summaryrefslogtreecommitdiffstats
path: root/sys/security/audit/audit_syscalls.c
Commit message (Collapse)AuthorAgeFilesLines
* Partially roll back a revision which changed the error code being returnedcsjp2008-11-301-1/+1
| | | | | | | | | | | | | | by getaudit(2). Some applications such has su, id will interpret E2BIG as requiring the use of getaudit_addr(2) to pull extended audit state (ip6) from the kernel. This change un-breaks the ABI when auditing has been activated on a system and the users are logged in via ip6. This is a RELENG_7_1 candidate. MFC after: 1 day Discussed with: rwatson
* When repeatedly accessing a thread credential, cache the credentialrwatson2008-11-141-25/+24
| | | | | | | | | | | | | pointer in a local thread. While this is unlikely to significantly improve performance given modern compiler behavior, it makes the code more readable and reduces diffs to the Mac OS X version of the same code (which stores things in creds in the same way, but where the cred for a thread is reached quite differently). Discussed with: sson MFC after: 1 month Sponsored by: Apple Inc. Obtained from: TrustedBSD Project
* Add support for extended header BSM tokens. Currently we use thecsjp2008-11-111-2/+5
| | | | | | | | | | | | | | | | | | | | | | regular header tokens. The extended header tokens contain an IP or IPv6 address which makes it possible to identify which host an audit record came from when audit records are centralized. If the host information has not been specified, the system will default to the old style headers. Otherwise, audit records that are created as a result of system calls will contain host information. This implemented has been designed to be consistent with the Solaris implementation. Host information is set/retrieved using the A_GETKAUDIT and A_SETKAUDIT auditon(2) commands. These commands require that a pointer to a auditinfo_addr_t object is passed. Currently only IP and IPv6 address families are supported. The users pace bits associated with this change will follow in an openbsm import. Reviewed by: rwatson, (sson, wsalamon (older version)) MFC after: 1 month
* Unbreak the build.des2008-09-041-2/+2
| | | | Pointy hat to: kevlo
* If the process id specified is invalid, the system call returns ESRCHkevlo2008-09-041-10/+10
|
* Use ERANGE instead of EOVERFLOW selected in r182059, this seems morerwatson2008-08-241-1/+1
| | | | | | | | | appropriate even if Solaris doesn't document it (E2BIG) or use it (EOVERFLOW). Submitted by: nectar at apple dot com Sponsored by: Apple, Inc. MFC after: 3 days
* When getaudit(2) is unable to fit the terminal IPv6 address into therwatson2008-08-231-1/+1
| | | | | | | | | | | space provided by its argument structure, return EOVERFLOW instead of E2BIG. The latter is documented in Solaris's man page, but the former is implemented. In either case, the caller should use getaudit_addr(2) to return the IPv6 address. Submitted by: sson Obtained from: Apple, Inc. MFC after: 3 days
* Further synchronization of copyrights, licenses, white space, etc fromrwatson2008-07-311-1/+1
| | | | | | | Apple and from the OpenBSM vendor tree. Obtained from: Apple Inc., TrustedBSD Project MFC after: 3 days
* In preparation to sync Apple and FreeBSD versions of security audit,rwatson2008-07-221-2/+2
| | | | | | | | pick up the Apple Computer -> Apple change in their copyright and license templates. Obtained from: Apple Inc. MFC after: 3 days
* Use __FBSDID() for $FreeBSD$ IDs in the audit code.rwatson2008-04-131-2/+3
| | | | MFC after: 3 days
* Change auditon(2) so that if somebody supplies an invalid command, itcsjp2008-03-061-0/+3
| | | | | | | | returns EINVAL. Right now we return 0 or success for invalid commands, which could be quite problematic in certain conditions. MFC after: 1 week Discussed with: rwatson
* Rename globally exposed symbol send_trigger() to audit_send_trigger().rwatson2008-03-011-1/+1
| | | | MFC after: 1 month
* VOP_LOCK1() (and so VOP_LOCK()) and VOP_UNLOCK() are only used inattilio2008-01-131-2/+2
| | | | | | | | | | | conjuction with 'thread' argument passing which is always curthread. Remove the unuseful extra-argument and pass explicitly curthread to lower layer functions, when necessary. KPI results broken by this change, which should affect several ports, so version bumping and manpage update will be further committed. Tested by: kris, pho, Diego Sardina <siarodx at gmail dot com>
* Merge first in a series of TrustedBSD MAC Framework KPI changesrwatson2007-10-241-6/+6
| | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer
* - Add audit_arg_audinfo_addr() for auditing the arguments for setaudit_addr(2)csjp2007-06-271-2/+7
