33
34#include <sys/param.h>
35#include <sys/condvar.h>
36#include <sys/conf.h>
37#include <sys/file.h>
38#include <sys/filedesc.h>
39#include <sys/fcntl.h>
40#include <sys/ipc.h>
41#include <sys/kernel.h>
42#include <sys/kthread.h>
43#include <sys/malloc.h>
44#include <sys/mount.h>
45#include <sys/namei.h>
46#include <sys/priv.h>
47#include <sys/proc.h>
48#include <sys/queue.h>
49#include <sys/socket.h>
50#include <sys/socketvar.h>
51#include <sys/protosw.h>
52#include <sys/domain.h>
53#include <sys/sysctl.h>
54#include <sys/sysproto.h>
55#include <sys/sysent.h>
56#include <sys/systm.h>
57#include <sys/ucred.h>
58#include <sys/uio.h>
59#include <sys/un.h>
60#include <sys/unistd.h>
61#include <sys/vnode.h>
62
63#include <bsm/audit.h>
64#include <bsm/audit_internal.h>
65#include <bsm/audit_kevents.h>
66
67#include <netinet/in.h>
68#include <netinet/in_pcb.h>
69
70#include <security/audit/audit.h>
71#include <security/audit/audit_private.h>
72
73#include <vm/uma.h>
74
75static uma_zone_t audit_record_zone;
76static MALLOC_DEFINE(M_AUDITCRED, "audit_cred", "Audit cred storage");
77MALLOC_DEFINE(M_AUDITDATA, "audit_data", "Audit data storage");
78MALLOC_DEFINE(M_AUDITPATH, "audit_path", "Audit path storage");
79MALLOC_DEFINE(M_AUDITTEXT, "audit_text", "Audit text storage");
80
81SYSCTL_NODE(_security, OID_AUTO, audit, CTLFLAG_RW, 0,
82 "TrustedBSD audit controls");
83
84/*
85 * Audit control settings that are set/read by system calls and are hence
86 * non-static.
87 *
88 * Define the audit control flags.
89 */
90int audit_enabled;
91int audit_suspended;
92
93/*
94 * Flags controlling behavior in low storage situations. Should we panic if
95 * a write fails? Should we fail stop if we're out of disk space?
96 */
97int audit_panic_on_write_fail;
98int audit_fail_stop;
99int audit_argv;
100int audit_arge;
101
102/*
103 * Are we currently "failing stop" due to out of disk space?
104 */
105int audit_in_failure;
106
107/*
108 * Global audit statistics.
109 */
110struct audit_fstat audit_fstat;
111
112/*
113 * Preselection mask for non-attributable events.
114 */
115struct au_mask audit_nae_mask;
116
117/*
118 * Mutex to protect global variables shared between various threads and
119 * processes.
120 */
121struct mtx audit_mtx;
122
123/*
124 * Queue of audit records ready for delivery to disk. We insert new records
125 * at the tail, and remove records from the head. Also, a count of the
126 * number of records used for checking queue depth. In addition, a counter
127 * of records that we have allocated but are not yet in the queue, which is
128 * needed to estimate the total size of the combined set of records
129 * outstanding in the system.
130 */
131struct kaudit_queue audit_q;
132int audit_q_len;
133int audit_pre_q_len;
134
135/*
136 * Audit queue control settings (minimum free, low/high water marks, etc.)
137 */
138struct au_qctrl audit_qctrl;
139
140/*
141 * Condition variable to signal to the worker that it has work to do: either
142 * new records are in the queue, or a log replacement is taking place.
143 */
144struct cv audit_worker_cv;
145
146/*
147 * Condition variable to flag when crossing the low watermark, meaning that
148 * threads blocked due to hitting the high watermark can wake up and continue
149 * to commit records.
150 */
151struct cv audit_watermark_cv;
152
153/*
154 * Condition variable for auditing threads wait on when in fail-stop mode.
155 * Threads wait on this CV forever (and ever), never seeing the light of day
156 * again.
157 */
158static struct cv audit_fail_cv;
159
160/*
161 * Construct an audit record for the passed thread.
162 */
163static int
164audit_record_ctor(void *mem, int size, void *arg, int flags)
165{
166 struct kaudit_record *ar;
167 struct thread *td;
168
169 KASSERT(sizeof(*ar) == size, ("audit_record_ctor: wrong size"));
170
171 td = arg;
172 ar = mem;
173 bzero(ar, sizeof(*ar));
174 ar->k_ar.ar_magic = AUDIT_RECORD_MAGIC;
175 nanotime(&ar->k_ar.ar_starttime);
176
177 /*
178 * Export the subject credential.
