1/*- |
2 * Copyright (c) 2004-2009 Apple Inc. |
3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. --- 10 unchanged lines hidden (view full) --- 21 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY 22 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 23 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 24 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 25 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 * |
29 * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#43 $ |
30 */ 31 32#include <sys/types.h> 33 34#include <config/config.h> 35 36#include <sys/dirent.h> 37#ifdef HAVE_FULL_QUEUE_H --- 24 unchanged lines hidden (view full) --- 62 63#include "auditd.h" 64 65#ifndef HAVE_STRLCPY 66#include <compat/strlcpy.h> 67#endif 68 69/* |
70 * XXX The following are temporary until these can be added to the kernel |
71 * audit.h header. 72 */ 73#ifndef AUDIT_TRIGGER_INITIALIZE 74#define AUDIT_TRIGGER_INITIALIZE 7 75#endif |
76#ifndef AUDIT_TRIGGER_EXPIRE_TRAILS 77#define AUDIT_TRIGGER_EXPIRE_TRAILS 8 78#endif |
79 |
80 |
81/* 82 * LaunchD flag (Mac OS X and, maybe, FreeBSD only.) See launchd(8) and 83 * http://wiki.freebsd.org/launchd for more information. 84 * 85 * In order for auditd to work "on demand" with launchd(8) it can't: 86 * call daemon(3) 87 * call fork and having the parent process exit 88 * change uids or gids. --- 76 unchanged lines hidden (view full) --- 165 len = strlen(lastfile) + 1; 166 oldname = (char *)malloc(len); 167 if (oldname == NULL) 168 return (-1); 169 strlcpy(oldname, lastfile, len); 170 171 /* Rename the last file -- append timestamp. */ 172 if ((ptr = strstr(lastfile, NOT_TERMINATED)) != NULL) { |
173 memcpy(ptr, TS, POSTFIX_LEN); |
174 if (rename(oldname, lastfile) != 0) 175 auditd_log_err( 176 "Could not rename %s to %s: %m", oldname, 177 lastfile); 178 else { 179 /* 180 * Remove the 'current' symlink since the link 181 * is now invalid. --- 92 unchanged lines hidden (view full) --- 274 /* 275 * XXX Faulty directory listing? - user should be given 276 * XXX an opportunity to change the audit_control file 277 * XXX switch to a reduced mode of auditing? 278 */ 279 return (-1); 280 } 281 |
282 /* 283 * Finally, see if there are any trail files to expire. 284 */ 285 err = auditd_expire_trails(audit_warn_expired); 286 if (err) 287 auditd_log_err("auditd_expire_trails(): %s", 288 auditd_strerror(err)); 289 |
290 return (0); 291} 292 293/* 294 * Start up auditing. 295 */ 296static void 297audit_setup(void) --- 259 unchanged lines hidden (view full) --- 557 break; 558 559 case AUDIT_TRIGGER_INITIALIZE: 560 auditd_log_info("Got audit initialize trigger"); 561 if (au_state == AUD_STATE_DISABLED) 562 audit_setup(); 563 break; 564 |
565 case AUDIT_TRIGGER_EXPIRE_TRAILS: 566 auditd_log_info("Got audit expire trails trigger"); 567 err = auditd_expire_trails(audit_warn_expired); 568 if (err) 569 auditd_log_err("auditd_expire_trails(): %s", 570 auditd_strerror(err)); 571 break; 572 |
573 default: 574 auditd_log_err("Got unknown trigger %d", trigger); 575 break; 576 } 577} 578 579/* 580 * Reap our children. --- 103 unchanged lines hidden (view full) --- 684 auditd_log_debug( 685 "Set audit trail min free percent in kernel."); 686 687 /* 688 * Configure host address in the audit kernel information. 689 */ 690 err = auditd_set_host(); 691 if (err) { |
692 if (err == ADE_PARSE) { 693 auditd_log_notice( 694 "audit_control(5) may be missing 'host:' field"); 695 } else { 696 auditd_log_err("auditd_set_host() %s: %m", 697 auditd_strerror(err)); 698 ret = -1; 699 } |
700 } else 701 auditd_log_debug( 702 "Set audit host address information in kernel."); |
703 |
704 return (ret); 705} 706 707/* 708 * Setup and initialize auditd. 709 */ 710static void 711setup(void) --- 111 unchanged lines hidden --- |