summaryrefslogtreecommitdiffstats
path: root/sys/security/audit/audit_bsm_token.c
diff options
context:
space:
mode:
Diffstat (limited to 'sys/security/audit/audit_bsm_token.c')
-rw-r--r--sys/security/audit/audit_bsm_token.c212
1 files changed, 137 insertions, 75 deletions
diff --git a/sys/security/audit/audit_bsm_token.c b/sys/security/audit/audit_bsm_token.c
index ad9ffcc..b1d977d 100644
--- a/sys/security/audit/audit_bsm_token.c
+++ b/sys/security/audit/audit_bsm_token.c
@@ -1,5 +1,5 @@
/*-
- * Copyright (c) 2004 Apple Inc.
+ * Copyright (c) 2004-2008 Apple Inc.
* Copyright (c) 2005 SPARTA, Inc.
* All rights reserved.
*
@@ -29,6 +29,8 @@
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
+ *
+ * P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_token.c#72
*/
#include <sys/cdefs.h>
@@ -71,7 +73,7 @@ __FBSDID("$FreeBSD$");
* text N bytes + 1 terminating NULL byte
*/
token_t *
-au_to_arg32(char n, char *text, u_int32_t v)
+au_to_arg32(char n, const char *text, u_int32_t v)
{
token_t *t;
u_char *dptr = NULL;
@@ -90,11 +92,10 @@ au_to_arg32(char n, char *text, u_int32_t v)
ADD_STRING(dptr, text, textlen);
return (t);
-
}
token_t *
-au_to_arg64(char n, char *text, u_int64_t v)
+au_to_arg64(char n, const char *text, u_int64_t v)
{
token_t *t;
u_char *dptr = NULL;
@@ -113,11 +114,10 @@ au_to_arg64(char n, char *text, u_int64_t v)
ADD_STRING(dptr, text, textlen);
return (t);
-
}
token_t *
-au_to_arg(char n, char *text, u_int32_t v)
+au_to_arg(char n, const char *text, u_int32_t v)
{
return (au_to_arg32(n, text, v));
@@ -147,8 +147,8 @@ au_to_attr32(struct vnode_au_info *vni)
ADD_U_CHAR(dptr, AUT_ATTR32);
/*
- * Darwin defines the size for the file mode
- * as 2 bytes; BSM defines 4 so pad with 0
+ * Darwin defines the size for the file mode as 2 bytes; BSM defines
+ * 4 so pad with 0.
*/
ADD_U_INT16(dptr, pad0_16);
ADD_U_INT16(dptr, vni->vn_mode);
@@ -190,8 +190,8 @@ au_to_attr64(struct vnode_au_info *vni)
ADD_U_CHAR(dptr, AUT_ATTR64);
/*
- * Darwin defines the size for the file mode
- * as 2 bytes; BSM defines 4 so pad with 0
+ * Darwin defines the size for the file mode as 2 bytes; BSM defines
+ * 4 so pad with 0.
*/
ADD_U_INT16(dptr, pad0_16);
ADD_U_INT16(dptr, vni->vn_mode);
@@ -235,7 +235,7 @@ au_to_attr(struct vnode_au_info *vni)
* data items (depends on basic unit)
*/
token_t *
-au_to_data(char unit_print, char unit_type, char unit_count, char *p)
+au_to_data(char unit_print, char unit_type, char unit_count, const char *p)
{
token_t *t;
u_char *dptr = NULL;
@@ -305,7 +305,7 @@ token_t *
au_to_groups(int *groups)
{
- return (au_to_newgroups(AUDIT_MAX_GROUPS, (gid_t*)groups));
+ return (au_to_newgroups(AUDIT_MAX_GROUPS, (gid_t *)groups));
}
/*
@@ -352,7 +352,7 @@ au_to_in_addr(struct in_addr *internet_addr)
/*
* token ID 1 byte
* address type/length 4 bytes
- * Address 16 bytes
+ * address 16 bytes
*/
token_t *
au_to_in_addr_ex(struct in6_addr *internet_addr)
@@ -432,8 +432,8 @@ au_to_ipc_perm(struct ipc_perm *perm)
ADD_U_CHAR(dptr, AUT_IPC_PERM);
/*
- * Darwin defines the sizes for ipc_perm members
- * as 2 bytes; BSM defines 4 so pad with 0
+ * Darwin defines the sizes for ipc_perm members as 2 bytes; BSM
+ * defines 4 so pad with 0.
