1/*
2 * Copyright (c) 1999-2005 Apple Computer, Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of
14 * its contributors may be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 *
| 1/*
2 * Copyright (c) 1999-2005 Apple Computer, Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of
14 * its contributors may be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 *
|
29 * $FreeBSD: head/sys/security/audit/audit_private.h 155408 2006-02-06 22:50:39Z rwatson $
| 29 * $FreeBSD: head/sys/security/audit/audit_private.h 156291 2006-03-04 17:00:55Z rwatson $
|
30 */
31
32/*
33 * This include file contains function prototypes and type definitions used
34 * within the audit implementation.
35 */
36
37#ifndef _BSM_AUDIT_PRIVATE_H
38#define _BSM_AUDIT_PRIVATE_H
39
40#ifndef _KERNEL
41#error "no user-serviceable parts inside"
42#endif
43
44#include <sys/ipc.h>
45#include <sys/socket.h>
46#include <sys/ucred.h>
47
48#ifdef MALLOC_DECLARE
49MALLOC_DECLARE(M_AUDITBSM);
50MALLOC_DECLARE(M_AUDITDATA);
51MALLOC_DECLARE(M_AUDITPATH);
52MALLOC_DECLARE(M_AUDITTEXT);
53#endif
54
55/*
56 * Audit control variables that are usually set/read via system calls
57 * and used to control various aspects of auditing.
58 */
59extern struct au_qctrl audit_qctrl;
60extern struct audit_fstat audit_fstat;
61extern struct au_mask audit_nae_mask;
62extern int audit_panic_on_write_fail;
63extern int audit_fail_stop;
64
65/*
66 * Success/failure conditions for the conversion of a kernel audit record to
67 * BSM format.
68 */
69#define BSM_SUCCESS 0
70#define BSM_FAILURE 1
71#define BSM_NOAUDIT 2
72
73/*
74 * Defines for the kernel audit record k_ar_commit field.
75 */
76#define AR_COMMIT_KERNEL 0x00000001U
77#define AR_COMMIT_USER 0x00000010U
78
79/*
80 * Audit data is generated as a stream of struct audit_record structures,
81 * linked by struct kaudit_record, and contain storage for possible audit so
82 * that it will not need to be allocated during the processing of a system
83 * call, both improving efficiency and avoiding sleeping at untimely moments.
84 * This structure is converted to BSM format before being written to disk.
85 */
86struct vnode_au_info {
87 mode_t vn_mode;
88 uid_t vn_uid;
89 gid_t vn_gid;
90 dev_t vn_dev;
91 long vn_fsid;
92 long vn_fileid;
93 long vn_gen;
94};
95
96struct groupset {
97 gid_t gidset[NGROUPS];
98 u_int gidset_size;
99};
100
101struct socket_au_info {
102 int so_domain;
103 int so_type;
104 int so_protocol;
105 in_addr_t so_raddr; /* remote address if INET socket */
106 in_addr_t so_laddr; /* local address if INET socket */
107 u_short so_rport; /* remote port */
108 u_short so_lport; /* local port */
109};
110
111union auditon_udata {
112 char *au_path;
113 long au_cond;
114 long au_flags;
115 long au_policy;
116 int au_trigger;
117 au_evclass_map_t au_evclass;
118 au_mask_t au_mask;
119 auditinfo_t au_auinfo;
120 auditpinfo_t au_aupinfo;
121 auditpinfo_addr_t au_aupinfo_addr;
122 au_qctrl_t au_qctrl;
123 au_stat_t au_stat;
124 au_fstat_t au_fstat;
125};
126
127struct posix_ipc_perm {
128 uid_t pipc_uid;
129 gid_t pipc_gid;
130 mode_t pipc_mode;
131};
132
133struct audit_record {
134 /* Audit record header. */
135 u_int32_t ar_magic;
