xref: /titanic_44/usr/src/lib/libbsm/common/libbsm.h (revision e5ba14ff435beeefdaa2e6649e175c74afe02c76)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #ifndef _BSM_LIBBSM_H
27 #define	_BSM_LIBBSM_H
28 
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 #include <secdb.h>
32 #include <stdio.h>
33 #include <errno.h>
34 #include <sys/types.h>
35 #include <bsm/audit.h>
36 #include <bsm/audit_record.h>
37 
38 #ifdef	__cplusplus
39 extern "C" {
40 #endif
41 
42 #ifndef TEXT_DOMAIN
43 #define	TEXT_DOMAIN	"SUNW_OST_OSLIB"
44 #endif
45 
46 extern const char *bsm_dom;
47 
48 /*
49  * For audit_event(5)
50  */
51 struct au_event_ent {
52 	au_event_t ae_number;
53 	char	*ae_name;
54 	char	*ae_desc;
55 	au_class_t ae_class;
56 };
57 typedef struct au_event_ent au_event_ent_t;
58 
59 /*
60  * For audit_class(5)
61  */
62 struct au_class_ent {
63 	char	*ac_name;
64 	au_class_t ac_class;
65 	char	*ac_desc;
66 };
67 typedef struct au_class_ent au_class_ent_t;
68 
69 /*
70  * For audit_user(5)
71  */
72 struct au_user_ent {
73 	char	*au_name;
74 	au_mask_t au_always;
75 	au_mask_t au_never;
76 };
77 typedef struct au_user_ent au_user_ent_t;
78 
79 /*
80  * Internal representation of audit user in libnsl
81  */
82 typedef struct au_user_str_s {
83 	char	*au_name;
84 	char	*au_always;
85 	char	*au_never;
86 } au_user_str_t;
87 
88 /*
89  * opaque context value for getacval.c
90  */
91 typedef struct au_acinfo au_acinfo_t;
92 
93 /*
94  * adrf's version of adr_t
95  */
96 typedef struct adrf_s {
97 	adr_t	*adrf_adr;
98 	FILE	*adrf_fp;
99 } adrf_t;
100 
101 /*
102  * Functions that manipulate bytes from an audit file
103  */
104 
105 extern void	adr_char(adr_t *, char *, int);
106 extern int	adr_count(adr_t *);
107 extern void	adr_int32(adr_t *, int32_t *, int);
108 extern void	adr_uid(adr_t *, uid_t *, int);
109 extern void	adr_int64(adr_t *, int64_t *, int);
110 extern void	adr_short(adr_t *, short *, int);
111 extern void	adr_start(adr_t *, char *);
112 
113 extern int	adrf_char(adrf_t *, char *, int);
114 extern int	adrf_int32(adrf_t *, int32_t *, int);
115 extern int	adrf_int64(adrf_t *, int64_t *, int);
116 extern int	adrf_short(adrf_t *, short *, int);
117 extern void	adrf_start(adrf_t *, adr_t *, FILE *);
118 extern int	adrf_u_char(adrf_t *, uchar_t *, int);
119 extern int	adrf_u_int32(adrf_t *, uint32_t *, int);
120 extern int	adrf_u_int64(adrf_t *, uint64_t *, int);
121 extern int	adrf_u_short(adrf_t *, ushort_t *, int);
122 
123 /*
124  * Functions that manipulate bytes from an audit character stream.
125  */
126 
127 extern void	adrm_start(adr_t *, char *);
128 extern void	adrm_char(adr_t *, char *, int);
129 extern void	adrm_short(adr_t *, short *, int);
130 extern void	adrm_int64(adr_t *, int64_t *, int);
131 extern void	adrm_int32(adr_t *, int32_t *, int);
132 extern void	adrm_u_int32(adr_t *, uint32_t *, int);
133 extern void	adrm_u_char(adr_t *, uchar_t *, int);
134 extern void	adrm_u_int64(adr_t *, uint64_t *, int);
135 extern void	adrm_u_short(adr_t *, ushort_t *, int);
136 extern void	adrm_putint32(adr_t *, int32_t *, int);
137 
138 /*
139  * Functions that do I/O for audit files
140  */
141 
142 extern int	au_close(int, int, short);
143 extern int	au_open(void);
144 extern int	au_write(int, token_t *);
145 
146 /*
147  * Functions than manipulate audit events
148  */
149 
150 extern void	setauevent(void);
151 extern void	endauevent(void);
152 
153 extern au_event_ent_t	*getauevent(void);
154 extern au_event_ent_t	*getauevent_r(au_event_ent_t *);
155 extern au_event_ent_t	*getauevnam(char *);
156 extern au_event_ent_t	*getauevnam_r(au_event_ent_t *, char *);
157 extern au_event_ent_t	*getauevnum(au_event_t);
158 extern au_event_ent_t	*getauevnum_r(au_event_ent_t *, au_event_t);
159 extern au_event_t	getauevnonam(char *);
160 extern int		au_preselect(au_event_t, au_mask_t *, int, int);
161 extern int		cacheauevent(au_event_ent_t **, au_event_t);
162 
163 /*
164  * Functions that manipulate audit classes
165  */
166 
167 extern void	setauclass(void);
168 extern void	endauclass(void);
169 
170 extern int	cacheauclass(au_class_ent_t **, au_class_t);
171 extern int	cacheauclassnam(au_class_ent_t **, char *);