179 */
180 cru2x(td->td_ucred, &ar->k_ar.ar_subj_cred);
181 ar->k_ar.ar_subj_ruid = td->td_ucred->cr_ruid;
182 ar->k_ar.ar_subj_rgid = td->td_ucred->cr_rgid;
183 ar->k_ar.ar_subj_egid = td->td_ucred->cr_groups[0];
184 ar->k_ar.ar_subj_auid = td->td_ucred->cr_audit.ai_auid;
185 ar->k_ar.ar_subj_asid = td->td_ucred->cr_audit.ai_asid;
186 ar->k_ar.ar_subj_pid = td->td_proc->p_pid;
187 ar->k_ar.ar_subj_amask = td->td_ucred->cr_audit.ai_mask;
188 ar->k_ar.ar_subj_term_addr = td->td_ucred->cr_audit.ai_termid;
189 return (0);
190}
191
192static void
193audit_record_dtor(void *mem, int size, void *arg)
194{
195 struct kaudit_record *ar;
196
197 KASSERT(sizeof(*ar) == size, ("audit_record_dtor: wrong size"));
198
199 ar = mem;
200 if (ar->k_ar.ar_arg_upath1 != NULL)
201 free(ar->k_ar.ar_arg_upath1, M_AUDITPATH);
202 if (ar->k_ar.ar_arg_upath2 != NULL)
203 free(ar->k_ar.ar_arg_upath2, M_AUDITPATH);
204 if (ar->k_ar.ar_arg_text != NULL)
205 free(ar->k_ar.ar_arg_text, M_AUDITTEXT);
206 if (ar->k_udata != NULL)
207 free(ar->k_udata, M_AUDITDATA);
208 if (ar->k_ar.ar_arg_argv != NULL)
209 free(ar->k_ar.ar_arg_argv, M_AUDITTEXT);
210 if (ar->k_ar.ar_arg_envv != NULL)
211 free(ar->k_ar.ar_arg_envv, M_AUDITTEXT);
212}
213
214/*
215 * Initialize the Audit subsystem: configuration state, work queue,
216 * synchronization primitives, worker thread, and trigger device node. Also
217 * call into the BSM assembly code to initialize it.
218 */
219static void
220audit_init(void)
221{
222
223 audit_enabled = 0;
224 audit_suspended = 0;
225 audit_panic_on_write_fail = 0;
226 audit_fail_stop = 0;
227 audit_in_failure = 0;
228 audit_argv = 0;
229 audit_arge = 0;
230
231 audit_fstat.af_filesz = 0; /* '0' means unset, unbounded. */
232 audit_fstat.af_currsz = 0;
233 audit_nae_mask.am_success = 0;
234 audit_nae_mask.am_failure = 0;
235
236 TAILQ_INIT(&audit_q);
237 audit_q_len = 0;
238 audit_pre_q_len = 0;
239 audit_qctrl.aq_hiwater = AQ_HIWATER;
240 audit_qctrl.aq_lowater = AQ_LOWATER;
241 audit_qctrl.aq_bufsz = AQ_BUFSZ;
242 audit_qctrl.aq_minfree = AU_FS_MINFREE;
243
244 mtx_init(&audit_mtx, "audit_mtx", NULL, MTX_DEF);
245 cv_init(&audit_worker_cv, "audit_worker_cv");
246 cv_init(&audit_watermark_cv, "audit_watermark_cv");
247 cv_init(&audit_fail_cv, "audit_fail_cv");
248
249 audit_record_zone = uma_zcreate("audit_record",
250 sizeof(struct kaudit_record), audit_record_ctor,
251 audit_record_dtor, NULL, NULL, UMA_ALIGN_PTR, 0);
252
253 /* Initialize the BSM audit subsystem. */
254 kau_init();
255
256 audit_trigger_init();
257
258 /* Register shutdown handler. */
259 EVENTHANDLER_REGISTER(shutdown_pre_sync, audit_shutdown, NULL,
260 SHUTDOWN_PRI_FIRST);
261
262 /* Start audit worker thread. */
263 audit_worker_init();
264}
265
266SYSINIT(audit_init, SI_SUB_AUDIT, SI_ORDER_FIRST, audit_init, NULL);
267
268/*
269 * Drain the audit queue and close the log at shutdown. Note that this can
270 * be called both from the system shutdown path and also from audit
271 * configuration syscalls, so 'arg' and 'howto' are ignored.
272 *
273 * XXXRW: In FreeBSD 7.x and 8.x, this fails to wait for the record queue to
274 * drain before returning, which could lead to lost records on shutdown.
275 */
276void
277audit_shutdown(void *arg, int howto)
278{
279
280 audit_rotate_vnode(NULL, NULL);
281}
282
283/*
284 * Return the current thread's audit record, if any.
285 */
286struct kaudit_record *
287currecord(void)
288{
289
290 return (curthread->td_ar);
291}
292
293/*
294 * XXXAUDIT: There are a number of races present in the code below due to
295 * release and re-grab of the mutex. The code should be revised to become
296 * slightly less racy.
297 *
298 * XXXAUDIT: Shouldn't there be logic here to sleep waiting on available
299 * pre_q space, suspending the system call until there is room?
300 */
301struct kaudit_record *
302audit_new(int event, struct thread *td)
303{
304 struct kaudit_record *ar;
305 int no_record;
306
307 mtx_lock(&audit_mtx);
308 no_record = (audit_suspended || !audit_enabled);
309 mtx_unlock(&audit_mtx);
310 if (no_record)
311 return (NULL);
312
313 /*
314 * Note: the number of outstanding uncommitted audit records is
315 * limited to the number of concurrent threads servicing system calls
316 * in the kernel.
