17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*9697ae98Sgww * Common Development and Distribution License (the "License"). 6*9697ae98Sgww * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22*9697ae98Sgww * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 237c478bd9Sstevel@tonic-gate * Use is subject to license terms. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 267c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate /* Audit daemon server */ 297c478bd9Sstevel@tonic-gate /* 307c478bd9Sstevel@tonic-gate * These routines make up the audit daemon server. This daemon, called 317c478bd9Sstevel@tonic-gate * auditd, handles the user level parts of auditing. It receives buffered 327c478bd9Sstevel@tonic-gate * audit records (usually one or more per buffer, potentially less than 337c478bd9Sstevel@tonic-gate * one) and passes them to one or more plugins for processing. 347c478bd9Sstevel@tonic-gate * 357c478bd9Sstevel@tonic-gate * The major interrupts are AU_SIG_READ_CONTROL (start over), 367c478bd9Sstevel@tonic-gate * AU_SIG_DISABLE (start shutting down), SIGALRM (quit), and 377c478bd9Sstevel@tonic-gate * AU_SIG_NEXT_DIR (start a new audit log file). SIGTERM (the implementation 387c478bd9Sstevel@tonic-gate * value of AU_SIG_DISABLE) is also used for the child to tell the parent 397c478bd9Sstevel@tonic-gate * that audit is ready. 407c478bd9Sstevel@tonic-gate * 417c478bd9Sstevel@tonic-gate * Configuration data comes from /etc/security/audit_control and the auditon 427c478bd9Sstevel@tonic-gate * system call. 437c478bd9Sstevel@tonic-gate * 447c478bd9Sstevel@tonic-gate * The major errors are EBUSY (auditing is already in use) and EINTR 457c478bd9Sstevel@tonic-gate * (one of the above signals was received). File space errors are 467c478bd9Sstevel@tonic-gate * handled by the audit_binfile plugin 477c478bd9Sstevel@tonic-gate */ 487c478bd9Sstevel@tonic-gate 497c478bd9Sstevel@tonic-gate #define DEBUG 0 507c478bd9Sstevel@tonic-gate #define MEM_TEST 0 /* set to one to generate core dump on exit */ 517c478bd9Sstevel@tonic-gate 527c478bd9Sstevel@tonic-gate #include <assert.h> 53*9697ae98Sgww #include <bsm/adt.h> 547c478bd9Sstevel@tonic-gate #include <bsm/audit.h> 557c478bd9Sstevel@tonic-gate #include <bsm/audit_record.h> 567c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h> 577c478bd9Sstevel@tonic-gate #include <fcntl.h> 587c478bd9Sstevel@tonic-gate #include <libintl.h> 597c478bd9Sstevel@tonic-gate #include <locale.h> 607c478bd9Sstevel@tonic-gate #include <netdb.h> 617c478bd9Sstevel@tonic-gate #include <pwd.h> 627c478bd9Sstevel@tonic-gate #include <secdb.h> 637c478bd9Sstevel@tonic-gate #include <signal.h> 647c478bd9Sstevel@tonic-gate #include <stdio.h> 657c478bd9Sstevel@tonic-gate #include <stdlib.h> 667c478bd9Sstevel@tonic-gate #include <string.h> 67*9697ae98Sgww #include <syslog.h> 687c478bd9Sstevel@tonic-gate #include <errno.h> 697c478bd9Sstevel@tonic-gate #include <sys/file.h> 707c478bd9Sstevel@tonic-gate #include <sys/param.h> 717c478bd9Sstevel@tonic-gate #include <sys/stat.h> 727c478bd9Sstevel@tonic-gate #include <sys/statvfs.h> 737c478bd9Sstevel@tonic-gate #include <sys/time.h> 747c478bd9Sstevel@tonic-gate #include <sys/types.h> 757c478bd9Sstevel@tonic-gate #include <sys/wait.h> 767c478bd9Sstevel@tonic-gate #include <termios.h> 777c478bd9Sstevel@tonic-gate #include <unistd.h> 787c478bd9Sstevel@tonic-gate #include "plugin.h" 797c478bd9Sstevel@tonic-gate #include "audit_sig_infc.h" 807c478bd9Sstevel@tonic-gate #include <audit_plugin.h> 817c478bd9Sstevel@tonic-gate 827c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) 837c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SUNW_OST_OSCMD" 847c478bd9Sstevel@tonic-gate #endif 857c478bd9Sstevel@tonic-gate /* 867c478bd9Sstevel@tonic-gate * After we get a AU_SIG_DISABLE, we want to set a timer for 2 seconds 877c478bd9Sstevel@tonic-gate * and let c2audit write as many records as it can until the timer 887c478bd9Sstevel@tonic-gate * goes off(at which point it returns to auditd with SIGALRM). If any 897c478bd9Sstevel@tonic-gate * other signals are received during that time, we call 907c478bd9Sstevel@tonic-gate * __audit_dowarn() to indicate that the queue may not have been fully 917c478bd9Sstevel@tonic-gate * flushed. 927c478bd9Sstevel@tonic-gate */ 937c478bd9Sstevel@tonic-gate #define ALRM_TIME 2 947c478bd9Sstevel@tonic-gate #define SLEEP_TIME 20 /* # of seconds to sleep in all hard loop */ 957c478bd9Sstevel@tonic-gate 967c478bd9Sstevel@tonic-gate #if DEBUG 977c478bd9Sstevel@tonic-gate #define DPRINT(x) {(void) fprintf x; } 987c478bd9Sstevel@tonic-gate static FILE *dbfp; /* debug file */ 997c478bd9Sstevel@tonic-gate #else 1007c478bd9Sstevel@tonic-gate #define DPRINT(x) 1017c478bd9Sstevel@tonic-gate #endif /* DEBUG */ 1027c478bd9Sstevel@tonic-gate 1037c478bd9Sstevel@tonic-gate static plugin_t *binfile = NULL; 1047c478bd9Sstevel@tonic-gate 1057c478bd9Sstevel@tonic-gate static int turn_audit_on = AUC_AUDITING; 1067c478bd9Sstevel@tonic-gate static int turn_audit_off = AUC_NOAUDIT; 1077c478bd9Sstevel@tonic-gate 1087c478bd9Sstevel@tonic-gate static int running = 1; 1097c478bd9Sstevel@tonic-gate 1107c478bd9Sstevel@tonic-gate /* 1117c478bd9Sstevel@tonic-gate * GLOBALS: 1127c478bd9Sstevel@tonic-gate */ 1137c478bd9Sstevel@tonic-gate plugin_t *plugin_head = NULL; 1147c478bd9Sstevel@tonic-gate