no_memory");
1987c478bd9Sstevel@tonic-gate break;
1997c478bd9Sstevel@tonic-gate case AUDITD_INVALID: /* invalid */
2007c478bd9Sstevel@tonic-gate warn = 1;
2017c478bd9Sstevel@tonic-gate bad_count = ++invalid;
2027c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "invalid");
2037c478bd9Sstevel@tonic-gate break;
2047c478bd9Sstevel@tonic-gate case AUDITD_RETRY:
2057c478bd9Sstevel@tonic-gate warn = 1;
2067c478bd9Sstevel@tonic-gate bad_count = ++retry;
2077c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "retry");
2087c478bd9Sstevel@tonic-gate break;
2097c478bd9Sstevel@tonic-gate case AUDITD_COMM_FAIL: /* comm_fail */
2107c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "comm_fail");
2117c478bd9Sstevel@tonic-gate break;
2127c478bd9Sstevel@tonic-gate case AUDITD_FATAL: /* failure */
2137c478bd9Sstevel@tonic-gate warn = 1;
2147c478bd9Sstevel@tonic-gate bad_count = ++fail;
2157c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "failure");
2167c478bd9Sstevel@tonic-gate break;
2177c478bd9Sstevel@tonic-gate default:
2187c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "error");
2197c478bd9Sstevel@tonic-gate break;
2207c478bd9Sstevel@tonic-gate }
2217c478bd9Sstevel@tonic-gate DPRINT((dbfp, "report_error(%d - %s): %s\n\t%s\n",
2227c478bd9Sstevel@tonic-gate bad_count, name, rcbuf, error_text));
2237c478bd9Sstevel@tonic-gate if (warn)
2247c478bd9Sstevel@tonic-gate __audit_dowarn2("plugin", name, rcbuf, error_text, bad_count);
2257c478bd9Sstevel@tonic-gate else {
2267c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
2277c478bd9Sstevel@tonic-gate gettext("audit plugin %s reported error = \"%s\": %s\n"),
2287c478bd9Sstevel@tonic-gate name, rcbuf, error_text);
2297c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
2307c478bd9Sstevel@tonic-gate }
2317c478bd9Sstevel@tonic-gate }
2327c478bd9Sstevel@tonic-gate
2337c478bd9Sstevel@tonic-gate static size_t
getlen(char * buf)2347c478bd9Sstevel@tonic-gate getlen(char *buf)
2357c478bd9Sstevel@tonic-gate {
2367c478bd9Sstevel@tonic-gate adr_t adr;
2377c478bd9Sstevel@tonic-gate char tokenid;
2387c478bd9Sstevel@tonic-gate uint32_t len;
2397c478bd9Sstevel@tonic-gate
2407c478bd9Sstevel@tonic-gate adr.adr_now = buf;
2417c478bd9Sstevel@tonic-gate adr.adr_stream = buf;
2427c478bd9Sstevel@tonic-gate
2437c478bd9Sstevel@tonic-gate adrm_char(&adr, &tokenid, 1);
2447c478bd9Sstevel@tonic-gate if ((tokenid == AUT_OHEADER) || (tokenid == AUT_HEADER32) ||
2457c478bd9Sstevel@tonic-gate (tokenid == AUT_HEADER32_EX) || (tokenid == AUT_HEADER64) ||
2467c478bd9Sstevel@tonic-gate (tokenid == AUT_HEADER64_EX)) {
2477c478bd9Sstevel@tonic-gate adrm_u_int32(&adr, &len, 1);
2487c478bd9Sstevel@tonic-gate
2497c478bd9Sstevel@tonic-gate return (len);
2507c478bd9Sstevel@tonic-gate }
2517c478bd9Sstevel@tonic-gate DPRINT((dbfp, "getlen() is not looking at a header token\n"));
2527c478bd9Sstevel@tonic-gate
2537c478bd9Sstevel@tonic-gate return (0);
2547c478bd9Sstevel@tonic-gate }
2557c478bd9Sstevel@tonic-gate
2567c478bd9Sstevel@tonic-gate /*
2577c478bd9Sstevel@tonic-gate * load_function - call dlsym() to resolve the function address
2587c478bd9Sstevel@tonic-gate */
2597c478bd9Sstevel@tonic-gate static int
load_function(plugin_t * p,char * name,auditd_rc_t (** func)())2607c478bd9Sstevel@tonic-gate load_function(plugin_t *p, char *name, auditd_rc_t (**func)())
2617c478bd9Sstevel@tonic-gate {
2627c478bd9Sstevel@tonic-gate *func = (auditd_rc_t (*)())dlsym(p->plg_dlptr, name);
2637c478bd9Sstevel@tonic-gate if (*func == NULL) {
2647c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
2657c478bd9Sstevel@tonic-gate char *errmsg = dlerror();
2667c478bd9Sstevel@tonic-gate
2677c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
2687c478bd9Sstevel@tonic-gate gettext("dlsym failed %s: error %s"),
2697c478bd9Sstevel@tonic-gate name, errmsg != NULL ? errmsg : gettext("Unknown error\n"));
2707c478bd9Sstevel@tonic-gate
2717c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
2727c478bd9Sstevel@tonic-gate return (-1);
2737c478bd9Sstevel@tonic-gate }
2747c478bd9Sstevel@tonic-gate return (0);
2757c478bd9Sstevel@tonic-gate }
2767c478bd9Sstevel@tonic-gate
2777c478bd9Sstevel@tonic-gate /*
2787c478bd9Sstevel@tonic-gate * load the auditd plug in
2797c478bd9Sstevel@tonic-gate */
2807c478bd9Sstevel@tonic-gate static int
load_plugin(plugin_t * p)2817c478bd9Sstevel@tonic-gate load_plugin(plugin_t *p)
2827c478bd9Sstevel@tonic-gate {
2837c478bd9Sstevel@tonic-gate struct stat64 stat;
2847c478bd9Sstevel@tonic-gate int fd;
2857c478bd9Sstevel@tonic-gate int fail = 0;
2867c478bd9Sstevel@tonic-gate
2877c478bd9Sstevel@tonic-gate /*
2887c478bd9Sstevel@tonic-gate * Stat the file so we can check modes and ownerships
2897c478bd9Sstevel@tonic-gate */
2907c478bd9Sstevel@tonic-gate if ((fd = open(p->plg_path, O_NONBLOCK | O_RDONLY)) != -1) {
2917c478bd9Sstevel@tonic-gate if ((fstat64(fd, &stat) == -1) || (!S_ISREG(stat.st_mode)))
2927c478bd9Sstevel@tonic-gate fail = 1;
2937c478bd9Sstevel@tonic-gate } else
2947c478bd9Sstevel@tonic-gate fail = 1;
2957c478bd9Sstevel@tonic-gate if (fail) {
2967c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
2977c478bd9Sstevel@tonic-gate
2987c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
2997c478bd9Sstevel@tonic-gate gettext("auditd plugin: stat(%s) failed: %s\n"),
3007c478bd9Sstevel@tonic-gate p->plg_path, strerror(errno));
3017c478bd9Sstevel@tonic-gate
3027c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
3037c478bd9Sstevel@tonic-gate return (-1);
3047c478bd9Sstevel@tonic-gate }
3057c478bd9Sstevel@tonic-gate /*
3067c478bd9Sstevel@tonic-gate * Check the ownership of the file
3077c478bd9Sstevel@tonic-gate */
3087c478bd9Sstevel@tonic-gate if (stat.st_uid != (uid_t)0) {
3097c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
3107c478bd9Sstevel@tonic-gate
3117c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
3127c478bd9Sstevel@tonic-gate gettext(
3137c478bd9Sstevel@tonic-gate "auditd plugin: Owner of the module %s is not root\n"),
3147c478bd9Sstevel@tonic-gate p->plg_path);
3157c478bd9Sstevel@tonic-gate
3167c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
3177c478bd9Sstevel@tonic-gate return (-1);
3187c478bd9Sstevel@tonic-gate }
3197c478bd9Sstevel@tonic-gate /*
3207c478bd9Sstevel@tonic-gate * Check the modes on the file
3217c478bd9Sstevel@tonic-gate */
3227c478bd9Sstevel@tonic-gate if (stat.st_mode&S_IWGRP) {
3237c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
3247c478bd9Sstevel@tonic-gate
3257c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
3267c478bd9Sstevel@tonic-gate gettext("auditd plugin: module %s writable by group\n"),
3277c478bd9Sstevel@tonic-gate p->plg_path);
3287c478bd9Sstevel@tonic-gate
3297c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
3307c478bd9Sstevel@tonic-gate return (-1);
3317c478bd9Sstevel@tonic-gate }
3327c478bd9Sstevel@tonic-gate if (stat.st_mode&S_IWOTH) {
3337c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
3347c478bd9Sstevel@tonic-gate
3357c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
3367c478bd9Sstevel@tonic-gate gettext("auditd plugin: module %s writable by world\n"),
3377c478bd9Sstevel@tonic-gate p->plg_path);
3387c478bd9Sstevel@tonic-gate
3397c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
3407c478bd9Sstevel@tonic-gate return (-1);
3417c478bd9Sstevel@tonic-gate }
3427c478bd9Sstevel@tonic-gate /*
3437c478bd9Sstevel@tonic-gate * Open the plugin
3447c478bd9Sstevel@tonic-gate */
3457c478bd9Sstevel@tonic-gate p->plg_dlptr = dlopen(p->plg_path, RTLD_LAZY);
3467c478bd9Sstevel@tonic-gate