*/
ADD_U_INT16(dptr, pad0);
ADD_U_INT16(dptr, perm->uid);
@@ -482,7 +482,7 @@ au_to_iport(u_int16_t iport)
* data size bytes
*/
token_t *
-au_to_opaque(char *data, u_int16_t bytes)
+au_to_opaque(const char *data, u_int16_t bytes)
{
token_t *t;
u_char *dptr = NULL;
@@ -504,7 +504,7 @@ au_to_opaque(char *data, u_int16_t bytes)
* file pathname N bytes + 1 terminating NULL byte
*/
token_t *
-au_to_file(char *file, struct timeval tm)
+au_to_file(const char *file, struct timeval tm)
{
token_t *t;
u_char *dptr = NULL;
@@ -534,7 +534,7 @@ au_to_file(char *file, struct timeval tm)
* text N bytes + 1 terminating NULL byte
*/
token_t *
-au_to_text(char *text)
+au_to_text(const char *text)
{
token_t *t;
u_char *dptr = NULL;
@@ -558,7 +558,7 @@ au_to_text(char *text)
* path N bytes + 1 terminating NULL byte
*/
token_t *
-au_to_path(char *text)
+au_to_path(const char *text)
{
token_t *t;
u_char *dptr = NULL;
@@ -657,7 +657,7 @@ au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
* terminal ID
* port ID 4 bytes/8 bytes (32-bit/64-bit value)
* address type-len 4 bytes
- * machine address 4/16 bytes
+ * machine address 16 bytes
*/
token_t *
au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
@@ -668,12 +668,12 @@ au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6),
("au_to_process32_ex: type %u", (unsigned int)tid->at_type));
- if (tid->at_type == AU_IPv6)
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
- sizeof(u_int32_t));
+ if (tid->at_type == AU_IPv4)
+ GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
+ 10 * sizeof(u_int32_t));
else
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
- sizeof(u_int32_t));
+ GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
+ 13 * sizeof(u_int32_t));
ADD_U_CHAR(dptr, AUT_PROCESS32_EX);
ADD_U_INT32(dptr, auid);
@@ -685,10 +685,12 @@ au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
ADD_U_INT32(dptr, sid);
ADD_U_INT32(dptr, tid->at_port);
ADD_U_INT32(dptr, tid->at_type);
- if (tid->at_type == AU_IPv6)
- ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
- else
- ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
+ ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
+ if (tid->at_type == AU_IPv6) {
+ ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
+ ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
+ ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
+ }
return (t);
}
@@ -831,7 +833,7 @@ kau_to_socket(struct socket_au_info *soi)
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
sizeof(u_int32_t) + sizeof(u_int16_t) + sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AU_SOCK_TOKEN);
+ ADD_U_CHAR(dptr, AUT_SOCKET);
/* Coerce the socket type into a short value */
so_type = soi->so_type;
ADD_U_INT16(dptr, so_type);
@@ -883,7 +885,7 @@ au_to_sock_unix(struct sockaddr_un *so)
GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + strlen(so->sun_path) + 1);
- ADD_U_CHAR(dptr, AU_SOCK_UNIX_TOKEN);
+ ADD_U_CHAR(dptr, AUT_SOCKUNIX);
/* BSM token has two bytes for family */
ADD_U_CHAR(dptr, 0);
ADD_U_CHAR(dptr, so->sun_family);
@@ -925,7 +927,6 @@ au_to_sock_inet32(struct sockaddr_in *so)
ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t));
return (t);
-
}
token_t *
@@ -949,7 +950,6 @@ au_to_sock_inet128(struct sockaddr_in6 *so)
ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t));
return (t);
-
}
token_t *
@@ -1040,7 +1040,7 @@ au_to_subject(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
* terminal ID
* port ID 4 bytes/8 bytes (32-bit/64-bit value)
* address type/length 4 bytes
- * machine address 4/16 bytes
+ * machine address 16 bytes
*/
token_t *