static thr_data_t main_thr; /* auditd thread (0) */ 1157c478bd9Sstevel@tonic-gate pthread_mutex_t plugin_mutex; /* for plugin_t list */ 1167c478bd9Sstevel@tonic-gate 1177c478bd9Sstevel@tonic-gate static int caught_alrm = 0; /* number of SIGALRMs pending */ 1187c478bd9Sstevel@tonic-gate static int caught_readc = 0; /* number of AU_SIG_READ_CONTROLs */ 1197c478bd9Sstevel@tonic-gate static int caught_term = 0; /* number of AU_SIG_DISABLEs pending */ 1207c478bd9Sstevel@tonic-gate static int caught_nextd = 0; /* number of AU_SIG_NEXT_DIRs pending */ 1217c478bd9Sstevel@tonic-gate 1227c478bd9Sstevel@tonic-gate static int reset_list = 1; /* 1 to re-read audit_control */ 1237c478bd9Sstevel@tonic-gate static int reset_file = 1; /* 1 to close/open binary log */ 1247c478bd9Sstevel@tonic-gate 1257c478bd9Sstevel@tonic-gate static int auditing_set = 0; /* 1 if auditon(A_SETCOND, on... */ 1267c478bd9Sstevel@tonic-gate 1277c478bd9Sstevel@tonic-gate static void my_sleep(); 1287c478bd9Sstevel@tonic-gate static void signal_thread(); 1297c478bd9Sstevel@tonic-gate static void loadauditlist(); 1307c478bd9Sstevel@tonic-gate static void block_signals(); 1317c478bd9Sstevel@tonic-gate static int do_sethost(); 1327c478bd9Sstevel@tonic-gate 1337c478bd9Sstevel@tonic-gate /* common exit function */ 1347c478bd9Sstevel@tonic-gate void 1357c478bd9Sstevel@tonic-gate auditd_exit(int status) 1367c478bd9Sstevel@tonic-gate { 1377c478bd9Sstevel@tonic-gate #if MEM_TEST 1387c478bd9Sstevel@tonic-gate sigset_t set; 1397c478bd9Sstevel@tonic-gate 1407c478bd9Sstevel@tonic-gate DPRINT((dbfp, "mem_test intentional abort (status=%d)\n", 1417c478bd9Sstevel@tonic-gate status)); 1427c478bd9Sstevel@tonic-gate abort(); 1437c478bd9Sstevel@tonic-gate #endif 1447c478bd9Sstevel@tonic-gate DPRINT((dbfp, "%ld exit status = %d auditing_set = %d\n", 1457c478bd9Sstevel@tonic-gate getpid(), status, auditing_set)); 1467c478bd9Sstevel@tonic-gate 1477c478bd9Sstevel@tonic-gate if (auditing_set) 1487c478bd9Sstevel@tonic-gate (void) auditon(A_SETCOND, (caddr_t)&turn_audit_off, 1497c478bd9Sstevel@tonic-gate (int)sizeof (int)); 1507c478bd9Sstevel@tonic-gate 1517c478bd9Sstevel@tonic-gate exit(status); 1527c478bd9Sstevel@tonic-gate } 1537c478bd9Sstevel@tonic-gate 1547c478bd9Sstevel@tonic-gate /* ARGSUSED */ 1557883e825Spaulson int 1567c478bd9Sstevel@tonic-gate main(int argc, char *argv[]) 1577c478bd9Sstevel@tonic-gate { 1587c478bd9Sstevel@tonic-gate auditinfo_addr_t as_null; /* audit state to set */ 1597c478bd9Sstevel@tonic-gate au_id_t auid; 1607c478bd9Sstevel@tonic-gate pthread_t tid; 1617c478bd9Sstevel@tonic-gate plugin_t *p; 1627c478bd9Sstevel@tonic-gate pid_t pid; 1637c478bd9Sstevel@tonic-gate 1647c478bd9Sstevel@tonic-gate #if DEBUG 1657c478bd9Sstevel@tonic-gate /* LINTED */ 1667c478bd9Sstevel@tonic-gate char *envp; 1677c478bd9Sstevel@tonic-gate dbfp = __auditd_debug_file_open(); 1687c478bd9Sstevel@tonic-gate #endif 1697c478bd9Sstevel@tonic-gate (void) setsid(); 1707c478bd9Sstevel@tonic-gate 1717c478bd9Sstevel@tonic-gate /* Internationalization */ 1727c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 1737c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 1747c478bd9Sstevel@tonic-gate 1757c478bd9Sstevel@tonic-gate /* 1767c478bd9Sstevel@tonic-gate * Set the audit host-id. 1777c478bd9Sstevel@tonic-gate */ 1787c478bd9Sstevel@tonic-gate if (do_sethost() != 0) { 1797c478bd9Sstevel@tonic-gate __audit_dowarn("nostart", "", 0); 1807c478bd9Sstevel@tonic-gate auditd_exit(1); 1817c478bd9Sstevel@tonic-gate } 1827c478bd9Sstevel@tonic-gate 1837c478bd9Sstevel@tonic-gate /* 1847c478bd9Sstevel@tonic-gate * Turn off all auditing for this process. 1857c478bd9Sstevel@tonic-gate */ 1867c478bd9Sstevel@tonic-gate if (getaudit_addr(&as_null, sizeof (as_null)) == -1) { 1877c478bd9Sstevel@tonic-gate __audit_dowarn("nostart", "", 0); 1887c478bd9Sstevel@tonic-gate auditd_exit(2); 1897c478bd9Sstevel@tonic-gate } 1907c478bd9Sstevel@tonic-gate as_null.ai_mask.as_success = 0; 1917c478bd9Sstevel@tonic-gate as_null.ai_mask.as_failure = 0; 1927c478bd9Sstevel@tonic-gate (void) setaudit_addr(&as_null, sizeof (as_null)); 1937c478bd9Sstevel@tonic-gate auid = AU_NOAUDITID; 1947c478bd9Sstevel@tonic-gate (void) setauid(&auid); 1957c478bd9Sstevel@tonic-gate /* 1967c478bd9Sstevel@tonic-gate * Set the audit state flag to AUDITING. 1977c478bd9Sstevel@tonic-gate */ 1987c478bd9Sstevel@tonic-gate if (auditon(A_SETCOND, (caddr_t)&turn_audit_on, (int)sizeof (int)) != 1997c478bd9Sstevel@tonic-gate 0) { 2007c478bd9Sstevel@tonic-gate DPRINT((dbfp, "auditon(A_SETCOND...) failed (exit)\n")); 2017c478bd9Sstevel@tonic-gate __audit_dowarn("nostart", "", 0); 2027c478bd9Sstevel@tonic-gate auditd_exit(7); 2037c478bd9Sstevel@tonic-gate } 2047c478bd9Sstevel@tonic-gate 2057c478bd9Sstevel@tonic-gate block_signals(); 2067c478bd9Sstevel@tonic-gate 2077c478bd9Sstevel@tonic-gate #if DEBUG 2087c478bd9Sstevel@tonic-gate /* output to dbfp shouldn't be duplicated by parent and child */ 2097c478bd9Sstevel@tonic-gate (void) fflush(dbfp); 2107c478bd9Sstevel@tonic-gate #endif 2117c478bd9Sstevel@tonic-gate /* 2127c478bd9Sstevel@tonic-gate * wait for "ready" signal before exit -- for greenline 2137c478bd9Sstevel@tonic-gate */ 2147c478bd9Sstevel@tonic-gate if (fork()) { 2157c478bd9Sstevel@tonic-gate sigset_t set; 2167c478bd9Sstevel@tonic-gate int signal_caught = 0; 2177c478bd9Sstevel@tonic-gate 