1 /*
2 * Copyright (c) 1999-2005 Apple Computer, Inc.
3 * Copyright (c) 2006 Robert N. M. Watson
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of
15 * its contributors may be used to endorse or promote products derived
16 * from this software without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
22 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
26 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
27 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28 * POSSIBILITY OF SUCH DAMAGE.
29 *
30 * $FreeBSD: releng/6.2/sys/security/audit/audit_worker.c 164286 2006-11-14 20:42:41Z cvs2svn $
31 */
32
33 #include <sys/param.h>
34 #include <sys/condvar.h>
35 #include <sys/conf.h>
36 #include <sys/file.h>
37 #include <sys/filedesc.h>
38 #include <sys/fcntl.h>
39 #include <sys/ipc.h>
40 #include <sys/kernel.h>
41 #include <sys/kthread.h>
42 #include <sys/malloc.h>
43 #include <sys/mount.h>
44 #include <sys/namei.h>
45 #include <sys/proc.h>
46 #include <sys/queue.h>
47 #include <sys/socket.h>
48 #include <sys/socketvar.h>
49 #include <sys/protosw.h>
50 #include <sys/domain.h>
51 #include <sys/sysproto.h>
52 #include <sys/sysent.h>
53 #include <sys/systm.h>
54 #include <sys/ucred.h>
55 #include <sys/uio.h>
56 #include <sys/un.h>
57 #include <sys/unistd.h>
58 #include <sys/vnode.h>
59
60 #include <bsm/audit.h>
61 #include <bsm/audit_internal.h>
62 #include <bsm/audit_kevents.h>
63
64 #include <netinet/in.h>
65 #include <netinet/in_pcb.h>
66
67 #include <security/audit/audit.h>
68 #include <security/audit/audit_private.h>
69
70 #include <vm/uma.h>
71
72 /*
73 * Worker thread that will schedule disk I/O, etc.
74 */
75 static struct proc *audit_thread;
76
77 /*
78 * When an audit log is rotated, the actual rotation must be performed by the
79 * audit worker thread, as it may have outstanding writes on the current
80 * audit log. audit_replacement_vp holds the vnode replacing the current
81 * vnode. We can't let more than one replacement occur at a time, so if more
82 * than one thread requests a replacement, only one can have the replacement
83 * "in progress" at any given moment. If a thread tries to replace the audit
84 * vnode and discovers a replacement is already in progress (i.e.,
85 * audit_replacement_flag != 0), then it will sleep on audit_replacement_cv
86 * waiting its turn to perform a replacement. When a replacement is
87 * completed, this cv is signalled by the worker thread so a waiting thread
88 * can start another replacement. We also store a credential to perform
89 * audit log write operations with.
90 *
91 * The current credential and vnode are thread-local to audit_worker.
92 */
93 static struct cv audit_replacement_cv;
94
95 static int audit_replacement_flag;
96 static struct vnode *audit_replacement_vp;
97 static struct ucred *audit_replacement_cred;
98
99 /*
100 * Flags related to Kernel->user-space communication.
101 */
102 static int audit_file_rotate_wait;
103
104 /*
105 * Write an audit record to a file, performed as the last stage after both
106 * preselection and BSM conversion. Both space management and write failures
107 * are handled in this function.
108 *
109 * No attempt is made to deal with possible failure to deliver a trigger to
110 * the audit daemon, since the message is asynchronous anyway.
111 */
112 static void
113 audit_record_write(struct vnode *vp, struct ucred *cred, struct thread *td,
114 void *data, size_t len)
115 {
116 static struct timeval last_lowspace_trigger;
117 static struct timeval last_fail;
118 static int cur_lowspace_trigger;
119 struct statfs *mnt_stat;
120 int error, vfslocked;
121 static int cur_fail;
122 struct vattr vattr;
123 long temp;
124
125 if (vp == NULL)
126 return;
127
128 mnt_stat = &vp->v_mount->mnt_stat;
129 vfslocked = VFS_LOCK_GIANT(vp->v_mount);
130
131 /*
132 * First, gather statistics on the audit log file and file system so
133 * that we know how we're doing on space. Consider failure of these
134 * operations to indicate a future inability to write to the file.