317 */
318 ar = uma_zalloc_arg(audit_record_zone, td, M_WAITOK);
319 ar->k_ar.ar_event = event;
320
321 mtx_lock(&audit_mtx);
322 audit_pre_q_len++;
323 mtx_unlock(&audit_mtx);
324
325 return (ar);
326}
327
328void
329audit_free(struct kaudit_record *ar)
330{
331
332 uma_zfree(audit_record_zone, ar);
333}
334
335void
336audit_commit(struct kaudit_record *ar, int error, int retval)
337{
338 au_event_t event;
339 au_class_t class;
340 au_id_t auid;
341 int sorf;
342 struct au_mask *aumask;
343
344 if (ar == NULL)
345 return;
346
347 /*
348 * Decide whether to commit the audit record by checking the error
349 * value from the system call and using the appropriate audit mask.
350 */
351 if (ar->k_ar.ar_subj_auid == AU_DEFAUDITID)
352 aumask = &audit_nae_mask;
353 else
354 aumask = &ar->k_ar.ar_subj_amask;
355
356 if (error)
357 sorf = AU_PRS_FAILURE;
358 else
359 sorf = AU_PRS_SUCCESS;
360
361 switch(ar->k_ar.ar_event) {
362 case AUE_OPEN_RWTC:
363 /*
364 * The open syscall always writes a AUE_OPEN_RWTC event;
365 * change it to the proper type of event based on the flags
366 * and the error value.
367 */
368 ar->k_ar.ar_event = audit_flags_and_error_to_openevent(
369 ar->k_ar.ar_arg_fflags, error);
370 break;
371
372 case AUE_SYSCTL:
373 ar->k_ar.ar_event = audit_ctlname_to_sysctlevent(
374 ar->k_ar.ar_arg_ctlname, ar->k_ar.ar_valid_arg);
375 break;
376
377 case AUE_AUDITON:
378 /* Convert the auditon() command to an event. */
379 ar->k_ar.ar_event = auditon_command_event(ar->k_ar.ar_arg_cmd);
380 break;
381 }
382
383 auid = ar->k_ar.ar_subj_auid;
384 event = ar->k_ar.ar_event;
385 class = au_event_class(event);
386
387 ar->k_ar_commit |= AR_COMMIT_KERNEL;
388 if (au_preselect(event, class, aumask, sorf) != 0)
389 ar->k_ar_commit |= AR_PRESELECT_TRAIL;
390 if (audit_pipe_preselect(auid, event, class, sorf,
391 ar->k_ar_commit & AR_PRESELECT_TRAIL) != 0)
392 ar->k_ar_commit |= AR_PRESELECT_PIPE;
393 if ((ar->k_ar_commit & (AR_PRESELECT_TRAIL | AR_PRESELECT_PIPE |
394 AR_PRESELECT_USER_TRAIL | AR_PRESELECT_USER_PIPE)) == 0) {
395 mtx_lock(&audit_mtx);
396 audit_pre_q_len--;
397 mtx_unlock(&audit_mtx);
398 audit_free(ar);
399 return;
400 }
401
402 ar->k_ar.ar_errno = error;
403 ar->k_ar.ar_retval = retval;
404 nanotime(&ar->k_ar.ar_endtime);
405
406 /*
407 * Note: it could be that some records initiated while audit was
408 * enabled should still be committed?
409 */
410 mtx_lock(&audit_mtx);
411 if (audit_suspended || !audit_enabled) {
412 audit_pre_q_len--;
413 mtx_unlock(&audit_mtx);
414 audit_free(ar);
415 return;
416 }
417
418 /*
419 * Constrain the number of committed audit records based on the
420 * configurable parameter.
421 */
422 while (audit_q_len >= audit_qctrl.aq_hiwater)
423 cv_wait(&audit_watermark_cv, &audit_mtx);
424
425 TAILQ_INSERT_TAIL(&audit_q, ar, k_q);
426 audit_q_len++;
427 audit_pre_q_len--;
428 cv_signal(&audit_worker_cv);
429 mtx_unlock(&audit_mtx);
430}
431
432/*
433 * audit_syscall_enter() is called on entry to each system call. It is
434 * responsible for deciding whether or not to audit the call (preselection),
435 * and if so, allocating a per-thread audit record. audit_new() will fill in
436 * basic thread/credential properties.
437 */
438void
439audit_syscall_enter(unsigned short code, struct thread *td)
440{
441 struct au_mask *aumask;
442 au_class_t class;
443 au_event_t event;
444 au_id_t auid;
445
446 KASSERT(td->td_ar == NULL, ("audit_syscall_enter: td->td_ar != NULL"));
447
448 /*
449 * In FreeBSD, each ABI has its own system call table, and hence
450 * mapping of system call codes to audit events. Convert the code to
451 * an audit event identifier using the process system call table
452 * reference. In Darwin, there's only one, so we use the global
453 * symbol for the system call table. No audit record is generated
454 * for bad system calls, as no operation has been performed.
455 */
456 if (code >= td->td_proc->p_sysent->sv_size)
457 return;
458
459 event = td->td_proc->p_sysent->sv_table[code].sy_auevent;
460 if (event == AUE_NULL)
461 return;
462
463 /*
464 * Check which audit mask to use; either the kernel non-attributable
465 * event mask or the process audit mask.
