Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/security/audit/audit_bsm.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /* 2 * Copyright (c) 1999-2005 Apple Inc. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of 14 * its contributors may be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD: releng/7.3/sys/security/audit/audit_bsm.c 189043 2009-02-25 15:01:26Z rwatson $"); 32 33 #include <sys/param.h> 34 #include <sys/vnode.h> 35 #include <sys/ipc.h> 36 #include <sys/lock.h> 37 #include <sys/malloc.h> 38 #include <sys/mutex.h> 39 #include <sys/socket.h> 40 #include <sys/extattr.h> 41 #include <sys/fcntl.h> 42 #include <sys/user.h> 43 #include <sys/systm.h> 44 45 #include <bsm/audit.h> 46 #include <bsm/audit_internal.h> 47 #include <bsm/audit_record.h> 48 #include <bsm/audit_kevents.h> 49 50 #include <security/audit/audit.h> 51 #include <security/audit/audit_private.h> 52 53 #include <netinet/in_systm.h> 54 #include <netinet/in.h> 55 #include <netinet/ip.h> 56 57 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data"); 58 59 static void audit_sys_auditon(struct audit_record *ar, 60 struct au_record *rec); 61 62 /* 63 * Initialize the BSM auditing subsystem. 64 */ 65 void 66 kau_init(void) 67 { 68 69 au_evclassmap_init(); 70 } 71 72 /* 73 * This call reserves memory for the audit record. Memory must be guaranteed 74 * before any auditable event can be generated. The au_record structure 75 * maintains a reference to the memory allocated above and also the list of 76 * tokens associated with this record. 77 */ 78 static struct au_record * 79 kau_open(void) 80 { 81 struct au_record *rec; 82 83 rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK); 84 rec->data = NULL; 85 TAILQ_INIT(&rec->token_q); 86 rec->len = 0; 87 rec->used = 1; 88 89 return (rec); 90 } 91 92 /* 93 * Store the token with the record descriptor. 94 */ 95 static void 96 kau_write(struct au_record *rec, struct au_token *tok) 97 { 98 99 KASSERT(tok != NULL, ("kau_write: tok == NULL")); 100 101 TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens); 102 rec->len += tok->len; 103 } 104 105 /* 106 * Close out the audit record by adding the header token, identifying any 107 * missing tokens. Write out the tokens to the record memory. 108 */ 109 static void 110 kau_close(struct au_record *rec, struct timespec *ctime, short event) 111 { 112 u_char *dptr; 113 size_t tot_rec_size; 114 token_t *cur, *hdr, *trail; 115 struct timeval tm; 116 117 tot_rec_size = rec->len + AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE; 118 rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO); 119 120 tm.tv_usec = ctime->tv_nsec / 1000; 121 tm.tv_sec = ctime->tv_sec; 122 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm); 123 TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens); 124 125 trail = au_to_trailer(tot_rec_size); 126 TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens); 127 128 rec->len = tot_rec_size; 129 dptr = rec->data; 130 TAILQ_FOREACH(cur, &rec->token_q, tokens) { 131 memcpy(dptr, cur->t_data, cur->len); 132 dptr += cur->len; 133 } 134 } 135 136 /* 137 * Free a BSM audit record by releasing all the tokens and clearing the audit 138 * record information. 139 */ 140 void 141 kau_free(struct au_record *rec) 142 { 143 struct au_token *tok; 144 145 /* Free the token list. */ 146 while ((tok = TAILQ_FIRST(&rec->token_q))) { 147 TAILQ_REMOVE(&rec->token_q, tok, tokens); 148 free(tok->t_data, M_AUDITBSM); 149 free(tok, M_AUDITBSM); 150 } 151 152 rec->used = 0; 153 rec->len = 0; 154 free(rec->data, M_AUDITBSM); 155 free(rec, M_AUDITBSM); 156 } 157 158 /* 159 * XXX: May want turn some (or all) of these macros into functions in order 160 * to reduce the generated code size. 161 * 162 * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the 163 * caller are OK with this. 164 */ 165 #define UPATH1_TOKENS do { \ 166 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \ 167 tok = au_to_path(ar->ar_arg_upath1); \ 168 kau_write(rec, tok); \ 169 } \ 170 } while (0) 171 172 #define UPATH2_TOKENS do { \ 173 if (ARG_IS_VALID(kar, ARG_UPATH2)) { \ 174 tok = au_to_path(ar->ar_arg_upath2); \ 175 kau_write(rec, tok); \ 176 } \ 177 } while (0) 178 179 #define VNODE1_TOKENS do { \ 180 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 181 tok = au_to_attr32(&ar->ar_arg_vnode1); \ 182 kau_write(rec, tok); \ 183 } \ 184 } while (0) 185 186 #define UPATH1_VNODE1_TOKENS do { \ 187 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \ 188 UPATH1_TOKENS; \ 189 } \ 190 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 191 tok = au_to_attr32(&ar->ar_arg_vnode1); \ 192 kau_write(rec, tok); \ 193 } \ 194 } while (0) 195 196 #define VNODE2_TOKENS do { \ 197 if (ARG_IS_VALID(kar, ARG_VNODE2)) { \ 198 tok = au_to_attr32(&ar->ar_arg_vnode2); \ 199 kau_write(rec, tok); \ 200 } \ 201 } while (0) 202 203 #define FD_VNODE1_TOKENS do { \ 204 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 205 if (ARG_IS_VALID(kar, ARG_FD)) { \ 206 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); \ 207 kau_write(rec, tok); \ 208 } \ 209 tok = au_to_attr32(&ar->ar_arg_vnode1); \ 210 kau_write(rec, tok); \ 211 } else { \ 212 if (ARG_IS_VALID(kar, ARG_FD)) { \ 213 tok = au_to_arg32(1, "non-file: fd", \ 214 ar->ar_arg_fd); \ 215 kau_write(rec, tok); \ 216 } \ 217 } \ 218 } while (0) 219 220 #define PROCESS_PID_TOKENS(argn) do { \ 221 if ((ar->ar_arg_pid > 0) /* Reference a single process */ \ 222 && (ARG_IS_VALID(kar, ARG_PROCESS))) { \ 223 tok = au_to_process32_ex(ar->ar_arg_auid, \ 224 ar->ar_arg_euid, ar->ar_arg_egid, \ 225 ar->ar_arg_ruid, ar->ar_arg_rgid, \ 226 ar->ar_arg_pid, ar->ar_arg_asid, \ 227 &ar->ar_arg_termid_addr); \ 228 kau_write(rec, tok); \ 229 } else if (ARG_IS_VALID(kar, ARG_PID)) { \ 230 tok = au_to_arg32(argn, "process", ar->ar_arg_pid); \ 231 kau_write(rec, tok); \ 232 } \ 233 } while (0) 234 235 #define EXTATTR_TOKENS do { \ 236 if (ARG_IS_VALID(kar, ARG_VALUE)) { \ 237 switch (ar->ar_arg_value) { \ 238 case EXTATTR_NAMESPACE_USER: \ 239 tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\ 240 break; \ 241 case EXTATTR_NAMESPACE_SYSTEM: \ 242 tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\ 243 break; \ 244 default: \ 245 tok = au_to_arg32(3, "attrnamespace", \ 246 ar->ar_arg_value); \ 247 break; \ 248 } \ 249 kau_write(rec, tok); \ 250 } \ 251 /* attrname is in the text field */ \ 252 if (ARG_IS_VALID(kar, ARG_TEXT)) { \ 253 tok = au_to_text(ar->ar_arg_text); \ 254 kau_write(rec, tok); \ 255 } \ 256 } while (0) 257 258 /* 259 * Implement auditing for the auditon() system call. The audit tokens that 260 * are generated depend on the command that was sent into the auditon() 261 * system call. 262 */ 263 static void 264 audit_sys_auditon(struct audit_record *ar, struct au_record *rec) 265 { 266 struct au_token *tok; 267 268 switch (ar->ar_arg_cmd) { 269 case A_SETPOLICY: 270 if (sizeof(ar->ar_arg_auditon.au_flags) > 4) 271 tok = au_to_arg64(1, "policy", 272 ar->ar_arg_auditon.au_flags); 273 else 274 tok = au_to_arg32(1, "policy", 275 ar->ar_arg_auditon.au_flags); 276 kau_write(rec, tok); 277 break; 278 279 case A_SETKMASK: 280 tok = au_to_arg32(2, "setkmask:as_success", 281 ar->ar_arg_auditon.au_mask.am_success); 282 kau_write(rec, tok); 283 tok = au_to_arg32(2, "setkmask:as_failure", 284 ar->ar_arg_auditon.au_mask.am_failure); 285 kau_write(rec, tok); 286 break; 287 288 case A_SETQCTRL: 289 tok = au_to_arg32(3, "setqctrl:aq_hiwater", 290 ar->ar_arg_auditon.au_qctrl.aq_hiwater); 291 kau_write(rec, tok); 292 tok = au_to_arg32(3, "setqctrl:aq_lowater", 293 ar->ar_arg_auditon.au_qctrl.aq_lowater); 294 kau_write(rec, tok); 295 tok = au_to_arg32(3, "setqctrl:aq_bufsz", 296 ar->ar_arg_auditon.au_qctrl.aq_bufsz); 297 kau_write(rec, tok); 298 tok = au_to_arg32(3, "setqctrl:aq_delay", 299 ar->ar_arg_auditon.au_qctrl.aq_delay); 300 kau_write(rec, tok); 301 tok = au_to_arg32(3, "setqctrl:aq_minfree", 302 ar->ar_arg_auditon.au_qctrl.aq_minfree); 303 kau_write(rec, tok); 304 break; 305 306 case A_SETUMASK: 307 tok = au_to_arg32(3, "setumask:as_success", 308 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 309 kau_write(rec, tok); 310 tok = au_to_arg32(3, "setumask:as_failure", 311 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 312 kau_write(rec, tok); 313 break; 314 315 case A_SETSMASK: 316 tok = au_to_arg32(3, "setsmask:as_success", 317 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 318 kau_write(rec, tok); 319 tok = au_to_arg32(3, "setsmask:as_failure", 320 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 321 kau_write(rec, tok); 322 break; 323 324 case A_SETCOND: 325 if (sizeof(ar->ar_arg_auditon.au_cond) > 4) 326 tok = au_to_arg64(3, "setcond", 327 ar->ar_arg_auditon.au_cond); 328 else 329 tok = au_to_arg32(3, "setcond", 330 ar->ar_arg_auditon.au_cond); 331 kau_write(rec, tok); 332 break; 333 334 case A_SETCLASS: 335 tok = au_to_arg32(2, "setclass:ec_event", 336 ar->ar_arg_auditon.au_evclass.ec_number); 337 kau_write(rec, tok); 338 tok = au_to_arg32(3, "setclass:ec_class", 339 ar->ar_arg_auditon.au_evclass.ec_class); 340 kau_write(rec, tok); 341 break; 342 343 case A_SETPMASK: 344 tok = au_to_arg32(2, "setpmask:as_success", 345 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success); 346 kau_write(rec, tok); 347 tok = au_to_arg32(2, "setpmask:as_failure", 348 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure); 349 kau_write(rec, tok); 350 break; 351 352 case A_SETFSIZE: 353 tok = au_to_arg32(2, "setfsize:filesize", 354 ar->ar_arg_auditon.au_fstat.af_filesz); 355 kau_write(rec, tok); 356 break; 357 358 default: 359 break; 360 } 361 } 362 363 /* 364 * Convert an internal kernel audit record to a BSM record and return a 365 * success/failure indicator. The BSM record is passed as an out parameter to 366 * this function. 