summaryrefslogtreecommitdiffstats
path: root/sys/security/audit
Commit message (Collapse)AuthorAgeFilesLines
* Replace use of AU_NULL with 0 when no audit classes are in use; thisrwatson2007-10-292-4/+4
| | | | | | | | supports the removal of hard-coded audit class constants in OpenBSM 1.0. All audit classes are now dynamically configured via the audit_class database. Obtained from: TrustedBSD Project
* Make sure we are incrementing the read count for each audit pipe read.csjp2007-10-271-0/+1
| | | | MFC after: 1 week
* Implement AUE_CORE, which adds process core dump support into the kernel.csjp2007-10-263-0/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change introduces audit_proc_coredump() which is called by coredump(9) to create an audit record for the coredump event. When a process dumps a core, it could be security relevant. It could be an indicator that a stack within the process has been overflowed with an incorrectly constructed malicious payload or a number of other events. The record that is generated looks like this: header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec argument,0,0xb,signal path,/usr/home/csjp/test.core subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2 return,success,1 trailer,111 - We allocate a completely new record to make sure we arent clobbering the audit data associated with the syscall that produced the core (assuming the core is being generated in response to SIGABRT and not an invalid memory access). - Shuffle around expand_name() so we can use the coredump name at the very beginning of the coredump call. Make sure we free the storage referenced by "name" if we need to bail out early. - Audit both successful and failed coredump creation efforts Obtained from: TrustedBSD Project Reviewed by: rwatson MFC after: 1 month
* Merge first in a series of TrustedBSD MAC Framework KPI changesrwatson2007-10-241-6/+6
| | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer
* Use extended process token. The in kernel process auditcsjp2007-10-241-2/+2
| | | | | | | | | | state is stored in an extended subject token now. Make sure that we are using the extended data. This fixes the termID for process tokens. Obtained from: TrustedBSD Project Discussed with: rwatson MFC after: 1 week
* Rename the kthread_xxx (e.g. kthread_create()) callsjulian2007-10-201-2/+2
| | | | | | | | | | | to kproc_xxx as they actually make whole processes. Thos makes way for us to add REAL kthread_create() and friends that actually make theads. it turns out that most of these calls actually end up being moved back to the thread version when it's added. but we need to make this cosmetic change first. I'd LOVE to do this rename in 7.0 so that we can eventually MFC the new kthread_xxx() calls.
* - Change the wakeup logic associated with having multiple sleeperscsjp2007-10-121-2/+2
| | | | | | | | | | | | | | | | on multiple different audit pipes. The old method used cv_signal() which would result in only one thread being woken up after we appended a record to it's queue. This resulted in un-timely wake-ups when processing audit records real-time. - Assign PSOCK priority to threads that have been sleeping on a read(2). This is the same priority threads are woken up with when they select(2) or poll(2). This yields fairness between various forms of sleep on the audit pipes. Obtained from: TrustedBSD Project Discussed with: rwatson MFC after: 1 week
* Remove two boot printfs generated by Audit to announce it's presence,rwatson2007-07-012-2/+4
| | | | | | | | and replace with software-testable sysctl node (security.audit) that can be used to detect kernel audit support. Obtained from: TrustedBSD Project Approved by: re (kensmith)
* - Add audit_arg_audinfo_addr() for auditing the arguments for setaudit_addr(2)csjp2007-06-275-6/+67
| | | | | | | | | | | | | | | | | | | | | | - In audit_bsm.c, make sure all the arguments: ARG_AUID, ARG_ASID, ARG_AMASK, and ARG_TERMID{_ADDR} are valid before auditing their arguments. (This is done for both setaudit and setaudit_addr. - Audit the arguments passed to setaudit_addr(2) - AF_INET6 does not equate to AU_IPv6. Change this in au_to_in_addr_ex() so the audit token is created with the correct type. This fixes the processing of the in_addr_ex token in users pace. - Change the size of the token (as generated by the kernel) from 5*4 bytes to 4*4 bytes (the correct size of an ip6 address) - Correct regression from ucred work which resulted in getaudit() not returning E2BIG if the subject had an ip6 termid - Correct slight regression in getaudit(2) which resulted in the size of a pointer being passed instead of the size of the structure. (This resulted in invalid auditinfo data being returned via getaudit(2)) Reviewed by: rwatson Approved by: re@ (kensmith) Obtained from: TrustedBSD Project MFC after: 1 month