135 */
136 error = VFS_STATFS(vp->v_mount, mnt_stat, td);
137 if (error)
138 goto fail;
139 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
140 error = VOP_GETATTR(vp, &vattr, cred, td);
141 VOP_UNLOCK(vp, 0, td);
142 if (error)
143 goto fail;
144 audit_fstat.af_currsz = vattr.va_size;
145
146 /*
147 * We handle four different space-related limits:
148 *
149 * - A fixed (hard) limit on the minimum free blocks we require on
150 * the file system, and results in record loss, a trigger, and
151 * possible fail stop due to violating invariants.
152 *
153 * - An administrative (soft) limit, which when fallen below, results
154 * in the kernel notifying the audit daemon of low space.
155 *
156 * - An audit trail size limit, which when gone above, results in the
157 * kernel notifying the audit daemon that rotation is desired.
158 *
159 * - The total depth of the kernel audit record exceeding free space,
160 * which can lead to possible fail stop (with drain), in order to
161 * prevent violating invariants. Failure here doesn't halt
162 * immediately, but prevents new records from being generated.
163 *
164 * Possibly, the last of these should be handled differently, always
165 * allowing a full queue to be lost, rather than trying to prevent
166 * loss.
167 *
168 * First, handle the hard limit, which generates a trigger and may
169 * fail stop. This is handled in the same manner as ENOSPC from
170 * VOP_WRITE, and results in record loss.
171 */
172 if (mnt_stat->f_bfree < AUDIT_HARD_LIMIT_FREE_BLOCKS) {
173 error = ENOSPC;
174 goto fail_enospc;
175 }
176
177 /*
178 * Second, handle falling below the soft limit, if defined; we send
179 * the daemon a trigger and continue processing the record. Triggers
180 * are limited to 1/sec.
181 */
182 if (audit_qctrl.aq_minfree != 0) {
183 /*
184 * XXXAUDIT: Check math and block size calculations here.
185 */
186 temp = mnt_stat->f_blocks / (100 / audit_qctrl.aq_minfree);
187 if (mnt_stat->f_bfree < temp) {
188 if (ppsratecheck(&last_lowspace_trigger,
189 &cur_lowspace_trigger, 1)) {
190 (void)send_trigger(AUDIT_TRIGGER_LOW_SPACE);
191 printf("Warning: audit space low\n");
192 }
193 }
194 }
195
196 /*
197 * If the current file is getting full, generate a rotation trigger
198 * to the daemon. This is only approximate, which is fine as more
199 * records may be generated before the daemon rotates the file.
200 */
201 if ((audit_fstat.af_filesz != 0) && (audit_file_rotate_wait == 0) &&
202 (vattr.va_size >= audit_fstat.af_filesz)) {
203 audit_file_rotate_wait = 1;
204 (void)send_trigger(AUDIT_TRIGGER_ROTATE_KERNEL);
205 }
206
207 /*
208 * If the estimated amount of audit data in the audit event queue
209 * (plus records allocated but not yet queued) has reached the amount
210 * of free space on the disk, then we need to go into an audit fail
211 * stop state, in which we do not permit the allocation/committing of
212 * any new audit records. We continue to process records but don't
213 * allow any activities that might generate new records. In the
214 * future, we might want to detect when space is available again and
215 * allow operation to continue, but this behavior is sufficient to
216 * meet fail stop requirements in CAPP.
217 */
218 if (audit_fail_stop) {
219 if ((unsigned long)((audit_q_len + audit_pre_q_len + 1) *
220 MAX_AUDIT_RECORD_SIZE) / mnt_stat->f_bsize >=
221 (unsigned long)(mnt_stat->f_bfree)) {
222 if (ppsratecheck(&last_fail, &cur_fail, 1))
223 printf("audit_record_write: free space "
224 "below size of audit queue, failing "
225 "stop\n");
226 audit_in_failure = 1;
227 } else if (audit_in_failure) {
228 /*
229 * XXXRW: If we want to handle recovery, this is the
230 * spot to do it: unset audit_in_failure, and issue a
231 * wakeup on the cv.
232 */
233 }
234 }
235
236 error = vn_rdwr(UIO_WRITE, vp, data, len, (off_t)0, UIO_SYSSPACE,
237 IO_APPEND|IO_UNIT, cred, NULL, NULL, td);
238 if (error == ENOSPC)
239 goto fail_enospc;
240 else if (error)
241 goto fail;
242
243 /*
244 * Catch completion of a queue drain here; if we're draining and the
245 * queue is now empty, fail stop. That audit_fail_stop is implicitly
246 * true, since audit_in_failure can only be set of audit_fail_stop is
247 * set.
