xref: /titanic_51/usr/src/cmd/auditd/auditd.c (revision 9697ae98dd505d4c445dd4336b4defa36e722f79)
17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
5*9697ae98Sgww  * Common Development and Distribution License (the "License").
6*9697ae98Sgww  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
217c478bd9Sstevel@tonic-gate /*
22*9697ae98Sgww  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
237c478bd9Sstevel@tonic-gate  * Use is subject to license terms.
247c478bd9Sstevel@tonic-gate  */
257c478bd9Sstevel@tonic-gate 
267c478bd9Sstevel@tonic-gate #pragma ident	"%Z%%M%	%I%	%E% SMI"
277c478bd9Sstevel@tonic-gate 
287c478bd9Sstevel@tonic-gate /* Audit daemon server */
297c478bd9Sstevel@tonic-gate /*
307c478bd9Sstevel@tonic-gate  * These routines make up the audit daemon server.  This daemon, called
317c478bd9Sstevel@tonic-gate  * auditd, handles the user level parts of auditing.  It receives buffered
327c478bd9Sstevel@tonic-gate  * audit records (usually one or more per buffer, potentially less than
337c478bd9Sstevel@tonic-gate  * one) and passes them to one or more plugins for processing.
347c478bd9Sstevel@tonic-gate  *
357c478bd9Sstevel@tonic-gate  * The major interrupts are AU_SIG_READ_CONTROL (start over),
367c478bd9Sstevel@tonic-gate  * AU_SIG_DISABLE (start shutting down), SIGALRM (quit), and
377c478bd9Sstevel@tonic-gate  * AU_SIG_NEXT_DIR (start a new audit log file). SIGTERM (the implementation
387c478bd9Sstevel@tonic-gate  * value of AU_SIG_DISABLE) is also used for the child to tell the parent
397c478bd9Sstevel@tonic-gate  * that audit is ready.
407c478bd9Sstevel@tonic-gate  *
417c478bd9Sstevel@tonic-gate  * Configuration data comes from /etc/security/audit_control and the auditon
427c478bd9Sstevel@tonic-gate  * system call.
437c478bd9Sstevel@tonic-gate  *
447c478bd9Sstevel@tonic-gate  * The major errors are EBUSY (auditing is already in use) and EINTR
457c478bd9Sstevel@tonic-gate  * (one of the above signals was received).  File space errors are
467c478bd9Sstevel@tonic-gate  * handled by the audit_binfile plugin
477c478bd9Sstevel@tonic-gate  */
487c478bd9Sstevel@tonic-gate 
497c478bd9Sstevel@tonic-gate #define	DEBUG 		0
507c478bd9Sstevel@tonic-gate #define	MEM_TEST	0	/* set to one to generate core dump on exit */
517c478bd9Sstevel@tonic-gate 
527c478bd9Sstevel@tonic-gate #include <assert.h>
53*9697ae98Sgww #include <bsm/adt.h>
547c478bd9Sstevel@tonic-gate #include <bsm/audit.h>
557c478bd9Sstevel@tonic-gate #include <bsm/audit_record.h>
567c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h>
577c478bd9Sstevel@tonic-gate #include <fcntl.h>
587c478bd9Sstevel@tonic-gate #include <libintl.h>
597c478bd9Sstevel@tonic-gate #include <locale.h>
607c478bd9Sstevel@tonic-gate #include <netdb.h>
617c478bd9Sstevel@tonic-gate #include <pwd.h>
627c478bd9Sstevel@tonic-gate #include <secdb.h>
637c478bd9Sstevel@tonic-gate #include <signal.h>
647c478bd9Sstevel@tonic-gate #include <stdio.h>
657c478bd9Sstevel@tonic-gate #include <stdlib.h>
667c478bd9Sstevel@tonic-gate #include <string.h>
67*9697ae98Sgww #include <syslog.h>
687c478bd9Sstevel@tonic-gate #include <errno.h>
697c478bd9Sstevel@tonic-gate #include <sys/file.h>
707c478bd9Sstevel@tonic-gate #include <sys/param.h>
717c478bd9Sstevel@tonic-gate #include <sys/stat.h>
727c478bd9Sstevel@tonic-gate #include <sys/statvfs.h>
737c478bd9Sstevel@tonic-gate #include <sys/time.h>
747c478bd9Sstevel@tonic-gate #include <sys/types.h>
757c478bd9Sstevel@tonic-gate #include <sys/wait.h>
767c478bd9Sstevel@tonic-gate #include <termios.h>
777c478bd9Sstevel@tonic-gate #include <unistd.h>
787c478bd9Sstevel@tonic-gate #include "plugin.h"
797c478bd9Sstevel@tonic-gate #include "audit_sig_infc.h"
807c478bd9Sstevel@tonic-gate #include <audit_plugin.h>
817c478bd9Sstevel@tonic-gate 
827c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)
837c478bd9Sstevel@tonic-gate #define	TEXT_DOMAIN	"SUNW_OST_OSCMD"
847c478bd9Sstevel@tonic-gate #endif
857c478bd9Sstevel@tonic-gate /*
867c478bd9Sstevel@tonic-gate  * After we get a AU_SIG_DISABLE, we want to set a timer for 2 seconds
877c478bd9Sstevel@tonic-gate  * and let c2audit write as many records as it can until the timer
887c478bd9Sstevel@tonic-gate  * goes off(at which point it returns to auditd with SIGALRM).  If any
897c478bd9Sstevel@tonic-gate  * other signals are received during that time, we call
907c478bd9Sstevel@tonic-gate  * __audit_dowarn() to indicate that the queue may not have been fully
917c478bd9Sstevel@tonic-gate  * flushed.
927c478bd9Sstevel@tonic-gate  */
937c478bd9Sstevel@tonic-gate #define	ALRM_TIME	2
947c478bd9Sstevel@tonic-gate #define	SLEEP_TIME	20	/* # of seconds to sleep in all hard loop */
957c478bd9Sstevel@tonic-gate 
967c478bd9Sstevel@tonic-gate #if DEBUG
977c478bd9Sstevel@tonic-gate #define	DPRINT(x) {(void) fprintf x; }
987c478bd9Sstevel@tonic-gate static FILE	*dbfp;	/* debug file */
997c478bd9Sstevel@tonic-gate #else
1007c478bd9Sstevel@tonic-gate #define	DPRINT(x)
1017c478bd9Sstevel@tonic-gate #endif /* DEBUG */
1027c478bd9Sstevel@tonic-gate 
1037c478bd9Sstevel@tonic-gate static plugin_t	*binfile = NULL;
1047c478bd9Sstevel@tonic-gate 
1057c478bd9Sstevel@tonic-gate static int	turn_audit_on  = AUC_AUDITING;
1067c478bd9Sstevel@tonic-gate static int	turn_audit_off = AUC_NOAUDIT;
1077c478bd9Sstevel@tonic-gate 
1087c478bd9Sstevel@tonic-gate static int	running = 1;
1097c478bd9Sstevel@tonic-gate 
1107c478bd9Sstevel@tonic-gate /*
1117c478bd9Sstevel@tonic-gate  * GLOBALS:
1127c478bd9Sstevel@tonic-gate  */
1137c478bd9Sstevel@tonic-gate plugin_t		*plugin_head = NULL;
1147c478bd9Sstevel@tonic-gate static thr_data_t	main_thr;	/* auditd thread (0) */
1157c478bd9Sstevel@tonic-gate pthread_mutex_t		plugin_mutex;	/* for plugin_t list */
1167c478bd9Sstevel@tonic-gate 
1177c478bd9Sstevel@tonic-gate static int	caught_alrm = 0;	/* number of SIGALRMs pending */
1187c478bd9Sstevel@tonic-gate static int	caught_readc = 0;	/* number of AU_SIG_READ_CONTROLs */
1197c478bd9Sstevel@tonic-gate static int	caught_term = 0;	/* number of AU_SIG_DISABLEs pending */
1207c478bd9Sstevel@tonic-gate static int	caught_nextd = 0;	/* number of AU_SIG_NEXT_DIRs pending */
1217c478bd9Sstevel@tonic-gate 
1227c478bd9Sstevel@tonic-gate static int	reset_list = 1;	/* 1 to re-read audit_control */
1237c478bd9Sstevel@tonic-gate static int	reset_file = 1; /* 1 to close/open binary log */
1247c478bd9Sstevel@tonic-gate 
