1#! /sbin/sh 2# 3# CDDL HEADER START 4# 5# The contents of this file are subject to the terms of the 6# Common Development and Distribution License (the "License"). 7# You may not use this file except in compliance with the License. 8# 9# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10# or http://www.opensolaris.org/os/licensing. 11# See the License for the specific language governing permissions 12# and limitations under the License. 13# 14# When distributing Covered Code, include this CDDL HEADER in each 15# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16# If applicable, add the following below this CDDL HEADER, with the 17# fields enclosed by brackets "[]" replaced with your own identifying 18# information: Portions Copyright [yyyy] [name of copyright owner] 19# 20# CDDL HEADER END 21# 22 23# 24# Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. 25# 26 27. /lib/svc/share/smf_include.sh 28 29AUDIT=/usr/sbin/audit 30AUDITCONFIG=/usr/sbin/auditconfig 31AUDITD=/usr/sbin/auditd 32AWK=/usr/bin/awk 33EGREP=/usr/bin/egrep 34MV=/usr/bin/mv 35PKILL=/usr/bin/pkill 36SLEEP=/usr/bin/sleep 37SVCADM=/usr/sbin/svcadm 38SVCCFG=/usr/sbin/svccfg 39SVCS=/usr/bin/svcs 40 41AUDIT_STARTUP=/etc/security/audit_startup 42AUDITD_FMRI="system/auditd:default" 43 44# 45# main - the execution starts there. 46main() 47{ 48 # 49 # Do the basic argument inspection and take the appropriate action. 50 case "$SMF_METHOD" in 51 start) 52 do_common 53 do_start 54 ;; 55 refresh) 56 do_common 57 do_refresh 58 ;; 59 *) 60 if [ -z "$SMF_METHOD" ]; then 61 echo "$0: No SMF method defined." 62 else 63 echo "$0: Unsupported SMF method: $SMF_METHOD." 64 fi 65 exit $SMF_EXIT_ERR_NOSMF 66 ;; 67 esac 68} 69 70# 71# do_common - executes all the code common to all supported service methods. 72do_common() 73{ 74 # 75 # If the audit state is "disabled" auditconfig returns non-zero exit 76 # status unless the c2audit module is loaded; if c2audit is loaded, 77 # "disabled" becomes "noaudit" early in the boot cycle and "auditing" 78 # only after auditd starts. 79 AUDITCOND="`$AUDITCONFIG -getcond 2>/dev/null`" 80 if [ $? -ne 0 ]; then 81 # The decision whether to start 82 # auditing is driven by bsmconv(1M) / bsmunconv(1M) 83 echo "$0: Unable to get current kernel auditing condition." 84 $SVCADM mark maintenance $AUDITD_FMRI 85 exit $SMF_EXIT_MON_OFFLINE 86 fi 87 # 88 # In a non-global zone, auditd is started/refreshed only if the 89 # "perzone" audit policy has been set. 90 if smf_is_nonglobalzone; then 91 $AUDITCONFIG -t -getpolicy | \ 92 $EGREP "perzone|all" 1>/dev/null 2>&1 93 if [ $? -eq 1 ]; then 94 echo "$0: auditd(1M) is not configured to run in" 95 echo " a local zone, perzone policy not set" \ 96 "(see auditconfig(1M))." 97 $SVCADM disable $AUDITD_FMRI 98 $SLEEP 5 & 99 exit $SMF_EXIT_OK 100 fi 101 fi 102 # 103 # Validate the audit service configuration 104 val_err="`$AUDIT -v 2>&1`" 105 if [ $? -ne 0 ]; then 106 echo "$0: audit service misconfiguration detected (${val_err})" 107 $SVCADM mark maintenance $AUDITD_FMRI 108 exit $SMF_EXIT_MON_OFFLINE 109 fi 110} 111 112# 113# do_start - service start method helper. 114do_start() 115{ 116 # 117 # The transition of the audit_startup(1M) has to be performed. 118 if [ -f "$AUDIT_STARTUP" ]; then 119 120 if [ -x "$AUDIT_STARTUP" ]; then 121 $AUDIT_STARTUP 122 else 123 echo "$0: Unable to execute $AUDIT_STARTUP" 124 $SVCADM mark maintenance $AUDITD_FMRI 125 exit $SMF_EXIT_MON_OFFLINE 126 fi 127 128 echo "$0: Transition of audit_startup(1M) started." 129 130 $MV $AUDIT_STARTUP $AUDIT_STARTUP._transitioned_ 131 if [ $? -ne 0 ]; then 132 # Unable to perform the backup of $AUDIT_STARTUP 133 echo "$0: The $AUDIT_STARTUP was not moved to" 134 echo " $AUDIT_STARTUP._transitioned_" 135 fi 136 137 # 138 # Refreshing service to make the newly created properties 139 # available for any other consequent svcprop(1). 140 $SVCCFG -s $AUDITD_FMRI refresh 141 if [ $? -ne 0 ]; then 142 echo "$0: Refresh of $AUDITD_FMRI configuration failed." 143 $SVCADM mark maintenance $AUDITD_FMRI 144 exit $SMF_EXIT_ERR_CONFIG 145 fi 146 147 echo "$0: Transition of audit_startup(1M) finished." 148 fi 149 150 # 151 # Daemon forks, parent exits when child says it's ready. 152 exec $AUDITD 153} 154 155# 156# do_refresh - service refresh method helper. 157do_refresh() 158{ 159 # 160 # The refresh capability is available only for those systems 161 # with already transformed audit_startup(1M) into $AUDITD_FMRI 162 # service properties. See do_start() for more information. 163 if [ ! -f "$AUDIT_STARTUP" ]; then 164 # 165 # Find the contract_id. 166 contract_id=`$SVCS -l $AUDITD_FMRI | \ 167 $AWK '/^contract_id/ {print $2}'` 168 if [ -z "${contract_id}" ]; then 169 echo "$0: Service $AUDITD_FMRI has no associated" \ 170 "contract. Service cannot be refreshed." 171 exit $SMF_EXIT_ERR_FATAL 172 fi 173 # 174 # signal to auditd(1M): 175 $PKILL -HUP -c ${contract_id} 176 if [ $? -ne 0 ]; then 177 echo "$0: SIGHUP was not successfully delivered to" \ 178 "the related contract (${contract_id}/err:$?)." 179 $SVCADM mark maintenance $AUDITD_FMRI 180 exit $SMF_EXIT_ERR_FATAL 181 fi 182 $SLEEP 5 & 183 else 184 echo "$0: Service refresh method not supported on systems" \ 185 "without converted audit_startup(1M) into auditd service" \ 186 "SMF configuration. Clear the service (svcadm(1M))." 187 $SVCADM mark maintenance $AUDITD_FMRI 188 exit $SMF_EXIT_ERR_CONFIG 189 fi 190} 191 192# 193# Call main() to start the own script execution. 194main 195