367 * 368 * Return conditions: 369 * BSM_SUCCESS: The BSM record is valid 370 * BSM_FAILURE: Failure; the BSM record is NULL. 371 * BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL. 372 */ 373 int 374 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau) 375 { 376 struct au_token *tok, *subj_tok; 377 struct au_record *rec; 378 au_tid_t tid; 379 struct audit_record *ar; 380 int ctr; 381 382 KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL")); 383 384 *pau = NULL; 385 ar = &kar->k_ar; 386 rec = kau_open(); 387 388 /* 389 * Create the subject token. 390 */ 391 switch (ar->ar_subj_term_addr.at_type) { 392 case AU_IPv4: 393 tid.port = ar->ar_subj_term_addr.at_port; 394 tid.machine = ar->ar_subj_term_addr.at_addr[0]; 395 subj_tok = au_to_subject32(ar->ar_subj_auid, /* audit ID */ 396 ar->ar_subj_cred.cr_uid, /* eff uid */ 397 ar->ar_subj_egid, /* eff group id */ 398 ar->ar_subj_ruid, /* real uid */ 399 ar->ar_subj_rgid, /* real group id */ 400 ar->ar_subj_pid, /* process id */ 401 ar->ar_subj_asid, /* session ID */ 402 &tid); 403 break; 404 case AU_IPv6: 405 subj_tok = au_to_subject32_ex(ar->ar_subj_auid, 406 ar->ar_subj_cred.cr_uid, 407 ar->ar_subj_egid, 408 ar->ar_subj_ruid, 409 ar->ar_subj_rgid, 410 ar->ar_subj_pid, 411 ar->ar_subj_asid, 412 &ar->ar_subj_term_addr); 413 break; 414 default: 415 bzero(&tid, sizeof(tid)); 416 subj_tok = au_to_subject32(ar->ar_subj_auid, 417 ar->ar_subj_cred.cr_uid, 418 ar->ar_subj_egid, 419 ar->ar_subj_ruid, 420 ar->ar_subj_rgid, 421 ar->ar_subj_pid, 422 ar->ar_subj_asid, 423 &tid); 424 } 425 426 /* 427 * The logic inside each case fills in the tokens required for the 428 * event, except for the header, trailer, and return tokens. The 429 * header and trailer tokens are added by the kau_close() function. 430 * The return token is added outside of the switch statement. 431 */ 432 switch(ar->ar_event) { 433 case AUE_ACCEPT: 434 case AUE_BIND: 435 case AUE_LISTEN: 436 case AUE_CONNECT: 437 case AUE_RECV: 438 case AUE_RECVFROM: 439 case AUE_RECVMSG: 440 case AUE_SEND: 441 case AUE_SENDFILE: 442 case AUE_SENDMSG: 443 case AUE_SENDTO: 444 /* 445 * Socket-related events. 446 */ 447 if (ARG_IS_VALID(kar, ARG_FD)) { 448 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 449 kau_write(rec, tok); 450 } 451 if (ARG_IS_VALID(kar, ARG_SADDRINET)) { 452 tok = au_to_sock_inet((struct sockaddr_in *) 453 &ar->ar_arg_sockaddr); 454 kau_write(rec, tok); 455 } 456 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) { 457 tok = au_to_sock_unix((struct sockaddr_un *) 458 &ar->ar_arg_sockaddr); 459 kau_write(rec, tok); 460 UPATH1_TOKENS; 461 } 462 /* XXX Need to handle ARG_SADDRINET6 */ 463 break; 464 465 case AUE_SOCKET: 466 case AUE_SOCKETPAIR: 467 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 468 tok = au_to_arg32(1,"domain", 469 ar->ar_arg_sockinfo.so_domain); 470 kau_write(rec, tok); 471 tok = au_to_arg32(2,"type", 472 ar->ar_arg_sockinfo.so_type); 473 kau_write(rec, tok); 474 tok = au_to_arg32(3,"protocol", 475 ar->ar_arg_sockinfo.so_protocol); 476 kau_write(rec, tok); 477 } 478 break; 479 480 case AUE_SETSOCKOPT: 481 case AUE_SHUTDOWN: 482 if (ARG_IS_VALID(kar, ARG_FD)) { 483 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 484 kau_write(rec, tok); 485 } 486 break; 487 488 case AUE_ACCT: 489 if (ARG_IS_VALID(kar, ARG_UPATH1)) { 490 UPATH1_VNODE1_TOKENS; 491 } else { 492 tok = au_to_arg32(1, "accounting off", 0); 493 kau_write(rec, tok); 494 } 495 break; 496 497 case AUE_SETAUID: 498 if (ARG_IS_VALID(kar, ARG_AUID)) { 499 tok = au_to_arg32(2, "setauid", ar->ar_arg_auid); 500 kau_write(rec, tok); 501 } 502 break; 503 504 case AUE_SETAUDIT: 505 if (ARG_IS_VALID(kar, ARG_AUID) && 506 ARG_IS_VALID(kar, ARG_ASID) && 507 ARG_IS_VALID(kar, ARG_AMASK) && 508 ARG_IS_VALID(kar, ARG_TERMID)) { 509 tok = au_to_arg32(1, "setaudit:auid", 510 ar->ar_arg_auid); 511 kau_write(rec, tok); 512 tok = au_to_arg32(1, "setaudit:port", 513 ar->ar_arg_termid.port); 514 kau_write(rec, tok); 515 tok = au_to_arg32(1, "setaudit:machine", 516 ar->ar_arg_termid.machine); 517 kau_write(rec, tok); 518 tok = au_to_arg32(1, "setaudit:as_success", 519 ar->ar_arg_amask.am_success); 520 kau_write(rec, tok); 521 tok = au_to_arg32(1, "setaudit:as_failure", 522 ar->ar_arg_amask.am_failure); 523 kau_write(rec, tok); 524 tok = au_to_arg32(1, "setaudit:asid", 525 ar->ar_arg_asid); 526 kau_write(rec, tok); 527 } 528 break; 529 530 case AUE_SETAUDIT_ADDR: 531 if (ARG_IS_VALID(kar, ARG_AUID) && 532 ARG_IS_VALID(kar, ARG_ASID) && 533 ARG_IS_VALID(kar, ARG_AMASK) && 534 ARG_IS_VALID(kar, ARG_TERMID_ADDR)) { 535 tok = au_to_arg32(1, "setaudit_addr:auid", 536 ar->ar_arg_auid); 537 kau_write(rec, tok); 538 tok = au_to_arg32(1, "setaudit_addr:as_success", 539 ar->ar_arg_amask.am_success); 540 kau_write(rec, tok); 541 tok = au_to_arg32(1, "setaudit_addr:as_failure", 542 