1257c478bd9Sstevel@tonic-gate static int	auditing_set = 0;	/* 1 if auditon(A_SETCOND, on... */
1267c478bd9Sstevel@tonic-gate 
1277c478bd9Sstevel@tonic-gate static void	my_sleep();
1287c478bd9Sstevel@tonic-gate static void	signal_thread();
1297c478bd9Sstevel@tonic-gate static void	loadauditlist();
1307c478bd9Sstevel@tonic-gate static void	block_signals();
1317c478bd9Sstevel@tonic-gate static int	do_sethost();
1327c478bd9Sstevel@tonic-gate 
1337c478bd9Sstevel@tonic-gate /* common exit function */
1347c478bd9Sstevel@tonic-gate void
1357c478bd9Sstevel@tonic-gate auditd_exit(int status)
1367c478bd9Sstevel@tonic-gate {
1377c478bd9Sstevel@tonic-gate #if MEM_TEST
1387c478bd9Sstevel@tonic-gate 	sigset_t	set;
1397c478bd9Sstevel@tonic-gate 
1407c478bd9Sstevel@tonic-gate 	DPRINT((dbfp, "mem_test intentional abort (status=%d)\n",
1417c478bd9Sstevel@tonic-gate 	    status));
1427c478bd9Sstevel@tonic-gate 	abort();
1437c478bd9Sstevel@tonic-gate #endif
1447c478bd9Sstevel@tonic-gate 	DPRINT((dbfp, "%ld exit status = %d auditing_set = %d\n",
1457c478bd9Sstevel@tonic-gate 	    getpid(), status, auditing_set));
1467c478bd9Sstevel@tonic-gate 
1477c478bd9Sstevel@tonic-gate 	if (auditing_set)
1487c478bd9Sstevel@tonic-gate 		(void) auditon(A_SETCOND, (caddr_t)&turn_audit_off,
1497c478bd9Sstevel@tonic-gate 		    (int)sizeof (int));
1507c478bd9Sstevel@tonic-gate 
1517c478bd9Sstevel@tonic-gate 	exit(status);
1527c478bd9Sstevel@tonic-gate }
1537c478bd9Sstevel@tonic-gate 
1547c478bd9Sstevel@tonic-gate /* ARGSUSED */
1557883e825Spaulson int
1567c478bd9Sstevel@tonic-gate main(int argc, char *argv[])
1577c478bd9Sstevel@tonic-gate {
1587c478bd9Sstevel@tonic-gate 	auditinfo_addr_t	as_null;	/* audit state to set */
1597c478bd9Sstevel@tonic-gate 	au_id_t			auid;
1607c478bd9Sstevel@tonic-gate 	pthread_t		tid;
1617c478bd9Sstevel@tonic-gate 	plugin_t		*p;
1627c478bd9Sstevel@tonic-gate 	pid_t			pid;
1637c478bd9Sstevel@tonic-gate 
1647c478bd9Sstevel@tonic-gate #if DEBUG
1657c478bd9Sstevel@tonic-gate 	/* LINTED */
1667c478bd9Sstevel@tonic-gate 	char			*envp;
1677c478bd9Sstevel@tonic-gate 	dbfp = __auditd_debug_file_open();
1687c478bd9Sstevel@tonic-gate #endif
1697c478bd9Sstevel@tonic-gate 	(void) setsid();
1707c478bd9Sstevel@tonic-gate 
1717c478bd9Sstevel@tonic-gate 	/* Internationalization */
1727c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_ALL, "");
1737c478bd9Sstevel@tonic-gate 	(void) textdomain(TEXT_DOMAIN);
1747c478bd9Sstevel@tonic-gate 
1757c478bd9Sstevel@tonic-gate 	/*
1767c478bd9Sstevel@tonic-gate 	 * Set the audit host-id.
1777c478bd9Sstevel@tonic-gate 	 */
1787c478bd9Sstevel@tonic-gate 	if (do_sethost() != 0) {
1797c478bd9Sstevel@tonic-gate 		__audit_dowarn("nostart", "", 0);
1807c478bd9Sstevel@tonic-gate 		auditd_exit(1);
1817c478bd9Sstevel@tonic-gate 	}
1827c478bd9Sstevel@tonic-gate 
1837c478bd9Sstevel@tonic-gate 	/*
1847c478bd9Sstevel@tonic-gate 	 * Turn off all auditing for this process.
1857c478bd9Sstevel@tonic-gate 	 */
1867c478bd9Sstevel@tonic-gate 	if (getaudit_addr(&as_null, sizeof (as_null)) == -1) {
1877c478bd9Sstevel@tonic-gate 		__audit_dowarn("nostart", "", 0);
1887c478bd9Sstevel@tonic-gate 		auditd_exit(2);
1897c478bd9Sstevel@tonic-gate 	}
1907c478bd9Sstevel@tonic-gate 	as_null.ai_mask.as_success = 0;
1917c478bd9Sstevel@tonic-gate 	as_null.ai_mask.as_failure = 0;
1927c478bd9Sstevel@tonic-gate 	(void) setaudit_addr(&as_null, sizeof (as_null));
1937c478bd9Sstevel@tonic-gate 	auid = AU_NOAUDITID;
1947c478bd9Sstevel@tonic-gate 	(void) setauid(&auid);
1957c478bd9Sstevel@tonic-gate 	/*
1967c478bd9Sstevel@tonic-gate 	 * Set the audit state flag to AUDITING.
1977c478bd9Sstevel@tonic-gate 	 */
1987c478bd9Sstevel@tonic-gate 	if (auditon(A_SETCOND, (caddr_t)&turn_audit_on, (int)sizeof (int)) !=
1997c478bd9Sstevel@tonic-gate 	    0) {
2007c478bd9Sstevel@tonic-gate 		DPRINT((dbfp, "auditon(A_SETCOND...) failed (exit)\n"));
2017c478bd9Sstevel@tonic-gate 		__audit_dowarn("nostart", "", 0);
2027c478bd9Sstevel@tonic-gate 		auditd_exit(7);
2037c478bd9Sstevel@tonic-gate 	}
2047c478bd9Sstevel@tonic-gate 
2057c478bd9Sstevel@tonic-gate 	block_signals();
2067c478bd9Sstevel@tonic-gate 
2077c478bd9Sstevel@tonic-gate #if DEBUG
2087c478bd9Sstevel@tonic-gate 	/* output to dbfp shouldn't be duplicated by parent and child */
2097c478bd9Sstevel@tonic-gate 	(void) fflush(dbfp);
2107c478bd9Sstevel@tonic-gate #endif
2117c478bd9Sstevel@tonic-gate 	/*
2127c478bd9Sstevel@tonic-gate 	 * wait for "ready" signal before exit -- for greenline
2137c478bd9Sstevel@tonic-gate 	 */
2147c478bd9Sstevel@tonic-gate 	if (fork()) {
2157c478bd9Sstevel@tonic-gate 		sigset_t	set;
2167c478bd9Sstevel@tonic-gate 		int		signal_caught = 0;
2177c478bd9Sstevel@tonic-gate 
2187c478bd9Sstevel@tonic-gate 		(void) sigemptyset(&set);
2197c478bd9Sstevel@tonic-gate 		(void) sigaddset(&set, AU_SIG_DISABLE);
2207c478bd9Sstevel@tonic-gate 
2217c478bd9Sstevel@tonic-gate 		while (signal_caught != AU_SIG_DISABLE)
2227c478bd9Sstevel@tonic-gate 			signal_caught = sigwait(&set);
2237c478bd9Sstevel@tonic-gate 
2247c478bd9Sstevel@tonic-gate 		DPRINT((dbfp, "init complete:  parent can now exit\n"));
2257c478bd9Sstevel@tonic-gate 
2267c478bd9Sstevel@tonic-gate 		auditd_exit(0);
2277c478bd9Sstevel@tonic-gate 	}
2287c478bd9Sstevel@tonic-gate 	pid = getppid();
2297c478bd9Sstevel@tonic-gate 
2307c478bd9Sstevel@tonic-gate 	auditing_set = 1;
2317c478bd9Sstevel@tonic-gate 
2327c478bd9Sstevel@tonic-gate #if DEBUG && MEM_TEST
2337c478bd9Sstevel@tonic-gate 	envp = getenv("UMEM_DEBUG");
2347c478bd9Sstevel@tonic-gate 	if (envp != NULL)
2357c478bd9Sstevel@tonic-gate 		DPRINT((dbfp, "UMEM_DEBUG=%s\n", envp));
2367c478bd9Sstevel@tonic-gate 	envp = getenv("UMEM_LOGGING");
2377c478bd9Sstevel@tonic-gate 	if (envp != NULL)
2387c478bd9Sstevel@tonic-gate 		DPRINT((dbfp, "UMEM_LOGGING=%s\n", envp));
2397c478bd9Sstevel@tonic-gate #endif
2407c478bd9Sstevel@tonic-gate 	DPRINT((dbfp, "auditd pid=%ld\n", getpid()));
2417c478bd9Sstevel@tonic-gate 
2427c478bd9Sstevel@tonic-gate 	/* thread 0 sync */
2437c478bd9Sstevel@tonic-gate 	(void) pthread_mutex_init(&(main_thr.thd_mutex), NULL);
2447c478bd9Sstevel@tonic-gate 	(void) pthread_cond_init(&(main_thr.thd_cv), NULL);
2457c478bd9Sstevel@tonic-gate 	(void) pthread_mutex_init(&plugin_mutex, NULL);
2467c478bd9Sstevel@tonic-gate 	/*
2477c478bd9Sstevel@tonic-gate 	 * Set up a separate thread for signal handling.