136 int ar_event;
137 int ar_retval; /* value returned to the process */
138 int ar_errno; /* return status of system call */
139 struct timespec ar_starttime;
140 struct timespec ar_endtime;
141 u_int64_t ar_valid_arg; /* Bitmask of valid arguments */
142
143 /* Audit subject information. */
144 struct xucred ar_subj_cred;
145 uid_t ar_subj_ruid;
146 gid_t ar_subj_rgid;
147 gid_t ar_subj_egid;
148 uid_t ar_subj_auid; /* Audit user ID */
149 pid_t ar_subj_asid; /* Audit session ID */
150 pid_t ar_subj_pid;
151 struct au_tid ar_subj_term;
152 char ar_subj_comm[MAXCOMLEN + 1];
153 struct au_mask ar_subj_amask;
154
155 /* Operation arguments. */
156 uid_t ar_arg_euid;
157 uid_t ar_arg_ruid;
158 uid_t ar_arg_suid;
159 gid_t ar_arg_egid;
160 gid_t ar_arg_rgid;
161 gid_t ar_arg_sgid;
162 pid_t ar_arg_pid;
163 pid_t ar_arg_asid;
164 struct au_tid ar_arg_termid;
165 uid_t ar_arg_uid;
166 uid_t ar_arg_auid;
167 gid_t ar_arg_gid;
168 struct groupset ar_arg_groups;
169 int ar_arg_fd;
170 int ar_arg_fflags;
171 mode_t ar_arg_mode;
172 int ar_arg_dev;
173 long ar_arg_value;
174 void * ar_arg_addr;
175 int ar_arg_len;
176 int ar_arg_mask;
177 u_int ar_arg_signum;
178 char ar_arg_login[MAXLOGNAME];
179 int ar_arg_ctlname[CTL_MAXNAME];
180 struct sockaddr ar_arg_sockaddr;
181 struct socket_au_info ar_arg_sockinfo;
182 char *ar_arg_upath1;
183 char *ar_arg_upath2;
184 char *ar_arg_text;
185 struct au_mask ar_arg_amask;
186 struct vnode_au_info ar_arg_vnode1;
187 struct vnode_au_info ar_arg_vnode2;
188 int ar_arg_cmd;
189 int ar_arg_svipc_cmd;
190 struct ipc_perm ar_arg_svipc_perm;
191 int ar_arg_svipc_id;
192 void * ar_arg_svipc_addr;
193 struct posix_ipc_perm ar_arg_pipc_perm;
194 union auditon_udata ar_arg_auditon;
195 int ar_arg_exitstatus;
196 int ar_arg_exitretval;
197};
198
199/*
200 * Arguments in the audit record are initially not defined; flags are set to
201 * indicate if they are present so they can be included in the audit log
202 * stream only if defined.
203 */
204#define ARG_IS_VALID(kar, arg) ((kar)->k_ar.ar_valid_arg & (arg))
205#define ARG_SET_VALID(kar, arg) do { \
206 (kar)->k_ar.ar_valid_arg |= (arg); \
207} while (0)
208
209/*
210 * In-kernel version of audit record; the basic record plus queue meta-data.
211 * This record can also have a pointer set to some opaque data that will
212 * be passed through to the audit writing mechanism.
213 */
214struct kaudit_record {
215 struct audit_record k_ar;
216 u_int32_t k_ar_commit;
217 void *k_udata; /* user data */
218 u_int k_ulen; /* user data length */
219 struct uthread *k_uthread; /* thread we are auditing */
220 TAILQ_ENTRY(kaudit_record) k_q;
221};
222
223/*
224 * Functions to manage the allocation, release, and commit of kernel audit
225 * records.
226 */
227void audit_abort(struct kaudit_record *ar);
228void audit_commit(struct kaudit_record *ar, int error,
229 int retval);
230struct kaudit_record *audit_new(int event, struct thread *td);
231
232/*
233 * Functions relating to the conversion of internal kernel audit records to
234 * the BSM file format.
235 */
| 30 */
31
32/*
33 * This include file contains function prototypes and type definitions used
34 * within the audit implementation.