248 *
249 * XXXRW: If we handle recovery from audit_in_failure, then we need
250 * to make panic here conditional.
251 */
252 if (audit_in_failure) {
253 if (audit_q_len == 0 && audit_pre_q_len == 0) {
254 VOP_LOCK(vp, LK_DRAIN | LK_INTERLOCK, td);
255 (void)VOP_FSYNC(vp, MNT_WAIT, td);
256 VOP_UNLOCK(vp, 0, td);
257 panic("Audit store overflow; record queue drained.");
258 }
259 }
260
261 VFS_UNLOCK_GIANT(vfslocked);
262 return;
263
264 fail_enospc:
265 /*
266 * ENOSPC is considered a special case with respect to failures, as
267 * this can reflect either our preemptive detection of insufficient
268 * space, or ENOSPC returned by the vnode write call.
269 */
270 if (audit_fail_stop) {
271 VOP_LOCK(vp, LK_DRAIN | LK_INTERLOCK, td);
272 (void)VOP_FSYNC(vp, MNT_WAIT, td);
273 VOP_UNLOCK(vp, 0, td);
274 panic("Audit log space exhausted and fail-stop set.");
275 }
276 (void)send_trigger(AUDIT_TRIGGER_NO_SPACE);
277 audit_suspended = 1;
278
279 /* FALLTHROUGH */
280 fail:
281 /*
282 * We have failed to write to the file, so the current record is
283 * lost, which may require an immediate system halt.
284 */
285 if (audit_panic_on_write_fail) {
286 VOP_LOCK(vp, LK_DRAIN | LK_INTERLOCK, td);
287 (void)VOP_FSYNC(vp, MNT_WAIT, td);
288 VOP_UNLOCK(vp, 0, td);
289 panic("audit_worker: write error %d\n", error);
290 } else if (ppsratecheck(&last_fail, &cur_fail, 1))
291 printf("audit_worker: write error %d\n", error);
292 VFS_UNLOCK_GIANT(vfslocked);
293 }
294
295 /*
296 * If an appropriate signal has been received rotate the audit log based on
297 * the global replacement variables. Signal consumers as needed that the
298 * rotation has taken place.
299 *
300 * XXXRW: The global variables and CVs used to signal the audit_worker to
301 * perform a rotation are essentially a message queue of depth 1. It would
302 * be much nicer to actually use a message queue.
303 */
304 static void
305 audit_worker_rotate(struct ucred **audit_credp, struct vnode **audit_vpp,
306 struct thread *audit_td)
307 {
308 int do_replacement_signal, vfslocked;
309 struct ucred *old_cred;
310 struct vnode *old_vp;
311
312 mtx_assert(&audit_mtx, MA_OWNED);
313
314 do_replacement_signal = 0;
315 while (audit_replacement_flag != 0) {
316 old_cred = *audit_credp;
317 old_vp = *audit_vpp;
318 *audit_credp = audit_replacement_cred;
319 *audit_vpp = audit_replacement_vp;
320 audit_replacement_cred = NULL;
321 audit_replacement_vp = NULL;
322 audit_replacement_flag = 0;
323
324 audit_enabled = (*audit_vpp != NULL);
325
326 /*
327 * XXX: What to do about write failures here?
328 */
329 if (old_vp != NULL) {
330 AUDIT_PRINTF(("Closing old audit file\n"));
331 mtx_unlock(&audit_mtx);
332 vfslocked = VFS_LOCK_GIANT(old_vp->v_mount);
333 vn_close(old_vp, AUDIT_CLOSE_FLAGS, old_cred,
334 audit_td);
335 VFS_UNLOCK_GIANT(vfslocked);
336 crfree(old_cred);
337 mtx_lock(&audit_mtx);
338 old_cred = NULL;
339 old_vp = NULL;
340 AUDIT_PRINTF(("Audit file closed\n"));
341 }
342 if (*audit_vpp != NULL) {
343 AUDIT_PRINTF(("Opening new audit file\n"));
344 }
345 do_replacement_signal = 1;
346 }
347
348 /*
349 * Signal that replacement have occurred to wake up and
350 * start any other replacements started in parallel. We can
351 * continue about our business in the mean time. We
352 * broadcast so that both new replacements can be inserted,
353 * but also so that the source(s) of replacement can return
354 * successfully.