2487c478bd9Sstevel@tonic-gate 	 */
2497c478bd9Sstevel@tonic-gate 	if (pthread_create(&tid, NULL, (void *(*)(void *))signal_thread,
2507c478bd9Sstevel@tonic-gate 	    NULL)) {
2517c478bd9Sstevel@tonic-gate 		(void) fprintf(stderr, gettext(
2527c478bd9Sstevel@tonic-gate 		    "auditd can't create a thread\n"));
2537c478bd9Sstevel@tonic-gate 		auditd_exit(3);
2547c478bd9Sstevel@tonic-gate 	}
2557c478bd9Sstevel@tonic-gate 	/*
2567c478bd9Sstevel@tonic-gate 	 * Set the umask so that only audit or other users in the audit group
2577c478bd9Sstevel@tonic-gate 	 * can get to the files created by auditd.
2587c478bd9Sstevel@tonic-gate 	 */
2597c478bd9Sstevel@tonic-gate 	(void) umask(007);
2607c478bd9Sstevel@tonic-gate 
2617c478bd9Sstevel@tonic-gate 	if (__logpost("")) {	/* Open the audit_data file. */
2627c478bd9Sstevel@tonic-gate 		DPRINT((dbfp, "logpost failed\n"));
2637c478bd9Sstevel@tonic-gate 		auditd_exit(4);
2647c478bd9Sstevel@tonic-gate 	}
2657c478bd9Sstevel@tonic-gate 	/*
2667c478bd9Sstevel@tonic-gate 	 * Here is the main body of the audit daemon.  running == 0 means that
2677c478bd9Sstevel@tonic-gate 	 * after flushing out the audit queue, it is time to exit in response to
2687c478bd9Sstevel@tonic-gate 	 * AU_SIG_DISABLE
2697c478bd9Sstevel@tonic-gate 	 */
2707c478bd9Sstevel@tonic-gate 	while (running) {
2717c478bd9Sstevel@tonic-gate 		/*
2727c478bd9Sstevel@tonic-gate 		 * Read audit_control and create plugin lists.
2737c478bd9Sstevel@tonic-gate 		 *
2747c478bd9Sstevel@tonic-gate 		 * loadauditlist() and auditd_thread_init() are called
2757c478bd9Sstevel@tonic-gate 		 * while under the plugin_mutex lock to avoid a race
2767c478bd9Sstevel@tonic-gate 		 * with unload_plugin().
2777c478bd9Sstevel@tonic-gate 		 */
2787c478bd9Sstevel@tonic-gate 		if (reset_list || reset_file) {
2797c478bd9Sstevel@tonic-gate 			(void) pthread_mutex_lock(&plugin_mutex);
2807c478bd9Sstevel@tonic-gate 			if (reset_list)
2817c478bd9Sstevel@tonic-gate 				loadauditlist();
2827c478bd9Sstevel@tonic-gate 
2837c478bd9Sstevel@tonic-gate 			if (auditd_thread_init()) {
2847c478bd9Sstevel@tonic-gate 				auditd_thread_close();
2857c478bd9Sstevel@tonic-gate 				/* continue; wait for audit -s */
2867c478bd9Sstevel@tonic-gate 			}
2877c478bd9Sstevel@tonic-gate 			(void) pthread_mutex_unlock(&plugin_mutex);
2887c478bd9Sstevel@tonic-gate 			reset_list = 0;
2897c478bd9Sstevel@tonic-gate 		}
2907c478bd9Sstevel@tonic-gate 		/*
2917c478bd9Sstevel@tonic-gate 		 * tell parent I'm running whether or not the initialization
2927c478bd9Sstevel@tonic-gate 		 * actually worked.  The failure case is to wait for an
2937c478bd9Sstevel@tonic-gate 		 * audit -n or audit -s to fix the problem.
2947c478bd9Sstevel@tonic-gate 		 */
2957c478bd9Sstevel@tonic-gate 		if (pid != 0) {
2967c478bd9Sstevel@tonic-gate 			(void) kill(pid, AU_SIG_DISABLE);
2977c478bd9Sstevel@tonic-gate 			pid = 0;
2987c478bd9Sstevel@tonic-gate 		}
2997c478bd9Sstevel@tonic-gate 		/*
3007c478bd9Sstevel@tonic-gate 		 * thread_signal() signals main (this thread) when
3017c478bd9Sstevel@tonic-gate 		 * it has received a signal.
3027c478bd9Sstevel@tonic-gate 		 */
3037c478bd9Sstevel@tonic-gate 		DPRINT((dbfp, "main thread is waiting\n"));
3047c478bd9Sstevel@tonic-gate 		(void) pthread_mutex_lock(&(main_thr.thd_mutex));
3057c478bd9Sstevel@tonic-gate 
3067c478bd9Sstevel@tonic-gate 		if (!(caught_readc || caught_term || caught_alrm ||
3077c478bd9Sstevel@tonic-gate 		    caught_nextd))
3087c478bd9Sstevel@tonic-gate 			(void) pthread_cond_wait(&(main_thr.thd_cv),
3097c478bd9Sstevel@tonic-gate 			    &(main_thr.thd_mutex));
3107c478bd9Sstevel@tonic-gate 		(void) pthread_mutex_unlock(&(main_thr.thd_mutex));
3117c478bd9Sstevel@tonic-gate 		/*
3127c478bd9Sstevel@tonic-gate 		 * Got here because a signal came in.
3137c478bd9Sstevel@tonic-gate 		 * Since we may have gotten more than one, we assume a
3147c478bd9Sstevel@tonic-gate 		 * priority scheme with SIGALRM being the most
3157c478bd9Sstevel@tonic-gate 		 * significant.
3167c478bd9Sstevel@tonic-gate 		 */
3177c478bd9Sstevel@tonic-gate 		if (caught_alrm) {
3187c478bd9Sstevel@tonic-gate 			/*
3197c478bd9Sstevel@tonic-gate 			 * We have returned from our timed wait for
3207c478bd9Sstevel@tonic-gate 			 * c2audit to calm down.  We need to really shut
3217c478bd9Sstevel@tonic-gate 			 * down here.