172 extern au_class_ent_t *getauclassent(void);
173 extern au_class_ent_t *getauclassent_r(au_class_ent_t *);
174 extern au_class_ent_t *getauclassnam(char *);
175 extern au_class_ent_t *getauclassnam_r(au_class_ent_t *, char *);
176 
177 /*
178  * Functions that manipulate audit attributes of users
179  */
180 
181 void	setauuser(void);
182 void	endauuser(void);
183 
184 au_user_ent_t *getauuserent(void);
185 au_user_ent_t *getauuserent_r(au_user_ent_t *);
186 au_user_ent_t *getauusernam(char *);
187 au_user_ent_t *getauusernam_r(au_user_ent_t *, char *);
188 
189 /*
190  * Functions that manipulate the audit control file
191  */
192 
193 void	endac(void);
194 void	setac(void);
195 
196 int	getacdir(char *, int);
197 int	getacmin(int *);
198 int	getacna(char *, int);
199 int	getacflg(char *, int);
200 
201 /*
202  * Functions that manipulate the audit control file
203  */
204 
205 
206 au_acinfo_t	*_openac(char *);
207 void		_endac(au_acinfo_t *);
208 void		_rewindac(au_acinfo_t *);
209 
210 int		_getacdir(au_acinfo_t *, char *, int);
211 int		_getaclib(au_acinfo_t *, kva_t **);
212 int		_getacmin(au_acinfo_t *, int *);
213 int		_getacna(au_acinfo_t *, char *, int);
214 int		_getacflg(au_acinfo_t *, char *, int);
215 int		_getacplug(au_acinfo_t *, kva_t **);
216 
217 /*
218  * Functions that manipulate audit masks
219  */
220 
221 extern int	au_user_mask(char *, au_mask_t *);
222 extern int	getauditflagsbin(char *, au_mask_t *);
223 extern int	getauditflagschar(char *, au_mask_t *, int);
224 extern int	getfauditflags(au_mask_t *, au_mask_t *, au_mask_t *);
225 
226 /*
227  * Functions that do system calls
228  */
229 
230 extern int	audit(char *, int);
231 extern int	auditon(int, caddr_t, int);
232 extern int	auditstat(au_stat_t *);
233 extern int	auditsvc(int, int);
234 extern int	auditdoor(int);
235 extern int	getaudit(auditinfo_t *);
236 extern int	getaudit_addr(auditinfo_addr_t *, int);
237 extern int	getauid(au_id_t *);
238 extern int	getkernstate(au_mask_t *);
239 extern int	getuseraudit(au_id_t, au_mask_t *);
240 extern int	setaudit(auditinfo_t *);
241 extern int	setaudit_addr(auditinfo_addr_t *, int);
242 extern int	setauid(au_id_t *);
243 extern int	setkernstate(au_mask_t *);
244 extern int	setuseraudit(au_id_t, au_mask_t *);
245 
246 #define	BSM_TEXTBUFSZ	256 /* size of string for generic text token */
247 
248 /*
249  * Defines for au_preselect(3)
250  */
251 #define	AU_PRS_SUCCESS	1
252 #define	AU_PRS_FAILURE	2
253 #define	AU_PRS_BOTH	(AU_PRS_SUCCESS|AU_PRS_FAILURE)
254 
255 #define	AU_PRS_USECACHE	0
256 #define	AU_PRS_REREAD	1
257 
258 /*
259  * Defines for cacheauclass and cacheauevent
260  */
261 #define	AU_CACHE_FREE	0x0000
262 #define	AU_CACHE_NAME	0x0001
263 #define	AU_CACHE_NUMBER	0x0002
264 
265 /* Flags for user-level audit routines: au_open, au_close, au_to_ */
266 #define	AU_TO_NO_WRITE	0
267 #define	AU_TO_WRITE	1
268 
269 /* system audit files for auditd */
270 #define	AUDITCLASSFILE		"/etc/security/audit_class"
271 #define	AUDITCONTROLFILE	"/etc/security/audit_control"
272 #define	AUDITDATAFILE		"/etc/security/audit_data"
273 #define	AUDITEVENTFILE		"/etc/security/audit_event"
274 #define	AUDITUSERFILE		"/etc/security/audit_user"
275 
276 /* array sizes for audit library structures */
277 #define	AU_CLASS_NAME_MAX	8
278 #define	AU_CLASS_DESC_MAX	72
279 #define	AU_EVENT_NAME_MAX	30
280 #define	AU_EVENT_DESC_MAX	50
281 #define	AU_EVENT_LINE_MAX	256
282 
283 /*
284  * Some macros used internally by the nsswitch code
285  */
286 #define	AUDITUSER_FILENAME		"/etc/security/audit_user"
287 #define	AUDITUSER_DB_NAME		"audit_user.org_dir"
288 #define	AUDITUSER_DB_NCOL		3	/* total columns */
289 #define	AUDITUSER_DB_NKEYCOL		1	/* total searchable columns */
290 #define	AUDITUSER_DB_TBLT		"audit_user_tbl"
291 #define	AUDITUSER_SUCCESS		0
292 #define	AUDITUSER_PARSE_ERANGE		1
293 #define	AUDITUSER_NOT_FOUND		2
294 
295 #define	AUDITUSER_COL0_KW		"name"
296 #define	AUDITUSER_COL1_KW		"always"
297 #define	AUDITUSER_COL2_KW		"never"
298 
299 /*
300  * indices of searchable columns
301  */
302 #define	AUDITUSER_KEYCOL0		0	/* name */
303 
304 
305 #ifdef	__cplusplus
306 }
307 #endif
308 
309 #endif	/* _BSM_LIBBSM_H */
310