audit.h

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*-
    2  * Copyright (c) 1999-2005 Apple Inc.
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1.  Redistributions of source code must retain the above copyright
    9  *     notice, this list of conditions and the following disclaimer.
   10  * 2.  Redistributions in binary form must reproduce the above copyright
   11  *     notice, this list of conditions and the following disclaimer in the
   12  *     documentation and/or other materials provided with the distribution.
   13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
   14  *     its contributors may be used to endorse or promote products derived
   15  *     from this software without specific prior written permission.
   16  *
   17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
   18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   20  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
   21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
   25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
   26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
   27  * POSSIBILITY OF SUCH DAMAGE.
   28  *
   29  * $FreeBSD: releng/8.1/sys/security/audit/audit.h 196187 2009-08-13 15:01:50Z rwatson $
   30  */
   31 
   32 /*
   33  * This header includes function prototypes and type definitions that are
   34  * necessary for the kernel as a whole to interact with the audit subsystem.
   35  */
   36 
   37 #ifndef _SECURITY_AUDIT_KERNEL_H_
   38 #define _SECURITY_AUDIT_KERNEL_H_
   39 
   40 #ifndef _KERNEL
   41 #error "no user-serviceable parts inside"
   42 #endif
   43 
   44 #include <bsm/audit.h>
   45 
   46 #include <sys/file.h>
   47 #include <sys/sysctl.h>
   48 
   49 /*
   50  * Audit subsystem condition flags.  The audit_enabled flag is set and
   51  * removed automatically as a result of configuring log files, and can be
   52  * observed but should not be directly manipulated.  The audit suspension
   53  * flag permits audit to be temporarily disabled without reconfiguring the
   54  * audit target.
   55  */
   56 extern int      audit_enabled;
   57 extern int      audit_suspended;
   58 
   59 void     audit_syscall_enter(unsigned short code, struct thread *td);
   60 void     audit_syscall_exit(int error, struct thread *td);
   61 
   62 /*
   63  * The remaining kernel functions are conditionally compiled in as they are
   64  * wrapped by a macro, and the macro should be the only place in the source
   65  * tree where these functions are referenced.
   66  */
   67 #ifdef AUDIT
   68 struct ipc_perm;
   69 struct sockaddr;
   70 union auditon_udata;
   71 void     audit_arg_addr(void * addr);
   72 void     audit_arg_exit(int status, int retval);
   73 void     audit_arg_len(int len);
   74 void     audit_arg_atfd1(int atfd);
   75 void     audit_arg_atfd2(int atfd);
   76 void     audit_arg_fd(int fd);
   77 void     audit_arg_fflags(int fflags);
   78 void     audit_arg_gid(gid_t gid);
   79 void     audit_arg_uid(uid_t uid);
   80 void     audit_arg_egid(gid_t egid);
   81 void     audit_arg_euid(uid_t euid);
   82 void     audit_arg_rgid(gid_t rgid);
   83 void     audit_arg_ruid(uid_t ruid);
   84 void     audit_arg_sgid(gid_t sgid);
   85 void     audit_arg_suid(uid_t suid);
   86 void     audit_arg_groupset(gid_t *gidset, u_int gidset_size);
   87 void     audit_arg_login(char *login);
   88 void     audit_arg_ctlname(int *name, int namelen);
   89 void     audit_arg_mask(int mask);
   90 void     audit_arg_mode(mode_t mode);
   91 void     audit_arg_dev(int dev);
   92 void     audit_arg_value(long value);
   93 void     audit_arg_owner(uid_t uid, gid_t gid);
   94 void     audit_arg_pid(pid_t pid);
   95 void     audit_arg_process(struct proc *p);
   96 void     audit_arg_signum(u_int signum);
   97 void     audit_arg_socket(int sodomain, int sotype, int soprotocol);
   98 void     audit_arg_sockaddr(struct thread *td, struct sockaddr *sa);
   99 void     audit_arg_auid(uid_t auid);
  100 void     audit_arg_auditinfo(struct auditinfo *au_info);
  101 void     audit_arg_auditinfo_addr(struct auditinfo_addr *au_info);
  102 void     audit_arg_upath1(struct thread *td, char *upath);
  103 void     audit_arg_upath2(struct thread *td, char *upath);
  104 void     audit_arg_vnode1(struct vnode *vp);
  105 void     audit_arg_vnode2(struct vnode *vp);
  106 void     audit_arg_text(char *text);
  107 void     audit_arg_cmd(int cmd);
  108 void     audit_arg_svipc_cmd(int cmd);
  109 void     audit_arg_svipc_perm(struct ipc_perm *perm);
  110 void     audit_arg_svipc_id(int id);
  111 void     audit_arg_svipc_addr(void *addr);
  112 void     audit_arg_posix_ipc_perm(uid_t uid, gid_t gid, mode_t mode);
  113 void     audit_arg_auditon(union auditon_udata *udata);
  114 void     audit_arg_file(struct proc *p, struct file *fp);
  115 void     audit_arg_argv(char *argv, int argc, int length);
  116 void     audit_arg_envv(char *envv, int envc, int length);
