1*7c478bd9Sstevel@tonic-gate /* 2*7c478bd9Sstevel@tonic-gate * CDDL HEADER START 3*7c478bd9Sstevel@tonic-gate * 4*7c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*7c478bd9Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*7c478bd9Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*7c478bd9Sstevel@tonic-gate * with the License. 8*7c478bd9Sstevel@tonic-gate * 9*7c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*7c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*7c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 12*7c478bd9Sstevel@tonic-gate * and limitations under the License. 13*7c478bd9Sstevel@tonic-gate * 14*7c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*7c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*7c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*7c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*7c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*7c478bd9Sstevel@tonic-gate * 20*7c478bd9Sstevel@tonic-gate * CDDL HEADER END 21*7c478bd9Sstevel@tonic-gate */ 22*7c478bd9Sstevel@tonic-gate /* 23*7c478bd9Sstevel@tonic-gate * Copyright 1993-2002 Sun Microsystems, Inc. All rights reserved. 24*7c478bd9Sstevel@tonic-gate * Use is subject to license terms. 25*7c478bd9Sstevel@tonic-gate */ 26*7c478bd9Sstevel@tonic-gate 27*7c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 28*7c478bd9Sstevel@tonic-gate 29*7c478bd9Sstevel@tonic-gate #include <dirent.h> 30*7c478bd9Sstevel@tonic-gate #include <locale.h> 31*7c478bd9Sstevel@tonic-gate #include <libintl.h> 32*7c478bd9Sstevel@tonic-gate #include <stdlib.h> 33*7c478bd9Sstevel@tonic-gate #include <strings.h> 34*7c478bd9Sstevel@tonic-gate #include <stdio.h> 35*7c478bd9Sstevel@tonic-gate #include <unistd.h> 36*7c478bd9Sstevel@tonic-gate 37*7c478bd9Sstevel@tonic-gate #include <sys/types.h> 38*7c478bd9Sstevel@tonic-gate #include <sys/file.h> 39*7c478bd9Sstevel@tonic-gate 40*7c478bd9Sstevel@tonic-gate #include <bsm/audit.h> 41*7c478bd9Sstevel@tonic-gate #include <bsm/audit_record.h> 42*7c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h> 43*7c478bd9Sstevel@tonic-gate 44*7c478bd9Sstevel@tonic-gate #include "praudit.h" 45*7c478bd9Sstevel@tonic-gate #include "toktable.h" 46*7c478bd9Sstevel@tonic-gate 47*7c478bd9Sstevel@tonic-gate static int process_options(int *argc, char *argv[], char *names[]); 48*7c478bd9Sstevel@tonic-gate 49*7c478bd9Sstevel@tonic-gate static int input_mode; /* audit file source */ 50*7c478bd9Sstevel@tonic-gate static int format = PRF_DEFAULTM; /* output mode */ 51*7c478bd9Sstevel@tonic-gate 52*7c478bd9Sstevel@tonic-gate static char SEPARATOR[SEP_SIZE] = ","; /* field separator */ 53*7c478bd9Sstevel@tonic-gate 54*7c478bd9Sstevel@tonic-gate 55*7c478bd9Sstevel@tonic-gate /* 56*7c478bd9Sstevel@tonic-gate * ---------------------------------------------------------------------- 57*7c478bd9Sstevel@tonic-gate * praudit - display contents of audit trail file 58*7c478bd9Sstevel@tonic-gate * 59*7c478bd9Sstevel@tonic-gate * main() - main control 60*7c478bd9Sstevel@tonic-gate * input: - command line input: praudit -r|s -l -x -ddelim. -c filename(s) 61*7c478bd9Sstevel@tonic-gate * ---------------------------------------------------------------------- 62*7c478bd9Sstevel@tonic-gate */ 63*7c478bd9Sstevel@tonic-gate 64*7c478bd9Sstevel@tonic-gate