2187c478bd9Sstevel@tonic-gate (void) sigemptyset(&set); 2197c478bd9Sstevel@tonic-gate (void) sigaddset(&set, AU_SIG_DISABLE); 2207c478bd9Sstevel@tonic-gate 2217c478bd9Sstevel@tonic-gate while (signal_caught != AU_SIG_DISABLE) 2227c478bd9Sstevel@tonic-gate signal_caught = sigwait(&set); 2237c478bd9Sstevel@tonic-gate 2247c478bd9Sstevel@tonic-gate DPRINT((dbfp, "init complete: parent can now exit\n")); 2257c478bd9Sstevel@tonic-gate 2267c478bd9Sstevel@tonic-gate auditd_exit(0); 2277c478bd9Sstevel@tonic-gate } 2287c478bd9Sstevel@tonic-gate pid = getppid(); 2297c478bd9Sstevel@tonic-gate 2307c478bd9Sstevel@tonic-gate auditing_set = 1; 2317c478bd9Sstevel@tonic-gate 2327c478bd9Sstevel@tonic-gate #if DEBUG && MEM_TEST 2337c478bd9Sstevel@tonic-gate envp = getenv("UMEM_DEBUG"); 2347c478bd9Sstevel@tonic-gate if (envp != NULL) 2357c478bd9Sstevel@tonic-gate DPRINT((dbfp, "UMEM_DEBUG=%s\n", envp)); 2367c478bd9Sstevel@tonic-gate envp = getenv("UMEM_LOGGING"); 2377c478bd9Sstevel@tonic-gate if (envp != NULL) 2387c478bd9Sstevel@tonic-gate DPRINT((dbfp, "UMEM_LOGGING=%s\n", envp)); 2397c478bd9Sstevel@tonic-gate #endif 2407c478bd9Sstevel@tonic-gate DPRINT((dbfp, "auditd pid=%ld\n", getpid())); 2417c478bd9Sstevel@tonic-gate 2427c478bd9Sstevel@tonic-gate /* thread 0 sync */ 2437c478bd9Sstevel@tonic-gate (void) pthread_mutex_init(&(main_thr.thd_mutex), NULL); 2447c478bd9Sstevel@tonic-gate (void) pthread_cond_init(&(main_thr.thd_cv), NULL); 2457c478bd9Sstevel@tonic-gate (void) pthread_mutex_init(&plugin_mutex, NULL); 2467c478bd9Sstevel@tonic-gate /* 2477c478bd9Sstevel@tonic-gate * Set up a separate thread for signal handling. 2487c478bd9Sstevel@tonic-gate */ 2497c478bd9Sstevel@tonic-gate if (pthread_create(&tid, NULL, (void *(*)(void *))signal_thread, 2507c478bd9Sstevel@tonic-gate NULL)) { 2517c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext( 2527c478bd9Sstevel@tonic-gate "auditd can't create a thread\n")); 2537c478bd9Sstevel@tonic-gate auditd_exit(3); 2547c478bd9Sstevel@tonic-gate } 2557c478bd9Sstevel@tonic-gate /* 2567c478bd9Sstevel@tonic-gate * Set the umask so that only audit or other users in the audit group 2577c478bd9Sstevel@tonic-gate * can get to the files created by auditd. 2587c478bd9Sstevel@tonic-gate */ 2597c478bd9Sstevel@tonic-gate (void) umask(007); 2607c478bd9Sstevel@tonic-gate 2617c478bd9Sstevel@tonic-gate if (__logpost("")) { /* Open the audit_data file. */ 2627c478bd9Sstevel@tonic-gate DPRINT((dbfp, "logpost failed\n")); 2637c478bd9Sstevel@tonic-gate auditd_exit(4); 2647c478bd9Sstevel@tonic-gate } 2657c478bd9Sstevel@tonic-gate /* 2667c478bd9Sstevel@tonic-gate * Here is the main body of the audit daemon. running == 0 means that 2677c478bd9Sstevel@tonic-gate * after flushing out the audit queue, it is time to exit in response to 2687c478bd9Sstevel@tonic-gate * AU_SIG_DISABLE 2697c478bd9Sstevel@tonic-gate */ 2707c478bd9Sstevel@tonic-gate while (running) { 2717c478bd9Sstevel@tonic-gate /* 2727c478bd9Sstevel@tonic-gate * Read audit_control and create plugin lists. 2737c478bd9Sstevel@tonic-gate * 2747c478bd9Sstevel@tonic-gate * loadauditlist() and auditd_thread_init() are called 2757c478bd9Sstevel@tonic-gate * while under the plugin_mutex lock to avoid a race 2767c478bd9Sstevel@tonic-gate * with unload_plugin(). 2777c478bd9Sstevel@tonic-gate */ 2787c478bd9Sstevel@tonic-gate if (reset_list || reset_file) { 2797c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&plugin_mutex); 2807c478bd9Sstevel@tonic-gate if (reset_list) 2817c478bd9Sstevel@tonic-gate loadauditlist(); 2827c478bd9Sstevel@tonic-gate 2837c478bd9Sstevel@tonic-gate if (auditd_thread_init()) { 2847c478bd9Sstevel@tonic-gate auditd_thread_close(); 2857c478bd9Sstevel@tonic-gate /* continue; wait for audit -s */ 2867c478bd9Sstevel@tonic-gate } 2877c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&plugin_mutex); 2887c478bd9Sstevel@tonic-gate reset_list = 0; 2897c478bd9Sstevel@tonic-gate } 2907c478bd9Sstevel@tonic-gate /* 2917c478bd9Sstevel@tonic-gate * tell parent I'm running whether or not the initialization 2927c478bd9Sstevel@tonic-gate * actually worked. The failure case is to wait for an 2937c478bd9Sstevel@tonic-gate * audit -n or audit -s to fix the problem. 2947c478bd9Sstevel@tonic-gate */ 2957c478bd9Sstevel@tonic-gate if (pid != 0) { 2967c478bd9Sstevel@tonic-gate (void) kill(pid, AU_SIG_DISABLE); 2977c478bd9Sstevel@tonic-gate pid = 0; 2987c478bd9Sstevel@tonic-gate } 2997c478bd9Sstevel@tonic-gate /* 3007c478bd9Sstevel@tonic-gate * thread_signal() signals main (this thread) when 3017c478bd9Sstevel@tonic-gate * it has received a signal. 3027c478bd9Sstevel@tonic-gate */ 3037c478bd9Sstevel@tonic-gate DPRINT((dbfp, "main thread is waiting\n")); 3047c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&(main_thr.thd_mutex)); 3057c478bd9Sstevel@tonic-gate 3067c478bd9Sstevel@tonic-gate if (!(caught_readc || caught_term || caught_alrm || 3077c478bd9Sstevel@tonic-gate caught_nextd)) 3087c478bd9Sstevel@tonic-gate (void) pthread_cond_wait(&(main_thr.thd_cv), 3097c478bd9Sstevel@tonic-gate &(main_thr.thd_mutex)); 3107c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&(main_thr.thd_mutex)); 3117c478bd9Sstevel@tonic-gate /* 3127c478bd9Sstevel@tonic-gate * Got here because a signal came in. 3137c478bd9Sstevel@tonic-gate * Since we may have gotten more than one, we assume a 3147c478bd9Sstevel@tonic-gate * priority scheme with SIGALRM being the most 3157c478bd9Sstevel@tonic-gate * significant. 