3477c478bd9Sstevel@tonic-gate if (p->plg_dlptr == NULL) {
3487c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
3497c478bd9Sstevel@tonic-gate char *errmsg = dlerror();
3507c478bd9Sstevel@tonic-gate
3517c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
3527c478bd9Sstevel@tonic-gate gettext("plugin load %s failed: %s\n"),
3537c478bd9Sstevel@tonic-gate p->plg_path, errmsg != NULL ? errmsg :
3547c478bd9Sstevel@tonic-gate gettext("Unknown error\n"));
3557c478bd9Sstevel@tonic-gate
3567c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
3577c478bd9Sstevel@tonic-gate return (-1);
3587c478bd9Sstevel@tonic-gate }
3597c478bd9Sstevel@tonic-gate if (load_function(p, "auditd_plugin", &(p->plg_fplugin)))
3607c478bd9Sstevel@tonic-gate return (-1);
3617c478bd9Sstevel@tonic-gate
3627c478bd9Sstevel@tonic-gate if (load_function(p, "auditd_plugin_open", &(p->plg_fplugin_open)))
3637c478bd9Sstevel@tonic-gate return (-1);
3647c478bd9Sstevel@tonic-gate
3657c478bd9Sstevel@tonic-gate if (load_function(p, "auditd_plugin_close", &(p->plg_fplugin_close)))
3667c478bd9Sstevel@tonic-gate return (-1);
3677c478bd9Sstevel@tonic-gate
3687c478bd9Sstevel@tonic-gate return (0);
3697c478bd9Sstevel@tonic-gate }
3707c478bd9Sstevel@tonic-gate
3717c478bd9Sstevel@tonic-gate /*
3727c478bd9Sstevel@tonic-gate * unload_plugin() unlinks and frees the plugin_t structure after
3737c478bd9Sstevel@tonic-gate * freeing buffers and structures that hang off it. It also dlcloses
3747c478bd9Sstevel@tonic-gate * the referenced plugin. The return is the next entry, which may be NULL
3757c478bd9Sstevel@tonic-gate *
3767c478bd9Sstevel@tonic-gate * hold plugin_mutex for this call
3777c478bd9Sstevel@tonic-gate */
3787c478bd9Sstevel@tonic-gate static plugin_t *
unload_plugin(plugin_t * p)3797c478bd9Sstevel@tonic-gate unload_plugin(plugin_t *p)
3807c478bd9Sstevel@tonic-gate {
3817c478bd9Sstevel@tonic-gate plugin_t *q, **r;
3827c478bd9Sstevel@tonic-gate
3837c478bd9Sstevel@tonic-gate assert(pthread_mutex_trylock(&plugin_mutex) != 0);
3847c478bd9Sstevel@tonic-gate
3857c478bd9Sstevel@tonic-gate DPRINT((dbfp, "unload_plugin: removing %s\n", p->plg_path));
3867c478bd9Sstevel@tonic-gate
3877c478bd9Sstevel@tonic-gate _kva_free(p->plg_kvlist); /* _kva_free accepts NULL */
3887c478bd9Sstevel@tonic-gate qpool_close(p); /* qpool_close accepts NULL pool, queue */
3897c478bd9Sstevel@tonic-gate DPRINT((dbfp, "unload_plugin: %s structure removed\n", p->plg_path));
3907c478bd9Sstevel@tonic-gate
3917c478bd9Sstevel@tonic-gate (void) dlclose(p->plg_dlptr);
3927c478bd9Sstevel@tonic-gate
3937c478bd9Sstevel@tonic-gate DPRINT((dbfp, "unload_plugin: %s dlclosed\n", p->plg_path));
3947c478bd9Sstevel@tonic-gate free(p->plg_path);
3957c478bd9Sstevel@tonic-gate
3967c478bd9Sstevel@tonic-gate (void) pthread_mutex_destroy(&(p->plg_mutex));
3977c478bd9Sstevel@tonic-gate (void) pthread_cond_destroy(&(p->plg_cv));
3987c478bd9Sstevel@tonic-gate
3997c478bd9Sstevel@tonic-gate q = plugin_head;
4007c478bd9Sstevel@tonic-gate r = &plugin_head;
4017c478bd9Sstevel@tonic-gate while (q != NULL) {
4027c478bd9Sstevel@tonic-gate if (q == p) {
4037c478bd9Sstevel@tonic-gate *r = p->plg_next;
4047c478bd9Sstevel@tonic-gate free(p);
4057c478bd9Sstevel@tonic-gate break;
4067c478bd9Sstevel@tonic-gate }
4077c478bd9Sstevel@tonic-gate r = &(q->plg_next);
4087c478bd9Sstevel@tonic-gate q = q->plg_next;
4097c478bd9Sstevel@tonic-gate }
4107c478bd9Sstevel@tonic-gate return (*r);
4117c478bd9Sstevel@tonic-gate }
4127c478bd9Sstevel@tonic-gate
4137c478bd9Sstevel@tonic-gate /*
4147c478bd9Sstevel@tonic-gate * process return values from plugin_open
4157c478bd9Sstevel@tonic-gate *
4167c478bd9Sstevel@tonic-gate * presently no attribute is defined.
4177c478bd9Sstevel@tonic-gate */
4187c478bd9Sstevel@tonic-gate /* ARGSUSED */
4197c478bd9Sstevel@tonic-gate static void
open_return(plugin_t * p,char * attrval)4207c478bd9Sstevel@tonic-gate open_return(plugin_t *p, char *attrval)
4217c478bd9Sstevel@tonic-gate {
4227c478bd9Sstevel@tonic-gate }
4237c478bd9Sstevel@tonic-gate
4247c478bd9Sstevel@tonic-gate /*
4257c478bd9Sstevel@tonic-gate * auditd_thread_init
4267c478bd9Sstevel@tonic-gate * - create threads
4277c478bd9Sstevel@tonic-gate * - load plugins
4287c478bd9Sstevel@tonic-gate *
4297c478bd9Sstevel@tonic-gate * auditd_thread_init is called at auditd startup with an initial list
430*f8994074SJan Friedel * of plugins and again each time audit catches a SIGHUP or SIGUSR1.
4317c478bd9Sstevel@tonic-gate */
4327c478bd9Sstevel@tonic-gate int
auditd_thread_init()4337c478bd9Sstevel@tonic-gate auditd_thread_init()
4347c478bd9Sstevel@tonic-gate {
4357c478bd9Sstevel@tonic-gate int threshold;
4367c478bd9Sstevel@tonic-gate auditd_rc_t rc;
4377c478bd9Sstevel@tonic-gate plugin_t *p;
4387c478bd9Sstevel@tonic-gate char *open_params;
4397c478bd9Sstevel@tonic-gate char *error_string;
4407c478bd9Sstevel@tonic-gate int plugin_count = 0;
4417c478bd9Sstevel@tonic-gate static int threads_ready = 0;
4427c478bd9Sstevel@tonic-gate
4437c478bd9Sstevel@tonic-gate if (!threads_ready) {
4447c478bd9Sstevel@tonic-gate struct sched_param param;
4457c478bd9Sstevel@tonic-gate #if DEBUG
4467c478bd9Sstevel@tonic-gate dbfp = __auditd_debug_file_open();
4477c478bd9Sstevel@tonic-gate #endif
4487c478bd9Sstevel@tonic-gate doorfd = door_create((void(*)())input, 0,
4497c478bd9Sstevel@tonic-gate DOOR_REFUSE_DESC | DOOR_NO_CANCEL);
4507c478bd9Sstevel@tonic-gate if (doorfd < 0)
4517c478bd9Sstevel@tonic-gate return (1); /* can't create door -> fatal */
4527c478bd9Sstevel@tonic-gate
4537c478bd9Sstevel@tonic-gate param.sched_priority = BASE_PRIORITY;
4547c478bd9Sstevel@tonic-gate (void) pthread_setschedparam(pthread_self(), SCHED_OTHER,
4557c478bd9Sstevel@tonic-gate ¶m);
4567c478bd9Sstevel@tonic-gate
4577c478bd9Sstevel@tonic-gate /* input door server */
4587c478bd9Sstevel@tonic-gate (void) pthread_mutex_init(&(in_thr.thd_mutex), NULL);
4597c478bd9Sstevel@tonic-gate (void) pthread_cond_init(&(in_thr.thd_cv), NULL);
4607c478bd9Sstevel@tonic-gate in_thr.thd_waiting = 0;
4617c478bd9Sstevel@tonic-gate
4627c478bd9Sstevel@tonic-gate bpool_init();
4637c478bd9Sstevel@tonic-gate }
4647c478bd9Sstevel@tonic-gate p = plugin_head;
4657c478bd9Sstevel@tonic-gate while (p != NULL) {
4667c478bd9Sstevel@tonic-gate if (p->plg_removed) {
4677c478bd9Sstevel@tonic-gate DPRINT((dbfp, "start removing %s\n", p->plg_path));
4687c478bd9Sstevel@tonic-gate /* tell process(p) to exit and dlclose */
4697c478bd9Sstevel@tonic-gate (void) pthread_cond_signal(&(p->plg_cv));
4707c478bd9Sstevel@tonic-gate } else if (!p->plg_initialized) {
4717c478bd9Sstevel@tonic-gate DPRINT((dbfp, "start initial load of %s\n",
4727c478bd9Sstevel@tonic-gate p->plg_path));
4737c478bd9Sstevel@tonic-gate if (load_plugin(p)) {
4747c478bd9Sstevel@tonic-gate report_error(INTERNAL_LOAD_ERROR,
4757c478bd9Sstevel@tonic-gate gettext("dynamic load failed"),
4767c478bd9Sstevel@tonic-gate p->plg_path);
4777c478bd9Sstevel@tonic-gate p = unload_plugin(p);
4787c478bd9Sstevel@tonic-gate continue;
4797c478bd9Sstevel@tonic-gate }
4807c478bd9Sstevel@tonic-gate open_params = NULL;
4817c478bd9Sstevel@tonic-gate error_string = NULL;
4827c478bd9Sstevel@tonic-gate if ((rc = p->plg_fplugin_open(
4837c478bd9Sstevel@tonic-gate p->plg_kvlist,
4847c478bd9Sstevel@tonic-gate &open_params, &error_string)) != AUDITD_SUCCESS) {
4857c478bd9Sstevel@tonic-gate report_error(rc, error_string, p->plg_path);
4867c478bd9Sstevel@tonic-gate free(error_string);
4877c478bd9Sstevel@tonic-gate p = unload_plugin(p);
4887c478bd9Sstevel@tonic-gate continue;