au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
@@ -1051,11 +1051,12 @@ au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6),
("au_to_subject32_ex: type %u", (unsigned int)tid->at_type));
- if (tid->at_type == AU_IPv6)
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
+
+ if (tid->at_type == AU_IPv4)
+ GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
sizeof(u_int32_t));
else
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
+ GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
sizeof(u_int32_t));
ADD_U_CHAR(dptr, AUT_SUBJECT32_EX);
@@ -1068,9 +1069,9 @@ au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
ADD_U_INT32(dptr, sid);
ADD_U_INT32(dptr, tid->at_port);
ADD_U_INT32(dptr, tid->at_type);
- if (tid->at_type == AU_IPv6)
+ if (tid->at_type == AU_IPv6)
ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
- else
+ else
ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
return (t);
@@ -1083,17 +1084,17 @@ au_to_subject64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
token_t *t;
u_char *dptr = NULL;
+ KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6),
+ ("au_to_subject64_ex: type %u", (unsigned int)tid->at_type));
+
if (tid->at_type == AU_IPv4)
GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
2 * sizeof(u_int32_t));
- else if (tid->at_type == AU_IPv6)
+ else
GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
5 * sizeof(u_int32_t));
- else
- panic("au_to_subject64_ex: invalid at_type (%d)",
- tid->at_type);
ADD_U_CHAR(dptr, AUT_SUBJECT64_EX);
ADD_U_INT32(dptr, auid);
@@ -1124,8 +1125,8 @@ au_to_subject_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
#if !defined(_KERNEL) && !defined(KERNEL) && defined(HAVE_AUDIT_SYSCALLS)
/*
- * Collects audit information for the current process
- * and creates a subject token from it
+ * Collects audit information for the current process and creates a subject
+ * token from it.
*/
token_t *
au_to_me(void)
@@ -1227,6 +1228,7 @@ au_to_exec_args(char **argv)
return (t);
}
+#endif
/*
* token ID 1 byte
@@ -1234,7 +1236,7 @@ au_to_exec_args(char **argv)
* zonename N bytes + 1 terminating NULL byte
*/
token_t *
-au_to_zonename(char *zonename)
+au_to_zonename(const char *zonename)
{
u_char *dptr = NULL;
u_int16_t textlen;
@@ -1249,6 +1251,7 @@ au_to_zonename(char *zonename)
return (t);
}
+#if !defined(_KERNEL) && !defined(KERNEL)
/*
* token ID 1 byte
* count 4 bytes
@@ -1292,45 +1295,34 @@ au_to_exec_env(char **envp)
/*
* token ID 1 byte
* record byte count 4 bytes
- * version # 1 byte
+ * version # 1 byte [2]
* event type 2 bytes
* event modifier 2 bytes
- * address type/length 4 bytes
- * machine address 4 bytes/16 bytes (IPv4/IPv6 address)
- * seconds of time 4 bytes/8 bytes (32/64-bits)
- * milliseconds of time 4 bytes/8 bytes (32/64-bits)
+ * seconds of time 4 bytes/8 bytes (32-bit/64-bit value)
+ * milliseconds of time 4 bytes/8 bytes (32-bit/64-bit value)
*/
token_t *
-au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
- struct timeval tm, struct auditinfo_addr *aia)
+au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
+ struct timeval tm)
{
- token_t *t;
+ token_t *t;
u_char *dptr = NULL;
u_int32_t timems;
- struct au_tid_addr *tid;
-
- tid = &aia->ai_termid;
- KASSERT(tid->at_type == AU_IPv4 || tid->at_type == AU_IPv6,
- ("au_to_header32_ex_tm: invalid address family"));
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
- sizeof(u_char) + 2 * sizeof(u_int16_t) + 3 * sizeof(u_int32_t) +
- tid->at_type);
+ sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_HEADER32_EX);
+ ADD_U_CHAR(dptr, AUT_HEADER32);
ADD_U_INT32(dptr, rec_size);
ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