355 */
356 if (do_replacement_signal)
357 cv_broadcast(&audit_replacement_cv);
358 }
359
360 /*
361 * Given a kernel audit record, process as required. Kernel audit records
362 * are converted to one, or possibly two, BSM records, depending on whether
363 * there is a user audit record present also. Kernel records need be
364 * converted to BSM before they can be written out. Both types will be
365 * written to disk, and audit pipes.
366 */
367 static void
368 audit_worker_process_record(struct vnode *audit_vp, struct ucred *audit_cred,
369 struct thread *audit_td, struct kaudit_record *ar)
370 {
371 struct au_record *bsm;
372 au_class_t class;
373 au_event_t event;
374 au_id_t auid;
375 int error, sorf;
376
377 /*
378 * First, handle the user record, if any: commit to the system trail
379 * and audit pipes as selected.
380 */
381 if ((ar->k_ar_commit & AR_COMMIT_USER) &&
382 (ar->k_ar_commit & AR_PRESELECT_USER_TRAIL))
383 audit_record_write(audit_vp, audit_cred, audit_td,
384 ar->k_udata, ar->k_ulen);
385
386 if ((ar->k_ar_commit & AR_COMMIT_USER) &&
387 (ar->k_ar_commit & AR_PRESELECT_USER_PIPE))
388 audit_pipe_submit_user(ar->k_udata, ar->k_ulen);
389
390 if (!(ar->k_ar_commit & AR_COMMIT_KERNEL) ||
391 ((ar->k_ar_commit & AR_PRESELECT_PIPE) == 0 &&
392 (ar->k_ar_commit & AR_PRESELECT_TRAIL) == 0))
393 return;
394
395 auid = ar->k_ar.ar_subj_auid;
396 event = ar->k_ar.ar_event;
397 class = au_event_class(event);
398 if (ar->k_ar.ar_errno == 0)
399 sorf = AU_PRS_SUCCESS;
400 else
401 sorf = AU_PRS_FAILURE;
402
403 error = kaudit_to_bsm(ar, &bsm);
404 switch (error) {
405 case BSM_NOAUDIT:
406 return;
407
408 case BSM_FAILURE:
409 printf("audit_worker_process_record: BSM_FAILURE\n");
410 return;
411
412 case BSM_SUCCESS:
413 break;
414
415 default:
416 panic("kaudit_to_bsm returned %d", error);
417 }
418
419 if (ar->k_ar_commit & AR_PRESELECT_TRAIL)
420 audit_record_write(audit_vp, audit_cred, audit_td, bsm->data,
421 bsm->len);
422
423 if (ar->k_ar_commit & AR_PRESELECT_PIPE)
424 audit_pipe_submit(auid, event, class, sorf,
425 ar->k_ar_commit & AR_PRESELECT_TRAIL, bsm->data,
426 bsm->len);
427
428 kau_free(bsm);
429 }
430
431 /*
432 * The audit_worker thread is responsible for watching the event queue,
433 * dequeueing records, converting them to BSM format, and committing them to
434 * disk. In order to minimize lock thrashing, records are dequeued in sets
435 * to a thread-local work queue. In addition, the audit_work performs the
436 * actual exchange of audit log vnode pointer, as audit_vp is a thread-local
437 * variable.
438 */
439 static void
440 audit_worker(void *arg)
441 {
442 struct kaudit_queue ar_worklist;
443 struct kaudit_record *ar;
444 struct ucred *audit_cred;
445 struct thread *audit_td;
446 struct vnode *audit_vp;
447 int lowater_signal;
448
449 AUDIT_PRINTF(("audit_worker starting\n"));
450
451 /*
452 * These are thread-local variables requiring no synchronization.
453 */
454 TAILQ_INIT(&ar_worklist);
455 audit_cred = NULL;
456 audit_td = curthread;
457 audit_vp = NULL;
458
459 mtx_lock(&audit_mtx);
460 while (1) {
461 mtx_assert(&audit_mtx, MA_OWNED);
462
463 /*
464 * Wait for record or rotation events.
465 */
466 while (!audit_replacement_flag && TAILQ_EMPTY(&audit_q)) {
467 AUDIT_PRINTF(("audit_worker waiting\n"));
468 cv_wait(&audit_worker_cv, &audit_mtx);
469 AUDIT_PRINTF(("audit_worker woken up\n"));
470 AUDIT_PRINTF(("audit_worker: new vp = %p; value of "
471 "flag %d\n", audit_replacement_vp,
472 audit_replacement_flag));
473 }
474
475 /*
476 * First priority: replace the audit log target if requested.