ar->ar_arg_amask.am_failure); 543 kau_write(rec, tok); 544 tok = au_to_arg32(1, "setaudit_addr:asid", 545 ar->ar_arg_asid); 546 kau_write(rec, tok); 547 tok = au_to_arg32(1, "setaudit_addr:type", 548 ar->ar_arg_termid_addr.at_type); 549 kau_write(rec, tok); 550 tok = au_to_arg32(1, "setaudit_addr:port", 551 ar->ar_arg_termid_addr.at_port); 552 kau_write(rec, tok); 553 if (ar->ar_arg_termid_addr.at_type == AU_IPv6) 554 tok = au_to_in_addr_ex((struct in6_addr *) 555 &ar->ar_arg_termid_addr.at_addr[0]); 556 if (ar->ar_arg_termid_addr.at_type == AU_IPv4) 557 tok = au_to_in_addr((struct in_addr *) 558 &ar->ar_arg_termid_addr.at_addr[0]); 559 kau_write(rec, tok); 560 } 561 break; 562 563 case AUE_AUDITON: 564 /* 565 * For AUDITON commands without own event, audit the cmd. 566 */ 567 if (ARG_IS_VALID(kar, ARG_CMD)) { 568 tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd); 569 kau_write(rec, tok); 570 } 571 /* FALLTHROUGH */ 572 573 case AUE_AUDITON_GETCAR: 574 case AUE_AUDITON_GETCLASS: 575 case AUE_AUDITON_GETCOND: 576 case AUE_AUDITON_GETCWD: 577 case AUE_AUDITON_GETKMASK: 578 case AUE_AUDITON_GETSTAT: 579 case AUE_AUDITON_GPOLICY: 580 case AUE_AUDITON_GQCTRL: 581 case AUE_AUDITON_SETCLASS: 582 case AUE_AUDITON_SETCOND: 583 case AUE_AUDITON_SETKMASK: 584 case AUE_AUDITON_SETSMASK: 585 case AUE_AUDITON_SETSTAT: 586 case AUE_AUDITON_SETUMASK: 587 case AUE_AUDITON_SPOLICY: 588 case AUE_AUDITON_SQCTRL: 589 if (ARG_IS_VALID(kar, ARG_AUDITON)) 590 audit_sys_auditon(ar, rec); 591 break; 592 593 case AUE_AUDITCTL: 594 UPATH1_VNODE1_TOKENS; 595 break; 596 597 case AUE_EXIT: 598 if (ARG_IS_VALID(kar, ARG_EXIT)) { 599 tok = au_to_exit(ar->ar_arg_exitretval, 600 ar->ar_arg_exitstatus); 601 kau_write(rec, tok); 602 } 603 break; 604 605 case AUE_ADJTIME: 606 case AUE_CLOCK_SETTIME: 607 case AUE_AUDIT: 608 case AUE_DUP2: 609 case AUE_GETAUDIT: 610 case AUE_GETAUDIT_ADDR: 611 case AUE_GETAUID: 612 case AUE_GETCWD: 613 case AUE_GETFSSTAT: 614 case AUE_GETRESUID: 615 case AUE_GETRESGID: 616 case AUE_KQUEUE: 617 case AUE_LSEEK: 618 case AUE_MODLOAD: 619 case AUE_MODUNLOAD: 620 case AUE_MSGSYS: 621 case AUE_NFS_SVC: 622 case AUE_NTP_ADJTIME: 623 case AUE_PIPE: 624 case AUE_PROFILE: 625 case AUE_RTPRIO: 626 case AUE_SEMSYS: 627 case AUE_SHMSYS: 628 case AUE_SETPGRP: 629 case AUE_SETRLIMIT: 630 case AUE_SETSID: 631 case AUE_SETTIMEOFDAY: 632 case AUE_SYSARCH: 633 634 /* 635 * Header, subject, and return tokens added at end. 636 */ 637 break; 638 639 case AUE_MKFIFO: 640 if (ARG_IS_VALID(kar, ARG_MODE)) { 641 tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 642 kau_write(rec, tok); 643 } 644 /* FALLTHROUGH */ 645 646 case AUE_ACCESS: 647 case AUE_CHDIR: 648 case AUE_CHROOT: 649 case AUE_EACCESS: 650 case AUE_GETATTRLIST: 651 case AUE_JAIL: 652 case AUE_LUTIMES: 653 case AUE_NFS_GETFH: 654 case AUE_LSTAT: 655 case AUE_PATHCONF: 656 case AUE_READLINK: 657 case AUE_REVOKE: 658 case AUE_RMDIR: 659 case AUE_SEARCHFS: 660 case AUE_SETATTRLIST: 661 case AUE_STAT: 662 case AUE_STATFS: 663 case AUE_SWAPON: 664 case AUE_SWAPOFF: 665 case AUE_TRUNCATE: 666 case AUE_UNDELETE: 667 case AUE_UNLINK: 668 case AUE_UTIMES: 669 UPATH1_VNODE1_TOKENS; 670 break; 671 672 case AUE_FHSTATFS: 673 case AUE_FHOPEN: 674 case AUE_FHSTAT: 675 /* XXXRW: Need to audit vnode argument. */ 676 break; 677 678 case AUE_CHFLAGS: 679 case AUE_LCHFLAGS: 680 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 681 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 682 kau_write(rec, tok); 683 } 684 UPATH1_VNODE1_TOKENS; 685 break; 686 687 case AUE_CHMOD: 688 case AUE_LCHMOD: 689 if (ARG_IS_VALID(kar, ARG_MODE)) { 690 tok = au_to_arg32(2, "new file mode", 691 ar->ar_arg_mode); 692 kau_write(rec, tok); 693 } 694 UPATH1_VNODE1_TOKENS; 695 break; 696 697 case AUE_CHOWN: 698 case AUE_LCHOWN: 699 if (ARG_IS_VALID(kar, ARG_UID)) { 700 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 701 kau_write(rec, tok); 702 } 703 if (ARG_IS_VALID(kar, ARG_GID)) { 704 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 705 kau_write(rec, tok); 706 } 707 UPATH1_VNODE1_TOKENS; 708 break; 709 710 case AUE_EXCHANGEDATA: 711 UPATH1_VNODE1_TOKENS; 712 UPATH2_TOKENS; 713 break; 714 715 case AUE_CLOSE: 716 if (ARG_IS_VALID(kar, ARG_FD)) { 717 tok = au_to_arg32(2, "fd", ar->ar_arg_fd); 718 kau_write(rec, tok); 719 } 720 UPATH1_VNODE1_TOKENS; 721 break; 722 723 case AUE_CORE: 724 if (ARG_IS_VALID(kar, ARG_SIGNUM)) { 725 tok = au_to_arg32(0, "signal", ar->ar_arg_signum); 726 kau_write(rec, tok); 727 } 728 UPATH1_VNODE1_TOKENS; 729 break; 730 731 case AUE_EXTATTRCTL: 732 UPATH1_VNODE1_TOKENS; 733 if (ARG_IS_VALID(kar, ARG_CMD)) { 734 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 735 kau_write(rec, tok); 736 } 737 /* extattrctl(2) filename parameter is in upath2/vnode2 */ 738 UPATH2_TOKENS; 739 VNODE2_TOKENS; 740 EXTATTR_TOKENS; 741 break; 742 743 case AUE_EXTATTR_GET_FILE: 744 case