  117 void     audit_sysclose(struct thread *td, int fd);
  118 void     audit_cred_copy(struct ucred *src, struct ucred *dest);
  119 void     audit_cred_destroy(struct ucred *cred);
  120 void     audit_cred_init(struct ucred *cred);
  121 void     audit_cred_kproc0(struct ucred *cred);
  122 void     audit_cred_proc1(struct ucred *cred);
  123 void     audit_proc_coredump(struct thread *td, char *path, int errcode);
  124 void     audit_thread_alloc(struct thread *td);
  125 void     audit_thread_free(struct thread *td);
  126 
  127 /*
  128  * Define macros to wrap the audit_arg_* calls by checking the global
  129  * audit_enabled flag before performing the actual call.
  130  */
  131 #define AUDITING_TD(td)         ((td)->td_pflags & TDP_AUDITREC)
  132 
  133 #define AUDIT_ARG_ADDR(addr) do {                                       \
  134         if (AUDITING_TD(curthread))                                     \
  135                 audit_arg_addr((addr));                                 \
  136 } while (0)
  137 
  138 #define AUDIT_ARG_ARGV(argv, argc, length) do {                         \
  139         if (AUDITING_TD(curthread))                                     \
  140                 audit_arg_argv((argv), (argc), (length));               \
  141 } while (0)
  142 
  143 #define AUDIT_ARG_ATFD1(atfd) do {                                      \
  144         if (AUDITING_TD(curthread))                                     \
  145                 audit_arg_atfd1((atfd));                                \
  146 } while (0)
  147 
  148 #define AUDIT_ARG_ATFD2(atfd) do {                                      \
  149         if (AUDITING_TD(curthread))                                     \
  150                 audit_arg_atfd2((atfd));                                \
  151 } while (0)
  152 
  153 #define AUDIT_ARG_AUDITON(udata) do {                                   \
  154         if (AUDITING_TD(curthread))                                     \
  155                 audit_arg_auditon((udata));                             \
  156 } while (0)
  157 
  158 #define AUDIT_ARG_CMD(cmd) do {                                         \
  159         if (AUDITING_TD(curthread))                                     \
  160                 audit_arg_cmd((cmd));                                   \
  161 } while (0)
  162 
  163 #define AUDIT_ARG_DEV(dev) do {                                         \
  164         if (AUDITING_TD(curthread))                                     \
  165                 audit_arg_dev((dev));                                   \
  166 } while (0)
  167 
  168 #define AUDIT_ARG_EGID(egid) do {                                       \
  169         if (AUDITING_TD(curthread))                                     \
  170                 audit_arg_egid((egid));                                 \
  171 } while (0)
  172 
  173 #define AUDIT_ARG_ENVV(envv, envc, length) do {                         \
  174         if (AUDITING_TD(curthread))                                     \
  175                 audit_arg_envv((envv), (envc), (length));               \
  176 } while (0)
  177 
  178 #define AUDIT_ARG_EXIT(status, retval) do {                             \
  179         if (AUDITING_TD(curthread))                                     \
  180                 audit_arg_exit((status), (retval));                     \
  181 } while (0)
  182 
  183 #define AUDIT_ARG_EUID(euid) do {                                       \
  184         if (AUDITING_TD(curthread))                                     \
  185                 audit_arg_euid((euid));                                 \
  186 } while (0)
  187 
  188 #define AUDIT_ARG_FD(fd) do {                                           \
  189         if (AUDITING_TD(curthread))                                     \
  190                 audit_arg_fd((fd));                                     \
  191 } while (0)
  192 
  193 #define AUDIT_ARG_FILE(p, fp) do {                                      \
  194         if (AUDITING_TD(curthread))                                     \
  195                 audit_arg_file((p), (fp));                              \
  196 } while (0)
  197 
  198 #define AUDIT_ARG_FFLAGS(fflags) do {                                   \
  199         if (AUDITING_TD(curthread))                                     \
  200                 audit_arg_fflags((fflags));                             \
  201 } while (0)
  202 
  203 #define AUDIT_ARG_GID(gid) do {                                         \
  204         if (AUDITING_TD(curthread))                                     \
  205                 audit_arg_gid((gid));                                   \
  206 } while (0)
  207 
  208 #define AUDIT_ARG_GROUPSET(gidset, gidset_size) do {                    \
  209         if (AUDITING_TD(curthread))                                     \
  210                 audit_arg_groupset((gidset), (gidset_size));            \
  211 } while (0)
  212 
  213 #define AUDIT_ARG_MODE(mode) do {                                       \