4897c478bd9Sstevel@tonic-gate }
4907c478bd9Sstevel@tonic-gate open_return(p, open_params);
4917c478bd9Sstevel@tonic-gate p->plg_reopen = 0;
4927c478bd9Sstevel@tonic-gate
4937c478bd9Sstevel@tonic-gate threshold = ((p->plg_qmax * THRESHOLD_PCT) + 99) / 100;
4947c478bd9Sstevel@tonic-gate p->plg_qmin = INPUT_MIN;
4957c478bd9Sstevel@tonic-gate
4967c478bd9Sstevel@tonic-gate DPRINT((dbfp,
4977c478bd9Sstevel@tonic-gate "calling qpool_init for %s with qmax=%d\n",
4987c478bd9Sstevel@tonic-gate p->plg_path, p->plg_qmax));
4997c478bd9Sstevel@tonic-gate
5007c478bd9Sstevel@tonic-gate qpool_init(p, threshold);
5017c478bd9Sstevel@tonic-gate audit_queue_init(&(p->plg_queue));
5027c478bd9Sstevel@tonic-gate p->plg_initialized = 1;
5037c478bd9Sstevel@tonic-gate
5047c478bd9Sstevel@tonic-gate (void) pthread_mutex_init(&(p->plg_mutex), NULL);
5057c478bd9Sstevel@tonic-gate (void) pthread_cond_init(&(p->plg_cv), NULL);
5067c478bd9Sstevel@tonic-gate p->plg_waiting = 0;
5077c478bd9Sstevel@tonic-gate
5087c478bd9Sstevel@tonic-gate if (pthread_create(&(p->plg_tid), NULL,
5097c478bd9Sstevel@tonic-gate (void *(*)(void *))process, p)) {
5107c478bd9Sstevel@tonic-gate report_error(INTERNAL_SYS_ERROR,
5117c478bd9Sstevel@tonic-gate gettext("thread creation failed"),
5127c478bd9Sstevel@tonic-gate p->plg_path);
5137c478bd9Sstevel@tonic-gate p = unload_plugin(p);
5147c478bd9Sstevel@tonic-gate continue;
5157c478bd9Sstevel@tonic-gate }
5167c478bd9Sstevel@tonic-gate } else if (p->plg_reopen) {
5177c478bd9Sstevel@tonic-gate DPRINT((dbfp, "reopen %s\n", p->plg_path));
5187c478bd9Sstevel@tonic-gate error_string = NULL;
519*f8994074SJan Friedel if ((rc = p->plg_fplugin_open(p->plg_kvlist,
5207c478bd9Sstevel@tonic-gate &open_params, &error_string)) != AUDITD_SUCCESS) {
5217c478bd9Sstevel@tonic-gate report_error(rc, error_string, p->plg_path);
5227c478bd9Sstevel@tonic-gate free(error_string);
5237c478bd9Sstevel@tonic-gate p = unload_plugin(p);
5247c478bd9Sstevel@tonic-gate continue;
5257c478bd9Sstevel@tonic-gate }
5267c478bd9Sstevel@tonic-gate open_return(p, open_params);
5277c478bd9Sstevel@tonic-gate p->plg_reopen = 0;
5287c478bd9Sstevel@tonic-gate
5297c478bd9Sstevel@tonic-gate DPRINT((dbfp, "%s qmax=%d\n",
5307c478bd9Sstevel@tonic-gate p->plg_path, p->plg_qmax));
5317c478bd9Sstevel@tonic-gate
5327c478bd9Sstevel@tonic-gate }
5337c478bd9Sstevel@tonic-gate p->plg_q_threshold = ((p->plg_qmax * THRESHOLD_PCT) + 99) / 100;
5347c478bd9Sstevel@tonic-gate
5357c478bd9Sstevel@tonic-gate p = p->plg_next;
5367c478bd9Sstevel@tonic-gate plugin_count++;
5377c478bd9Sstevel@tonic-gate }
5387c478bd9Sstevel@tonic-gate if (plugin_count == 0) {
5397c478bd9Sstevel@tonic-gate report_error(INTERNAL_CONFIG_ERROR,
5407c478bd9Sstevel@tonic-gate gettext("No plugins are configured"), NULL);
5417c478bd9Sstevel@tonic-gate return (-1);
5427c478bd9Sstevel@tonic-gate }
5437c478bd9Sstevel@tonic-gate if (!threads_ready) {
5447c478bd9Sstevel@tonic-gate /* unleash the kernel */
5457c478bd9Sstevel@tonic-gate rc = auditdoor(doorfd);
5467c478bd9Sstevel@tonic-gate
5477c478bd9Sstevel@tonic-gate DPRINT((dbfp, "%d returned from auditdoor.\n",
5487c478bd9Sstevel@tonic-gate rc));
5497c478bd9Sstevel@tonic-gate if (rc != 0)
5507c478bd9Sstevel@tonic-gate return (1); /* fatal */
5517c478bd9Sstevel@tonic-gate
5527c478bd9Sstevel@tonic-gate threads_ready = 1;
5537c478bd9Sstevel@tonic-gate }
5547c478bd9Sstevel@tonic-gate return (0);
5557c478bd9Sstevel@tonic-gate }
5567c478bd9Sstevel@tonic-gate
5577c478bd9Sstevel@tonic-gate /*
5587c478bd9Sstevel@tonic-gate * Door invocations that are in progress during a
5597c478bd9Sstevel@tonic-gate * door_revoke() invocation are allowed to complete normally.
5607c478bd9Sstevel@tonic-gate * -- man page for door_revoke()
5617c478bd9Sstevel@tonic-gate */
5627c478bd9Sstevel@tonic-gate void
auditd_thread_close()5637c478bd9Sstevel@tonic-gate auditd_thread_close()
5647c478bd9Sstevel@tonic-gate {
5657c478bd9Sstevel@tonic-gate if (doorfd == -1)
5667c478bd9Sstevel@tonic-gate return;
5677c478bd9Sstevel@tonic-gate (void) door_revoke(doorfd);
5687c478bd9Sstevel@tonic-gate doorfd = -1;
5697c478bd9Sstevel@tonic-gate }
5707c478bd9Sstevel@tonic-gate
5717c478bd9Sstevel@tonic-gate /*
5727c478bd9Sstevel@tonic-gate * qpool_init() sets up pool for queue entries (audit_q_t)
5737c478bd9Sstevel@tonic-gate *
5747c478bd9Sstevel@tonic-gate */
5757c478bd9Sstevel@tonic-gate static void
qpool_init(plugin_t * p,int threshold)5767c478bd9Sstevel@tonic-gate qpool_init(plugin_t *p, int threshold)
5777c478bd9Sstevel@tonic-gate {
5787c478bd9Sstevel@tonic-gate int i;
5797c478bd9Sstevel@tonic-gate audit_q_t *node;
5807c478bd9Sstevel@tonic-gate
5817c478bd9Sstevel@tonic-gate audit_queue_init(&(p->plg_pool));
5827c478bd9Sstevel@tonic-gate
5837c478bd9Sstevel@tonic-gate DPRINT((dbfp, "qpool_init(%d) max, min, threshhold = %d, %d, %d\n",
5847c478bd9Sstevel@tonic-gate p->plg_tid, p->plg_qmax, p->plg_qmin, threshold));
5857c478bd9Sstevel@tonic-gate
5867c478bd9Sstevel@tonic-gate if (p->plg_qmax > largest_queue)
5877c478bd9Sstevel@tonic-gate largest_queue = p->plg_qmax;
5887c478bd9Sstevel@tonic-gate
5897c478bd9Sstevel@tonic-gate p->plg_q_threshold = threshold;
5907c478bd9Sstevel@tonic-gate
5917c478bd9Sstevel@tonic-gate for (i = 0; i < p->plg_qmin; i++) {
5927c478bd9Sstevel@tonic-gate node = malloc(sizeof (audit_q_t));
5937c478bd9Sstevel@tonic-gate if (node == NULL)
5947c478bd9Sstevel@tonic-gate warn_or_fatal(1, gettext("no memory\n"));
5957c478bd9Sstevel@tonic-gate /* doesn't return */
5967c478bd9Sstevel@tonic-gate
5977c478bd9Sstevel@tonic-gate audit_enqueue(&p->plg_pool, node);
5987c478bd9Sstevel@tonic-gate }
5997c478bd9Sstevel@tonic-gate }
6007c478bd9Sstevel@tonic-gate
6017c478bd9Sstevel@tonic-gate /*
6027c478bd9Sstevel@tonic-gate * bpool_init() sets up pool and queue for record entries (audit_rec_t)
6037c478bd9Sstevel@tonic-gate *
6047c478bd9Sstevel@tonic-gate */
6057c478bd9Sstevel@tonic-gate static void
bpool_init()6067c478bd9Sstevel@tonic-gate bpool_init()
6077c478bd9Sstevel@tonic-gate {
6087c478bd9Sstevel@tonic-gate int i;
6097c478bd9Sstevel@tonic-gate audit_rec_t *node;
6107c478bd9Sstevel@tonic-gate
6117c478bd9Sstevel@tonic-gate audit_queue_init(&b_pool);
6127c478bd9Sstevel@tonic-gate (void) pthread_mutex_init(&b_alloc_lock, NULL);
6137c478bd9Sstevel@tonic-gate (void) pthread_mutex_init(&b_refcnt_lock, NULL);
6147c478bd9Sstevel@tonic-gate
6157c478bd9Sstevel@tonic-gate for (i = 0; i < INPUT_MIN; i++) {
6167c478bd9Sstevel@tonic-gate node = malloc(AUDIT_REC_HEADER + DEFAULT_BUF_SZ);
6177c478bd9Sstevel@tonic-gate if (node == NULL)
6187c478bd9Sstevel@tonic-gate warn_or_fatal(1, gettext("no memory\n"));
6197c478bd9Sstevel@tonic-gate /* doesn't return */
6207c478bd9Sstevel@tonic-gate
6217c478bd9Sstevel@tonic-gate node->abq_buf_len = DEFAULT_BUF_SZ;
6227c478bd9Sstevel@tonic-gate
6237c478bd9Sstevel@tonic-gate node->abq_data_len = 0;
6247c478bd9Sstevel@tonic-gate audit_enqueue(&b_pool, node);
6257c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&b_alloc_lock);
6267c478bd9Sstevel@tonic-gate b_allocated++;
6277c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&b_alloc_lock);
6287c478bd9Sstevel@tonic-gate }
6297c478bd9Sstevel@tonic-gate }
6307c478bd9Sstevel@tonic-gate
6317c478bd9Sstevel@tonic-gate /*
6327c478bd9Sstevel@tonic-gate * qpool_close() discard queue and pool for a discontinued plugin
6337c478bd9Sstevel@tonic-gate *
6347c478bd9Sstevel@tonic-gate * there is no corresponding bpool_close() since it would only
6357c478bd9Sstevel@tonic-gate * be called as auditd is going down.
