audit.h

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*-
    2  * Copyright (c) 1999-2005 Apple Inc.
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1.  Redistributions of source code must retain the above copyright
    9  *     notice, this list of conditions and the following disclaimer.
   10  * 2.  Redistributions in binary form must reproduce the above copyright
   11  *     notice, this list of conditions and the following disclaimer in the
   12  *     documentation and/or other materials provided with the distribution.
   13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
   14  *     its contributors may be used to endorse or promote products derived
   15  *     from this software without specific prior written permission.
   16  *
   17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
   18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   20  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
   21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
   25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
   26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
   27  * POSSIBILITY OF SUCH DAMAGE.
   28  *
   29  * $FreeBSD: releng/9.1/sys/security/audit/audit.h 224181 2011-07-18 12:58:18Z jonathan $
   30  */
   31 
   32 /*
   33  * This header includes function prototypes and type definitions that are
   34  * necessary for the kernel as a whole to interact with the audit subsystem.
   35  */
   36 
   37 #ifndef _SECURITY_AUDIT_KERNEL_H_
   38 #define _SECURITY_AUDIT_KERNEL_H_
   39 
   40 #ifndef _KERNEL
   41 #error "no user-serviceable parts inside"
   42 #endif
   43 
   44 #include <bsm/audit.h>
   45 
   46 #include <sys/file.h>
   47 #include <sys/sysctl.h>
   48 
   49 /*
   50  * Audit subsystem condition flags.  The audit_enabled flag is set and
   51  * removed automatically as a result of configuring log files, and can be
   52  * observed but should not be directly manipulated.  The audit suspension
   53  * flag permits audit to be temporarily disabled without reconfiguring the
   54  * audit target.
   55  */
   56 extern int      audit_enabled;
   57 extern int      audit_suspended;
   58 
   59 void     audit_syscall_enter(unsigned short code, struct thread *td);
   60 void     audit_syscall_exit(int error, struct thread *td);
   61 
   62 /*
   63  * The remaining kernel functions are conditionally compiled in as they are
   64  * wrapped by a macro, and the macro should be the only place in the source
   65  * tree where these functions are referenced.
   66  */
   67 #ifdef AUDIT
   68 struct ipc_perm;
   69 struct sockaddr;
   70 union auditon_udata;
   71 void     audit_arg_addr(void * addr);
   72 void     audit_arg_exit(int status, int retval);
   73 void     audit_arg_len(int len);
   74 void     audit_arg_atfd1(int atfd);
   75 void     audit_arg_atfd2(int atfd);
   76 void     audit_arg_fd(int fd);
   77 void     audit_arg_fflags(int fflags);
   78 void     audit_arg_gid(gid_t gid);
   79 void     audit_arg_uid(uid_t uid);
   80 void     audit_arg_egid(gid_t egid);
   81 void     audit_arg_euid(uid_t euid);
   82 void     audit_arg_rgid(gid_t rgid);
   83 void     audit_arg_ruid(uid_t ruid);
   84 void     audit_arg_sgid(gid_t sgid);
   85 void     audit_arg_suid(uid_t suid);
   86 void     audit_arg_groupset(gid_t *gidset, u_int gidset_size);
   87 void     audit_arg_login(char *login);
   88 void     audit_arg_ctlname(int *name, int namelen);
   89 void     audit_arg_mask(int mask);
   90 void     audit_arg_mode(mode_t mode);
   91 void     audit_arg_dev(int dev);
   92 void     audit_arg_value(long value);
   93 void     audit_arg_owner(uid_t uid, gid_t gid);
   94 void     audit_arg_pid(pid_t pid);
   95 void     audit_arg_process(struct proc *p);
   96 void     audit_arg_signum(u_int signum);
   97 void     audit_arg_socket(int sodomain, int sotype, int soprotocol);
   98 void     audit_arg_sockaddr(struct thread *td, struct sockaddr *sa);
   99 void     audit_arg_auid(uid_t auid);
  100 void     audit_arg_auditinfo(struct auditinfo *au_info);
  101 void     audit_arg_auditinfo_addr(struct auditinfo_addr *au_info);
  102 void     audit_arg_upath1(struct thread *td, char *upath);
  103 void     audit_arg_upath2(struct thread *td, char *upath);
  104 void     audit_arg_vnode1(struct vnode *vp);
  105 void     audit_arg_vnode2(struct vnode *vp);
  106 void     audit_arg_text(char *text);
  107 void     audit_arg_cmd(int cmd);
  108 void     audit_arg_svipc_cmd(int cmd);
  109 void     audit_arg_svipc_perm(struct ipc_perm *perm);
  110 void     audit_arg_svipc_id(int id);
  111 void     audit_arg_svipc_addr(void *addr);
  112 void     audit_arg_posix_ipc_perm(uid_t uid, gid_t gid, mode_t mode);
  113 void     audit_arg_auditon(union auditon_udata *udata);
  114 void     audit_arg_file(struct proc *p, struct file *fp);
  115 void     audit_arg_argv(char *argv, int argc, int length);
  116 void     audit_arg_envv(char *envv, int envc, int length);
  117 void     audit_arg_rights(cap_rights_t rights);
  118 void     audit_sysclose(struct thread *td, int fd);