| | | | | | | | | | | | | | | | | | | | | | - In audit_bsm.c, make sure all the arguments: ARG_AUID, ARG_ASID, ARG_AMASK, and ARG_TERMID{_ADDR} are valid before auditing their arguments. (This is done for both setaudit and setaudit_addr. - Audit the arguments passed to setaudit_addr(2) - AF_INET6 does not equate to AU_IPv6. Change this in au_to_in_addr_ex() so the audit token is created with the correct type. This fixes the processing of the in_addr_ex token in users pace. - Change the size of the token (as generated by the kernel) from 5*4 bytes to 4*4 bytes (the correct size of an ip6 address) - Correct regression from ucred work which resulted in getaudit() not returning E2BIG if the subject had an ip6 termid - Correct slight regression in getaudit(2) which resulted in the size of a pointer being passed instead of the size of the structure. (This resulted in invalid auditinfo data being returned via getaudit(2)) Reviewed by: rwatson Approved by: re@ (kensmith) Obtained from: TrustedBSD Project MFC after: 1 month
* Add a new MAC framework and policy entry point,rwatson2007-06-261-1/+1
| | | | | | | | | mpo_check_proc_setaudit_addr to be used when controlling use of setaudit_addr(), rather than mpo_check_proc_setaudit(), which takes a different argument type. Reviewed by: csjp Approved by: re (kensmith)
* In setaudit_addr(), drop the process lock in error cases.rwatson2007-06-151-0/+1
| | | | Submitted by: Peter Holm <peter@holm.cc> (BugMaster)
* Move per-process audit state from a pointer in the proc structure torwatson2007-06-071-102/+99
| | | | | | | | | | | embedded storage in struct ucred. This allows audit state to be cached with the thread, avoiding locking operations with each system call, and makes it available in asynchronous execution contexts, such as deep in the network stack or VFS. Reviewed by: csjp Approved by: re (kensmith) Obtained from: TrustedBSD Project
* Change the VOP_OPEN(), vn_open() vnode operation and d_fdopen() cdev operationkib2007-06-011-1/+1
| | | | | | | | argument from being file descriptor index into the pointer to struct file: part 2. Convert calls missed in the first big commit. Noted by: rwatson Pointy hat to: kib
* Remove unused !AUDIT audit_proc_*() prototypes: unlike in Mac OS X, werwatson2007-05-301-19/+0
| | | | | | don't define or use these functions if AUDIT isn't configured. Obtained from: TrustedBSD Project
* Consistent white space after .'s in comments.rwatson2007-05-301-3/+3
|
* Allow MAC policy modules to control access to audit configuration systemrwatson2007-04-211-0/+44
| | | | | | | | | | | | | | | | calls. Add MAC Framework entry points and MAC policy entry points for audit(), auditctl(), auditon(), setaudit(), aud setauid(). MAC Framework entry points are only added for audit system calls where additional argument context may be useful for policy decision-making; other audit system calls without arguments may be controlled via the priv(9) entry points. Update various policy modules to implement audit-related checks, and in some cases, other missing system-related checks. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
* Fix the handling of IPv6 addresses for subject and process BSM auditcsjp2007-04-131-7/+52
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | tokens. Currently, we do not support the set{get}audit_addr(2) system calls which allows processes like sshd to set extended or ip6 information for subject tokens. The approach that was taken was to change the process audit state slightly to use an extended terminal ID in the kernel. This allows us to store both IPv4 IPv6 addresses. In the case that an IPv4 address is in use, we convert the terminal ID from an struct auditinfo_addr to a struct auditinfo. If getaudit(2) is called when the subject is bound to an ip6 address, we return E2BIG. - Change the internal audit record to store an extended terminal ID - Introduce ARG_TERMID_ADDR - Change the kaudit <-> BSM conversion process so that we are using the appropriate subject token. If the address associated with the subject is IPv4, we use the standard subject32 token. If the subject has an IPv6 address associated with them, we use an extended subject32 token. - Fix a couple of endian issues where we do a couple of byte swaps when we shouldn't be. IP addresses are already in the correct byte order, so reading the ip6 address 4 bytes at a time and swapping them results in in-correct address data. It should be noted that the same issue was found in the openbsm library and it has been changed there too on the vendor branch - Change A_GETPINFO to use the appropriate structures - Implement A_GETPINFO_ADDR which basically does what A_GETPINFO does, but can also handle ip6 addresses - Adjust get{set}audit(2) syscalls to convert the data auditinfo <-> auditinfo_addr - Fully implement set{get}audit_addr(2) NOTE: This adds the ability for processes to correctly set extended subject information. The appropriate userspace utilities still need to be updated. MFC after: 1 month Reviewed by: rwatson Obtained from: TrustedBSD
* Remove 'MPSAFE' annotations from the comments above most system calls: allrwatson2007-03-041-12/+0
| | | | | | | | system calls now enter without Giant held, and then in some cases, acquire Giant explicitly. Remove a number of other MPSAFE annotations in the credential code and tweak one or two other adjacent comments.