3167c478bd9Sstevel@tonic-gate */ 3177c478bd9Sstevel@tonic-gate if (caught_alrm) { 3187c478bd9Sstevel@tonic-gate /* 3197c478bd9Sstevel@tonic-gate * We have returned from our timed wait for 3207c478bd9Sstevel@tonic-gate * c2audit to calm down. We need to really shut 3217c478bd9Sstevel@tonic-gate * down here. 3227c478bd9Sstevel@tonic-gate */ 3237c478bd9Sstevel@tonic-gate caught_alrm = 0; 3247c478bd9Sstevel@tonic-gate running = 0; /* shut down now */ 3257c478bd9Sstevel@tonic-gate } else if (caught_term) { 3267c478bd9Sstevel@tonic-gate /* 3277c478bd9Sstevel@tonic-gate * we are going to shut down, but need to 3287c478bd9Sstevel@tonic-gate * allow time for the audit queues in 3297c478bd9Sstevel@tonic-gate * c2audit and for the threads to empty. 3307c478bd9Sstevel@tonic-gate */ 3317c478bd9Sstevel@tonic-gate 3327c478bd9Sstevel@tonic-gate p = plugin_head; 3337c478bd9Sstevel@tonic-gate while (p != NULL) { 3347c478bd9Sstevel@tonic-gate DPRINT((dbfp, "signalling thread %d\n", 3357c478bd9Sstevel@tonic-gate p->plg_tid)); 3367c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&(p->plg_mutex)); 3377c478bd9Sstevel@tonic-gate p->plg_removed = 1; 3387c478bd9Sstevel@tonic-gate 3397c478bd9Sstevel@tonic-gate if (p->plg_initialized) 3407c478bd9Sstevel@tonic-gate (void) pthread_cond_signal( 3417c478bd9Sstevel@tonic-gate &(p->plg_cv)); 3427c478bd9Sstevel@tonic-gate 3437c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&(p->plg_mutex)); 3447c478bd9Sstevel@tonic-gate p = p->plg_next; 3457c478bd9Sstevel@tonic-gate } 3467c478bd9Sstevel@tonic-gate 3477c478bd9Sstevel@tonic-gate caught_alrm = 0; 3487c478bd9Sstevel@tonic-gate caught_readc = 0; 3497c478bd9Sstevel@tonic-gate caught_term = 0; 3507c478bd9Sstevel@tonic-gate caught_nextd = 0; 3517c478bd9Sstevel@tonic-gate 3527c478bd9Sstevel@tonic-gate DPRINT((dbfp, 3537c478bd9Sstevel@tonic-gate "main thread is pausing before exit.\n")); 3547c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&(main_thr.thd_mutex)); 3557c478bd9Sstevel@tonic-gate caught_alrm = 0; 3567c478bd9Sstevel@tonic-gate (void) alarm(ALRM_TIME); 3577c478bd9Sstevel@tonic-gate while (!caught_alrm) 3587c478bd9Sstevel@tonic-gate (void) pthread_cond_wait(&(main_thr.thd_cv), 3597c478bd9Sstevel@tonic-gate &(main_thr.thd_mutex)); 3607c478bd9Sstevel@tonic-gate 3617c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&(main_thr.thd_mutex)); 3627c478bd9Sstevel@tonic-gate 3637c478bd9Sstevel@tonic-gate running = 0; /* Close down auditing and exit */ 3647c478bd9Sstevel@tonic-gate } else if (caught_readc) { 3657c478bd9Sstevel@tonic-gate /* 3667c478bd9Sstevel@tonic-gate * if both hup and usr1 are caught, the logic in 3677c478bd9Sstevel@tonic-gate * loadauditlist() results in hup winning. The 3687c478bd9Sstevel@tonic-gate * result will be that the audit file is not rolled 3697c478bd9Sstevel@tonic-gate * over unless audit_control actually changed. 3707c478bd9Sstevel@tonic-gate * 3717c478bd9Sstevel@tonic-gate * They want to reread the audit_control file. 3727c478bd9Sstevel@tonic-gate * Set reset_list which will return us to the 3737c478bd9Sstevel@tonic-gate * main while loop in the main routine. 3747c478bd9Sstevel@tonic-gate */ 3757c478bd9Sstevel@tonic-gate caught_readc = 0; 3767c478bd9Sstevel@tonic-gate reset_list = 1; 3777c478bd9Sstevel@tonic-gate } else if (caught_nextd) { 3787c478bd9Sstevel@tonic-gate /* 3797c478bd9Sstevel@tonic-gate * This is a special case for the binfile 3807c478bd9Sstevel@tonic-gate * plugin. (audit -n) NULL out kvlist 3817c478bd9Sstevel@tonic-gate * so binfile won't re-read audit_control 3827c478bd9Sstevel@tonic-gate */ 3837c478bd9Sstevel@tonic-gate caught_nextd = 0; 3847c478bd9Sstevel@tonic-gate reset_file = 1; 3857c478bd9Sstevel@tonic-gate if (binfile != NULL) { 3867c478bd9Sstevel@tonic-gate _kva_free(binfile->plg_kvlist); 3877c478bd9Sstevel@tonic-gate binfile->plg_kvlist = NULL; 3887c478bd9Sstevel@tonic-gate binfile->plg_reopen = 1; 3897c478bd9Sstevel@tonic-gate } 3907c478bd9Sstevel@tonic-gate } 3917c478bd9Sstevel@tonic-gate } /* end while (running) */ 3927c478bd9Sstevel@tonic-gate auditd_thread_close(); 3937c478bd9Sstevel@tonic-gate 3947c478bd9Sstevel@tonic-gate auditd_exit(0); 3957c478bd9Sstevel@tonic-gate return (0); 3967c478bd9Sstevel@tonic-gate } 3977c478bd9Sstevel@tonic-gate 3987c478bd9Sstevel@tonic-gate /* 3997c478bd9Sstevel@tonic-gate * my_sleep - sleep for SLEEP_TIME seconds but only accept the signals 4007c478bd9Sstevel@tonic-gate * that we want to accept. (Premature termination just means the 4017c478bd9Sstevel@tonic-gate * caller retries more often, not a big deal.) 4027c478bd9Sstevel@tonic-gate */ 4037c478bd9Sstevel@tonic-gate 4047c478bd9Sstevel@tonic-gate static void 4057c478bd9Sstevel@tonic-gate my_sleep() 4067c478bd9Sstevel@tonic-gate { 4077c478bd9Sstevel@tonic-gate DPRINT((dbfp, "auditd: sleeping for 20 seconds\n")); 4087c478bd9Sstevel@tonic-gate /* 4097c478bd9Sstevel@tonic-gate * Set timer to "sleep" 4107c478bd9Sstevel@tonic-gate */ 4117c478bd9Sstevel@tonic-gate (void) alarm(SLEEP_TIME); 4127c478bd9Sstevel@tonic-gate 4137c478bd9Sstevel@tonic-gate DPRINT((dbfp, "main thread is waiting for SIGALRM before exit.