  214         if (AUDITING_TD(curthread))                                     \
  215                 audit_arg_mode((mode));                                 \
  216 } while (0)
  217 
  218 #define AUDIT_ARG_OWNER(uid, gid) do {                                  \
  219         if (AUDITING_TD(curthread))                                     \
  220                 audit_arg_owner((uid), (gid));                          \
  221 } while (0)
  222 
  223 #define AUDIT_ARG_PID(pid) do {                                         \
  224         if (AUDITING_TD(curthread))                                     \
  225                 audit_arg_pid((pid));                                   \
  226 } while (0)
  227 
  228 #define AUDIT_ARG_PROCESS(p) do {                                       \
  229         if (AUDITING_TD(curthread))                                     \
  230                 audit_arg_process((p));                                 \
  231 } while (0)
  232 
  233 #define AUDIT_ARG_RGID(rgid) do {                                       \
  234         if (AUDITING_TD(curthread))                                     \
  235                 audit_arg_rgid((rgid));                                 \
  236 } while (0)
  237 
  238 #define AUDIT_ARG_RUID(ruid) do {                                       \
  239         if (AUDITING_TD(curthread))                                     \
  240                 audit_arg_ruid((ruid));                                 \
  241 } while (0)
  242 
  243 #define AUDIT_ARG_SIGNUM(signum) do {                                   \
  244         if (AUDITING_TD(curthread))                                     \
  245                 audit_arg_signum((signum));                             \
  246 } while (0)
  247 
  248 #define AUDIT_ARG_SGID(sgid) do {                                       \
  249         if (AUDITING_TD(curthread))                                     \
  250                 audit_arg_sgid((sgid));                                 \
  251 } while (0)
  252 
  253 #define AUDIT_ARG_SOCKET(sodomain, sotype, soprotocol) do {             \
  254         if (AUDITING_TD(curthread))                                     \
  255                 audit_arg_socket((sodomain), (sotype), (soprotocol));   \
  256 } while (0)
  257 
  258 #define AUDIT_ARG_SUID(suid) do {                                       \
  259         if (AUDITING_TD(curthread))                                     \
  260                 audit_arg_suid((suid));                                 \
  261 } while (0)
  262 
  263 #define AUDIT_ARG_TEXT(text) do {                                       \
  264         if (AUDITING_TD(curthread))                                     \
  265                 audit_arg_text((text));                                 \
  266 } while (0)
  267 
  268 #define AUDIT_ARG_UID(uid) do {                                         \
  269         if (AUDITING_TD(curthread))                                     \
  270                 audit_arg_uid((uid));                                   \
  271 } while (0)
  272 
  273 #define AUDIT_ARG_UPATH1(td, upath) do {                                \
  274         if (AUDITING_TD(curthread))                                     \
  275                 audit_arg_upath1((td), (upath));                        \
  276 } while (0)
  277 
  278 #define AUDIT_ARG_UPATH2(td, upath) do {                                \
  279         if (AUDITING_TD(curthread))                                     \
  280                 audit_arg_upath2((td), (upath));                        \
  281 } while (0)
  282 
  283 #define AUDIT_ARG_VALUE(value) do {                                     \
  284         if (AUDITING_TD(curthread))                                     \
  285                 audit_arg_value((value));                               \
  286 } while (0)
  287 
  288 #define AUDIT_ARG_VNODE1(vp) do {                                       \
  289         if (AUDITING_TD(curthread))                                     \
  290                 audit_arg_vnode1((vp));                                 \
  291 } while (0)
  292 
  293 #define AUDIT_ARG_VNODE2(vp) do {                                       \
  294         if (AUDITING_TD(curthread))                                     \
  295                 audit_arg_vnode2((vp));                                 \
  296 } while (0)
  297 
  298 #define AUDIT_SYSCALL_ENTER(code, td)   do {                            \
  299         if (audit_enabled) {                                            \
  300                 audit_syscall_enter(code, td);                          \
  301         }                                                               \
  302 } while (0)
  303 
  304 /*
  305  * Wrap the audit_syscall_exit() function so that it is called only when
  306  * we have a audit record on the thread.  Audit records can persist after
  307  * auditing is disabled, so we don't just check audit_enabled here.