3227c478bd9Sstevel@tonic-gate 			 */
3237c478bd9Sstevel@tonic-gate 			caught_alrm = 0;
3247c478bd9Sstevel@tonic-gate 			running = 0;	/* shut down now */
3257c478bd9Sstevel@tonic-gate 		} else if (caught_term) {
3267c478bd9Sstevel@tonic-gate 			/*
3277c478bd9Sstevel@tonic-gate 			 * we are going to shut down, but need to
3287c478bd9Sstevel@tonic-gate 			 * allow time for the audit queues in
3297c478bd9Sstevel@tonic-gate 			 * c2audit and for the threads to empty.
3307c478bd9Sstevel@tonic-gate 			 */
3317c478bd9Sstevel@tonic-gate 
3327c478bd9Sstevel@tonic-gate 			p = plugin_head;
3337c478bd9Sstevel@tonic-gate 			while (p != NULL) {
3347c478bd9Sstevel@tonic-gate 				DPRINT((dbfp, "signalling thread %d\n",
3357c478bd9Sstevel@tonic-gate 				    p->plg_tid));
3367c478bd9Sstevel@tonic-gate 				(void) pthread_mutex_lock(&(p->plg_mutex));
3377c478bd9Sstevel@tonic-gate 				p->plg_removed = 1;
3387c478bd9Sstevel@tonic-gate 
3397c478bd9Sstevel@tonic-gate 				if (p->plg_initialized)
3407c478bd9Sstevel@tonic-gate 					(void) pthread_cond_signal(
3417c478bd9Sstevel@tonic-gate 					    &(p->plg_cv));
3427c478bd9Sstevel@tonic-gate 
3437c478bd9Sstevel@tonic-gate 				(void) pthread_mutex_unlock(&(p->plg_mutex));
3447c478bd9Sstevel@tonic-gate 				p = p->plg_next;
3457c478bd9Sstevel@tonic-gate 			}
3467c478bd9Sstevel@tonic-gate 
3477c478bd9Sstevel@tonic-gate 			caught_alrm = 0;
3487c478bd9Sstevel@tonic-gate 			caught_readc  = 0;
3497c478bd9Sstevel@tonic-gate 			caught_term = 0;
3507c478bd9Sstevel@tonic-gate 			caught_nextd = 0;
3517c478bd9Sstevel@tonic-gate 
3527c478bd9Sstevel@tonic-gate 			DPRINT((dbfp,
3537c478bd9Sstevel@tonic-gate 			    "main thread is pausing before exit.\n"));
3547c478bd9Sstevel@tonic-gate 			(void) pthread_mutex_lock(&(main_thr.thd_mutex));
3557c478bd9Sstevel@tonic-gate 			caught_alrm = 0;
3567c478bd9Sstevel@tonic-gate 			(void) alarm(ALRM_TIME);
3577c478bd9Sstevel@tonic-gate 			while (!caught_alrm)
3587c478bd9Sstevel@tonic-gate 				(void) pthread_cond_wait(&(main_thr.thd_cv),
3597c478bd9Sstevel@tonic-gate 				    &(main_thr.thd_mutex));
3607c478bd9Sstevel@tonic-gate 
3617c478bd9Sstevel@tonic-gate 			(void) pthread_mutex_unlock(&(main_thr.thd_mutex));
3627c478bd9Sstevel@tonic-gate 
3637c478bd9Sstevel@tonic-gate 			running = 0;	/* Close down auditing and exit */
3647c478bd9Sstevel@tonic-gate 		} else if (caught_readc) {
3657c478bd9Sstevel@tonic-gate 			/*
3667c478bd9Sstevel@tonic-gate 			 * if both hup and usr1 are caught, the logic in
3677c478bd9Sstevel@tonic-gate 			 * loadauditlist() results in hup winning.  The
3687c478bd9Sstevel@tonic-gate 			 * result will be that the audit file is not rolled
3697c478bd9Sstevel@tonic-gate 			 * over unless audit_control actually changed.
3707c478bd9Sstevel@tonic-gate 			 *
3717c478bd9Sstevel@tonic-gate 			 * They want to reread the audit_control file.
3727c478bd9Sstevel@tonic-gate 			 * Set reset_list which will return us to the
3737c478bd9Sstevel@tonic-gate 			 * main while loop in the main routine.
3747c478bd9Sstevel@tonic-gate 			 */
3757c478bd9Sstevel@tonic-gate 			caught_readc = 0;
3767c478bd9Sstevel@tonic-gate 			reset_list = 1;
3777c478bd9Sstevel@tonic-gate 		} else if (caught_nextd) {
3787c478bd9Sstevel@tonic-gate 			/*
3797c478bd9Sstevel@tonic-gate 			 * This is a special case for the binfile
3807c478bd9Sstevel@tonic-gate 			 * plugin. (audit -n)  NULL out kvlist
3817c478bd9Sstevel@tonic-gate 			 * so binfile won't re-read audit_control
3827c478bd9Sstevel@tonic-gate 			 */
3837c478bd9Sstevel@tonic-gate 			caught_nextd = 0;
3847c478bd9Sstevel@tonic-gate 			reset_file = 1;
3857c478bd9Sstevel@tonic-gate 			if (binfile != NULL) {
3867c478bd9Sstevel@tonic-gate 				_kva_free(binfile->plg_kvlist);
3877c478bd9Sstevel@tonic-gate 				binfile->plg_kvlist = NULL;
3887c478bd9Sstevel@tonic-gate 				binfile->plg_reopen = 1;
3897c478bd9Sstevel@tonic-gate 			}
3907c478bd9Sstevel@tonic-gate 		}
3917c478bd9Sstevel@tonic-gate 	}	/* end while (running) */
3927c478bd9Sstevel@tonic-gate 	auditd_thread_close();
3937c478bd9Sstevel@tonic-gate 
3947c478bd9Sstevel@tonic-gate 	auditd_exit(0);
3957c478bd9Sstevel@tonic-gate 	return (0);
3967c478bd9Sstevel@tonic-gate }
3977c478bd9Sstevel@tonic-gate 
3987c478bd9Sstevel@tonic-gate /*
3997c478bd9Sstevel@tonic-gate  * my_sleep - sleep for SLEEP_TIME seconds but only accept the signals
4007c478bd9Sstevel@tonic-gate  *	that we want to accept.  (Premature termination just means the
4017c478bd9Sstevel@tonic-gate  *	caller retries more often, not a big deal.)
4027c478bd9Sstevel@tonic-gate  */
4037c478bd9Sstevel@tonic-gate 
4047c478bd9Sstevel@tonic-gate static void
4057c478bd9Sstevel@tonic-gate my_sleep()
4067c478bd9Sstevel@tonic-gate {
4077c478bd9Sstevel@tonic-gate 	DPRINT((dbfp, "auditd: sleeping for 20 seconds\n"));
4087c478bd9Sstevel@tonic-gate 	/*
4097c478bd9Sstevel@tonic-gate 	 * Set timer to "sleep"
4107c478bd9Sstevel@tonic-gate 	 */
4117c478bd9Sstevel@tonic-gate 	(void) alarm(SLEEP_TIME);
4127c478bd9Sstevel@tonic-gate 
4137c478bd9Sstevel@tonic-gate 	DPRINT((dbfp, "main thread is waiting for SIGALRM before exit.\n"));
4147c478bd9Sstevel@tonic-gate 	(void) pthread_mutex_lock(&(main_thr.thd_mutex));
4157c478bd9Sstevel@tonic-gate 	(void) pthread_cond_wait(&(main_thr.thd_cv), &(main_thr.thd_mutex));
4167c478bd9Sstevel@tonic-gate 	(void) pthread_mutex_unlock(&(main_thr.thd_mutex));
4177c478bd9Sstevel@tonic-gate 
4187c478bd9Sstevel@tonic-gate 	if (caught_term) {
4197c478bd9Sstevel@tonic-gate 		DPRINT((dbfp, "normal AU_SIG_DISABLE exit\n"));
4207c478bd9Sstevel@tonic-gate 		/*
4217c478bd9Sstevel@tonic-gate 		 * Exit, as requested.