466 */
467 auid = td->td_ucred->cr_audit.ai_auid;
468 if (auid == AU_DEFAUDITID)
469 aumask = &audit_nae_mask;
470 else
471 aumask = &td->td_ucred->cr_audit.ai_mask;
472
473 /*
474 * Allocate an audit record, if preselection allows it, and store in
475 * the thread for later use.
476 */
477 class = au_event_class(event);
478 if (au_preselect(event, class, aumask, AU_PRS_BOTH)) {
479 /*
480 * If we're out of space and need to suspend unprivileged
481 * processes, do that here rather than trying to allocate
482 * another audit record.
483 *
484 * Note: we might wish to be able to continue here in the
485 * future, if the system recovers. That should be possible
486 * by means of checking the condition in a loop around
487 * cv_wait(). It might be desirable to reevaluate whether an
488 * audit record is still required for this event by
489 * re-calling au_preselect().
490 */
491 if (audit_in_failure &&
492 priv_check(td, PRIV_AUDIT_FAILSTOP) != 0) {
493 cv_wait(&audit_fail_cv, &audit_mtx);
494 panic("audit_failing_stop: thread continued");
495 }
496 td->td_ar = audit_new(event, td);
497 } else if (audit_pipe_preselect(auid, event, class, AU_PRS_BOTH, 0))
498 td->td_ar = audit_new(event, td);
499 else
500 td->td_ar = NULL;
501}
502
503/*
504 * audit_syscall_exit() is called from the return of every system call, or in
505 * the event of exit1(), during the execution of exit1(). It is responsible
506 * for committing the audit record, if any, along with return condition.
507 */
508void
509audit_syscall_exit(int error, struct thread *td)
510{
511 int retval;
512
513 /*
514 * Commit the audit record as desired; once we pass the record into
515 * audit_commit(), the memory is owned by the audit subsystem. The
516 * return value from the system call is stored on the user thread.
517 * If there was an error, the return value is set to -1, imitating
518 * the behavior of the cerror routine.
519 */
520 if (error)
521 retval = -1;
522 else
523 retval = td->td_retval[0];
524
525 audit_commit(td->td_ar, error, retval);
526 td->td_ar = NULL;
527}
528
529void
530audit_cred_copy(struct ucred *src, struct ucred *dest)
531{
532
533 bcopy(&src->cr_audit, &dest->cr_audit, sizeof(dest->cr_audit));
534}
535
536void
537audit_cred_destroy(struct ucred *cred)
538{
539
540}
541
542void
543audit_cred_init(struct ucred *cred)
544{
545
546 bzero(&cred->cr_audit, sizeof(cred->cr_audit));
547}
548
549/*
550 * Initialize audit information for the first kernel process (proc 0) and for
551 * the first user process (init).
552 */
553void
554audit_cred_kproc0(struct ucred *cred)
555{
556
557 cred->cr_audit.ai_auid = AU_DEFAUDITID;
558 cred->cr_audit.ai_termid.at_type = AU_IPv4;
559}
560
561void
562audit_cred_proc1(struct ucred *cred)
563{
564
565 cred->cr_audit.ai_auid = AU_DEFAUDITID;
566 cred->cr_audit.ai_termid.at_type = AU_IPv4;
567}
568
569void
570audit_thread_alloc(struct thread *td)
571{
572
573 td->td_ar = NULL;
574}
575
576void
577audit_thread_free(struct thread *td)
578{
579
580 KASSERT(td->td_ar == NULL, ("audit_thread_free: td_ar != NULL"));
581}
582
583void
584audit_proc_coredump(struct thread *td, char *path, int errcode)
585{
586 struct kaudit_record *ar;
587 struct au_mask *aumask;
588 au_class_t class;
589 int ret, sorf;
590 char **pathp;
591 au_id_t auid;
592
593 ret = 0;
594
595 /*
596 * Make sure we are using the correct preselection mask.
597 */
598 auid = td->td_ucred->cr_audit.ai_auid;
599 if (auid == AU_DEFAUDITID)
600 aumask = &audit_nae_mask;
601 else
602 aumask = &td->td_ucred->cr_audit.ai_mask;
603 /*
604 * It's possible for coredump(9) generation to fail. Make sure that
605 * we handle this case correctly for preselection.
606 */
607 if (errcode != 0)
608 sorf = AU_PRS_FAILURE;
609 else
610 sorf = AU_PRS_SUCCESS;
611 class = au_event_class(AUE_CORE);
612 if (au_preselect(AUE_CORE, class, aumask, sorf) == 0)
613 return;
614 /*
615 * If we are interested in seeing this audit record, allocate it.
616 * Where possible coredump records should contain a pathname and arg32
617 * (signal) tokens.