6367c478bd9Sstevel@tonic-gate */
6377c478bd9Sstevel@tonic-gate static void
qpool_close(plugin_t * p)6387c478bd9Sstevel@tonic-gate qpool_close(plugin_t *p) {
6397c478bd9Sstevel@tonic-gate audit_q_t *q_node;
6407c478bd9Sstevel@tonic-gate audit_rec_t *b_node;
6417c478bd9Sstevel@tonic-gate
6427c478bd9Sstevel@tonic-gate if (!p->plg_initialized)
6437c478bd9Sstevel@tonic-gate return;
6447c478bd9Sstevel@tonic-gate
6457c478bd9Sstevel@tonic-gate while (audit_dequeue(&(p->plg_pool), (void *)&q_node) == 0) {
6467c478bd9Sstevel@tonic-gate free(q_node);
6477c478bd9Sstevel@tonic-gate }
6487c478bd9Sstevel@tonic-gate audit_queue_destroy(&(p->plg_pool));
6497c478bd9Sstevel@tonic-gate
6507c478bd9Sstevel@tonic-gate while (audit_dequeue(&(p->plg_queue), (void *)&q_node) == 0) {
6517c478bd9Sstevel@tonic-gate b_node = audit_release(&b_refcnt_lock, q_node->aqq_data);
6527c478bd9Sstevel@tonic-gate if (b_node != NULL)
6537c478bd9Sstevel@tonic-gate audit_enqueue(&b_pool, b_node);
6547c478bd9Sstevel@tonic-gate free(q_node);
6557c478bd9Sstevel@tonic-gate }
6567c478bd9Sstevel@tonic-gate audit_queue_destroy(&(p->plg_queue));
6577c478bd9Sstevel@tonic-gate }
6587c478bd9Sstevel@tonic-gate
6597c478bd9Sstevel@tonic-gate /*
6607c478bd9Sstevel@tonic-gate * qpool_withdraw
6617c478bd9Sstevel@tonic-gate */
6627c478bd9Sstevel@tonic-gate static audit_q_t *
qpool_withdraw(plugin_t * p)6637c478bd9Sstevel@tonic-gate qpool_withdraw(plugin_t *p)
6647c478bd9Sstevel@tonic-gate {
6657c478bd9Sstevel@tonic-gate audit_q_t *node;
6667c478bd9Sstevel@tonic-gate int rc;
6677c478bd9Sstevel@tonic-gate
6687c478bd9Sstevel@tonic-gate /* get a buffer from the pool, if any */
6697c478bd9Sstevel@tonic-gate rc = audit_dequeue(&(p->plg_pool), (void *)&node);
6707c478bd9Sstevel@tonic-gate if (rc == 0)
6717c478bd9Sstevel@tonic-gate return (node);
6727c478bd9Sstevel@tonic-gate
6737c478bd9Sstevel@tonic-gate /*
6747c478bd9Sstevel@tonic-gate * the pool is empty: allocate a new element
6757c478bd9Sstevel@tonic-gate */
6767c478bd9Sstevel@tonic-gate node = malloc(sizeof (audit_q_t));
6777c478bd9Sstevel@tonic-gate
6787c478bd9Sstevel@tonic-gate if (node == NULL)
6797c478bd9Sstevel@tonic-gate warn_or_fatal(1, gettext("no memory\n"));
6807c478bd9Sstevel@tonic-gate /* doesn't return */
6817c478bd9Sstevel@tonic-gate
6827c478bd9Sstevel@tonic-gate return (node);
6837c478bd9Sstevel@tonic-gate }
6847c478bd9Sstevel@tonic-gate
6857c478bd9Sstevel@tonic-gate /*
6867c478bd9Sstevel@tonic-gate * bpool_withdraw -- gets a buffer and fills it
6877c478bd9Sstevel@tonic-gate *
6887c478bd9Sstevel@tonic-gate */
6897c478bd9Sstevel@tonic-gate static audit_rec_t *
bpool_withdraw(char * buffer,size_t buff_size,size_t request_size)6907c478bd9Sstevel@tonic-gate bpool_withdraw(char *buffer, size_t buff_size, size_t request_size)
6917c478bd9Sstevel@tonic-gate {
6927c478bd9Sstevel@tonic-gate audit_rec_t *node;
6937c478bd9Sstevel@tonic-gate int rc;
6947c478bd9Sstevel@tonic-gate size_t new_length;
6957c478bd9Sstevel@tonic-gate
6967c478bd9Sstevel@tonic-gate new_length = (request_size > DEFAULT_BUF_SZ) ?
6977c478bd9Sstevel@tonic-gate request_size : DEFAULT_BUF_SZ;
6987c478bd9Sstevel@tonic-gate
6997c478bd9Sstevel@tonic-gate /* get a buffer from the pool, if any */
7007c478bd9Sstevel@tonic-gate rc = audit_dequeue(&b_pool, (void *)&node);
7017c478bd9Sstevel@tonic-gate
7027c478bd9Sstevel@tonic-gate DPRINT((dbfp, "bpool_withdraw buf length=%d,"
7037c478bd9Sstevel@tonic-gate " requested size=%d, dequeue rc=%d\n",
7047c478bd9Sstevel@tonic-gate new_length, request_size, rc));
7057c478bd9Sstevel@tonic-gate
7067c478bd9Sstevel@tonic-gate if (rc == 0) {
707dfc7be02SJan Friedel DPRINT((dbfp, "bpool_withdraw node=%p (pool=%d)\n",
708dfc7be02SJan Friedel (void *)node, audit_queue_size(&b_pool)));
7097c478bd9Sstevel@tonic-gate
7107c478bd9Sstevel@tonic-gate if (new_length > node->abq_buf_len) {
7117c478bd9Sstevel@tonic-gate node = realloc(node, AUDIT_REC_HEADER + new_length);
7127c478bd9Sstevel@tonic-gate if (node == NULL)
7137c478bd9Sstevel@tonic-gate warn_or_fatal(1, gettext("no memory\n"));
7147c478bd9Sstevel@tonic-gate /* no return */
7157c478bd9Sstevel@tonic-gate }
7167c478bd9Sstevel@tonic-gate } else {
7177c478bd9Sstevel@tonic-gate /*
7187c478bd9Sstevel@tonic-gate * the pool is empty: allocate a new element
7197c478bd9Sstevel@tonic-gate */
7207c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&b_alloc_lock);
7217c478bd9Sstevel@tonic-gate if (b_allocated >= largest_queue) {
7227c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&b_alloc_lock);
7237c478bd9Sstevel@tonic-gate DPRINT((dbfp, "bpool_withdraw is over max (pool=%d)\n",
7247c478bd9Sstevel@tonic-gate audit_queue_size(&b_pool)));
7257c478bd9Sstevel@tonic-gate return (NULL);
7267c478bd9Sstevel@tonic-gate }
7277c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&b_alloc_lock);
7287c478bd9Sstevel@tonic-gate
7297c478bd9Sstevel@tonic-gate node = malloc(AUDIT_REC_HEADER + new_length);
7307c478bd9Sstevel@tonic-gate
7317c478bd9Sstevel@tonic-gate if (node == NULL)
7327c478bd9Sstevel@tonic-gate warn_or_fatal(1, gettext("no memory\n"));
7337c478bd9Sstevel@tonic-gate /* no return */
7347c478bd9Sstevel@tonic-gate
7357c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&b_alloc_lock);
7367c478bd9Sstevel@tonic-gate b_allocated++;
7377c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&b_alloc_lock);
738dfc7be02SJan Friedel DPRINT((dbfp, "bpool_withdraw node=%p (alloc=%d, pool=%d)\n",
739dfc7be02SJan Friedel (void *)node, b_allocated, audit_queue_size(&b_pool)));
7407c478bd9Sstevel@tonic-gate }
7417c478bd9Sstevel@tonic-gate assert(request_size <= new_length);
7427c478bd9Sstevel@tonic-gate
7437c478bd9Sstevel@tonic-gate (void) memcpy(node->abq_buffer, buffer, buff_size);
7447c478bd9Sstevel@tonic-gate node->abq_data_len = buff_size;
7457c478bd9Sstevel@tonic-gate node->abq_buf_len = new_length;
7467c478bd9Sstevel@tonic-gate node->abq_ref_count = 0;
7477c478bd9Sstevel@tonic-gate
7487c478bd9Sstevel@tonic-gate return (node);
7497c478bd9Sstevel@tonic-gate }
7507c478bd9Sstevel@tonic-gate
7517c478bd9Sstevel@tonic-gate /*
7527c478bd9Sstevel@tonic-gate * qpool_return() moves queue nodes back to the pool queue.
7537c478bd9Sstevel@tonic-gate *
7547c478bd9Sstevel@tonic-gate * if the pool is over max, the node is discarded instead.
7557c478bd9Sstevel@tonic-gate */
7567c478bd9Sstevel@tonic-gate static void
qpool_return(plugin_t * p,audit_q_t * node)7577c478bd9Sstevel@tonic-gate qpool_return(plugin_t *p, audit_q_t *node)
7587c478bd9Sstevel@tonic-gate {
7597c478bd9Sstevel@tonic-gate int qpool_size;
7607c478bd9Sstevel@tonic-gate int q_size;
7617c478bd9Sstevel@tonic-gate
7627c478bd9Sstevel@tonic-gate #if DEBUG
7638f775e0aSJan Friedel uint64_t sequence = node->aqq_sequence;
7647c478bd9Sstevel@tonic-gate #endif
7657c478bd9Sstevel@tonic-gate qpool_size = audit_queue_size(&(p->plg_pool));
7667c478bd9Sstevel@tonic-gate q_size = audit_queue_size(&(p->plg_queue));
7677c478bd9Sstevel@tonic-gate
7687c478bd9Sstevel@tonic-gate if (qpool_size + q_size > p->plg_qmax)
7697c478bd9Sstevel@tonic-gate free(node);
7707c478bd9Sstevel@tonic-gate else
7717c478bd9Sstevel@tonic-gate audit_enqueue(&(p->plg_pool), node);
7727c478bd9Sstevel@tonic-gate
7737c478bd9Sstevel@tonic-gate DPRINT((dbfp,
7748f775e0aSJan Friedel "qpool_return(%d): seq=%llu, q size=%d,"
7757c478bd9Sstevel@tonic-gate " pool size=%d (total alloc=%d), threshhold=%d\n",
7767c478bd9Sstevel@tonic-gate p->plg_tid, sequence, q_size, qpool_size,
7777c478bd9Sstevel@tonic-gate q_size + qpool_size, p->plg_q_threshold));
7787c478bd9Sstevel@tonic-gate }
7797c478bd9Sstevel@tonic-gate
7807c478bd9Sstevel@tonic-gate /*
7817c478bd9Sstevel@tonic-gate * bpool_return() moves queue nodes back to the pool queue.