4227c478bd9Sstevel@tonic-gate 		 */
4237c478bd9Sstevel@tonic-gate 		auditd_thread_close();
4247c478bd9Sstevel@tonic-gate 	}
4257c478bd9Sstevel@tonic-gate 	if (caught_readc)
4267c478bd9Sstevel@tonic-gate 		reset_list = 1;		/* Reread the audit_control file */
4277c478bd9Sstevel@tonic-gate 
4287c478bd9Sstevel@tonic-gate 	caught_readc = 0;
4297c478bd9Sstevel@tonic-gate 	caught_nextd = 0;
4307c478bd9Sstevel@tonic-gate }
4317c478bd9Sstevel@tonic-gate 
4327c478bd9Sstevel@tonic-gate /*
4337c478bd9Sstevel@tonic-gate  * search for $ISA/ in path and replace it with "" if auditd
4347c478bd9Sstevel@tonic-gate  * is 32 bit, else "sparcv9/"  The plugin $ISA must match however
4357c478bd9Sstevel@tonic-gate  * auditd was compiled.
4367c478bd9Sstevel@tonic-gate  */
4377c478bd9Sstevel@tonic-gate 
4387c478bd9Sstevel@tonic-gate static void
4397c478bd9Sstevel@tonic-gate isa_ified(char *path, char **newpath)
4407c478bd9Sstevel@tonic-gate {
4417c478bd9Sstevel@tonic-gate 	char	*p, *q;
4427c478bd9Sstevel@tonic-gate 
4437c478bd9Sstevel@tonic-gate 	if (((p = strchr(path, '$')) != NULL) &&
4447c478bd9Sstevel@tonic-gate 	    (strncmp("$ISA/", p, 5) == 0)) {
4457c478bd9Sstevel@tonic-gate 		(void) memcpy(*newpath, path, p - path);
4467c478bd9Sstevel@tonic-gate 		q = *newpath + (p - path);
4477c478bd9Sstevel@tonic-gate #ifdef __sparcv9
4487c478bd9Sstevel@tonic-gate 		q += strlcpy(q, "sparcv9/", avail_length);
4497c478bd9Sstevel@tonic-gate #endif
4507c478bd9Sstevel@tonic-gate 		(void) strcpy(q, p + 5);
4517c478bd9Sstevel@tonic-gate 	} else
4527c478bd9Sstevel@tonic-gate 		*newpath = path;
4537c478bd9Sstevel@tonic-gate }
4547c478bd9Sstevel@tonic-gate 
4557c478bd9Sstevel@tonic-gate /*
4567c478bd9Sstevel@tonic-gate  * init_plugin first searches the existing plugin list to see
4577c478bd9Sstevel@tonic-gate  * if the plugin already has been defined; if not, it creates it
4587c478bd9Sstevel@tonic-gate  * and links it into the list.  It returns a pointer to the found
4597c478bd9Sstevel@tonic-gate  * or created struct.  A change of path in audit_control for a
4607c478bd9Sstevel@tonic-gate  * given plugin will cause a miss.
4617c478bd9Sstevel@tonic-gate  */
4627c478bd9Sstevel@tonic-gate /*
4637c478bd9Sstevel@tonic-gate  * for 64 bits, the path name can grow 3 bytes (minus 5 for the
4647c478bd9Sstevel@tonic-gate  * removed "$ISA" and plus 8 for the added "sparcv9/"
4657c478bd9Sstevel@tonic-gate  */
4667c478bd9Sstevel@tonic-gate 
4677c478bd9Sstevel@tonic-gate #define	ISA_GROW	8 - 5
4687c478bd9Sstevel@tonic-gate 
4697c478bd9Sstevel@tonic-gate static plugin_t *
4707c478bd9Sstevel@tonic-gate init_plugin(char *name, kva_t *list, int cnt_flag)
4717c478bd9Sstevel@tonic-gate {
4727c478bd9Sstevel@tonic-gate 	plugin_t	*p, *q;
4737c478bd9Sstevel@tonic-gate 	char		filepath[MAXPATHLEN + 1 + ISA_GROW];
4747c478bd9Sstevel@tonic-gate 	char		*path = filepath;
4757c478bd9Sstevel@tonic-gate 
4767c478bd9Sstevel@tonic-gate 	if (*name != '/') {
4777c478bd9Sstevel@tonic-gate #ifdef  __sparcv9
4787c478bd9Sstevel@tonic-gate 		(void) strcpy(filepath, "/usr/lib/security/sparcv9/");
4797c478bd9Sstevel@tonic-gate #else
4807c478bd9Sstevel@tonic-gate 		(void) strcpy(filepath, "/usr/lib/security/");
4817c478bd9Sstevel@tonic-gate #endif
4827c478bd9Sstevel@tonic-gate 		if (strlcat(filepath, name, MAXPATHLEN) >= MAXPATHLEN)
4837c478bd9Sstevel@tonic-gate 			return (NULL);
4847c478bd9Sstevel@tonic-gate 	} else {
4857c478bd9Sstevel@tonic-gate 		if (strlen(name) > MAXPATHLEN + ISA_GROW)
4867c478bd9Sstevel@tonic-gate 			return (NULL);
4877c478bd9Sstevel@tonic-gate 		isa_ified(name, &path);
4887c478bd9Sstevel@tonic-gate 	}
4897c478bd9Sstevel@tonic-gate 	p = plugin_head;
4907c478bd9Sstevel@tonic-gate 	q = plugin_head;
4917c478bd9Sstevel@tonic-gate 	while (p != NULL) {
4927c478bd9Sstevel@tonic-gate 		if (p->plg_path != NULL) {
4937c478bd9Sstevel@tonic-gate 			if (strcmp(p->plg_path, path) == 0) {
4947c478bd9Sstevel@tonic-gate 				p->plg_removed = 0;
4957c478bd9Sstevel@tonic-gate 				p->plg_to_be_removed = 0;
4967c478bd9Sstevel@tonic-gate 				p->plg_cnt = cnt_flag;
4977c478bd9Sstevel@tonic-gate 
4987c478bd9Sstevel@tonic-gate 				_kva_free(p->plg_kvlist);
4997c478bd9Sstevel@tonic-gate 				p->plg_kvlist = list;
5007c478bd9Sstevel@tonic-gate 				p->plg_reopen = 1;
5017c478bd9Sstevel@tonic-gate 				DPRINT((dbfp, "reusing %s\n", p->plg_path));
5027c478bd9Sstevel@tonic-gate 				return (p);
5037c478bd9Sstevel@tonic-gate 			}
5047c478bd9Sstevel@tonic-gate 		}
5057c478bd9Sstevel@tonic-gate 		q = p;
5067c478bd9Sstevel@tonic-gate 		p = p->plg_next;
5077c478bd9Sstevel@tonic-gate 	}
5087c478bd9Sstevel@tonic-gate 	DPRINT((dbfp, "creating new plugin structure for %s\n", path));
5097c478bd9Sstevel@tonic-gate 
5107c478bd9Sstevel@tonic-gate 	p = malloc(sizeof (plugin_t));
5117c478bd9Sstevel@tonic-gate 
5127c478bd9Sstevel@tonic-gate 	if (p == NULL) {
5137c478bd9Sstevel@tonic-gate 		perror("auditd");
5147c478bd9Sstevel@tonic-gate 		return (NULL);
5157c478bd9Sstevel@tonic-gate 	}
5167c478bd9Sstevel@tonic-gate 	if (q == NULL)
5177c478bd9Sstevel@tonic-gate 		plugin_head = p;
5187c478bd9Sstevel@tonic-gate 	else
5197c478bd9Sstevel@tonic-gate 		q->plg_next = p;
5207c478bd9Sstevel@tonic-gate 
5217c478bd9Sstevel@tonic-gate 	p->plg_next = NULL;
5227c478bd9Sstevel@tonic-gate 	p->plg_initialized = 0;
5237c478bd9Sstevel@tonic-gate 	p->plg_reopen = 1;
5247c478bd9Sstevel@tonic-gate 	p->plg_tid = 0;
5257c478bd9Sstevel@tonic-gate 	p->plg_removed = 0;
5267c478bd9Sstevel@tonic-gate 	p->plg_to_be_removed = 0;
5277c478bd9Sstevel@tonic-gate 	p->plg_tossed = 0;
5287c478bd9Sstevel@tonic-gate 	p->plg_queued = 0;
5297c478bd9Sstevel@tonic-gate 	p->plg_output = 0;
5307c478bd9Sstevel@tonic-gate 	p->plg_sequence = 1;
5317c478bd9Sstevel@tonic-gate 	p->plg_last_seq_out = 0;
5327c478bd9Sstevel@tonic-gate 	p->plg_path = strdup(path);
5337c478bd9Sstevel@tonic-gate 	p->plg_kvlist = list;
5347c478bd9Sstevel@tonic-gate 	p->plg_cnt = cnt_flag;
5357c478bd9Sstevel@tonic-gate 	p->plg_retry_time = SLEEP_TIME;
5367c478bd9Sstevel@tonic-gate 	p->plg_qmax = 0;
5377c478bd9Sstevel@tonic-gate 	p->plg_save_q_copy = NULL;
5387c478bd9Sstevel@tonic-gate 
5397c478bd9Sstevel@tonic-gate 	DPRINT((dbfp, "created plugin:  %s\n", path));
5407c478bd9Sstevel@tonic-gate 	return (p);
5417c478bd9Sstevel@tonic-gate }
5427c478bd9Sstevel@tonic-gate 
5437c478bd9Sstevel@tonic-gate /*
5447c478bd9Sstevel@tonic-gate  * loadauditlist - read the directory list from the audit_control file.