618 */
619 ar = audit_new(AUE_CORE, td);
620 if (path != NULL) {
621 pathp = &ar->k_ar.ar_arg_upath1;
622 *pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
623 audit_canon_path(td, path, *pathp);
624 ARG_SET_VALID(ar, ARG_UPATH1);
625 }
626 ar->k_ar.ar_arg_signum = td->td_proc->p_sig;
627 ARG_SET_VALID(ar, ARG_SIGNUM);
628 if (errcode != 0)
629 ret = 1;
630 audit_commit(ar, errcode, ret);
631}
| 33
34#include <sys/param.h>
35#include <sys/condvar.h>
36#include <sys/conf.h>
37#include <sys/file.h>
38#include <sys/filedesc.h>
39#include <sys/fcntl.h>
40#include <sys/ipc.h>
41#include <sys/kernel.h>
42#include <sys/kthread.h>
43#include <sys/malloc.h>
44#include <sys/mount.h>
45#include <sys/namei.h>
46#include <sys/priv.h>
47#include <sys/proc.h>
48#include <sys/queue.h>
49#include <sys/socket.h>
50#include <sys/socketvar.h>
51#include <sys/protosw.h>
52#include <sys/domain.h>
53#include <sys/sysctl.h>
54#include <sys/sysproto.h>
55#include <sys/sysent.h>
56#include <sys/systm.h>
57#include <sys/ucred.h>
58#include <sys/uio.h>
59#include <sys/un.h>
60#include <sys/unistd.h>
61#include <sys/vnode.h>
62
63#include <bsm/audit.h>
64#include <bsm/audit_internal.h>
65#include <bsm/audit_kevents.h>
66
67#include <netinet/in.h>
68#include <netinet/in_pcb.h>
69
70#include <security/audit/audit.h>
71#include <security/audit/audit_private.h>
72
73#include <vm/uma.h>
74
75static uma_zone_t audit_record_zone;
76static MALLOC_DEFINE(M_AUDITCRED, "audit_cred", "Audit cred storage");
77MALLOC_DEFINE(M_AUDITDATA, "audit_data", "Audit data storage");
78MALLOC_DEFINE(M_AUDITPATH, "audit_path", "Audit path storage");
79MALLOC_DEFINE(M_AUDITTEXT, "audit_text", "Audit text storage");
80
81SYSCTL_NODE(_security, OID_AUTO, audit, CTLFLAG_RW, 0,
82 "TrustedBSD audit controls");
83
84/*
85 * Audit control settings that are set/read by system calls and are hence
86 * non-static.
87 *
88 * Define the audit control flags.
89 */
90int audit_enabled;
91int audit_suspended;
92
93/*
94 * Flags controlling behavior in low storage situations. Should we panic if
95 * a write fails? Should we fail stop if we're out of disk space?
96 */
97int audit_panic_on_write_fail;
98int audit_fail_stop;
99int audit_argv;
100int audit_arge;
101
102/*
103 * Are we currently "failing stop" due to out of disk space?
104 */
105int audit_in_failure;
106
107/*
108 * Global audit statistics.
109 */
110struct audit_fstat audit_fstat;
111
112/*
113 * Preselection mask for non-attributable events.
114 */
115struct au_mask audit_nae_mask;
116
117/*
118 * Mutex to protect global variables shared between various threads and
119 * processes.
120 */
121struct mtx audit_mtx;
122
123/*
124 * Queue of audit records ready for delivery to disk. We insert new records
125 * at the tail, and remove records from the head. Also, a count of the
126 * number of records used for checking queue depth. In addition, a counter
127 * of records that we have allocated but are not yet in the queue, which is
128 * needed to estimate the total size of the combined set of records
129 * outstanding in the system.
130 */
131struct kaudit_queue audit_q;
132int audit_q_len;
133int audit_pre_q_len;
134
135/*
136 * Audit queue control settings (minimum free, low/high water marks, etc.)
137 */
138struct au_qctrl audit_qctrl;
139
140/*
141 * Condition variable to signal to the worker that it has work to do: either
142 * new records are in the queue, or a log replacement is taking place.
143 */
144struct cv audit_worker_cv;
145
146/*
147 * Condition variable to flag when crossing the low watermark, meaning that
148 * threads blocked due to hitting the high watermark can wake up and continue
149 * to commit records.
150 */
151struct cv audit_watermark_cv;
152
153/*
154 * Condition variable for auditing threads wait on when in fail-stop mode.
155 * Threads wait on this CV forever (and ever), never seeing the light of day
156 * again.
157 */
158static struct cv audit_fail_cv;
159
160/*
161 * Construct an audit record for the passed thread.
162 */
163static int
164audit_record_ctor(void *mem, int size, void *arg, int flags)
165{
166 struct kaudit_record *ar;
167 struct thread *td;
168
169 KASSERT(sizeof(*ar) == size, ("audit_record_ctor: wrong size"));
170
171 td = arg;
172 ar = mem;
173 bzero(ar, sizeof(*ar));
174 ar->k_ar.ar_magic = AUDIT_RECORD_MAGIC;
175 nanotime(&ar->k_ar.ar_starttime);
176
177 /*
178 * Export the subject credential.