7827c478bd9Sstevel@tonic-gate */
7837c478bd9Sstevel@tonic-gate static void
bpool_return(audit_rec_t * node)7847c478bd9Sstevel@tonic-gate bpool_return(audit_rec_t *node)
7857c478bd9Sstevel@tonic-gate {
7867c478bd9Sstevel@tonic-gate #if DEBUG
7877c478bd9Sstevel@tonic-gate audit_rec_t *copy = node;
7887c478bd9Sstevel@tonic-gate #endif
7897c478bd9Sstevel@tonic-gate node = audit_release(&b_refcnt_lock, node); /* decrement ref cnt */
7907c478bd9Sstevel@tonic-gate
7917c478bd9Sstevel@tonic-gate if (node != NULL) { /* NULL if ref cnt is not zero */
7927c478bd9Sstevel@tonic-gate audit_enqueue(&b_pool, node);
7937c478bd9Sstevel@tonic-gate DPRINT((dbfp,
794dfc7be02SJan Friedel "bpool_return: requeue %p (allocated=%d,"
795dfc7be02SJan Friedel " pool size=%d)\n", (void *)node, b_allocated,
7967c478bd9Sstevel@tonic-gate audit_queue_size(&b_pool)));
7977c478bd9Sstevel@tonic-gate }
7987c478bd9Sstevel@tonic-gate #if DEBUG
7997c478bd9Sstevel@tonic-gate else {
8007c478bd9Sstevel@tonic-gate DPRINT((dbfp,
801dfc7be02SJan Friedel "bpool_return: decrement count for %p (allocated=%d,"
802dfc7be02SJan Friedel " pool size=%d)\n", (void *)copy, b_allocated,
8037c478bd9Sstevel@tonic-gate audit_queue_size(&b_pool)));
8047c478bd9Sstevel@tonic-gate }
8057c478bd9Sstevel@tonic-gate #endif
8067c478bd9Sstevel@tonic-gate }
8077c478bd9Sstevel@tonic-gate
8087c478bd9Sstevel@tonic-gate #if DEBUG
8097c478bd9Sstevel@tonic-gate static void
dump_state(char * src,plugin_t * p,uint64_t count,char * msg)8108f775e0aSJan Friedel dump_state(char *src, plugin_t *p, uint64_t count, char *msg)
8117c478bd9Sstevel@tonic-gate {
8127c478bd9Sstevel@tonic-gate struct sched_param param;
8137c478bd9Sstevel@tonic-gate int policy;
8147c478bd9Sstevel@tonic-gate /*
8157c478bd9Sstevel@tonic-gate * count is message sequence
8167c478bd9Sstevel@tonic-gate */
8177c478bd9Sstevel@tonic-gate (void) pthread_getschedparam(p->plg_tid, &policy, ¶m);
8188f775e0aSJan Friedel (void) fprintf(dbfp, "%7s(%d/%llu) %11s:"
8197c478bd9Sstevel@tonic-gate " input_in_wait=%d"
8207c478bd9Sstevel@tonic-gate " priority=%d"
8217c478bd9Sstevel@tonic-gate " queue size=%d pool size=%d"
8227c478bd9Sstevel@tonic-gate "\n\t"
8237c478bd9Sstevel@tonic-gate "process wait=%d"
8247c478bd9Sstevel@tonic-gate " tossed=%d"
8257c478bd9Sstevel@tonic-gate " queued=%d"
8267c478bd9Sstevel@tonic-gate " written=%d"
8277c478bd9Sstevel@tonic-gate "\n",
8287c478bd9Sstevel@tonic-gate src, p->plg_tid, count, msg,
8297c478bd9Sstevel@tonic-gate in_thr.thd_waiting, param.sched_priority,
8307c478bd9Sstevel@tonic-gate audit_queue_size(&(p->plg_queue)),
8317c478bd9Sstevel@tonic-gate audit_queue_size(&(p->plg_pool)),
8327c478bd9Sstevel@tonic-gate p->plg_waiting, p->plg_tossed,
8337c478bd9Sstevel@tonic-gate p->plg_queued, p->plg_output);
8347c478bd9Sstevel@tonic-gate
8357c478bd9Sstevel@tonic-gate (void) fflush(dbfp);
8367c478bd9Sstevel@tonic-gate }
8377c478bd9Sstevel@tonic-gate #endif
8387c478bd9Sstevel@tonic-gate
8397c478bd9Sstevel@tonic-gate /*
8407c478bd9Sstevel@tonic-gate * policy_is_block: return 1 if the continue policy is off for any active
8417c478bd9Sstevel@tonic-gate * plugin, else 0
8427c478bd9Sstevel@tonic-gate */
8437c478bd9Sstevel@tonic-gate static int
policy_is_block()8447c478bd9Sstevel@tonic-gate policy_is_block()
8457c478bd9Sstevel@tonic-gate {
8467c478bd9Sstevel@tonic-gate plugin_t *p;
8477c478bd9Sstevel@tonic-gate
8487c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&plugin_mutex);
8497c478bd9Sstevel@tonic-gate p = plugin_head;
8507c478bd9Sstevel@tonic-gate
8517c478bd9Sstevel@tonic-gate while (p != NULL) {
8527c478bd9Sstevel@tonic-gate if (p->plg_cnt == 0) {
8537c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&plugin_mutex);
8547c478bd9Sstevel@tonic-gate DPRINT((dbfp,
8557c478bd9Sstevel@tonic-gate "policy_is_block: policy is to block\n"));
8567c478bd9Sstevel@tonic-gate return (1);
8577c478bd9Sstevel@tonic-gate }
8587c478bd9Sstevel@tonic-gate p = p->plg_next;
8597c478bd9Sstevel@tonic-gate }
8607c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&plugin_mutex);
8617c478bd9Sstevel@tonic-gate DPRINT((dbfp, "policy_is_block: policy is to continue\n"));
8627c478bd9Sstevel@tonic-gate return (0);
8637c478bd9Sstevel@tonic-gate }
8647c478bd9Sstevel@tonic-gate
8657c478bd9Sstevel@tonic-gate /*
8667c478bd9Sstevel@tonic-gate * policy_update() -- the kernel has received a policy change.
8677c478bd9Sstevel@tonic-gate * Presently, the only policy auditd cares about is AUDIT_CNT
8687c478bd9Sstevel@tonic-gate */
8697c478bd9Sstevel@tonic-gate static void
policy_update(uint32_t newpolicy)8707c478bd9Sstevel@tonic-gate policy_update(uint32_t newpolicy)
8717c478bd9Sstevel@tonic-gate {
8727c478bd9Sstevel@tonic-gate plugin_t *p;
8737c478bd9Sstevel@tonic-gate
8747c478bd9Sstevel@tonic-gate DPRINT((dbfp, "policy change: %X\n", newpolicy));
8757c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&plugin_mutex);
8767c478bd9Sstevel@tonic-gate p = plugin_head;
8777c478bd9Sstevel@tonic-gate while (p != NULL) {
8787c478bd9Sstevel@tonic-gate p->plg_cnt = (newpolicy & AUDIT_CNT) ? 1 : 0;
8797c478bd9Sstevel@tonic-gate (void) pthread_cond_signal(&(p->plg_cv));
8807c478bd9Sstevel@tonic-gate
8817c478bd9Sstevel@tonic-gate DPRINT((dbfp, "policy changed for thread %d\n", p->plg_tid));
8827c478bd9Sstevel@tonic-gate p = p->plg_next;
8837c478bd9Sstevel@tonic-gate }
8847c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&plugin_mutex);
8857c478bd9Sstevel@tonic-gate }
8867c478bd9Sstevel@tonic-gate
8877c478bd9Sstevel@tonic-gate /*
8887c478bd9Sstevel@tonic-gate * queue_buffer() inputs a buffer and queues for each active plugin if
8897c478bd9Sstevel@tonic-gate * it represents a complete audit record. Otherwise it builds a
8907c478bd9Sstevel@tonic-gate * larger buffer to hold the record and take successive buffers from
8917c478bd9Sstevel@tonic-gate * c2audit to build a complete record; then queues it for each plugin.
8927c478bd9Sstevel@tonic-gate *
8937c478bd9Sstevel@tonic-gate * return 0 if data is queued (or damaged and tossed). If resources
8947c478bd9Sstevel@tonic-gate * are not available, return 0 if all active plugins have the cnt
8957c478bd9Sstevel@tonic-gate * policy set, else 1. 0 is also returned if the input is a control
8967c478bd9Sstevel@tonic-gate * message. (aub_buf is aligned on a 64 bit boundary, so casting
8977c478bd9Sstevel@tonic-gate * it to an integer works just fine.)
8987c478bd9Sstevel@tonic-gate */
8997c478bd9Sstevel@tonic-gate static int
queue_buffer(au_dbuf_t * kl)9007c478bd9Sstevel@tonic-gate queue_buffer(au_dbuf_t *kl)
9017c478bd9Sstevel@tonic-gate {
9027c478bd9Sstevel@tonic-gate plugin_t *p;
9037c478bd9Sstevel@tonic-gate audit_rec_t *b_copy;
9047c478bd9Sstevel@tonic-gate audit_q_t *q_copy;
9057c478bd9Sstevel@tonic-gate boolean_t referenced = 0;
9067c478bd9Sstevel@tonic-gate static char *invalid_msg = "invalid audit record discarded";
9071a578a15Spaulson static char *invalid_control = "invalid audit control discarded";
9087c478bd9Sstevel@tonic-gate
9097c478bd9Sstevel@tonic-gate static audit_rec_t *alt_b_copy = NULL;
9107c478bd9Sstevel@tonic-gate static size_t alt_length;
9117c478bd9Sstevel@tonic-gate static size_t alt_offset;
9127c478bd9Sstevel@tonic-gate
9137c478bd9Sstevel@tonic-gate /*
9147c478bd9Sstevel@tonic-gate * the buffer may be a kernel -> auditd message. (only
9157c478bd9Sstevel@tonic-gate * the policy change message exists so far.)