5457c478bd9Sstevel@tonic-gate  *		   to determine if a binary file is to be written.
5467c478bd9Sstevel@tonic-gate  *		 - read the plugin entries from the audit_control file
5477c478bd9Sstevel@tonic-gate  *
5487c478bd9Sstevel@tonic-gate  * globals -
5497c478bd9Sstevel@tonic-gate  *
5507c478bd9Sstevel@tonic-gate  *	plugin queues
5517c478bd9Sstevel@tonic-gate  *
5527c478bd9Sstevel@tonic-gate  * success is when at least one plug in is defined.
5537c478bd9Sstevel@tonic-gate  *
5547c478bd9Sstevel@tonic-gate  * set cnt policy here based on auditconfig setting.  future could
5557c478bd9Sstevel@tonic-gate  * have a policy = {+|-}cnt entry per plugin with auditconfig providing the
5567c478bd9Sstevel@tonic-gate  * default.
5577c478bd9Sstevel@tonic-gate  */
5587c478bd9Sstevel@tonic-gate 
5597c478bd9Sstevel@tonic-gate static void
5607c478bd9Sstevel@tonic-gate loadauditlist()
5617c478bd9Sstevel@tonic-gate {
5627c478bd9Sstevel@tonic-gate 	char		buf[MAXPATHLEN];
5637c478bd9Sstevel@tonic-gate 	char		*value;
5647c478bd9Sstevel@tonic-gate 	plugin_t	*p;
5657c478bd9Sstevel@tonic-gate 	int		acresult;
5667c478bd9Sstevel@tonic-gate 	int		wait_count = 0;
5677c478bd9Sstevel@tonic-gate 	kva_t		*kvlist;
5687c478bd9Sstevel@tonic-gate 	long		policy;
5697c478bd9Sstevel@tonic-gate 	int		cnt_flag;
5707c478bd9Sstevel@tonic-gate 	struct au_qctrl	kqmax;
5717c478bd9Sstevel@tonic-gate 	au_acinfo_t	*ach = NULL;
5727c478bd9Sstevel@tonic-gate 	int		got_dir = 0;
5737c478bd9Sstevel@tonic-gate 	int		have_plugin = 0;
5747c478bd9Sstevel@tonic-gate 	char		*endptr;
5757c478bd9Sstevel@tonic-gate 
5767c478bd9Sstevel@tonic-gate 	if (auditon(A_GETPOLICY, (char *)&policy, 0) == -1) {
5777c478bd9Sstevel@tonic-gate 		DPRINT((dbfp, "auditon(A_GETPOLICY...) failed (exit)\n"));
5787c478bd9Sstevel@tonic-gate 		__audit_dowarn("auditoff", "", 0);
5797c478bd9Sstevel@tonic-gate 		auditd_thread_close();
5807c478bd9Sstevel@tonic-gate 		auditd_exit(5);
5817c478bd9Sstevel@tonic-gate 	}
5827c478bd9Sstevel@tonic-gate 	cnt_flag = ((policy & AUDIT_CNT) != 0) ? 1 : 0;
5837c478bd9Sstevel@tonic-gate 	DPRINT((dbfp, "loadauditlist:  policy is to %s\n", (cnt_flag == 1) ?
5847c478bd9Sstevel@tonic-gate 	    "continue" : "block"));
5857c478bd9Sstevel@tonic-gate 
5867c478bd9Sstevel@tonic-gate #if DEBUG
5877c478bd9Sstevel@tonic-gate 	if (auditon(A_GETCOND, (caddr_t)&acresult, (int)sizeof (int)) !=
5887c478bd9Sstevel@tonic-gate 	    0)
5897c478bd9Sstevel@tonic-gate 		DPRINT((dbfp, "auditon(A_GETCOND...) failed (exit)\n"));
5907c478bd9Sstevel@tonic-gate #endif
5917c478bd9Sstevel@tonic-gate 	DPRINT((dbfp, "audit cond = %d (1 is on)\n", acresult));
5927c478bd9Sstevel@tonic-gate 
5937c478bd9Sstevel@tonic-gate 
5947c478bd9Sstevel@tonic-gate 	if (auditon(A_GETQCTRL, (char *)&kqmax, sizeof (struct au_qctrl)) !=
5957c478bd9Sstevel@tonic-gate 	    0) {
5967c478bd9Sstevel@tonic-gate 		DPRINT((dbfp, "auditon(A_GETQCTRL...) failed (exit)\n"));
5977c478bd9Sstevel@tonic-gate 		__audit_dowarn("auditoff", "", 0);
5987c478bd9Sstevel@tonic-gate 		auditd_thread_close();
5997c478bd9Sstevel@tonic-gate 		auditd_exit(6);
6007c478bd9Sstevel@tonic-gate 	}
6017c478bd9Sstevel@tonic-gate 	kqmax.aq_hiwater *= 5;		/* RAM is cheaper in userspace */
6027c478bd9Sstevel@tonic-gate 	DPRINT((dbfp, "auditd: reading audit_control\n"));
6037c478bd9Sstevel@tonic-gate 
6047c478bd9Sstevel@tonic-gate 	p = plugin_head;
6057c478bd9Sstevel@tonic-gate 	/*
6067c478bd9Sstevel@tonic-gate 	 * two-step on setting p->plg_removed because the input thread
6077c478bd9Sstevel@tonic-gate 	 * in doorway.c uses p->plg_removed to decide if the plugin is
6087c478bd9Sstevel@tonic-gate 	 * active.
6097c478bd9Sstevel@tonic-gate 	 */
6107c478bd9Sstevel@tonic-gate 	while (p != NULL) {
6117c478bd9Sstevel@tonic-gate 		DPRINT((dbfp, "loadauditlist:  %X, %s previously created\n",
6127c478bd9Sstevel@tonic-gate 		    p, p->plg_path));
6137c478bd9Sstevel@tonic-gate 		p->plg_to_be_removed = 1;	/* tentative removal */
6147c478bd9Sstevel@tonic-gate 		p = p->plg_next;
6157c478bd9Sstevel@tonic-gate 	}
6167c478bd9Sstevel@tonic-gate 	/*
6177c478bd9Sstevel@tonic-gate 	 * have_plugin may over count by one if both a "dir" entry
6187c478bd9Sstevel@tonic-gate 	 * and a "plugin" entry for binfile are found.  All that
6197c478bd9Sstevel@tonic-gate 	 * matters is that it be zero if no plugin or dir entries
6207c478bd9Sstevel@tonic-gate 	 * are found.