ADD_U_INT16(dptr, e_type);
ADD_U_INT16(dptr, e_mod);
- ADD_U_INT32(dptr, tid->at_type);
- if (tid->at_type == AU_IPv6)
- ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
- else
- ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
- timems = tm.tv_usec / 1000;
+
+ timems = tm.tv_usec/1000;
/* Add the timestamp */
ADD_U_INT32(dptr, tm.tv_sec);
- ADD_U_INT32(dptr, timems); /* We need time in ms. */
+ ADD_U_INT32(dptr, timems); /* We need time in ms. */
+
return (t);
}
@@ -1340,32 +1332,45 @@ au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
* version # 1 byte [2]
* event type 2 bytes
* event modifier 2 bytes
+ * address type/length 4 bytes
+ * machine address 4 bytes/16 bytes (IPv4/IPv6 address)
* seconds of time 4 bytes/8 bytes (32-bit/64-bit value)
* milliseconds of time 4 bytes/8 bytes (32-bit/64-bit value)
*/
token_t *
-au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
- struct timeval tm)
+au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
+ struct timeval tm, struct auditinfo_addr *aia)
{
token_t *t;
u_char *dptr = NULL;
u_int32_t timems;
+ au_tid_addr_t *tid;
+
+ tid = &aia->ai_termid;
+ KASSERT(tid->at_type == AU_IPv4 || tid->at_type == AU_IPv6,
+ ("au_to_header32_ex_tm: invalid address family"));
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
- sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t));
+ sizeof(u_char) + 2 * sizeof(u_int16_t) + 3 *
+ sizeof(u_int32_t) + tid->at_type);
- ADD_U_CHAR(dptr, AUT_HEADER32);
+ ADD_U_CHAR(dptr, AUT_HEADER32_EX);
ADD_U_INT32(dptr, rec_size);
ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
ADD_U_INT16(dptr, e_type);
ADD_U_INT16(dptr, e_mod);
+ ADD_U_INT32(dptr, tid->at_type);
+ if (tid->at_type == AU_IPv6)
+ ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
+ else
+ ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
timems = tm.tv_usec/1000;
/* Add the timestamp */
ADD_U_INT32(dptr, tm.tv_sec);
- ADD_U_INT32(dptr, timems); /* We need time in ms. */
+ ADD_U_INT32(dptr, timems); /* We need time in ms. */
- return (t);
+ return (t);
}
token_t *
@@ -1393,6 +1398,63 @@ au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
return (t);
}
+#if !defined(KERNEL) && !defined(_KERNEL)
+#ifdef HAVE_AUDIT_SYSCALLS
+token_t *
+au_to_header32_ex(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+ struct timeval tm;
+ struct auditinfo_addr aia;
+
+ if (gettimeofday(&tm, NULL) == -1)
+ return (NULL);
+ if (auditon(A_GETKAUDIT, &aia, sizeof(aia)) < 0) {
+ if (errno != ENOSYS)
+ return (NULL);
+ return (au_to_header32_tm(rec_size, e_type, e_mod, tm));
+ }
+ return (au_to_header32_ex_tm(rec_size, e_type, e_mod, tm, &aia));
+}
+#endif /* HAVE_AUDIT_SYSCALLS */
+
+token_t *
+au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+ struct timeval tm;
+
+ if (gettimeofday(&tm, NULL) == -1)
+ return (NULL);
+ return (au_to_header32_tm(rec_size, e_type, e_mod, tm));
+}
+
+token_t *
+au_to_header64(__unused int rec_size, __unused au_event_t e_type,
+ __unused au_emod_t e_mod)
+{
+ struct timeval tm;
+
+ if (gettimeofday(&tm, NULL) == -1)
+ return (NULL);
+ return (au_to_header64_tm(rec_size, e_type, e_mod, tm));
+}
+
+token_t *
+au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+
+ return (au_to_header32(rec_size, e_type, e_mod));
+}
+
+#ifdef HAVE_AUDIT_SYSCALLS
+token_t *
+au_to_header_ex(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+
+ return (au_to_header32_ex(rec_size, e_type, e_mod));
+}
+#endif /* HAVE_AUDIT_SYSCALLS */
+#endif /* !defined(KERNEL) && !defined(_KERNEL) */
+
/*
* token ID 1 byte
* trailer magic number 2 bytes
OpenPOWER on IntegriCloud