\n")); 4147c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&(main_thr.thd_mutex)); 4157c478bd9Sstevel@tonic-gate (void) pthread_cond_wait(&(main_thr.thd_cv), &(main_thr.thd_mutex)); 4167c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&(main_thr.thd_mutex)); 4177c478bd9Sstevel@tonic-gate 4187c478bd9Sstevel@tonic-gate if (caught_term) { 4197c478bd9Sstevel@tonic-gate DPRINT((dbfp, "normal AU_SIG_DISABLE exit\n")); 4207c478bd9Sstevel@tonic-gate /* 4217c478bd9Sstevel@tonic-gate * Exit, as requested. 4227c478bd9Sstevel@tonic-gate */ 4237c478bd9Sstevel@tonic-gate auditd_thread_close(); 4247c478bd9Sstevel@tonic-gate } 4257c478bd9Sstevel@tonic-gate if (caught_readc) 4267c478bd9Sstevel@tonic-gate reset_list = 1; /* Reread the audit_control file */ 4277c478bd9Sstevel@tonic-gate 4287c478bd9Sstevel@tonic-gate caught_readc = 0; 4297c478bd9Sstevel@tonic-gate caught_nextd = 0; 4307c478bd9Sstevel@tonic-gate } 4317c478bd9Sstevel@tonic-gate 4327c478bd9Sstevel@tonic-gate /* 4337c478bd9Sstevel@tonic-gate * search for $ISA/ in path and replace it with "" if auditd 4347c478bd9Sstevel@tonic-gate * is 32 bit, else "sparcv9/" The plugin $ISA must match however 4357c478bd9Sstevel@tonic-gate * auditd was compiled. 4367c478bd9Sstevel@tonic-gate */ 4377c478bd9Sstevel@tonic-gate 4387c478bd9Sstevel@tonic-gate static void 4397c478bd9Sstevel@tonic-gate isa_ified(char *path, char **newpath) 4407c478bd9Sstevel@tonic-gate { 4417c478bd9Sstevel@tonic-gate char *p, *q; 4427c478bd9Sstevel@tonic-gate 4437c478bd9Sstevel@tonic-gate if (((p = strchr(path, '$')) != NULL) && 4447c478bd9Sstevel@tonic-gate (strncmp("$ISA/", p, 5) == 0)) { 4457c478bd9Sstevel@tonic-gate (void) memcpy(*newpath, path, p - path); 4467c478bd9Sstevel@tonic-gate q = *newpath + (p - path); 4477c478bd9Sstevel@tonic-gate #ifdef __sparcv9 4487c478bd9Sstevel@tonic-gate q += strlcpy(q, "sparcv9/", avail_length); 4497c478bd9Sstevel@tonic-gate #endif 4507c478bd9Sstevel@tonic-gate (void) strcpy(q, p + 5); 4517c478bd9Sstevel@tonic-gate } else 4527c478bd9Sstevel@tonic-gate *newpath = path; 4537c478bd9Sstevel@tonic-gate } 4547c478bd9Sstevel@tonic-gate 4557c478bd9Sstevel@tonic-gate /* 4567c478bd9Sstevel@tonic-gate * init_plugin first searches the existing plugin list to see 4577c478bd9Sstevel@tonic-gate * if the plugin already has been defined; if not, it creates it 4587c478bd9Sstevel@tonic-gate * and links it into the list. It returns a pointer to the found 4597c478bd9Sstevel@tonic-gate * or created struct. A change of path in audit_control for a 4607c478bd9Sstevel@tonic-gate * given plugin will cause a miss. 4617c478bd9Sstevel@tonic-gate */ 4627c478bd9Sstevel@tonic-gate /* 4637c478bd9Sstevel@tonic-gate * for 64 bits, the path name can grow 3 bytes (minus 5 for the 4647c478bd9Sstevel@tonic-gate * removed "$ISA" and plus 8 for the added "sparcv9/" 4657c478bd9Sstevel@tonic-gate */ 4667c478bd9Sstevel@tonic-gate 4677c478bd9Sstevel@tonic-gate #define ISA_GROW 8 - 5 4687c478bd9Sstevel@tonic-gate 4697c478bd9Sstevel@tonic-gate static plugin_t * 4707c478bd9Sstevel@tonic-gate init_plugin(char *name, kva_t *list, int cnt_flag) 4717c478bd9Sstevel@tonic-gate { 4727c478bd9Sstevel@tonic-gate plugin_t *p, *q; 4737c478bd9Sstevel@tonic-gate char filepath[MAXPATHLEN + 1 + ISA_GROW]; 4747c478bd9Sstevel@tonic-gate char *path = filepath; 4757c478bd9Sstevel@tonic-gate 4767c478bd9Sstevel@tonic-gate if (*name != '/') { 4777c478bd9Sstevel@tonic-gate #ifdef __sparcv9 4787c478bd9Sstevel@tonic-gate (void) strcpy(filepath, "/usr/lib/security/sparcv9/"); 4797c478bd9Sstevel@tonic-gate #else 4807c478bd9Sstevel@tonic-gate (void) strcpy(filepath, "/usr/lib/security/"); 4817c478bd9Sstevel@tonic-gate #endif 4827c478bd9Sstevel@tonic-gate if (strlcat(filepath, name, MAXPATHLEN) >= MAXPATHLEN) 4837c478bd9Sstevel@tonic-gate return (NULL); 4847c478bd9Sstevel@tonic-gate } else { 4857c478bd9Sstevel@tonic-gate if (strlen(name) > MAXPATHLEN + ISA_GROW) 4867c478bd9Sstevel@tonic-gate return (NULL); 4877c478bd9Sstevel@tonic-gate isa_ified(name, &path); 4887c478bd9Sstevel@tonic-gate } 4897c478bd9Sstevel@tonic-gate p = plugin_head; 4907c478bd9Sstevel@tonic-gate q = plugin_head; 4917c478bd9Sstevel@tonic-gate while (p != NULL) { 4927c478bd9Sstevel@tonic-gate if (p->plg_path != NULL) { 4937c478bd9Sstevel@tonic-gate if (strcmp(p->plg_path, path) == 0) { 4947c478bd9Sstevel@tonic-gate p->plg_removed = 0; 4957c478bd9Sstevel@tonic-gate p->plg_to_be_removed = 0; 4967c478bd9Sstevel@tonic-gate p->plg_cnt = cnt_flag; 4977c478bd9Sstevel@tonic-gate 4987c478bd9Sstevel@tonic-gate _kva_free(p->plg_kvlist); 4997c478bd9Sstevel@tonic-gate p->plg_kvlist = list; 5007c478bd9Sstevel@tonic-gate p->plg_reopen = 1; 5017c478bd9Sstevel@tonic-gate DPRINT((dbfp, "reusing %s\n", p->plg_path)); 5027c478bd9Sstevel@tonic-gate return (p); 5037c478bd9Sstevel@tonic-gate } 5047c478bd9Sstevel@tonic-gate } 5057c478bd9Sstevel@tonic-gate q = p; 5067c478bd9Sstevel@tonic-gate p = p->plg_next; 5077c478bd9Sstevel@tonic-gate } 5087c478bd9Sstevel@tonic-gate DPRINT((dbfp, "creating new plugin structure for %s\n", path)); 5097c478bd9Sstevel@tonic-gate 5107c478bd9Sstevel@tonic-gate p = malloc(sizeof (plugin_t)); 5117c478bd9Sstevel@tonic-gate 5127c478bd9Sstevel@tonic-gate if (p == NULL) { 5137c478bd9Sstevel@tonic-gate perror("auditd"); 5147c478bd9Sstevel@tonic-gate return (NULL); 5157c478bd9Sstevel@tonic-gate } 5167c478bd9Sstevel@tonic-gate if (q == NULL) 5177c478bd9Sstevel@tonic-gate plugin_head = p; 5187c478bd9Sstevel@tonic-gate else 