9167c478bd9Sstevel@tonic-gate */
9177c478bd9Sstevel@tonic-gate
9187c478bd9Sstevel@tonic-gate if ((kl->aub_type & AU_DBUF_NOTIFY) != 0) {
9197c478bd9Sstevel@tonic-gate uint32_t control;
9207c478bd9Sstevel@tonic-gate
9217c478bd9Sstevel@tonic-gate control = kl->aub_type & ~AU_DBUF_NOTIFY;
9227c478bd9Sstevel@tonic-gate switch (control) {
9237c478bd9Sstevel@tonic-gate case AU_DBUF_POLICY:
9247c478bd9Sstevel@tonic-gate /* LINTED */
9257c478bd9Sstevel@tonic-gate policy_update(*(uint32_t *)kl->aub_buf);
9267c478bd9Sstevel@tonic-gate break;
9277c478bd9Sstevel@tonic-gate case AU_DBUF_SHUTDOWN:
928*f8994074SJan Friedel (void) kill(getpid(), SIGTERM);
9297c478bd9Sstevel@tonic-gate DPRINT((dbfp, "AU_DBUF_SHUTDOWN message\n"));
9307c478bd9Sstevel@tonic-gate break;
9317c478bd9Sstevel@tonic-gate default:
9327c478bd9Sstevel@tonic-gate warn_or_fatal(0, gettext(invalid_control));
9337c478bd9Sstevel@tonic-gate break;
9347c478bd9Sstevel@tonic-gate }
9357c478bd9Sstevel@tonic-gate return (0);
9367c478bd9Sstevel@tonic-gate }
9377c478bd9Sstevel@tonic-gate /*
9387c478bd9Sstevel@tonic-gate * The test for valid continuation/completion may fail. Need to
9397c478bd9Sstevel@tonic-gate * assume the failure was earlier and that this buffer may
9407c478bd9Sstevel@tonic-gate * be a valid first or complete buffer after discarding the
9417c478bd9Sstevel@tonic-gate * incomplete record
9427c478bd9Sstevel@tonic-gate */
9437c478bd9Sstevel@tonic-gate
9447c478bd9Sstevel@tonic-gate if (alt_b_copy != NULL) {
9457c478bd9Sstevel@tonic-gate if ((kl->aub_type == AU_DBUF_FIRST) ||
9467c478bd9Sstevel@tonic-gate (kl->aub_type == AU_DBUF_COMPLETE)) {
9477c478bd9Sstevel@tonic-gate DPRINT((dbfp, "copy is not null, partial is %d\n",
9487c478bd9Sstevel@tonic-gate kl->aub_type));
9497c478bd9Sstevel@tonic-gate bpool_return(alt_b_copy);
9507c478bd9Sstevel@tonic-gate warn_or_fatal(0, gettext(invalid_msg));
9517c478bd9Sstevel@tonic-gate alt_b_copy = NULL;
9527c478bd9Sstevel@tonic-gate }
9537c478bd9Sstevel@tonic-gate }
9547c478bd9Sstevel@tonic-gate if (alt_b_copy != NULL) { /* continue collecting a long record */
9557c478bd9Sstevel@tonic-gate if (kl->aub_size + alt_offset > alt_length) {
9567c478bd9Sstevel@tonic-gate bpool_return(alt_b_copy);
9577c478bd9Sstevel@tonic-gate alt_b_copy = NULL;
9587c478bd9Sstevel@tonic-gate warn_or_fatal(0, gettext(invalid_msg));
9597c478bd9Sstevel@tonic-gate return (0);
9607c478bd9Sstevel@tonic-gate }
9617c478bd9Sstevel@tonic-gate (void) memcpy(alt_b_copy->abq_buffer + alt_offset, kl->aub_buf,
9627c478bd9Sstevel@tonic-gate kl->aub_size);
9637c478bd9Sstevel@tonic-gate alt_offset += kl->aub_size;
9647c478bd9Sstevel@tonic-gate if (kl->aub_type == AU_DBUF_MIDDLE)
9657c478bd9Sstevel@tonic-gate return (0);
9667c478bd9Sstevel@tonic-gate b_copy = alt_b_copy;
9677c478bd9Sstevel@tonic-gate alt_b_copy = NULL;
9687c478bd9Sstevel@tonic-gate b_copy->abq_data_len = alt_length;
9697c478bd9Sstevel@tonic-gate } else if (kl->aub_type == AU_DBUF_FIRST) {
9707c478bd9Sstevel@tonic-gate /* first buffer of a multiple buffer record */
9717c478bd9Sstevel@tonic-gate alt_length = getlen(kl->aub_buf);
9727c478bd9Sstevel@tonic-gate if ((alt_length < MIN_RECORD_SIZE) ||
9737c478bd9Sstevel@tonic-gate (alt_length <= kl->aub_size)) {
9747c478bd9Sstevel@tonic-gate warn_or_fatal(0, gettext(invalid_msg));
9757c478bd9Sstevel@tonic-gate return (0);
9767c478bd9Sstevel@tonic-gate }
9777c478bd9Sstevel@tonic-gate alt_b_copy = bpool_withdraw(kl->aub_buf, kl->aub_size,
9787c478bd9Sstevel@tonic-gate alt_length);
9797c478bd9Sstevel@tonic-gate
9807c478bd9Sstevel@tonic-gate if (alt_b_copy == NULL)
9817c478bd9Sstevel@tonic-gate return (policy_is_block());
9827c478bd9Sstevel@tonic-gate
9837c478bd9Sstevel@tonic-gate alt_offset = kl->aub_size;
9847c478bd9Sstevel@tonic-gate return (0);
9857c478bd9Sstevel@tonic-gate } else { /* one buffer, one record -- the basic case */
9867c478bd9Sstevel@tonic-gate if (kl->aub_type != AU_DBUF_COMPLETE) {
9877c478bd9Sstevel@tonic-gate DPRINT((dbfp, "copy is null, partial is %d\n",
9887c478bd9Sstevel@tonic-gate kl->aub_type));
9897c478bd9Sstevel@tonic-gate warn_or_fatal(0, gettext(invalid_msg));
9907c478bd9Sstevel@tonic-gate return (0); /* tossed */
9917c478bd9Sstevel@tonic-gate }
9927c478bd9Sstevel@tonic-gate b_copy = bpool_withdraw(kl->aub_buf, kl->aub_size,
9937c478bd9Sstevel@tonic-gate kl->aub_size);
9947c478bd9Sstevel@tonic-gate
9957c478bd9Sstevel@tonic-gate if (b_copy == NULL)
9967c478bd9Sstevel@tonic-gate return (policy_is_block());
9977c478bd9Sstevel@tonic-gate }
9987c478bd9Sstevel@tonic-gate
9997c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&plugin_mutex);
10007c478bd9Sstevel@tonic-gate p = plugin_head;
10017c478bd9Sstevel@tonic-gate while (p != NULL) {
10027c478bd9Sstevel@tonic-gate if (!p->plg_removed) {
10037c478bd9Sstevel@tonic-gate /*
10047c478bd9Sstevel@tonic-gate * Link the record buffer to the input queues.
10057c478bd9Sstevel@tonic-gate * To avoid a race, it is necessary to wait
10067c478bd9Sstevel@tonic-gate * until all reference count increments
10077c478bd9Sstevel@tonic-gate * are complete before queueing q_copy.
10087c478bd9Sstevel@tonic-gate */
10097c478bd9Sstevel@tonic-gate audit_incr_ref(&b_refcnt_lock, b_copy);
10107c478bd9Sstevel@tonic-gate
10117c478bd9Sstevel@tonic-gate q_copy = qpool_withdraw(p);
10127c478bd9Sstevel@tonic-gate q_copy->aqq_sequence = p->plg_sequence++;
10137c478bd9Sstevel@tonic-gate q_copy->aqq_data = b_copy;
10147c478bd9Sstevel@tonic-gate
10157c478bd9Sstevel@tonic-gate p->plg_save_q_copy = q_copy; /* enqueue below */
10167c478bd9Sstevel@tonic-gate referenced = 1;
10177c478bd9Sstevel@tonic-gate } else
10187c478bd9Sstevel@tonic-gate p->plg_save_q_copy = NULL;
10197c478bd9Sstevel@tonic-gate p = p->plg_next;
10207c478bd9Sstevel@tonic-gate }
10217c478bd9Sstevel@tonic-gate /*
10227c478bd9Sstevel@tonic-gate * now that the reference count is updated, queue it.
10237c478bd9Sstevel@tonic-gate */
10247c478bd9Sstevel@tonic-gate if (referenced) {
10257c478bd9Sstevel@tonic-gate p = plugin_head;
10267c478bd9Sstevel@tonic-gate while ((p != NULL) && (p->plg_save_q_copy != NULL)) {
10277c478bd9Sstevel@tonic-gate audit_enqueue(&(p->plg_queue), p->plg_save_q_copy);
10287c478bd9Sstevel@tonic-gate (void) pthread_cond_signal(&(p->plg_cv));
10297c478bd9Sstevel@tonic-gate p->plg_queued++;
10307c478bd9Sstevel@tonic-gate p = p->plg_next;
10317c478bd9Sstevel@tonic-gate }
10327c478bd9Sstevel@tonic-gate } else
10337c478bd9Sstevel@tonic-gate bpool_return(b_copy);
10347c478bd9Sstevel@tonic-gate
10357c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&plugin_mutex);
10367c478bd9Sstevel@tonic-gate
10377c478bd9Sstevel@tonic-gate return (0);
10387c478bd9Sstevel@tonic-gate }
10397c478bd9Sstevel@tonic-gate
10407c478bd9Sstevel@tonic-gate /*
10417c478bd9Sstevel@tonic-gate * wait_a_while() -- timed wait in the door server to allow output
10427c478bd9Sstevel@tonic-gate * time to catch up.