477 */
478 audit_worker_rotate(&audit_cred, &audit_vp, audit_td);
479
480 /*
481 * If there are records in the global audit record queue,
482 * transfer them to a thread-local queue and process them
483 * one by one. If we cross the low watermark threshold,
484 * signal any waiting processes that they may wake up and
485 * continue generating records.
486 */
487 lowater_signal = 0;
488 while ((ar = TAILQ_FIRST(&audit_q))) {
489 TAILQ_REMOVE(&audit_q, ar, k_q);
490 audit_q_len--;
491 if (audit_q_len == audit_qctrl.aq_lowater)
492 lowater_signal++;
493 TAILQ_INSERT_TAIL(&ar_worklist, ar, k_q);
494 }
495 if (lowater_signal)
496 cv_broadcast(&audit_watermark_cv);
497
498 mtx_unlock(&audit_mtx);
499 while ((ar = TAILQ_FIRST(&ar_worklist))) {
500 TAILQ_REMOVE(&ar_worklist, ar, k_q);
501 audit_worker_process_record(audit_vp, audit_cred,
502 audit_td, ar);
503 audit_free(ar);
504 }
505 mtx_lock(&audit_mtx);
506 }
507 }
508
509 /*
510 * audit_rotate_vnode() is called by a user or kernel thread to configure or
511 * de-configure auditing on a vnode. The arguments are the replacement
512 * credential and vnode to substitute for the current credential and vnode,
513 * if any. If either is set to NULL, both should be NULL, and this is used
514 * to indicate that audit is being disabled. The real work is done in the
515 * audit_worker thread, but audit_rotate_vnode() waits synchronously for that
516 * to complete.
517 *
518 * The vnode should be referenced and opened by the caller. The credential
519 * should be referenced. audit_rotate_vnode() will own both references as of
520 * this call, so the caller should not release either.
521 *
522 * XXXAUDIT: Review synchronize communication logic. Really, this is a
523 * message queue of depth 1.
524 *
525 * XXXAUDIT: Enhance the comments below to indicate that we are basically
526 * acquiring ownership of the communications queue, inserting our message,
527 * and waiting for an acknowledgement.
528 */
529 void
530 audit_rotate_vnode(struct ucred *cred, struct vnode *vp)
531 {
532
533 /*
534 * If other parallel log replacements have been requested, we wait
535 * until they've finished before continuing.
536 */
537 mtx_lock(&audit_mtx);
538 while (audit_replacement_flag != 0) {
539 AUDIT_PRINTF(("audit_rotate_vnode: sleeping to wait for "
540 "flag\n"));
541 cv_wait(&audit_replacement_cv, &audit_mtx);
542 AUDIT_PRINTF(("audit_rotate_vnode: woken up (flag %d)\n",
543 audit_replacement_flag));
544 }
545 audit_replacement_cred = cred;
546 audit_replacement_flag = 1;
547 audit_replacement_vp = vp;
548
549 /*
550 * Wake up the audit worker to perform the exchange once we
551 * release the mutex.
552 */
553 cv_signal(&audit_worker_cv);
554
555 /*
556 * Wait for the audit_worker to broadcast that a replacement has
557 * taken place; we know that once this has happened, our vnode
558 * has been replaced in, so we can return successfully.
559 */
560 AUDIT_PRINTF(("audit_rotate_vnode: waiting for news of "
561 "replacement\n"));
562 cv_wait(&audit_replacement_cv, &audit_mtx);
563 AUDIT_PRINTF(("audit_rotate_vnode: change acknowledged by "
564 "audit_worker (flag " "now %d)\n", audit_replacement_flag));
565 mtx_unlock(&audit_mtx);
566
567 audit_file_rotate_wait = 0; /* We can now request another rotation */
568 }
569
570 void
571 audit_worker_init(void)
572 {
573 int error;
574
575 cv_init(&audit_replacement_cv, "audit_replacement_cv");
576 error = kthread_create(audit_worker, NULL, &audit_thread, RFHIGHPID,
577 0, "audit_worker");
578 if (error)
579 panic("audit_worker_init: kthread_create returned %d", error);
580 }
Cache object: 0587b8d7ef076a78a61f878e8dcfd68d
|