  119 void     audit_cred_copy(struct ucred *src, struct ucred *dest);
  120 void     audit_cred_destroy(struct ucred *cred);
  121 void     audit_cred_init(struct ucred *cred);
  122 void     audit_cred_kproc0(struct ucred *cred);
  123 void     audit_cred_proc1(struct ucred *cred);
  124 void     audit_proc_coredump(struct thread *td, char *path, int errcode);
  125 void     audit_thread_alloc(struct thread *td);
  126 void     audit_thread_free(struct thread *td);
  127 
  128 /*
  129  * Define macros to wrap the audit_arg_* calls by checking the global
  130  * audit_enabled flag before performing the actual call.
  131  */
  132 #define AUDITING_TD(td)         ((td)->td_pflags & TDP_AUDITREC)
  133 
  134 #define AUDIT_ARG_ADDR(addr) do {                                       \
  135         if (AUDITING_TD(curthread))                                     \
  136                 audit_arg_addr((addr));                                 \
  137 } while (0)
  138 
  139 #define AUDIT_ARG_ARGV(argv, argc, length) do {                         \
  140         if (AUDITING_TD(curthread))                                     \
  141                 audit_arg_argv((argv), (argc), (length));               \
  142 } while (0)
  143 
  144 #define AUDIT_ARG_ATFD1(atfd) do {                                      \
  145         if (AUDITING_TD(curthread))                                     \
  146                 audit_arg_atfd1((atfd));                                \
  147 } while (0)
  148 
  149 #define AUDIT_ARG_ATFD2(atfd) do {                                      \
  150         if (AUDITING_TD(curthread))                                     \
  151                 audit_arg_atfd2((atfd));                                \
  152 } while (0)
  153 
  154 #define AUDIT_ARG_AUDITON(udata) do {                                   \
  155         if (AUDITING_TD(curthread))                                     \
  156                 audit_arg_auditon((udata));                             \
  157 } while (0)
  158 
  159 #define AUDIT_ARG_CMD(cmd) do {                                         \
  160         if (AUDITING_TD(curthread))                                     \
  161                 audit_arg_cmd((cmd));                                   \
  162 } while (0)
  163 
  164 #define AUDIT_ARG_DEV(dev) do {                                         \
  165         if (AUDITING_TD(curthread))                                     \
  166                 audit_arg_dev((dev));                                   \
  167 } while (0)
  168 
  169 #define AUDIT_ARG_EGID(egid) do {                                       \
  170         if (AUDITING_TD(curthread))                                     \
  171                 audit_arg_egid((egid));                                 \
  172 } while (0)
  173 
  174 #define AUDIT_ARG_ENVV(envv, envc, length) do {                         \
  175         if (AUDITING_TD(curthread))                                     \
  176                 audit_arg_envv((envv), (envc), (length));               \
  177 } while (0)
  178 
  179 #define AUDIT_ARG_EXIT(status, retval) do {                             \
  180         if (AUDITING_TD(curthread))                                     \
  181                 audit_arg_exit((status), (retval));                     \
  182 } while (0)
  183 
  184 #define AUDIT_ARG_EUID(euid) do {                                       \
  185         if (AUDITING_TD(curthread))                                     \
  186                 audit_arg_euid((euid));                                 \
  187 } while (0)
  188 
  189 #define AUDIT_ARG_FD(fd) do {                                           \
  190         if (AUDITING_TD(curthread))                                     \
  191                 audit_arg_fd((fd));                                     \
  192 } while (0)
  193 
  194 #define AUDIT_ARG_FILE(p, fp) do {                                      \
  195         if (AUDITING_TD(curthread))                                     \
  196                 audit_arg_file((p), (fp));                              \
  197 } while (0)
  198 
  199 #define AUDIT_ARG_FFLAGS(fflags) do {                                   \
  200         if (AUDITING_TD(curthread))                                     \
  201                 audit_arg_fflags((fflags));                             \
  202 } while (0)
  203 
  204 #define AUDIT_ARG_GID(gid) do {                                         \
  205         if (AUDITING_TD(curthread))                                     \
  206                 audit_arg_gid((gid));                                   \
  207 } while (0)
  208 
  209 #define AUDIT_ARG_GROUPSET(gidset, gidset_size) do {                    \
  210         if (AUDITING_TD(curthread))                                     \
  211                 audit_arg_groupset((gidset), (gidset_size));            \
  212 } while (0)
  213 
  214 #define AUDIT_ARG_MODE(mode) do {                                       \
  215         if (AUDITING_TD(curthread))                                     \
  216                 audit_arg_mode((mode));                                 \