35 */
36
37#ifndef _BSM_AUDIT_PRIVATE_H
38#define _BSM_AUDIT_PRIVATE_H
39
40#ifndef _KERNEL
41#error "no user-serviceable parts inside"
42#endif
43
44#include <sys/ipc.h>
45#include <sys/socket.h>
46#include <sys/ucred.h>
47
48#ifdef MALLOC_DECLARE
49MALLOC_DECLARE(M_AUDITBSM);
50MALLOC_DECLARE(M_AUDITDATA);
51MALLOC_DECLARE(M_AUDITPATH);
52MALLOC_DECLARE(M_AUDITTEXT);
53#endif
54
55/*
56 * Audit control variables that are usually set/read via system calls
57 * and used to control various aspects of auditing.
58 */
59extern struct au_qctrl audit_qctrl;
60extern struct audit_fstat audit_fstat;
61extern struct au_mask audit_nae_mask;
62extern int audit_panic_on_write_fail;
63extern int audit_fail_stop;
64
65/*
66 * Success/failure conditions for the conversion of a kernel audit record to
67 * BSM format.
68 */
69#define BSM_SUCCESS 0
70#define BSM_FAILURE 1
71#define BSM_NOAUDIT 2
72
73/*
74 * Defines for the kernel audit record k_ar_commit field.
75 */
76#define AR_COMMIT_KERNEL 0x00000001U
77#define AR_COMMIT_USER 0x00000010U
78
79/*
80 * Audit data is generated as a stream of struct audit_record structures,
81 * linked by struct kaudit_record, and contain storage for possible audit so
82 * that it will not need to be allocated during the processing of a system
83 * call, both improving efficiency and avoiding sleeping at untimely moments.
84 * This structure is converted to BSM format before being written to disk.
85 */
86struct vnode_au_info {
87 mode_t vn_mode;
88 uid_t vn_uid;
89 gid_t vn_gid;
90 dev_t vn_dev;
91 long vn_fsid;
92 long vn_fileid;
93 long vn_gen;
94};
95
96struct groupset {
97 gid_t gidset[NGROUPS];
98 u_int gidset_size;
99};
100
101struct socket_au_info {
102 int so_domain;
103 int so_type;
104 int so_protocol;
105 in_addr_t so_raddr; /* remote address if INET socket */
106 in_addr_t so_laddr; /* local address if INET socket */
107 u_short so_rport; /* remote port */
108 u_short so_lport; /* local port */
109};
110
111union auditon_udata {
112 char *au_path;
113 long au_cond;
114 long au_flags;
115 long au_policy;
116 int au_trigger;
117 au_evclass_map_t au_evclass;
118 au_mask_t au_mask;
119 auditinfo_t au_auinfo;
120 auditpinfo_t au_aupinfo;
121 auditpinfo_addr_t au_aupinfo_addr;
122 au_qctrl_t au_qctrl;
123 au_stat_t au_stat;
124 au_fstat_t au_fstat;
125};
126
127struct posix_ipc_perm {
128 uid_t pipc_uid;
129 gid_t pipc_gid;
130 mode_t pipc_mode;
131};
132
133struct audit_record {
134 /* Audit record header. */
135 u_int32_t ar_magic;
136 int ar_event;
137 int ar_retval; /* value returned to the process */
138 int ar_errno; /* return status of system call */
139 struct timespec ar_starttime;
140 struct timespec ar_endtime;
141 u_int64_t ar_valid_arg; /* Bitmask of valid arguments */
142
143 /* Audit subject information. */
144 struct xucred ar_subj_cred;
145 uid_t ar_subj_ruid;
146 gid_t ar_subj_rgid;
147 gid_t ar_subj_egid;
148 uid_t ar_subj_auid; /* Audit user ID */
149 pid_t ar_subj_asid; /* Audit session ID */
150 pid_t ar_subj_pid;
151 struct au_tid ar_subj_term;
