audit_private.h

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*
    2  * Copyright (c) 1999-2005 Apple Computer, Inc.
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1.  Redistributions of source code must retain the above copyright
    9  *     notice, this list of conditions and the following disclaimer.
   10  * 2.  Redistributions in binary form must reproduce the above copyright
   11  *     notice, this list of conditions and the following disclaimer in the
   12  *     documentation and/or other materials provided with the distribution.
   13  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
   14  *     its contributors may be used to endorse or promote products derived
   15  *     from this software without specific prior written permission.
   16  *
   17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
   18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   20  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
   21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
   25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
   26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
   27  * POSSIBILITY OF SUCH DAMAGE.
   28  *
   29  * $FreeBSD$
   30  */
   31 
   32 /*
   33  * This include file contains function prototypes and type definitions used
   34  * within the audit implementation.
   35  */
   36 
   37 #ifndef _SECURITY_AUDIT_PRIVATE_H_
   38 #define _SECURITY_AUDIT_PRIVATE_H_
   39 
   40 #ifndef _KERNEL
   41 #error "no user-serviceable parts inside"
   42 #endif
   43 
   44 #include <sys/ipc.h>
   45 #include <sys/socket.h>
   46 #include <sys/ucred.h>
   47 
   48 #ifdef MALLOC_DECLARE
   49 MALLOC_DECLARE(M_AUDITBSM);
   50 MALLOC_DECLARE(M_AUDITDATA);
   51 MALLOC_DECLARE(M_AUDITPATH);
   52 MALLOC_DECLARE(M_AUDITTEXT);
   53 #endif
   54 
   55 /*
   56  * Audit control variables that are usually set/read via system calls and
   57  * used to control various aspects of auditing.
   58  */
   59 extern struct au_qctrl          audit_qctrl;
   60 extern struct audit_fstat       audit_fstat;
   61 extern struct au_mask           audit_nae_mask;
   62 extern int                      audit_panic_on_write_fail;
   63 extern int                      audit_fail_stop;
   64 extern int                      audit_argv;
   65 extern int                      audit_arge;
   66 
   67 /*
   68  * Success/failure conditions for the conversion of a kernel audit record to
   69  * BSM format.
   70  */
   71 #define BSM_SUCCESS     0
   72 #define BSM_FAILURE     1
   73 #define BSM_NOAUDIT     2
   74 
   75 /*
   76  * Defines for the kernel audit record k_ar_commit field.  Flags are set to
   77  * indicate what sort of record it is, and which preselection mechanism
   78  * selected it.
   79  */
   80 #define AR_COMMIT_KERNEL        0x00000001U
   81 #define AR_COMMIT_USER          0x00000010U
   82 
   83 #define AR_PRESELECT_TRAIL      0x00001000U
   84 #define AR_PRESELECT_PIPE       0x00002000U
   85 
   86 #define AR_PRESELECT_USER_TRAIL 0x00004000U
   87 #define AR_PRESELECT_USER_PIPE  0x00008000U
   88 
   89 /*
   90  * Audit data is generated as a stream of struct audit_record structures,
   91  * linked by struct kaudit_record, and contain storage for possible audit so
   92  * that it will not need to be allocated during the processing of a system
   93  * call, both improving efficiency and avoiding sleeping at untimely moments.
   94  * This structure is converted to BSM format before being written to disk.