6217c478bd9Sstevel@tonic-gate 	 */
6227c478bd9Sstevel@tonic-gate 	have_plugin = 0;
6237c478bd9Sstevel@tonic-gate 	for (;;) {
6247c478bd9Sstevel@tonic-gate 		/* NULL == use standard path for audit_control */
6257c478bd9Sstevel@tonic-gate 		ach = _openac(NULL);
6267c478bd9Sstevel@tonic-gate 		/*
6277c478bd9Sstevel@tonic-gate 		 * loop until a directory entry is found (0) or eof (-1)
6287c478bd9Sstevel@tonic-gate 		 */
6297c478bd9Sstevel@tonic-gate 		while (((acresult = _getacdir(ach, buf, sizeof (buf))) != 0) &&
6307c478bd9Sstevel@tonic-gate 		    acresult != -1) {
6317c478bd9Sstevel@tonic-gate 		}
6327c478bd9Sstevel@tonic-gate 		if (acresult == 0) {
6337c478bd9Sstevel@tonic-gate 			DPRINT((dbfp,
6347c478bd9Sstevel@tonic-gate 			    "loadauditlist: "
6357c478bd9Sstevel@tonic-gate 			    "got binfile via old config syntax\n"));
6367c478bd9Sstevel@tonic-gate 			/*
6377c478bd9Sstevel@tonic-gate 			 * A directory entry was found.
6387c478bd9Sstevel@tonic-gate 			 */
6397c478bd9Sstevel@tonic-gate 			got_dir = 1;
6407c478bd9Sstevel@tonic-gate 			kvlist = _str2kva("name=audit_binfile.so.1",
6417c478bd9Sstevel@tonic-gate 			    "=", ";");
6427c478bd9Sstevel@tonic-gate 
6437c478bd9Sstevel@tonic-gate 			p = init_plugin("audit_binfile.so.1", kvlist, cnt_flag);
6447c478bd9Sstevel@tonic-gate 
6457c478bd9Sstevel@tonic-gate 			if (p != NULL) {
6467c478bd9Sstevel@tonic-gate 				binfile = p;
6477c478bd9Sstevel@tonic-gate 				p->plg_qmax = kqmax.aq_hiwater;
6487c478bd9Sstevel@tonic-gate 				have_plugin++;
6497c478bd9Sstevel@tonic-gate 			}
6507c478bd9Sstevel@tonic-gate 		}
6517c478bd9Sstevel@tonic-gate 		/*
6527c478bd9Sstevel@tonic-gate 		 * collect plugin entries.  If there is an entry for
6537c478bd9Sstevel@tonic-gate 		 * binfile.so.1, the parameters from the plugin line
6547c478bd9Sstevel@tonic-gate 		 * override those set above.  For binfile, p_dir is
6557c478bd9Sstevel@tonic-gate 		 * required only if dir wasn't specified elsewhere in
6567c478bd9Sstevel@tonic-gate 		 * audit_control
6577c478bd9Sstevel@tonic-gate 		 */
6587c478bd9Sstevel@tonic-gate 		_rewindac(ach);
6597c478bd9Sstevel@tonic-gate 		while ((acresult = _getacplug(ach, &kvlist)) == 0) {
6607c478bd9Sstevel@tonic-gate 			value = kva_match(kvlist, "name");
6617c478bd9Sstevel@tonic-gate 			if (value == NULL)
6627c478bd9Sstevel@tonic-gate 				break;
6637c478bd9Sstevel@tonic-gate 			DPRINT((dbfp, "loadauditlist: have an entry for %s\n",
6647c478bd9Sstevel@tonic-gate 			    value));
6657c478bd9Sstevel@tonic-gate 			p = init_plugin(value, kvlist, cnt_flag);
6667c478bd9Sstevel@tonic-gate 			if (p == NULL)
6677c478bd9Sstevel@tonic-gate 				continue;
6687c478bd9Sstevel@tonic-gate 
6697c478bd9Sstevel@tonic-gate 			if (strstr(value, "/audit_binfile.so") != NULL) {
6707c478bd9Sstevel@tonic-gate 				binfile = p;
6717c478bd9Sstevel@tonic-gate 				if (!got_dir &&
6727c478bd9Sstevel@tonic-gate 				    (kva_match(kvlist, "p_dir") ==
6737c478bd9Sstevel@tonic-gate 				    NULL)) {
6747c478bd9Sstevel@tonic-gate 					__audit_dowarn("getacdir", "",
6757c478bd9Sstevel@tonic-gate 					    wait_count);
6767c478bd9Sstevel@tonic-gate 				}
6777c478bd9Sstevel@tonic-gate 			}
6787c478bd9Sstevel@tonic-gate 			p->plg_qmax = kqmax.aq_hiwater; /* default */
6797c478bd9Sstevel@tonic-gate 			value = kva_match(kvlist, "qsize");
6807c478bd9Sstevel@tonic-gate 			if (value != NULL) {
6817c478bd9Sstevel@tonic-gate 				long	tmp;
6827c478bd9Sstevel@tonic-gate 
6837c478bd9Sstevel@tonic-gate 				tmp = strtol(value, &endptr, 10);
6847c478bd9Sstevel@tonic-gate 				if (*endptr == '\0')
6857c478bd9Sstevel@tonic-gate 					p->plg_qmax = tmp;
6867c478bd9Sstevel@tonic-gate 			}
687*9697ae98Sgww 			DPRINT((dbfp, "%s queue max = %d\n", p->plg_path,
688*9697ae98Sgww 			    p->plg_qmax));
6897c478bd9Sstevel@tonic-gate 
6907c478bd9Sstevel@tonic-gate 			have_plugin++;
6917c478bd9Sstevel@tonic-gate 		}
6927c478bd9Sstevel@tonic-gate 		_endac(ach);
6937c478bd9Sstevel@tonic-gate 		if (have_plugin != 0)
6947c478bd9Sstevel@tonic-gate 			break;
6957c478bd9Sstevel@tonic-gate 		/*
6967c478bd9Sstevel@tonic-gate 		 * there was a problem getting the directory
6977c478bd9Sstevel@tonic-gate 		 * list or remote host info from the audit_control file
6987c478bd9Sstevel@tonic-gate 		 */
6997c478bd9Sstevel@tonic-gate 		wait_count++;
7007c478bd9Sstevel@tonic-gate #if	DEBUG
7017c478bd9Sstevel@tonic-gate 		if (wait_count < 2)
7027c478bd9Sstevel@tonic-gate 			DPRINT((dbfp,
7037c478bd9Sstevel@tonic-gate 			    "auditd: problem getting directory "
7047c478bd9Sstevel@tonic-gate 			    "/ or plugin list from audit_control.\n"));
7057c478bd9Sstevel@tonic-gate #endif	/* DEBUG */
7067c478bd9Sstevel@tonic-gate 		__audit_dowarn("getacdir", "", wait_count);
7077c478bd9Sstevel@tonic-gate 		/*
7087c478bd9Sstevel@tonic-gate 		 * sleep for SLEEP_TIME seconds.
7097c478bd9Sstevel@tonic-gate 		 */
7107c478bd9Sstevel@tonic-gate 		my_sleep();
7117c478bd9Sstevel@tonic-gate 	}    /* end for(;;) */
7127c478bd9Sstevel@tonic-gate 
7137c478bd9Sstevel@tonic-gate 	p = plugin_head;
7147c478bd9Sstevel@tonic-gate 	while (p != NULL) {
7157c478bd9Sstevel@tonic-gate 		DPRINT((dbfp, "loadauditlist: %s remove flag=%d; cnt=%d\n",
7167c478bd9Sstevel@tonic-gate 		    p->plg_path, p->plg_to_be_removed, p->plg_cnt));
7177c478bd9Sstevel@tonic-gate 		p->plg_removed = p->plg_to_be_removed;
7187c478bd9Sstevel@tonic-gate 		p = p->plg_next;
7197c478bd9Sstevel@tonic-gate 	}
7207c478bd9Sstevel@tonic-gate }
7217c478bd9Sstevel@tonic-gate 
7227c478bd9Sstevel@tonic-gate /*
7237c478bd9Sstevel@tonic-gate  * block signals -- thread-specific blocking of the signals expected
7247c478bd9Sstevel@tonic-gate  * by the main thread.