* Add a new MAC framework and policy entry point,rwatson2007-06-261-1/+1
| | | | | | | | | mpo_check_proc_setaudit_addr to be used when controlling use of setaudit_addr(), rather than mpo_check_proc_setaudit(), which takes a different argument type. Reviewed by: csjp Approved by: re (kensmith)
* In setaudit_addr(), drop the process lock in error cases.rwatson2007-06-151-0/+1
| | | | Submitted by: Peter Holm <peter@holm.cc> (BugMaster)
* Spell statistics more correctly in comments.rwatson2007-06-141-1/+1
|
* Close a very narrow race that might cause a trigger allocation to berwatson2007-06-131-7/+6
| | | | | | leaked if a trigger is delivered as the trigger device is closed. Obtained from: TrustedBSD Project
* Clean up, and sometimes remove, a number of audit-related implementationrwatson2007-06-113-32/+3
| | | | | | comments. Obtained from: TrutstedBSD Project
* Move per-process audit state from a pointer in the proc structure torwatson2007-06-074-162/+133
| | | | | | | | | | | embedded storage in struct ucred. This allows audit state to be cached with the thread, avoiding locking operations with each system call, and makes it available in asynchronous execution contexts, such as deep in the network stack or VFS. Reviewed by: csjp Approved by: re (kensmith) Obtained from: TrustedBSD Project
* Clean up audit comments--formatting, spelling, etc.rwatson2007-06-018-74/+70
|
* Change the VOP_OPEN(), vn_open() vnode operation and d_fdopen() cdev operationkib2007-06-011-1/+1
| | | | | | | | argument from being file descriptor index into the pointer to struct file: part 2. Convert calls missed in the first big commit. Noted by: rwatson Pointy hat to: kib
* Remove AUDIT_PRINTF() debugging statements and definition; clean up orrwatson2007-06-013-55/+10
| | | | | | | | | remove associated comments. Slip audit_file_rotate_wait assignment in audit_rotate_vnode() before the drop of the global audit mutex. Obtained from: TrustedBSD Project
* Remove unused !AUDIT audit_proc_*() prototypes: unlike in Mac OS X, werwatson2007-05-302-23/+0
| | | | | | don't define or use these functions if AUDIT isn't configured. Obtained from: TrustedBSD Project
* Synchronize white space to congruent user-space code in OpenBSM.rwatson2007-05-301-0/+2
| | | | Obtained from: TrustedBSD Project
* Remove unused ar_subj_comm field from in-kernel audit record; we neverrwatson2007-05-302-2/+0
| | | | | | export this via BSM, so don't pay space/time cost of maintaining it. Obtained from: TrustedBSD Project
* Consistent white space after .'s in comments.rwatson2007-05-301-3/+3
|
* No need to force __inline__ of currecord(), as the compiler will usefullyrwatson2007-05-231-1/+1
| | | | | | | | inline it when needed already, and the symbol is also required outside of audit.c. This silences a new gcc warning on the topic of using __inline__ instead of __inline. MFC after: 3 days
* Short name of kernel audit worker thread from "audit_worker" to "audit".rwatson2007-05-211-1/+1
| | | | MFC after: 3 days
* Don't expose #ifdef NOTYET parts to userspace via audit_ioctl.h, justrwatson2007-04-291-3/+0
| | | | | | | remove them, since the functionality they are associated with isn't there yet. MFC after: 3 days
* Allow MAC policy modules to control access to audit configuration systemrwatson2007-04-211-0/+44
| | | | | | | | | | | | | | | | calls. Add MAC Framework entry points and MAC policy entry points for audit(), auditctl(), auditon(), setaudit(), aud setauid(). MAC Framework entry points are only added for audit system calls where additional argument context may be useful for policy decision-making; other audit system calls without arguments may be controlled via the priv(9) entry points. Update various policy modules to implement audit-related checks, and in some cases, other missing system-related checks. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
* Remove $P4$ that snuck into CVS from Perforce.rwatson2007-04-171-1/+0
|