  217 } while (0)
  218 
  219 #define AUDIT_ARG_OWNER(uid, gid) do {                                  \
  220         if (AUDITING_TD(curthread))                                     \
  221                 audit_arg_owner((uid), (gid));                          \
  222 } while (0)
  223 
  224 #define AUDIT_ARG_PID(pid) do {                                         \
  225         if (AUDITING_TD(curthread))                                     \
  226                 audit_arg_pid((pid));                                   \
  227 } while (0)
  228 
  229 #define AUDIT_ARG_PROCESS(p) do {                                       \
  230         if (AUDITING_TD(curthread))                                     \
  231                 audit_arg_process((p));                                 \
  232 } while (0)
  233 
  234 #define AUDIT_ARG_RGID(rgid) do {                                       \
  235         if (AUDITING_TD(curthread))                                     \
  236                 audit_arg_rgid((rgid));                                 \
  237 } while (0)
  238 
  239 #define AUDIT_ARG_RIGHTS(rights) do {                                   \
  240         if (AUDITING_TD(curthread))                                     \
  241                 audit_arg_rights((rights));                             \
  242 } while (0)
  243 
  244 #define AUDIT_ARG_RUID(ruid) do {                                       \
  245         if (AUDITING_TD(curthread))                                     \
  246                 audit_arg_ruid((ruid));                                 \
  247 } while (0)
  248 
  249 #define AUDIT_ARG_SIGNUM(signum) do {                                   \
  250         if (AUDITING_TD(curthread))                                     \
  251                 audit_arg_signum((signum));                             \
  252 } while (0)
  253 
  254 #define AUDIT_ARG_SGID(sgid) do {                                       \
  255         if (AUDITING_TD(curthread))                                     \
  256                 audit_arg_sgid((sgid));                                 \
  257 } while (0)
  258 
  259 #define AUDIT_ARG_SOCKET(sodomain, sotype, soprotocol) do {             \
  260         if (AUDITING_TD(curthread))                                     \
  261                 audit_arg_socket((sodomain), (sotype), (soprotocol));   \
  262 } while (0)
  263 
  264 #define AUDIT_ARG_SUID(suid) do {                                       \
  265         if (AUDITING_TD(curthread))                                     \
  266                 audit_arg_suid((suid));                                 \
  267 } while (0)
  268 
  269 #define AUDIT_ARG_TEXT(text) do {                                       \
  270         if (AUDITING_TD(curthread))                                     \
  271                 audit_arg_text((text));                                 \
  272 } while (0)
  273 
  274 #define AUDIT_ARG_UID(uid) do {                                         \
  275         if (AUDITING_TD(curthread))                                     \
  276                 audit_arg_uid((uid));                                   \
  277 } while (0)
  278 
  279 #define AUDIT_ARG_UPATH1(td, upath) do {                                \
  280         if (AUDITING_TD(curthread))                                     \
  281                 audit_arg_upath1((td), (upath));                        \
  282 } while (0)
  283 
  284 #define AUDIT_ARG_UPATH2(td, upath) do {                                \
  285         if (AUDITING_TD(curthread))                                     \
  286                 audit_arg_upath2((td), (upath));                        \
  287 } while (0)
  288 
  289 #define AUDIT_ARG_VALUE(value) do {                                     \
  290         if (AUDITING_TD(curthread))                                     \
  291                 audit_arg_value((value));                               \
  292 } while (0)
  293 
  294 #define AUDIT_ARG_VNODE1(vp) do {                                       \
  295         if (AUDITING_TD(curthread))                                     \
  296                 audit_arg_vnode1((vp));                                 \
  297 } while (0)
  298 
  299 #define AUDIT_ARG_VNODE2(vp) do {                                       \
  300         if (AUDITING_TD(curthread))                                     \
  301                 audit_arg_vnode2((vp));                                 \
  302 } while (0)
  303 
  304 #define AUDIT_SYSCALL_ENTER(code, td)   do {                            \
  305         if (audit_enabled) {                                            \
  306                 audit_syscall_enter(code, td);                          \
  307         }                                                               \
  308 } while (0)
  309 
  310 /*
  311  * Wrap the audit_syscall_exit() function so that it is called only when
  312  * we have a audit record on the thread.  Audit records can persist after
  313  * auditing is disabled, so we don't just check audit_enabled here.