  308  */
  309 #define AUDIT_SYSCALL_EXIT(error, td)   do {                            \
  310         if (td->td_pflags & TDP_AUDITREC)                               \
  311                 audit_syscall_exit(error, td);                          \
  312 } while (0)
  313 
  314 /*
  315  * A Macro to wrap the audit_sysclose() function.
  316  */
  317 #define AUDIT_SYSCLOSE(td, fd)  do {                                    \
  318         if (td->td_pflags & TDP_AUDITREC)                               \
  319                 audit_sysclose(td, fd);                                 \
  320 } while (0)
  321 
  322 #else /* !AUDIT */
  323 
  324 #define AUDIT_ARG_ADDR(addr)
  325 #define AUDIT_ARG_ARGV(argv, argc, length)
  326 #define AUDIT_ARG_ATFD1(atfd)
  327 #define AUDIT_ARG_ATFD2(atfd)
  328 #define AUDIT_ARG_AUDITON(udata)
  329 #define AUDIT_ARG_CMD(cmd)
  330 #define AUDIT_ARG_DEV(dev)
  331 #define AUDIT_ARG_EGID(egid)
  332 #define AUDIT_ARG_ENVV(envv, envc, length)
  333 #define AUDIT_ARG_EXIT(status, retval)
  334 #define AUDIT_ARG_EUID(euid)
  335 #define AUDIT_ARG_FD(fd)
  336 #define AUDIT_ARG_FILE(p, fp)
  337 #define AUDIT_ARG_FFLAGS(fflags)
  338 #define AUDIT_ARG_GID(gid)
  339 #define AUDIT_ARG_GROUPSET(gidset, gidset_size)
  340 #define AUDIT_ARG_MODE(mode)
  341 #define AUDIT_ARG_OWNER(uid, gid)
  342 #define AUDIT_ARG_PID(pid)
  343 #define AUDIT_ARG_PROCESS(p)
  344 #define AUDIT_ARG_RGID(rgid)
  345 #define AUDIT_ARG_RUID(ruid)
  346 #define AUDIT_ARG_SIGNUM(signum)
  347 #define AUDIT_ARG_SGID(sgid)
  348 #define AUDIT_ARG_SOCKET(sodomain, sotype, soprotocol)
  349 #define AUDIT_ARG_SUID(suid)
  350 #define AUDIT_ARG_TEXT(text)
  351 #define AUDIT_ARG_UID(uid)
  352 #define AUDIT_ARG_UPATH1(td, upath)
  353 #define AUDIT_ARG_UPATH2(td, upath)
  354 #define AUDIT_ARG_VALUE(value)
  355 #define AUDIT_ARG_VNODE1(vp)
  356 #define AUDIT_ARG_VNODE2(vp)
  357 
  358 #define AUDIT_SYSCALL_ENTER(code, td)
  359 #define AUDIT_SYSCALL_EXIT(error, td)
  360 
  361 #define AUDIT_SYSCLOSE(p, fd)
  362 
  363 #endif /* AUDIT */
  364 
  365 #endif /* !_SECURITY_AUDIT_KERNEL_H_ */
Cache object: f64192715e665af1c6e796d248e15588
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/security/audit/audit.h

FreeBSD/Linux Kernel Cross Reference
sys/security/audit/audit.h