* Merge OpenBSM 1.0 alpha 14 changes to src/sys/security/audit:rwatson2007-04-161-13/+184
| | | | | | | | - au_to_attr64(), au_to_process64(), au_to_subject64(), au_to_subject64_ex(), au_to_zonename(), au_to_header64_tm(). - Extended address token fixes. Obtained from: TrustedBSD Project
* Fix the handling of IPv6 addresses for subject and process BSM auditcsjp2007-04-137-33/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | tokens. Currently, we do not support the set{get}audit_addr(2) system calls which allows processes like sshd to set extended or ip6 information for subject tokens. The approach that was taken was to change the process audit state slightly to use an extended terminal ID in the kernel. This allows us to store both IPv4 IPv6 addresses. In the case that an IPv4 address is in use, we convert the terminal ID from an struct auditinfo_addr to a struct auditinfo. If getaudit(2) is called when the subject is bound to an ip6 address, we return E2BIG. - Change the internal audit record to store an extended terminal ID - Introduce ARG_TERMID_ADDR - Change the kaudit <-> BSM conversion process so that we are using the appropriate subject token. If the address associated with the subject is IPv4, we use the standard subject32 token. If the subject has an IPv6 address associated with them, we use an extended subject32 token. - Fix a couple of endian issues where we do a couple of byte swaps when we shouldn't be. IP addresses are already in the correct byte order, so reading the ip6 address 4 bytes at a time and swapping them results in in-correct address data. It should be noted that the same issue was found in the openbsm library and it has been changed there too on the vendor branch - Change A_GETPINFO to use the appropriate structures - Implement A_GETPINFO_ADDR which basically does what A_GETPINFO does, but can also handle ip6 addresses - Adjust get{set}audit(2) syscalls to convert the data auditinfo <-> auditinfo_addr - Fully implement set{get}audit_addr(2) NOTE: This adds the ability for processes to correctly set extended subject information. The appropriate userspace utilities still need to be updated. MFC after: 1 month Reviewed by: rwatson Obtained from: TrustedBSD
* Replace custom file descriptor array sleep lock constructed using a mutexrwatson2007-04-041-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and flags with an sxlock. This leads to a significant and measurable performance improvement as a result of access to shared locking for frequent lookup operations, reduced general overhead, and reduced overhead in the event of contention. All of these are imported for threaded applications where simultaneous access to a shared file descriptor array occurs frequently. Kris has reported 2x-4x transaction rate improvements on 8-core MySQL benchmarks; smaller improvements can be expected for many workloads as a result of reduced overhead. - Generally eliminate the distinction between "fast" and regular acquisisition of the filedesc lock; the plan is that they will now all be fast. Change all locking instances to either shared or exclusive locks. - Correct a bug (pointed out by kib) in fdfree() where previously msleep() was called without the mutex held; sx_sleep() is now always called with the sxlock held exclusively. - Universally hold the struct file lock over changes to struct file, rather than the filedesc lock or no lock. Always update the f_ops field last. A further memory barrier is required here in the future (discussed with jhb). - Improve locking and reference management in linux_at(), which fails to properly acquire vnode references before using vnode pointers. Annotate improper use of vn_fullpath(), which will be replaced at a future date. In fcntl(), we conservatively acquire an exclusive lock, even though in some cases a shared lock may be sufficient, which should be revisited. The dropping of the filedesc lock in fdgrowtable() is no longer required as the sxlock can be held over the sleep operation; we should consider removing that (pointed out by attilio). Tested by: kris Discussed with: jhb, kris, attilio, jeff
* Remove 'MPSAFE' annotations from the comments above most system calls: allrwatson2007-03-042-17/+0
| | | | | | | | system calls now enter without Giant held, and then in some cases, acquire Giant explicitly. Remove a number of other MPSAFE annotations in the credential code and tweak one or two other adjacent comments.