int 65*7c478bd9Sstevel@tonic-gate main(int argc, char **argv) 66*7c478bd9Sstevel@tonic-gate { 67*7c478bd9Sstevel@tonic-gate int i = 0, retstat; 68*7c478bd9Sstevel@tonic-gate char *names[MAXFILENAMES]; 69*7c478bd9Sstevel@tonic-gate 70*7c478bd9Sstevel@tonic-gate /* Internationalization */ 71*7c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 72*7c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 73*7c478bd9Sstevel@tonic-gate /* 74*7c478bd9Sstevel@tonic-gate * get audit file names 75*7c478bd9Sstevel@tonic-gate */ 76*7c478bd9Sstevel@tonic-gate if ((retstat = process_options(&argc, argv, names)) == 0) { 77*7c478bd9Sstevel@tonic-gate if (format & PRF_XMLM) 78*7c478bd9Sstevel@tonic-gate print_audit_xml_prolog(); 79*7c478bd9Sstevel@tonic-gate do { 80*7c478bd9Sstevel@tonic-gate retstat = 0; 81*7c478bd9Sstevel@tonic-gate /* 82*7c478bd9Sstevel@tonic-gate * process each audit file 83*7c478bd9Sstevel@tonic-gate */ 84*7c478bd9Sstevel@tonic-gate if (input_mode == FILEMODE) { 85*7c478bd9Sstevel@tonic-gate if (freopen(names[i], "r", stdin) == NULL) { 86*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 87*7c478bd9Sstevel@tonic-gate gettext("praudit: Can't assign %s " 88*7c478bd9Sstevel@tonic-gate "to stdin.\n"), names[i]); 89*7c478bd9Sstevel@tonic-gate break; 90*7c478bd9Sstevel@tonic-gate } 91*7c478bd9Sstevel@tonic-gate } 92*7c478bd9Sstevel@tonic-gate 93*7c478bd9Sstevel@tonic-gate /* 94*7c478bd9Sstevel@tonic-gate * Call the library routine to format the 95*7c478bd9Sstevel@tonic-gate * audit data from stdin and print to stdout 96*7c478bd9Sstevel@tonic-gate */ 97*7c478bd9Sstevel@tonic-gate retstat = print_audit(format, SEPARATOR); 98*7c478bd9Sstevel@tonic-gate 99*7c478bd9Sstevel@tonic-gate } while ((++i < argc) && retstat >= 0); 100*7c478bd9Sstevel@tonic-gate } 101*7c478bd9Sstevel@tonic-gate if ((retstat == 0) && (format & PRF_XMLM)) 102*7c478bd9Sstevel@tonic-gate print_audit_xml_ending(); 103*7c478bd9Sstevel@tonic-gate 104*7c478bd9Sstevel@tonic-gate if (retstat == -2) { 105*7c478bd9Sstevel@tonic-gate (void) printf(gettext("\nusage: praudit [-r/-s] [-l] [-x] " 106*7c478bd9Sstevel@tonic-gate "[-ddel] [-c] filename...\n")); 107*7c478bd9Sstevel@tonic-gate retstat = -1; 108*7c478bd9Sstevel@tonic-gate } 109*7c478bd9Sstevel@tonic-gate if (retstat == 1) 110*7c478bd9Sstevel@tonic-gate retstat = 0; 111*7c478bd9Sstevel@tonic-gate return (retstat); 112*7c478bd9Sstevel@tonic-gate } 113*7c478bd9Sstevel@tonic-gate 114*7c478bd9Sstevel@tonic-gate 115*7c478bd9Sstevel@tonic-gate /* 116*7c478bd9Sstevel@tonic-gate * ------------------------------------------------------------------- 117*7c478bd9Sstevel@tonic-gate * process_options() - get command line flags and file names 118*7c478bd9Sstevel@tonic-gate * input: - praudit [-r]/[-s] [-l] [-x] [-ddel] [-c] {audit file names} 119*7c478bd9Sstevel@tonic-gate * output: - {audit file names} 120*7c478bd9Sstevel@tonic-gate * globals set: format: RAWM / SHORTM / XML / ONELINE or DEFAULTM 121*7c478bd9Sstevel@tonic-gate * SEPARATOR: default, ",", set here if 122*7c478bd9Sstevel@tonic-gate * user specified 123*7c478bd9Sstevel@tonic-gate * NOTE: no changes required here for new audit record format 124*7c478bd9Sstevel@tonic-gate * ------------------------------------------------------------------- 125*7c478bd9Sstevel@tonic-gate */ 126*7c478bd9Sstevel@tonic-gate int 127*7c478bd9Sstevel@tonic-gate process_options(int *argc, char **argv, char **names) 128*7c478bd9Sstevel@tonic-gate { 129*7c478bd9Sstevel@tonic-gate int c, returnstat = 0; 130*7c478bd9Sstevel@tonic-gate 131*7c478bd9Sstevel@tonic-gate /* 132*7c478bd9Sstevel@tonic-gate * check for flags 133*7c478bd9Sstevel@tonic-gate */ 134*7c478bd9Sstevel@tonic-gate 135*7c478bd9Sstevel@tonic-gate while ((c = getopt(*argc, argv, "crslxd:")) != -1) { 136*7c478bd9Sstevel@tonic-gate switch (c) { 137*7c478bd9Sstevel@tonic-gate case 'c': 138*7c478bd9Sstevel@tonic-gate format |= PRF_NOCACHE; /* turn off cache */ 139*7c478bd9Sstevel@tonic-gate break; 140*7c478bd9Sstevel@tonic-gate case 'r': 141*7c478bd9Sstevel@tonic-gate if (format & PRF_SHORTM) 142*7c478bd9Sstevel@tonic-gate returnstat = -2; 143*7c478bd9Sstevel@tonic-gate else 144*7c478bd9Sstevel@tonic-gate format |= PRF_RAWM; 145*7c478bd9Sstevel@tonic-gate break; 146*7c478bd9Sstevel@tonic-gate case 's': 147*7c478bd9Sstevel@tonic-gate if (format & PRF_RAWM) 148*7c478bd9Sstevel@tonic-gate returnstat = -2; 149*7c478bd9Sstevel@tonic-gate else 150*7c478bd9Sstevel@tonic-gate format |= PRF_SHORTM; 151*7c478bd9Sstevel@tonic-gate break; 152*7c478bd9Sstevel@tonic-gate case 'l': 153*7c478bd9Sstevel@tonic-gate format |= PRF_ONELINE; 154*7c478bd9Sstevel@tonic-gate break; 155*7c478bd9Sstevel@tonic-gate case 'x': 156*7c478bd9Sstevel@tonic-gate format |= PRF_XMLM; 157*7c478bd9Sstevel@tonic-gate break; 158*7c478bd9Sstevel@tonic-gate case 'd': 159*7c478bd9Sstevel@tonic-gate if (strlen(optarg) < sizeof (SEPARATOR)) 160*7c478bd9Sstevel@tonic-gate (void) strlcpy(SEPARATOR, optarg, 161*7c478bd9Sstevel@tonic-gate sizeof (SEPARATOR)); 162*7c478bd9Sstevel@tonic-gate else { 163*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 164*7c478bd9Sstevel@tonic-gate gettext("praudit: Delimiter too " 165*7c478bd9Sstevel@tonic-gate "long. Using default.\n")); 166*7c478bd9Sstevel@tonic-gate } 167*7c478bd9Sstevel@tonic-gate break; 168*7c478bd9Sstevel@tonic-gate default: 169*7c478bd9Sstevel@tonic-gate returnstat = -2; 170*7c478bd9Sstevel@tonic-gate break; 171*7c478bd9Sstevel@tonic-gate } 172*7c478bd9Sstevel@tonic-gate } 173*7c478bd9Sstevel@tonic-gate 174*7c478bd9Sstevel@tonic-gate argv = &argv[optind - 1]; 175*7c478bd9Sstevel@tonic-gate *argc -= optind; 176*7c478bd9Sstevel@tonic-gate 177*7c478bd9Sstevel@tonic-gate if (*argc > MAXFILENAMES) { 178*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("praudit: Too many file " 179*7c478bd9Sstevel@tonic-gate "names.\n")); 180*7c478bd9Sstevel@tonic-gate return (-1); 181*7c478bd9Sstevel@tonic-gate } 182*7c478bd9Sstevel@tonic-gate if (*argc > 0) { 183*7c478bd9Sstevel@tonic-gate int count = *argc; 184*7c478bd9Sstevel@tonic-gate 185*7c478bd9Sstevel@tonic-gate input_mode = FILEMODE; 186*7c478bd9Sstevel@tonic-gate /* 187*7c478bd9Sstevel@tonic-gate * copy file names from command line 188*7c478bd9Sstevel@tonic-gate */ 189*7c478bd9Sstevel@tonic-gate do { 190*7c478bd9Sstevel@tonic-gate *names++ = *++argv; 191*7c478bd9Sstevel@tonic-gate } while (--count > 0); 192*7c478bd9Sstevel@tonic-gate } else 193*7c478bd9Sstevel@tonic-gate input_mode = PIPEMODE; 194*7c478bd9Sstevel@tonic-gate 195*7c478bd9Sstevel@tonic-gate return (returnstat); 196*7c478bd9Sstevel@tonic-gate } 197