10437c478bd9Sstevel@tonic-gate */
10447c478bd9Sstevel@tonic-gate static void
wait_a_while()1045*f8994074SJan Friedel wait_a_while()
1046*f8994074SJan Friedel {
10477c478bd9Sstevel@tonic-gate struct timespec delay = {0, 500000000}; /* 1/2 second */;
10487c478bd9Sstevel@tonic-gate
10497c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&(in_thr.thd_mutex));
10507c478bd9Sstevel@tonic-gate in_thr.thd_waiting = 1;
10517c478bd9Sstevel@tonic-gate (void) pthread_cond_reltimedwait_np(&(in_thr.thd_cv),
10527c478bd9Sstevel@tonic-gate &(in_thr.thd_mutex), &delay);
10537c478bd9Sstevel@tonic-gate in_thr.thd_waiting = 0;
10547c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&(in_thr.thd_mutex));
10557c478bd9Sstevel@tonic-gate }
10567c478bd9Sstevel@tonic-gate
10577c478bd9Sstevel@tonic-gate /*
10587c478bd9Sstevel@tonic-gate * adjust_priority() -- check queue and pools and adjust the priority
10597c478bd9Sstevel@tonic-gate * for process() accordingly. If we're way ahead of output, do a
10607c478bd9Sstevel@tonic-gate * timed wait as well.
10617c478bd9Sstevel@tonic-gate */
10627c478bd9Sstevel@tonic-gate static void
adjust_priority()1063*f8994074SJan Friedel adjust_priority()
1064*f8994074SJan Friedel {
10657c478bd9Sstevel@tonic-gate int queue_near_full;
10667c478bd9Sstevel@tonic-gate plugin_t *p;
10677c478bd9Sstevel@tonic-gate int queue_size;
10687c478bd9Sstevel@tonic-gate struct sched_param param;
10697c478bd9Sstevel@tonic-gate
10707c478bd9Sstevel@tonic-gate queue_near_full = 0;
10717c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&plugin_mutex);
10727c478bd9Sstevel@tonic-gate p = plugin_head;
10737c478bd9Sstevel@tonic-gate while (p != NULL) {
10747c478bd9Sstevel@tonic-gate queue_size = audit_queue_size(&(p->plg_queue));
10757c478bd9Sstevel@tonic-gate if (queue_size > p->plg_q_threshold) {
10767c478bd9Sstevel@tonic-gate if (p->plg_priority != HIGH_PRIORITY) {
10777c478bd9Sstevel@tonic-gate p->plg_priority =
10787c478bd9Sstevel@tonic-gate param.sched_priority =
10797c478bd9Sstevel@tonic-gate HIGH_PRIORITY;
10807c478bd9Sstevel@tonic-gate (void) pthread_setschedparam(p->plg_tid,
10817c478bd9Sstevel@tonic-gate SCHED_OTHER, ¶m);
10827c478bd9Sstevel@tonic-gate }
10837c478bd9Sstevel@tonic-gate if (queue_size > p->plg_qmax - p->plg_qmin) {
10847c478bd9Sstevel@tonic-gate queue_near_full = 1;
10857c478bd9Sstevel@tonic-gate break;
10867c478bd9Sstevel@tonic-gate }
10877c478bd9Sstevel@tonic-gate }
10887c478bd9Sstevel@tonic-gate p = p->plg_next;
10897c478bd9Sstevel@tonic-gate }
10907c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&plugin_mutex);
10917c478bd9Sstevel@tonic-gate
10927c478bd9Sstevel@tonic-gate if (queue_near_full) {
10937c478bd9Sstevel@tonic-gate DPRINT((dbfp,
10947c478bd9Sstevel@tonic-gate "adjust_priority: input taking a short break\n"));
10957c478bd9Sstevel@tonic-gate wait_a_while();
10967c478bd9Sstevel@tonic-gate DPRINT((dbfp,
10977c478bd9Sstevel@tonic-gate "adjust_priority: input back from my break\n"));
10987c478bd9Sstevel@tonic-gate }
10997c478bd9Sstevel@tonic-gate }
11007c478bd9Sstevel@tonic-gate
11017c478bd9Sstevel@tonic-gate /*
11027c478bd9Sstevel@tonic-gate * input() is a door server; it blocks if any plugins have full queues
1103*f8994074SJan Friedel * with the continue policy off. (auditconfig -setpolicy -cnt)
11047c478bd9Sstevel@tonic-gate *
11057c478bd9Sstevel@tonic-gate * input() is called synchronously from c2audit and is NOT
11067c478bd9Sstevel@tonic-gate * reentrant due to the (unprotected) static variables in
11077c478bd9Sstevel@tonic-gate * queue_buffer(). If multiple clients are created, a context
11087c478bd9Sstevel@tonic-gate * structure will be required for queue_buffer.
11097c478bd9Sstevel@tonic-gate *
11107c478bd9Sstevel@tonic-gate * timedwait is used when input() gets too far ahead of process();
11117c478bd9Sstevel@tonic-gate * the wait terminates either when the set time expires or when
11127c478bd9Sstevel@tonic-gate * process() signals that it has nearly caught up.
11137c478bd9Sstevel@tonic-gate */
11147c478bd9Sstevel@tonic-gate /* ARGSUSED */
11157c478bd9Sstevel@tonic-gate static void
input(void * cookie,void * argp,int arg_size,door_desc_t * dp,int n_descriptors)11167c478bd9Sstevel@tonic-gate input(void *cookie, void *argp, int arg_size, door_desc_t *dp,
11177c478bd9Sstevel@tonic-gate int n_descriptors)
11187c478bd9Sstevel@tonic-gate {
11197c478bd9Sstevel@tonic-gate int is_blocked;
11207c478bd9Sstevel@tonic-gate plugin_t *p;
11217c478bd9Sstevel@tonic-gate #if DEBUG
11227c478bd9Sstevel@tonic-gate int loop_count = 0;
11237c478bd9Sstevel@tonic-gate static int call_counter = 0;
11247c478bd9Sstevel@tonic-gate #endif
11257c478bd9Sstevel@tonic-gate if (argp == NULL) {
11267c478bd9Sstevel@tonic-gate warn_or_fatal(0,
11277c478bd9Sstevel@tonic-gate gettext("invalid data received from c2audit\n"));
11287c478bd9Sstevel@tonic-gate goto input_exit;
11297c478bd9Sstevel@tonic-gate }
11307c478bd9Sstevel@tonic-gate DPRINT((dbfp, "%d input new buffer: length=%u, "
11317c478bd9Sstevel@tonic-gate "partial=%u, arg_size=%d\n",
11327c478bd9Sstevel@tonic-gate ++call_counter, ((au_dbuf_t *)argp)->aub_size,
11337c478bd9Sstevel@tonic-gate ((au_dbuf_t *)argp)->aub_type, arg_size));
11347c478bd9Sstevel@tonic-gate
11357c478bd9Sstevel@tonic-gate if (((au_dbuf_t *)argp)->aub_size < 1) {
11367c478bd9Sstevel@tonic-gate warn_or_fatal(0,
11377c478bd9Sstevel@tonic-gate gettext("invalid data length received from c2audit\n"));
11387c478bd9Sstevel@tonic-gate goto input_exit;
11397c478bd9Sstevel@tonic-gate }
11407c478bd9Sstevel@tonic-gate /*
11417c478bd9Sstevel@tonic-gate * is_blocked is true only if one or more plugins have "no
11427c478bd9Sstevel@tonic-gate * continue" (-cnt) set and one of those has a full queue.
11437c478bd9Sstevel@tonic-gate * All plugins block until success is met.