  314  */
  315 #define AUDIT_SYSCALL_EXIT(error, td)   do {                            \
  316         if (td->td_pflags & TDP_AUDITREC)                               \
  317                 audit_syscall_exit(error, td);                          \
  318 } while (0)
  319 
  320 /*
  321  * A Macro to wrap the audit_sysclose() function.
  322  */
  323 #define AUDIT_SYSCLOSE(td, fd)  do {                                    \
  324         if (td->td_pflags & TDP_AUDITREC)                               \
  325                 audit_sysclose(td, fd);                                 \
  326 } while (0)
  327 
  328 #else /* !AUDIT */
  329 
  330 #define AUDIT_ARG_ADDR(addr)
  331 #define AUDIT_ARG_ARGV(argv, argc, length)
  332 #define AUDIT_ARG_ATFD1(atfd)
  333 #define AUDIT_ARG_ATFD2(atfd)
  334 #define AUDIT_ARG_AUDITON(udata)
  335 #define AUDIT_ARG_CMD(cmd)
  336 #define AUDIT_ARG_DEV(dev)
  337 #define AUDIT_ARG_EGID(egid)
  338 #define AUDIT_ARG_ENVV(envv, envc, length)
  339 #define AUDIT_ARG_EXIT(status, retval)
  340 #define AUDIT_ARG_EUID(euid)
  341 #define AUDIT_ARG_FD(fd)
  342 #define AUDIT_ARG_FILE(p, fp)
  343 #define AUDIT_ARG_FFLAGS(fflags)
  344 #define AUDIT_ARG_GID(gid)
  345 #define AUDIT_ARG_GROUPSET(gidset, gidset_size)
  346 #define AUDIT_ARG_MODE(mode)
  347 #define AUDIT_ARG_OWNER(uid, gid)
  348 #define AUDIT_ARG_PID(pid)
  349 #define AUDIT_ARG_PROCESS(p)
  350 #define AUDIT_ARG_RGID(rgid)
  351 #define AUDIT_ARG_RIGHTS(rights)
  352 #define AUDIT_ARG_RUID(ruid)
  353 #define AUDIT_ARG_SIGNUM(signum)
  354 #define AUDIT_ARG_SGID(sgid)
  355 #define AUDIT_ARG_SOCKET(sodomain, sotype, soprotocol)
  356 #define AUDIT_ARG_SUID(suid)
  357 #define AUDIT_ARG_TEXT(text)
  358 #define AUDIT_ARG_UID(uid)
  359 #define AUDIT_ARG_UPATH1(td, upath)
  360 #define AUDIT_ARG_UPATH2(td, upath)
  361 #define AUDIT_ARG_VALUE(value)
  362 #define AUDIT_ARG_VNODE1(vp)
  363 #define AUDIT_ARG_VNODE2(vp)
  364 
  365 #define AUDIT_SYSCALL_ENTER(code, td)
  366 #define AUDIT_SYSCALL_EXIT(error, td)
  367 
  368 #define AUDIT_SYSCLOSE(p, fd)
  369 
  370 #endif /* AUDIT */
  371 
  372 #endif /* !_SECURITY_AUDIT_KERNEL_H_ */
Cache object: 091a64f030bfadb1d8722434836c0be5
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/security/audit/audit.h

FreeBSD/Linux Kernel Cross Reference
sys/security/audit/audit.h