AUE_EXTATTR_SET_FILE: 745 case AUE_EXTATTR_LIST_FILE: 746 case AUE_EXTATTR_DELETE_FILE: 747 case AUE_EXTATTR_GET_LINK: 748 case AUE_EXTATTR_SET_LINK: 749 case AUE_EXTATTR_LIST_LINK: 750 case AUE_EXTATTR_DELETE_LINK: 751 UPATH1_VNODE1_TOKENS; 752 EXTATTR_TOKENS; 753 break; 754 755 case AUE_EXTATTR_GET_FD: 756 case AUE_EXTATTR_SET_FD: 757 case AUE_EXTATTR_LIST_FD: 758 case AUE_EXTATTR_DELETE_FD: 759 if (ARG_IS_VALID(kar, ARG_FD)) { 760 tok = au_to_arg32(2, "fd", ar->ar_arg_fd); 761 kau_write(rec, tok); 762 } 763 EXTATTR_TOKENS; 764 break; 765 766 case AUE_EXECVE: 767 case AUE_MAC_EXECVE: 768 if (ARG_IS_VALID(kar, ARG_ARGV)) { 769 tok = au_to_exec_args(ar->ar_arg_argv, 770 ar->ar_arg_argc); 771 kau_write(rec, tok); 772 } 773 if (ARG_IS_VALID(kar, ARG_ENVV)) { 774 tok = au_to_exec_env(ar->ar_arg_envv, 775 ar->ar_arg_envc); 776 kau_write(rec, tok); 777 } 778 UPATH1_VNODE1_TOKENS; 779 break; 780 781 case AUE_FCHMOD: 782 if (ARG_IS_VALID(kar, ARG_MODE)) { 783 tok = au_to_arg32(2, "new file mode", 784 ar->ar_arg_mode); 785 kau_write(rec, tok); 786 } 787 FD_VNODE1_TOKENS; 788 break; 789 790 /* 791 * XXXRW: Some of these need to handle non-vnode cases as well. 792 */ 793 case AUE_FCHDIR: 794 case AUE_FPATHCONF: 795 case AUE_FSTAT: 796 case AUE_FSTATFS: 797 case AUE_FSYNC: 798 case AUE_FTRUNCATE: 799 case AUE_FUTIMES: 800 case AUE_GETDIRENTRIES: 801 case AUE_GETDIRENTRIESATTR: 802 case AUE_POLL: 803 case AUE_READ: 804 case AUE_READV: 805 case AUE_WRITE: 806 case AUE_WRITEV: 807 FD_VNODE1_TOKENS; 808 break; 809 810 case AUE_FCHOWN: 811 if (ARG_IS_VALID(kar, ARG_UID)) { 812 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 813 kau_write(rec, tok); 814 } 815 if (ARG_IS_VALID(kar, ARG_GID)) { 816 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 817 kau_write(rec, tok); 818 } 819 FD_VNODE1_TOKENS; 820 break; 821 822 case AUE_FCNTL: 823 if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK || 824 ar->ar_arg_cmd == F_SETLKW) { 825 if (ARG_IS_VALID(kar, ARG_CMD)) { 826 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 827 kau_write(rec, tok); 828 } 829 FD_VNODE1_TOKENS; 830 } 831 break; 832 833 case AUE_FCHFLAGS: 834 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 835 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 836 kau_write(rec, tok); 837 } 838 FD_VNODE1_TOKENS; 839 break; 840 841 case AUE_FLOCK: 842 if (ARG_IS_VALID(kar, ARG_CMD)) { 843 tok = au_to_arg32(2, "operation", ar->ar_arg_cmd); 844 kau_write(rec, tok); 845 } 846 FD_VNODE1_TOKENS; 847 break; 848 849 case AUE_RFORK: 850 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 851 tok = au_to_arg32(1, "flags", ar->ar_arg_fflags); 852 kau_write(rec, tok); 853 } 854 /* FALLTHROUGH */ 855 856 case AUE_FORK: 857 case AUE_VFORK: 858 if (ARG_IS_VALID(kar, ARG_PID)) { 859 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid); 860 kau_write(rec, tok); 861 } 862 break; 863 864 case AUE_IOCTL: 865 if (ARG_IS_VALID(kar, ARG_CMD)) { 866 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 867 kau_write(rec, tok); 868 } 869 if (ARG_IS_VALID(kar, ARG_ADDR)) { 870 tok = au_to_arg32(1, "arg", 871 (u_int32_t)(uintptr_t)ar->ar_arg_addr); 872 kau_write(rec, tok); 873 } 874 if (ARG_IS_VALID(kar, ARG_VNODE1)) 875 FD_VNODE1_TOKENS; 876 else { 877 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 878 tok = kau_to_socket(&ar->ar_arg_sockinfo); 879 kau_write(rec, tok); 880 } else { 881 if (ARG_IS_VALID(kar, ARG_FD)) { 882 tok = au_to_arg32(1, "fd", 883 ar->ar_arg_fd); 884 kau_write(rec, tok); 885 } 886 } 887 } 888 break; 889 890 case AUE_KILL: 891 case AUE_KILLPG: 892 if (ARG_IS_VALID(kar, ARG_SIGNUM)) { 893 tok = au_to_arg32(2, "signal", ar->ar_arg_signum); 894 kau_write(rec, tok); 895 } 896 PROCESS_PID_TOKENS(1); 897 break; 898 899 case AUE_KTRACE: 900 if (ARG_IS_VALID(kar, ARG_CMD)) { 901 tok = au_to_arg32(2, "ops", ar->ar_arg_cmd); 902 kau_write(rec, tok); 903 } 904 if (ARG_IS_VALID(kar, ARG_VALUE)) { 905 tok = au_to_arg32(3, "trpoints", ar->ar_arg_value); 906 kau_write(rec, tok); 907 } 908 PROCESS_PID_TOKENS(4); 909 UPATH1_VNODE1_TOKENS; 910 break; 911 912 case AUE_LINK: 913 case AUE_RENAME: 914 UPATH1_VNODE1_TOKENS; 915 UPATH2_TOKENS; 916 break; 917 918 case AUE_LOADSHFILE: 919 if (ARG_IS_VALID(kar, ARG_ADDR)) { 920 tok = au_to_arg32(4, "base addr", 921 (u_int32_t)(uintptr_t)ar->ar_arg_addr); 922 kau_write(rec, tok); 923 } 924 UPATH1_VNODE1_TOKENS; 925 break; 926 927 case AUE_MKDIR: 928 if (ARG_IS_VALID(kar, ARG_MODE)) { 929 tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 930 kau_write(rec, tok); 931 } 932 UPATH1_VNODE1_TOKENS; 933 break; 934 935 case AUE_MKNOD: 936 if (ARG_IS_VALID(kar, ARG_MODE)) { 937 tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 938 kau_write(rec, tok); 939 } 940 if (ARG_IS_VALID(kar, ARG_DEV)) { 941 tok = au_to_arg32(3, "dev", ar->ar_arg_dev); 942 kau_write(rec, tok); 943 } 944 UPATH1_VNODE1_TOKENS; 945 break; 