179 */
180 cru2x(td->td_ucred, &ar->k_ar.ar_subj_cred);
181 ar->k_ar.ar_subj_ruid = td->td_ucred->cr_ruid;
182 ar->k_ar.ar_subj_rgid = td->td_ucred->cr_rgid;
183 ar->k_ar.ar_subj_egid = td->td_ucred->cr_groups[0];
184 ar->k_ar.ar_subj_auid = td->td_ucred->cr_audit.ai_auid;
185 ar->k_ar.ar_subj_asid = td->td_ucred->cr_audit.ai_asid;
186 ar->k_ar.ar_subj_pid = td->td_proc->p_pid;
187 ar->k_ar.ar_subj_amask = td->td_ucred->cr_audit.ai_mask;
188 ar->k_ar.ar_subj_term_addr = td->td_ucred->cr_audit.ai_termid;
189 return (0);
190}
191
192static void
193audit_record_dtor(void *mem, int size, void *arg)
194{
195 struct kaudit_record *ar;
196
197 KASSERT(sizeof(*ar) == size, ("audit_record_dtor: wrong size"));
198
199 ar = mem;
200 if (ar->k_ar.ar_arg_upath1 != NULL)
201 free(ar->k_ar.ar_arg_upath1, M_AUDITPATH);
202 if (ar->k_ar.ar_arg_upath2 != NULL)
203 free(ar->k_ar.ar_arg_upath2, M_AUDITPATH);
204 if (ar->k_ar.ar_arg_text != NULL)
205 free(ar->k_ar.ar_arg_text, M_AUDITTEXT);
206 if (ar->k_udata != NULL)
207 free(ar->k_udata, M_AUDITDATA);
208 if (ar->k_ar.ar_arg_argv != NULL)
209 free(ar->k_ar.ar_arg_argv, M_AUDITTEXT);
210 if (ar->k_ar.ar_arg_envv != NULL)
211 free(ar->k_ar.ar_arg_envv, M_AUDITTEXT);
212}
213
214/*
215 * Initialize the Audit subsystem: configuration state, work queue,
216 * synchronization primitives, worker thread, and trigger device node. Also
217 * call into the BSM assembly code to initialize it.
218 */
219static void
220audit_init(void)
221{
222
223 audit_enabled = 0;
224 audit_suspended = 0;
225 audit_panic_on_write_fail = 0;
226 audit_fail_stop = 0;
227 audit_in_failure = 0;
228 audit_argv = 0;
229 audit_arge = 0;
230
231 audit_fstat.af_filesz = 0; /* '0' means unset, unbounded. */
232 audit_fstat.af_currsz = 0;
233 audit_nae_mask.am_success = 0;
234 audit_nae_mask.am_failure = 0;
235
236 TAILQ_INIT(&audit_q);
237 audit_q_len = 0;
238 audit_pre_q_len = 0;
239 audit_qctrl.aq_hiwater = AQ_HIWATER;
240 audit_qctrl.aq_lowater = AQ_LOWATER;
241 audit_qctrl.aq_bufsz = AQ_BUFSZ;
242 audit_qctrl.aq_minfree = AU_FS_MINFREE;
243
244 mtx_init(&audit_mtx, "audit_mtx", NULL, MTX_DEF);
245 cv_init(&audit_worker_cv, "audit_worker_cv");
246 cv_init(&audit_watermark_cv, "audit_watermark_cv");
247 cv_init(&audit_fail_cv, "audit_fail_cv");
248
249 audit_record_zone = uma_zcreate("audit_record",
250 sizeof(struct kaudit_record), audit_record_ctor,
251 audit_record_dtor, NULL, NULL, UMA_ALIGN_PTR, 0);
252
253 /* Initialize the BSM audit subsystem. */
254 kau_init();
255
256 audit_trigger_init();
257
258 /* Register shutdown handler. */
259 EVENTHANDLER_REGISTER(shutdown_pre_sync, audit_shutdown, NULL,
260 SHUTDOWN_PRI_FIRST);
261
262 /* Start audit worker thread. */
263 audit_worker_init();
264}
265
266SYSINIT(audit_init, SI_SUB_AUDIT, SI_ORDER_FIRST, audit_init, NULL);
267
268/*
269 * Drain the audit queue and close the log at shutdown. Note that this can
270 * be called both from the system shutdown path and also from audit
271 * configuration syscalls, so 'arg' and 'howto' are ignored.
272 *
273 * XXXRW: In FreeBSD 7.x and 8.x, this fails to wait for the record queue to
274 * drain before returning, which could lead to lost records on shutdown.
275 */
276void
277audit_shutdown(void *arg, int howto)
278{
279
280 audit_rotate_vnode(NULL, NULL);
281}
282
283/*
284 * Return the current thread's audit record, if any.
285 */
286struct kaudit_record *
287currecord(void)
288{
289
290 return (curthread->td_ar);
291}
292
293/*
294 * XXXAUDIT: There are a number of races present in the code below due to
295 * release and re-grab of the mutex. The code should be revised to become
296 * slightly less racy.
297 *
298 * XXXAUDIT: Shouldn't there be logic here to sleep waiting on available
299 * pre_q space, suspending the system call until there is room?
300 */
301struct kaudit_record *
302audit_new(int event, struct thread *td)
303{
304 struct kaudit_record *ar;
305 int no_record;
306
307 mtx_lock(&audit_mtx);
308 no_record = (audit_suspended || !audit_enabled);
309 mtx_unlock(&audit_mtx);
310 if (no_record)
311 return (NULL);
312
313 /*
314 * Note: the number of outstanding uncommitted audit records is
315 * limited to the number of concurrent threads servicing system calls
316 * in the kernel.