* Remove two XXX comments that no longer apply.rwatson2006-12-291-5/+0
| | | | Obtained from: TrustedBSD Project
* Use p_cansee() to check that a target process for an audit staterwatson2006-12-291-3/+9
| | | | | | | | | | manipulation is visible to the subject process. Remove XXX comments suggesting this. Convert one XXX on a difference from Darwin into a note: it's not a bug, it's a feature. Obtained from: TrustedBSD Project
* Sweep kernel replacing suser(9) calls with priv(9) calls, assigningrwatson2006-11-061-9/+10
| | | | | | | | | | | | | specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* Mark the audit system calls as being un-implemented in jails. Currently we docsjp2006-10-101-0/+19
| | | | | | | | | | | | | | | | | | | | | not trust jails enough to execute audit related system calls. An example of this is with su(1), or login(1) within prisons. So, if the syscall request comes from a jail return ENOSYS. This will cause these utilities to operate as if audit is not present in the kernel. Looking forward, this problem will be remedied by allowing non privileged users to maintain and their own audit streams, but the details on exactly how this will be implemented needs to be worked out. This change should fix situations when options AUDIT has been compiled into the kernel, and utilities like su(1), or login(1) fail due to audit system call failures within jails. This is a RELENG_6 candidate. Reported by: Christian Brueffer Discussed with: rwatson MFC after: 3 days
* Audit path argument when changing audit trails.rwatson2006-10-021-3/+4
| | | | | | | | Call NDFREE(), which while not currently strictly necessary, isn't a bad idea. MFC after: 3 days Obtained from: TrustedBSD Project
* Correct a slight regression which was introduced with the implementation ofcsjp2006-09-171-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | audit pipes. If the kernel record was not selected for the trail or the pipe, any user supplied record attached to it would be tossed away, resulting in otherwise selected events being lost. - Introduce two new masks: AR_PRESELECT_USER_TRAIL AR_PRESELECT_USER_PIPE, currently we have AR_PRESELECT_TRAIL and AR_PRESELECT_PIPE, which tells the audit worker that we are interested in the kernel record, with the additional masks we can determine if either the pipe or trail is interested in seeing the kernel or user record. - In audit(2), we unconditionally set the AR_PRESELECT_USER_TRAIL and AR_PRESELECT_USER_PIPE masks under the assumption that userspace has done the preselection [1]. Currently, there is work being done that allows the kernel to parse and preselect user supplied records, so in the future preselection could occur in either layer. But there is still a few details to work out here. [1] At some point we need to teach au_preselect(3) about the interests of all the individual audit pipes. This is a RELENG_6 candidate. Reviewed by: rwatson Obtained from: TrustedBSD Project MFC after: 1 week
* Audit the argv and env vectors passed in on exec:wsalamon2006-09-011-1/+8
| | | | | | | | | | | | Add the argument auditing functions for argv and env. Add kernel-specific versions of the tokenizer functions for the arg and env represented as a char array. Implement the AUDIT_ARGV and AUDIT_ARGE audit policy commands to enable/disable argv/env auditing. Call the argument auditing from the exec system calls. Obtained from: TrustedBSD Project Approved by: rwatson (mentor)
* Remove use of Giant around vn_open() in audit trail setup.rwatson2006-06-051-15/+10
| | | | | Submitted by: jhb, wsalamon Obtained from: TrustedBSD Project
* Merge Perforce change 93581 from TrustedBSD audit3 branch:rwatson2006-03-191-45/+53
| | | | | | Mega-style patch. Obtained from: TrustedBSD Project
* Merge perforce change 93199:rwatson2006-03-181-1/+1
| | | | | | | | | | Change send_trigger() prototype to return an int, so that user space callers can tell if the message was successfully placed in the trigger queue. This isn't quite the same as it being successfully received, but is close enough that we can generate a more useful warning message in audit(8). Obtained from: TrustedBSD Project
* Import kernel audit framework:rwatson2006-02-011-0/+652
- Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
OpenPOWER on IntegriCloud