946 947 case AUE_MMAP: 948 case AUE_MUNMAP: 949 case AUE_MPROTECT: 950 case AUE_MLOCK: 951 case AUE_MUNLOCK: 952 case AUE_MINHERIT: 953 if (ARG_IS_VALID(kar, ARG_ADDR)) { 954 tok = au_to_arg32(1, "addr", 955 (u_int32_t)(uintptr_t)ar->ar_arg_addr); 956 kau_write(rec, tok); 957 } 958 if (ARG_IS_VALID(kar, ARG_LEN)) { 959 tok = au_to_arg32(2, "len", ar->ar_arg_len); 960 kau_write(rec, tok); 961 } 962 if (ar->ar_event == AUE_MMAP) 963 FD_VNODE1_TOKENS; 964 if (ar->ar_event == AUE_MPROTECT) { 965 if (ARG_IS_VALID(kar, ARG_VALUE)) { 966 tok = au_to_arg32(3, "protection", 967 ar->ar_arg_value); 968 kau_write(rec, tok); 969 } 970 } 971 if (ar->ar_event == AUE_MINHERIT) { 972 if (ARG_IS_VALID(kar, ARG_VALUE)) { 973 tok = au_to_arg32(3, "inherit", 974 ar->ar_arg_value); 975 kau_write(rec, tok); 976 } 977 } 978 break; 979 980 case AUE_MOUNT: 981 case AUE_NMOUNT: 982 /* XXX Need to handle NFS mounts */ 983 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 984 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags); 985 kau_write(rec, tok); 986 } 987 if (ARG_IS_VALID(kar, ARG_TEXT)) { 988 tok = au_to_text(ar->ar_arg_text); 989 kau_write(rec, tok); 990 } 991 /* FALLTHROUGH */ 992 993 case AUE_UMOUNT: 994 UPATH1_VNODE1_TOKENS; 995 break; 996 997 case AUE_MSGCTL: 998 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd); 999 /* Fall through */ 1000 1001 case AUE_MSGRCV: 1002 case AUE_MSGSND: 1003 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id); 1004 kau_write(rec, tok); 1005 if (ar->ar_errno != EINVAL) { 1006 tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id); 1007 kau_write(rec, tok); 1008 } 1009 break; 1010 1011 case AUE_MSGGET: 1012 if (ar->ar_errno == 0) { 1013 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1014 tok = au_to_ipc(AT_IPC_MSG, 1015 ar->ar_arg_svipc_id); 1016 kau_write(rec, tok); 1017 } 1018 } 1019 break; 1020 1021 case AUE_RESETSHFILE: 1022 if (ARG_IS_VALID(kar, ARG_ADDR)) { 1023 tok = au_to_arg32(1, "base addr", 1024 (u_int32_t)(uintptr_t)ar->ar_arg_addr); 1025 kau_write(rec, tok); 1026 } 1027 break; 1028 1029 case AUE_OPEN_RC: 1030 case AUE_OPEN_RTC: 1031 case AUE_OPEN_RWC: 1032 case AUE_OPEN_RWTC: 1033 case AUE_OPEN_WC: 1034 case AUE_OPEN_WTC: 1035 case AUE_CREAT: 1036 if (ARG_IS_VALID(kar, ARG_MODE)) { 1037 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1038 kau_write(rec, tok); 1039 } 1040 /* FALLTHROUGH */ 1041 1042 case AUE_OPEN_R: 1043 case AUE_OPEN_RT: 1044 case AUE_OPEN_RW: 1045 case AUE_OPEN_RWT: 1046 case AUE_OPEN_W: 1047 case AUE_OPEN_WT: 1048 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1049 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1050 kau_write(rec, tok); 1051 } 1052 UPATH1_VNODE1_TOKENS; 1053 break; 1054 1055 case AUE_PTRACE: 1056 if (ARG_IS_VALID(kar, ARG_CMD)) { 1057 tok = au_to_arg32(1, "request", ar->ar_arg_cmd); 1058 kau_write(rec, tok); 1059 } 1060 if (ARG_IS_VALID(kar, ARG_ADDR)) { 1061 tok = au_to_arg32(3, "addr", 1062 (u_int32_t)(uintptr_t)ar->ar_arg_addr); 1063 kau_write(rec, tok); 1064 } 1065 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1066 tok = au_to_arg32(4, "data", ar->ar_arg_value); 1067 kau_write(rec, tok); 1068 } 1069 PROCESS_PID_TOKENS(2); 1070 break; 1071 1072 case AUE_QUOTACTL: 1073 if (ARG_IS_VALID(kar, ARG_CMD)) { 1074 tok = au_to_arg32(2, "command", ar->ar_arg_cmd); 1075 kau_write(rec, tok); 1076 } 1077 if (ARG_IS_VALID(kar, ARG_UID)) { 1078 tok = au_to_arg32(3, "uid", ar->ar_arg_uid); 1079 kau_write(rec, tok); 1080 } 1081 UPATH1_VNODE1_TOKENS; 1082 break; 1083 1084 case AUE_REBOOT: 1085 if (ARG_IS_VALID(kar, ARG_CMD)) { 1086 tok = au_to_arg32(1, "howto", ar->ar_arg_cmd); 1087 kau_write(rec, tok); 1088 } 1089 break; 1090 1091 case AUE_SEMCTL: 1092 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd); 1093 /* Fall through */ 1094 1095 case AUE_SEMOP: 1096 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1097 tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id); 1098 kau_write(rec, tok); 1099 if (ar->ar_errno != EINVAL) { 1100 tok = au_to_ipc(AT_IPC_SEM, 1101 ar->ar_arg_svipc_id); 1102 kau_write(rec, tok); 1103 } 1104 } 1105 break; 1106 1107 case AUE_SEMGET: 1108 if (ar->ar_errno == 0) { 1109 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1110 tok = au_to_ipc(AT_IPC_SEM, 1111 ar->ar_arg_svipc_id); 1112 kau_write(rec, tok); 1113 } 1114 } 1115 break; 1116 1117 case AUE_SETEGID: 1118 if (ARG_IS_VALID(kar, ARG_EGID)) { 1119 tok = au_to_arg32(1, "gid", ar->ar_arg_egid); 1120 kau_write(rec, tok); 1121 } 1122 break; 1123 1124 case AUE_SETEUID: 1125 if (ARG_IS_VALID(kar, ARG_EUID)) { 1126 tok = au_to_arg32(1, "uid", ar->ar_arg_euid); 1127 kau_write(rec, tok); 1128 } 1129 break; 1130 1131 case AUE_SETREGID: 1132 if (ARG_IS_VALID(kar, ARG_RGID)) { 1133 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1134 kau_write(rec, tok); 1135 } 1136 if (ARG_IS_VALID(kar, ARG_EGID)) { 1137 tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1138 kau_write(rec, tok); 1139 } 1140 break; 1141 1142 case AUE_SETREUID: 1143 if (ARG_IS_VALID(kar, ARG_RUID)) { 1144 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1145 kau_write(rec, tok); 1146 } 1147 if (ARG_IS_VALID(kar, ARG_EUID)) { 1148 tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1149 kau_write(rec, tok); 1150 } 1151 break; 1152 1153 case AUE_SETRESGID: 1154 if (ARG_IS_VALID(kar, ARG_RGID)) { 1155 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1156 kau_write(rec, tok); 1157 } 1158 if (ARG_IS_VALID(kar, ARG_EGID)) { 1159 tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1160 kau_write(rec, tok); 1161 } 1162 if (ARG_IS_VALID(kar, ARG_SGID)) { 1163 tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid); 1164 kau_write(rec, tok); 1165 } 1166 break; 1167 1168 case AUE_SETRESUID: 1169 if (ARG_IS_VALID(kar, ARG_RUID)) { 1170 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1171 kau_write(rec, tok); 1172 } 1173 if (ARG_IS_VALID(kar, ARG_EUID)) { 1174 tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1175 kau_write(rec, tok); 1176 } 1177 if (ARG_IS_VALID(kar, ARG_SUID)) { 1178 tok = au_to_arg32(3, "suid", ar->ar_arg_suid); 1179 kau_write(rec, tok); 1180 } 1181 break; 1182 1183 case AUE_SETGID: 1184 if (ARG_IS_VALID(kar, ARG_GID)) { 1185 tok = au_to_arg32(1, "gid", ar->ar_arg_gid); 1186 kau_write(rec, tok); 1187 } 1188 break; 1189 1190 case AUE_SETUID: 1191 if (ARG_IS_VALID(kar, ARG_UID)) { 1192 tok = au_to_arg32(1, "uid", ar->ar_arg_uid); 1193 kau_write(rec, tok); 1194 } 1195 break; 1196 1197 case AUE_SETGROUPS: 1198 if (ARG_IS_VALID(kar, ARG_GROUPSET)) { 1199 for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++) 1200 { 1201 tok = au_to_arg32(1, "setgroups", 1202 ar->ar_arg_groups.gidset[ctr]); 1203 kau_write(rec, tok); 1204 } 1205 } 1206 break; 1207 1208 case AUE_SETLOGIN: 1209 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1210 tok = au_to_text(ar->ar_arg_text); 1211 kau_write(rec, tok); 1212 } 1213 break; 1214 1215 case AUE_SETPRIORITY: 1216 if (ARG_IS_VALID(kar, ARG_CMD)) { 1217 tok = au_to_arg32(1, "which", ar->ar_arg_cmd); 1218 kau_write(rec, tok); 1219 } 1220 if (ARG_IS_VALID(kar, ARG_UID)) { 1221 tok = au_to_arg32(2, "who", ar->ar_arg_uid); 1222 kau_write(rec, tok); 1223 } 1224 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1225 tok = au_to_arg32(2, "priority", ar->ar_arg_value); 1226 kau_write(rec, tok); 1227 } 1228 break; 1229 1230 case AUE_SETPRIVEXEC: 1231 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1232 tok = au_to_arg32(1, "flag", ar->ar_arg_value); 1233 kau_write(rec, tok); 1234 } 1235 break; 1236 1237 /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */ 1238 case AUE_SHMAT: 1239 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1240 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1241 kau_write(rec, tok); 1242 /* XXXAUDIT: Does having the ipc token make sense? */ 1243 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1244 kau_write(rec, tok); 1245 } 1246 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1247 tok = au_to_arg32(2, "shmaddr", 1248 (int)(uintptr_t)ar->ar_arg_svipc_addr); 1249 kau_write(rec, tok); 1250 } 1251 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1252 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1253 kau_write(rec, tok); 1254 } 1255 break; 1256 1257 case AUE_SHMCTL: 1258 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1259 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1260 kau_write(rec, tok); 1261 /* XXXAUDIT: Does having the ipc token make sense? */ 1262 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1263 kau_write(rec, tok); 1264 } 1265 switch (ar->ar_arg_svipc_cmd) { 1266 case IPC_STAT: 1267 ar->ar_event = AUE_SHMCTL_STAT; 1268 break; 1269 case IPC_RMID: 1270 ar->ar_event = AUE_SHMCTL_RMID; 1271 break; 1272 case IPC_SET: 1273 ar->ar_event = AUE_SHMCTL_SET; 1274 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1275 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1276 kau_write(rec, tok); 1277 } 1278 break; 1279 default: 1280 break; /* We will audit a bad command */ 1281 } 1282 break; 1283 1284 case AUE_SHMDT: 1285 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1286 tok = au_to_arg32(1, "shmaddr", 1287 (int)(uintptr_t)ar->ar_arg_svipc_addr); 1288 kau_write(rec, tok); 1289 } 1290 break; 1291 1292 case AUE_SHMGET: 1293 /* This is unusual; the return value is in an argument token */ 1294 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1295 tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id); 1296 kau_write(rec, tok); 1297 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1298 kau_write(rec, tok); 1299 } 1300 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1301 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1302 kau_write(rec, tok); 1303 } 1304 break; 1305 1306 /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE 1307 * and AUE_SEMUNLINK are Posix IPC */ 1308 case AUE_SHMOPEN: 1309 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1310 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1311 kau_write(rec, tok); 1312 } 1313 if (ARG_IS_VALID(kar, ARG_MODE)) { 1314 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1315 kau_write(rec, tok); 1316 } 1317 /* FALLTHROUGH */ 1318 1319 case AUE_SHMUNLINK: 1320 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1321 tok = au_to_text(ar->ar_arg_text); 1322 kau_write(rec, tok); 1323 } 1324 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1325 struct ipc_perm perm; 1326 1327 perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1328 perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1329 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1330 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1331 perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1332 perm.seq = 0; 1333 perm.key = 0; 1334 tok = au_to_ipc_perm(&perm); 1335 kau_write(rec, tok); 1336 } 1337 break; 1338 1339 case AUE_SEMOPEN: 1340 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1341 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1342 kau_write(rec, tok); 1343 } 1344 if (ARG_IS_VALID(kar, ARG_MODE)) { 1345 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1346 kau_write(rec, tok); 1347 } 1348 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1349 tok = au_to_arg32(4, "value", ar->ar_arg_value); 1350 kau_write(rec, tok); 1351 } 1352 /* FALLTHROUGH */ 1353 1354 case AUE_SEMUNLINK: 1355 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1356 tok = au_to_text(ar->ar_arg_text); 1357 kau_write(rec, tok); 1358 } 1359 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1360 struct ipc_perm perm; 1361 1362 perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1363 perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1364 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1365 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1366 perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1367 perm.seq = 0; 1368 perm.key = 0; 1369 tok = au_to_ipc_perm(&perm); 1370 kau_write(rec, tok); 1371 } 1372 break; 1373 1374 case AUE_SEMCLOSE: 1375 if (ARG_IS_VALID(kar, ARG_FD)) { 1376 tok = au_to_arg32(1, "sem", ar->ar_arg_fd); 1377 kau_write(rec, tok); 1378 } 1379 break; 1380 1381 case AUE_SYMLINK: 1382 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1383 tok = au_to_text(ar->ar_arg_text); 1384 kau_write(rec, tok); 1385 } 1386 UPATH1_VNODE1_TOKENS; 1387 break; 1388 1389 case AUE_SYSCTL: 1390 case AUE_SYSCTL_NONADMIN: 1391 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) { 1392 for (ctr = 0; ctr < ar->ar_arg_len; ctr++) { 1393 tok = au_to_arg32(1, "name", 1394 ar->ar_arg_ctlname[ctr]); 1395 kau_write(rec, tok); 1396 } 1397 } 1398 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1399 tok = au_to_arg32(5, "newval", ar->ar_arg_value); 1400 kau_write(rec, tok); 1401 } 1402 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1403 tok = au_to_text(ar->ar_arg_text); 1404 kau_write(rec, tok); 1405 } 1406 break; 1407 1408 case AUE_UMASK: 1409 if (ARG_IS_VALID(kar, ARG_MASK)) { 1410 tok = au_to_arg32(1, "new mask", ar->ar_arg_mask); 1411 kau_write(rec, tok); 1412 } 1413 tok = au_to_arg32(0, "prev mask", ar->ar_retval); 1414 kau_write(rec, tok); 1415 break; 1416 1417 case AUE_WAIT4: 1418 if (ARG_IS_VALID(kar, ARG_PID)) { 1419 tok = au_to_arg32(0, "pid", ar->ar_arg_pid); 1420 kau_write(rec, tok); 1421 } 1422 break; 1423 1424 case AUE_NULL: 1425 default: 1426 printf("BSM conversion requested for unknown event %d\n", 1427 ar->ar_event); 1428 1429 /* 1430 * Write the subject token so it is properly freed here. 1431 */ 1432 kau_write(rec, subj_tok); 1433 kau_free(rec); 1434 return (BSM_NOAUDIT); 1435 } 1436 1437 kau_write(rec, subj_tok); 1438 tok = au_to_return32((char)ar->ar_errno, ar->ar_retval); 1439 kau_write(rec, tok); /* Every record gets a return token */ 1440 1441 kau_close(rec, &ar->ar_endtime, ar->ar_event); 1442 1443 *pau = rec; 1444 return (BSM_SUCCESS); 1445 } 1446 1447 /* 1448 * Verify that a record is a valid BSM record. This verification is simple 1449 * now, but may be expanded on sometime in the future. Return 1 if the 1450 * record is good, 0 otherwise. 1451 */ 1452 int 1453 bsm_rec_verify(void *rec) 1454 { 1455 char c = *(char *)rec; 1456 1457 /* 1458 * Check the token ID of the first token; it has to be a header 1459 * token. 1460 * 1461 * XXXAUDIT There needs to be a token structure to map a token. 1462 * XXXAUDIT 'Shouldn't be simply looking at the first char. 1463 */ 1464 if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) && 1465 (c != AUT_HEADER64) && (c != AUT_HEADER64_EX)) 1466 return (0); 1467 return (1); 1468 }
Cache object: ea18f10bd04ba3050d625e4cb1d0d0f6
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]