152 char ar_subj_comm[MAXCOMLEN + 1];
153 struct au_mask ar_subj_amask;
154
155 /* Operation arguments. */
156 uid_t ar_arg_euid;
157 uid_t ar_arg_ruid;
158 uid_t ar_arg_suid;
159 gid_t ar_arg_egid;
160 gid_t ar_arg_rgid;
161 gid_t ar_arg_sgid;
162 pid_t ar_arg_pid;
163 pid_t ar_arg_asid;
164 struct au_tid ar_arg_termid;
165 uid_t ar_arg_uid;
166 uid_t ar_arg_auid;
167 gid_t ar_arg_gid;
168 struct groupset ar_arg_groups;
169 int ar_arg_fd;
170 int ar_arg_fflags;
171 mode_t ar_arg_mode;
172 int ar_arg_dev;
173 long ar_arg_value;
174 void * ar_arg_addr;
175 int ar_arg_len;
176 int ar_arg_mask;
177 u_int ar_arg_signum;
178 char ar_arg_login[MAXLOGNAME];
179 int ar_arg_ctlname[CTL_MAXNAME];
180 struct sockaddr ar_arg_sockaddr;
181 struct socket_au_info ar_arg_sockinfo;
182 char *ar_arg_upath1;
183 char *ar_arg_upath2;
184 char *ar_arg_text;
185 struct au_mask ar_arg_amask;
186 struct vnode_au_info ar_arg_vnode1;
187 struct vnode_au_info ar_arg_vnode2;
188 int ar_arg_cmd;
189 int ar_arg_svipc_cmd;
190 struct ipc_perm ar_arg_svipc_perm;
191 int ar_arg_svipc_id;
192 void * ar_arg_svipc_addr;
193 struct posix_ipc_perm ar_arg_pipc_perm;
194 union auditon_udata ar_arg_auditon;
195 int ar_arg_exitstatus;
196 int ar_arg_exitretval;
197};
198
199/*
200 * Arguments in the audit record are initially not defined; flags are set to
201 * indicate if they are present so they can be included in the audit log
202 * stream only if defined.
203 */
204#define ARG_IS_VALID(kar, arg) ((kar)->k_ar.ar_valid_arg & (arg))
205#define ARG_SET_VALID(kar, arg) do { \
206 (kar)->k_ar.ar_valid_arg |= (arg); \
207} while (0)
208
209/*
210 * In-kernel version of audit record; the basic record plus queue meta-data.
211 * This record can also have a pointer set to some opaque data that will
212 * be passed through to the audit writing mechanism.
213 */
214struct kaudit_record {
215 struct audit_record k_ar;
216 u_int32_t k_ar_commit;
217 void *k_udata; /* user data */
218 u_int k_ulen; /* user data length */
219 struct uthread *k_uthread; /* thread we are auditing */
220 TAILQ_ENTRY(kaudit_record) k_q;
221};
222
223/*
224 * Functions to manage the allocation, release, and commit of kernel audit
225 * records.
226 */
227void audit_abort(struct kaudit_record *ar);
228void audit_commit(struct kaudit_record *ar, int error,
229 int retval);
230struct kaudit_record *audit_new(int event, struct thread *td);
231
232/*
233 * Functions relating to the conversion of internal kernel audit records to
234 * the BSM file format.
235 */
|
| 236struct au_record;
|
236int kaudit_to_bsm(struct kaudit_record *kar,
237 struct au_record **pau);
238int bsm_rec_verify(void *rec);
239
240/*
241 * Kernel versions of the libbsm audit record functions.
242 */
243void kau_free(struct au_record *rec);
244void kau_init(void);
245
246/*
247 * Return values for pre-selection and post-selection decisions.
248 */
249#define AU_PRS_SUCCESS 1
250#define AU_PRS_FAILURE 2
251#define AU_PRS_BOTH (AU_PRS_SUCCESS|AU_PRS_FAILURE)
252
253/*
254 * Flags to use on audit files when opening and closing.