11447c478bd9Sstevel@tonic-gate */
11457c478bd9Sstevel@tonic-gate for (;;) {
11467c478bd9Sstevel@tonic-gate DPRINT((dbfp, "%d input is calling queue_buffer\n",
11477c478bd9Sstevel@tonic-gate call_counter));
11487c478bd9Sstevel@tonic-gate
11497c478bd9Sstevel@tonic-gate is_blocked = queue_buffer((au_dbuf_t *)argp);
11507c478bd9Sstevel@tonic-gate
11517c478bd9Sstevel@tonic-gate if (!is_blocked) {
11527c478bd9Sstevel@tonic-gate adjust_priority();
11537c478bd9Sstevel@tonic-gate break;
11547c478bd9Sstevel@tonic-gate } else {
11557c478bd9Sstevel@tonic-gate DPRINT((dbfp,
11567c478bd9Sstevel@tonic-gate "%d input blocked (loop=%d)\n",
11577c478bd9Sstevel@tonic-gate call_counter, loop_count));
11587c478bd9Sstevel@tonic-gate
11597c478bd9Sstevel@tonic-gate wait_a_while();
11607c478bd9Sstevel@tonic-gate
11617c478bd9Sstevel@tonic-gate DPRINT((dbfp, "%d input unblocked (loop=%d)\n",
11627c478bd9Sstevel@tonic-gate call_counter, loop_count));
11637c478bd9Sstevel@tonic-gate }
11647c478bd9Sstevel@tonic-gate #if DEBUG
11657c478bd9Sstevel@tonic-gate loop_count++;
11667c478bd9Sstevel@tonic-gate #endif
11677c478bd9Sstevel@tonic-gate }
11687c478bd9Sstevel@tonic-gate input_exit:
11697c478bd9Sstevel@tonic-gate p = plugin_head;
11707c478bd9Sstevel@tonic-gate while (p != NULL) {
11717c478bd9Sstevel@tonic-gate (void) pthread_cond_signal(&(p->plg_cv));
11727c478bd9Sstevel@tonic-gate p = p->plg_next;
11737c478bd9Sstevel@tonic-gate }
11747c478bd9Sstevel@tonic-gate ((au_dbuf_t *)argp)->aub_size = 0; /* return code */
11757c478bd9Sstevel@tonic-gate (void) door_return(argp, sizeof (uint64_t), NULL, 0);
11767c478bd9Sstevel@tonic-gate }
11777c478bd9Sstevel@tonic-gate
11787c478bd9Sstevel@tonic-gate /*
11797c478bd9Sstevel@tonic-gate * process() -- pass a buffer to a plugin
11807c478bd9Sstevel@tonic-gate */
11817c478bd9Sstevel@tonic-gate static void
process(plugin_t * p)11827c478bd9Sstevel@tonic-gate process(plugin_t *p)
11837c478bd9Sstevel@tonic-gate {
11847c478bd9Sstevel@tonic-gate int rc;
11857c478bd9Sstevel@tonic-gate audit_rec_t *b_node;
11867c478bd9Sstevel@tonic-gate audit_q_t *q_node;
11877c478bd9Sstevel@tonic-gate auditd_rc_t plugrc;
11887c478bd9Sstevel@tonic-gate char *error_string;
11897c478bd9Sstevel@tonic-gate struct timespec delay;
11907c478bd9Sstevel@tonic-gate int sendsignal;
11917c478bd9Sstevel@tonic-gate int queue_len;
11927c478bd9Sstevel@tonic-gate struct sched_param param;
11931a578a15Spaulson static boolean_t once = B_FALSE;
11947c478bd9Sstevel@tonic-gate
11957c478bd9Sstevel@tonic-gate DPRINT((dbfp, "%s is thread %d\n", p->plg_path, p->plg_tid));
11967c478bd9Sstevel@tonic-gate p->plg_priority = param.sched_priority = BASE_PRIORITY;
11977c478bd9Sstevel@tonic-gate (void) pthread_setschedparam(p->plg_tid, SCHED_OTHER, ¶m);
11987c478bd9Sstevel@tonic-gate
11997c478bd9Sstevel@tonic-gate delay.tv_nsec = 0;
12007c478bd9Sstevel@tonic-gate
12017c478bd9Sstevel@tonic-gate for (;;) {
12027c478bd9Sstevel@tonic-gate while (audit_dequeue(&(p->plg_queue), (void *)&q_node) != 0) {
12037c478bd9Sstevel@tonic-gate DUMP("process", p, p->plg_last_seq_out, "blocked");
12047c478bd9Sstevel@tonic-gate (void) pthread_cond_signal(&(in_thr.thd_cv));
12057c478bd9Sstevel@tonic-gate
12067c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&(p->plg_mutex));
12077c478bd9Sstevel@tonic-gate p->plg_waiting++;
12087c478bd9Sstevel@tonic-gate (void) pthread_cond_wait(&(p->plg_cv),
12097c478bd9Sstevel@tonic-gate &(p->plg_mutex));
12107c478bd9Sstevel@tonic-gate p->plg_waiting--;
12117c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&(p->plg_mutex));
12127c478bd9Sstevel@tonic-gate
12137c478bd9Sstevel@tonic-gate if (p->plg_removed)
12141a578a15Spaulson goto plugin_removed;
12157c478bd9Sstevel@tonic-gate
12167c478bd9Sstevel@tonic-gate DUMP("process", p, p->plg_last_seq_out, "unblocked");
12177c478bd9Sstevel@tonic-gate }
12187c478bd9Sstevel@tonic-gate #if DEBUG
12197c478bd9Sstevel@tonic-gate if (q_node->aqq_sequence != p->plg_last_seq_out + 1)
12207c478bd9Sstevel@tonic-gate (void) fprintf(dbfp,
12218f775e0aSJan Friedel "process(%d): buffer sequence=%llu but prev=%llu\n",
12227c478bd9Sstevel@tonic-gate p->plg_tid, q_node->aqq_sequence,
12237c478bd9Sstevel@tonic-gate p->plg_last_seq_out);
12247c478bd9Sstevel@tonic-gate #endif
12257c478bd9Sstevel@tonic-gate error_string = NULL;
12267c478bd9Sstevel@tonic-gate
12277c478bd9Sstevel@tonic-gate b_node = q_node->aqq_data;
12281a578a15Spaulson retry_mode:
12297c478bd9Sstevel@tonic-gate plugrc = p->plg_fplugin(b_node->abq_buffer,
12301a578a15Spaulson b_node->abq_data_len, q_node->aqq_sequence, &error_string);
12311a578a15Spaulson
12321a578a15Spaulson if (p->plg_removed)
12331a578a15Spaulson goto plugin_removed;
12347c478bd9Sstevel@tonic-gate #if DEBUG
12357c478bd9Sstevel@tonic-gate p->plg_last_seq_out = q_node->aqq_sequence;
12367c478bd9Sstevel@tonic-gate #endif
12377c478bd9Sstevel@tonic-gate switch (plugrc) {
12387c478bd9Sstevel@tonic-gate case AUDITD_RETRY:
12391a578a15Spaulson if (!once) {
12407c478bd9Sstevel@tonic-gate report_error(plugrc, error_string, p->plg_path);
12411a578a15Spaulson once = B_TRUE;
12421a578a15Spaulson }
12437c478bd9Sstevel@tonic-gate free(error_string);
12447c478bd9Sstevel@tonic-gate error_string = NULL;
12457c478bd9Sstevel@tonic-gate
12467c478bd9Sstevel@tonic-gate DPRINT((dbfp, "process(%d) AUDITD_RETRY returned."
12477c478bd9Sstevel@tonic-gate " cnt=%d (if 1, enter retry)\n",
12487c478bd9Sstevel@tonic-gate p->plg_tid, p->plg_cnt));
12497c478bd9Sstevel@tonic-gate
12507c478bd9Sstevel@tonic-gate if (p->plg_cnt) /* if cnt is on, lose the buffer */
12517c478bd9Sstevel@tonic-gate break;
12527c478bd9Sstevel@tonic-gate
12537c478bd9Sstevel@tonic-gate delay.tv_sec = p->plg_retry_time;
12547c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&(p->plg_mutex));
12557c478bd9Sstevel@tonic-gate p->plg_waiting++;
12567c478bd9Sstevel@tonic-gate (void) pthread_cond_reltimedwait_np(&(p->plg_cv),
12577c478bd9Sstevel@tonic-gate &(p->plg_mutex), &delay);
12587c478bd9Sstevel@tonic-gate p->plg_waiting--;
12597c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&(p->plg_mutex));
12607c478bd9Sstevel@tonic-gate
12617c478bd9Sstevel@tonic-gate DPRINT((dbfp, "left retry mode for %d\n", p->plg_tid));
12627c478bd9Sstevel@tonic-gate goto retry_mode;
12637c478bd9Sstevel@tonic-gate
12647c478bd9Sstevel@tonic-gate case AUDITD_SUCCESS:
12657c478bd9Sstevel@tonic-gate p->plg_output++;
12661a578a15Spaulson once = B_FALSE;
12677c478bd9Sstevel@tonic-gate break;
12687c478bd9Sstevel@tonic-gate default:
12697c478bd9Sstevel@tonic-gate report_error(plugrc, error_string, p->plg_path);
12707c478bd9Sstevel@tonic-gate free(error_string);
12717c478bd9Sstevel@tonic-gate error_string = NULL;
12727c478bd9Sstevel@tonic-gate break;
12737c478bd9Sstevel@tonic-gate } /* end switch */
12747c478bd9Sstevel@tonic-gate bpool_return(b_node);
12757c478bd9Sstevel@tonic-gate qpool_return(p, q_node);
12767c478bd9Sstevel@tonic-gate
12777c478bd9Sstevel@tonic-gate sendsignal = 0;
12787c478bd9Sstevel@tonic-gate queue_len = audit_queue_size(&(p->plg_queue));
12797c478bd9Sstevel@tonic-gate
12807c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&(in_thr.thd_mutex));
12817c478bd9Sstevel@tonic-gate if (in_thr.thd_waiting && (queue_len > p->plg_qmin) &&
12827c478bd9Sstevel@tonic-gate (queue_len < p->plg_q_threshold))
12837c478bd9Sstevel@tonic-gate sendsignal = 1;
12847c478bd9Sstevel@tonic-gate
12857c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&(in_thr.thd_mutex));
12867c478bd9Sstevel@tonic-gate
12877c478bd9Sstevel@tonic-gate if (sendsignal) {
12887c478bd9Sstevel@tonic-gate (void) pthread_cond_signal(&(in_thr.thd_cv));
12897c478bd9Sstevel@tonic-gate /*
12907c478bd9Sstevel@tonic-gate * sched_yield(); does not help
12917c478bd9Sstevel@tonic-gate * performance and in artificial tests
12927c478bd9Sstevel@tonic-gate * (high sustained volume) appears to
12937c478bd9Sstevel@tonic-gate * hurt by adding wide variability in
12947c478bd9Sstevel@tonic-gate * the results.
12957c478bd9Sstevel@tonic-gate */
12967c478bd9Sstevel@tonic-gate } else if ((p->plg_priority < BASE_PRIORITY) &&
12977c478bd9Sstevel@tonic-gate (queue_len < p->plg_q_threshold)) {
12987c478bd9Sstevel@tonic-gate p->plg_priority = param.sched_priority =
12997c478bd9Sstevel@tonic-gate BASE_PRIORITY;
13007c478bd9Sstevel@tonic-gate (void) pthread_setschedparam(p->plg_tid, SCHED_OTHER,
13017c478bd9Sstevel@tonic-gate ¶m);
13027c478bd9Sstevel@tonic-gate }
13037c478bd9Sstevel@tonic-gate } /* end for (;;) */
13041a578a15Spaulson plugin_removed:
13057c478bd9Sstevel@tonic-gate DUMP("process", p, p->plg_last_seq_out, "exit");
13067c478bd9Sstevel@tonic-gate error_string = NULL;
13077c478bd9Sstevel@tonic-gate if ((rc = p->plg_fplugin_close(&error_string)) !=
13087c478bd9Sstevel@tonic-gate AUDITD_SUCCESS)
13097c478bd9Sstevel@tonic-gate report_error(rc, error_string, p->plg_path);
13107c478bd9Sstevel@tonic-gate
13117c478bd9Sstevel@tonic-gate free(error_string);
13127c478bd9Sstevel@tonic-gate
13137c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&plugin_mutex);
13147c478bd9Sstevel@tonic-gate (void) unload_plugin(p);
13157c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&plugin_mutex);
13167c478bd9Sstevel@tonic-gate }
1317