5197c478bd9Sstevel@tonic-gate q->plg_next = p; 5207c478bd9Sstevel@tonic-gate 5217c478bd9Sstevel@tonic-gate p->plg_next = NULL; 5227c478bd9Sstevel@tonic-gate p->plg_initialized = 0; 5237c478bd9Sstevel@tonic-gate p->plg_reopen = 1; 5247c478bd9Sstevel@tonic-gate p->plg_tid = 0; 5257c478bd9Sstevel@tonic-gate p->plg_removed = 0; 5267c478bd9Sstevel@tonic-gate p->plg_to_be_removed = 0; 5277c478bd9Sstevel@tonic-gate p->plg_tossed = 0; 5287c478bd9Sstevel@tonic-gate p->plg_queued = 0; 5297c478bd9Sstevel@tonic-gate p->plg_output = 0; 5307c478bd9Sstevel@tonic-gate p->plg_sequence = 1; 5317c478bd9Sstevel@tonic-gate p->plg_last_seq_out = 0; 5327c478bd9Sstevel@tonic-gate p->plg_path = strdup(path); 5337c478bd9Sstevel@tonic-gate p->plg_kvlist = list; 5347c478bd9Sstevel@tonic-gate p->plg_cnt = cnt_flag; 5357c478bd9Sstevel@tonic-gate p->plg_retry_time = SLEEP_TIME; 5367c478bd9Sstevel@tonic-gate p->plg_qmax = 0; 5377c478bd9Sstevel@tonic-gate p->plg_save_q_copy = NULL; 5387c478bd9Sstevel@tonic-gate 5397c478bd9Sstevel@tonic-gate DPRINT((dbfp, "created plugin: %s\n", path)); 5407c478bd9Sstevel@tonic-gate return (p); 5417c478bd9Sstevel@tonic-gate } 5427c478bd9Sstevel@tonic-gate 5437c478bd9Sstevel@tonic-gate /* 5447c478bd9Sstevel@tonic-gate * loadauditlist - read the directory list from the audit_control file. 5457c478bd9Sstevel@tonic-gate * to determine if a binary file is to be written. 5467c478bd9Sstevel@tonic-gate * - read the plugin entries from the audit_control file 5477c478bd9Sstevel@tonic-gate * 5487c478bd9Sstevel@tonic-gate * globals - 5497c478bd9Sstevel@tonic-gate * 5507c478bd9Sstevel@tonic-gate * plugin queues 5517c478bd9Sstevel@tonic-gate * 5527c478bd9Sstevel@tonic-gate * success is when at least one plug in is defined. 5537c478bd9Sstevel@tonic-gate * 5547c478bd9Sstevel@tonic-gate * set cnt policy here based on auditconfig setting. future could 5557c478bd9Sstevel@tonic-gate * have a policy = {+|-}cnt entry per plugin with auditconfig providing the 5567c478bd9Sstevel@tonic-gate * default. 5577c478bd9Sstevel@tonic-gate */ 5587c478bd9Sstevel@tonic-gate 5597c478bd9Sstevel@tonic-gate static void 5607c478bd9Sstevel@tonic-gate loadauditlist() 5617c478bd9Sstevel@tonic-gate { 5627c478bd9Sstevel@tonic-gate char buf[MAXPATHLEN]; 5637c478bd9Sstevel@tonic-gate char *value; 5647c478bd9Sstevel@tonic-gate plugin_t *p; 5657c478bd9Sstevel@tonic-gate int acresult; 5667c478bd9Sstevel@tonic-gate int wait_count = 0; 5677c478bd9Sstevel@tonic-gate kva_t *kvlist; 5687c478bd9Sstevel@tonic-gate long policy; 5697c478bd9Sstevel@tonic-gate int cnt_flag; 5707c478bd9Sstevel@tonic-gate struct au_qctrl kqmax; 5717c478bd9Sstevel@tonic-gate au_acinfo_t *ach = NULL; 5727c478bd9Sstevel@tonic-gate int got_dir = 0; 5737c478bd9Sstevel@tonic-gate int have_plugin = 0; 5747c478bd9Sstevel@tonic-gate char *endptr; 5757c478bd9Sstevel@tonic-gate 5767c478bd9Sstevel@tonic-gate if (auditon(A_GETPOLICY, (char *)&policy, 0) == -1) { 5777c478bd9Sstevel@tonic-gate DPRINT((dbfp, "auditon(A_GETPOLICY...) failed (exit)\n")); 5787c478bd9Sstevel@tonic-gate __audit_dowarn("auditoff", "", 0); 5797c478bd9Sstevel@tonic-gate auditd_thread_close(); 5807c478bd9Sstevel@tonic-gate auditd_exit(5); 5817c478bd9Sstevel@tonic-gate } 5827c478bd9Sstevel@tonic-gate cnt_flag = ((policy & AUDIT_CNT) != 0) ? 1 : 0; 5837c478bd9Sstevel@tonic-gate DPRINT((dbfp, "loadauditlist: policy is to %s\n", (cnt_flag == 1) ? 5847c478bd9Sstevel@tonic-gate "continue" : "block")); 5857c478bd9Sstevel@tonic-gate 5867c478bd9Sstevel@tonic-gate #if DEBUG 5877c478bd9Sstevel@tonic-gate if (auditon(A_GETCOND, (caddr_t)&acresult, (int)sizeof (int)) != 5887c478bd9Sstevel@tonic-gate 0) 5897c478bd9Sstevel@tonic-gate DPRINT((dbfp, "auditon(A_GETCOND...) failed (exit)\n")); 5907c478bd9Sstevel@tonic-gate #endif 5917c478bd9Sstevel@tonic-gate DPRINT((dbfp, "audit cond = %d (1 is on)\n", acresult)); 5927c478bd9Sstevel@tonic-gate 5937c478bd9Sstevel@tonic-gate 5947c478bd9Sstevel@tonic-gate if (auditon(A_GETQCTRL, (char *)&kqmax, sizeof (struct au_qctrl)) != 5957c478bd9Sstevel@tonic-gate 0) { 5967c478bd9Sstevel@tonic-gate DPRINT((dbfp, "auditon(A_GETQCTRL...) failed (exit)\n")); 5977c478bd9Sstevel@tonic-gate __audit_dowarn("auditoff", "", 0); 5987c478bd9Sstevel@tonic-gate auditd_thread_close(); 5997c478bd9Sstevel@tonic-gate auditd_exit(6); 6007c478bd9Sstevel@tonic-gate } 6017c478bd9Sstevel@tonic-gate kqmax.aq_hiwater *= 5; /* RAM is cheaper in userspace */ 6027c478bd9Sstevel@tonic-gate DPRINT((dbfp, "auditd: reading audit_control\n")); 6037c478bd9Sstevel@tonic-gate 6047c478bd9Sstevel@tonic-gate p = plugin_head; 6057c478bd9Sstevel@tonic-gate /* 6067c478bd9Sstevel@tonic-gate * two-step on setting p->plg_removed because the input thread 6077c478bd9Sstevel@tonic-gate * in doorway.c uses p->plg_removed to decide if the plugin is 6087c478bd9Sstevel@tonic-gate * active. 6097c478bd9Sstevel@tonic-gate */ 6107c478bd9Sstevel@tonic-gate while (p != NULL) { 6117c478bd9Sstevel@tonic-gate DPRINT((dbfp, "loadauditlist: %X, %s previously created\n", 6127c478bd9Sstevel@tonic-gate p, p->plg_path)); 6137c478bd9Sstevel@tonic-gate p->plg_to_be_removed = 1; /* tentative removal */ 6147c478bd9Sstevel@tonic-gate p = p->plg_next; 6157c478bd9Sstevel@tonic-gate } 6167c478bd9Sstevel@tonic-gate /* 6177c478bd9Sstevel@tonic-gate * have_plugin may over count by one if both a "dir" entry 6187c478bd9Sstevel@tonic-gate * and a "plugin" entry for binfile are found. All that 6197c478bd9Sstevel@tonic-gate * matters is that it be zero if no plugin or dir entries 6207c478bd9Sstevel@tonic-gate * are found. 