* Update auditing of socket information for the inpcb new world order:rwatson2007-02-201-6/+4
| | | | | so_pcb will always be non-NULL, and lock the inpcb while non-atomically accessing address data.
* When returning early from audit_arg_file() due to so->so_pcb being NULLrwatson2007-01-061-2/+3
| | | | | | | (due to an early reset or the like), remember to unlock the socket lock. This will not occur in 7-CURRENT, but could in theory occur in 6-STABLE. MFC after: 1 week
* Remove two XXX comments that no longer apply.rwatson2006-12-291-5/+0
| | | | Obtained from: TrustedBSD Project
* Use p_cansee() to check that a target process for an audit staterwatson2006-12-291-3/+9
| | | | | | | | | | manipulation is visible to the subject process. Remove XXX comments suggesting this. Convert one XXX on a difference from Darwin into a note: it's not a bug, it's a feature. Obtained from: TrustedBSD Project
* Add a witness sleep warning to canon_path(), which invokes vput() and hencerwatson2006-12-292-3/+3
| | | | | | | may perform an unbounded sleep. Remove an XXX comment suggesting that one be added. Obtained from: TrustedBSD Project
* Update a number of comments:rwatson2006-12-284-23/+22
| | | | | | | | | | | | - Replace XXX with Note: in several cases where observations are made about future functionality rather than problems or bugs. - Remove an XXX comment about byte order and au_to_ip() -- IP headers must be submitted in network byte order. Add a comment to this effect. - Mention that we don't implement select/poll for /dev/audit. Obtained from: TrustedBSD Project
* Sweep kernel replacing suser(9) calls with priv(9) calls, assigningrwatson2006-11-063-13/+16
| | | | | | | | | | | | | specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* Change the type of ar_arg_sockaddr from struct sockaddr to structcsjp2006-11-062-3/+2
| | | | | | | | | | | | | | | | | sockaddr_storage. This structure is defined in RFC 2553 and is a more semantically correct structure for holding IP and IP6 sockaddr information. struct sockaddr is not big enough to hold all the required information for IP6, resulting in truncated addresses et al when auditing IP6 sockaddr information. We also need to assume that the sa->sa_len has been validated before the call to audit_arg_sockaddr() is made, otherwise it could result in a buffer overflow. This is being done to accommodate auditing of network related arguments (like connect, bind et al) that will be added soon. Discussed with: rwatson Obtained from: TrustedBSD Project MFC after: 2 weeks
* Mark the audit system calls as being un-implemented in jails. Currently we docsjp2006-10-101-0/+19
| | | | | | | | | | | | | | | | | | | | | not trust jails enough to execute audit related system calls. An example of this is with su(1), or login(1) within prisons. So, if the syscall request comes from a jail return ENOSYS. This will cause these utilities to operate as if audit is not present in the kernel. Looking forward, this problem will be remedied by allowing non privileged users to maintain and their own audit streams, but the details on exactly how this will be implemented needs to be worked out. This change should fix situations when options AUDIT has been compiled into the kernel, and utilities like su(1), or login(1) fail due to audit system call failures within jails. This is a RELENG_6 candidate. Reported by: Christian Brueffer Discussed with: rwatson MFC after: 3 days
* Add BSM conversion switch entries for a number of system calls, manyrwatson2006-10-031-7/+43
| | | | | | | | administrative, to prevent console warnings and enable basic event auditing (generally without arguments). MFC after: 3 days Obtained from: TrustedBSD Project
* Trim some no longer XXX comments.rwatson2006-10-021-22/+5
| | | | | | | Remove some commented out debugging printfs. MFC after: 3 days Obtained from: TrustedBSD Project
