diff options
Diffstat (limited to 'sys/security/audit/audit_bsm_token.c')
-rw-r--r-- | sys/security/audit/audit_bsm_token.c | 202 |
1 files changed, 125 insertions, 77 deletions
diff --git a/sys/security/audit/audit_bsm_token.c b/sys/security/audit/audit_bsm_token.c index b1d977d..6733030 100644 --- a/sys/security/audit/audit_bsm_token.c +++ b/sys/security/audit/audit_bsm_token.c @@ -147,8 +147,12 @@ au_to_attr32(struct vnode_au_info *vni) ADD_U_CHAR(dptr, AUT_ATTR32); /* - * Darwin defines the size for the file mode as 2 bytes; BSM defines - * 4 so pad with 0. + * BSD defines the size for the file mode as 2 bytes; BSM defines 4 + * so pad with 0. + * + * XXXRW: Possibly should be conditionally compiled. + * + * XXXRW: Should any conversions take place on the mode? */ ADD_U_INT16(dptr, pad0_16); ADD_U_INT16(dptr, vni->vn_mode); @@ -190,8 +194,12 @@ au_to_attr64(struct vnode_au_info *vni) ADD_U_CHAR(dptr, AUT_ATTR64); /* - * Darwin defines the size for the file mode as 2 bytes; BSM defines - * 4 so pad with 0. + * BSD defines the size for the file mode as 2 bytes; BSM defines 4 + * so pad with 0. + * + * XXXRW: Possibly should be conditionally compiled. + * + * XXXRW: Should any conversions take place on the mode? */ ADD_U_INT16(dptr, pad0_16); ADD_U_INT16(dptr, vni->vn_mode); @@ -269,6 +277,10 @@ au_to_data(char unit_print, char unit_type, char unit_count, const char *p) GET_TOKEN_AREA(t, dptr, 4 * sizeof(u_char) + totdata); + /* + * XXXRW: We should be byte-swapping each data item for multi-byte + * types. + */ ADD_U_CHAR(dptr, AUT_DATA); ADD_U_CHAR(dptr, unit_print); ADD_U_CHAR(dptr, unit_type); @@ -432,25 +444,36 @@ au_to_ipc_perm(struct ipc_perm *perm) ADD_U_CHAR(dptr, AUT_IPC_PERM); /* - * Darwin defines the sizes for ipc_perm members as 2 bytes; BSM - * defines 4 so pad with 0. + * Systems vary significantly in what types they use in struct + * ipc_perm; at least a few still use 16-bit uid's and gid's, so + * allow for that, as BSM define 32-bit values here. + * Some systems define the sizes for ipc_perm members as 2 bytes; + * BSM defines 4 so pad with 0. + * + * XXXRW: Possibly shoulid be conditionally compiled, and more cases + * need to be handled. */ - ADD_U_INT16(dptr, pad0); - ADD_U_INT16(dptr, perm->uid); - - ADD_U_INT16(dptr, pad0); - ADD_U_INT16(dptr, perm->gid); - - ADD_U_INT16(dptr, pad0); - ADD_U_INT16(dptr, perm->cuid); - - ADD_U_INT16(dptr, pad0); - ADD_U_INT16(dptr, perm->cgid); + if (sizeof(perm->uid) != sizeof(u_int32_t)) { + ADD_U_INT16(dptr, pad0); + ADD_U_INT16(dptr, perm->uid); + ADD_U_INT16(dptr, pad0); + ADD_U_INT16(dptr, perm->gid); + ADD_U_INT16(dptr, pad0); + ADD_U_INT16(dptr, perm->cuid); + ADD_U_INT16(dptr, pad0); + ADD_U_INT16(dptr, perm->cgid); + } else { + ADD_U_INT32(dptr, perm->uid); + ADD_U_INT32(dptr, perm->gid); + ADD_U_INT32(dptr, perm->cuid); + ADD_U_INT32(dptr, perm->cgid); + } ADD_U_INT16(dptr, pad0); ADD_U_INT16(dptr, perm->mode); ADD_U_INT16(dptr, pad0); + ADD_U_INT16(dptr, perm->seq); ADD_U_INT32(dptr, perm->key); @@ -543,6 +566,8 @@ au_to_text(const char *text) textlen = strlen(text); textlen += 1; + /* XXXRW: Should validate length against token size limit. */ + GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen); ADD_U_CHAR(dptr, AUT_TEXT); @@ -607,6 +632,13 @@ au_to_process32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, ADD_U_INT32(dptr, pid); ADD_U_INT32(dptr, sid); ADD_U_INT32(dptr, tid->port); + + /* + * Note: Solaris will write out IPv6 addresses here as a 32-bit + * address type and 16 bytes of address, but for IPv4 addresses it + * simply writes the 4-byte address directly. We support only IPv4 + * addresses for process32 tokens. + */ ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t)); return (t); @@ -631,6 +663,13 @@ au_to_process64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, ADD_U_INT32(dptr, pid); ADD_U_INT32(dptr, sid); ADD_U_INT64(dptr, tid->port); + + /* + * Note: Solaris will write out IPv6 addresses here as a 32-bit + * address type and 16 bytes of address, but for IPv4 addresses it + * simply writes the 4-byte address directly. We support only IPv4 + * addresses for process64 tokens. + */ ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t)); return (t); @@ -805,22 +844,60 @@ au_to_seq(long audit_count) /* * token ID 1 byte + * socket domain 2 bytes * socket type 2 bytes + * address type 2 byte * local port 2 bytes - * local Internet address 4 bytes + * local address 4 bytes/16 bytes (IPv4/IPv6 address) * remote port 2 bytes - * remote Internet address 4 bytes + * remote address 4 bytes/16 bytes (IPv4/IPv6 address) */ token_t * -au_to_socket(struct socket *so) +au_to_socket_ex(u_short so_domain, u_short so_type, + struct sockaddr *sa_local, struct sockaddr *sa_remote) { + token_t *t; + u_char *dptr = NULL; + struct sockaddr_in *sin; + struct sockaddr_in6 *sin6; + + if (so_domain == AF_INET) + GET_TOKEN_AREA(t, dptr, sizeof(u_char) + + 5 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t)); + else if (so_domain == AF_INET6) + GET_TOKEN_AREA(t, dptr, sizeof(u_char) + + 5 * sizeof(u_int16_t) + 16 * sizeof(u_int32_t)); + else + return (NULL); + + ADD_U_CHAR(dptr, AUT_SOCKET_EX); + ADD_U_INT16(dptr, so_domain); /* XXXRW: explicitly convert? */ + ADD_U_INT16(dptr, so_type); /* XXXRW: explicitly convert? */ + if (so_domain == AF_INET) { + ADD_U_INT16(dptr, AU_IPv4); + sin = (struct sockaddr_in *)sa_local; + ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t)); + ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t)); + sin = (struct sockaddr_in *)sa_remote; + ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t)); + ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t)); + } else { + ADD_U_INT16(dptr, AU_IPv6); + sin6 = (struct sockaddr_in6 *)sa_local; + ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t)); + ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t)); + sin6 = (struct sockaddr_in6 *)sa_remote; + ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t)); + ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t)); + } - /* XXXRW ... */ - return (NULL); + return (t); } /* * Kernel-specific version of the above function. + * + * XXXRW: Should now use au_to_socket_ex() here. */ #ifdef _KERNEL token_t * @@ -832,7 +909,7 @@ kau_to_socket(struct socket_au_info *soi) GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) + sizeof(u_int32_t) + sizeof(u_int16_t) + sizeof(u_int32_t)); - + ADD_U_CHAR(dptr, AUT_SOCKET); /* Coerce the socket type into a short value */ so_type = soi->so_type; @@ -848,32 +925,6 @@ kau_to_socket(struct socket_au_info *soi) /* * token ID 1 byte - * socket type 2 bytes - * local port 2 bytes - * address type/length 4 bytes - * local Internet address 4 bytes/16 bytes (IPv4/IPv6 address) - * remote port 4 bytes - * address type/length 4 bytes - * remote Internet address 4 bytes/16 bytes (IPv4/IPv6 address) - */ -token_t * -au_to_socket_ex_32(u_int16_t lp, u_int16_t rp, struct sockaddr *la, - struct sockaddr *ra) -{ - - return (NULL); -} - -token_t * -au_to_socket_ex_128(u_int16_t lp, u_int16_t rp, struct sockaddr *la, - struct sockaddr *ra) -{ - - return (NULL); -} - -/* - * token ID 1 byte * socket family 2 bytes * path 104 bytes */ @@ -940,8 +991,9 @@ au_to_sock_inet128(struct sockaddr_in6 *so) ADD_U_CHAR(dptr, AUT_SOCKINET128); /* - * In Darwin, sin6_family is one octet, but BSM defines the token - * to store two. So we copy in a 0 first. + * In BSD, sin6_family is one octet, but BSM defines the token to + * store two. So we copy in a 0 first. XXXRW: Possibly should be + * conditionally compiled. */ ADD_U_CHAR(dptr, 0); ADD_U_CHAR(dptr, so->sin6_family); @@ -1215,7 +1267,6 @@ au_to_exec_args(char **argv) nextarg = *(argv + count); } - totlen += count * sizeof(char); /* nul terminations. */ GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen); ADD_U_CHAR(dptr, AUT_EXEC_ARGS); @@ -1228,30 +1279,7 @@ au_to_exec_args(char **argv) return (t); } -#endif - -/* - * token ID 1 byte - * zonename length 2 bytes - * zonename N bytes + 1 terminating NULL byte - */ -token_t * -au_to_zonename(const char *zonename) -{ - u_char *dptr = NULL; - u_int16_t textlen; - token_t *t; - - textlen = strlen(zonename); - textlen += 1; - GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen); - ADD_U_CHAR(dptr, AUT_ZONENAME); - ADD_U_INT16(dptr, textlen); - ADD_STRING(dptr, zonename, textlen); - return (t); -} -#if !defined(_KERNEL) && !defined(KERNEL) /* * token ID 1 byte * count 4 bytes @@ -1277,7 +1305,6 @@ au_to_exec_env(char **envp) nextenv = *(envp + count); } - totlen += sizeof(char) * count; GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen); ADD_U_CHAR(dptr, AUT_EXEC_ENV); @@ -1294,6 +1321,27 @@ au_to_exec_env(char **envp) /* * token ID 1 byte + * zonename length 2 bytes + * zonename N bytes + 1 terminating NULL byte + */ +token_t * +au_to_zonename(const char *zonename) +{ + u_char *dptr = NULL; + u_int16_t textlen; + token_t *t; + + textlen = strlen(zonename) + 1; + GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen); + + ADD_U_CHAR(dptr, AUT_ZONENAME); + ADD_U_INT16(dptr, textlen); + ADD_STRING(dptr, zonename, textlen); + return (t); +} + +/* + * token ID 1 byte * record byte count 4 bytes * version # 1 byte [2] * event type 2 bytes @@ -1465,7 +1513,7 @@ au_to_trailer(int rec_size) { token_t *t; u_char *dptr = NULL; - u_int16_t magic = TRAILER_PAD_MAGIC; + u_int16_t magic = AUT_TRAILER_MAGIC; GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + sizeof(u_int32_t)); |