317 */
318 ar = uma_zalloc_arg(audit_record_zone, td, M_WAITOK);
319 ar->k_ar.ar_event = event;
320
321 mtx_lock(&audit_mtx);
322 audit_pre_q_len++;
323 mtx_unlock(&audit_mtx);
324
325 return (ar);
326}
327
328void
329audit_free(struct kaudit_record *ar)
330{
331
332 uma_zfree(audit_record_zone, ar);
333}
334
335void
336audit_commit(struct kaudit_record *ar, int error, int retval)
337{
338 au_event_t event;
339 au_class_t class;
340 au_id_t auid;
341 int sorf;
342 struct au_mask *aumask;
343
344 if (ar == NULL)
345 return;
346
347 /*
348 * Decide whether to commit the audit record by checking the error
349 * value from the system call and using the appropriate audit mask.
350 */
351 if (ar->k_ar.ar_subj_auid == AU_DEFAUDITID)
352 aumask = &audit_nae_mask;
353 else
354 aumask = &ar->k_ar.ar_subj_amask;
355
356 if (error)
357 sorf = AU_PRS_FAILURE;
358 else
359 sorf = AU_PRS_SUCCESS;
360
361 switch(ar->k_ar.ar_event) {
362 case AUE_OPEN_RWTC:
363 /*
364 * The open syscall always writes a AUE_OPEN_RWTC event;
365 * change it to the proper type of event based on the flags
366 * and the error value.
367 */
368 ar->k_ar.ar_event = audit_flags_and_error_to_openevent(
369 ar->k_ar.ar_arg_fflags, error);
370 break;
371
372 case AUE_SYSCTL:
373 ar->k_ar.ar_event = audit_ctlname_to_sysctlevent(
374 ar->k_ar.ar_arg_ctlname, ar->k_ar.ar_valid_arg);
375 break;
376
377 case AUE_AUDITON:
378 /* Convert the auditon() command to an event. */
379 ar->k_ar.ar_event = auditon_command_event(ar->k_ar.ar_arg_cmd);
380 break;
381 }
382
383 auid = ar->k_ar.ar_subj_auid;
384 event = ar->k_ar.ar_event;
385 class = au_event_class(event);
386
387 ar->k_ar_commit |= AR_COMMIT_KERNEL;
388 if (au_preselect(event, class, aumask, sorf) != 0)
389 ar->k_ar_commit |= AR_PRESELECT_TRAIL;
390 if (audit_pipe_preselect(auid, event, class, sorf,
391 ar->k_ar_commit & AR_PRESELECT_TRAIL) != 0)
392 ar->k_ar_commit |= AR_PRESELECT_PIPE;
393 if ((ar->k_ar_commit & (AR_PRESELECT_TRAIL | AR_PRESELECT_PIPE |
394 AR_PRESELECT_USER_TRAIL | AR_PRESELECT_USER_PIPE)) == 0) {
395 mtx_lock(&audit_mtx);
396 audit_pre_q_len--;
397 mtx_unlock(&audit_mtx);
398 audit_free(ar);
399 return;
400 }
401
402 ar->k_ar.ar_errno = error;
403 ar->k_ar.ar_retval = retval;
404 nanotime(&ar->k_ar.ar_endtime);
405
406 /*
407 * Note: it could be that some records initiated while audit was
408 * enabled should still be committed?
409 */
410 mtx_lock(&audit_mtx);
411 if (audit_suspended || !audit_enabled) {
412 audit_pre_q_len--;
413 mtx_unlock(&audit_mtx);
414 audit_free(ar);
415 return;
416 }
417
418 /*
419 * Constrain the number of committed audit records based on the
420 * configurable parameter.
421 */
422 while (audit_q_len >= audit_qctrl.aq_hiwater)
423 cv_wait(&audit_watermark_cv, &audit_mtx);
424
425 TAILQ_INSERT_TAIL(&audit_q, ar, k_q);
426 audit_q_len++;
427 audit_pre_q_len--;
428 cv_signal(&audit_worker_cv);
429 mtx_unlock(&audit_mtx);
430}
431
432/*
433 * audit_syscall_enter() is called on entry to each system call. It is
434 * responsible for deciding whether or not to audit the call (preselection),
435 * and if so, allocating a per-thread audit record. audit_new() will fill in
436 * basic thread/credential properties.
437 */
438void
439audit_syscall_enter(unsigned short code, struct thread *td)
440{
441 struct au_mask *aumask;
442 au_class_t class;
443 au_event_t event;
444 au_id_t auid;
445
446 KASSERT(td->td_ar == NULL, ("audit_syscall_enter: td->td_ar != NULL"));
447
448 /*
449 * In FreeBSD, each ABI has its own system call table, and hence
450 * mapping of system call codes to audit events. Convert the code to
451 * an audit event identifier using the process system call table
452 * reference. In Darwin, there's only one, so we use the global
453 * symbol for the system call table. No audit record is generated
454 * for bad system calls, as no operation has been performed.
455 */
456 if (code >= td->td_proc->p_sysent->sv_size)
457 return;
458
459 event = td->td_proc->p_sysent->sv_table[code].sy_auevent;
460 if (event == AUE_NULL)
461 return;
462
463 /*
464 * Check which audit mask to use; either the kernel non-attributable
465 * event mask or the process audit mask.