   95  */
   96 struct vnode_au_info {
   97         mode_t  vn_mode;
   98         uid_t   vn_uid;
   99         gid_t   vn_gid;
  100         dev_t   vn_dev;
  101         long    vn_fsid;
  102         long    vn_fileid;
  103         long    vn_gen;
  104 };
  105 
  106 struct groupset {
  107         gid_t   gidset[NGROUPS];
  108         u_int   gidset_size;
  109 };
  110 
  111 struct socket_au_info {
  112         int             so_domain;
  113         int             so_type;
  114         int             so_protocol;
  115         in_addr_t       so_raddr;       /* Remote address if INET socket. */
  116         in_addr_t       so_laddr;       /* Local address if INET socket. */
  117         u_short         so_rport;       /* Remote port. */
  118         u_short         so_lport;       /* Local port. */
  119 };
  120 
  121 union auditon_udata {
  122         char                    *au_path;
  123         long                    au_cond;
  124         long                    au_flags;
  125         long                    au_policy;
  126         int                     au_trigger;
  127         au_evclass_map_t        au_evclass;
  128         au_mask_t               au_mask;
  129         auditinfo_t             au_auinfo;
  130         auditpinfo_t            au_aupinfo;
  131         auditpinfo_addr_t       au_aupinfo_addr;
  132         au_qctrl_t              au_qctrl;
  133         au_stat_t               au_stat;
  134         au_fstat_t              au_fstat;
  135 };
  136 
  137 struct posix_ipc_perm {
  138         uid_t   pipc_uid;
  139         gid_t   pipc_gid;
  140         mode_t  pipc_mode;
  141 };
  142 
  143 struct audit_record {
  144         /* Audit record header. */
  145         u_int32_t               ar_magic;
  146         int                     ar_event;
  147         int                     ar_retval; /* value returned to the process */
  148         int                     ar_errno;  /* return status of system call */
  149         struct timespec         ar_starttime;
  150         struct timespec         ar_endtime;
  151         u_int64_t               ar_valid_arg;  /* Bitmask of valid arguments */
  152 
  153         /* Audit subject information. */
  154         struct xucred           ar_subj_cred;
  155         uid_t                   ar_subj_ruid;
  156         gid_t                   ar_subj_rgid;
  157         gid_t                   ar_subj_egid;
  158         uid_t                   ar_subj_auid; /* Audit user ID */
  159         pid_t                   ar_subj_asid; /* Audit session ID */
  160         pid_t                   ar_subj_pid;
  161         struct au_tid           ar_subj_term;
  162         struct au_tid_addr      ar_subj_term_addr;
  163         struct au_mask          ar_subj_amask;
  164 
  165         /* Operation arguments. */
  166         uid_t                   ar_arg_euid;
  167         uid_t                   ar_arg_ruid;
  168         uid_t                   ar_arg_suid;
  169         gid_t                   ar_arg_egid;
  170         gid_t                   ar_arg_rgid;
  171         gid_t                   ar_arg_sgid;
  172         pid_t                   ar_arg_pid;
  173         pid_t                   ar_arg_asid;
  174         struct au_tid           ar_arg_termid;
  175         struct au_tid_addr      ar_arg_termid_addr;
  176         uid_t                   ar_arg_uid;
  177         uid_t                   ar_arg_auid;
  178         gid_t                   ar_arg_gid;
  179         struct groupset         ar_arg_groups;
  180         int                     ar_arg_fd;
  181         int                     ar_arg_fflags;
  182         mode_t                  ar_arg_mode;
  183         int                     ar_arg_dev;
  184         long                    ar_arg_value;
  185         void *                  ar_arg_addr;
  186         int                     ar_arg_len;
  187         int                     ar_arg_mask;
  188         u_int                   ar_arg_signum;
  189         char                    ar_arg_login[MAXLOGNAME];
  190         int                     ar_arg_ctlname[CTL_MAXNAME];
  191         struct socket_au_info   ar_arg_sockinfo;
  192         char                    *ar_arg_upath1;
  193         char                    *ar_arg_upath2;
  194         char                    *ar_arg_text;
  195         struct au_mask          ar_arg_amask;
  196         struct vnode_au_info    ar_arg_vnode1;
  197         struct vnode_au_info    ar_arg_vnode2;
  198         int                     ar_arg_cmd;
  199         int                     ar_arg_svipc_cmd;
  200         struct ipc_perm         ar_arg_svipc_perm;
  201         int                     ar_arg_svipc_id;
  202         void *                  ar_arg_svipc_addr;
  203         struct posix_ipc_perm   ar_arg_pipc_perm;
  204         union auditon_udata     ar_arg_auditon;
  205         char                    *ar_arg_argv;
  206         int                     ar_arg_argc;
  207         char                    *ar_arg_envv;
  208         int                     ar_arg_envc;
  209         int                     ar_arg_exitstatus;
  210         int                     ar_arg_exitretval;
  211         struct sockaddr_storage ar_arg_sockaddr;
  212 };
  213 
  214 /*
  215  * Arguments in the audit record are initially not defined; flags are set to
  216  * indicate if they are present so they can be included in the audit log
  217  * stream only if defined.
  218  */
  219 #define ARG_IS_VALID(kar, arg)  ((kar)->k_ar.ar_valid_arg & (arg))
  220 #define ARG_SET_VALID(kar, arg) do {                                    \
  221         (kar)->k_ar.ar_valid_arg |= (arg);                              \
  222 } while (0)
  223 
  224 /*
  225  * In-kernel version of audit record; the basic record plus queue meta-data.
  226  * This record can also have a pointer set to some opaque data that will be
  227  * passed through to the audit writing mechanism.