255 */
256#define AUDIT_OPEN_FLAGS (FWRITE | O_APPEND)
257#define AUDIT_CLOSE_FLAGS (FWRITE | O_APPEND)
258
259#include <sys/fcntl.h>
260#include <sys/kernel.h>
261#include <sys/malloc.h>
| 237int kaudit_to_bsm(struct kaudit_record *kar,
238 struct au_record **pau);
239int bsm_rec_verify(void *rec);
240
241/*
242 * Kernel versions of the libbsm audit record functions.
243 */
244void kau_free(struct au_record *rec);
245void kau_init(void);
246
247/*
248 * Return values for pre-selection and post-selection decisions.
249 */
250#define AU_PRS_SUCCESS 1
251#define AU_PRS_FAILURE 2
252#define AU_PRS_BOTH (AU_PRS_SUCCESS|AU_PRS_FAILURE)
253
254/*
255 * Flags to use on audit files when opening and closing.
256 */
257#define AUDIT_OPEN_FLAGS (FWRITE | O_APPEND)
258#define AUDIT_CLOSE_FLAGS (FWRITE | O_APPEND)
259
260#include <sys/fcntl.h>
261#include <sys/kernel.h>
262#include <sys/malloc.h>
|
262#include <security/audit/audit.h>
| |
263
264/*
265 * Some of the BSM tokenizer functions take different parameters in the
266 * kernel implementations in order to save the copying of large kernel
267 * data structures. The prototypes of these functions are declared here.
268 */
269token_t *kau_to_socket(struct socket_au_info *soi);
270
271/*
272 * audit_klib prototypes
273 */
274int au_preselect(au_event_t event, au_mask_t *mask_p, int sorf);
275au_event_t flags_and_error_to_openevent(int oflags, int error);
276void au_evclassmap_init(void);
277void au_evclassmap_insert(au_event_t event, au_class_t class);
278au_class_t au_event_class(au_event_t event);
279au_event_t ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
280int auditon_command_event(int cmd);
281int msgctl_to_event(int cmd);
282int semctl_to_event(int cmr);
283void canon_path(struct thread *td, char *path, char *cpath);
284
285/*
286 * Audit trigger events notify user space of kernel audit conditions
287 * asynchronously.
288 */
289void audit_trigger_init(void);
290void send_trigger(unsigned int trigger);
291
292/*
293 * General audit related functions.
294 */
295struct kaudit_record *currecord(void);
296void audit_shutdown(void *arg, int howto);
297void audit_rotate_vnode(struct ucred *cred,
298 struct vnode *vp);
299
300/*
301 * Audit pipe functions.
302 */
303void audit_pipe_submit(void *record, u_int record_len);
304
305#endif /* ! _BSM_AUDIT_PRIVATE_H */
| 263
264/*
265 * Some of the BSM tokenizer functions take different parameters in the
266 * kernel implementations in order to save the copying of large kernel
267 * data structures. The prototypes of these functions are declared here.
268 */
269token_t *kau_to_socket(struct socket_au_info *soi);
270
271/*
272 * audit_klib prototypes
273 */
274int au_preselect(au_event_t event, au_mask_t *mask_p, int sorf);
275au_event_t flags_and_error_to_openevent(int oflags, int error);
276void au_evclassmap_init(void);
277void au_evclassmap_insert(au_event_t event, au_class_t class);
278au_class_t au_event_class(au_event_t event);
279au_event_t ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
280int auditon_command_event(int cmd);
281int msgctl_to_event(int cmd);
282int semctl_to_event(int cmr);
283void canon_path(struct thread *td, char *path, char *cpath);
284
285/*
286 * Audit trigger events notify user space of kernel audit conditions
287 * asynchronously.
288 */
289void audit_trigger_init(void);
290void send_trigger(unsigned int trigger);
291
292/*
293 * General audit related functions.
294 */
295struct kaudit_record *currecord(void);
296void audit_shutdown(void *arg, int howto);
297void audit_rotate_vnode(struct ucred *cred,
298 struct vnode *vp);
299
300/*
301 * Audit pipe functions.
302 */
303void audit_pipe_submit(void *record, u_int record_len);
304
305#endif /* ! _BSM_AUDIT_PRIVATE_H */
|