7257c478bd9Sstevel@tonic-gate  */
7267c478bd9Sstevel@tonic-gate 
7277c478bd9Sstevel@tonic-gate static void
7287c478bd9Sstevel@tonic-gate block_signals()
7297c478bd9Sstevel@tonic-gate {
7307c478bd9Sstevel@tonic-gate 	sigset_t	set;
7317c478bd9Sstevel@tonic-gate 
7327c478bd9Sstevel@tonic-gate 	(void) sigfillset(&set);
7337c478bd9Sstevel@tonic-gate 	(void) pthread_sigmask(SIG_BLOCK, &set, NULL);
7347c478bd9Sstevel@tonic-gate }
7357c478bd9Sstevel@tonic-gate 
7367c478bd9Sstevel@tonic-gate /*
7377c478bd9Sstevel@tonic-gate  * signal_thread is the designated signal catcher.  It wakes up the
7387c478bd9Sstevel@tonic-gate  * main thread whenever it receives a signal and then goes back to
7397c478bd9Sstevel@tonic-gate  * sleep; it does not exit.  The global variables caught_* let
7407c478bd9Sstevel@tonic-gate  * the main thread which signal was received.
7417c478bd9Sstevel@tonic-gate  *
7427c478bd9Sstevel@tonic-gate  * The thread is created with all signals blocked.
7437c478bd9Sstevel@tonic-gate  */
7447c478bd9Sstevel@tonic-gate 
7457c478bd9Sstevel@tonic-gate static void
7467c478bd9Sstevel@tonic-gate signal_thread()
7477c478bd9Sstevel@tonic-gate {
7487c478bd9Sstevel@tonic-gate 	sigset_t	set;
7497c478bd9Sstevel@tonic-gate 	int		signal_caught;
7507c478bd9Sstevel@tonic-gate 
7517c478bd9Sstevel@tonic-gate 	DPRINT((dbfp, "the signal thread is thread %d\n",
7527c478bd9Sstevel@tonic-gate 	    pthread_self()));
7537c478bd9Sstevel@tonic-gate 
7547c478bd9Sstevel@tonic-gate 	(void) sigemptyset(&set);
7557c478bd9Sstevel@tonic-gate 	(void) sigaddset(&set, SIGALRM);
7567c478bd9Sstevel@tonic-gate 	(void) sigaddset(&set, AU_SIG_DISABLE);
7577c478bd9Sstevel@tonic-gate 	(void) sigaddset(&set, AU_SIG_READ_CONTROL);
7587c478bd9Sstevel@tonic-gate 	(void) sigaddset(&set, AU_SIG_NEXT_DIR);
7597c478bd9Sstevel@tonic-gate 
7607c478bd9Sstevel@tonic-gate 	for (;;) {
7617c478bd9Sstevel@tonic-gate 		signal_caught = sigwait(&set);
7627c478bd9Sstevel@tonic-gate 		switch (signal_caught) {
7637c478bd9Sstevel@tonic-gate 		case SIGALRM:
7647c478bd9Sstevel@tonic-gate 			caught_alrm++;
7657c478bd9Sstevel@tonic-gate 			DPRINT((dbfp, "caught SIGALRM\n"));
7667c478bd9Sstevel@tonic-gate 			break;
7677c478bd9Sstevel@tonic-gate 		case AU_SIG_DISABLE:
7687c478bd9Sstevel@tonic-gate 			caught_term++;
7697c478bd9Sstevel@tonic-gate 			DPRINT((dbfp, "caught AU_SIG_DISABLE\n"));
7707c478bd9Sstevel@tonic-gate 			break;
7717c478bd9Sstevel@tonic-gate 		case AU_SIG_READ_CONTROL:
7727c478bd9Sstevel@tonic-gate 			caught_readc++;
7737c478bd9Sstevel@tonic-gate 			DPRINT((dbfp, "caught AU_SIG_READ_CONTROL\n"));
7747c478bd9Sstevel@tonic-gate 			break;
7757c478bd9Sstevel@tonic-gate 		case AU_SIG_NEXT_DIR:
7767c478bd9Sstevel@tonic-gate 			caught_nextd++;
7777c478bd9Sstevel@tonic-gate 			DPRINT((dbfp, "caught AU_SIG_NEXT_DIR\n"));
7787c478bd9Sstevel@tonic-gate 			break;
7797c478bd9Sstevel@tonic-gate 		default:
7807c478bd9Sstevel@tonic-gate 			DPRINT((dbfp, "caught unexpected signal:  %d\n",
7817c478bd9Sstevel@tonic-gate 			    signal_caught));
7827c478bd9Sstevel@tonic-gate 			break;
7837c478bd9Sstevel@tonic-gate 		}
7847c478bd9Sstevel@tonic-gate 		(void) pthread_cond_signal(&(main_thr.thd_cv));
7857c478bd9Sstevel@tonic-gate 	}
7867c478bd9Sstevel@tonic-gate }
7877c478bd9Sstevel@tonic-gate 
7887c478bd9Sstevel@tonic-gate /*
7897c478bd9Sstevel@tonic-gate  * do_sethost - do auditon(2) to set the audit host-id.
790*9697ae98Sgww  *		Returns 0 if success or -1 otherwise.
7917c478bd9Sstevel@tonic-gate  */
7927c478bd9Sstevel@tonic-gate static int
7937c478bd9Sstevel@tonic-gate do_sethost(void)
7947c478bd9Sstevel@tonic-gate {
795*9697ae98Sgww 	au_tid_addr_t	*termid;
7967c478bd9Sstevel@tonic-gate 	auditinfo_addr_t	audit_info;
797*9697ae98Sgww 	char	msg[512];
7987c478bd9Sstevel@tonic-gate 
799*9697ae98Sgww 	if (adt_load_hostname(NULL, (adt_termid_t **)&termid) < 0) {
800*9697ae98Sgww 		(void) snprintf(msg, sizeof (msg), "unable to get local "
801*9697ae98Sgww 		    "IP address: %s", strerror(errno));
802*9697ae98Sgww 		goto fail;
8037c478bd9Sstevel@tonic-gate 	}
8047c478bd9Sstevel@tonic-gate 	/* Get current kernel audit info, and fill in the IP address */
805*9697ae98Sgww 	if (auditon(A_GETKAUDIT, (caddr_t)&audit_info,
806*9697ae98Sgww 	    sizeof (audit_info)) < 0) {
807*9697ae98Sgww 		(void) snprintf(msg, sizeof (msg), "unable to get kernel "
808*9697ae98Sgww 		    "audit info: %s", strerror(errno));
809*9697ae98Sgww 		goto fail;
8107c478bd9Sstevel@tonic-gate 	}
8117c478bd9Sstevel@tonic-gate 
812*9697ae98Sgww 	audit_info.ai_termid = *termid;
8137c478bd9Sstevel@tonic-gate 
8147c478bd9Sstevel@tonic-gate 	/* Update the kernel audit info with new IP address */
815*9697ae98Sgww 	if (auditon(A_SETKAUDIT, (caddr_t)&audit_info,
816*9697ae98Sgww 	    sizeof (audit_info)) < 0) {
817*9697ae98Sgww 		(void) snprintf(msg, sizeof (msg), "unable to set kernel "
818*9697ae98Sgww 		    "audit info: %s", strerror(errno));
819*9697ae98Sgww 		goto fail;
8207c478bd9Sstevel@tonic-gate 	}
8217c478bd9Sstevel@tonic-gate 
822*9697ae98Sgww 	free(termid);
8237c478bd9Sstevel@tonic-gate 	return (0);
824*9697ae98Sgww 
825*9697ae98Sgww fail:
826*9697ae98Sgww 	free(termid);
827*9697ae98Sgww 	__audit_syslog("auditd", LOG_PID | LOG_CONS | LOG_NOWAIT, LOG_DAEMON,
828*9697ae98Sgww 	    LOG_ALERT, msg);
829*9697ae98Sgww 	return (-1);
8307c478bd9Sstevel@tonic-gate }
831