  228  */
  229 struct kaudit_record {
  230         struct audit_record              k_ar;
  231         u_int32_t                        k_ar_commit;
  232         void                            *k_udata;       /* User data. */
  233         u_int                            k_ulen;        /* User data length. */
  234         struct uthread                  *k_uthread;     /* Audited thread. */
  235         TAILQ_ENTRY(kaudit_record)       k_q;
  236 };
  237 TAILQ_HEAD(kaudit_queue, kaudit_record);
  238 
  239 /*
  240  * Functions to manage the allocation, release, and commit of kernel audit
  241  * records.
  242  */
  243 void                     audit_abort(struct kaudit_record *ar);
  244 void                     audit_commit(struct kaudit_record *ar, int error,
  245                             int retval);
  246 struct kaudit_record    *audit_new(int event, struct thread *td);
  247 
  248 /*
  249  * Functions relating to the conversion of internal kernel audit records to
  250  * the BSM file format.
  251  */
  252 struct au_record;
  253 int      kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau);
  254 int      bsm_rec_verify(void *rec);
  255 
  256 /*
  257  * Kernel versions of the libbsm audit record functions.
  258  */
  259 void     kau_free(struct au_record *rec);
  260 void     kau_init(void);
  261 
  262 /*
  263  * Return values for pre-selection and post-selection decisions.
  264  */
  265 #define AU_PRS_SUCCESS  1
  266 #define AU_PRS_FAILURE  2
  267 #define AU_PRS_BOTH     (AU_PRS_SUCCESS|AU_PRS_FAILURE)
  268 
  269 /*
  270  * Data structures relating to the kernel audit queue.  Ideally, these might
  271  * be abstracted so that only accessor methods are exposed.
  272  */
  273 extern struct mtx               audit_mtx;
  274 extern struct cv                audit_watermark_cv;
  275 extern struct cv                audit_worker_cv;
  276 extern struct kaudit_queue      audit_q;
  277 extern int                      audit_q_len;
  278 extern int                      audit_pre_q_len;
  279 extern int                      audit_in_failure;
  280 
  281 /*
  282  * Flags to use on audit files when opening and closing.
  283  */
  284 #define AUDIT_OPEN_FLAGS        (FWRITE | O_APPEND)
  285 #define AUDIT_CLOSE_FLAGS       (FWRITE | O_APPEND)
  286 
  287 #include <sys/fcntl.h>
  288 #include <sys/kernel.h>
  289 #include <sys/malloc.h>
  290 
  291 /*
  292  * Some of the BSM tokenizer functions take different parameters in the
  293  * kernel implementations in order to save the copying of large kernel data
  294  * structures.  The prototypes of these functions are declared here.
  295  */
  296 token_t         *kau_to_socket(struct socket_au_info *soi);
  297 
  298 /*
  299  * audit_klib prototypes
  300  */
  301 int              au_preselect(au_event_t event, au_class_t class,
  302                     au_mask_t *mask_p, int sorf);
  303 au_event_t       flags_and_error_to_openevent(int oflags, int error);
  304 void             au_evclassmap_init(void);
  305 void             au_evclassmap_insert(au_event_t event, au_class_t class);
  306 au_class_t       au_event_class(au_event_t event);
  307 au_event_t       ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
  308 int              auditon_command_event(int cmd);
  309 int              msgctl_to_event(int cmd);
  310 int              semctl_to_event(int cmr);
  311 void             canon_path(struct thread *td, char *path, char *cpath);
  312 
  313 /*
  314  * Audit trigger events notify user space of kernel audit conditions
  315  * asynchronously.
  316  */
  317 void             audit_trigger_init(void);
  318 int              send_trigger(unsigned int trigger);
  319 
  320 /*
  321  * General audit related functions.
  322  */
  323 struct kaudit_record    *currecord(void);
  324 void                     audit_free(struct kaudit_record *ar);
  325 void                     audit_shutdown(void *arg, int howto);
  326 void                     audit_rotate_vnode(struct ucred *cred,
  327                             struct vnode *vp);
  328 void                     audit_worker_init(void);
  329 
  330 /*
  331  * Audit pipe functions.
  332  */
  333 int      audit_pipe_preselect(au_id_t auid, au_event_t event,
  334             au_class_t class, int sorf, int trail_select);
  335 void     audit_pipe_submit(au_id_t auid, au_event_t event, au_class_t class,
  336             int sorf, int trail_select, void *record, u_int record_len);
  337 void     audit_pipe_submit_user(void *record, u_int record_len);
  338 
  339 #endif /* ! _SECURITY_AUDIT_PRIVATE_H_ */
Cache object: a41e0af2665314b28f52d9c01ab846ad
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/security/audit/audit_private.h

FreeBSD/Linux Kernel Cross Reference
sys/security/audit/audit_private.h