6217c478bd9Sstevel@tonic-gate */ 6227c478bd9Sstevel@tonic-gate have_plugin = 0; 6237c478bd9Sstevel@tonic-gate for (;;) { 6247c478bd9Sstevel@tonic-gate /* NULL == use standard path for audit_control */ 6257c478bd9Sstevel@tonic-gate ach = _openac(NULL); 6267c478bd9Sstevel@tonic-gate /* 6277c478bd9Sstevel@tonic-gate * loop until a directory entry is found (0) or eof (-1) 6287c478bd9Sstevel@tonic-gate */ 6297c478bd9Sstevel@tonic-gate while (((acresult = _getacdir(ach, buf, sizeof (buf))) != 0) && 6307c478bd9Sstevel@tonic-gate acresult != -1) { 6317c478bd9Sstevel@tonic-gate } 6327c478bd9Sstevel@tonic-gate if (acresult == 0) { 6337c478bd9Sstevel@tonic-gate DPRINT((dbfp, 6347c478bd9Sstevel@tonic-gate "loadauditlist: " 6357c478bd9Sstevel@tonic-gate "got binfile via old config syntax\n")); 6367c478bd9Sstevel@tonic-gate /* 6377c478bd9Sstevel@tonic-gate * A directory entry was found. 6387c478bd9Sstevel@tonic-gate */ 6397c478bd9Sstevel@tonic-gate got_dir = 1; 6407c478bd9Sstevel@tonic-gate kvlist = _str2kva("name=audit_binfile.so.1", 6417c478bd9Sstevel@tonic-gate "=", ";"); 6427c478bd9Sstevel@tonic-gate 6437c478bd9Sstevel@tonic-gate p = init_plugin("audit_binfile.so.1", kvlist, cnt_flag); 6447c478bd9Sstevel@tonic-gate 6457c478bd9Sstevel@tonic-gate if (p != NULL) { 6467c478bd9Sstevel@tonic-gate binfile = p; 6477c478bd9Sstevel@tonic-gate p->plg_qmax = kqmax.aq_hiwater; 6487c478bd9Sstevel@tonic-gate have_plugin++; 6497c478bd9Sstevel@tonic-gate } 6507c478bd9Sstevel@tonic-gate } 6517c478bd9Sstevel@tonic-gate /* 6527c478bd9Sstevel@tonic-gate * collect plugin entries. If there is an entry for 6537c478bd9Sstevel@tonic-gate * binfile.so.1, the parameters from the plugin line 6547c478bd9Sstevel@tonic-gate * override those set above. For binfile, p_dir is 6557c478bd9Sstevel@tonic-gate * required only if dir wasn't specified elsewhere in 6567c478bd9Sstevel@tonic-gate * audit_control 6577c478bd9Sstevel@tonic-gate */ 6587c478bd9Sstevel@tonic-gate _rewindac(ach); 6597c478bd9Sstevel@tonic-gate while ((acresult = _getacplug(ach, &kvlist)) == 0) { 6607c478bd9Sstevel@tonic-gate value = kva_match(kvlist, "name"); 6617c478bd9Sstevel@tonic-gate if (value == NULL) 6627c478bd9Sstevel@tonic-gate break; 6637c478bd9Sstevel@tonic-gate DPRINT((dbfp, "loadauditlist: have an entry for %s\n", 6647c478bd9Sstevel@tonic-gate value)); 6657c478bd9Sstevel@tonic-gate p = init_plugin(value, kvlist, cnt_flag); 6667c478bd9Sstevel@tonic-gate if (p == NULL) 6677c478bd9Sstevel@tonic-gate continue; 6687c478bd9Sstevel@tonic-gate 6697c478bd9Sstevel@tonic-gate if (strstr(value, "/audit_binfile.so") != NULL) { 6707c478bd9Sstevel@tonic-gate binfile = p; 6717c478bd9Sstevel@tonic-gate if (!got_dir && 6727c478bd9Sstevel@tonic-gate (kva_match(kvlist, "p_dir") == 6737c478bd9Sstevel@tonic-gate NULL)) { 6747c478bd9Sstevel@tonic-gate __audit_dowarn("getacdir", "", 6757c478bd9Sstevel@tonic-gate wait_count); 6767c478bd9Sstevel@tonic-gate } 6777c478bd9Sstevel@tonic-gate } 6787c478bd9Sstevel@tonic-gate p->plg_qmax = kqmax.aq_hiwater; /* default */ 6797c478bd9Sstevel@tonic-gate value = kva_match(kvlist, "qsize"); 6807c478bd9Sstevel@tonic-gate if (value != NULL) { 6817c478bd9Sstevel@tonic-gate long tmp; 6827c478bd9Sstevel@tonic-gate 6837c478bd9Sstevel@tonic-gate tmp = strtol(value, &endptr, 10); 6847c478bd9Sstevel@tonic-gate if (*endptr == '\0') 6857c478bd9Sstevel@tonic-gate p->plg_qmax = tmp; 6867c478bd9Sstevel@tonic-gate } 687*9697ae98Sgww DPRINT((dbfp, "%s queue max = %d\n", p->plg_path, 688*9697ae98Sgww p->plg_qmax)); 6897c478bd9Sstevel@tonic-gate 6907c478bd9Sstevel@tonic-gate have_plugin++; 6917c478bd9Sstevel@tonic-gate } 6927c478bd9Sstevel@tonic-gate _endac(ach); 6937c478bd9Sstevel@tonic-gate if (have_plugin != 0) 6947c478bd9Sstevel@tonic-gate break; 6957c478bd9Sstevel@tonic-gate /* 6967c478bd9Sstevel@tonic-gate * there was a problem getting the directory 6977c478bd9Sstevel@tonic-gate * list or remote host info from the audit_control file 6987c478bd9Sstevel@tonic-gate */ 6997c478bd9Sstevel@tonic-gate wait_count++; 7007c478bd9Sstevel@tonic-gate #if DEBUG 7017c478bd9Sstevel@tonic-gate if (wait_count < 2) 7027c478bd9Sstevel@tonic-gate DPRINT((dbfp, 7037c478bd9Sstevel@tonic-gate "auditd: problem getting directory " 7047c478bd9Sstevel@tonic-gate "/ or plugin list from audit_control.\n")); 7057c478bd9Sstevel@tonic-gate #endif /* DEBUG */ 7067c478bd9Sstevel@tonic-gate __audit_dowarn("getacdir", "", wait_count); 7077c478bd9Sstevel@tonic-gate /* 7087c478bd9Sstevel@tonic-gate * sleep for SLEEP_TIME seconds. 7097c478bd9Sstevel@tonic-gate */ 7107c478bd9Sstevel@tonic-gate my_sleep(); 7117c478bd9Sstevel@tonic-gate } /* end for(;;) */ 7127c478bd9Sstevel@tonic-gate 7137c478bd9Sstevel@tonic-gate p = plugin_head; 7147c478bd9Sstevel@tonic-gate while (p != NULL) { 7157c478bd9Sstevel@tonic-gate DPRINT((dbfp, "loadauditlist: %s remove flag=%d; cnt=%d\n", 7167c478bd9Sstevel@tonic-gate p->plg_path, p->plg_to_be_removed, p->plg_cnt)); 7177c478bd9Sstevel@tonic-gate p->plg_removed = p->plg_to_be_removed; 7187c478bd9Sstevel@tonic-gate p = p->plg_next; 7197c478bd9Sstevel@tonic-gate } 7207c478bd9Sstevel@tonic-gate } 7217c478bd9Sstevel@tonic-gate 7227c478bd9Sstevel@tonic-gate /* 7237c478bd9Sstevel@tonic-gate * block signals -- thread-specific blocking of the signals expected 7247c478bd9Sstevel@tonic-gate * by the main thread. 