* Audit path argument when changing audit trails.rwatson2006-10-021-3/+4
| | | | | | | | Call NDFREE(), which while not currently strictly necessary, isn't a bad idea. MFC after: 3 days Obtained from: TrustedBSD Project
* Rework the way errors are handled with respect to how audit records arerwatson2006-09-241-100/+145
| | | | | | | | | | | | | | | | | | | | | | | | written to the audit trail file: - audit_record_write() now returns void, and all file system specific error handling occurs inside this function. This pushes error handling complexity out of the record demux routine that hands off to both the trail and audit pipes, and makes trail behavior more consistent with pipes as a record destination. - Rate limit kernel printfs associated with running low on space. Rate limit audit triggers for low space. Rate limit printfs for fail stop events. Rate limit audit worker write error printfs. - Document in detail the types of limits and space checks we perform, and combine common cases. This improves the audit subsystems tolerance to low space conditions by avoiding toasting the console with printfs are waking up the audit daemon continuously. MFC after: 3 days Obtained from: TrustedBSD Project
* Merge OpenBSM 1.0 alpha 11 changes into src/sys/bsm and src/sys/security;rwatson2006-09-211-1/+1
| | | | | | primarily, add new event identifiers and update trigger names. Obtained from: TrustedBSD Project
* Rather than allocating all buffer memory for the completed BSM recordrwatson2006-09-201-19/+17
| | | | | | | | | | | | | | | when allocating the record in the first place, allocate the final buffer when closing the BSM record. At that point, more size information is available, so a sufficiently large buffer can be allocated. This allows the kernel to generate audit records in excess of MAXAUDITDATA bytes, but is consistent with Solaris's behavior. This only comes up when auditing command line arguments, in which case we presume the administrator really does want the data as they have specified the policy flag to gather them. Obtained from: TrustedBSD Project MFC after: 3 days
* Add missing white space in au_to_exec_{args,env}().rwatson2006-09-201-0/+2
| | | | MFC after: 3 days
* Make sure that lutimes(2) gets processed and converted into a BSM record.csjp2006-09-181-0/+1
| | | | | Submitted by: rwatson MFC after: 1 day
* Correct a slight regression which was introduced with the implementation ofcsjp2006-09-174-5/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | audit pipes. If the kernel record was not selected for the trail or the pipe, any user supplied record attached to it would be tossed away, resulting in otherwise selected events being lost. - Introduce two new masks: AR_PRESELECT_USER_TRAIL AR_PRESELECT_USER_PIPE, currently we have AR_PRESELECT_TRAIL and AR_PRESELECT_PIPE, which tells the audit worker that we are interested in the kernel record, with the additional masks we can determine if either the pipe or trail is interested in seeing the kernel or user record. - In audit(2), we unconditionally set the AR_PRESELECT_USER_TRAIL and AR_PRESELECT_USER_PIPE masks under the assumption that userspace has done the preselection [1]. Currently, there is work being done that allows the kernel to parse and preselect user supplied records, so in the future preselection could occur in either layer. But there is still a few details to work out here. [1] At some point we need to teach au_preselect(3) about the interests of all the individual audit pipes. This is a RELENG_6 candidate. Reviewed by: rwatson Obtained from: TrustedBSD Project MFC after: 1 week
* Add AUE_SYSARCH to the list of audit events during BSM conversion to preventrwatson2006-09-171-0/+1
| | | | | | | a console warning. Eventually, we will capture more arguments for sysarch. Obtained from: TrustedBSD Project MFC after: 3 days
OpenPOWER on IntegriCloud