466 */
467 auid = td->td_ucred->cr_audit.ai_auid;
468 if (auid == AU_DEFAUDITID)
469 aumask = &audit_nae_mask;
470 else
471 aumask = &td->td_ucred->cr_audit.ai_mask;
472
473 /*
474 * Allocate an audit record, if preselection allows it, and store in
475 * the thread for later use.
476 */
477 class = au_event_class(event);
478 if (au_preselect(event, class, aumask, AU_PRS_BOTH)) {
479 /*
480 * If we're out of space and need to suspend unprivileged
481 * processes, do that here rather than trying to allocate
482 * another audit record.
483 *
484 * Note: we might wish to be able to continue here in the
485 * future, if the system recovers. That should be possible
486 * by means of checking the condition in a loop around
487 * cv_wait(). It might be desirable to reevaluate whether an
488 * audit record is still required for this event by
489 * re-calling au_preselect().
490 */
491 if (audit_in_failure &&
492 priv_check(td, PRIV_AUDIT_FAILSTOP) != 0) {
493 cv_wait(&audit_fail_cv, &audit_mtx);
494 panic("audit_failing_stop: thread continued");
495 }
496 td->td_ar = audit_new(event, td);
497 } else if (audit_pipe_preselect(auid, event, class, AU_PRS_BOTH, 0))
498 td->td_ar = audit_new(event, td);
499 else
500 td->td_ar = NULL;
501}
502
503/*
504 * audit_syscall_exit() is called from the return of every system call, or in
505 * the event of exit1(), during the execution of exit1(). It is responsible
506 * for committing the audit record, if any, along with return condition.
507 */
508void
509audit_syscall_exit(int error, struct thread *td)
510{
511 int retval;
512
513 /*
514 * Commit the audit record as desired; once we pass the record into
515 * audit_commit(), the memory is owned by the audit subsystem. The
516 * return value from the system call is stored on the user thread.
517 * If there was an error, the return value is set to -1, imitating
518 * the behavior of the cerror routine.
519 */
520 if (error)
521 retval = -1;
522 else
523 retval = td->td_retval[0];
524
525 audit_commit(td->td_ar, error, retval);
526 td->td_ar = NULL;
527}
528
529void
530audit_cred_copy(struct ucred *src, struct ucred *dest)
531{
532
533 bcopy(&src->cr_audit, &dest->cr_audit, sizeof(dest->cr_audit));
534}
535
536void
537audit_cred_destroy(struct ucred *cred)
538{
539
540}
541
542void
543audit_cred_init(struct ucred *cred)
544{
545
546 bzero(&cred->cr_audit, sizeof(cred->cr_audit));
547}
548
549/*
550 * Initialize audit information for the first kernel process (proc 0) and for
551 * the first user process (init).
552 */
553void
554audit_cred_kproc0(struct ucred *cred)
555{
556
557 cred->cr_audit.ai_auid = AU_DEFAUDITID;
558 cred->cr_audit.ai_termid.at_type = AU_IPv4;
559}
560
561void
562audit_cred_proc1(struct ucred *cred)
563{
564
565 cred->cr_audit.ai_auid = AU_DEFAUDITID;
566 cred->cr_audit.ai_termid.at_type = AU_IPv4;
567}
568
569void
570audit_thread_alloc(struct thread *td)
571{
572
573 td->td_ar = NULL;
574}
575
576void
577audit_thread_free(struct thread *td)
578{
579
580 KASSERT(td->td_ar == NULL, ("audit_thread_free: td_ar != NULL"));
581}
582
583void
584audit_proc_coredump(struct thread *td, char *path, int errcode)
585{
586 struct kaudit_record *ar;
587 struct au_mask *aumask;
588 au_class_t class;
589 int ret, sorf;
590 char **pathp;
591 au_id_t auid;
592
593 ret = 0;
594
595 /*
596 * Make sure we are using the correct preselection mask.
597 */
598 auid = td->td_ucred->cr_audit.ai_auid;
599 if (auid == AU_DEFAUDITID)
600 aumask = &audit_nae_mask;
601 else
602 aumask = &td->td_ucred->cr_audit.ai_mask;
603 /*
604 * It's possible for coredump(9) generation to fail. Make sure that
605 * we handle this case correctly for preselection.
606 */
607 if (errcode != 0)
608 sorf = AU_PRS_FAILURE;
609 else
610 sorf = AU_PRS_SUCCESS;
611 class = au_event_class(AUE_CORE);
612 if (au_preselect(AUE_CORE, class, aumask, sorf) == 0)
613 return;
614 /*
615 * If we are interested in seeing this audit record, allocate it.
616 * Where possible coredump records should contain a pathname and arg32
617 * (signal) tokens.
618 */
619 ar = audit_new(AUE_CORE, td);
620 if (path != NULL) {
621 pathp = &ar->k_ar.ar_arg_upath1;
622 *pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
623 audit_canon_path(td, path, *pathp);
624 ARG_SET_VALID(ar, ARG_UPATH1);
625 }
626 ar->k_ar.ar_arg_signum = td->td_proc->p_sig;
627 ARG_SET_VALID(ar, ARG_SIGNUM);
628 if (errcode != 0)
629 ret = 1;
630 audit_commit(ar, errcode, ret);
631}
|