7257c478bd9Sstevel@tonic-gate */ 7267c478bd9Sstevel@tonic-gate 7277c478bd9Sstevel@tonic-gate static void 7287c478bd9Sstevel@tonic-gate block_signals() 7297c478bd9Sstevel@tonic-gate { 7307c478bd9Sstevel@tonic-gate sigset_t set; 7317c478bd9Sstevel@tonic-gate 7327c478bd9Sstevel@tonic-gate (void) sigfillset(&set); 7337c478bd9Sstevel@tonic-gate (void) pthread_sigmask(SIG_BLOCK, &set, NULL); 7347c478bd9Sstevel@tonic-gate } 7357c478bd9Sstevel@tonic-gate 7367c478bd9Sstevel@tonic-gate /* 7377c478bd9Sstevel@tonic-gate * signal_thread is the designated signal catcher. It wakes up the 7387c478bd9Sstevel@tonic-gate * main thread whenever it receives a signal and then goes back to 7397c478bd9Sstevel@tonic-gate * sleep; it does not exit. The global variables caught_* let 7407c478bd9Sstevel@tonic-gate * the main thread which signal was received. 7417c478bd9Sstevel@tonic-gate * 7427c478bd9Sstevel@tonic-gate * The thread is created with all signals blocked. 7437c478bd9Sstevel@tonic-gate */ 7447c478bd9Sstevel@tonic-gate 7457c478bd9Sstevel@tonic-gate static void 7467c478bd9Sstevel@tonic-gate signal_thread() 7477c478bd9Sstevel@tonic-gate { 7487c478bd9Sstevel@tonic-gate sigset_t set; 7497c478bd9Sstevel@tonic-gate int signal_caught; 7507c478bd9Sstevel@tonic-gate 7517c478bd9Sstevel@tonic-gate DPRINT((dbfp, "the signal thread is thread %d\n", 7527c478bd9Sstevel@tonic-gate pthread_self())); 7537c478bd9Sstevel@tonic-gate 7547c478bd9Sstevel@tonic-gate (void) sigemptyset(&set); 7557c478bd9Sstevel@tonic-gate (void) sigaddset(&set, SIGALRM); 7567c478bd9Sstevel@tonic-gate (void) sigaddset(&set, AU_SIG_DISABLE); 7577c478bd9Sstevel@tonic-gate (void) sigaddset(&set, AU_SIG_READ_CONTROL); 7587c478bd9Sstevel@tonic-gate (void) sigaddset(&set, AU_SIG_NEXT_DIR); 7597c478bd9Sstevel@tonic-gate 7607c478bd9Sstevel@tonic-gate for (;;) { 7617c478bd9Sstevel@tonic-gate signal_caught = sigwait(&set); 7627c478bd9Sstevel@tonic-gate switch (signal_caught) { 7637c478bd9Sstevel@tonic-gate case SIGALRM: 7647c478bd9Sstevel@tonic-gate caught_alrm++; 7657c478bd9Sstevel@tonic-gate DPRINT((dbfp, "caught SIGALRM\n")); 7667c478bd9Sstevel@tonic-gate break; 7677c478bd9Sstevel@tonic-gate case AU_SIG_DISABLE: 7687c478bd9Sstevel@tonic-gate caught_term++; 7697c478bd9Sstevel@tonic-gate DPRINT((dbfp, "caught AU_SIG_DISABLE\n")); 7707c478bd9Sstevel@tonic-gate break; 7717c478bd9Sstevel@tonic-gate case AU_SIG_READ_CONTROL: 7727c478bd9Sstevel@tonic-gate caught_readc++; 7737c478bd9Sstevel@tonic-gate DPRINT((dbfp, "caught AU_SIG_READ_CONTROL\n")); 7747c478bd9Sstevel@tonic-gate break; 7757c478bd9Sstevel@tonic-gate case AU_SIG_NEXT_DIR: 7767c478bd9Sstevel@tonic-gate caught_nextd++; 7777c478bd9Sstevel@tonic-gate DPRINT((dbfp, "caught AU_SIG_NEXT_DIR\n")); 7787c478bd9Sstevel@tonic-gate break; 7797c478bd9Sstevel@tonic-gate default: 7807c478bd9Sstevel@tonic-gate DPRINT((dbfp, "caught unexpected signal: %d\n", 7817c478bd9Sstevel@tonic-gate signal_caught)); 7827c478bd9Sstevel@tonic-gate break; 7837c478bd9Sstevel@tonic-gate } 7847c478bd9Sstevel@tonic-gate (void) pthread_cond_signal(&(main_thr.thd_cv)); 7857c478bd9Sstevel@tonic-gate } 7867c478bd9Sstevel@tonic-gate } 7877c478bd9Sstevel@tonic-gate 7887c478bd9Sstevel@tonic-gate /* 7897c478bd9Sstevel@tonic-gate * do_sethost - do auditon(2) to set the audit host-id. 790*9697ae98Sgww * Returns 0 if success or -1 otherwise. 7917c478bd9Sstevel@tonic-gate */ 7927c478bd9Sstevel@tonic-gate static int 7937c478bd9Sstevel@tonic-gate do_sethost(void) 7947c478bd9Sstevel@tonic-gate { 795*9697ae98Sgww au_tid_addr_t *termid; 7967c478bd9Sstevel@tonic-gate auditinfo_addr_t audit_info; 797*9697ae98Sgww char msg[512]; 7987c478bd9Sstevel@tonic-gate 799*9697ae98Sgww if (adt_load_hostname(NULL, (adt_termid_t **)&termid) < 0) { 800*9697ae98Sgww (void) snprintf(msg, sizeof (msg), "unable to get local " 801*9697ae98Sgww "IP address: %s", strerror(errno)); 802*9697ae98Sgww goto fail; 8037c478bd9Sstevel@tonic-gate } 8047c478bd9Sstevel@tonic-gate /* Get current kernel audit info, and fill in the IP address */ 805*9697ae98Sgww if (auditon(A_GETKAUDIT, (caddr_t)&audit_info, 806*9697ae98Sgww sizeof (audit_info)) < 0) { 807*9697ae98Sgww (void) snprintf(msg, sizeof (msg), "unable to get kernel " 808*9697ae98Sgww "audit info: %s", strerror(errno)); 809*9697ae98Sgww goto fail; 8107c478bd9Sstevel@tonic-gate } 8117c478bd9Sstevel@tonic-gate 812*9697ae98Sgww audit_info.ai_termid = *termid; 8137c478bd9Sstevel@tonic-gate 8147c478bd9Sstevel@tonic-gate /* Update the kernel audit info with new IP address */ 815*9697ae98Sgww if (auditon(A_SETKAUDIT, (caddr_t)&audit_info, 816*9697ae98Sgww sizeof (audit_info)) < 0) { 817*9697ae98Sgww (void) snprintf(msg, sizeof (msg), "unable to set kernel " 818*9697ae98Sgww "audit info: %s", strerror(errno)); 819*9697ae98Sgww goto fail; 8207c478bd9Sstevel@tonic-gate } 8217c478bd9Sstevel@tonic-gate 822*9697ae98Sgww free(termid); 8237c478bd9Sstevel@tonic-gate return (0); 824*9697ae98Sgww 825*9697ae98Sgww fail: 826*9697ae98Sgww free(termid); 827*9697ae98Sgww __audit_syslog("auditd", LOG_PID | LOG_CONS | LOG_NOWAIT, LOG_DAEMON, 828*9697ae98Sgww LOG_ALERT, msg); 829*9697ae98Sgww return (-1); 8307c478bd9Sstevel@tonic-gate } 831